Function at 0x1400aabf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x440
mov qword [rsp + 0x298], 0xfffffffffffffffe
mov qword [rsp + 0x490], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x438], rax
mov qword [rsp + 0xa8], rdx
mov rbx, rcx
mov qword [rsp + 0x268], rcx
lea rcx, [rsp + 0x78]
call fcn.14002e810
mov byte [rsp + 0x88], 0xff
xorpd xmm0, xmm0
movsd qword [rsp + 0x2a0], xmm0
xor edx, edx
mov r8d, 0xd0
lea rcx, [rsp + 0x2a8]
call fcn.14010c6c0
xor r12d, r12d
lea esi, [r12 + 9]
lea edi, [rsi + 0x17]
lea r13, [0x14019cf50]
lea ebp, [rsi + 0x21]
mov byte [rsp + 0x148], 0
mov rdx, rbx
lea rcx, [rsp + 0x110]
call fcn.140071240
nop
mov rbx, qword [rsp + 0x110]
mov qword [rsp + 0x90], rbx
mov edx, 0x3e8
lea rcx, [rsp + 0xe8]
call fcn.140063580
nop
mov r14d, r12d
mov dword [rsp + 0x9c], r12d
mov dword [rsp + 0x144], r12d
mov dword [rsp + 0x180], r12d
add rbx, 0xc
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x160], rbx
movzx eax, word [rbx]
test ax, ax
je 0x1400aad19
cmp si, ax
ja 0x1400aad00
cmp ax, 0xd
jbe 0x1400aad19
cmp di, ax
je 0x1400aad19
add rbx, 2
mov qword [rsp + 0x160], rbx
mov ax, word [rbx]
test ax, ax
jne 0x1400aacf5
mov qword [rsp + 0x220], rbx
lea rcx, [rsp + 0x220]
call fcn.14005b560
mov r8d, 6
mov rdx, qword [rsp + 0x220]
lea rcx, str.__free
call fcn.14005c4b0
test al, al
jne 0x1400ad095
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x14019c6ac]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.14002e814
lea rcx, [rsp + 0x78]
call fcn.14002e800
mov ecx, r12d
test eax, eax
sete cl
mov dword [rsp + 0x1d8], ecx
lea rcx, [rsp + 0xd0]
call fcn.140063500
nop
lea rcx, [rsp + 0x168]
call fcn.140063500
nop
lea rcx, [rsp + 0x80]
call fcn.140063500
nop
mov qword [rsp + 0xc0], r12
lea rcx, [rsp + 0xb8]
call fcn.140063500
nop
lea rcx, [rsp + 0x130]
call fcn.140063500
nop
lea rcx, [rsp + 0xb0]
call fcn.140063500
nop
lea rcx, [rsp + 0x138]
call fcn.140063500
nop
lea rcx, [rsp + 0x120]
call fcn.140063500
nop
lea rcx, [rsp + 0xd8]
call fcn.140063500
nop
lea rcx, [rsp + 0x118]
call fcn.140063500
nop
lea rcx, [rsp + 0x108]
call fcn.140063500
nop
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x1e0], 0xffffffffffffffff
mov qword [rsp + 0x1e8], 0xffffffffffffffff
mov qword [rsp + 0x210], r12
mov r15, r12
mov qword [rsp + 0x1f8], r12
mov rax, qword [rsp + 0x70]
cmp bp, word [rax]
sete bpl
mov byte [rsp + 0x98], bpl
mov dword [rsp + 0xa0], r12d
lea rax, [0x14014f7a8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x200], rax
mov edx, 0xc8
lea rcx, [rsp + 0xe0]
call fcn.140063580
nop
mov rdi, qword [rsp + 0x160]
mov qword [rsp + 0x198], rdi
movzx esi, word [rdi]
mov word [rsp + 0xa6], si
mov rbx, rdi
mov qword [rsp + 0xc8], rbx
test bpl, bpl
je 0x1400ab0c1
add qword [rsp + 0x70], 2
mov word [rdi], r12w
mov rax, qword [rsp + 0x70]
mov rdx, rax
movzx ecx, word [rax]
test cx, cx
je 0x1400aaf09
cmp cx, 0x2a
je 0x1400aaf09
add rax, 2
mov qword [rsp + 0x70], rax
mov cx, word [rax]
test cx, cx
jne 0x1400aaef2
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0xd0]
call fcn.140063740
mov r12, qword [rsp + 0xd0]
cmp word [r12], 0
je 0x1400aaf41
mov edx, 0x3e8
lea rcx, [rsp + 0xe8]
call fcn.1400635c0
mov qword [rsp + 0xc8], rdi
test si, si
je 0x1400aaf5a
lea rax, [rdi + 2]
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0xc8]
call fcn.14005b560
mov ebx, 1
lea rsi, [0x14014f7a8]
mov edi, 0xfff00000
lea rbp, [0x140153308]
nop
mov r8d, 4
lea rdx, [rsp + 0xc8]
lea rcx, str._mem
call fcn.1400657f0
test al, al
je 0x1400aafa8
mov qword [rsp + 0x1a0], rsi
jmp 0x1400aaf80
mov r8d, 2
lea rdx, [rsp + 0xc8]
lea rcx, [0x14014b074]
call fcn.1400657f0
test al, al
je 0x1400aafd0
mov qword [rsp + 0x1a0], rsi
jmp 0x1400aaf80
mov r8d, 3
lea rdx, [rsp + 0xc8]
lea rcx, [0x140151420]
call fcn.1400657f0
test al, al
je 0x1400aaff8
mov qword [rsp + 0x1a0], rbp
jmp 0x1400aaf80
mov r8d, 4
lea rdx, [rsp + 0xc8]
lea rcx, str._map
call fcn.1400657f0
