Function at 0x1400267b0
Capabilities:
Create directory
Create process on windows
Create process suspended
Delete file
Enumerate files on windows
Execute command
Get common file path
Get file size
Log keystrokes via polling
Query or enumerate registry value
Read file on windows
Set console window title
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push rdi
mov eax, 0x1170
call fcn.14002c9f0
sub rsp, rax
mov qword [rsp + 0x7e0], 0xfffffffffffffffe
lea rax, [rsp + 0x990]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0xef0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0xde0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xde0]
lea rcx, [rsp + 0x890]
call fcn.140010d10
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x1d0], rax
lea rcx, [0x140043b90]
call fcn.1403b04e7
nop
mov qword [rsp + 0x1c8], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1d0]
call fcn.140016a90
cmp rax, 0xffffffffffffffff
jne 0x140026873
mov dword [rsp + 0x70], 1
jmp 0x14002687b
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x890]
call fcn.140010dc0
movzx eax, byte [rsp + 0x51]
test eax, eax
je 0x140026ba5
mov edx, 0x104
lea rcx, [rsp + 0xf60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [rsp + 0xf60]
lea rcx, [rsp + 0x750]
call fcn.140010d10
nop
lea rcx, [0x140043ba0]
call fcn.1403b04e7
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x750]
call fcn.140016a90
mov qword [rsp + 0x1e0], rax
lea rdx, [rsp + 0x800]
lea rcx, [rsp + 0x750]
call fcn.140016880
mov rax, qword [rax]
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x1f8], rax
lea rdx, [rsp + 0x808]
lea rcx, [rsp + 0x750]
call fcn.140016670
mov qword [rsp + 0x1e8], rax
mov r8, qword [rsp + 0x1e0]
lea rdx, [rsp + 0x7d0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400221d0
mov rax, qword [rax]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x200], rax
mov r9, qword [rsp + 0x1f8]
mov r8, qword [rsp + 0x200]
lea rdx, [rsp + 0x7d8]
lea rcx, [rsp + 0x750]
call fcn.140026030
lea rax, [rsp + 0x7e8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0xd70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rcx, [0x140043bb8]
call fcn.1403b04e7
nop
mov r8, rax
lea rdx, [rsp + 0x750]
lea rcx, [rsp + 0x8b0]
call fcn.14001fb30
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0x208]
call fcn.140016750
lea rcx, [rsp + 0x7e8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xd70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0xc0], eax
lea rcx, [rsp + 0x8b0]
call fcn.140010dc0
cmp dword [rsp + 0xc0], 0
je 0x140026b81
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x120089
lea rcx, [rsp + 0xde0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xb8], 0
cmp qword [rsp + 0x88], 0xffffffffffffffff
je 0x140026b42
mov dword [rsp + 0xc4], 0
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
mov ecx, eax
call fcn.14002c3dc
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc4]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8d, eax
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x7e8]
call fcn.140023be0
mov dword [rsp + 0xc8], 0
lea rcx, [rsp + 0x750]
call fcn.140010dc0
mov eax, dword [rsp + 0xc8]
jmp 0x1400289eb
lea rax, [rsp + 0x770]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x770]
and eax, 0xfffffffe
mov dword [rsp + 0x770], eax
mov eax, dword [rsp + 0x770]
and eax, 0xfffffff7
mov dword [rsp + 0x770], eax
lea rcx, [0x14003f81c]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov r8d, 1
mov edx, 0x40021
lea rcx, [rsp + 0x770]
call qword [sym.imp.SHELL32.dll_SHGetSetSettings]
lea rcx, [0x140043bc8]
call fcn.1403b04e7
nop
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rcx, [0x140043bd8]
call fcn.1403b04e7
nop
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
call fcn.1400265e0
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x220], rax
lea rcx, [0x140043bf0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x218], rax
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x220]
call fcn.140012720
