Function at 0x1400010e0
Capabilities:
Check os version
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x468
movabs rax, 0x71639c73d52703
mov qword [rsp + 0x1d8], rax
movabs rax, 0x79d36f56b18693
mov qword [rsp + 0x2d8], rax
mov dword [rsp + 0x2c8], 0xacaf
movsx eax, word [section..data]
sub eax, 0x9f
mov word [section..data], ax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x1b8], 0x291f
mov eax, dword [rsp + 0x1b8]
mov dword [rsp + 0x42c], eax
cmp dword [rsp + 0x42c], 0x2124
je 0x140001192
cmp dword [rsp + 0x42c], 0x3535
je 0x1400011a1
jmp 0x1400011be
mov rcx, qword [rsp + 0xf8]
call fcn.140001040
jmp 0x1400011be
movabs rcx, 0x734028da3083c0
mov rax, qword [rsp + 0x3a0]
add rax, rcx
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x430], rax
movabs rax, 0x71639c73d52703
cmp qword [rsp + 0x430], rax
je 0x1400011e7
jmp 0x140004018
mov eax, dword [rsp + 0x1b8]
mov dword [rsp + 0x2f0], eax
mov byte [rsp + 0x400], 0x5e
mov eax, 0xaf8
mov word [rsp + 0x100], ax
movzx eax, word [section..data]
mov word [rsp + 0x1e8], ax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x2e0], rax
mov dword [rsp + 0x390], 0x5a54
mov byte [rsp + 0x1b4], 0
movzx eax, byte [rsp + 0x1b4]
mov byte [0x14000f044], al
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x438], rax
movabs rax, 0x75be806f6e8db4
cmp qword [rsp + 0x438], rax
je 0x140001270
jmp 0x1400012ac
mov rax, qword [rsp + 0x1d8]
sar rax, 0x18
mov qword [rsp + 0xf8], rax
mov eax, dword [rsp + 0x2f0]
xor eax, 0x442d
mov dword [rsp + 0x1b8], eax
mov rax, qword [rsp + 0x2e0]
movzx ecx, byte [rax]
call fcn.140001000
jmp 0x140003fe4
cmp dword [rsp + 0x390], 0x81ec
je 0x1400013de
movzx eax, byte [0x14000f044]
sub eax, 0x11
mov byte [rsp + 0x1b4], al
mov eax, dword [rsp + 0x390]
add eax, 0xb5
mov dword [rsp + 0x390], eax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movsx eax, word [section..data]
and eax, 0x748
mov word [rsp + 0x1e8], ax
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
add eax, 0x11
mov byte [rsp + 0x400], al
movzx eax, byte [rsp + 0x1b4]
sub eax, 0x63
mov byte [0x14000f044], al
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
add eax, 0x20
mov byte [rsp + 0x400], al
movabs rcx, 0x734183b2d3a064
mov rax, qword [rsp + 0x1d8]
sub rax, rcx
mov qword [rsp + 0xf8], rax
mov eax, dword [rsp + 0x2f0]
shl eax, 0x1a
mov dword [rsp + 0x1b8], eax
movzx eax, byte [0x14000f044]
xor eax, 0x86
mov byte [rsp + 0x1b4], al
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
sar eax, 7
mov byte [rsp + 0x400], al
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
or ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movsx ecx, byte [rsp + 0x400]
and ecx, 0x18
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
jmp 0x1400012ac
mov rax, qword [rsp + 0x2e0]
mov al, byte [rax]
mov byte [rsp + 0x440], al
cmp byte [rsp + 0x440], 0x45
je 0x140001408
cmp byte [rsp + 0x440], 0x69
je 0x14000146b
jmp 0x1400014ed
movabs rcx, 0x7b3befd0d0582a
mov rax, qword [rsp + 0x3a0]
add rax, rcx
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
sub ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movabs rcx, 0x7936da73c0cd70
mov rax, qword [rsp + 0x1d8]
sub rax, rcx
mov qword [rsp + 0xf8], rax
call fcn.1400041b0
jmp 0x1400014ed
mov eax, dword [rsp + 0x2f0]
add eax, 0x4f69
mov dword [rsp + 0x1b8], eax
movsx eax, word [section..data]
and eax, 0x2f0
mov word [rsp + 0x1e8], ax
movzx eax, byte [0x14000f044]
add eax, 0xf1
mov byte [rsp + 0x1b4], al
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov qword [rsp + 0x1a8], rax
movsx ecx, byte [rsp + 0x400]
sub ecx, 0x53
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov r8, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0xf8]
movzx ecx, word [rsp + 0x100]
call fcn.1400041f0
lea rcx, [0x14000a680]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x428], ax
movzx eax, byte [rsp + 0x1b4]
mov byte [rsp + 0x420], al
movzx ecx, byte [rsp + 0x1b4]
movzx eax, byte [0x14000f044]
sub ecx, eax
movzx eax, byte [rsp + 0x420]
cmp ecx, eax
jge 0x140001567
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x258], rax
movzx eax, byte [rsp + 0x400]
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x8c], 0xb2fb
mov eax, dword [rsp + 0x2f0]
mov dword [rsp + 0x74], eax
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x260], ax
lea rax, [rsp + 0x420]
mov qword [rsp + 0x418], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x418]
mov al, byte [rax]
mov byte [rsp + 0x444], al
cmp byte [rsp + 0x444], 0x26
je 0x1400015cd
jmp 0x140003f73
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x448], rax
movabs rax, 0x77541b9c111a1e
cmp qword [rsp + 0x448], rax
je 0x1400015f3
jmp 0x14000162e
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x350]
and rax, rcx
mov qword [rsp + 0x2d8], rax
movsx edx, byte [rsp + 0x78]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x400], al
jmp 0x140003f4e
mov al, byte [0x14000f044]
mov byte [rsp + 0x450], al
cmp byte [rsp + 0x450], 0x55
je 0x140003ef6
cmp byte [rsp + 0x450], 0xa0
je 0x140001658
jmp 0x140003f29
cmp dword [rsp + 0x2c8], 0xdc0d
jae 0x140001b2f
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1b4]
add eax, ecx
mov byte [0x14000f044], al
mov ecx, dword [rsp + 0x2f0]
mov eax, dword [rsp + 0x74]
and eax, ecx
mov dword [rsp + 0x1b8], eax
movzx ecx, byte [0x14000f044]
movzx eax, byte [rsp + 0x420]
sub ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x350]
add rax, rcx
mov qword [rsp + 0x2d8], rax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x50]
sub rax, rcx
mov qword [rsp + 0x1d8], rax
movzx ecx, byte [rsp + 0x1b4]
movzx eax, byte [rsp + 0x420]
xor ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
movzx eax, byte [rsp + 0x420]
