Function at 0x1400028f0
Capabilities:
Change the wallpaper
Check for foreground window switch
Check for unmoving mouse cursor
Check os version
Create process on windows
Create thread
Enumerate gui resources
Enumerate processes
Get common file path
Get system information on windows
Log keystrokes via application hook
Log keystrokes via polling
Resume thread
Suspend thread
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov eax, 0x1658
push rdi
call fcn.140015680
sub rsp, rax
lea rax, [sym.__gxx_personality_sj0]
mov qword [rsp + 0x110], rax
lea rax, [0x1400351b8]
mov qword [rsp + 0x118], rax
lea rax, [0x14000b280]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x1670], rcx
mov rcx, rax
mov dword [rsp + 0x1678], edx
mov qword [rsp + 0x1680], r8
mov qword [rsp + 0x1688], r9
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x130], rsp
mov qword [rsp + 0x68], rax
call dbg._Unwind_SjLj_Register
cmp dword [rsp + 0x1678], 0x111
je 0x1400041e0
jbe 0x140002a10
cmp dword [rsp + 0x1678], 0x201
je 0x140003080
jbe 0x140002c00
cmp dword [rsp + 0x1678], 0x312
je 0x1400030b0
cmp dword [rsp + 0x1678], 0x403
jne 0x14000302f
cmp qword [rsp + 0x1688], 0x203
je 0x140004358
cmp qword [rsp + 0x1688], 0x205
je 0x140006870
nop dword [rax]
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
call sym._Unwind_SjLj_Unregister
mov rax, qword [rsp + 0x70]
add rsp, 0x1658
pop rdi
pop rbp
ret
cmp dword [rsp + 0x1678], 5
je 0x140003020
jbe 0x140002f38
cmp dword [rsp + 0x1678], 6
je 0x140003150
cmp dword [rsp + 0x1678], 0x4e
jne 0x14000302f
mov rax, qword [rsp + 0x1688]
mov eax, dword [rax + 0x10]
cmp eax, 0xfffffffc
je 0x1400042c8
cmp eax, 0xfffffffe
je 0x1400064e0
cmp eax, 0xfffffb20
jne 0x140003010
mov rax, qword [rsp + 0x1688]
mov rcx, qword [rax]
cmp rcx, qword [0x140038098]
jne 0x140003010
mov eax, dword [rax + 0x24]
lea rdx, [rsp + 0x590]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x1688]
movd xmm3, dword [rsp + 0x70]
movd xmm0, dword [rax + 0x18]
mov dword [rsp + 0xe8], 0xffffffff
punpckldq xmm0, xmm3
movq qword [rsp + 0x590], xmm0
call qword [sym.imp.USER32.dll_ClientToScreen]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov r8d, 1
mov edx, 0x400
cmp dword [0x1400380bc], 1
mov dword [rsp + 0xe8], 0xffffffff
mov rdi, rax
lea r9, [0x14002d31e]
mov rcx, rdi
mov qword [rsp + 0x70], rdi
lea rax, [0x14002d315]
cmovne r9, rax
call qword [sym.imp.USER32.dll_AppendMenuA]
xor r8d, r8d
mov edx, 1
cmp dword [0x1400380bc], 2
mov rcx, qword [rsp + 0x70]
sete r8b
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rcx, qword [0x140038058]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0x70]
mov edx, 0x100
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x1670]
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x594]
mov r8d, dword [rsp + 0x590]
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, qword [0x140038058]
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [rsp + 0x70], 1
jne 0x140003010
xor eax, eax
cmp dword [0x1400380bc], 0
mov rcx, qword [str.StudentMain.exe]
sete al
mov dword [rsp + 0x70], eax
call sym.GetProcessIDFromName_char_const_
mov edx, dword [rsp + 0x70]
mov ecx, eax
call sym.SuspendProcess_unsigned_long__int_
test eax, eax
je 0x14000ac86
mov rcx, qword [0x140038090]
lea rdx, [0x14002dd0d]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
mov r8d, 2
mov edx, 0x113
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x140003010
cmp dword [rsp + 0x1678], 0x112
je 0x140003220
cmp dword [rsp + 0x1678], 0x113
jne 0x14000302f
cmp qword [rsp + 0x1680], 2
je 0x140002c68
cmp qword [rsp + 0x1680], 3
je 0x1400065e0
cmp qword [rsp + 0x1680], 1
jne 0x140003010
cmp byte [0x1400380ba], 0
jne 0x140002c68
cmp byte [0x1400380b9], 0
jne 0x140006a47
nop dword [rax]
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
call sym.RandomWindowTitle__
mov rcx, qword [rsp + 0x1670]
mov rdx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowTextA]
mov qword [rsp + 0x98], rax
call rax
mov rax, qword [str.StudentMain.exe]
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
mov qword [rsp + 0x90], rax
call sym.CreateToolhelp32Snapshot
mov rdx, rdi
mov qword [rsp + 0x70], rdi
mov rcx, rax
mov qword [rsp + 0x88], rax
call sym.Process32First
test eax, eax
je 0x140006470
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x140002d25
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call sym.Process32Next
test eax, eax
je 0x140006470
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140002d00
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x598]
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x80]
test ecx, ecx
je 0x140006489
mov ecx, dword [rsp + 0x80]
lea rdi, [rsp + 0x5a0]
mov dword [rsp + 0xe8], 0xffffffff
call sym.GetProcessState_unsigned_long_
mov qword [rsp + 0x78], rdi
cmp eax, 0xffffffff
mov dword [0x1400380bc], eax
mov qword [rsp + 0x590], rdi
mov qword [rsp + 0x598], 0
mov byte [rsp + 0x5a0], 0
je 0x1400069fe
test eax, eax
je 0x140006973
cmp eax, 1
mov rcx, rdi
je 0x140009213
mov r9d, dword [rsp + 0x80]
mov r8, rcx
lea rdx, str._s_PID:_d_
call sym.sprintf_char__char_const__::_
mov r8d, 1
mov edx, 0x401
mov r9, qword [rsp + 0x590]
mov rcx, qword [0x140038090]
mov dword [rsp + 0xe8], 0x14
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x140038098]
lea rdx, [0x14002d479]
mov rax, qword [rsp + 0x98]
call rax
mov ecx, 8
call sym.operator_new_unsigned_long_long_
mov qword [rsp + 0x70], rax
mov rdx, rax
mov qword [rax], 0
lea rcx, [sym.EnumWindowsProc_HWND____long_long_]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x140002e8f
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x13
mov edi, eax
mov rax, qword [rsp + 0x70]
and edi, 1
mov dword [rsp + 0x90], edi
mov rcx, qword [rax]
xor eax, eax
test rcx, rcx
mov qword [0x1400382f0], rcx
mov edx, 0x3f6
setne al
mov rcx, qword [rsp + 0x1670]
mov dword [rsp + 0xe8], 0x14
mov dword [rsp + 0x70], eax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [rsp + 0x90]
lea r8, [0x14002d30a]
mov dword [rsp + 0xe8], 0x14
lea rax, [0x14002d2ff]
mov rcx, qword [rsp + 0x1670]
test edx, edx
mov edx, 0x3f6
cmovne r8, rax
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rsp + 0x590]
mov rax, qword [rsp + 0x78]
cmp rcx, rax
je 0x140003010
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x140003010
cmp dword [rsp + 0x1678], 1
je 0x140003380
cmp dword [rsp + 0x1678], 2
jne 0x14000302f
mov rax, qword [sym.imp.USER32.dll_UnregisterHotKey]
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x1670]
mov qword [rsp + 0x70], rax
call rax
mov rcx, qword [rsp + 0x1670]
mov edx, 1
mov rax, qword [rsp + 0x70]
call rax
mov edx, 2
mov rcx, qword [rsp + 0x1670]
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140038058]
mov qword [rsp + 0x70], rax
call rax
mov rcx, qword [0x140038048]
mov rax, qword [rsp + 0x70]
call rax
mov rcx, qword [0x140038050]
mov rax, qword [rsp + 0x70]
call rax
lea rdx, [0x1400380e0]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov rax, qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140038308]
mov qword [rsp + 0x70], rax
call rax
mov rcx, qword [0x140038310]
mov rax, qword [rsp + 0x70]
call rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
nop dword [rax]
mov qword [rsp + 0x70], 1
jmp 0x1400029f1
cmp qword [rsp + 0x1680], 1
je 0x140004389
mov eax, dword [rsp + 0x1678]
cmp dword [0x140038040], eax
je 0x1400063f0
mov r9, qword [rsp + 0x1688]
mov dword [rsp + 0xe8], 0xffffffff
mov r8, qword [rsp + 0x1680]
mov edx, dword [rsp + 0x1678]
mov rcx, qword [rsp + 0x1670]
call qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rsp + 0x70], rax
jmp 0x1400029f1
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
mov r8d, 2
mov edx, 0xa1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x140003010
cmp qword [rsp + 0x1680], 1
je 0x1400065a0
cmp qword [rsp + 0x1680], 2
je 0x140006410
cmp qword [rsp + 0x1680], 0
jne case.0x140004207.1003
cmp byte [0x1400380b8], 0
je 0x140006940
mov rcx, qword [rsp + 0x1670]
mov edx, 3
mov byte [0x1400380b8], 0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_KillTimer]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x590]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rsp + 0x590]
cmp ecx, eax
je case.0x140004207.1003
mov edx, 1
call sym.KillProcess_unsigned_long__int_
jmp case.0x140004207.1003
cmp word [rsp + 0x1680], 0
jne 0x140004210
mov rax, qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xfffffff0
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x1670]
mov qword [rsp + 0x70], rax
call rax
test eax, 0x10000000
je case.0x140004207.1003
call qword [sym.imp.USER32.dll_GetFocus]
mov r8d, 7
mov rcx, rax
mov qword [0x1400382f8], rax
lea rax, [rsp + 0x590]
mov rdx, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [rsp + 0x78]
lea rdx, str.Button
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne case.0x140004207.1003
mov rcx, qword [0x1400382f8]
mov edx, 0xfffffff0
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x70]
call rax
and eax, 3
cmp eax, 3
je case.0x140004207.1003
mov rcx, qword [0x1400382f8]
mov r9d, 1
xor r8d, r8d
mov edx, 0xf4
call qword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x140004207.1003
cmp qword [rsp + 0x1680], 4
je 0x140006690
jbe 0x1400032b0
cmp qword [rsp + 0x1680], 0xf020
je 0x140006660
cmp qword [rsp + 0x1680], 0xf060
jne 0x140003270
mov dword [rsp + 0xe8], 0xffffffff
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400043a9
nop
mov r9, qword [rsp + 0x1688]
mov edx, 0x112
mov dword [rsp + 0xe8], 0xffffffff
mov r8, qword [rsp + 0x1680]
mov rcx, qword [rsp + 0x1670]
call qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rsp + 0x70], rax
jmp 0x1400029f1
cmp qword [rsp + 0x1680], 2
je 0x140006790
cmp qword [rsp + 0x1680], 3
jne 0x140003270
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
lea rcx, str.TaskManagerWindow
mov qword [rsp + 0x70], rax
call rax
test rax, rax
mov qword [rsp + 0x78], rax
je 0x140006381
mov rcx, qword [rsp + 0x78]
lea rdi, [rsp + 0x598]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetMenu]
mov ecx, 9
xor r8d, r8d
mov edx, 0x7704
lea r9, [rsp + 0x590]
mov r10, rax
xor eax, eax
rep stosq qword [rdi], rax
mov rax, qword [0x14002e160]
mov rcx, r10
mov qword [rsp + 0x590], rax
call qword [sym.imp.USER32.dll_GetMenuItemInfoA]
test byte [rsp + 0x59c], 8
je 0x1400069e0
mov rcx, qword [0x140038090]
lea rdx, [0x14002dc40]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x140003270
lea rdi, [rsp + 0x194]
xor eax, eax
mov ecx, 0x12
rep stosq qword [rdi], rax
lea rcx, [rsp + 0x190]
mov dword [rsp + 0x190], 0x94
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
mov ecx, 6
rep stosq qword [rdi], rax
lea rcx, [rsp + 0x160]
lea rdi, [rsp + 0x398]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
mov ecx, 0x3f
mov qword [rsp + 0x390], 0
rep stosq qword [rdi], rax
movzx eax, word [rsp + 0x160]
cmp ax, 9
je 0x1400042b8
cmp ax, 6
je 0x1400042b8
mov eax, 0x20
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x19c]
lea rdi, [rsp + 0x390]
mov r8d, dword [rsp + 0x194]
lea rdx, [0x14002d357]
mov rcx, rdi
mov qword [rsp + 0x70], rdi
mov r9d, dword [rsp + 0x198]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14002d328]
mov qword [rsp + 0x38], 0x40
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
mov rcx, qword [rsp + 0x70]
call sym.strlen
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, r8
jb 0x14000adb1
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140038320]
mov dword [rsp + 0xe8], 0xffffffff
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
call sym.EnableDebugPrivilege__
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov qword [rsp + 0x70], rax
call rax
mov ecx, 1
sub eax, 1
mov dword [0x1400380c4], eax
