Function at 0x140067c90
Capabilities:
Check os version
Encode data using xor
Extract resource via kernel32 functions
Get hostname
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x1c30
call fcn.140157830
sub rsp, rax
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x1c20], rax
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rcx
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rcx, str.SHCORE.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
xor r15d, r15d
xor esi, esi
xor r14d, r14d
test rbx, rbx
je 0x140067d1b
lea rdx, str.SetProcessDPIAware
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.SetProcessDpiAwarenessContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rdi, rdi
je 0x140067d33
lea rdx, str.SetProcessDpiAwareness
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r14, r14
je 0x140067d46
mov rcx, 0xfffffffffffffffc
call r14
test eax, eax
je 0x140067d5e
test rsi, rsi
je 0x140067d56
mov ecx, 2
call rsi
test eax, eax
je 0x140067d5e
test r15, r15
je 0x140067d5e
call r15
test rbx, rbx
je 0x140067d6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
je 0x140067d7a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 2
call fcn.14012f8d4
mov rcx, rax
xor edx, edx
call fcn.140133c00
xor r14d, r14d
mov qword [0x1401bc5b0], r14
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14006800e
lea rdx, str.SetDllDirectoryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401bfd58], rax
test rax, rax
je 0x140067dd8
lea rcx, [0x14019945a]
call rax
jmp 0x14006800e
mov dword [rsp + 0x190], __WSAFDIsSet
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x194], 5
jne 0x14006800e
mov eax, dword [rsp + 0x198]
test eax, eax
jne 0x140067e27
lea rdx, str.Service_Pack_3
lea rcx, [rsp + 0x1a4]
call fcn.140157be0
test eax, eax
jns 0x140067e3e
jmp 0x14006800e
cmp eax, 1
jne 0x14006800e
cmp byte [rsp + 0x1a4], r14b
jb 0x14006800e
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x50], 4
lea r8, str.Using_Win2k__SP3____WinXP__No_SP_.._Checking_SafeDllSearch_n
mov edx, 3
lea rcx, vtable.Log.0
call fcn.1400155a0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdi, str.SystemCurrentControlSetControlSession_Manager
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140067f09
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rbx, str.SafeDllSearchMode
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140067efa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.HKLM
lea r8, str.Could_not_read_reg_key__s_subkey__s_value:__s_nError:__u_n
mov edx, 3
lea rcx, vtable.Log.0
call fcn.1400155a0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140067f35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, str.Could_not_open_reg_subkey:__s_nError:__u_n
mov edx, 3
lea rcx, vtable.Log.0
call fcn.1400155a0
lea rbx, str.SafeDllSearchMode
mov edx, 3
lea rcx, vtable.Log.0
cmp dword [rsp + 0x44], r14d
je 0x140068002
lea r8, str.Trying_to_set_SafeDllSearchMode_to_0_n
call fcn.1400155a0
mov dword [rsp + 0x44], r14d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140067fdf
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140067fd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Error_writing_SafeDllSearchMode._Error:__u_n
mov edx, 3
lea rcx, vtable.Log.0
call fcn.1400155a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006800e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Error_opening_Session_Manager_key_for_writing._Error:__u_n
mov edx, 3
lea rcx, vtable.Log.0
call fcn.1400155a0
jmp 0x14006800e
lea r8, str.SafeDllSearchMode_is_set_to_0_n
call fcn.1400155a0
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x1420]
call fcn.1401216a0
mov dword [rsp + 0x48], 0x400
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1420]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14006a5e9
mov edx, 0x66
lea r8d, [rdx - 0x5c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x14006a5e9
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test r15, r15
je 0x14006a5e9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], InitCommonControls
mov byte [rsp + 0xd0], r14b
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.14002dc40
nop
lea rdi, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe0]
cmp rsi, 1
jb 0x14006814a
lea r14, [rdi + rsi]
mov r8, rsi
mov edx, 0x20
mov rcx, rdi
call fcn.140121a70
mov rbx, rax
test rax, rax
je 0x140068147
cmp byte [rbx], 0x20
jne 0x14006811c
xor eax, eax
jmp 0x140068121
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400681ea
inc rbx
mov r8, r14
sub r8, rbx
mov edx, 0x20
mov rcx, rbx
call fcn.140121a70
mov rbx, rax
test rax, rax
jne 0x140068113
xor r14d, r14d
mov rdi, 0xffffffffffffffff
mov rbx, rdi
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], InitCommonControls
mov byte [rsp + 0xf0], 0
mov r8, rbx
cmp rsi, rbx
cmovb r8, rsi
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.14002dc40
lea rcx, [rsp + 0xf0]
call fcn.14002dbe0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rbx + 1]
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], InitCommonControls
mov byte [rsp + 0x130], 0
mov rax, qword [rsp + 0xe0]
cmp rax, rcx
jb 0x14006a614
jmp 0x1400681fc
sub rbx, rdi
mov rdi, 0xffffffffffffffff
xor r14d, r14d
jmp 0x140068154
sub rax, rcx
mov r8, rdi
cmp rax, 0xffffffffffffffff
cmovb r8, rax
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
add rdx, rcx
lea rcx, [rsp + 0x130]
call fcn.14002dc40
nop
mov r8d, 1
lea rdx, [0x14019dc98]
lea rcx, [rsp + 0x130]
call fcn.140047e60
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x160], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
lea rax, [rsp + 0x1420]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140068290
lea rdx, [rsp + 0x1420]
lea rcx, [rsp + 0x150]
call fcn.140047e60
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x120], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], InitCommonControls
mov byte [rax], 0
lea rcx, [rsp + 0x150]
call fcn.14002dbe0
nop
lea rcx, [rsp + 0x130]
