Function at 0x14017e790
Capabilities:
Create process on windows
Empty the recycle bin

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x5c8
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov r9d, dword [rsp + 0x5d8]
mov r8w, PathMakeUniqueName
mov edx, dword [rsp + 0x5d0]
mov cx, 0x47
call fcn.140181f10
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov ecx, 0xf8
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_ILCloneFirst]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov cx, reloc.SHELL32.dll_ILCreateFromPathW
call fcn.140182fd0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov cx, 0x3c
call fcn.140182fd0
call fcn.140181f50
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov ecx, 0xdd
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov cx, reloc.SHELL32.dll_ILAppendID
call fcn.140182fd0
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x110], rax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d8]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov cx, 0x59
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov edx, 4
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0xe4], eax
cmp dword [rsp + 0xe4], 0x3b1f68db
je 0x14017ee07
jmp 0x14017ee4e
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov ecx, 0xa9
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x14017eeda
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0xec], eax
cmp dword [rsp + 0xec], 0x6ff1ca88
je 0x14017ee92
jmp 0x14017eeb0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
jmp 0x14017eeda
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov ecx, reloc.SHELL32.dll_ILFindLastID
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d0]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jle 0x14017ef61
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0xf0], eax
cmp dword [rsp + 0xf0], 0x2b92d6a4
je 0x14017ef8c
jmp 0x14017efaa
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
jmp 0x14017efd4
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov ecx, 0x35
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov r8d, dword [rsp + 0x5e0]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5e0]
call fcn.14017e790
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
lea r9, [rsp + 0x1b0]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x9ffbfc7
je 0x14017f120
cmp dword [rsp + 0x50], 0x7c820e06
je 0x14017f110
jmp 0x14017f153
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
jmp 0x14017f153
mov cx, 0x50
call fcn.140182fd0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d8]
call fcn.14017e790
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov ecx, SHTestTokenMembership
call fcn.140182e60
mov ecx, 0x67
call fcn.140182e60
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x100], rax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x1da40d03
je 0x14017f22e
cmp dword [rsp + 0x54], 0x59dab70f
je 0x14017f292
jmp 0x14017f2e6
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
jmp 0x14017f2e6
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x138], rax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0x6212b38c
je 0x14017f351
jmp 0x14017f3de
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov ecx, 0xc2
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x14017f47a
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov ecx, 0xd2
call fcn.140182e60
mov ecx, 0x3b
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov cx, 0xa8
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov r9d, dword [rsp + 0x5d8]
mov r8w, 0xb8
mov edx, dword [rsp + 0x5d0]
mov cx, 0xed
call fcn.140181f10
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov r9d, 0x37
mov r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5d8]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5e0]
je 0x14017f52d
mov dword [rsp + 0x28], ILGetNext
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov ecx, 2
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0x68c7f6d1
je 0x14017f5fc
jmp 0x14017f641
mov r9d, dword [rsp + 0x5d0]
mov r8w, 0xb8
mov edx, dword [rsp + 0x5d0]
mov cx, 0xfc
call fcn.140181f10
mov ecx, 0xe7
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
jmp 0x14017f64f
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d8]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0x57d03b54
je 0x14017f6bf
jmp 0x14017f71d
mov ecx, reloc.SHELL32.dll_ILClone
call fcn.140182e60
mov r8d, dword [rsp + 0x5e0]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
jmp 0x14017f77f
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov cx, 0x51
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov r9d, dword [rsp + 0x5e0]
mov r8w, 0xc5
mov edx, dword [rsp + 0x5d0]
mov cx, PathMakeUniqueName
call fcn.140181f10
mov eax, dword [rsp + 0x5e0]
movzx ecx, al
mov eax, dword [rsp + 0x5d0]
shl eax, cl
cmp eax, dword [rsp + 0x5d8]
jle 0x14017f85a
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov dword [rsp + 0x40], eax
call fcn.140181f50
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d8]
call fcn.14017e790
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov ecx, 0xc7
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov ecx, 0xc2
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
movzx ecx, al
mov eax, dword [rsp + 0x5e0]
sar eax, cl
cmp eax, dword [rsp + 0x5d0]
jg 0x14017f984
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov r8d, dword [rsp + 0x5e0]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x34], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d0]
or ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5e0]
jle 0x14017faed
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0x2f1a1a1b
je 0x14017fa22
jmp 0x14017fadf
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x15425798
je 0x14017facf
cmp dword [rsp + 0x58], 0x2548110a
je 0x14017fa58
jmp 0x14017fadd
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf8]
lea r8, [rsp + 0xa8]
mov edx, 0x35
lea rcx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov r9d, dword [rsp + 0x5e0]
mov r8w, 0xf8
mov edx, dword [rsp + 0x5d0]
mov cx, reloc.SHELL32.dll_ILIsEqual
call fcn.140181f10
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
jmp 0x14017fadd
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
jmp 0x14017faed
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jg 0x14017fc06
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_ILRemoveLastID