movzx ecx, byte [0x14000f044]
or eax, ecx
mov byte [rsp + 0x1b4], al
movzx eax, word [rsp + 0x260]
shl eax, 4
mov word [rsp + 0x100], ax
movsx edx, word [section..data]
mov rax, qword [rsp + 0x258]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x1e8], ax
movzx edx, byte [rsp + 0x420]
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x14000f044], al
mov eax, dword [rsp + 0x2c8]
add eax, 0x8d
mov dword [rsp + 0x2c8], eax
mov ecx, dword [rsp + 0x2f0]
mov eax, dword [rsp + 0x1b8]
sub eax, ecx
mov dword [rsp + 0x74], eax
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x1b8]
add eax, ecx
mov dword [rsp + 0x2f0], eax
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x350]
sub rax, rcx
mov qword [rsp + 0x2d8], rax
movsx ecx, word [rsp + 0x1e8]
movsx eax, word [section..data]
add ecx, eax
mov rax, qword [rsp + 0x90]
mov word [rax], cx
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x400]
add eax, ecx
mov byte [rsp + 0x78], al
movsx edx, byte [rsp + 0x78]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x400], al
movzx eax, word [rsp + 0x260]
and eax, 0x8bf
mov word [rsp + 0x100], ax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x1e8], ax
movzx ecx, byte [rsp + 0x1b4]
movzx eax, byte [rsp + 0x420]
or ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rax, qword [rsp + 0xf8]
movzx ecx, al
mov rax, qword [rsp + 0x50]
sar rax, cl
mov qword [rsp + 0x1d8], rax
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x2d8]
xor rax, rcx
mov qword [rsp + 0x350], rax
mov eax, dword [rsp + 0x2f0]
movzx ecx, al
mov eax, dword [rsp + 0x74]
shl eax, cl
mov dword [rsp + 0x1b8], eax
movzx ecx, byte [0x14000f044]
movzx eax, byte [rsp + 0x420]
sub ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
and ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movzx eax, word [rsp + 0x100]
sub eax, 0x928
mov word [rsp + 0x260], ax
movzx eax, byte [rsp + 0x420]
movzx ecx, byte [0x14000f044]
add eax, ecx
mov byte [rsp + 0x1b4], al
movsx edx, word [section..data]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e8], ax
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x420]
sub ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x1e8], ax
mov rcx, qword [rsp + 0x350]
mov rax, qword [rsp + 0x3a0]
sub rax, rcx
mov qword [rsp + 0x2d8], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0xf8]
add rax, rcx
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x78]
and ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movzx eax, word [rsp + 0x100]
shl eax, 0xb
mov word [rsp + 0x260], ax
movsx edx, byte [rsp + 0x400]
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x78], al
movsx edx, word [section..data]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [rsp + 0x1e8], ax
movsx ecx, byte [rsp + 0x78]
movsx eax, byte [rsp + 0x400]
xor ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x258]
movsx edx, word [rax]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x1e8], ax
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1b4]
sub eax, ecx
mov byte [0x14000f044], al
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x78]
and ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov ecx, dword [rsp + 0x2f0]
mov eax, dword [rsp + 0x74]
add eax, ecx
mov dword [rsp + 0x1b8], eax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x1d8], rax
movzx ecx, byte [rsp + 0x1b4]
movzx eax, byte [rsp + 0x420]
sub ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
movsx edx, byte [rsp + 0x78]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x400], al
movzx eax, word [rsp + 0x260]
add eax, 0x658
mov word [rsp + 0x100], ax
movzx edx, byte [rsp + 0x1b4]
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x420], al
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x400]
sub eax, ecx
mov byte [rsp + 0x78], al
jmp 0x140001658
movsx ecx, byte [rsp + 0x400]
movsx eax, byte [rsp + 0x78]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
cmp ecx, eax
jne 0x140001b90
mov rax, qword [rsp + 0x50]
movzx ecx, al
mov rax, qword [rsp + 0xf8]
shl rax, cl
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x1a0], 0xf55b
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x120], 0x181b
jmp 0x140001bba
movzx r9d, word [rsp + 0x260]
movzx r8d, word [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
call fcn.140004140
mov ecx, dword [rsp + 0x1b8]
mov eax, dword [rsp + 0x74]
or eax, ecx
mov dword [rsp + 0x2f0], eax
cmp dword [rsp + 0x1a0], 0x1271f
jae 0x140001ef2
mov eax, dword [rsp + 0x1a0]
add eax, 0x8c
mov dword [rsp + 0x1a0], eax
movsx edx, word [section..data]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x1e8], ax
movsx ecx, byte [rsp + 0x78]
movsx eax, byte [rsp + 0x400]
and ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x1e8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x2ac], eax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x78]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x1b4]
and ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
movsx ecx, byte [rsp + 0x78]
movsx eax, byte [rsp + 0x400]
sub ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
sub ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x1d8]
add rax, rcx
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x120]
sub eax, 0x15eb
mov dword [rsp + 0x120], eax
mov rcx, qword [rsp + 0x350]
mov rax, qword [rsp + 0x3a0]
add rax, rcx
mov qword [rsp + 0x2d8], rax
movsx edx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x258]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x90]
mov word [rax], cx
movsx edx, byte [rsp + 0x400]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1b4]
xor eax, ecx
mov byte [rsp + 0x420], al
mov rax, qword [rsp + 0x418]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x1b4]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [0x14000f044], al