mov qword [rsp + 0x228], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x228]
call qword [0x140035288]
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x238], rax
lea rcx, [0x140043c10]
call fcn.1403b04e7
nop
mov qword [rsp + 0x230], rax
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x238]
call fcn.140012720
mov qword [rsp + 0x240], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x240]
call qword [0x140035288]
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x250], rax
lea rcx, [0x140043c30]
call fcn.1403b04e7
nop
mov qword [rsp + 0x248], rax
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
call fcn.140012720
mov qword [rsp + 0x258], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x258]
call qword [0x140035288]
lea rdx, [0x14003f5ae]
lea rcx, [rsp + 0x108]
call fcn.140010d10
nop
lea rdx, [0x14003f5af]
lea rcx, [rsp + 0xe8]
call fcn.140010d10
nop
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0
je 0x140026d94
xor edx, edx
mov rcx, qword [rsp + 0x138]
call fcn.140021e90
mov qword [rsp + 0x140], rax
jmp 0x140026da0
mov qword [rsp + 0x140], 0
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0x9a8]
mov qword [rsp + 0x268], rax
lea rdx, [0x14003f5b6]
mov rcx, qword [rsp + 0x268]
call fcn.140010d10
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x9c8]
mov qword [rsp + 0x280], rax
lea rcx, [0x140043c50]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x280]
call fcn.140010d10
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x298], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x298]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x2a0]
call fcn.140015950
lea rcx, [0x140043c80]
call fcn.1403b04e7
nop
lea rdx, [rsp + 0xe8]
mov rcx, rax
call fcn.14001fa90
movzx eax, al
test eax, eax
je 0x140026f3c
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x2b0], rax
lea rcx, str.PhgG
call fcn.1403b04e7
nop
mov qword [rsp + 0x2a8], rax
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2b0]
call fcn.140012720
lea rcx, [0x140043ce4]
call fcn.1403b04e7
nop
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x90], 0
lea rcx, [rsp + 0xe8]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x108]
call fcn.140010dc0
mov eax, dword [rsp + 0x90]
jmp 0x1400289eb
lea rdx, [0x14003f5b7]
lea rcx, [rsp + 0xe8]
call fcn.140022160
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x78], 0
lea rcx, [0x140043cf0]
call fcn.1403b04e7
nop
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400271d4
lea rcx, [0x140043d20]
call fcn.1403b04e7
nop
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x2c0], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400271cf
lea rax, [rsp + 0x1070]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov dword [rsp + 0x74], 0
lea rcx, [0x140043d40]
call fcn.1403b04e7
nop
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x2d0], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x74], 0
je 0x1400271cf
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x78], 0
lea rcx, [0x140043d60]
call fcn.1403b04e7
nop
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400271cf
mov dword [rsp + 0x94], 0
lea rcx, [0x140043d90]
call fcn.1403b04e7
nop
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x2e0], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x94]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400271cf
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x2f0], rax
lea rcx, [0x140043db0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x2e8], rax
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2f0]
call fcn.140012720
mov qword [rsp + 0x2f8], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x2f8]
call qword [0x140035288]
lea rcx, [0x140043dbc]
call fcn.1403b04e7
nop
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x98], 0
lea rcx, [rsp + 0xe8]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x108]
call fcn.140010dc0
mov eax, dword [rsp + 0x98]
jmp 0x1400289eb
jmp 0x14002733c
lea rcx, [0x140043dc8]
call fcn.1403b04e7
nop