test al, al
je 0x1400ab01e
mov r15, rbx
jmp 0x1400aaf80
mov r8d, 4
lea rdx, [rsp + 0xc8]
lea rcx, str._exe
call fcn.1400657f0
test al, al
je 0x1400ab044
mov r14d, ebx
jmp 0x1400aaf80
mov r8d, 5
lea rdx, [rsp + 0xc8]
lea rcx, str._nexe
call fcn.1400657f0
test al, al
je 0x1400ab06a
mov r14d, edi
jmp 0x1400aaf80
mov r8d, 6
lea rdx, [rsp + 0xc8]
lea rcx, str._nexe1
call fcn.1400657f0
test al, al
je 0x1400ab097
mov r14d, edi
mov dword [rsp + 0x180], ebx
jmp 0x1400aaf80
mov dword [rsp + 0x9c], r14d
mov rbx, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x198]
mov si, word [rsp + 0xa6]
movzx ebp, byte [rsp + 0x98]
jmp 0x1400ab0c9
mov r12, qword [rsp + 0xd0]
lea r8, [0x1401532d0]
lea rdx, str.ERRORLEVEL
mov rcx, qword [rsp + 0xa8]
call fcn.140061290
cmp word [r12], 0
je 0x1400ab12d
or r9d, 0xffffffff
or r8d, r9d
lea rdx, [0x1401532cc]
lea rcx, [rsp + 0xc0]
call fcn.140063690
mov rdx, r12
lea rcx, [rsp + 0xc0]
call fcn.140063600
lea rdx, str.Imdisk
lea rcx, [rsp + 0xc0]
call fcn.140063600
jmp 0x1400ab148
or r9d, 0xffffffff
or r8d, r9d
lea rdx, str._Imdisk
lea rcx, [rsp + 0xc0]
call fcn.140063690
test bpl, bpl
je 0x1400abeb7
mov qword [rsp + 0x170], rbx
cmp word [rbx], 0
je 0x1400ab1f4
mov ebx, 0x20
nop dword [rax + rax]
mov r8d, 2
lea rdx, [rsp + 0x170]
lea rcx, [0x14014b074]
call fcn.140065780
test al, al
jne 0x1400ab1e4
mov rcx, qword [rsp + 0x170]
movzx eax, word [rcx]
test ax, ax
je 0x1400ab1c7
mov edx, 9
cmp dx, ax
ja 0x1400ab1ae
cmp ax, 0xd
jbe 0x1400ab1bf
cmp bx, ax
je 0x1400ab1bf
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400ab1a3
mov qword [rsp + 0x170], rcx
lea rcx, [rsp + 0x170]
call fcn.14005b560
mov rcx, qword [rsp + 0x170]
cmp word [rcx], 0
jne 0x1400ab170
jmp 0x1400ab1f4
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x70]
mov r13d, 0x2a
cmp r13w, word [rax]
jne 0x1400abea7
xor ebp, ebp
mov qword [rsp + 0x230], rbp
mov qword [rsp + 0x1c8], rbp
xor bl, bl
add rax, 2
mov qword [rsp + 0x70], rax
cmp word [rax], 0x40
jne 0x1400ab237
mov bl, 1
add rax, 2
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x70]
call fcn.140068f80
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab25d
add r11, 2
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x70]
call fcn.140068f80
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab283
add r11, 2
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x70]
call fcn.140068f80
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab2a9
add r11, 2
mov qword [rsp + 0x70], r11
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x1b8], rax
movzx r15d, al
and r15b, 1
mov byte [rsp + 0xa4], r15b
mov edx, r13d
lea rcx, [rsp + 0x70]
call fcn.1400cc7d0
mov r8, qword [rsp + 0x70]
sub r8, r11
sar r8, 1
mov rdx, r11
lea rcx, [rsp + 0x108]
call fcn.140063740
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab305
add r11, 2
mov qword [rsp + 0x70], r11
mov edx, r13d
lea rcx, [rsp + 0x70]
call fcn.1400cc7d0
mov r8, qword [rsp + 0x70]
sub r8, r11
sar r8, 1
mov rdx, r11
lea rcx, [rsp + 0xd8]
call fcn.140063740
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab341
add r11, 2
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x70]
call fcn.140068f80
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab367
add r11, 2
mov qword [rsp + 0x70], r11
mov edx, r13d
lea rcx, [rsp + 0x70]
call fcn.1400cc7d0
mov r8, qword [rsp + 0x70]
sub r8, r11
sar r8, 1
mov rdx, r11
lea rcx, [rsp + 0x118]
call fcn.140063740
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x70]
call fcn.140068f80
mov r11, qword [rsp + 0x70]
cmp word [r11], bp
je 0x1400ab3b5
add r11, 2
mov qword [rsp + 0x70], r11
mov rdi, qword [rsp + 0x1e0]
mov qword [rsp + 0x240], rdi
mov rsi, qword [rsp + 0x1e8]
mov qword [rsp + 0x208], rsi
test bl, bl
je 0x1400ab3ed
mov qword [rsp + 0x240], rbp
lea rax, [rsi + rdi]
mov qword [rsp + 0x208], rax
mov rbx, qword [rsp + 0x230]
test rbx, rbx
jle 0x1400ab416
mov rax, qword [rsp + 0x1c8]
test rax, rax