movsx edx, byte [rsp + 0x400]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x78], al
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x2f0]
add eax, ecx
mov dword [rsp + 0x1b8], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x1d8]
sub rax, rcx
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0x350]
mov rax, qword [rsp + 0x3a0]
add rax, rcx
mov qword [rsp + 0x310], rax
mov eax, dword [rsp + 0x120]
sub eax, 0x9686
mov dword [rsp + 0x120], eax
movzx eax, word [rsp + 0x100]
and eax, 0xbe3
mov word [rsp + 0x260], ax
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x1b4]
sub ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rax, qword [rsp + 0x258]
movsx edx, word [rax]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e8], ax
movsx edx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x258]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x78]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x350]
or rax, rcx
mov qword [rsp + 0x3a0], rax
mov eax, dword [rsp + 0x74]
movzx ecx, al
mov eax, dword [rsp + 0x1b8]
shl eax, cl
mov dword [rsp + 0x2f0], eax
movsx ecx, byte [rsp + 0x400]
movsx eax, byte [rsp + 0x78]
xor ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov eax, dword [rsp + 0x120]
shr eax, 5
mov dword [rsp + 0x120], eax
jmp 0x140001bce
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x338], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r11, qword [rsp + 0x90]
movzx eax, word [r11]
mov word [rsp + 0x1e4], ax
lea rcx, str.7ytjvBrh_CV9jA5I_Rm0I
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x288], ax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [rsp + 0xf8]
and rax, rcx
cmp rax, qword [rsp + 0x50]
jg 0x140001fa4
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78]
sub eax, ecx
mov byte [rsp + 0x400], al
lea rcx, [rsp + 0xa0]
call qword [sym.imp.COMDLG32.dll_FindTextW]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x1b4]
add ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
call fcn.1400041b0
jmp 0x140002053
mov ecx, dword [rsp + 0x2f0]
mov eax, dword [rsp + 0x1b8]
add eax, ecx
cmp eax, dword [rsp + 0x74]
jle 0x140002025
lea rax, [rsp + 0x1e4]
mov qword [rsp + 0x160], rax
mov eax, dword [rsp + 0x1b8]
mov dword [rsp + 0xf0], eax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x2f8], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x268], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x320], rax
mov dword [rsp + 0x2d0], 0xd083
lea rax, [rsp + 0x100]
mov qword [rsp + 0x138], rax
jmp 0x140002053
mov ecx, dword [rsp + 0x2f0]
mov eax, dword [rsp + 0x1b8]
sub eax, ecx
cmp eax, dword [rsp + 0x74]
jge 0x140002053
movzx eax, byte [rsp + 0x420]
movzx ecx, byte [0x14000f044]
sub eax, ecx
mov byte [rsp + 0x1b4], al
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x400]
and eax, ecx
mov byte [rsp + 0x78], al
movsx edx, word [rsp + 0x1e4]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [0x14000f044]
add ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
movzx ecx, word [rsp + 0x100]
movzx eax, word [rsp + 0x260]
sub ecx, eax
mov rax, qword [rsp + 0x138]
mov word [rax], cx
mov rax, qword [rsp + 0x2f8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x50]
shl rax, cl
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x268]
mov eax, dword [rax]
or eax, 0xca4
mov dword [rsp + 0x120], eax
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x310]
xor rax, rcx
mov qword [rsp + 0x3a0], rax
movzx edx, word [rsp + 0x260]
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x100], ax
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x400]
and eax, ecx
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78]
sub eax, ecx
mov byte [rsp + 0x400], al
movsx ecx, word [rsp + 0x1e8]
mov rax, qword [rsp + 0x160]
movsx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x90]
mov word [rax], cx
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x260]
add eax, ecx
mov word [rsp + 0x338], ax
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x310]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3a0], rax
mov eax, dword [rsp + 0x8c]
add eax, 0xbd
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x268]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x120]
mov rax, qword [rsp + 0x268]
mov dword [rax], ecx
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x2f0]
sub eax, ecx
mov dword [rsp + 0x1b8], eax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x50]
and rax, rcx
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x90]
movsx edx, word [rax]
mov rax, qword [rsp + 0x160]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e4], ax
mov rax, qword [rsp + 0x138]
movzx edx, word [rax]
movzx eax, word [rsp + 0x260]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x338], ax
movsx edx, word [section..data]
mov rax, qword [rsp + 0x258]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x1e8], ax
movzx ecx, word [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x270], ax
movzx ecx, byte [rsp + 0x1b4]
movzx eax, byte [rsp + 0x420]
or ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
movsx edx, byte [rsp + 0x78]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x400], al
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x350]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3a0], rax
cmp dword [rsp + 0x8c], 0xce4c
jbe 0x140002053
mov rax, qword [rsp + 0x268]
mov eax, dword [rax]
mov dword [rsp + 0x124], eax
mov rax, qword [rsp + 0xf8]
imul rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d8], rax
movzx edx, word [rsp + 0x338]
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
and edx, eax
movzx eax, word [rsp + 0x100]