lea rcx, [rsp + 0x740]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x300]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14002733c
mov dword [rsp + 0x9c], 0
lea rcx, [0x140043df8]
call fcn.1403b04e7
nop
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14002733c
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x320], rax
lea rcx, [0x140043e18]
call fcn.1403b04e7
nop
mov qword [rsp + 0x318], rax
mov rdx, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x320]
call fcn.140012720
mov qword [rsp + 0x328], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x328]
call qword [0x140035288]
lea rcx, [0x140043e24]
call fcn.1403b04e7
nop
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0xa0], 0
lea rcx, [rsp + 0xe8]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x108]
call fcn.140010dc0
mov eax, dword [rsp + 0xa0]
jmp 0x1400289eb
lea rcx, [rsp + 0xd0]
call fcn.140021d50
nop
lea rcx, [0x140043e30]
call fcn.1403b04e7
nop
lea rdx, [rsp + 0xc30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0xffffffffffffffff
je 0x1400273de
mov eax, dword [rsp + 0xc30]
and eax, 0x10
test eax, eax
je 0x14002738b
jmp 0x1400273c4
lea rdx, [rsp + 0xc5c]
lea rcx, [rsp + 0x850]
call fcn.140010d10
nop
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0xd0]
call fcn.140026620
nop
lea rcx, [rsp + 0x850]
call fcn.140010dc0
lea rdx, [rsp + 0xc30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002737b
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x148], 0
je 0x140027414
xor edx, edx
mov rcx, qword [rsp + 0x148]
call fcn.140021e90
mov qword [rsp + 0x150], rax
jmp 0x140027420
mov qword [rsp + 0x150], 0
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x370], rax
lea rax, [rsp + 0x9e8]
mov qword [rsp + 0x338], rax
lea rdx, [0x14003f5c5]
mov rcx, qword [rsp + 0x338]
call fcn.140010d10
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0xa08]
mov qword [rsp + 0x350], rax
lea rcx, [0x140043e60]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x350]
call fcn.140010d10
mov qword [rsp + 0x358], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x368], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x368]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x370]
call fcn.140015950
lea rcx, [0x140043e90]
call fcn.1403b04e7
nop
mov qword [rsp + 0x388], rax
lea rcx, [0x140043e98]
call fcn.1403b04e7
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x8f0]
call fcn.14001fbf0
mov qword [rsp + 0x378], rax
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x380], rax
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x390], rax
mov r8, qword [rsp + 0x388]
mov rdx, qword [rsp + 0x390]
lea rcx, [rsp + 0x8d0]
call fcn.14001fad0
mov qword [rsp + 0x398], rax
mov rdx, qword [rsp + 0x398]
lea rcx, [0x14004f6e0]
call fcn.140010e10
lea rcx, [rsp + 0x8d0]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x8f0]
call fcn.140010dc0
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
jmp 0x1400275e2
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x58]
mov qword [rsp + 0x3a0], rax
lea rcx, [rsp + 0xd0]
call fcn.140026730
mov rcx, qword [rsp + 0x3a0]
cmp rcx, rax
jae 0x1400276ce
movsxd rax, dword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140025d40
mov qword [rsp + 0x3a8], rax
xor r8d, r8d
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x3a8]
call fcn.1400260d0
cmp rax, 0xffffffffffffffff
je 0x14002764f
mov byte [rsp + 0x50], 1
jmp 0x1400276c9
movsxd rax, dword [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140025d40
mov qword [rsp + 0x3b0], rax
lea rcx, [0x140043eb0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x3b8], rax
mov r8, qword [rsp + 0x3b0]
mov rdx, qword [rsp + 0x3b8]
lea rcx, [rsp + 0x910]
call fcn.14001fbf0
mov qword [rsp + 0x3c0], rax
mov rcx, qword [rsp + 0x3c0]
call fcn.140016750
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x910]
call fcn.140010dc0
jmp 0x1400275d8
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x1400278ca
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
je 0x14002770f
mov rcx, qword [rsp + 0x158]
call fcn.140021e10
mov qword [rsp + 0x160], rax