mov ecx, 1
cmovle rax, rcx
mov qword [rsp + 0x1c8], rax
mov edx, 0x318
lea rcx, [rsp + 0x190]
call fcn.140063580
nop
mov rbp, qword [rsp + 0x190]
lea r14, [rbp + 0x6a]
xor eax, eax
mov word [r14 + 0xd4], ax
mov word [r14 + 0x6a], ax
mov rax, rdi
cqo
and edx, 0x1ff
add rax, rdx
sar rax, 9
mov qword [rsp + 0x1e0], rax
mov rdx, rax
mov rcx, rbp
call fcn.140062c70
mov rax, rsi
cqo
and edx, 0x1ff
add rax, rdx
sar rax, 9
mov qword [rsp + 0x1e8], rax
mov rdx, rax
mov rcx, r14
call fcn.140062c70
xor eax, eax
mov word [r14 + 0xd4], ax
test rbx, rbx
jle 0x1400ab4ac
mov rdx, rbx
lea rcx, [r14 + 0xd4]
call fcn.140062c70
xor r13d, r13d
mov rax, r13
cmp word [rsp + 0xa6], ax
setne al
mov rcx, qword [rsp + 0x198]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x100]
call fcn.14005b560
mov dword [rsp + 0x188], r13d
lea r8d, [r13 + 4]
mov r10, qword [rsp + 0x100]
mov rdx, r10
lea rcx, str.__w:
call fcn.14005c510
test al, al
je 0x1400ab526
add r10, 8
mov qword [rsp + 0x100], r10
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x100]
call fcn.140066e40
or r8d, 0xffffffff
lea rdx, [rsp + 0x100]
lea rcx, [0x140153298]
call fcn.140065780
mov r11d, dword [0x140195e0c]
test r11d, r11d
jns 0x1400ab5c2
mov r11d, r13d
mov dword [0x140195e0c], r13d
mov dword [rsp + 0x184], r13d
mov dword [rsp + 0x1f0], r13d
mov rax, qword [0x14019c168]
test rax, rax
je 0x1400ab5df
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x184]
call rax
mov r11d, dword [rsp + 0x184]
cmp r11d, 0x202
jb 0x1400ab5a2
mov r11d, 7
mov dword [0x140195e0c], r11d
jmp 0x1400ab5c7
cmp r11d, 0x184
jb 0x1400ab5bb
mov eax, 1
mov r11d, eax
mov dword [0x140195e0c], eax
jmp 0x1400ab5c7
mov r11d, dword [0x140195e0c]
test r11d, r11d
jle 0x1400ab5df
mov eax, dword [rsp + 0x9c]
test eax, eax
mov ecx, 0xfff00000
cmove eax, ecx
mov dword [rsp + 0x9c], eax
xor r14b, r14b
xor dil, dil
lea r8, [0x14014f7a8]
mov rcx, r8
mov qword [rsp + 0x1b0], rcx
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x150], rax
mov ebx, r13d
cmp word [rax], bx
je 0x1400ab70b
mov esi, 9
lea r12d, [rsi - 8]
nop dword [rax]
mov r8d, 2
lea rdx, [rsp + 0x150]
lea rcx, [0x14015165c]
call fcn.140065780
test al, al
je 0x1400ab646
mov ebx, r12d
jmp 0x1400ab6db
test ebx, ebx
je 0x1400ab692
mov r8d, 2
lea rdx, [rsp + 0x150]
lea rcx, [0x140153294]
call fcn.140065780
test al, al
je 0x1400ab66e
movzx r14d, r12b
jmp 0x1400ab6db
mov r8d, 3
lea rdx, [rsp + 0x150]
lea rcx, [0x140153290]
call fcn.140065780
test al, al
je 0x1400ab692
movzx edi, r12b
jmp 0x1400ab6db
mov rcx, qword [rsp + 0x150]
movzx eax, word [rcx]
test ax, ax
je 0x1400ab6cb
mov edx, 0x20
cmp si, ax
ja 0x1400ab6b2
cmp ax, 0xd
jbe 0x1400ab6c3
cmp dx, ax
je 0x1400ab6c3
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400ab6a7
mov qword [rsp + 0x150], rcx
lea rcx, [rsp + 0x150]
call fcn.14005b560
mov ebx, r13d
mov rax, qword [rsp + 0x150]
cmp word [rax], r13w
jne 0x1400ab620
mov r12, qword [rsp + 0xd0]
mov r11d, dword [0x140195e0c]
mov rcx, qword [rsp + 0x1b0]
lea r8, [0x14014f7a8]
test r11b, 2
je 0x1400ab727
lea rax, str._o_par
test dil, dil
cmovne rax, rcx
mov qword [rsp + 0x1b0], rax
mov ecx, r11d
and ecx, 4
lea r13, str._o_shared
cmove r13, r8
mov qword [rsp + 0x250], r13
movzx eax, byte [rsp + 0x88]
test ecx, ecx
mov edx, 0
cmovne eax, edx
mov rdx, qword [rsp + 0x1b8]
bt rdx, 9
jb 0x1400ab775
test ecx, ecx
jne 0x1400ab775
test r15b, r15b
je 0x1400ab777
bt rdx, 8
jae 0x1400ab777
mov al, 1
jmp 0x1400ab777
xor al, al
test r11d, r11d
jle 0x1400ab965
test r15b, r15b
je 0x1400ab78d
test al, al
jne 0x1400ab965
mov rsi, r8
test r15b, r15b
jne 0x1400ab7a3
test r14b, r14b
jne 0x1400ab7be
lea rsi, str._o_ro
jmp 0x1400ab7be
mov eax, dword [rsp + 0x148]
movzx eax, al
test ecx, ecx
mov ecx, 1
cmove eax, ecx
mov dword [rsp + 0x148], eax
mov rbx, qword [rsp + 0x108]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + rdi + 0x800]
lea rcx, [rsp + 0x80]
call fcn.1400635c0
mov qword [rsp + 0x38], rbx