movzx ecx, word [rsp + 0x260]
sub eax, ecx
cmp edx, eax
jge 0x140002383
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [0x14000f044]
add ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rcx, qword [rsp + 0x2f8]
mov rcx, qword [rcx]
call fcn.140001040
jmp 0x140003e95
movzx edx, word [rsp + 0x100]
mov rax, qword [rsp + 0x138]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x14000e004], ax
lea rax, [rsp + 0x1e4]
mov qword [rsp + 0x108], rax
movzx eax, byte [rsp + 0x1b4]
mov byte [rsp + 0x2cc], al
lea rax, [rsp + 0x124]
mov qword [rsp + 0x148], rax
mov edx, dword [rsp + 0xf0]
imul edx, dword [rsp + 0x2f0]
mov ecx, dword [rsp + 0x1b8]
mov eax, dword [rsp + 0x74]
and eax, ecx
cmp edx, eax
jl 0x1400024ef
mov eax, dword [rsp + 0x74]
movzx ecx, al
mov eax, dword [rsp + 0x2f0]
sar eax, cl
mov dword [rsp + 0xf0], eax
mov rax, qword [rsp + 0x268]
mov eax, dword [rax]
mov dword [rsp + 0x454], eax
cmp dword [rsp + 0x454], 0x2c81
je 0x1400024d0
cmp dword [rsp + 0x454], 0x9762
je 0x14000243f
jmp 0x1400024ef
mov rcx, qword [rsp + 0x2f8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x50]
or rax, rcx
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x310]
movzx ecx, al
mov rax, qword [rsp + 0x2d8]
shl rax, cl
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x90]
movsx edx, word [rax]
mov rax, qword [rsp + 0x258]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x1e8], ax
movsx ecx, byte [rsp + 0x78]
movsx eax, byte [rsp + 0x400]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2cc]
add eax, ecx
mov byte [0x14000f044], al
jmp 0x1400024ef
movzx edx, word [rsp + 0x338]
mov rax, qword [rsp + 0x138]
movzx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x260], ax
mov edx, dword [rsp + 0x1b8]
imul edx, dword [rsp + 0x74]
mov ecx, dword [rsp + 0xf0]
mov eax, dword [rsp + 0x2f0]
sub eax, ecx
cmp edx, eax
jge 0x140002572
movzx eax, byte [rsp + 0x400]
mov byte [rsp + 0x240], al
mov rax, qword [rsp + 0x2f8]
mov rax, qword [rax]
add rax, qword [rsp + 0x1d8]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x398], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x358], rax
mov dword [rsp + 0x364], WriteFile
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x110], rax
mov eax, dword [rsp + 0x124]
mov dword [rsp + 0x1b0], eax
movzx eax, word [section..data]
mov word [rsp + 0x2a4], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x338]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2a4]
sub eax, ecx
mov word [section..data], ax
movzx eax, byte [rsp + 0x2cc]
movzx ecx, byte [rsp + 0x1b4]
sub eax, ecx
mov byte [rsp + 0x420], al
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x2f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x268]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x124]
add eax, ecx
mov dword [rsp + 0x1b0], eax
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x2d8]
add rax, rcx
mov qword [rsp + 0x350], rax
mov ecx, dword [rsp + 0xf0]
mov eax, dword [rsp + 0x1b8]
xor eax, ecx
mov dword [rsp + 0x2f0], eax
movsx edx, word [rsp + 0x1e8]
movsx eax, word [rsp + 0x1e4]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x2a4], ax
mov rax, qword [rsp + 0x2e0]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x240]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x2cc]
or ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
movzx eax, byte [rsp + 0x2cc]
movzx ecx, byte [rsp + 0x1b4]
and eax, ecx
mov byte [0x14000f044], al
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x100]
sub eax, ecx
mov word [rsp + 0x260], ax
mov rax, qword [rsp + 0x2f8]
mov rax, qword [rax]
add rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x310]
and rax, rcx
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x148]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x124]
add eax, ecx
mov dword [rsp + 0x1b0], eax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xf0]
add eax, ecx
mov dword [rsp + 0x1b8], eax
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78]
sub eax, ecx
mov byte [rsp + 0x240], al
movzx edx, byte [rsp + 0x420]
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x1b4], al
mov rax, qword [rsp + 0x138]
movzx edx, word [rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x100], ax
movzx edx, word [rsp + 0x260]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [0x14000e004], ax
mov rax, qword [rsp + 0x160]
movsx edx, word [rax]
mov rax, qword [rsp + 0x108]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x2a4], ax
mov rax, qword [rsp + 0x418]
movzx edx, byte [rax]
movzx eax, byte [0x14000f044]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov rax, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x320]
mov rax, qword [rsp + 0x2d8]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x110]
mov qword [rax], rcx
mov rax, qword [rsp + 0x148]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x268]
add eax, dword [rcx]
mov dword [rsp + 0x1b0], eax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x74]
add eax, ecx
mov dword [rsp + 0x1b8], eax
movzx edx, word [rsp + 0x100]
mov rax, qword [rsp + 0x138]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x260], ax
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x400]
add eax, ecx
mov byte [rsp + 0x78], al
movsx ecx, word [rsp + 0x1e4]
movsx eax, word [rsp + 0x1e8]
and ecx, eax
mov rax, qword [rsp + 0x90]
mov word [rax], cx
movsx edx, byte [rsp + 0x240]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0x108]
movsx edx, word [rax]
mov rax, qword [rsp + 0x160]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x1e8], ax
mov eax, dword [rsp + 0x364]
add eax, 0x77
mov dword [rsp + 0x364], eax
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x178], eax
mov rax, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x148]