mov rax, qword [rsp + 0x70]
call rax
lea rcx, str.TaskbarCreated
sub eax, 1
mov dword [0x1400380c0], eax
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x140038040], eax
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [sym.ThreadProc_void_]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x70], rax
call rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [0x140038058], rax
lea r8, [sym.KeyHookThreadProc_void_]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [0x140038048], rax
lea r8, [sym.MouseHookThreadProc_void_]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call rax
xor r9d, r9d
mov r8d, 0x3e8
mov edx, 1
mov qword [0x140038050], rax
mov rax, qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [rsp + 0x1670]
mov qword [rsp + 0x70], rax
call rax
xor r9d, r9d
mov r8d, 0x7d0
mov edx, 2
mov rcx, qword [rsp + 0x1670]
mov rax, qword [rsp + 0x70]
call rax
xor edx, edx
mov r9d, 0x43
mov r8d, 1
mov rax, qword [sym.imp.USER32.dll_RegisterHotKey]
mov rcx, qword [rsp + 0x1670]
mov qword [rsp + 0x70], rax
call rax
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x57
mov r8d, 1
mov edx, 1
mov rax, qword [rsp + 0x70]
call rax
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x42
mov r8d, 1
mov rax, qword [rsp + 0x70]
mov edx, 2
call rax
test eax, eax
jne 0x140003650
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x31
lea r8, [0x14002d36a]
lea rdx, [0x14002d380]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x1400069aa
mov rax, qword [rsp + 0x1688]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d3f8]
lea rdi, [rsp + 0x598]
mov rax, qword [rax + 8]
mov dword [rsp + 0x38], 0x14
mov qword [rsp + 0x40], rdx
lea rdx, str.SysLink
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0x3e9
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rax
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 8
mov dword [rsp + 0xe8], 0xffffffff
mov qword [rsp + 0x78], rax
call rax
mov r11, qword [rsp + 0x78]
mov r9d, 0x50010000
xor ecx, ecx
mov rdx, qword [rsp + 0x1670]
mov qword [0x140038088], rax
lea r8, [0x14002d44e]
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0x3ea
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 0x5a
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0xa6
call r11
lea rdx, [rsp + 0x590]
mov ecx, 0x3f
mov qword [rsp + 0x590], 0
mov qword [0x1400380a0], rax
xor eax, eax
rep stosq qword [rdi], rax
mov rcx, rdx
mov qword [rsp + 0x80], rdx
call sym.GetMythwarePasswordFromRegedit_char_
mov rdi, qword [rsp + 0x70]
mov ecx, 0x200
mov r9d, 0x50010800
test eax, eax
mov r10, qword [rsp + 0x1670]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
lea rdx, str.Edit
mov qword [rsp + 0x48], 0x3eb
mov dword [rsp + 0x38], 0x14
lea r8, [0x14002d2a6]
mov qword [rsp + 0x50], rdi
cmovne r8, qword [rsp + 0x80]
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x30], 0xf8
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 8
mov dword [rsp + 0xe8], 0xffffffff
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010001
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d464]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x32
mov qword [rsp + 0x48], 0x3f5
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0xf8
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 8
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x5001000c
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d479]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x32
mov qword [rsp + 0x48], 0x3ec
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0xf8
mov dword [rsp + 0x28], 0x7a
mov dword [rsp + 0x20], 8
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50000000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d482]
mov qword [0x140038098], rax
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.msctls_statusbar32
mov qword [rsp + 0x48], 0x3ed
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r11
mov r10, qword [sym.imp.USER32.dll_SendMessageA]
lea r9, [rsp + 0x158]
mov r8d, 2
mov rcx, rax
mov qword [0x140038090], rax
mov edx, 0x404
mov rax, qword [0x14002e128]
mov qword [rsp + 0x80], r10
mov qword [rsp + 0x158], rax
call r10
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50000007
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d49e]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x62
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0xf8
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0x108
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d4ab]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x48], 0x3ef
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x1c
mov dword [rsp + 0x20], 0x110
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d4bc]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x48], 0x3f0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x42
mov dword [rsp + 0x20], 0x110
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d4c9]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x48], 0x3f1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x42
mov dword [rsp + 0x20], 0x188
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d4d9]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x48], 0x3f2
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x1c
mov dword [rsp + 0x20], 0x188
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x58010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d30a]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x48], 0x3f6
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x28], 0x70
mov dword [rsp + 0x20], 0x108
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d4e8]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x1e
mov qword [rsp + 0x48], 0x3f7
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x28], 0x70
mov dword [rsp + 0x20], 0x188
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, str.MeltdownDFC
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x16
mov qword [rsp + 0x48], 0x3fb
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x28], 0x96
mov dword [rsp + 0x20], 0x108
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010000
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d505]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x16
mov qword [rsp + 0x48], 0x3fc
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x28], 0x96
mov dword [rsp + 0x20], 0x188
call r11
mov rdi, qword [rsp + 0x70]
mov r9d, 0x50010003
xor ecx, ecx
mov rdx, qword [rsp + 0x1670]
lea r8, [0x14002d50c]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x12
mov qword [rsp + 0x48], 0x3f4
mov qword [rsp + 0x50], rdi
lea rdi, [rsp + 0x230]
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x30], 0x82
mov dword [rsp + 0x28], 0xb0
mov dword [rsp + 0x20], 0x181
call r11
mov ecx, 0x23
mov r8d, 3
mov edx, 2
mov qword [0x140038060], rax
xor eax, eax
rep stosq qword [rdi], rax
mov rax, qword [0x14002e130]
mov dword [rdi], 0
mov qword [rsp + 0x230], rax
mov rax, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [rsp + 0x238], 1
mov qword [rsp + 0x88], rax
call rax
mov r8d, 3
mov edx, 1
mov rcx, rax
mov rax, qword [rsp + 0x88]
call rax
mov r8d, 3
mov edx, 0x20
mov rcx, rax
mov rax, qword [rsp + 0x88]
call rax
mov edx, 0x23
mov r8, rax
lea rax, [rsp + 0x230]
mov rcx, rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov rdi, qword [rsp + 0x70]
lea r8, [0x14002d51d]
mov qword [rsp + 0x58], 0
cmp eax, 1
mov r11, qword [rsp + 0x78]
mov qword [rsp + 0x48], 0x3f3
mov rdx, qword [rsp + 0x1670]
sbb eax, eax
mov dword [rsp + 0x38], 0x12
xor ecx, ecx
and eax, 0x8000000
mov dword [rsp + 0x30], 0x41
mov qword [rsp + 0x50], rdi
lea r9d, [rax + 0x50010003]
mov dword [rsp + 0x28], 0xb0
mov qword [rsp + 0x40], rdx
lea rdx, str.Button
mov dword [rsp + 0x20], 0x135
mov dword [rsp + 0xe8], 0xffffffff
call r11
xor r9d, r9d
mov r10, qword [rsp + 0x80]
mov r8d, 1
mov rcx, rax
mov edx, 0xf1
mov qword [0x140038068], rax
call r10
mov r10, qword [rsp + 0x80]
xor r9d, r9d
mov r8d, 0x3f3
mov rcx, qword [rsp + 0x1670]
mov edx, 0x111
call r10
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010003
mov rax, qword [rsp + 0x1670]
lea r8, [0x14002d526]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
lea rdx, str.Button
mov qword [rsp + 0x48], 0x3f8
mov dword [rsp + 0x38], 0x12
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x4d
mov dword [rsp + 0x28], 0xb0
mov dword [rsp + 0x20], 8
call r11
mov r10, qword [rsp + 0x80]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rax
mov r8d, 1
mov qword [0x140038080], rax
call r10
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010003
mov rax, qword [rsp + 0x1670]
lea r8, [0x14002d531]
mov qword [rsp + 0x58], 0
mov r11, qword [rsp + 0x78]
lea rdx, str.Button
mov qword [rsp + 0x48], 0x3f9
mov dword [rsp + 0x38], 0x12
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x6b
mov dword [rsp + 0x28], 0xb0
mov dword [rsp + 0x20], 0x5f
call r11
mov rdi, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x50010003
mov qword [0x140038078], rax
mov rax, qword [rsp + 0x1670]
lea r8, [0x14002d542]
mov r11, qword [rsp + 0x78]
lea rdx, str.Button
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0x3fa
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x12
mov dword [rsp + 0x30], 0x55
mov dword [rsp + 0x28], 0xb0
mov dword [rsp + 0x20], 0xd5
call r11
mov r8, qword [rsp + 0x88]
xor r9d, r9d
xor edx, edx
mov qword [0x140038070], rax
mov ecx, 0x29
mov dword [rsp + 0x230], 0x158
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r8d, r8d
test eax, eax
jne 0x140006450
mov rcx, qword [rsp + 0x1670]
lea rdx, [sym.SetWindowFont_HWND____long_long_]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rax, qword [rsp + 0x1670]
lea rdx, [0x14002d193]
mov dword [0x1400380e0], 0x210
mov dword [0x1400380f8], 0x403
mov rcx, qword [rsp + 0x70]
mov qword [0x1400380e8], rax
mov rax, qword [0x14002e120]
mov qword [0x1400380f0], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rdx, [0x1400380e0]
xor ecx, ecx
mov qword [0x140038100], rax
movabs rax, 0xdfbea4b9f2d3abbc
mov qword [0x140038108], rax
mov dword [0x14003810f], 0xfcb0df
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
xor edx, edx
mov rcx, qword [rsp + 0x1670]
call qword [sym.imp.USER32.dll_GetSystemMenu]
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x70], rax
lea r9, [0x14002d54f]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_AppendMenuA]
mov qword [rsp + 0x78], rax
call rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov r8d, 4
lea r9, [0x14002d562]
mov rax, qword [rsp + 0x78]
call rax
lea r9, [0x14002d573]
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov r8d, 3
mov rax, qword [rsp + 0x78]
call rax
mov edx, 0x3f5
mov rcx, qword [rsp + 0x1670]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov qword [0x1400382f8], rax
call qword [sym.imp.USER32.dll_SetFocus]
xor r9d, r9d
mov r8d, 2
mov rcx, qword [rsp + 0x1670]
mov edx, 0x113
mov rax, qword [rsp + 0x80]
call rax
lea rcx, str.LibTDProcHook64.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003010
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140003010
movzx eax, word [rsp + 0x1680]
sub ax, 0x3ea
cmp ax, 0x12
ja case.0x140004207.1003
lea rdx, [0x14002ddac]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rcx, qword [0x1400382f8]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetFocus]
lea rax, [rsp + 0x590]
mov rcx, qword [0x1400382f8]
mov r8d, 7
mov rdx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [rsp + 0x70]
lea rdx, str.Button
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne case.0x140004207.1003
mov rcx, qword [0x1400382f8]
mov edx, 0xfffffff0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 3
cmp eax, 3
je case.0x140004207.1003