jmp 0x14002771b
mov qword [rsp + 0x160], 0
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x3c8], rax
mov rax, qword [rsp + 0x3c8]
mov qword [rsp + 0x408], rax
lea rax, [rsp + 0xa28]
mov qword [rsp + 0x3d0], rax
lea rdx, [0x14003f5c6]
mov rcx, qword [rsp + 0x3d0]
call fcn.140010d10
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x3f8], rax
lea rax, [rsp + 0xa48]
mov qword [rsp + 0x3e8], rax
lea rcx, [0x140043ec8]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x3e8]
call fcn.140010d10
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x400], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x3f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x400]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x408]
call fcn.140015950
mov dword [rsp + 0xa4], 0
lea rcx, [0x14004f6e0]
call fcn.140016750
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x108]
call fcn.140016bd0
mov dword [rsp + 0xa8], eax
lea rcx, [rsp + 0x108]
call fcn.140016750
mov qword [rsp + 0x410], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa4]
mov r8d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x410]
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x744], eax
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x168], rax
cmp qword [rsp + 0x168], 0
je 0x140027900
xor edx, edx
mov rcx, qword [rsp + 0x168]
call fcn.140021e90
mov qword [rsp + 0x170], rax
jmp 0x14002790c
mov qword [rsp + 0x170], 0
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x458], rax
lea rdx, [0x14003f5c7]
lea rcx, [rsp + 0x790]
call fcn.140010d10
nop
lea rax, [rsp + 0xa68]
mov qword [rsp + 0x420], rax
lea rdx, [0x14003f5da]
mov rcx, qword [rsp + 0x420]
call fcn.140010d10
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0xa88]
mov qword [rsp + 0x438], rax
lea rcx, [0x140043ef8]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x438]
call fcn.140010d10
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x790]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x450]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x458]
call fcn.140015950
lea rax, [rsp + 0xaa8]
mov qword [rsp + 0x460], rax
lea rdx, [0x14004f6e0]
mov rcx, qword [rsp + 0x460]
call fcn.140014180
mov qword [rsp + 0x468], rax
mov rdx, qword [rsp + 0x468]
lea rcx, [rsp + 0x810]
call fcn.140022620
nop
lea rdx, [rsp + 0x790]
lea rcx, [rsp + 0x810]
call fcn.14001fa50
movzx eax, al
test eax, eax
je 0x140027b20
mov byte [rsp + 0x50], 0
lea rcx, [0x14004f6e0]
call fcn.140016750
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x478], rax
lea rcx, [0x140043f28]
call fcn.1403b04e7
nop
mov qword [rsp + 0x470], rax
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x478]
call fcn.140012720
mov qword [rsp + 0x480], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x480]
call qword [0x140035288]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x810]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x790]
call fcn.140010dc0
nop
lea rcx, [rsp + 0xd0]
call fcn.1400220d0
jmp 0x14002733c
lea rcx, [rsp + 0x810]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x790]
call fcn.140010dc0
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x108]
call fcn.140025ea0
lea rcx, [rsp + 0xe8]
call fcn.140025ea0
lea rcx, [rsp + 0xd0]
call fcn.140025ed0
lea rcx, [0x140043f50]
call fcn.1403b04e7
nop
lea rdx, [rsp + 0xc30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0xffffffffffffffff
je 0x140027bfb
mov eax, dword [rsp + 0xc30]
and eax, 0x10
test eax, eax
je 0x140027ba8
jmp 0x140027be1
lea rdx, [rsp + 0xc5c]
lea rcx, [rsp + 0x870]
call fcn.140010d10
nop
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0xd0]
call fcn.140026620
nop
lea rcx, [rsp + 0x870]
call fcn.140010dc0
lea rdx, [rsp + 0xc30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140027b98
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x178], 0
je 0x140027c31
xor edx, edx
mov rcx, qword [rsp + 0x178]
call fcn.140021e90
mov qword [rsp + 0x180], rax
jmp 0x140027c3d
mov qword [rsp + 0x180], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x4c8], rax