mov ecx, dword [rsp + 0x1b0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0xf0]
movzx ecx, al
mov eax, dword [rsp + 0x1b8]
sar eax, cl
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x310]
xor rax, rcx
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x118]
movzx edx, word [rax]
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x100], ax
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x420]
or eax, ecx
mov byte [rsp + 0x1b4], al
movzx ecx, word [rsp + 0x338]
movzx eax, word [rsp + 0x100]
and ecx, eax
mov rax, qword [rsp + 0x138]
mov word [rax], cx
mov rax, qword [rsp + 0x160]
movsx edx, word [rax]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x1e4], ax
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x420]
sub ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov r11, qword [rsp + 0x268]
mov eax, dword [r11]
mov ecx, dword [rsp + 0x124]
sub ecx, eax
mov rax, qword [rsp + 0x148]
mov dword [rax], ecx
cmp dword [rsp + 0x364], 0xe44c
jne 0x1400025b7
movzx edx, word [rsp + 0x100]
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
add edx, eax
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
movzx ecx, word [0x14000e004]
add eax, ecx
cmp edx, eax
jle 0x140002b46
mov rcx, qword [rsp + 0x2f8]
mov rcx, qword [rcx]
call fcn.140001040
mov r11, qword [rsp + 0x398]
mov ecx, dword [rsp + 0x2f0]
mov eax, dword [r11]
and eax, ecx
mov dword [rsp + 0xf0], eax
mov rcx, qword [rsp + 0x320]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x3a0]
sub rax, rcx
mov qword [rsp + 0x350], rax
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.COMDLG32.dll_FindTextW]
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x2f8]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x1d8]
mov rax, qword [rsp + 0x2f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e0]
movsx r8d, byte [rax]
movsx eax, byte [rsp + 0x400]
add r8d, eax
movsx edx, byte [rsp + 0x240]
movsx eax, byte [rsp + 0x78]
movzx ecx, al
mov eax, edx
shl eax, cl
cmp r8d, eax
jle 0x140002b94
call fcn.140004100
movsx ecx, byte [rsp + 0x400]
movsx eax, byte [rsp + 0x78]
or ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x458], eax
cmp dword [rsp + 0x458], 0xfffffff8
je 0x140002bb1
jmp 0x140002c61
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
mov byte [rsp + 0x360], al
mov rax, qword [rsp + 0x3a0]
movzx ecx, al
mov rax, qword [rsp + 0x310]
shr rax, cl
mov qword [0x14000e008], rax
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x240]
xor eax, ecx
mov byte [rsp + 0x400], al
movzx eax, word [rsp + 0x1e8]
mov word [rsp + 0x40c], ax
movzx edx, word [0x14000e004]
mov rax, qword [rsp + 0x138]
movzx ecx, word [rax]
mov eax, edx
imul eax, ecx
mov word [rsp + 0x260], ax
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x110]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x2f8]
mov rax, qword [rax]
mov qword [rsp + 0x380], rax
jmp 0x140002cdb
mov r8, qword [rsp + 0x2f8]
mov r8, qword [r8]
mov rdx, qword [rsp + 0x2f8]
mov rdx, qword [rdx]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax]
call fcn.1400041f0
mov r11d, dword [rsp + 0x2f0]
mov eax, dword [rsp + 0x74]
sub eax, r11d
mov dword [rsp + 0xf0], eax
mov ecx, dword [rsp + 0x1b0]
mov eax, dword [rsp + 0x120]
sub eax, ecx
mov dword [rsp + 0x124], eax
mov rax, qword [rsp + 0x108]
movsx edx, word [rax]
mov rax, qword [rsp + 0x258]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e4], ax
call fcn.140004070
mov rax, qword [rsp + 0x2f8]
mov rax, qword [rax]
mov qword [0x14000f048], rax
lea rax, [0x14000f044]
mov qword [rsp + 0x68], rax
movzx edx, word [rsp + 0x338]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x100], ax
movzx eax, byte [rsp + 0x400]
mov byte [rsp + 0x328], al
mov rdx, qword [rsp + 0x320]
mov rdx, qword [rdx]
mov rax, qword [rsp + 0x110]
add rdx, qword [rax]
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x3a0]
add rax, rcx
cmp rdx, rax
ja 0x140002e88
movzx edx, word [rsp + 0x338]
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
sub edx, eax
movzx eax, word [rsp + 0x100]
movzx ecx, word [rsp + 0x260]
or eax, ecx
cmp edx, eax
jg 0x140002e46
mov rax, qword [rsp + 0x398]
mov eax, dword [rax]
mov edx, dword [rsp + 0xf0]
xor edx, eax
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x1b8]
add eax, ecx
cmp edx, eax
jge 0x140002dca
movzx ecx, byte [rsp + 0x1b4]
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
jmp 0x140002e0f
lea rax, [rsp + 0x120]
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x1b8]
add eax, ecx
mov dword [rsp + 0x2f0], eax
mov rax, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x420]
sub eax, ecx
mov byte [0x14000e002], al
jmp 0x140002e86
mov ecx, dword [rsp + 0x1b8]
mov rax, qword [rsp + 0x398]
mov edx, dword [rax]
shl edx, cl
mov eax, dword [rsp + 0x74]
movzx ecx, al
mov eax, dword [rsp + 0x2f0]
sar eax, cl
cmp edx, eax
jl 0x140002e86
movzx eax, word [0x14000e004]
movzx ecx, word [rsp + 0x338]
sub eax, ecx
mov word [rsp + 0x100], ax
jmp 0x140002ec7
movsx edx, byte [rsp + 0x240]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x400], al
movsx ecx, byte [rsp + 0x328]
movsx eax, byte [rsp + 0x240]
and ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
call fcn.1400040b0
movsx ecx, word [rsp + 0x40c]
movsx eax, word [rsp + 0x1e8]
or ecx, eax
mov rax, qword [rsp + 0x160]
mov word [rax], cx
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
mov word [rsp + 0x424], ax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x248], rax
mov eax, dword [rsp + 0x2d0]
add eax, 0x3f
mov dword [rsp + 0x2d0], eax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x1b8]
xor eax, ecx
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0x310]