mov rcx, qword [0x1400382f8]
mov r9d, 1
mov r8d, 1
mov edx, 0xf4
call qword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x140004207.1003
mov eax, 0x40
jmp 0x140003415
mov rax, qword [rsp + 0x1688]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x1688]
lea rcx, [rsp + 0x590]
mov r8d, 0x10b8
lea rdx, [rax + 0x18]
call sym.memcpy
mov rax, qword [rsp + 0x70]
cmp qword [0x140038088], rax
je 0x140006610
lea rcx, [rsp + 0x5a0]
lea rdx, str.idInfo
call sym.wcscmp
test eax, eax
jne 0x140003010
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
mov dword [rsp + 0xe8], 0xffffffff
lea r8, str.Example
lea rdx, str.This_isnt_much_help.
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140003010
mov rcx, qword [rsp + 0x1670]
mov edx, 1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1670]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x1670]
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140003010
mov r9, qword [rsp + 0x1688]
mov r8d, 0xf020
mov edx, 0x112
mov rcx, qword [rsp + 0x1670]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x140003010
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, qword [0x140038060]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
cmp rax, 1
sete byte [0x1400380b9]
jmp case.0x140004207.1003
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, qword [0x140038068]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
cmp rax, 1
je 0x1400093f8
mov rcx, qword [rsp + 0x1670]
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
jmp case.0x140004207.1003
lea rcx, str.Shell_TrayWnd
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x590]
mov qword [rsp + 0x70], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x590]
test r8d, r8d
je 0x140006ac6
cmp qword [rsp + 0x70], 0
je 0x140006ac6
xor edx, edx
mov ecx, 1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, 2
mov qword [rsp + 0x70], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000985a
mov rcx, qword [0x140038090]
lea rdx, [0x14002d59a]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x140004207.1003
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, 5
lea rdx, [sym.CBTProc_int__unsigned_long_long__long_long_]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x10023
lea r8, str.USB_Setting
mov qword [rsp + 0x78], rax
lea rdx, [0x14002da40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x70], eax
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [rsp + 0x70], 6
je 0x1400097c3
cmp dword [rsp + 0x70], 7
jne case.0x140004207.1003
xor edx, edx
xor ecx, ecx
mov r8d, 1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 0x10020
lea rdx, str.TDFileFilter
mov rcx, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, 7
mov edx, 1
mov qword [rsp + 0x70], rax
mov r10, rax
xor eax, eax
lea rdi, [rsp + 0x590]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x590]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000a8b9
mov rcx, qword [0x140038090]
lea rdx, [0x14002d997]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], rax
call rax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
call rax
jmp case.0x140004207.1003
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str..TDNetFilter
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
call rdi
test eax, eax
jne 0x14000734e
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120014
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rdi, qword [rsp + 0x78]
call rdi
lea rcx, [0x14002d9c1]
mov edx, eax
call sym.PrtError_char_const__long_long_
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x88], rax
call rax
lea rdi, [rsp + 0x590]
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
mov dword [rsp + 0xe8], 0xffffffff
call sym.CreateToolhelp32Snapshot
mov rdx, rdi
mov qword [rsp + 0x70], rdi
mov rcx, rax
mov qword [rsp + 0x90], rax
call sym.Process32First
test eax, eax
je 0x140006a3a
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x14000477d
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x90]
call sym.Process32Next
test eax, eax
je 0x140006a3a
mov rcx, qword [rsp + 0x78]
lea rdx, str.MasterHelper.exe
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140004758
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x88]
call rax
mov r10, qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov ecx, 1
mov r8d, dword [rsp + 0x78]
mov qword [rsp + 0x98], r10
call r10
mov r10, qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xa0], r10
call r10
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov dword [rsp + 0x80], eax
call rdi
mov eax, dword [rsp + 0x80]
mov ecx, 2
mov dword [rsp + 0x590], 0x130
test eax, eax
setne byte [rsp + 0xa8]
xor edx, edx
call sym.CreateToolhelp32Snapshot
mov rdx, qword [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x90], rax
call sym.Process32First
test eax, eax
je 0x140006a2d
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x1400048a5
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x90]
call sym.Process32Next
test eax, eax
je 0x140006a2d
mov rcx, qword [rsp + 0x78]
lea rdx, str.GATESRV.exe
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140004880
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x88]
call rax
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 1
mov r10, qword [rsp + 0x98]
call r10
xor edx, edx
mov r10, qword [rsp + 0xa0]
mov rcx, rax
mov qword [rsp + 0x78], rax
call r10
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov dword [rsp + 0x80], eax
call rdi
mov rdx, qword [rsp + 0x70]
lea rdi, [rsp + 0x1a0]
xor r8d, r8d
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x190], rdi
movabs rdi, 0xe7c2f8cdfdb3e2bd
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x590], 0x1a
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rdx, qword [rsp + 0x590]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x1a0], rdx
mov qword [rax], rdi
movabs rdi, 0xa3cdbaa3c6d6decf
mov qword [rax + 8], rdi
movabs rdi, 0xf8bdd8b9e0cfb9d6
mov qword [rax + 0x10], rdi
mov edi, 0xffffccb3
mov word [rax + 0x18], di
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x198], rdx
mov byte [rax + rdx], 0
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14000768a
cmp byte [rsp + 0xa8], 0
je 0x14000768a
lea rax, [0x14002d2b3]
mov qword [rsp + 0xa0], rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, 4
mov r8d, 0x1000
xor ecx, ecx
mov dword [rsp + 0xe8], 0xd
mov edx, 0x40
mov qword [rsp + 0xd0], rax
call rax
lea rdi, [rsp + 0x390]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov rcx, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov qword [rsp + 0xb8], rdi
call rdi
movzx eax, word [rsp + 0x39e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x392]
movzx r8d, word [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x39c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x39a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x398]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x396]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x230]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x230], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0x98], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x590], rax
ja 0x1400095aa
cmp qword [rsp + 0x80], 1
je 0x1400094dd
cmp qword [rsp + 0x80], 0
jne 0x14000aada
mov rax, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x238], rdi
mov byte [rax + rdi], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x1f
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x238]
cmp rax, r8
jb 0x14000b216
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov r8, qword [rsp + 0x198]
movabs rax, 0x3fffffffffffffff
mov dword [rsp + 0xe8], 0xb
sub rax, qword [rsp + 0x238]
mov rdx, qword [rsp + 0x190]
cmp rax, r8
jb 0x14000b20a
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x3a0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x390], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x80], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rdi
cmp rdx, rdi
je 0x14000968a
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x390], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x398], rax
mov rdi, qword [rsp + 0x98]
mov rax, qword [rsp + 0x78]
mov qword [rax + 8], 0
mov byte [rax + 0x10], 0
mov qword [rax], rdi
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
mov dword [rsp + 0xe8], 0xc
cmp rax, 3
jbe 0x14000b065
mov rdx, qword [rsp + 0xa0]
mov r8d, 4
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xa0], rdi
cmp rdx, rdi
je 0x14000965f
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x1400096fe
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000978d
movdqu xmm1, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm1
je 0x1400097a4
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x140004da5
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x140004dcb
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xa8]
cmp rcx, rax
je 0x140004df1
mov rax, qword [rsp + 0x240]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
lea rax, [0x140038320]
mov qword [rsp + 0x98], rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000b1ad
mov rcx, qword [rsp + 0x98]
lea rax, [0x14002d2a3]
mov r8d, 2
mov dword [rsp + 0xe8], 0xd
mov rdx, rax
mov qword [rsp + 0xa0], rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
lea rdx, str.TDNetFilter
mov r8d, 0x10020
mov qword [rsp + 0xc0], rax
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x160], 0
mov edx, 1
mov rcx, rax
lea r8, [rsp + 0x160]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x170], 0
mov dword [rsp + 0x178], 0
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0xc8], eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], rdi
call rdi
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
call rdi
mov r8, qword [rsp + 0x198]
lea r9, [0x14002da20]
xor edx, edx
mov qword [rsp + 0x20], 0x1a
mov rcx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_replace_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long_
mov r11d, dword [rsp + 0xc8]
lea rdx, [0x14002d2b8]
mov r9d, 4
mov r8d, 0x1000
lea rax, [0x14002d2b3]
mov dword [rsp + 0xe8], 0xd
test r11d, r11d
cmove rax, rdx
mov edx, 0x40
xor ecx, ecx
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xd0]
call rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov rdi, qword [rsp + 0xb8]
call rdi
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x230], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xc8], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x590], rax
ja 0x140009518
cmp qword [rsp + 0xb8], 1
je 0x140009410
cmp qword [rsp + 0xb8], 0
jne 0x14000aae7
mov rax, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x238], rdi
mov byte [rax + rdi], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x20
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x238]
cmp rax, r8
jb 0x14000b0fd
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov r8, qword [rsp + 0x198]
movabs rax, 0x3fffffffffffffff
mov dword [rsp + 0xe8], 0xe
sub rax, qword [rsp + 0x238]
mov rdx, qword [rsp + 0x190]
cmp rax, r8
jb 0x14000b0f1
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rdi, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x390], rdi
mov rdx, qword [rax]
lea rdi, [rax + 0x10]
mov qword [rsp + 0x88], rdi
mov rax, qword [rax + 8]
cmp rdx, rdi
je 0x140009634
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x390], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x398], rax
mov rdi, qword [rsp + 0x88]
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], 0
mov byte [rax + 0x10], 0
mov qword [rax], rdi
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
mov dword [rsp + 0xe8], 0xf
cmp rax, 3
jbe 0x14000b245
mov rdx, qword [rsp + 0xc0]
mov r8d, 4
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