lea r10, [rbp + 0x6a]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r13
mov r9, qword [rsp + 0x1b0]
mov r8, rsi
lea rdx, str.imdisk__a___s__s__s___b__sb__s__sb__f__s
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, qword [rsp + 0x100]
mov qword [rsp + 0xf0], rbx
cmp word [rbx], 0
je 0x1400ab93d
nop word [rax + rax]
mov r8d, 2
lea rdx, [rsp + 0xf0]
lea rcx, [0x1401531f0]
call fcn.1400657f0
test al, al
jne 0x1400ab8db
mov r8d, 2
lea rdx, [rsp + 0xf0]
lea rcx, [0x14014b1d4]
call fcn.1400657f0
test al, al
jne 0x1400ab8db
mov rcx, qword [rsp + 0xf0]
movzx eax, word [rcx]
test ax, ax
je 0x1400ab8cc
mov edx, 0x20
mov r8d, 9
cmp r8w, ax
ja 0x1400ab8b3
cmp ax, 0xd
jbe 0x1400ab8c4
cmp dx, ax
je 0x1400ab8c4
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400ab8a7
mov qword [rsp + 0xf0], rcx
lea rcx, [rsp + 0xf0]
call fcn.14005b560
jmp 0x1400ab92b
mov rcx, qword [rsp + 0xf0]
movzx eax, word [rcx]
test ax, ax
je 0x1400ab91e
mov edx, 0x20
mov r8d, 9
cmp r8w, ax
ja 0x1400ab902
cmp ax, 0xd
jbe 0x1400ab916
cmp dx, ax
je 0x1400ab916
mov word [rcx], dx
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400ab8f6
mov qword [rsp + 0xf0], rcx
lea rcx, [rsp + 0xf0]
call fcn.14005b560
mov rax, qword [rsp + 0xf0]
cmp word [rax], 0
jne 0x1400ab850
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140063600
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x90], r13
xor r14d, r14d
jmp 0x1400abe76
mov rsi, qword [rsp + 0x108]
test r15b, r15b
je 0x1400ab9b9
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xa0000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r14 + 7]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400ac9f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x14014f7a8]
lea r15, [0x1401531e8]
mov r13b, byte [rsp + 0xa4]
test r13b, r13b
cmovne r15, r8
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
jle 0x1400ab9eb
lea r14, [rbp + 0x6a]
lea rcx, [r14 + 0x6a]
call fcn.140062c70
jmp 0x1400ab9ef
lea r14, [rbp + 0x6a]
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
test rax, rax
jne 0x1400aba0b
mov rbx, rsi
jmp 0x1400aba0f
add rbx, 2
mov rdi, qword [rsp + 0xd8]
cmp word [rdi], 0
jne 0x1400aba5b
mov edx, 0x800
lea rcx, [rsp + 0xd8]
call fcn.1400635c0
call fcn.14005d820
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9, rbp
mov r8, rbx
lea rdx, str._s_s_s__u
mov rdi, qword [rsp + 0xd8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r14d, eax
cmp eax, 0x400
jle 0x1400aba7d
xor eax, eax
mov r14d, 0x400
mov word [rdi + 0x800], ax
lea rdx, str.Global_
lea rcx, [rsp + 0xe0]
call fcn.140071480
mov rdx, rdi
lea rcx, [rsp + 0xe0]
call fcn.140063600
lea rdx, str._devio_Ack
lea rcx, [rsp + 0xe0]
call fcn.140063600
xor r8d, r8d
mov word [rsp + 0x3a8], r8w
lea rbx, [rbp + 0x6a]
mov word [rbx + 0x13e], r8w
mov rax, qword [rsp + 0x1b8]
test al, 0x30
jne 0x1400abaea
test r13b, r13b
je 0x1400abc05
test al, 0x40
jne 0x1400abc05
mov rax, qword [str.__kill:]
mov qword [rbx + 0x13e], rax
mov rax, qword [0x1401531a0]
mov qword [rbx + 0x146], rax
mov r8d, 0x104
lea rdx, [rbx + 0x3bc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbx + 0x14c]
mov r8d, 0x104
lea rcx, [rbx + 0x3bc]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rcx, [rbx + 0x13e]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r11, qword [rsp + 0x200]
mov r13, r11
movzx ecx, word [r11]
mov edx, 0x22
cmp dx, cx
jne 0x1400abb85
add r11, 2
movzx ecx, word [r13]
test cx, cx
je 0x1400abbb4
nop dword [rax]
cmp dx, cx
je 0x1400abbb4
add r13, 2
mov cx, word [r13]
test cx, cx
jne 0x1400abb70
jmp 0x1400abbb4
test cx, cx
je 0x1400abbb4
mov edx, 0x20
mov r8d, 9
cmp r8w, cx
ja 0x1400abba1
cmp cx, 0xd
jbe 0x1400abbb4
cmp dx, cx
je 0x1400abbb4
add r13, 2
mov cx, word [r13]
test cx, cx
jne 0x1400abb95
movzx ebx, word [r13]
xor edx, edx
mov word [r13], dx
mov rdx, qword [rsp + 0x1b8]
test dl, 0x20
lea rdx, str._RAMD_ImdiskV__D__m__s_
lea rcx, str._LOAD_25_poweroff