call fcn.14002dbe0
lea r8, [rsp + 0x110]
cmp qword [rsp + 0x128], 0x10
cmovae r8, qword [rsp + 0x110]
mov edx, 0x400
lea rcx, [rsp + 0x1420]
call fcn.14012524c
lea rcx, [rsp + 0x1420]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140068333
mov r8d, 0x400
sub r8, rax
lea rcx, [rsp + 0x1420]
add rcx, rax
xor edx, edx
call fcn.1401216a0
lea rax, [rsp + 0x1420]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140068362
inc r8d
mov edx, r14d
test r8d, r8d
jle 0x1400683a7
lea rcx, [rsp + 0x1420]
lea r9, [0x14019e190]
nop word [rax + rax]
mov eax, edx
and eax, 7
movzx eax, byte [rax + r9]
xor byte [rcx], al
inc edx
lea rcx, [rcx + 1]
cmp edx, r8d
jl 0x140068390
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
movsxd r11, eax
test eax, eax
jle 0x1400683ee
mov r9, r14
mov r10d, r8d
nop dword [rax]
movzx edx, byte [rsp + r9 + 0x1420]
movsxd rax, r10d
lea rcx, [rsp + rax + 0x141f]
movzx eax, byte [rcx]
mov byte [rsp + r9 + 0x1420], al
mov byte [rcx], dl
sub r10d, 2
add r9, 2
cmp r9, r11
jl 0x1400683c0
mov edx, r14d
test r8d, r8d
jle 0x140068411
lea rcx, [rsp + 0x1420]
nop
lea eax, [rdx + r8]
add byte [rcx], al
inc edx
lea rcx, [rcx + 1]
cmp edx, r8d
jl 0x140068400
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x1820]
call fcn.1401216a0
lea rcx, [rsp + 0x1420]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140068431
mov dword [rsp + 0x48], eax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x1420]
lea rcx, [rsp + 0x1820]
call fcn.140067aa0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], InitCommonControls
mov byte [rsp + 0x78], 0
lea rax, [rsp + 0x1820]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140068483
mov r8, rdi
lea rdx, [rsp + 0x1820]
lea rcx, [rsp + 0x78]
call fcn.14002dc40
nop
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], InitCommonControls
mov byte [rsp + 0xf0], 0
cmp qword [rsp + 0xe0], rbx
cmovb rbx, qword [rsp + 0xe0]
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
mov r8, rbx
lea rcx, [rsp + 0xf0]
call fcn.14002dc40
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x170]
call fcn.14006a620
lea rcx, [rsp + 0x170]
call fcn.14002dbe0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x1310]
call fcn.1401216a0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x1200]
call fcn.1401216a0
mov r8d, 0x104
lea rdx, [rsp + 0x1310]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14006857a
mov edx, 0x5c
lea rcx, [rsp + 0x1310]
call fcn.140120eb0
mov byte [rax], 0
lea r8, [rsp + 0x1310]
mov edx, 0x104
lea rcx, [rsp + 0x1200]
call fcn.14012524c
lea r8, [0x14019c38c]
mov edx, 0x104
lea rcx, [rsp + 0x1200]
call fcn.1401252ac
lea r8, str.vnclang.dll
mov edx, 0x104
lea rcx, [rsp + 0x1200]
call fcn.1401252ac
lea rcx, [rsp + 0x1200]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
test rax, rax
cmove rcx, qword [rsp + 0x68]
mov qword [0x1401bc5b0], rcx
mov rbx, qword [rsp + 0x70]
cmp byte [rbx], r14b
movzx eax, byte [reloc.WS2_32.dll_accept]
cmove eax, r14d
mov byte [reloc.WS2_32.dll_accept], al
mov r9d, 0x3f
lea r8, [0x1401bb5f0]
mov edx, 0xc367
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb2f0]
mov edx, 0xc368
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb8f0]
mov edx, 0xc36a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbb70]
mov edx, 0xc36b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb9f0]
mov edx, 0xc36c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb970]
mov edx, 0xc36d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb9b0]
mov edx, 0xc36e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb6f0]
mov edx, 0xc36f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb870]
mov edx, 0xc370
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbc30]
mov edx, 0xc371
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb7b0]
mov edx, 0xc372
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb470]
mov edx, 0xc373
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbaf0]
mov edx, 0xc374
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bac30]
mov edx, 0xc375
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bad30]
mov edx, 0xc376
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb430]
mov edx, 0xc377
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baff0]
mov edx, 0xc378
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401badf0]
mov edx, 0xc379
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bacf0]
mov edx, 0xc37a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baef0]
mov edx, 0xc37b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bac70]
mov edx, 0xc37c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb030]
mov edx, 0xc37d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb0f0]
mov edx, 0xc37e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401badb0]
mov edx, 0xc37f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb2b0]
mov edx, 0xc380
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baf70]
mov edx, 0xc381
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb370]
mov edx, 0xc382
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bacb0]
mov edx, 0xc383
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bab30]
mov edx, 0xc384
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb3b0]
mov edx, 0xc385
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bab70]
mov edx, 0xc386
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baaf0]
mov edx, 0xc387
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bad70]
mov edx, 0xc388
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb0b0]
mov edx, 0xc389
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baeb0]
mov edx, 0xc38a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb330]
mov edx, 0xc38b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb3f0]
mov edx, 0xc38c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401babb0]
mov edx, 0xc38d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb230]
mov edx, 0xc38e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd3c0]