lea rax, [rsp + 0xac8]
mov qword [rsp + 0x490], rax
lea rdx, [0x14003f5db]
mov rcx, qword [rsp + 0x490]
call fcn.140010d10
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4b8], rax
lea rax, [rsp + 0xae8]
mov qword [rsp + 0x4a8], rax
lea rcx, [0x140043f80]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140010d10
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x4c0], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x4c0]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x4c8]
call fcn.140015950
lea rcx, [0x140043fb0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x4e0], rax
lea rcx, [0x140043fb8]
call fcn.1403b04e7
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x950]
call fcn.14001fbf0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
mov rax, qword [rsp + 0x4d8]
mov qword [rsp + 0x4e8], rax
mov r8, qword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x4e8]
lea rcx, [rsp + 0x930]
call fcn.14001fad0
mov qword [rsp + 0x4f0], rax
mov rdx, qword [rsp + 0x4f0]
lea rcx, [0x14004f6a0]
call fcn.140010e10
lea rcx, [rsp + 0x930]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x950]
call fcn.140010dc0
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x5c], 0
jmp 0x140027dff
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
mov qword [rsp + 0x4f8], rax
lea rcx, [rsp + 0xd0]
call fcn.140026730
mov rcx, qword [rsp + 0x4f8]
cmp rcx, rax
jae 0x140027eeb
movsxd rax, dword [rsp + 0x5c]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140025d40
mov qword [rsp + 0x500], rax
xor r8d, r8d
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x500]
call fcn.1400260d0
cmp rax, 0xffffffffffffffff
je 0x140027e6c
mov byte [rsp + 0x50], 1
jmp 0x140027ee6
movsxd rax, dword [rsp + 0x5c]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140025d40
mov qword [rsp + 0x508], rax
lea rcx, [0x140043fd0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x510], rax
mov r8, qword [rsp + 0x508]
mov rdx, qword [rsp + 0x510]
lea rcx, [rsp + 0x970]
call fcn.14001fbf0
mov qword [rsp + 0x518], rax
mov rcx, qword [rsp + 0x518]
call fcn.140016750
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x970]
call fcn.140010dc0
jmp 0x140027df5
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x1400280e7
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x188], rax
cmp qword [rsp + 0x188], 0
je 0x140027f2c
mov rcx, qword [rsp + 0x188]
call fcn.140021e10
mov qword [rsp + 0x1b8], rax
jmp 0x140027f38
mov qword [rsp + 0x1b8], 0
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x560], rax
lea rax, [rsp + 0xb08]
mov qword [rsp + 0x528], rax
lea rdx, [0x14003f5df]
mov rcx, qword [rsp + 0x528]
call fcn.140010d10
mov qword [rsp + 0x530], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x538], rax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x550], rax
lea rax, [rsp + 0xb28]
mov qword [rsp + 0x540], rax
lea rcx, [0x140043fe8]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x540]
call fcn.140010d10
mov qword [rsp + 0x548], rax
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x558], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x550]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x558]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x560]
call fcn.140015950
mov dword [rsp + 0xac], 0
lea rcx, [0x14004f6a0]
call fcn.140016750
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x198], rax
lea rcx, [rsp + 0x108]
call fcn.140016bd0
mov dword [rsp + 0xb0], eax
lea rcx, [rsp + 0x108]
call fcn.140016750
mov qword [rsp + 0x568], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xac]
mov r8d, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x748], eax
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x1a0], rax
cmp qword [rsp + 0x1a0], 0
je 0x14002811d
xor edx, edx
mov rcx, qword [rsp + 0x1a0]
call fcn.140021e90
mov qword [rsp + 0x1a8], rax
jmp 0x140028129
mov qword [rsp + 0x1a8], 0
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x570], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x5b0], rax