cmovne rdx, rcx
cdqe
lea r10, [rbp + 0x6a]
lea rcx, [r10 + rax*2 + 0x13e]
mov r8, r11
call qword [sym.imp.USER32.dll_wsprintfW]
mov word [r13], bx
mov rax, qword [rsp + 0x1b8]
lea rbx, [rbp + 0x6a]
sar rax, 1
and eax, 3
je 0x1400abc25
mov r8d, eax
lea rdx, str._nrc:_d
lea rcx, [rsp + 0x3a8]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsp + 0x240]
cqo
and edx, 0x1ff
add rdx, rax
sar rdx, 9
mov rcx, rbp
call fcn.140062c70
mov rax, qword [rsp + 0x208]
cqo
and edx, 0x1ff
add rdx, rax
sar rdx, 9
mov rcx, rbx
call fcn.140062c70
lea r8, [0x140143378]
lea rdx, str.__ImdMapPid
mov rcx, qword [rsp + 0xa8]
call fcn.140061290
mov rbx, qword [rsp + 0x118]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + r13]
lea edx, [rcx + r14 + 0x940]
lea rcx, [rsp + 0x1a8]
call fcn.140063580
nop
lea rdx, str.Global_
lea rcx, [rsp + 0x1d0]
call fcn.140071240
mov rdx, rdi
lea rcx, [rsp + 0x1d0]
call fcn.140063600
mov r8, qword [rsp + 0x1d0]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x1400aca4a
lea rcx, [rsp + 0x1d0]
call fcn.14005b520
lea r13, [rbp + 0x6a]
lea rax, [r13 + 0x6a]
lea rcx, [rax + 0x6a]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rcx + 0x6a]
mov r8, qword [rsp + 0x1a0]
lea rdx, str.EXEC___pid:__ImdMapPid____exe:_s10INDATA___nfb___MyName0____s__w:60000__s__s__s_shm:_s___s__s__s__s__s
mov rbx, qword [rsp + 0x1a8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea edx, [r14 + 0x800]
lea rcx, [rsp + 0x80]
call fcn.1400635c0
xor r14d, r14d
mov word [rbp], r14w
mov word [r13], r14w
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1b0]
lea r8, [0x14014f7a8]
lea rdx, str.imdisk__a__t_proxy__s__s__s__o_shm__f__s
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x80]
call fcn.140063600
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x90], r13
mov r9, qword [rsp + 0xe0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rsi, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.14004d38c
mov edx, 0xea60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400aca25
lea ebx, [r14 + 0x31]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1400abe40
mov edx, dword [rsp + 0x188]
test edx, edx
jle 0x1400abe61
mov rcx, rsi
call fcn.14002bb1c
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
mov rbx, qword [rsp + 0x100]
mov qword [rsp + 0x160], rbx
mov word [rbx], r14w
mov r15d, 1
lea rcx, [rsp + 0x190]
call fcn.14005b520
mov rdi, qword [rsp + 0x198]
mov si, word [rsp + 0xa6]
jmp 0x1400abeaf
mov r13, qword [rsp + 0x90]
mov word [rdi], si
jmp 0x1400ac4c7
mov r8d, 4
lea rdx, [rsp + 0x160]
lea rcx, str._exe
call fcn.140065780
test al, al
mov eax, 1
cmovne r14d, eax
lea r8d, [rax + 4]
lea rdx, [rsp + 0x160]
lea rcx, str._nexe
call fcn.140065780
test al, al
mov eax, 0xfff00000
cmovne r14d, eax
mov dword [rsp + 0x9c], r14d
mov r8d, 0x2c
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call fcn.140066780
mov rbx, qword [rsp + 0xb8]
xor r14d, r14d
mov word [rbx], r14w
mov rax, qword [rsp + 0x90]
cmp word [rax], r14w
je 0x1400ac085
add rax, 2
mov qword [rsp + 0x90], rax
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call fcn.140066780
mov r11, qword [rsp + 0x90]
cmp word [r11], r14w
je 0x1400ac07d
add r11, 2
mov qword [rsp + 0x90], r11
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x90]
call fcn.140066780
mov r11, qword [rsp + 0x90]
cmp word [r11], r14w
je 0x1400ac07d
add r11, 2
mov qword [rsp + 0x90], r11
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call fcn.140066780
mov r11, qword [rsp + 0x90]
cmp word [r11], r14w
je 0x1400ac07d
add r11, 2
mov qword [rsp + 0x90], r11
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x90]
call fcn.140066780
mov r11, qword [rsp + 0x90]
cmp word [r11], r14w
je 0x1400ac07d
add r11, 2
mov qword [rsp + 0x90], r11
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
call fcn.140066780
mov r11, qword [rsp + 0x90]
cmp word [r11], r14w
je 0x1400ac07d
add r11, 2
mov qword [rsp + 0x90], r11