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d8]
call fcn.14017e790
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov dword [rsp + 0x30], eax
mov cx, 0xa4
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x3462ed70
je 0x14017fce7
cmp dword [rsp + 0x5c], 0x5e64f430
je 0x14017fd9c
jmp 0x14017fdd4
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0x38248a0f
je 0x14017fd20
jmp 0x14017fd83
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x14017fd9a
mov cx, 0xe7
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x14017fdd4
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHTestTokenMembership
lea r9, [rsp + 0x120]
lea r8, [rsp + 0xf8]
mov edx, 0x73
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov ecx, 0xed
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov ecx, 0x59
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5e0]
xor ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d0]
jg 0x14017ff36
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x44], eax
mov ecx, reloc.COMCTL32.dll_MakeDragList
call fcn.140182e60
mov r9d, dword [rsp + 0x5e0]
mov r8w, 0x90
mov edx, dword [rsp + 0x5d8]
mov cx, SHGetNewLinkInfoW
call fcn.140181f10
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0xc0], eax
cmp dword [rsp + 0xc0], 0x1414fc18
je 0x14017ffda
jmp 0x14018002c
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov ecx, 0x37
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
jmp 0x140180048
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5d8]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5e0]
jl 0x1401800cf
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov ecx, ILGetNext
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x100]
mov edx, 0xb6
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov cx, 0xc7
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x4bd1e87c
je 0x1401801f0
cmp dword [rsp + 0x60], 0x50f19a2c
je 0x14018021f
jmp 0x1401802a5
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
jmp 0x1401802a5
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov r8d, 6
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0x84], eax
mov ecx, 0xb7
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov ecx, reloc.SHELL32.dll_ILFindChild
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5e0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov edx, reloc.SHELL32.dll_SHTestTokenMembership
mov rcx, qword [rsp + 0x160]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5e0]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d0]
jne 0x1401803d7
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov ecx, PathMakeUniqueName
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov ecx, 0x2a
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xc4]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0xdc], eax
mov cx, 0xd8
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
movzx ecx, al
mov eax, dword [rsp + 0x5e0]
sar eax, cl
cmp eax, dword [rsp + 0x5d0]
jne 0x1401804ec
call fcn.140181f50
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x3b794d41
je 0x140180564
cmp dword [rsp + 0x64], 0x4b623d1e
je 0x1401805ba
jmp 0x1401805fa
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x1401805fa
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x140], rax
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov ecx, 0xdb
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov ecx, 0x60
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov edx, 0x89
lea rcx, [rsp + 0x74]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
mov eax, dword [rsp + 0x5d8]
movzx ecx, al
mov eax, dword [rsp + 0x5d0]
shl eax, cl
cmp eax, dword [rsp + 0x5e0]
je 0x140180745
mov ecx, 0x27
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov ecx, 0x5a
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5d8]
or ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5e0]
jge 0x14018083d
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov r9d, dword [rsp + 0x5d0]
mov r8w, 0x4c
mov edx, dword [rsp + 0x5d0]
mov cx, 0x78
call fcn.140181f10
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0xc4
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x5e0]
mov edx, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x2fcb2934
je 0x1401809a3
cmp dword [rsp + 0x68], 0x33a612f5
je 0x140180974
jmp 0x140180a78
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
jmp 0x140180a78
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov r9d, 0x86
mov r8, qword [rsp + 0x170]
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x34], eax
mov r9d, dword [rsp + 0x5d8]
mov r8w, 0x5d
mov edx, dword [rsp + 0x5e0]
mov cx, 0xfa
call fcn.140181f10
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x24258465
je 0x140180a3e
cmp dword [rsp + 0x6c], 0x3b0f8e19
je 0x140180a6a
jmp 0x140180a78
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
jmp 0x140180a78
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5e0]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d0]
jl 0x140180b73
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
lea r9, [rsp + 0x128]
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x140]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jl 0x140180c28
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x150], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov cx, SHDoDragDrop
call fcn.140182fd0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d0]
xor ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jle 0x140180d48
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jne 0x140180dd6
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
lea rcx, [rsp + 0x160]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0xe8], eax
mov ecx, 0x46
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0xe79e218
je 0x140180e50
cmp dword [rsp + 0x70], 0xffc10a2
je 0x140180e24
jmp 0x140180ebc
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
jmp 0x140180ebc
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov r8d, 0x8a
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0x74], eax
mov cx, 0x9d
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xc8], 0x36534569
je 0x140180f48
jmp 0x140180f66
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
jmp 0x140180fb6
mov ecx, 0x62
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov cx, 0x3d