mov rax, qword [rsp + 0x320]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x350], rax
mov rcx, qword [rsp + 0x310]
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
shl rax, cl
mov qword [0x14000e008], rax
mov rax, qword [rsp + 0x90]
movsx edx, word [rax]
mov rax, qword [rsp + 0x160]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x2a4], ax
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x260]
add eax, ecx
mov word [rsp + 0x100], ax
mov rax, qword [rsp + 0x160]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x160]
mov word [rax], cx
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x360]
sub eax, ecx
mov byte [rsp + 0x2cc], al
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x328]
sub eax, ecx
mov byte [rsp + 0x240], al
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x248]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x320]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x2d8]
add rax, rcx
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x300]
mov eax, dword [rax]
add eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x120], eax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x1d8]
sub rax, rcx
mov qword [0x14000f048], rax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x1e4], ax
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x360]
sub eax, ecx
mov byte [rsp + 0x1b4], al
cmp dword [rsp + 0x2d0], 0xe472
jb 0x140002f04
mov dword [rsp + 0x188], 0xc2719c3e
mov rax, qword [rsp + 0x2e0]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x328]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
mov byte [rsp + 0x2a8], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.NWBGqxho_t7gv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x340], rax
movzx eax, word [rsp + 0x338]
movzx ecx, word [rsp + 0x424]
or eax, ecx
mov word [rsp + 0x260], ax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x310]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x2d8], rax
mov eax, dword [rsp + 0x188]
xor eax, 0xc2759c3e
mov dword [rsp + 0x188], eax
lea rax, [rsp + 0x124]
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x118]
movzx edx, word [rax]
movzx eax, word [rsp + 0x100]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [0x14000e010], ax
mov rax, qword [rsp + 0x398]
mov eax, dword [rax]
cdq
idiv dword [rsp + 0x74]
mov dword [rsp + 0x2f0], eax
lea rax, [rsp + 0x424]
mov qword [rsp + 0x290], rax
mov dword [rsp + 0x2a0], 0xd18ede43
movzx eax, word [rsp + 0x2a4]
mov word [rsp + 0x58], ax
movsx edx, byte [rsp + 0x240]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x328], al
mov rax, qword [rsp + 0x68]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x418]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x1b4], al
mov eax, dword [rsp + 0x2a0]
sub eax, 0xd18dd883
mov dword [rsp + 0x2a0], eax
mov rax, qword [rsp + 0x108]
movzx eax, word [rax]
mov word [rsp + 0x394], ax
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov rcx, qword [0x14000f048]
add rcx, rax
mov rax, qword [rsp + 0x2f8]
mov qword [rax], rcx
mov eax, dword [rsp + 0x2f0]
mov dword [rsp + 0x404], eax
mov rax, qword [rsp + 0x300]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x1b0]
and eax, ecx
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x148]
mov eax, dword [rax]
mov dword [0x14000f040], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x348], eax
mov al, byte [rsp + 0x328]
mov byte [rsp + 0x45c], al
cmp byte [rsp + 0x45c], 0
je 0x1400032e8
cmp byte [rsp + 0x45c], 5
je 0x14000332a
jmp 0x140003343
lea rax, [rsp + 0x310]
mov qword [rsp + 0x150], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x2f4], eax
mov rax, qword [rsp + 0x290]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x290]
mov word [rax], cx
jmp 0x140003343
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2cc]
add eax, ecx
mov byte [rsp + 0x1b4], al
mov rax, qword [rsp + 0x470]
mov rax, qword [rax + 0xa188]
mov qword [rsp + 0x168], rax
movzx eax, word [rsp + 0x40c]
mov word [rsp + 0x298], ax
movsx eax, byte [rsp + 0x328]
movsx ecx, byte [rsp + 0x240]
sub eax, ecx
mov byte [rsp + 0x78], al
mov r8d, dword [rsp + 0x348]
mov edx, dword [rsp + 0x2a0]
mov ecx, dword [rsp + 0x188]
call qword [rsp + 0x168]
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x290]
movzx eax, word [rax]
mov word [rsp + 0x318], ax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x248]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x98]
mov qword [rax], rcx
mov rax, qword [rsp + 0x398]
mov ecx, dword [rsp + 0x74]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xf0], eax
lea rax, [rsp + 0x1e4]
mov qword [0x14000f050], rax
mov rax, qword [rsp + 0x268]
mov eax, dword [rax]
mov dword [rsp + 0x134], eax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x290]
movzx edx, word [rax]
mov rax, qword [rsp + 0x138]
movzx eax, word [rax]
or edx, eax
movzx eax, word [rsp + 0x338]
movzx ecx, word [rsp + 0x424]
xor eax, ecx
cmp edx, eax
jne 0x140003455
call fcn.1400040b0
jmp 0x140003483
mov rax, qword [rsp + 0x2e0]
movsx r8d, byte [rax]
movsx eax, byte [rsp + 0x328]
movzx ecx, al
sar r8d, cl
movsx edx, byte [rsp + 0x240]
movsx eax, byte [rsp + 0x78]
movzx ecx, al
mov eax, edx
shl eax, cl
mov dword [rsp + 0x368], 0xb93e59ad
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0x5c], al
mov dword [rsp + 0x130], 0xd5
mov rax, qword [rsp + 0x2e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x240]
add eax, ecx
mov byte [rsp + 0x78], al
lea rax, [rsp + 0x338]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x470]
add rax, 0x126c0
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x398]
mov eax, dword [rsp + 0xf0]
mov edx, dword [rcx]
sub edx, eax
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x1b8]
sub eax, ecx
cmp edx, eax