lea rdi, [rax + 0x10]
mov qword [rsp + 0x88], rdi
mov rax, qword [rax + 8]
cmp rdx, rdi
je 0x14000960c
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0x88]
mov rax, qword [rsp + 0x70]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x1400096b5
lea rcx, [0x140038330]
cmp rax, rcx
je 0x140009757
movdqu xmm2, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm2
je 0x14000976e
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x1400052b7
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x1400052dd
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xa8]
cmp rcx, rax
je 0x140005303
mov rax, qword [rsp + 0x240]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000b251
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xd
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [0x140038090]
lea rdx, [0x14002d2bd]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x148]
cmp rcx, rax
je case.0x140004207.1003
mov rax, qword [rsp + 0x1a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp case.0x140004207.1003
xor r8d, r8d
mov r9d, 0x202
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x158], 0
lea rax, [rsp + 0x230]
mov dword [rsp + 0xe8], 0xffffffff
mov qword [rsp + 0x88], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov qword [rsp + 0xb0], rax
call rax
lea rax, [rsp + 0x158]
xor r8d, r8d
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0x70], rax
mov r9d, 4
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, str.DisableCMD
mov dword [rsp + 0x28], 4
mov qword [rsp + 0xa8], rax
call rax
test eax, eax
je 0x140007382
lea rcx, [0x14002d66e]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
lea rcx, [0x140038320]
mov qword [rsp + 0x98], rcx
cmp rax, 1
jbe 0x14000adb1
lea rax, [0x14002d2a3]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, rax
mov qword [rsp + 0xa0], rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0xb8], rax
call rax
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov r9d, 0x202
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
call rax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9d, 4
mov rcx, qword [rsp + 0x230]
mov dword [rsp + 0x28], 4
lea rdx, str.DisableRegistryTools
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x140007d0c
lea rcx, [0x14002d6d7]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov rcx, qword [rsp + 0x230]
mov r9d, 4
lea rdx, str.DisableTaskMgr
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x14000830e
lea rcx, [0x14002d710]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xb8]
call rax
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov r9d, 0x202
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
call rax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9d, 4
mov rcx, qword [rsp + 0x230]
mov dword [rsp + 0x28], 4
lea rdx, str.NoRun
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x14000800d
lea rcx, [0x14002d77a]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov rcx, qword [rsp + 0x230]
mov r9d, 4
lea rdx, str.RestrictRun
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x140008f12
lea rcx, [0x14002d7c6]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xb8]
call rax
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov r9d, 0x202
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskkill.exe
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea rdx, str.debugger
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0xc8], rax
call rax
test eax, eax
je 0x140008c11
lea rcx, [0x14002d870]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov r9d, 0x202
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_ntsd.exe
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
call rax
mov rcx, qword [rsp + 0x230]
lea rdx, str.debugger
mov rax, qword [rsp + 0xc8]
call rax
test eax, eax
je 0x140008910
lea rcx, [0x14002d8eb]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xb8]
call rax
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov r9d, 0x202
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
call rax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9d, 4
mov rcx, qword [rsp + 0x230]
mov dword [rsp + 0x28], 4
lea rdx, str.NoLogOff
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x14000860f
lea rcx, [0x14002d90e]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov rcx, qword [rsp + 0x230]
mov r9d, 4
lea rdx, str.StartMenuLogOff
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x1400079fe
lea rcx, [0x14002d93c]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
mov byte [rsp + 0xc0], 1
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rdx, qword [rsp + 0xa0]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x98]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xb8]
call rax
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov r9d, 0x202
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
call rax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9d, 4
mov rcx, qword [rsp + 0x230]
mov dword [rsp + 0x28], 4
lea rdx, str.DisableLockWorkstation
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xa8]
call rax
test eax, eax
je 0x14000769e
lea rcx, [0x14002d97d]
movsxd rdx, eax
call sym.PrtError_char_const__long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000adb1
mov rcx, qword [rsp + 0x98]
mov r8d, 2
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0xa0]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xb8]
call rax
mov rcx, qword [0x140038090]
lea rdx, [0x14002d9a0]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
cmp dword [0x1400380bc], 2
je 0x14000924f
mov rax, qword [str.StudentMain.exe]
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
lea rdi, [rsp + 0x590]
mov dword [rsp + 0xe8], 0xffffffff
mov qword [rsp + 0x90], rax
call sym.CreateToolhelp32Snapshot
mov rdx, rdi
mov qword [rsp + 0x70], rdi
mov rcx, rax
mov qword [rsp + 0x88], rax
call sym.Process32First
test eax, eax
je 0x140007cff
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x140005bd5
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call sym.Process32Next
test eax, eax
je 0x140007cff
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140005bb0
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x70], eax
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x70]
mov edx, 1
call sym.KillProcess_unsigned_long__int_
test al, al
je 0x14000957a
mov rcx, qword [0x140038090]
lea rdx, [0x14002d59a]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006237
mov rdx, qword [0x14002c020]
mov r9d, 0x40
xor ecx, ecx
mov dword [rsp + 0xe8], 0xffffffff
lea r8, [0x14002d44e]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x140004207.1003
lea rdi, [rsp + 0x590]
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
mov dword [rsp + 0xe8], 0xffffffff
call sym.CreateToolhelp32Snapshot
mov rdx, rdi
mov qword [rsp + 0x70], rdi
mov rcx, rax
mov qword [rsp + 0x88], rax
call sym.Process32First
test eax, eax
je 0x140006b07
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x140005d15
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call sym.Process32Next
test eax, eax
je 0x140006b07
mov rcx, qword [rsp + 0x78]
lea rdx, [0x14002dc49]
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140005cf0
mov eax, dword [rsp + 0x598]
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], rax
call rax
mov r11d, dword [rsp + 0x78]
test r11d, r11d
jne case.0x140004207.1003
mov rdx, qword [rsp + 0x70]
mov ecx, 0x104
mov dword [rsp + 0xe8], 0xffffffff
movabs rdi, 0x2e6b73696472635c
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, qword [rsp + 0x70]
call sym.strlen
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov r8d, 1
mov edx, 0x10000000
add rax, rcx
mov qword [rax], rdi
mov dword [rax + 8], 0x657865
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x78], rax
je 0x1400094f4
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdx, rax
je 0x14000a0d8
mov edi, dword [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x78]
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140009995
mov rcx, qword [0x140038090]
lea rdx, [0x14002dc37]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
call rax
jmp case.0x140004207.1003
lea rdi, [rsp + 0x590]
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
mov dword [rsp + 0xe8], 0xffffffff
call sym.CreateToolhelp32Snapshot
mov rdx, rdi
mov qword [rsp + 0x70], rdi
mov rcx, rax
mov qword [rsp + 0x88], rax
call sym.Process32First
test eax, eax
je 0x140006b30
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x140005f2d
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call sym.Process32Next
test eax, eax
je 0x140006b30
mov rcx, qword [rsp + 0x78]
lea rdx, str.MeltdownDFC.exe
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140005f08
mov eax, dword [rsp + 0x598]
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], rax
call rax
mov edi, dword [rsp + 0x78]
test edi, edi
jne case.0x140004207.1003
mov rdx, qword [rsp + 0x70]
mov ecx, 0x104
mov dword [rsp + 0xe8], 0xffffffff
movabs rdi, 0x776f64746c654d5c
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, qword [rsp + 0x70]
call sym.strlen
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov r8d, 1
mov edx, 0x10000000
add rax, rcx
mov qword [rax], rdi
movabs rdi, 0x6578652e4346446e
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x78], rax
je 0x1400094f4
mov r8d, 0xa
mov edx, 2
jmp 0x140005df4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, qword [0x140038080]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
cmp rax, 1
je 0x1400094cb
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov rdx, 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x140038058]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x34
mov dword [rsp + 0xe8], 0xffffffff
lea r8, [0x14002db87]
lea rdx, [0x14002db90]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne case.0x140004207.1003
lea rcx, [rsp + 0x590]
lea rdx, str.8a29cc29f5951530ac69f4
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const___clone_.isra.0_
lea rax, [rsp + 0x390]
xor r8d, r8d
mov r9d, 2
mov qword [rsp + 0x20], rax
lea rdx, str.Software
mov rcx, 0xffffffff80000001
mov dword [rsp + 0xe8], 0x12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000a687
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
mov dword [0x14002c028], eax
lea rdx, [0x14002d2c6]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x590]
lea rax, [rsp + 0x5a0]
cmp rcx, rax
je case.0x140004207.1003
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp case.0x140004207.1003
mov rcx, qword [0x140038070]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x140038048]
cmp rax, 1
je 0x140009427
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [0x140038310]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
jmp case.0x140004207.1003
xor r9d, r9d
mov rcx, qword [0x1400382f0]
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
lea r8, str.AfxWnd80u
call qword [sym.imp.USER32.dll_FindWindowExA]
mov rcx, qword [0x1400382f0]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov rcx, qword [0x1400382f0]
mov edx, 0x111
xor r9d, r9d
mov r8d, 0xf503ec
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, qword [0x140038090]
lea rdx, [0x14002db7c]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
mov r8d, 2
mov edx, 0x113
call qword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x140004207.1003
mov rcx, qword [0x140038078]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x140038050]
cmp rax, 1
je 0x1400094c0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [0x140038308]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
jmp case.0x140004207.1003
xor eax, eax
xor r8d, r8d
mov r9d, 0x201
mov dword [rsp + 0x158], 0
mov word [rsp + 0x15c], ax