lea rdx, [0x14003f5ed]
lea rcx, [rsp + 0x7b0]
call fcn.140010d10
nop
lea rax, [rsp + 0xb48]
mov qword [rsp + 0x578], rax
lea rdx, [0x14003f5ee]
mov rcx, qword [rsp + 0x578]
call fcn.140010d10
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x588], rax
mov rax, qword [rsp + 0x588]
mov qword [rsp + 0x5a0], rax
lea rax, [rsp + 0xb68]
mov qword [rsp + 0x590], rax
lea rcx, [0x140044018]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x590]
call fcn.140010d10
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x598]
mov qword [rsp + 0x5a8], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x5a8]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x5b0]
call fcn.140015950
lea rax, [rsp + 0xb88]
mov qword [rsp + 0x5b8], rax
lea rdx, [0x14004f6a0]
mov rcx, qword [rsp + 0x5b8]
call fcn.140014180
mov qword [rsp + 0x5c0], rax
mov rdx, qword [rsp + 0x5c0]
lea rcx, [rsp + 0x830]
call fcn.140022620
nop
lea rdx, [rsp + 0x7b0]
lea rcx, [rsp + 0x830]
call fcn.14001fa50
movzx eax, al
test eax, eax
je 0x14002832f
mov byte [rsp + 0x50], 0
lea rcx, [0x14004f6a0]
call fcn.140016750
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x5d0], rax
lea rcx, [0x140044048]
call fcn.1403b04e7
nop
mov qword [rsp + 0x5c8], rax
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rsp + 0x5d0]
call fcn.140012720
mov qword [rsp + 0x5d8], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x5d8]
call qword [0x140035288]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x830]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x7b0]
call fcn.140010dc0
jmp 0x140027b3b
lea rcx, [rsp + 0x830]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x7b0]
call fcn.140010dc0
lea rcx, [0x140044070]
call fcn.1403b04e7
nop
mov edx, 1
mov rcx, rax
call fcn.140024620
lea rcx, [0x140044088]
call fcn.1403b04e7
nop
mov edx, 1
mov rcx, rax
call fcn.140024620
call fcn.140011f20
movzx eax, al
test eax, eax
je 0x14002895a
call fcn.1400120b0
movzx eax, al
test eax, eax
jne 0x140028613
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x53], 1
mov byte [rsp + 0x52], 1
call fcn.14001c740
mov qword [0x14004f648], rax
cmp qword [0x14004f648], 0xffffffffffffffff
jne 0x14002841e
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x5e8], rax
lea rcx, [0x1400440a0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x5e0], rax
mov rdx, qword [rsp + 0x5e0]
mov rcx, qword [rsp + 0x5e8]
call fcn.140012720
mov qword [rsp + 0x5f0], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x5f0]
call qword [0x140035288]
jmp 0x14002860e
mov dword [rsp + 0xb4], 0
mov rax, qword [0x14004f4b8]
mov qword [rsp + 0x608], rax
mov rax, qword [0x14004f648]
mov qword [rsp + 0x610], rax
lea rax, [rsp + 0xba8]
mov qword [rsp + 0x5f8], rax
lea rdx, [0x14004f6e0]
mov rcx, qword [rsp + 0x5f8]
call fcn.140014180
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0x618], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x48], rax
lea rax, [0x140025dc0]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x52]
mov byte [rsp + 0x38], al
movzx eax, byte [rsp + 0x53]
mov byte [rsp + 0x30], al
mov byte [rsp + 0x28], 1
movzx eax, byte [rsp + 0x54]
mov byte [rsp + 0x20], al
mov r9, qword [rsp + 0x608]
xor r8d, r8d
mov rdx, qword [rsp + 0x610]
mov rcx, qword [rsp + 0x618]
call fcn.140029790
test rax, rax
jne 0x140028548
mov rcx, qword [0x14004f648]
call fcn.14001d810
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x628], rax
lea rcx, [0x1400440b0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x620], rax
mov rdx, qword [rsp + 0x620]
mov rcx, qword [rsp + 0x628]
call fcn.140012720
mov qword [rsp + 0x630], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x630]
call qword [0x140035288]
jmp 0x14002860e
mov rcx, qword [0x14004f648]
call fcn.14001d810
movzx eax, al
test eax, eax
jne 0x1400285b3
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x640], rax
lea rcx, [0x1400440c0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x638], rax
mov rdx, qword [rsp + 0x638]
mov rcx, qword [rsp + 0x640]
call fcn.140012720