jle 0x140003e29
mov eax, dword [rsp + 0x1b0]
movzx ecx, al
mov eax, dword [rsp + 0x120]
shr eax, cl
mov dword [rsp + 0x134], eax
mov rax, qword [rsp + 0x68]
movzx r8d, byte [rax]
movzx eax, byte [rsp + 0x5c]
xor r8d, eax
mov rax, qword [rsp + 0x418]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x1b4]
movzx ecx, al
mov eax, edx
shl eax, cl
cmp r8d, eax
jne 0x1400035c4
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x248]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x1d8], rax
movzx eax, byte [rsp + 0x400]
mov byte [rsp + 0x408], al
mov rax, qword [rsp + 0x388]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x338]
and eax, ecx
mov word [rsp + 0x260], ax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2cc]
mov qword [rsp + 0x250], rax
mov eax, dword [rsp + 0x1b0]
mov edx, dword [rsp + 0x120]
add edx, eax
mov rax, qword [rsp + 0x268]
mov ecx, dword [rsp + 0x134]
mov eax, dword [rax]
sub eax, ecx
cmp edx, eax
jae 0x140003637
mov rcx, qword [rsp + 0x248]
mov rcx, qword [rcx]
call fcn.140001040
movsx ecx, word [section..data]
movsx eax, word [rsp + 0x298]
sub ecx, eax
mov rax, qword [rsp + 0x90]
mov word [rax], cx
mov dword [rsp + 0x1bc], 0xb8100
lea rax, [rsp + 0x420]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x258]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x58]
sub eax, ecx
mov word [rsp + 0x394], ax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x74]
add eax, ecx
mov dword [0x14000e014], eax
mov ecx, dword [rsp + 0x120]
mov eax, dword [rsp + 0x1b0]
and eax, ecx
mov dword [rsp + 0x124], eax
mov rax, qword [rsp + 0x248]
mov rax, qword [rax]
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rsp + 0x74]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0x1bc]
or eax, 0x402091
mov dword [rsp + 0x1bc], eax
lea rax, [rsp + 0x350]
mov qword [rsp + 0x330], rax
movzx edx, byte [rsp + 0x420]
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x2a8], al
movsx eax, byte [rsp + 0x328]
movsx ecx, byte [rsp + 0x408]
add eax, ecx
mov byte [rsp + 0x78], al
mov rax, qword [rsp + 0x388]
movzx eax, word [rax]
mov word [rsp + 0x1e0], ax
mov eax, dword [rsp + 0x1bc]
cmp dword [rsp + 0x130], eax
jae 0x140003bdf
movzx ecx, byte [rsp + 0x5c]
mov rax, qword [rsp + 0x250]
movzx eax, byte [rax]
or ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.XAc0Srm9Ioeb37x
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x160]
movsx edx, word [rax]
movsx eax, word [rsp + 0x394]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [section..data], ax
mov rax, qword [rsp + 0x280]
movzx eax, byte [rax]
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x1d8]
shl rax, cl
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2d8]
xor rcx, rax
mov rax, qword [rsp + 0x330]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x124]
mov eax, dword [rsp + 0x134]
and eax, ecx
mov dword [rsp + 0x120], eax
movzx ecx, byte [rsp + 0x368]
movzx eax, byte [rsp + 0x158]
rol al, cl
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0x398]
mov ecx, dword [rsp + 0x404]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1b8], eax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x400]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x290]
movzx edx, word [rax]
mov rax, qword [rsp + 0x138]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x318], ax
movzx eax, byte [rsp + 0x158]
add eax, dword [rsp + 0x368]
mov byte [rsp + 0x158], al
movzx eax, byte [rsp + 0x420]
movzx ecx, byte [rsp + 0x360]
sub eax, ecx
mov byte [rsp + 0x2a8], al
movzx ecx, word [rsp + 0x424]
mov rax, qword [rsp + 0x388]
movzx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x290]
mov word [rax], cx
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rsp + 0x158]
mov byte [rcx], al
mov rax, qword [rsp + 0x2e8]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x134]
add eax, ecx
mov dword [0x14000f040], eax
mov rax, qword [rsp + 0x398]
mov ecx, dword [rsp + 0x74]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x2f0], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x29c], eax
mov rax, qword [rsp + 0x330]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x320]
add rax, qword [rcx]
mov qword [rsp + 0x310], rax
mov ecx, dword [rsp + 0x134]
mov rax, qword [rsp + 0x2e8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1b0], eax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x248]
mov rax, qword [rax]
mov rcx, qword [rcx]
or rcx, rax
mov rax, qword [rsp + 0x2f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x280]
add rax, 1
mov qword [rsp + 0x280], rax
movsx edx, word [rsp + 0x1e4]
movsx eax, word [rsp + 0x1e8]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x108]
mov word [rax], cx
movzx eax, word [rsp + 0x260]
movzx ecx, word [rsp + 0x424]
xor eax, ecx
mov word [rsp + 0x318], ax
movsx eax, word [rsp + 0x2a4]
movsx ecx, word [rsp + 0x58]
add eax, ecx
mov word [rsp + 0x40c], ax
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1b4]
and eax, ecx
mov byte [rsp + 0x420], al
mov rax, qword [rsp + 0x60]
add rax, 1
mov qword [rsp + 0x60], rax
movsx edx, word [rsp + 0x298]
mov rax, qword [rsp + 0x160]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x300]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x268]
add ecx, dword [rax]
mov rax, qword [rsp + 0x300]
mov dword [rax], ecx
mov rax, qword [rsp + 0x398]
mov ecx, dword [0x14000e014]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x2f0], eax
mov rax, qword [rsp + 0x248]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1d8]
sub rcx, rax
mov rax, qword [rsp + 0x2f8]
mov qword [rax], rcx
mov eax, dword [rsp + 0x368]
rol eax, 0x15
mov dword [rsp + 0x368], eax
mov rcx, qword [rsp + 0x310]
mov rax, qword [rsp + 0x370]
sub rax, rcx