lea rax, [rsp + 0x160]
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREWOW6432NodeZM
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x154]
mov rcx, qword [rsp + 0x160]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x154], 6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140006b59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002db28]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
lea rcx, str.taskmgr
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x78], 0x64
mov dword [0x14002c028], eax
nop dword [rax]
sub byte [rsp + 0x78], 1
je 0x1400094f4
mov dword [rsp + 0xe8], 0xffffffff
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rax, qword [rsp + 0x70]
lea rcx, str.TaskManagerWindow
call rax
test rax, rax
je 0x1400063a8
mov qword [rsp + 0x78], rax
jmp 0x1400032fa
lea rdx, [0x1400380e0]
xor ecx, ecx
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
jmp 0x140003042
mov rax, qword [sym.imp.USER32.dll_SetForegroundWindow]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x1670]
mov edx, 1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1670]
mov rax, qword [rsp + 0x70]
call rax
jmp case.0x140004207.1003
lea rcx, [rsp + 0x348]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov r8, rax
jmp 0x14000407a
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140038090]
mov r8d, 1
mov edx, 0x401
mov dword [rsp + 0xe8], 0xffffffff
lea r9, [0x14002dcb9]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x140038098]
lea rdx, [0x14002dcc4]
mov dword [0x1400380bc], 2
mov rax, qword [rsp + 0x98]
call rax
jmp 0x140003010
mov rax, qword [rsp + 0x1688]
mov rax, qword [rax]
cmp rax, qword [0x140038090]
mov qword [rsp + 0x70], rax
jne 0x1400042d8
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetFocus]
mov r8d, 7
mov rcx, rax
mov qword [0x1400382f8], rax
lea rax, [rsp + 0x590]
mov rdx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [rsp + 0x70]
lea rdx, str.Button
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x140003010
mov rcx, qword [0x1400382f8]
mov edx, 0xfffffff0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 3
cmp eax, 3
je 0x140003010
mov rcx, qword [0x1400382f8]
mov r9d, 1
mov r8d, 1
mov edx, 0xf4
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x140003010
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x70], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
jne case.0x140004207.1003
mov rcx, qword [rsp + 0x70]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x1670]
mov edx, 3
mov dword [rsp + 0xe8], 0xffffffff
mov byte [0x1400380b8], 0
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x140003010
mov eax, dword [rsp + 0x594]
test eax, eax
jne 0x140004309
mov dword [rsp + 0x28], 5
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x600]
lea rdx, [0x14002dd2a]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140003010
mov rcx, qword [rsp + 0x1670]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetActiveWindow]
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [0x1400382f8], rax
jmp 0x140003270
lea rdi, [rsp + 0x590]
mov ecx, 0x104
mov dword [rsp + 0xe8], 0xffffffff
mov rdx, rdi
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, qword [rsp + 0x70]
call sym.strlen
mov rdi, qword [rsp + 0x70]
xor r9d, r9d
movabs rdx, 0x74696b6c6f6f545c
mov r8d, 1
add rax, rdi
mov rcx, rdi
mov qword [rax], rdx
movabs rdx, 0x7478742e676f4c
mov qword [rax + 8], rdx
mov edx, 0x10000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r9d, r9d
mov rdx, qword [0x140038320]
mov qword [rsp + 0x20], 0
mov rdi, rax
mov rax, qword [0x140038328]
mov rcx, rdi
mov qword [rsp + 0x78], rdi
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0x1670]
mov dword [rsp + 0x28], 5
xor r9d, r9d
mov r8, qword [rsp + 0x70]
lea rdx, str.open
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003270
mov r8d, dword [0x14002c028]
cmp r8d, 0xffffffff
je 0x140006ae8
lea rax, [rsp + 0x390]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x390], 0
mov ecx, 0x1300
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x598]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
mov ecx, 0x3f
mov qword [rsp + 0x590], 0
rep stosq qword [rdi], rax
mov r9, qword [rsp + 0x390]
lea rax, [rsp + 0x590]
mov r8d, dword [0x14002c028]
lea rdx, str.GetLastError
mov rcx, rax
mov qword [rsp + 0x70], rax
call sym.sprintf_char__char_const__::_
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x70]
mov r9d, 0x40
mov rcx, qword [rsp + 0x1670]
lea r8, [0x14002dd80]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x14002c028], 0xffffffff
jmp 0x140003270
lea rcx, [0x1400380a8]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rsp + 0x1670]
mov qword [rsp + 0x70], rax
call rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdi, qword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
mov r8d, 1
lea r9, [0x14002dcfb]
mov rcx, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
call rdi
xor edx, edx
mov rcx, qword [rsp + 0x78]
mov r8d, 2
mov rdi, qword [rsp + 0x80]
lea r9, [0x14002dd04]
call rdi
mov rdi, qword [rsp + 0x1670]
mov dword [rsp + 0x20], 0
mov edx, 0x100
mov qword [rsp + 0x30], 0
mov r9d, dword [0x1400380ac]
mov r8d, dword [0x1400380a8]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rdi
call qword [sym.imp.USER32.dll_TrackPopupMenu]
cmp eax, 1
je 0x1400069b7
cmp eax, 2
je 0x14000641c
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
mov r8d, 0x2ee
mov edx, 3
mov dword [rsp + 0xe8], 0xffffffff
mov byte [0x1400380b8], 1
call qword [sym.imp.USER32.dll_SetTimer]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x70]
lea r9, [0x14002dcda]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0xa
mov dword [rsp + 0xe8], 0x14
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_replace_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x590]
jmp 0x140002de0
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x1670]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov r8d, 0x7704
mov edx, 0x111
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x14000335b
mov rcx, qword [rsp + 0x70]
lea r9, [0x14002dccd]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0xc
mov dword [rsp + 0xe8], 0x14
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_replace_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long_
jmp 0x14000699d
mov dword [rsp + 0x78], 0
jmp 0x1400048d5
mov dword [rsp + 0x78], 0
jmp 0x1400047ad
lea rcx, [0x1400380b0]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x1400380b0]
test eax, eax
jne 0x1400092bf
mov r10d, dword [0x1400380b4]
test r10d, r10d
jne 0x140003010
mov byte [0x1400380ba], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x50044
mov qword [rsp + 0x70], rax
lea r8, [0x14002d00c]
lea rdx, [0x14002dc58]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x14000adc8
mov byte [0x1400380ba], 0
jmp 0x140003010
lea rcx, str.explorer.exe
mov edx, 5
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp case.0x140004207.1003
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov dword [0x14002c028], eax
jmp 0x1400067a1
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x88], rax
call rax
jmp 0x140005d6c
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x88], rax
call rax
jmp 0x140005f82
mov rcx, qword [rsp + 0x78]
lea rdi, [rsp + 0x240]
mov qword [rsp + 0x238], 0xe
mov qword [rsp + 0xa8], rdi
lea rax, [rsp + 0x230]
mov qword [rsp + 0x230], rdi
movabs rdi, 0xd6cafad6bfb7fabb
mov qword [rsp + 0x240], rdi
movabs rdi, 0xbaa3beb1e6b0d6ca
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x246], rdi
mov byte [rsp + 0x24e], 0
call sym.strlen
mov rdx, qword [rsp + 0x78]
mov dword [rsp + 0xe8], 0x10
mov rcx, qword [rsp + 0x88]
mov r8, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x238]
cmp rax, 0x11
jbe 0x14000b274
mov rcx, qword [rsp + 0x88]
mov r8d, 0x12
mov dword [rsp + 0xe8], 0x10
lea rdx, str._nprozs.exe
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rsp + 0x190]
mov qword [rsp + 0xb8], rax
call rax
movzx ecx, word [rsp + 0x192]
movzx edx, word [rsp + 0x196]
cmp byte [rsp + 0x158], 0x37
lea r8d, [rcx + rdx]
je 0x140009cd4
mov eax, r8d
mov edx, 0xaaaaaaab
mov dword [rsp + 0x390], 0x70
imul rax, rdx
mov edx, r8d
shr rax, 0x21
lea eax, [rax + rax*2]
sub edx, eax
mov eax, r8d
and eax, 3
add edx, 3
add eax, 4
and r8d, 1
je 0x140009cc9
lea ecx, [rax + 0x66]
lea eax, [rdx + 0x62]
mov byte [rsp + 0x392], al
lea rax, [rsp + 0x390]
mov byte [rsp + 0x391], cl
mov rcx, rax
mov qword [rsp + 0x90], rax
call sym.strlen
mov dword [rsp + 0xe8], 0x10
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x238]
cmp rax, r8
jb 0x14000b268
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x90]
call sym.strlen
mov rdi, qword [rsp + 0x90]
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
add rax, rdi
mov dword [rax], 0x6578652e
mov byte [rax + 4], 0
call sym.CreateToolhelp32Snapshot
lea rdi, [rsp + 0x590]
mov rcx, rax
mov qword [rsp + 0x88], rax
mov rdx, rdi
mov qword [rsp + 0x70], rdi
call sym.Process32First
test eax, eax
je 0x140009747
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x140006da6
mov dword [rsp + 0xe8], 0x10
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call sym.Process32Next
test eax, eax
je 0x140009747
mov dword [rsp + 0xe8], 0x10
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140006d81
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0xe8], 0x10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0x10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdi, [rsp + 0x390]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov rcx, rdi
mov rdi, qword [rsp + 0xb8]
call rdi
movzx eax, word [rsp + 0x39e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x392]
movzx r8d, word [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x39c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x39a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x398]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x396]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x590], rax
ja 0x1400099ec
cmp qword [rsp + 0x88], 1
je 0x140009dba
cmp qword [rsp + 0x88], 0
jne 0x14000ac6c
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x21
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b195
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov r8, qword [rsp + 0x238]
movabs rax, 0x3fffffffffffffff
mov dword [rsp + 0xe8], 0x11
sub rax, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x230]
cmp rax, r8
jb 0x14000b189
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0x90], rdi
cmp rdx, rdi
je 0x14000a312
mov rdi, qword [rsp + 0x88]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a2c9
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a61b
movdqu xmm1, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm1
je 0x14000a632
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x1400070bb
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x1400070e1
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [0x140038328]
cmp rax, 1
jbe 0x14000b109
lea rdx, [0x14002d2a3]
mov r8d, 2
mov dword [rsp + 0xe8], 0x10
lea rcx, [0x140038320]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov ecx, 1
mov r8d, dword [rsp + 0x98]
mov qword [rsp + 0x98], rax
call rax
mov qword [rsp + 0x78], rax
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
mov qword [rsp + 0xa0], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x88], rax
call rax
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
call sym.CreateToolhelp32Snapshot
mov rdx, qword [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x90], rax
call sym.Process32First
test eax, eax
je 0x140009242
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
mov qword [rsp + 0x80], rax
jmp 0x1400071ed