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x90]
call fcn.140066a80
mov rbx, qword [rsp + 0xb8]
jmp 0x1400ac085
mov rbx, qword [rsp + 0xb8]
xor bpl, bpl
mov edx, 6
lea rcx, [rsp + 0xb0]
call fcn.1400635c0
mov rdi, qword [rsp + 0xb0]
mov eax, 0x3a
mov word [rdi + 2], ax
mov word [rdi + 4], r14w
cmp word [rdi], r14w
je 0x1400ac144
mov rcx, rdi
call fcn.1400cf330
test eax, eax
je 0x1400ac13e
lea rax, str.imdisk
mov qword [rsp + 0x270], rax
lea rax, [0x140152fb0]
mov qword [rsp + 0x278], rax
lea rax, [0x140152fa8]
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x290], r14
lea rcx, [rsp + 0x218]
call fcn.140063500
nop
lea r8, [rsp + 0x218]
lea rdx, [rsp + 0x270]
mov ecx, 4
call fcn.14004481c
test eax, eax
sete bpl
lea rcx, [rsp + 0x218]
call fcn.14005b520
cmp word [rdi], 0
jne 0x1400ac16a
lea rdx, [0x14014ab60]
lea rcx, [rsp + 0xb0]
call fcn.140071360
mov rdi, qword [rsp + 0xb0]
cmp word [rdi], 0
je 0x1400acf8b
mov edx, 0x3c
lea rcx, [rsp + 0x178]
call fcn.140063580
nop
mov qword [rsp + 0x228], 0xffffffffffffffff
mov qword [rsp + 0x238], 0xffffffffffffffff
mov qword [rsp + 0x248], 0xffffffffffffffff
or rsi, 0xffffffffffffffff
mov qword [rsp + 0xf8], rbx
cmp word [rbx], 0
je 0x1400ace73
lea edi, [rsi + 0x69]
lea r12d, [rsi + 0x6d]
lea r13d, [rsi + 0x71]
lea rcx, [rsp + 0xf8]
call fcn.14005b560
mov rcx, qword [rsp + 0xf8]
movzx eax, word [rcx]
or ax, 0x20
cmp r13w, ax
jne 0x1400ac207
add rcx, 2
mov qword [rsp + 0xf8], rcx
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0xf8]
call fcn.140066e10
jmp 0x1400ac256
cmp r12w, ax
jne 0x1400ac230
add rcx, 2
mov qword [rsp + 0xf8], rcx
lea rdx, [rsp + 0x238]
lea rcx, [rsp + 0xf8]
call fcn.140066e10
jmp 0x1400ac256
cmp di, ax
jne 0x1400ac268
add rcx, 2
mov qword [rsp + 0xf8], rcx
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0xf8]
call fcn.140066e10
mov rax, qword [rsp + 0xf8]
cmp word [rax], 0
jne 0x1400ac1c2
mov rbx, qword [rsp + 0x228]
test rbx, rbx
mov rdi, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0x1f8]
jle 0x1400ac2c7
mov r14d, 1
mov ecx, r14d
call fcn.1400307d8
mov r11, rax
imul r11, rbx
movabs rax, 0xa3d70a3d70a3d70b
imul r11
lea rsi, [r11 + rdx]
sar rsi, 6
mov rax, rsi
shr rax, 0x3f
add rsi, rax
sar rsi, 0x14
jmp 0x1400ac2cd
mov r14d, 1
mov rax, qword [rsp + 0x238]
cmp rsi, rax
cmovl rsi, rax
mov rax, qword [rsp + 0x248]
test rax, rax
jle 0x1400ac2f7
cmp rsi, rax
cmovg rsi, rax
test rsi, rsi
cmovle rsi, rax
test rsi, rsi
js 0x1400ace73
cmp word [rdi], 0
je 0x1400ace73
test rsi, rsi
cmovle rsi, r14
mov rdx, rsi
mov rcx, qword [rsp + 0x178]
call fcn.140062c80
lea rdx, [0x140152fa0]
lea rcx, [rsp + 0x178]
call fcn.140063600
lea rdx, str.imdisk___a
test bpl, bpl
lea rax, str.imdisk___e
cmovne rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140071360
test r13b, 1
je 0x1400ac371
lea rdx, str.__o_awe
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rbx, qword [rsp + 0x178]
cmp word [rbx], 0
je 0x1400ac3a3
lea rdx, str.___s
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140063600
cmp word [rdi], 0
je 0x1400ac3cd
lea rdx, str.___m
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rdi, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x130]
cmp word [rbx], 0
jne 0x1400ac3ed
cmp word [rdi], 0
je 0x1400ac4aa
lea rdx, str.___p__
lea rcx, [rsp + 0x80]
call fcn.140063600
cmp word [rbx], 0
je 0x1400ac42b
lea rdx, str.__FS:
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140063600
cmp word [rdi], 0
je 0x1400ac455
lea rdx, str.__V:
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.140063600
mov rdx, rbx
lea rcx, str.NTFS
call fcn.14005c550
test al, al
je 0x1400ac496
mov rax, qword [rsp + 0x120]
movzx ecx, word [rax]
test cx, cx
je 0x1400ac496
mov eax, 0x30
cmp ax, cx
je 0x1400ac496
lea rdx, [0x140150508]
lea rcx, [rsp + 0x80]
call fcn.140063600
lea rdx, str.___Q__Y__
lea rcx, [rsp + 0x80]
call fcn.140063600
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x90], r13