mov edx, 0xc38f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc740]
mov edx, 0xc390
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba9f0]
mov edx, 0xc391
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbb30]
mov edx, 0xc393
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb4b0]
mov edx, 0xc394
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bda80]
mov edx, 0xc395
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be880]
mov edx, 0xc396
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bd7c0]
mov edx, 0xc397
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bb570]
mov edx, 0xc398
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bba30]
mov edx, 0xc39a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcb80]
mov edx, 0xc39b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb730]
mov edx, 0xc39c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb7f0]
mov edx, 0xc39c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbcf0]
mov edx, 0xc39c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbe70]
mov edx, 0xc39f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bccc0]
mov edx, 0xc3a0
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bd500]
mov edx, 0xc3a1
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc900]
mov edx, 0xc3a2
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd2c0]
mov edx, 0xc3a3
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc8c0]
mov edx, 0xc3a4
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd640]
mov edx, 0xc3a5
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbe30]
mov edx, 0xc3a6
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc840]
mov edx, 0xc3a7
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc680]
mov edx, 0xc3a8
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbeb0]
mov edx, 0xc3a9
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd580]
mov edx, 0xc3aa
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd680]
mov edx, 0xc3ab
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc800]
mov edx, 0xc3ac
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcf80]
mov edx, 0xc3ad
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbf70]
mov edx, 0xc3ae
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcbc0]
mov edx, 0xc3af
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd080]
mov edx, 0xc3b0
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd700]
mov edx, 0xc3b1
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc470]
mov edx, 0xc3b2
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc230]
mov edx, 0xc3b3
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd4c0]
mov edx, 0xc3b4
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc980]
mov edx, 0xc3b5
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc6c0]
mov edx, 0xc3b6
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bce00]
mov edx, 0xc3b7
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc780]
mov edx, 0xc3b8
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd1c0]
mov edx, 0xc3b9
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcf40]
mov edx, 0xc3ba
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd240]
mov edx, 0xc3bb
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd000]
mov edx, 0xc3bc
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc2f0]
mov edx, 0xc3bd
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc880]
mov edx, 0xc3be
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc0b0]
mov edx, 0xc3bf
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc070]
mov edx, 0xc3c0
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcfc0]
mov edx, 0xc3c1
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc700]
mov edx, 0xc3c2
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcec0]
mov edx, 0xc3c3
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bcc00]
mov edx, 0xc3c4
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc9c0]
mov edx, 0xc3c5
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcd00]
mov edx, 0xc3c6
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbff0]
mov edx, 0xc3c7
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc3b0]
mov edx, 0xc3c8
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bc600]
mov edx, 0xc3c9
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd280]
mov edx, 0xc3ca
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc570]
mov edx, 0xc3cb
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bbc70]
mov edx, 0xc3cc
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd600]
mov edx, 0xc3cd
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcc80]
mov edx, 0xc3ce
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc030]
mov edx, 0xc3cf
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcf00]
mov edx, 0xc3d0
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd440]
mov edx, 0xc3d1
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc2b0]
mov edx, 0xc3d2
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd300]
mov edx, 0xc3d3
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd0c0]
mov edx, 0xc3d4
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbfb0]
mov edx, 0xc3d5
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd6c0]
mov edx, 0xc3d6
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb670]
mov edx, 0xc3d7
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc1f0]
mov edx, 0xc440
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc270]
mov edx, 0xc441
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd040]
mov edx, 0xc442
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd400]
mov edx, 0xc443
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc170]
mov edx, 0xc444
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bca80]
mov edx, 0xc445
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc3f0]
mov edx, 0xc446
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc0f0]
mov edx, 0xc447
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc5c0]