mov dword [rsp + 0xe8], 0x10
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x90]
call sym.Process32Next
test eax, eax
je 0x140009242
mov rcx, qword [rsp + 0x78]
lea rdx, str.jfglzs.exe
mov dword [rsp + 0xe8], 0x10
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x1400071c8
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0xe8], 0x10
mov rax, qword [rsp + 0x88]
call rax
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 1
mov rdi, qword [rsp + 0x98]
call rdi
mov r10, qword [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x78], rax
mov rcx, rax
call r10
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
call rax
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 0x20
mov qword [rsp + 0x78], rax
mov rcx, rax
lea rdx, str.zmserv
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r8, qword [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x590], 0
mov edx, 1
mov qword [rsp + 0x598], 0
mov qword [rsp + 0x5a0], 0
mov dword [rsp + 0x5a8], 0
mov qword [rsp + 0x70], rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
call rax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0xc0]
call rax
mov rcx, qword [0x140038090]
lea rdx, [0x14002d59a]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0xa8]
cmp rcx, rax
je case.0x140004207.1003
mov rax, qword [rsp + 0x240]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp case.0x140004207.1003
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x78]
call rax
lea rcx, [0x14002d9dc]
mov edx, eax
call sym.PrtError_char_const__long_long_
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], rax
jmp 0x1400046ec
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xa0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x590], rax
ja 0x1400098bb
cmp qword [rsp + 0x98], 1
jne 0x14000988a
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x15
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b17d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0xa
jbe 0x14000b166
mov rcx, qword [rsp + 0x90]
mov r8d, 0xb
mov dword [rsp + 0xe8], 1
lea rdx, [0x14002d67a]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rdi
cmp rdx, rdi
je 0x14000a145
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a0fc
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a750
movdqu xmm2, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm2
je 0x14000a767
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x140007657
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x14000767d
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov byte [rsp + 0xc0], 0
jmp 0x14000543c
lea rax, [0x14002d2b8]
mov qword [rsp + 0xa0], rax
jmp 0x1400049ff
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0x88], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x590], rax
ja 0x140009fa6
cmp qword [rsp + 0x78], 1
je 0x140009f8f
cmp qword [rsp + 0x78], 0
jne 0x14000ac79
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x1e
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b1a1
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0xb
jbe 0x14000b088
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009f42
cmp qword [rsp + 0xc8], 1
je 0x140009f2b
cmp qword [rsp + 0xc8], 0
jne 0x14000ad3d
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x1d
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b09f
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0x13
jbe 0x14000b071
mov rcx, qword [rsp + 0x90]
mov r8d, 0x14
mov dword [rsp + 0xe8], 9
lea rdx, [0x14002d951]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a3fa
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a3b1
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a579
movdqu xmm5, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm5
je 0x14000a590
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x140007cd0
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x1400059e3
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400059e3
mov dword [rsp + 0x70], 0
jmp 0x140005c06
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009ec7
cmp qword [rsp + 0xc8], 1
je 0x140009f14
cmp qword [rsp + 0xc8], 0
jne 0x14000ad4a
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x16
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b239
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0x13
jbe 0x14000b222
mov rcx, qword [rsp + 0x90]
mov r8d, 0x14
mov dword [rsp + 0xe8], 2
lea rdx, [0x14002d6ec]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a29e
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a255
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a5af
movdqu xmm1, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm1
je 0x14000a5c6
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x140007fde
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x140005528
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x140005528
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009e7a
cmp qword [rsp + 0xc8], 1
je 0x140009dff
cmp qword [rsp + 0xc8], 0
jne 0x14000acaa
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x18
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b0c2
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0x28
jbe 0x14000b0ab
mov rcx, qword [rsp + 0x90]
mov r8d, 0x29
mov dword [rsp + 0xe8], 4
lea rdx, [0x14002d790]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a039
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x140009ff0
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a651
movdqu xmm5, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm5
je 0x14000a668
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x1400082df
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x140005690
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x140005690
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009e2d
cmp qword [rsp + 0xc8], 1
je 0x140009e16
cmp qword [rsp + 0xc8], 0
jne 0x14000acb7
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x17
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b137
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0x11
jbe 0x14000b120
mov rcx, qword [rsp + 0x90]
mov r8d, 0x12
mov dword [rsp + 0xe8], 3
lea rdx, [0x14002d723]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a386
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a33d
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a5e5
movdqu xmm3, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm3
je 0x14000a5fc
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x1400085e0
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x1400055bc
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400055bc
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009b34
cmp qword [rsp + 0xc8], 1
je 0x140009de8
cmp qword [rsp + 0xc8], 0
jne 0x14000ac5f
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x1c
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b1fe
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0xd
jbe 0x14000b1e7
mov rcx, qword [rsp + 0x90]
mov r8d, 0xe
mov dword [rsp + 0xe8], 8
lea rdx, [0x14002d91d]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a4b7
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a425
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a50d
movdqu xmm3, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm3
je 0x14000a524
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x1400088e1
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x14000594f
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x14000594f
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009ae7
cmp qword [rsp + 0xc8], 1
je 0x140009dd1
cmp qword [rsp + 0xc8], 0
jne 0x14000ac52
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x1b
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b15a
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0xb
jbe 0x14000b143
mov rcx, qword [rsp + 0x90]
mov r8d, 0xc
mov dword [rsp + 0xe8], 7
lea rdx, [0x14002d8f8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a4e2
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a46e
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a543
movdqu xmm1, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm1
je 0x14000a55a
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x140008be2
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x14000587b
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x14000587b
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd8], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x590], rax
ja 0x140009a9a
cmp qword [rsp + 0xd0], 1
je 0x140009b81
cmp qword [rsp + 0xd0], 0
jne 0x14000ac45
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x1a
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b1db
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0xf
jbe 0x14000b1c4
mov rcx, qword [rsp + 0x90]
mov r8d, 0x10
mov dword [rsp + 0xe8], 6
lea rdx, [0x14002d881]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd0], rdi
cmp rdx, rdi
je 0x14000a0ad
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a064
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a786
movdqu xmm4, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm4
je 0x14000a79d
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x140008ee3
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x1400057dc
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400057dc
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x40
mov dword [rsp + 0xe8], 0xffffffff
lea rdi, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x59e]
lea rdx, str.__04d__02d__02d__02d:_02d:_02d._03d_
movzx r9d, word [rsp + 0x592]
movzx r8d, word [rsp + 0x590]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x59c]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x59a]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x598]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x596]
mov dword [rsp + 0x20], eax
call sym.sprintf_char__char_const__::_
lea rax, [rsp + 0x390]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x390], rax
mov rax, qword [0x140038320]
mov qword [rsp + 0xd0], rax
mov rax, qword [0x140038328]
cmp rax, 0xf
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x590], rax
ja 0x140009a4d
cmp qword [rsp + 0xc8], 1
je 0x140009a36
cmp qword [rsp + 0xc8], 0
jne 0x14000ac38
mov rax, qword [rsp + 0x590]
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x398], rax
mov byte [rdx + rax], 0
call sym.strlen
mov dword [rsp + 0xe8], 0x19
mov r8, rax
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, r8
jb 0x14000b0e5
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x398]
cmp rax, 0x2b
jbe 0x14000b0ce
mov rcx, qword [rsp + 0x90]
mov r8d, 0x2c
mov dword [rsp + 0xe8], 5
lea rdx, [0x14002d7e0]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_long_long_
lea rdi, [rsp + 0x5a0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x590], rdi
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rdi
cmp rdx, rdi
je 0x14000a1b9
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x590], rdx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x598], rax
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov rdi, qword [rsp + 0x78]
mov byte [rax + 0x10], 0
mov rdx, qword [rsp + 0x590]
mov rcx, qword [0x140038320]
mov qword [rax + 8], 0
cmp rdx, rdi
mov rax, rcx
je 0x14000a170
lea rcx, [0x140038330]
cmp rax, rcx
je 0x14000a71a
movdqu xmm2, xmmword [rsp + 0x598]
test rax, rax
mov qword [0x140038320], rdx
mov rcx, qword [0x140038330]
movups xmmword [0x140038328], xmm2
je 0x14000a731
mov qword [rsp + 0x590], rax
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x598], 0
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x590]
cmp rcx, rax
je 0x1400091e4
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x140005724