mov qword [rsp + 0x648], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x648]
call qword [0x140035288]
jmp 0x14002860e
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x658], rax
lea rcx, [0x1400440d0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x650], rax
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rsp + 0x658]
call fcn.140012720
mov qword [rsp + 0x660], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x660]
call qword [0x140035288]
jmp 0x14002837e
jmp 0x140028958
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x670], rax
lea rcx, [0x1400440e0]
call fcn.1403b04e7
nop
mov qword [rsp + 0x668], rax
mov rdx, qword [rsp + 0x668]
mov rcx, qword [rsp + 0x670]
call fcn.140012720
mov qword [rsp + 0x678], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x678]
call qword [0x140035288]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x690], rax
mov dword [0x14004f038], 1
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x688], rax
lea rcx, [0x1400440f8]
call fcn.1403b04e7
nop
mov qword [rsp + 0x680], rax
mov rdx, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x688]
call fcn.140012720
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [rsp + 0x690]
cmp rax, 0xfa0
jae 0x1400286fe
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400286fc
mov edx, 0x64
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
mov dword [0x14004f038], 2
jmp 0x1400286fe
jmp 0x1400286ba
mov rax, qword [0x140035288]
mov qword [rsp + 0x6a0], rax
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x698], rax
cmp dword [0x14004f038], 1
jne 0x14002873c
lea rcx, [0x140044110]
call fcn.1403b04e7
nop
mov qword [rsp + 0x130], rax
jmp 0x140028751
lea rcx, [0x140044120]
call fcn.1403b04e7
nop
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x698]
call fcn.140012720
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x6a0]
mov qword [rsp + 0x6b0], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x6a8]
call qword [rsp + 0x6b0]
lea rax, [rsp + 0xbc8]
mov qword [rsp + 0x6b8], rax
lea rdx, [0x14004f6a0]
mov rcx, qword [rsp + 0x6b8]
call fcn.140014180
mov qword [rsp + 0x6c0], rax
mov rcx, qword [rsp + 0x6c0]
call fcn.140022880
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x6d0], rax
lea rcx, [0x140044130]
call fcn.1403b04e7
nop
mov qword [rsp + 0x6c8], rax
mov rdx, qword [rsp + 0x6c8]
mov rcx, qword [rsp + 0x6d0]
call fcn.140012720
mov qword [rsp + 0x6d8], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x6d8]
call qword [0x140035288]
mov ecx, 0xb8
call fcn.14002c398
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
je 0x140028859
xor edx, edx
mov rcx, qword [rsp + 0x128]
call fcn.140021e90
mov qword [rsp + 0x1b0], rax
jmp 0x140028865
mov qword [rsp + 0x1b0], 0
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x720], rax
lea rax, [rsp + 0xbe8]
mov qword [rsp + 0x6e8], rax
lea rdx, [0x14003f5ef]
mov rcx, qword [rsp + 0x6e8]
call fcn.140010d10
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x6f8], rax
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0x710], rax
lea rax, [rsp + 0xc08]
mov qword [rsp + 0x700], rax
lea rcx, [0x140044150]
call fcn.1403b04e7
nop
mov rdx, rax
mov rcx, qword [rsp + 0x700]
call fcn.140010d10
mov qword [rsp + 0x708], rax
mov rax, qword [rsp + 0x708]
mov qword [rsp + 0x718], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x710]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x718]
mov r8d, 0xb
mov edx, 0xa
mov rcx, qword [rsp + 0x720]
call fcn.140015950
jmp 0x1400289b0
mov rax, qword [0x1400352a8]
mov qword [rsp + 0x730], rax
lea rcx, [0x140044180]
call fcn.1403b04e7
nop
mov qword [rsp + 0x728], rax
mov rdx, qword [rsp + 0x728]
mov rcx, qword [rsp + 0x730]
call fcn.140012720
mov qword [rsp + 0x738], rax
lea rdx, [0x140013fa0]
mov rcx, qword [rsp + 0x738]
call qword [0x140035288]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0xd0]
call fcn.1400220d0
nop
lea rcx, [rsp + 0xe8]
call fcn.140010dc0
nop
lea rcx, [rsp + 0x108]
call fcn.140010dc0
jmp 0x1400289e9
xor eax, eax
add rsp, 0x1170
pop rdi
ret