mov edx, 0xc448
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd480]
mov edx, 0xc449
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bca00]
mov edx, 0xc44a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc530]
mov edx, 0xc44b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc430]
mov edx, 0xc44c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbf30]
mov edx, 0xc44d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bce40]
mov edx, 0xc44e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc7c0]
mov edx, 0xc44f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbdb0]
mov edx, 0xc3d8
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbdf0]
mov edx, 0xc3d9
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbd70]
mov edx, 0xc3da
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bbbb0]
mov edx, 0xc3db
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb530]
mov edx, 0xc3dc
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd780]
mov edx, 0xc3de
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcd80]
mov edx, 0xc3dd
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x80
lea r8, [0x1401bd340]
mov edx, 0xc3df
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd740]
mov edx, 0xc3e0
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbd30]
mov edx, 0xc3e1
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbab0]
mov edx, 0xc3e2
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be040]
mov edx, 0xc3e4
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd8c0]
mov edx, 0xc3e5
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb170]
mov edx, 0xc3e6
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdd00]
mov edx, 0xc3e7
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baa30]
mov edx, 0xc3e8
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be240]
mov edx, 0xc3e9
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be740]
mov edx, 0xc3ea
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba970]
mov edx, 0xc3eb
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be900]
mov edx, 0xc3ec
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd9c0]
mov edx, 0xc3ed
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdbc0]
mov edx, 0xc3ee
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be3c0]
mov edx, 0xc3ef
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be0c0]
mov edx, 0xc3f0
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baa70]
mov edx, 0xc3f1
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdc00]
mov edx, 0xc3f2
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be500]
mov edx, 0xc3f3
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bafb0]
mov edx, 0xc3f4
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd840]
mov edx, 0xc3f5
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be440]
mov edx, 0xc3f6
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdc40]
mov edx, 0xc3f7
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be300]
mov edx, 0xc3f8
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd940]
mov edx, 0xc3f9
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb070]
mov edx, 0xc3fa
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdb80]
mov edx, 0xc3fb
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be380]
mov edx, 0xc3fc
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba830]
mov edx, 0xc3fd
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba9b0]
mov edx, 0xc3fe
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401babf0]
mov edx, 0xc3ff
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be000]
mov edx, 0xc400
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bae30]
mov edx, 0xc401
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be8c0]
mov edx, 0xc402
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdb40]
mov edx, 0xc403
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be2c0]
mov edx, 0xc404
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bda00]
mov edx, 0xc405
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be680]
mov edx, 0xc406
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bde00]
mov edx, 0xc407
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdec0]
mov edx, 0xc408
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb270]
mov edx, 0xc409
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be580]
mov edx, 0xc40a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be140]
mov edx, 0xc40b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdd80]
mov edx, 0xc40c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb130]
mov edx, 0xc40d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baf30]
mov edx, 0xc40e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be640]
mov edx, 0xc40f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdb00]
mov edx, 0xc410
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd900]
mov edx, 0xc411
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdf00]
mov edx, 0xc412
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be340]
mov edx, 0xc413
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bda40]
mov edx, 0xc414
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be280]
mov edx, 0xc415
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401be180]
mov edx, 0xc416
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be840]
mov edx, 0xc417
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401baab0]
mov edx, 0xc418
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be5c0]
mov edx, 0xc419
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be200]
mov edx, 0xc41a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be600]
mov edx, 0xc41b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdcc0]
mov edx, 0xc41c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd880]
mov edx, 0xc41d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba8b0]
mov edx, 0xc41e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb630]
mov edx, 0xc41f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb930]