lea rcx, [rsp + 0x178]
call fcn.14005b520
lea rcx, [rsp + 0x160]
call fcn.14005b560
mov r8d, 4
mov rbx, qword [rsp + 0x160]
mov rdx, rbx
lea rcx, str._gui
call fcn.14005c4b0
test al, al
jne 0x1400acd45
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14d, [rax - 0xc8]
xor r10b, r10b
cmp byte [rsp + 0x98], r10b
je 0x1400ac537
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140153298]
call fcn.14005c4b0
movzx r10d, r10b
test al, al
mov eax, 1
cmovne r10d, eax
test r15, r15
jne 0x1400ac545
test r10b, r10b
je 0x1400ac5fa
cmp dword [rsp + 0x9c], 0
jne 0x1400ac5fa
lea rcx, [rsp + 0x380]
mov rax, qword [str.imdisk___version]
mov qword [rcx], rax
mov rax, qword [0x140152ef0]
mov qword [rcx + 8], rax
mov rax, qword [0x140152ef8]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140152f00]
mov qword [rcx + 0x18], rax
mov eax, dword [0x140152f08]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140152f0c]
mov word [rcx + 0x24], ax
xor eax, eax
mov word [rsp + 0x140], ax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
mov rax, qword [rsp + 0xa8]
mov r8, rax
lea rdx, [rsp + 0x380]
mov rcx, rax
call fcn.140023208
test eax, eax
jne 0x1400ac5fa
test r15, r15
je 0x1400ac5ef
mov dword [rsp + 0x9c], 0x11
lea r15d, [rax + 0x11]
jmp 0x1400ac5fa
mov dword [rsp + 0x9c], 0x40
mov rdx, r13
movzx eax, word [r13]
test ax, ax
je 0x1400ac62f
mov ecx, 0x20
mov ebx, 9
cmp bx, ax
ja 0x1400ac61c
cmp ax, 0xd
jbe 0x1400ac634
cmp cx, ax
je 0x1400ac634
add rdx, 2
mov ax, word [rdx]
test ax, ax
jne 0x1400ac611
jmp 0x1400ac634
mov ebx, 9
lea rcx, [rsp + 0x128]
call fcn.140071480
mov rbp, qword [rsp + 0x128]
mov qword [rsp + 0x158], rbp
cmp word [rbp], 0
je 0x1400ac716
nop dword [rax]
mov r8d, 6
lea rdx, [rsp + 0x158]
lea rcx, str.__nbrd
call fcn.1400657f0
test al, al
jne 0x1400ac704
mov r8d, 6
lea rdx, [rsp + 0x158]
lea rcx, [0x14014695c]
call fcn.1400657f0
test al, al
jne 0x1400ac704
mov r8d, 2
lea rdx, [rsp + 0x158]
lea rcx, [0x14014b068]
call fcn.1400657f0
test al, al
jne 0x1400ac704
mov rcx, qword [rsp + 0x158]
movzx eax, word [rcx]
test ax, ax
je 0x1400ac6f7
mov edx, 0x20
cmp bx, ax
ja 0x1400ac6de
cmp ax, 0xd
jbe 0x1400ac6ef
cmp dx, ax
je 0x1400ac6ef
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400ac6d3
mov qword [rsp + 0x158], rcx
lea rcx, [rsp + 0x158]
call fcn.14005b560
mov rax, qword [rsp + 0x158]
cmp word [rax], 0
jne 0x1400ac660
movsxd rsi, dword [rsp + 0x1d8]
movsxd rdi, dword [rsp + 0x180]
mov rbx, qword [rsp + 0xc0]
nop
test rsi, rsi
jne 0x1400ac7c9
cmp dword [rsp + 0x9c], esi
jg 0x1400ac7c9
xor r8d, r8d
mov rdx, r13
lea rcx, [rsp + 0x2a0]
call fcn.140075040
cmp dword [rsp + 0x2ec], 1
jle 0x1400acb87
mov rax, qword [rsp + 0x2f0]
lea rcx, str.imdisk
mov qword [rax], rcx
lea r8, [rsp + 0xe8]
mov rdx, qword [rsp + 0x2f0]
mov ecx, dword [rsp + 0x2ec]
call fcn.14004481c
mov dword [rsp + 0xa0], eax
xor ecx, ecx
mov dword [rsp + 0x144], ecx
cmp byte [rsp + 0x148], cl
jle 0x1400ac89a
cmp eax, 3
jne 0x1400ac89a
test rdi, rdi
je 0x1400ac8d7
jmp 0x1400ac89a
test rdi, rdi
jne 0x1400ac893
mov rdx, rbx
lea rcx, [rsp + 0x1c0]
call fcn.140071240
nop
mov rdx, rbp
lea rcx, [rsp + 0x1c0]
call fcn.140063600
mov dword [rsp + 0x144], 1
cmp word [r12], di
je 0x1400ac83b
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0xa8]
mov r8, rax
xor edx, edx
mov rcx, rax
call fcn.140023208
mov dword [rsp + 0xa0], eax
jmp 0x1400ac87d
xor eax, eax
mov word [rsp + 0x14c], ax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x14c]
mov rax, qword [rsp + 0xa8]
mov r8, rax
mov rdx, qword [rsp + 0x1c0]
mov rcx, rax
call fcn.140023208
mov dword [rsp + 0xa0], eax
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
mov eax, dword [rsp + 0xa0]
jmp 0x1400ac89a
mov eax, dword [rsp + 0xa0]
test r15, r15
je 0x1400acbc1
cmp eax, 3
jne 0x1400acbad
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
cmp eax, 0x1388
jae 0x1400acb99
mov edx, 0xc8
mov rcx, qword [rsp + 0xa8]