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov ecx, ILGetNext
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov r8d, dword [rsp + 0x5e0]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5e0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x195d3429
je 0x1401810fa
cmp dword [rsp + 0x78], 0x77ad8853
je 0x1401810c0
jmp 0x140181116
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x140181116
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x4b7b4874
je 0x14018113e
cmp dword [rsp + 0x7c], 0x4f9c8b82
je 0x1401811cd
jmp 0x14018126f
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov r9d, 0x27
mov r8, qword [rsp + 0xa0]
mov edx, 0xa1
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov dword [rsp + 0xe8], eax
jmp 0x14018126f
mov r9d, dword [rsp + 0x5d8]
mov r8w, 0xc1
mov edx, dword [rsp + 0x5d0]
mov cx, 0xc3
call fcn.140181f10
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
or ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jne 0x14018126f
call fcn.140181f50
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0xd0], 0x2b50ce2b
je 0x140181243
jmp 0x140181261
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
jmp 0x14018126f
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov ecx, 0x88
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov cx, 0x5c
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_ILCloneFirst]
mov qword [rsp + 0x148], rax
mov eax, dword [rsp + 0x5d8]
movzx ecx, al
mov eax, dword [rsp + 0x5d0]
sar eax, cl
cmp eax, dword [rsp + 0x5e0]
jne 0x1401813ae
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0x7cb2bd72
je 0x14018136b
jmp 0x140181397
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
jmp 0x1401813ae
mov cx, PathMakeUniqueName
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5d8]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
lea rcx, [rsp + 0x148]
call qword [sym.imp.SHELL32.dll_ILFree]
mov cx, 0xf1
call fcn.140182fd0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
movzx ecx, al
mov eax, dword [rsp + 0x5e0]
shl eax, cl
cmp eax, dword [rsp + 0x5d8]
jge 0x14018155a
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov cx, 0x21
call fcn.140182fd0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
jmp 0x140181627
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
je 0x140181627
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov cx, 0xe6
call fcn.140182fd0
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x100]
mov edx, 0x9d
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x198], rax
mov ecx, 0x32
call fcn.140182e60
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov ecx, 0x78
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0x6607633
je 0x14018166c
cmp dword [rsp + 0x80], 0x3d980bf2
je 0x1401816a6
jmp 0x140181723
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
jmp 0x140181723
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jge 0x140181723
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov edx, 0xea
lea rcx, [rsp + 0x138]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x84], eax
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jne 0x140181837
mov cx, reloc.SHELL32.dll_SHTestTokenMembership
call fcn.140182fd0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov r9d, dword [rsp + 0x5d8]
mov r8w, 1
mov edx, dword [rsp + 0x5d0]
mov cx, 0xc5
call fcn.140181f10
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
movzx ecx, al
mov eax, dword [rsp + 0x5d0]
sar eax, cl
cmp eax, dword [rsp + 0x5d8]
jl 0x1401818e7
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
movzx ecx, al
mov eax, dword [rsp + 0x5d8]
shl eax, cl
cmp eax, dword [rsp + 0x5d0]
jne 0x1401818b9
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x88], eax
mov cx, 0x63
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0x693a11c1
je 0x14018190d
jmp 0x140181947
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
jmp 0x1401819a8
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov r8d, dword [rsp + 0x5d0]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5d8]
call fcn.14017e790
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov cx, 3
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
lea r9, [rsp + 0x1b0]
lea r8, [rsp + 0xa8]
mov edx, 0x5c
mov ecx, 0xfa
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov ecx, 7
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5e0]
call fcn.14017e790
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
call fcn.140181f50
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0x1a0], rax
mov r8d, dword [rsp + 0x5d8]
mov edx, dword [rsp + 0x5e0]
mov ecx, dword [rsp + 0x5e0]
call fcn.14017e790
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0x30123032
je 0x140181c0a
cmp dword [rsp + 0x8c], 0x761d1e7c
je 0x140181bdb
jmp 0x140181ca4
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
jmp 0x140181ca4
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov ecx, dword [rsp + 0x5e0]
or ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x5d8]
jg 0x140181c5d
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov r9d, dword [rsp + 0x5e0]
mov r8w, 0xa3
mov edx, dword [rsp + 0x5e0]
mov cx, 0x2b
call fcn.140181f10
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov edx, 0xc3
lea rcx, [rsp + 0x148]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x34], eax
mov r9d, dword [rsp + 0x5d0]
mov r8w, 0xca
mov edx, dword [rsp + 0x5d8]
mov cx, 0x9f
call fcn.140181f10
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov cx, 0x81
call fcn.140182fd0
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xe0], 0x15cce140
je 0x140181d9b
jmp 0x140181e21
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov ecx, 0x27
call fcn.140182e60
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov ecx, 0x3d
call fcn.140182e60
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
jmp 0x140181e46
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
lea rdx, [rsp + 0x1f0]
mov ecx, reloc.SHELL32.dll_ILGetNext
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x54e04fc6
je 0x140181e70
cmp dword [rsp + 0x90], 0x699db40b
je 0x140181eaa
jmp 0x140181ed4
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d8]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
jmp 0x140181ed4
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5e0]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x5d8], eax
mov eax, 0xca
add rsp, 0x5c8
ret