mov edx, 0xc420
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb4f0]
mov edx, 0xc421
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be4c0]
mov edx, 0xc422
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be6c0]
mov edx, 0xc423
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be480]
mov edx, 0xc424
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdf80]
mov edx, 0xc425
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdf40]
mov edx, 0xc426
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdc80]
mov edx, 0xc427
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be540]
mov edx, 0xc428
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb1b0]
mov edx, 0xc429
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bae70]
mov edx, 0xc42a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be940]
mov edx, 0xc42b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdd40]
mov edx, 0xc42c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be080]
mov edx, 0xc42d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be100]
mov edx, 0xc42e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba7f0]
mov edx, 0xc42f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401ba8f0]
mov edx, 0xc430
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba870]
mov edx, 0xc431
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb830]
mov edx, 0xc432
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb8b0]
mov edx, 0xc433
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401be780]
mov edx, 0xc434
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba770]
mov edx, 0xc435
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb770]
mov edx, 0xc436
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb6b0]
mov edx, 0xc437
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bde40]
mov edx, 0xc438
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bdfc0]
mov edx, 0xc439
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be700]
mov edx, 0xc43a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bb1f0]
mov edx, 0xc43b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be400]
mov edx, 0xc43c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401ba7b0]
mov edx, 0xc43d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd980]
mov edx, 0xc43e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bddc0]
mov edx, 0xc43f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bde80]
mov edx, 0xc45f
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401be800]
mov edx, 0xc462
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc940]
mov edx, 0xc450
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd200]
mov edx, 0xc451
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd100]
mov edx, 0xc452
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc4f0]
mov edx, 0xc453
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc370]
mov edx, 0xc454
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc130]
mov edx, 0xc455
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcac0]
mov edx, 0xc456
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcdc0]
mov edx, 0xc457
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcd40]
mov edx, 0xc458
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc330]
mov edx, 0xc459
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bc4b0]
mov edx, 0xc45a
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcb40]
mov edx, 0xc45b
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bba70]
mov edx, 0xc45c
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bbef0]
mov edx, 0xc45d
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bcb00]
mov edx, 0xc45e
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x3f
lea r8, [0x1401bd5c0]
mov edx, 0xc460
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 0x7f
lea r8, [0x1401bd140]
mov edx, 0xc461
mov rcx, qword [0x1401bc5b0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r8, rbx
lea rcx, [rsp + 0x230]
call fcn.14006b6f0
nop
movzx eax, byte [rsp + 0x91d]
mov byte [rsp + 0x40], al
nop
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x14006a500
mov byte [reloc.WS2_32.dll_accept], 0
cmp byte [rsp + 0x248], 0
je 0x14006a469
cmp byte [rsp + 0x240], 0
jne 0x14006a483
mov r9d, dword [rsp + 0x804]
lea r8, [rsp + 0x709]
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.14006b830
jmp 0x14006a483
cmp byte [rsp + 0x240], 0
jne 0x14006a483
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.14006b7d0
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x14006a4fb
nop dword [rax]
mov rcx, qword [0x1401b7f38]
test rcx, rcx
je 0x14006a4c5
lea r8, [rsp + 0xa0]
mov rdx, qword [0x1401b7f40]
call qword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x14006a4e1
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x14006a4a0
jmp 0x14006a420
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r8, str.Exiting_n
mov edx, 3
lea rcx, vtable.Log.0
call fcn.1400155a0
cmp byte [rsp + 0x40], 0
je 0x14006a530
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401ba762], 0
je 0x14006a554
nop dword [rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401ba762], 0
jne 0x14006a540
mov ebx, dword [rsp + 0xb0]
lea rax, vtable.VNCviewerApp32.0
mov qword [rsp + 0x230], rax
mov rcx, qword [rsp + 0x11f8]
test rcx, rcx
je 0x14006a581
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rax, vtable.VNCviewerApp.0
mov qword [rsp + 0x230], rax
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r8, str.VNC_viewer_closing_down_n
mov edx, 2
lea rcx, vtable.Log.0
call fcn.1400155a0
lea rcx, [rsp + 0x11d0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rsp + 0x238]
call fcn.140062190
nop
lea rcx, [rsp + 0x110]
call fcn.14002dbe0
nop
lea rcx, [rsp + 0xd0]
call fcn.14002dbe0
mov eax, ebx
jmp 0x14006a5eb
xor eax, eax
mov rcx, qword [rsp + 0x1c20]
xor rcx, rsp
call fcn.14011c340
lea r11, [rsp + 0x1c30]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140047ef0
nop
int3