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x258]
movsx edx, word [rax]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x394], ax
mov eax, dword [rsp + 0x368]
add eax, 0xffeb
mov dword [rsp + 0x368], eax
movzx eax, word [rsp + 0x1e0]
movzx ecx, word [rsp + 0x260]
sub eax, ecx
mov word [rsp + 0x100], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.47K2WkvpS1Xyn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x278], rax
mov eax, dword [rsp + 0x130]
add eax, 0x5b53
mov dword [rsp + 0x130], eax
movsx eax, byte [rsp + 0x328]
movsx ecx, byte [rsp + 0x408]
and eax, ecx
mov byte [rsp + 0x400], al
mov rax, qword [rsp + 0x2b0]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x418]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x68]
mov byte [rax], cl
movzx edx, word [rsp + 0x260]
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [0x14000e004], ax
mov rcx, qword [rsp + 0x398]
mov eax, dword [rsp + 0x74]
mov ecx, dword [rcx]
or ecx, eax
mov rax, qword [rsp + 0x398]
mov dword [rax], ecx
jmp 0x14000372a
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov rdx, qword [rsp + 0xf8]
xor rdx, rax
mov rax, qword [rsp + 0x2f8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x248]
add rax, qword [rcx]
cmp rdx, rax
jle 0x140003c2a
mov rax, qword [rsp + 0x300]
mov ecx, dword [rax]
add ecx, dword [0x14000f040]
mov rax, qword [rsp + 0x148]
mov dword [rax], ecx
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x330]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x128], rax
movzx eax, byte [rsp + 0x420]
movzx ecx, byte [rsp + 0x360]
sub eax, ecx
mov byte [rsp + 0x2a8], al
mov rax, qword [rsp + 0x410]
add rax, 0xd4
mov qword [rsp + 0x1c0], rax
movzx eax, word [rsp + 0x2a4]
mov word [rsp + 0x308], ax
movzx ecx, word [rsp + 0x424]
mov rax, qword [rsp + 0x388]
movzx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x290]
mov word [rax], cx
mov rax, qword [rsp + 0x68]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x250]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x2a8], al
movsx edx, byte [rsp + 0x328]
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [0x14000e003], al
mov rax, qword [rsp + 0x170]
add rax, 0xd4
mov qword [rsp + 0x1c8], rax
movzx eax, byte [rsp + 0x408]
mov byte [rsp + 0x378], al
mov rax, qword [rsp + 0x398]
mov eax, dword [rax]
add eax, dword [0x14000e014]
mov dword [rsp + 0x1b8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x2f4], eax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x1d0], rax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x190], rax
mov rcx, qword [rsp + 0x248]
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x2f8]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x134]
mov eax, dword [rsp + 0x124]
sub eax, ecx
mov dword [rsp + 0x120], eax
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x88], al
lea rcx, [rsp + 0x1c0]
call qword [rsp + 0x410]
lea r11, [rsp + 0x328]
mov qword [rsp + 0x80], r11
mov rax, qword [rsp + 0x250]
movzx eax, byte [rax]
movzx ecx, byte [0x14000e002]
add eax, ecx
mov byte [rsp + 0x420], al
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax]
mov byte [0x14000f045], al
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x2b8], ax
mov rax, qword [rsp + 0x160]
movsx edx, word [rax]
movsx eax, word [rsp + 0x394]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x160]
mov word [rax], cx
jmp 0x140003e5f
mov ecx, dword [rsp + 0x404]
mov eax, dword [rsp + 0x1b8]
add eax, ecx
mov dword [rsp + 0xf0], eax
mov rax, qword [rsp + 0x108]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x2a4]
add ecx, eax
mov rax, qword [0x14000f050]
mov word [rax], cx
movsx eax, byte [rsp + 0x240]
movsx ecx, byte [rsp + 0x328]
sub eax, ecx
mov byte [rsp + 0x400], al
mov rax, qword [rsp + 0x108]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1e8]
sub eax, ecx
mov word [rsp + 0x1e4], ax
mov ecx, dword [rsp + 0xf0]
mov eax, dword [rsp + 0x2f0]
sub eax, ecx
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x2e0]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x78]
sub ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movzx edx, word [rsp + 0x338]
mov rax, qword [rsp + 0x138]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x260], ax
mov rax, qword [rsp + 0x2e0]
movzx ecx, byte [rax]
call fcn.140001000
jmp 0x140003f29
movzx eax, word [rsp + 0x260]
sub eax, 0xcaa
mov word [rsp + 0x100], ax
movsx edx, word [section..data]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x1e8], ax
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x1e8]
sub ecx, eax
mov rax, qword [rsp + 0x90]
mov word [rax], cx
call fcn.1400040b0
movzx edx, byte [rsp + 0x420]
movzx eax, byte [rsp + 0x1b4]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x418]
mov byte [rax], cl
jmp 0x140003fcb
movzx edx, byte [rsp + 0x1b4]
movzx eax, byte [rsp + 0x420]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [0x14000f044], al
movsx edx, word [section..data]
mov rax, qword [rsp + 0x90]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x1e8], ax
call fcn.1400041b0
mov r11, qword [rsp + 0x1d8]
mov rax, qword [rsp + 0xf8]
or rax, r11
mov qword [rsp + 0x50], rax
movsx ecx, byte [rsp + 0x400]
movsx eax, byte [rsp + 0x78]
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
movabs rcx, 0x7afa256be810a8
mov rax, qword [rsp + 0x2d8]
or rax, rcx
mov qword [rsp + 0x3a0], rax
movsx ecx, byte [rsp + 0x400]
shl ecx, 6
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
jmp 0x14000401d
call fcn.140004070
movabs rcx, 0x76c1755ce42714
mov rax, qword [rsp + 0xf8]
and rax, rcx
mov qword [rsp + 0x1d8], rax
mov r8, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0xf8]
mov cx, 0x4e
call fcn.1400041f0
mov eax, dword [rsp + 0x1b8]
add rsp, 0x468
ret