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x140005724
mov rcx, qword [rsp + 0x70]
lea r9, [0x14002dce5]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0xa
mov dword [rsp + 0xe8], 0x14
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_replace_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long_
jmp 0x14000699d
mov dword [rsp + 0x78], 0
jmp 0x14000721d
xor r8d, r8d
mov r9d, 0x201
mov rcx, 0xffffffff80000002
mov dword [rsp + 0xe8], 0xffffffff
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARETopDomaine_Learning_Class_Standard1.00
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400098f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d5e2]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x140004207.1003
cmp eax, dword [0x1400380c4]
jne 0x140003010
cmp dword [0x1400380b4], 0
jne 0x140003010
mov byte [0x1400380ba], 1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, 5
lea rdx, [sym.CBTProc_int__unsigned_long_long__long_long_]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rcx, qword [rsp + 0x1670]
mov r9d, 0x50043
lea r8, [0x14002d00c]
mov qword [rsp + 0x80], rax
lea rdx, [0x14002dc88]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [rsp + 0x78], 6
je 0x14000af87
cmp dword [rsp + 0x78], 7
jne 0x140006aba
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0xe8], 0xffffffff
mov qword [rsp + 0x58], r8
lea rdx, str.Static
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r8
lea r8, [0x14002dcb1]
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r9d
xor r9d, r9d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x70]
mov rdx, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_SetParent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x140006aba
mov rcx, qword [rsp + 0x1670]
mov edx, 0x11
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
jmp case.0x140004207.1003
mov rax, qword [rsp + 0xc8]
movzx eax, byte [rax]
mov byte [rsp + 0x240], al
jmp 0x140005051
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str..TDKeybd
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x70], rax
call rax
test eax, eax
je 0x140009b98
mov rax, qword [rsp + 0x70]
call rax
mov edi, eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rdi
call rax
mov rdx, qword [rsp + 0x78]
lea rcx, [0x14002d2e8]
mov dword [rsp + 0xe8], 0xffffffff
cmp eax, 2
lea rax, [0x14002d2cf]
cmove rcx, rax
call sym.PrtError_char_const__long_long_
jmp case.0x140004207.1003
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp case.0x140004207.1003
mov rcx, qword [0x140038058]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp case.0x140004207.1003
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
mov byte [rsp + 0x240], al
jmp 0x140004b2c
mov rcx, qword [0x140038090]
lea rdx, [0x14002d629]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x240], rax
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc8]
call sym.memcpy
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x230]
jmp 0x140005059
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d5a3]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x240], rax
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x98]
call sym.memcpy
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x230]
jmp 0x140004b34
mov r8, rax
add r8, 1
je 0x1400051fa
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
jmp 0x1400051fa
mov r8, rax
add r8, 1
je 0x140005149
mov rcx, qword [rsp + 0x80]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
jmp 0x140005149
mov r8, rax
add r8, 1
je 0x140004ce5
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x98]
mov rax, qword [rax + 8]
jmp 0x140004ce5
mov r8, rax
add r8, 1
je 0x140004c26
mov rcx, qword [rsp + 0x80]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 8]
jmp 0x140004c26
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x1400096e5
cmp r8, 1
je 0x14000ad57
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140005285
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000972e
cmp r8, 1
je 0x14000abec
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140004d73
mov dword [rsp + 0x98], 0
jmp 0x140006dda
movdqu xmm4, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm4
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140005285
movdqu xmm3, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm3
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140004d73
xor r9d, r9d
xor r10d, r10d
xor r8d, r8d
lea rax, [rsp + 0x390]
mov qword [rsp + 0x390], r9
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rcx, str.TDFileFilterPort
mov qword [rsp + 0x20], r10
call sym.FilterConnectCommunicationPort
test eax, eax
mov dword [rsp + 0x70], eax
jne 0x14000982b
cmp qword [rsp + 0x390], 0
je 0x14000982b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe8], 0xffffffff
mov qword [rsp + 0x78], rax
call rax
test eax, eax
je 0x14000aef7
movzx eax, word [rsp + 0x70]
lea rdx, [0x14002d2c6]
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [0x140038090]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d5a3]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x1400044e3
cmp qword [rsp + 0x98], 0
je 0x14000749c
mov rcx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
call sym.memcpy
jmp 0x14000749c
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
jmp 0x1400098a1
lea rax, [rsp + 0x150]
xor r8d, r8d
mov rcx, qword [rsp + 0x160]
mov dword [rsp + 0x150], 0x208
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x590]
lea r9, [rsp + 0x154]
mov qword [rsp + 0x88], rax
lea rdx, str.TargetDirectory
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x154], 1
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x160]
mov dword [rsp + 0x70], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x70], 0
je 0x14000a8e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d5e2]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
call rax
mov rcx, qword [rsp + 0x70]
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x14000a895
mov rcx, qword [0x140038090]
lea rdx, [0x14002d629]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
mov rcx, qword [rsp + 0x90]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xa0]
call sym.memcpy
jmp 0x140006efe
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140009029
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140009029
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0x148]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
call sym.memcpy
jmp 0x140008d28
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140008a27
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140008726
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140008d28
xor eax, eax
mov rcx, qword [rsp + 0x78]
mov edx, 0x220000
mov dword [rsp + 0x230], 1
mov qword [rsp + 0x38], rax
mov r9d, 4
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x28], eax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x230]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14000a7bc
call sym.FormatLogTime__
lea rdi, [0x140038320]
mov r8, rax
mov rdx, rdi
mov qword [rsp + 0x98], rdi
lea rax, [rsp + 0x390]
mov rcx, rax
mov qword [rsp + 0x70], rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
mov rcx, qword [rsp + 0x70]
lea rdx, [0x14002dc10]
mov dword [rsp + 0xe8], 0x13
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const_
mov rdx, rax
lea rax, [rsp + 0x590]
mov rcx, rax
mov qword [rsp + 0x70], rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x70]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______clone_.isra.0_
mov rcx, qword [rsp + 0x590]
lea rax, [rsp + 0x5a0]
cmp rcx, rax
je 0x140009c88
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x390]
lea rax, [rsp + 0x3a0]
cmp rcx, rax
je 0x140009cae
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x140004207.1003
lea ecx, [rdx + 0x63]
add eax, 0x6a
jmp 0x140006c9e
movzx eax, byte [rsp + 0x15a]
cmp al, 0x38
je 0x14000a7e1
cmp al, 0x35
je 0x14000a7e1
cmp al, 0x34
je 0x14000acc4
cmp al, 0x32
jne 0x140006c5f
mov eax, r8d
mov edi, 7
mov r10d, 5
cdq
idiv edi
mov eax, r8d
mov edi, 9
mov ecx, edx
cdq
idiv edi
mov eax, r8d
mov r9d, edx
cdq
idiv r10d
and r8b, 1
je 0x14000ae19
mov eax, ecx
movd xmm0, dword [0x14002e158]
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
shl eax, 8
or eax, r9d
movd xmm4, eax
paddb xmm4, xmm0
movdqa xmm0, xmm4
lea rcx, [rsp + 0x590]
mov byte [rsp + 0x594], 0
mov qword [rsp + 0x70], rcx
mov rdx, rcx
mov rcx, qword [rsp + 0x88]
movd dword [rsp + 0x590], xmm0
mov dword [rsp + 0xe8], 0x10
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const_
mov rcx, qword [rsp + 0x70]
call sym.strlen
mov rcx, qword [rsp + 0x70]
add rax, rcx
mov dword [rax], 0x6578652e
mov byte [rax + 4], 0
call sym.GetProcessIDFromName_char_const_
mov dword [rsp + 0x98], eax
jmp 0x140006df3
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140006efe
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140008a27
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140008726
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140008124
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140008425
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140008425
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140008124
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140007e23
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140007e23
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x140007b15
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xd8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
call sym.memcpy
jmp 0x140007b15
mov rax, qword [rsp + 0x88]
movzx eax, byte [rax]
mov byte [rsp + 0x3a0], al
jmp 0x1400077ac
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x88]
call sym.memcpy
jmp 0x1400077ac
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a020
cmp r8, 1
je 0x14000ae63
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x1400082ad
mov r8, rax
add r8, 1
je 0x14000821f
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x14000821f
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a094
cmp r8, 1
je 0x14000ae45
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140008eb1
mov r8, rax
add r8, 1
je 0x140008e23
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140008e23
mov rcx, qword [0x140038090]
lea rdx, [0x14002dc37]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a12c
cmp r8, 1
je 0x14000afed
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140007625
mov r8, rax
add r8, 1
je 0x140007597
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140007597
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a1a0
cmp r8, 1
je 0x14000ae81
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x1400091b2
mov r8, rax
add r8, 1
je 0x140009124
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140009124
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a285
cmp r8, 1
je 0x14000ad93
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140007fac
mov r8, rax
add r8, 1
je 0x140007f1e
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140007f1e
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a2f9
cmp r8, 1
je 0x14000ad75
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140007089
mov r8, rax
add r8, 1
je 0x140006ffb
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
jmp 0x140006ffb
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a36d
cmp r8, 1
je 0x14000adfb
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x1400085ae
mov r8, rax
add r8, 1
je 0x140008520
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140008520
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a3e1
cmp r8, 1
je 0x14000b047
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140007c9e
mov r8, rax
add r8, 1
je 0x140007c10
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140007c10
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a455
cmp r8, 1
je 0x14000b00b
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x1400088af
mov r8, qword [rsp + 0x598]
test r8, r8
je 0x14000a49e
cmp r8, 1
je 0x14000b029
mov rdx, qword [rsp + 0x78]
call sym.memcpy
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
mov qword [0x140038328], r8
mov byte [rcx + r8], 0
mov rax, qword [rsp + 0x590]
jmp 0x140008bb0
mov r8, rax
add r8, 1
je 0x140008821
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140008821
mov r8, rax
add r8, 1
je 0x140008b22
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
jmp 0x140008b22
movdqu xmm2, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm2
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x1400088af
movdqu xmm5, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm5
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140008bb0
movdqu xmm4, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm4
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140007c9e
movdqu xmm3, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm3
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140007fac
movdqu xmm2, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm2
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x1400085ae
movdqu xmm5, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm5
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140007089
movdqu xmm4, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm4
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x1400082ad
mov eax, dword [rsp + 0x598]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0xe8], 0x12
mov rcx, qword [rsp + 0x390]
lea rdx, [0x14002dc02]
add eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d997]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x14000613e
movdqu xmm1, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x1400091b2
movdqu xmm1, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140007625
movdqu xmm3, xmmword [rsp + 0x598]
mov qword [0x140038320], rdx
movups xmmword [0x140038328], xmm3
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x590], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x78], rax
jmp 0x140008eb1
mov dword [rsp + 0xe8], 0xffffffff
mov rax, qword [rsp + 0x70]
call rax
lea rcx, [0x14002d2e8]
mov edx, eax
call sym.PrtError_char_const__long_long_
jmp 0x140009cae
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x590], 0x130
mov dword [rsp + 0xe8], 0x10
call sym.CreateToolhelp32Snapshot
lea rdi, [rsp + 0x590]
mov rcx, rax
mov qword [rsp + 0x80], rax
mov rdx, rdi
mov qword [rsp + 0x70], rdi
call sym.Process32First
test eax, eax
je 0x14000a877
lea rax, [rsp + 0x5bc]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call sym.strlen
cmp byte [rsp + 0x15a], 0x35
je 0x14000aaf4
cmp rax, 7
ja 0x14000ac0a
mov dword [rsp + 0xe8], 0x10
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
call sym.Process32Next
test eax, eax
jne 0x14000a834
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0xe8], 0x10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006df3
mov rcx, qword [0x140038090]
lea rdx, [0x14002dc40]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d2c6]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x1400045f4
lea rcx, str.Shell_TrayWnd
xor edx, edx
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x158]
mov rcx, rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, dword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov qword [rsp + 0x78], rax
je 0x14000aede
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x78]
mov edx, 2
mov dword [rsp + 0xe8], 0xffffffff
mov r8, rax
mov qword [rsp + 0x90], rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rax, qword [rsp + 0x90]
xor r8d, r8d
mov r9d, 1
mov rcx, qword [rsp + 0x190]
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
lea rdi, [rsp + 0x394]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [rsp + 0x70]
mov ecx, 0x19
mov rdx, qword [str.StudentMain.exe]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x230]
mov ecx, 6
mov dword [rsp + 0x390], 0x68
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x3cc], 1
mov word [rsp + 0x3d0], 5
call sym.strcat
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x190]
mov rdx, rax
mov dword [rsp + 0x30], 0x220
lea rax, [rsp + 0x230]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x390]
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x28], eax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x14000ae9f
mov rcx, qword [0x140038090]
lea rdx, [0x14002d620]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0x88], rax
call rax
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x88]
call rax
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
call rax
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x88]
call rax
xor r9d, r9d
mov r8d, 2
mov edx, 0x113
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0xa8]
jmp 0x1400095da
mov rcx, qword [rsp + 0xa8]
jmp 0x140009548
cmp rax, 0xe
jne 0x14000a856
movzx eax, byte [rsp + 0x5bc]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5bd]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5be]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5bf]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5c0]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5c1]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5c2]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5c3]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5c4]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
movzx eax, byte [rsp + 0x5c5]
sub eax, 0x64
cmp al, 9
ja 0x14000a856
mov dword [rsp + 0xe8], 0x10
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const_
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x98], eax
jmp 0x14000a877
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000972e
lea rcx, [rax - 4]
xor edx, edx
jmp 0x14000ac31
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax + rdx]
mov byte [rsp + 0x90], al
sub eax, 0x64
cmp al, 9
ja 0x14000a856
add rdx, 1
cmp rdx, rcx
jb 0x14000ac12
jmp 0x14000abbc
mov rcx, qword [rsp + 0x80]
jmp 0x140009a80
mov rcx, qword [rsp + 0x80]
jmp 0x140009acd
mov rcx, qword [rsp + 0x80]
jmp 0x140009b1a
mov rcx, qword [rsp + 0x80]
jmp 0x140009b67
mov rcx, qword [rsp + 0x80]
jmp 0x140009a1c
mov rcx, qword [rsp + 0x80]
jmp 0x140009fd9
mov rcx, qword [0x140038090]
lea rdx, [0x14002dd1b]
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x140002bce
mov rcx, qword [rsp + 0x80]
jmp 0x140009ead
mov rcx, qword [rsp + 0x80]
jmp 0x140009e60
imul ecx, edx
mov edi, 9
mov r11d, 3
mov eax, ecx
cdq
idiv edi
mov eax, ecx
mov edi, 7
mov r8d, edx
cdq
idiv edi
mov eax, ecx
mov edi, 5
mov r9d, edx
cdq
idiv edi
mov eax, ecx
mov r10d, edx
cdq
idiv r11d
movzx r10d, r10b
movzx eax, dl
shl eax, 8
or eax, r10d
and cl, 1
jne 0x14000afc0
movzx r8d, r8b
shl eax, 8
movzx r9d, r9b
movd xmm0, dword [str.lKbAbAlKgok0ame0P]
or eax, r8d
shl eax, 8
or eax, r9d
movd xmm4, eax
paddb xmm4, xmm0
movdqa xmm0, xmm4
jmp 0x140009d54
mov rcx, qword [rsp + 0x80]
jmp 0x140009f75
mov rcx, qword [rsp + 0x80]
jmp 0x140009efa
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x1400096e5
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a2f9
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a285
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 0xffffffff
call method.std.__throw_length_error_char_const_
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
jne 0x140006aba
mov rcx, qword [rsp + 0x70]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140006aba
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a36d
mov eax, r9d
movd xmm0, dword [0x14002e15c]
shl eax, 8
or eax, edx
shl eax, 8
or eax, r9d
shl eax, 8
or eax, ecx
movd xmm5, eax
paddb xmm5, xmm0
movdqa xmm0, xmm5
jmp 0x140009d54
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a094
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a020
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a1a0
mov dword [rsp + 0xe8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140038090]
lea rdx, [0x14002d629]
mov dword [0x14002c028], eax
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], rax
jmp 0x14000aa8d
mov rcx, qword [0x140038090]
lea rdx, [0x14002d60d]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
xor ecx, ecx
movdqa xmm0, xmmword [0x14002e140]
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x390]
lea rdx, [rsp + 0x590]
mov dword [rsp + 0x20], r8d
mov r8d, 0x10
movaps xmmword [rsp + 0x590], xmm0
call sym.FilterSendMessage
mov rdi, qword [rsp + 0x78]
mov dword [rsp + 0x70], eax
call rdi
mov rcx, qword [rsp + 0x390]
mov dword [0x14002c028], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x70], 0
lea rdx, [0x14002d2c6]
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [0x140038090]
lea rax, [0x14002d2bd]
cmove rdx, rax
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x140004207.1003
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x140006aba
movzx r9d, r9b
shl eax, 8
movzx r8d, r8b
movd xmm0, dword [0x14002e154]
or eax, r9d
shl eax, 8
or eax, r8d
movd xmm5, eax
paddb xmm5, xmm0
movdqa xmm0, xmm5
jmp 0x140009d54
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a12c
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a455
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a49e
movzx eax, byte [rsp + 0x5a0]
mov byte [rcx], al
mov rcx, qword [0x140038320]
mov r8, qword [rsp + 0x598]
jmp 0x14000a3e1
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 9
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 0xa
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 4
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 5
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 0x10
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 3
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 7
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 1
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 0xd
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 6
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 8
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 2
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
mov dword [rsp + 0xe8], 0xd
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
lea rcx, [0x14002d28e]
call method.std.__throw_length_error_char_const_
mov rax, qword [rsp + 0xf0]
cmp dword [rsp + 0xe8], 0x20
mov qword [rsp + 0x68], rax
ja case.default.0x14000b2ac
mov eax, dword [rsp + 0xe8]
lea rdx, [0x14002ddf8]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
ud2
mov rcx, qword [rsp + 0x590]
lea rax, [rsp + 0x5a0]
cmp rcx, rax
je 0x14000b2fe
mov rax, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x14000b2fe
mov rcx, qword [rsp + 0x390]
lea rax, [rsp + 0x3a0]
cmp rcx, rax
je 0x14000b2fe
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov dword [rsp + 0xe8], 0xffffffff
mov rcx, qword [rsp + 0x68]
call dbg._Unwind_SjLj_Resume
mov rcx, qword [rsp + 0x390]
lea rax, [rsp + 0x3a0]
cmp rcx, rax
je case.0x14000b2ac.15
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
lea rax, [rsp + 0x240]
cmp rcx, rax
je 0x14000b2fe
mov rax, qword [rsp + 0x240]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x14000b2fe
mov rcx, qword [rsp + 0x390]
lea rax, [rsp + 0x3a0]
cmp rcx, rax
je case.0x14000b2ac.10
mov rax, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x230]
lea rax, [rsp + 0x240]
cmp rcx, rax
je case.0x14000b2ac.12
mov rax, qword [rsp + 0x240]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x190]
lea rax, [rsp + 0x1a0]
cmp rcx, rax
je 0x14000b2fe
mov rax, qword [rsp + 0x1a0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x14000b2fe