call fcn.14002bb1c
jmp 0x1400ac730
mov byte [rsp + 0x88], 1
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x120]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x168]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea r13, [0x14019cf50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x14019c6ac]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
mov rbx, qword [rsp + 0x268]
mov edi, 0x20
lea esi, [rdi - 0x17]
xor r12d, r12d
lea ebp, [rdi + 0xa]
jmp 0x1400aac85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
mov eax, 1
cmove ebx, eax
lea rcx, [rsp + 0x190]
call fcn.14005b520
mov rsi, qword [rsp + 0xa8]
jmp 0x1400acbd3
mov ebx, 1
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
jmp 0x1400acbd3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1d0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x120]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x168]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x14019c6ac]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
mov eax, 0xb7
jmp 0x1400ad124
mov ebx, 0x80070057
mov rsi, qword [rsp + 0xa8]
xor r14d, r14d
jmp 0x1400acbd3
mov ebx, dword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
xor r14d, r14d
jmp 0x1400acbd3
mov ebx, dword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
xor r14d, r14d
jmp 0x1400acbd3
mov ebx, dword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
xor r14d, r14d
mov rax, qword [rsp + 0x2f8]
test rax, rax
je 0x1400acbfd
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x2f8], r14
lea rcx, [rsp + 0x260]
call fcn.14005b520
cmp word [r12], 0
je 0x1400acc3e
cmp dword [rsp + 0x144], 0
jne 0x1400acc3e
lea r8, [rsp + 0x3f0]
mov word [rsp + 0x3f0], r14w
mov rax, qword [rsp + 0xe8]
cmp word [rax], 0x2a
jne 0x1400acc32
lea r8, [rax + 2]
mov rdx, r12
mov rcx, rsi
call fcn.140061290
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x120]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x168]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x14019c6ac]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
mov eax, ebx
jmp 0x1400ad124
mov dword [rsp + 0x20], 0xffffff9c
lea r9, [0x14014f7a8]
xor r8d, r8d
lea rdx, str.imdisk.cpl_
mov rcx, qword [rsp + 0xa8]
call fcn.140086e50
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x120]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x168]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x14019c6ac]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
xor eax, eax
jmp 0x1400ad124
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x120]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x168]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x14019c6ac]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
mov eax, 0x80070057
jmp 0x1400ad124
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x120]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0xb8]
call fcn.14005b520
nop
lea rcx, [rsp + 0xc0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x80]
call fcn.14005b520
nop
lea rcx, [rsp + 0x168]
call fcn.14005b520
nop
lea rcx, [rsp + 0xd0]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [0x14019c6ac]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
mov eax, 0x80070057
jmp 0x1400ad124
mov qword [rsp + 0x258], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [0x14019c6ac]
test eax, eax
jle 0x1400ad0ef
mov rdi, qword [rsp + 0xa8]
mov ebp, 1
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, ebp
mov rcx, rdi
call fcn.14002bb1c
mov qword [rsp + 0x258], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [0x14019c6ac]
test eax, eax
jg 0x1400ad0c0
or edx, 0xffffffff
lea rcx, [rsp + 0x78]
call fcn.14002e814
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0xe8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
xor eax, eax
mov rcx, qword [rsp + 0x438]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x490]
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret