Function at 0x140001010
Capabilities:
Check for unexpected memory writes
Check mutex on windows
Copy file
Encode data using xor
Extract resource via kernel32 functions
Get disk information
Get file size
Get geographical location
Get session user name
Get system information on windows
Identify system language via api
Query environment variable
Read file on windows
Resume thread
Set current directory
Set file attributes
Suspend thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x12c8
call fcn.140008fb0
sub rsp, rax
movabs rax, 0x7a8d7f4cb62daa
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x70], 0x9a16
movabs rax, 0x7d8ce599153ce5
mov qword [rsp + 0xd8], rax
mov eax, 0x3ab
mov word [rsp + 0x48], ax
mov eax, 0x42b
mov word [rsp + 0xb8], ax
mov eax, 0x681
mov word [rsp + 0x64], ax
mov byte [rsp + 0x40], 0x1c
mov byte [rsp + 0x5c], 0x71
mov byte [rsp + 0x44], 0x9c
movabs rax, 0x7d4ab17c164f8f
mov qword [rsp + 0x78], rax
mov eax, 0x114
mov word [rsp + 0x54], ax
mov dword [rsp + 0x150], 0xf4f4
mov dword [rsp + 0x174], 0x36aa
mov byte [rsp + 0x41], 0x31
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x440], rax
movabs rax, 0x7259a9bf67f5c7
mov qword [rsp + 0x80], rax
movzx eax, byte [rsp + 0x41]
add eax, 0xf5
mov byte [rsp + 0x41], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x1a4], 0xe81c
movabs rax, 0x70d0ca6dffa9b9
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x88]
sar rax, 0xe3
cmp rax, qword [rsp + 0x80]
jne 0x1400011a7
movabs rax, 0x723881140bbc97
mov rcx, qword [rsp + 0x80]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
movabs rax, 0x7dbd4cec1776d8
mov rcx, qword [rsp + 0x78]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
movabs rax, 0x7cdcec01c0ad06
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
jmp 0x14000128d
movabs rax, 0x77f0c5d7d99a67
cmp qword [rsp + 0x78], rax
ja 0x14000122a
mov eax, 0xd7
mov word [rsp + 0x50], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x448], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.Ki99Re0dHLmL6KMJ_tNe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x128], rax
lea rcx, str.YI3St4Ca5_IucH54jF
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x108], ax
jmp 0x14000128d
mov rax, qword [rsp + 0x88]
shl rax, 0x51
cmp rax, qword [rsp + 0x80]
jle 0x14000126e
movabs rax, 0x718de2193b9f24
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x80]
mov ecx, 0x48
call fcn.140005670
jmp 0x14000128d
mov r8d, 0x80
mov rdx, qword [rsp + 0x190]
mov ecx, 0xca
call sub.KERNEL32.dll_VerLanguageNameW
mov dword [rsp + 0x98], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x1b8], 0x2c4e
movabs rax, 0x7a55b443a26fba
cmp qword [rsp + 0x78], rax
jae 0x140001366
mov eax, dword [rsp + 0x98]
shl eax, 7
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x1a8], 0x24af
mov eax, 0xb4b
mov word [rsp + 0x4c], ax
mov dword [rsp + 0xc8], 0x6767767e
mov byte [0x140024ad0], 0x19
movsx eax, byte [0x140024ad0]
sar eax, 1
mov byte [rsp + 0x40], al
movsx eax, word [rsp + 0x50]
cmp eax, 0x9c
jg 0x140001364
mov edx, 0xee
mov rcx, qword [rsp + 0x1f0]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0x140], eax
mov eax, dword [rsp + 0x98]
sub eax, 0xc06f
mov dword [rsp + 0x70], eax
lea r9, [rsp + 0x80]
mov r8d, 0xfe
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov dword [rsp + 0x10c], eax
jmp 0x14000138c
mov r9d, 0x12
mov r8d, 0xb3
mov edx, 0x4b
mov rcx, qword [rsp + 0x428]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x248], rax
movsx eax, word [rsp + 0x50]
cdq
mov ecx, 0x5b8
idiv ecx
cmp eax, 0x4d3
jne 0x1400013fc
mov eax, dword [rsp + 0xc8]
and eax, 0x70529f2c
mov dword [rsp + 0xc8], eax
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x41]
or eax, 0xc7
mov byte [rsp + 0x41], al
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x78]
call fcn.140005990
jmp 0x14000563f
movabs rax, 0x7cedd5303055ab
cmp qword [rsp + 0x78], rax
ja 0x1400055db
mov eax, dword [rsp + 0xa8]
movzx ecx, al
mov eax, dword [rsp + 0x98]
shr eax, cl
mov dword [rsp + 0x70], eax
mov dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], 0x7714
movsx eax, word [rsp + 0x50]
mov dword [rsp + 0x284], eax
cmp dword [rsp + 0x284], 0xd7
je 0x140001451
jmp 0x1400015da
lea rcx, str.HOzUE_tHfUsV_VsPMW8J
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x1ac], ax
mov rax, qword [rsp + 0x88]
shl rax, 0x64
cmp rax, qword [rsp + 0x80]
jg 0x1400015d8
movsx eax, byte [rsp + 0x40]
add eax, 2
movsx ecx, byte [0x140024ad0]
cmp eax, ecx
jne 0x1400014e7
movabs rax, 0x7ea76c50898025
mov rcx, qword [rsp + 0x88]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x16c], eax
lea rcx, [rsp + 0x640]
call qword [sym.imp.COMDLG32.dll_PrintDlgW]
mov dword [rsp + 0x140], eax
jmp 0x1400015d8
movabs rax, 0x798baa855d423a
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x80]
jne 0x14000151b
movzx eax, word [rsp + 0x4c]
shl eax, 0xa
mov word [rsp + 0x4c], ax
jmp 0x1400015d8
mov eax, dword [rsp + 0xf4]
add eax, 0x3eb817b8
cmp eax, dword [rsp + 0xc8]
jge 0x1400015ac
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x14c], eax
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x45], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x80000000
lea rcx, str.7x8pURB41
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x130], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, word [rsp + 0x50]
imul eax, eax, 0x257
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0xac], eax
jmp 0x1400015d8
mov word [rsp + 0x20], 0xa7
mov r9d, 0xbc
mov r8, qword [rsp + 0x250]
mov edx, 0xf1
mov ecx, 0x45
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov dword [rsp + 0xe8], eax
jmp 0x1400015f4
movabs rax, 0x7a771c33a5f758
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
cmp dword [rsp + 0x1a8], 0x6553
ja 0x140001727
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x198], eax
movsx eax, byte [0x140024ad0]
add eax, 0x4f
mov byte [rsp + 0x40], al
movabs rax, 0x74dc929df981c1
mov rcx, qword [rsp + 0x80]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x4c]
and eax, 0x1ce
mov word [rsp + 0x4c], ax
movsx eax, word [rsp + 0x48]
or eax, 0xe6
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x41]
sar eax, 3
mov byte [rsp + 0x45], al
movsx eax, byte [rsp + 0x40]
shl eax, 1
mov byte [0x140024ad0], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov eax, dword [rsp + 0x1a8]
add eax, 0xc5
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x138], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
movzx ecx, word [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf0], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x178], eax
mov dword [rsp + 0x20], 0x5cf
mov r9d, 0x175e
mov r8d, 0x1f7c
mov edx, 0x3e6c
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x170], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
jmp 0x1400015f4
movsx eax, word [rsp + 0x48]
mov dword [rsp + 0x210], eax
cmp dword [rsp + 0x210], 0x3a2
je 0x1400017bf
cmp dword [rsp + 0x210], 0x51d
je 0x140001752
jmp 0x1400017f0
movsx eax, byte [0x140024ad0]
add eax, 0x50
mov byte [rsp + 0x40], al
movabs rax, 0x7ae05ba93ec83b
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x4c]
add eax, 0x574
mov word [rsp + 0x4c], ax
movsx eax, word [rsp + 0x48]
or eax, 0x23a
mov word [rsp + 0x50], ax
lea r8, [rsp + 0x4f0]
mov edx, 0xe2
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
mov dword [rsp + 0x70], eax
jmp 0x1400017f0
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
mov dword [rsp + 0x10c], eax
lea rdx, [rsp + 0x78]
mov cl, 0xc2
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov dword [rsp + 0x140], eax
lea rcx, [rsp + 0x458]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movzx eax, byte [rsp + 0x45]
shl eax, 1
movzx ecx, byte [rsp + 0x41]
cmp eax, ecx
jle 0x140001831
mov rax, qword [rsp + 0x80]
sar rax, 0x3c
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x4c]
sub eax, 0xf8b
mov word [rsp + 0x4c], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x308], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1c0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov eax, dword [rsp + 0x98]
mov ecx, dword [rsp + 0xac]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xa8]
mov edx, dword [rsp + 0x70]
and edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x140005511
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
movzx eax, word [rsp + 0x4c]
mov word [rsp + 0x58], ax
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x13c], eax
movsx eax, word [rsp + 0x48]
add eax, 0x338
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x41]
or eax, 0x59
mov byte [rsp + 0x45], al
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x13c], eax
mov r9d, 2
lea r8, [rsp + 0x2d0]
mov rdx, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x13c], eax
lea rdx, [rsp + 0x1dc]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x138], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x460], rax
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x178], eax
lea rcx, [rsp + 0x540]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x40]
shl eax, 1
mov byte [0x140024ad0], al
mov eax, dword [rsp + 0x98]
movzx ecx, al
mov eax, dword [rsp + 0xac]
shr eax, cl
mov dword [rsp + 0x70], eax
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x14c], eax
mov edx, 0x307ce3
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x1a4]
sub eax, 0x96
mov dword [rsp + 0x1a4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1dc], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
movsx eax, byte [0x140024ad0]
and eax, 0x40
mov byte [rsp + 0x40], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodeSystemPointer]
movsx eax, word [rsp + 0x50]
xor eax, 0x2e2
mov word [rsp + 0x48], ax
movzx eax, word [rsp + 0x58]
sub eax, 0x4d5
mov word [rsp + 0x4c], ax
movsx eax, word [rsp + 0x50]
add eax, 0x429
mov word [rsp + 0x48], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
movsx eax, byte [rsp + 0x40]
or eax, 0x67
mov byte [0x140024ad0], al
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x26c], eax
cmp dword [rsp + 0x1a4], 0xd84a
jae 0x14000188c
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x1c4], 0xe490
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x42], al
movzx eax, word [rsp + 0x58]
shl eax, 0x18
movzx ecx, word [rsp + 0x4c]
cmp eax, ecx
jl 0x140001b91
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xf4], eax
movzx eax, byte [rsp + 0x45]
add eax, 0x19
mov byte [rsp + 0x41], al
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x340], rcx
movzx ecx, al
mov rax, qword [rsp + 0x340]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetACP]
mov dword [rsp + 0x98], eax
movsx eax, word [rsp + 0x48]
mov dword [rsp + 0x288], eax
cmp dword [rsp + 0x288], 0x525
je 0x140001b3c
jmp 0x140001b4a
mov rax, qword [rsp + 0x78]
shr rax, 0x15
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x98]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [0x140024ad0]
xor eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0xa8]
mov eax, dword [rax]
and eax, ecx
mov dword [rsp + 0x70], eax
jmp 0x14000545b
movzx eax, word [rsp + 0x4c]
sar eax, 0xc7
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
je 0x14000545b
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x50]
sub eax, ecx
mov word [rsp + 0x54], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x1bc], 0x850
mov eax, dword [rsp + 0xf4]
mov ecx, dword [rsp + 0xe4]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xe8]
mov edx, dword [rsp + 0xc8]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140001ce1
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
movsx eax, word [rsp + 0x54]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0x253
je 0x140001cca
cmp dword [rsp + 0x218], 0x3e9
je 0x140001c80
jmp 0x140001cdc
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x16c], eax
movzx eax, word [rsp + 0x58]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c], ax
lea rdx, [rsp + 0x5d0]
mov rcx, qword [rsp + 0x420]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x120], eax
jmp 0x140001cdc
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov byte [0x140024ad0], al
jmp 0x140001d62
movzx eax, byte [rsp + 0x41]
or eax, 0x5e
movzx ecx, byte [rsp + 0x45]
cmp eax, ecx
jne 0x140001d20
movzx eax, word [rsp + 0x58]
movzx ecx, word [rsp + 0x4c]
add eax, ecx
mov rcx, qword [rsp + 0xc0]
mov word [rcx], ax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
add eax, dword [rsp + 0x70]
mov dword [rsp + 0xac], eax
jmp 0x140001d62
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x1a0], 0xfc8
lea rax, [rsp + 0x41]
mov qword [rsp + 0x100], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rsp + 0xc10], 0x11c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x468], rax
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0x98]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x70]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
jae 0x140001e0b
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x78]
shl rax, 0x19
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x80]
movzx ecx, al
mov rax, qword [rsp + 0x88]
sar rax, cl
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov r8d, 0x4b
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov dword [rsp + 0x10c], eax
jmp 0x140005340
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x348], rcx
movzx ecx, al
mov rax, qword [rsp + 0x348]
mov eax, dword [rax]
shl eax, cl
mov ecx, dword [rsp + 0xa8]
mov edx, dword [rsp + 0x70]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jb 0x1400051f3
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x1b0], 0xeb07
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x28c], al
cmp byte [rsp + 0x28c], 0
je 0x140001e82
jmp 0x140001ef8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0xd8], rax
movzx eax, word [rsp + 0x4c]
mov word [rsp + 0x60], ax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x350], rcx
movzx ecx, al
mov rax, qword [rsp + 0x350]
mov rax, qword [rax]
shl rax, cl
mov qword [section..data], rax
mov dword [rsp + 0xaf0], 0x114
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x43], al
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0xa8], eax
jmp 0x140001f1a
mov r9, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
call fcn.140005990
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41]
sar eax, cl
mov byte [rsp + 0x44], al
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0xf8], eax
movabs rax, 0x707c054c8f0ec7
mov rcx, qword [rsp + 0xa0]
or rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x78]
jb 0x1400050e9
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x358], rax
movabs rax, 0x74dc929df981c1
cmp qword [rsp + 0x358], rax
je 0x140001f8a
jmp 0x140004fa3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x21c], al
cmp byte [rsp + 0x21c], 0
je 0x140001fc0
cmp byte [rsp + 0x21c], 0x5f
je 0x1400020d9
jmp 0x1400020f4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x360], rcx
movzx ecx, al
mov rax, qword [rsp + 0x360]
mov rax, qword [rax]
shl rax, cl
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x368], rax
movabs rax, 0x758298d6123846
cmp qword [rsp + 0x368], rax
je 0x140002021
jmp 0x1400020d7
mov eax, dword [rsp + 0xc8]
movzx ecx, al
mov eax, dword [rsp + 0xf8]
sar eax, cl
mov ecx, dword [rsp + 0xe8]
mov edx, dword [rsp + 0xf4]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x140002084
mov r8d, 1
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x1d8], eax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c]
add eax, ecx
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x13
mov r8d, 0xaf
mov edx, 0x46
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x214], eax
mov r8d, 0x70
mov edx, 0xb2
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x10c], eax
jmp 0x1400020f4
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
imul eax, ecx
mov word [rsp + 0x64], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodeSystemPointer]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1c0], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x4c], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41]
sar eax, cl
mov byte [rsp + 0x45], al
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xf4], eax
mov eax, dword [rsp + 0x1a0]
add eax, 5
mov dword [rsp + 0x1a0], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x470], rax
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x208], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x1dc], eax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x98]
shl eax, cl
mov dword [rsp + 0x70], eax
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x42]
or eax, ecx
mov byte [rsp + 0x40], al
movabs rax, 0x75b4090f1e3e19
mov rcx, qword [rsp + 0x78]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
movsx eax, word [rsp + 0x54]
mov rcx, qword [rsp + 0x90]
movsx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x48], ax
mov dword [rsp + 0xd30], 0x11c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc423
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x138], eax
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x48]
add eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
or eax, ecx
mov word [rsp + 0x60], ax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x43]
shl eax, cl
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x370], rcx
movzx ecx, al
mov rax, qword [rsp + 0x370]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0xac], eax
movzx ecx, word [rsp + 0x1ac]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf0], ax
movabs rax, 0x76a0329fc95e65
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
lea rcx, str.JmJLi6D_YUBToo
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0xf0], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x168], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x198], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x1c0], eax
cmp dword [rsp + 0x1a0], 0x116c
jbe 0x140002112
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x45]
add eax, ecx
movzx ecx, byte [rsp + 0x41]
movzx edx, byte [rsp + 0x44]
or ecx, edx
cmp eax, ecx
jge 0x14000241b
mov rdx, qword [rsp + 0x88]
mov ecx, dword [rsp + 0xe8]
call fcn.140005670
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov dword [rsp + 0x1c8], 0xa572
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x1f8], al
cmp byte [rsp + 0x1f8], 0
je 0x140002477
cmp byte [rsp + 0x1f8], 0x4a
je 0x140002455
jmp 0x140004f27
mov rdx, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
mov dword [rsp + 0x120], eax
jmp 0x140004f27
cmp dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], 0x78db
je 0x1400027c6
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x80]
and rcx, rax
mov rax, rcx
mov qword [section..data], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov eax, dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass]
add eax, 0x23
mov dword [rsp + reloc.COMCTL32.dll_RemoveWindowSubclass], eax
lea rdx, [rsp + 0x1c0]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x138], eax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0xe8], eax
lea rcx, [rsp + 0x750]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x44]
xor eax, ecx
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x78]
shr rax, 0x2b
mov qword [rsp + 0xa0], rax
mov edx, 0x3eeae1
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x14c], eax
movzx ecx, word [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0xf0], ax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0xa8]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x43]
or eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x50]
shl eax, cl
mov word [rsp + 0x48], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x1fc], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x170], eax
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
sar eax, cl
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1fc], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x14c], eax
mov rax, qword [rsp + 0x80]
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c]
sub eax, ecx
mov rcx, qword [rsp + 0xd0]
mov word [rcx], ax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov word [rsp + 0x50], ax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x42]
add eax, ecx
mov byte [rsp + 0x43], al
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0x70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
movabs rax, 0x7defacd9442438
mov rcx, qword [rsp + 0x78]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
movzx eax, word [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x4c], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x138], eax
movsx eax, word [rsp + 0x54]
mov rcx, qword [rsp + 0x90]
movsx ecx, word [rcx]
or eax, ecx
mov word [rsp + 0x48], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x378], rcx
movzx ecx, al
mov rax, qword [rsp + 0x378]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x478], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x380], rcx
movzx ecx, al
mov rax, qword [rsp + 0x380]
mov rax, qword [rax]
shl rax, cl
mov qword [section..data], rax
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x44]
sub eax, ecx
mov byte [rsp + 0x45], al
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x64]
or eax, ecx
mov rcx, qword [rsp + 0xd0]
mov word [rcx], ax
jmp 0x140002477
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x40]
shl eax, cl
mov byte [rsp + 0x43], al
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.3HO1Xz1GU
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2c8], rax
cmp dword [rsp + 0x1bc], 0x41a
jb 0x140002ae4
mov eax, dword [rsp + 0x118]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x388], rcx
movzx ecx, al
mov rax, qword [rsp + 0x388]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1270
mov r9d, 0x971
mov r8d, 0xc095489e
mov edx, 2
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0x13c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalShrink]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x50]
sub eax, ecx
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x1bc]
sub eax, 0x4d
mov dword [rsp + 0x1bc], eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x88], rax
movzx ecx, word [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x108], ax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x64], ax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rax]
xor rax, rcx
mov qword [section..data], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rsp + 0x540]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x50]
and eax, ecx
mov word [rsp + 0x48], ax
movzx eax, word [rsp + 0x58]
movzx ecx, word [rsp + 0x64]
shl eax, cl
mov word [rsp + 0x4c], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x390], rcx
movzx ecx, al
mov rax, qword [rsp + 0x390]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x110], rax
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x100]
mov byte [rcx], al
movzx ecx, word [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x148], ax
mov qword [rsp + 0x20], 0
mov r9d, 0x1270
mov r8d, 0x971
mov edx, 0xe7
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [rsp + 0x208], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x178], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, str.aa4rrak
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rsp + 0x148], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
movzx eax, word [rsp + 0x58]
movzx ecx, word [rsp + 0x64]
sub eax, ecx
mov word [rsp + 0x60], ax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov eax, dword [rsp + 0xc8]
movzx ecx, al
mov eax, dword [rsp + 0xe8]
shl eax, cl
mov dword [rsp + 0xf8], eax
mov rax, qword [rsp + 0xd8]
movzx ecx, al
mov rax, qword [rsp + 0x80]
sar rax, cl
mov qword [section..data], rax
jmp 0x14000281f
xor r9d, r9d
lea r8, [rsp + 0x2d0]
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [rsp + 0x170], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
or eax, ecx
movzx ecx, word [rsp + 0x58]
movzx edx, word [rsp + 0x60]
add ecx, edx
cmp eax, ecx
jne 0x140004edc
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x42]
and eax, ecx
movsx ecx, byte [rsp + 0x40]
mov dword [rsp + 0x290], ecx
movsx edx, byte [0x140024ad0]
movzx ecx, dl
mov edx, dword [rsp + 0x290]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140002c18
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [rsp + 0xf8], eax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x110], rax
mov edx, 0x3f
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rsp + 0x1d0], eax
lea r9, [rsp + 0x98]
mov r8d, 0xa4
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x1f0]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x120], eax
lea rdx, [rsp + 0x870]
mov rcx, qword [rsp + 0x3e0]
call sub.MAGNIFICATION.dll_MagGetColorEffect
mov dword [rsp + 0x120], eax
jmp 0x140004e08
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x40]
or eax, ecx
movsx ecx, byte [0x140024ad0]
mov dword [rsp + 0x294], ecx
movsx edx, byte [rsp + 0x42]
movzx ecx, dl
mov edx, dword [rsp + 0x294]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jg 0x140004dce
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0x64]
shl eax, cl
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0xc0]
movzx edx, word [rdx]
add ecx, edx
cmp eax, ecx
jg 0x140004b41
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x238], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0x98]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0]
mov ecx, dword [rcx]
mov edx, dword [rsp + 0x118]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jbe 0x140002d54
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
movsx eax, word [rsp + 0x54]
mov rcx, qword [rsp + 0x90]
movsx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x50], ax
lea r9, [rsp + 0x90]
mov r8d, 0xff
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov dword [rsp + 0x140], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0xd8]
mov qword [section..data], rax
lea r9, [rsp + 0x4f0]
mov r8d, 0x43
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov dword [rsp + 0x1d4], eax
jmp 0x140002e07
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
or eax, ecx
movzx ecx, word [rsp + 0x64]
mov dword [rsp + 0x298], ecx
movzx edx, word [rsp + 0x58]
movzx ecx, dl
mov edx, dword [rsp + 0x298]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140002dc7
mov rcx, qword [rsp + 0x300]
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rsp + 0x16c], eax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
call fcn.140005990
jmp 0x140002e07
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xa0]
jne 0x140002e07
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xc0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnWire]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov rcx, qword [section..data]
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rdx]
sar rdx, cl
mov rcx, rdx
cmp rax, rcx
jl 0x140002f5f
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0x58]
shl eax, cl
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0x4c]
xor ecx, edx
cmp eax, ecx
je 0x140002f06
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x64]
sar eax, cl
mov rcx, qword [rsp + 0x188]
movzx ecx, word [rcx]
mov rdx, qword [rsp + 0xd0]
movzx edx, word [rdx]
or ecx, edx
cmp eax, ecx
jne 0x140002ed3
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x42]
shl eax, cl
mov byte [rsp + 0x40], al
mov r8d, 0xc2
mov edx, 0xe4
lea rcx, [fcn.140005990]
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
mov dword [rsp + 0x1d8], eax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x174], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x480], rax
jmp 0x140002f5f
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
and rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x110]
jne 0x140002f40
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x110], rax
jmp 0x140002f5f
mov r8d, 0x21
mov rdx, qword [rsp + 0x220]
mov ecx, 0x9b
call sub.KERNEL32.dll_VerLanguageNameW
mov dword [rsp + 0x11c], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
add eax, ecx
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x160], rax
movzx eax, word [rsp + 0x64]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x4c], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0xd8]
mov qword [rsp + 0x80], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xa0]
mov qword [0x140024ad8], rax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov word [rsp + 0xe0], ax
mov dword [rsp + 0x1b4], 0x4f52
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x320], rax
movabs rax, 0xc69a408042410
cmp qword [rsp + 0x320], rax
je 0x1400031c6
movabs rax, 0x7211d67d1b62c7
cmp qword [rsp + 0x320], rax
je 0x14000302d
jmp 0x140004ad8
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x1d0], eax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x2f8], rax
movabs rax, 0x7143201b642873
cmp qword [rsp + 0x2f8], rax
je 0x14000307f
movabs rax, 0x7b20b391516521
cmp qword [rsp + 0x2f8], rax
je 0x14000309f
jmp 0x1400031c1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
jmp 0x1400031c1
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x45]
xor eax, ecx
mov dword [rsp + 0x2a0], eax
movzx ecx, byte [rsp + 0x41]
mov rdx, qword [rsp + 0x100]
movzx edx, byte [rdx]
mov dword [rsp + 0x29c], edx
mov eax, ecx
cdq
mov ecx, dword [rsp + 0x29c]
idiv ecx
mov ecx, dword [rsp + 0x2a0]
cmp ecx, eax
je 0x140003131
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0xe4], eax
mov r9, qword [rsp + 0x78]
mov r8, qword [0x140024ad8]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x110]
call fcn.140005990
jmp 0x1400031c1
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x70]
shr eax, cl
mov ecx, dword [rsp + 0xa8]
mov edx, dword [rsp + 0x118]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jae 0x140003189
mov eax, dword [rsp + 0xe4]
mov rcx, qword [rsp + 0x238]
mov qword [rsp + 0x398], rcx
movzx ecx, al
mov rax, qword [rsp + 0x398]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xf8], eax
jmp 0x1400031c1
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x110]
imul rcx, qword [0x140024ad8]
cmp rax, rcx
ja 0x1400031c1
movzx eax, byte [rsp + 0x45]
movzx ecx, byte [rsp + 0x44]
or eax, ecx
mov byte [rsp + 0x41], al
jmp 0x140004ad8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [rsp + 0x200], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x488], rax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x2a4], al
cmp byte [rsp + 0x2a4], 0
je 0x14000320b
jmp 0x140004959
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x43]
xor eax, ecx
mov byte [rsp + 0x40], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x408], rax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x118]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x150], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
mov dword [rsp + 0x2a8], eax
cmp dword [rsp + 0x2a8], 0x1a6
je 0x140003270
jmp 0x140003286
mov rdx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xf4]
call fcn.140005670
jmp 0x1400032be
xor edx, edx
mov rax, qword [rsp + 0x110]
div qword [rsp + 0xa0]
mov qword [rsp + 0x78], rax
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x54]
or eax, ecx
mov word [rsp + 0x50], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x3a0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x160]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jl 0x140003370
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xe0]
imul eax, ecx
mov word [rsp + 0x64], ax
mov dword [rsp + 0x950], 0x11c
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0xac]
mov eax, dword [rax]
sub eax, ecx
mov dword [0x140024008], eax
movzx eax, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x60]
add eax, ecx
mov word [rsp + 0xb8], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xd8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x160], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x180], rax
movzx eax, word [rsp + 0xe0]
movzx ecx, word [rsp + 0x58]
shl eax, cl
movzx ecx, word [rsp + 0x60]
mov dword [rsp + 0x2ac], ecx
mov rdx, qword [rsp + 0x188]
movzx edx, word [rdx]
movzx ecx, dl
mov edx, dword [rsp + 0x2ac]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140003433
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x278]
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x188]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
or eax, ecx
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x300], rax
mov edx, 0xb5
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x1d0], eax
movzx eax, byte [rsp + 0x41]
movzx ecx, byte [rsp + 0x45]
add eax, ecx
mov byte [rsp + 0x44], al
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x2d8], rax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov byte [rsp + 0x43], al
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x170], eax
mov edx, 0x624020
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0x13c], eax
cmp dword [rsp + 0x1b0], 0xf7af
ja 0x1400036f2
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20c], eax
lea rdx, [rsp + 0x780]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x200], eax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x150]
mov eax, dword [rax]
and eax, ecx
mov dword [0x140024008], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x1fc], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sar eax, cl
mov word [rsp + 0x50], ax
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x54]
shl eax, cl
mov word [rsp + 0x50], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
lea rcx, [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x13c], eax
mov rax, qword [rsp + 0x188]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb8]
or eax, ecx
mov word [rsp + 0x64], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x230]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
movsx eax, byte [0x140024ad0]
movsx ecx, byte [rsp + 0x43]
add eax, ecx
mov byte [rsp + 0x42], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x118], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x48]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rax]
or rax, rcx
mov qword [section..data], rax
mov rax, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x3b0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3b0]
mov rax, qword [rax]
sar rax, cl
mov qword [rsp + 0x80], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
mov eax, dword [rsp + 0x1b0]
add eax, 0x87
mov dword [rsp + 0x1b0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x188]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x58], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41]
add eax, ecx
mov byte [rsp + 0x44], al
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x2b4], eax
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov dword [rsp + 0x200], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
jmp 0x140003482
mov eax, dword [rsp + 0xe4]
mov ecx, dword [rsp + 0xe8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x110]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x3b8], rax
xor edx, edx
mov rax, qword [rsp + 0x78]
div qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x3b8]
cmp rcx, rax
je 0x1400037fd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x11c], eax
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x42]
or eax, ecx
mov byte [rsp + 0x5c], al
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
sar eax, cl
movzx ecx, byte [rsp + 0x45]
movzx edx, byte [rsp + 0x41]
imul ecx, edx
cmp eax, ecx
jl 0x1400037de
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x48]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x180]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
movzx eax, word [rsp + 0x58]
movzx ecx, word [rsp + 0xb8]
add eax, ecx
mov rcx, qword [rsp + 0x188]
mov word [rcx], ax
jmp 0x1400039c3
mov rax, qword [rsp + 0x230]
mov rcx, qword [section..data]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x80]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jle 0x1400039c3
lea rcx, [rsp + 0x810]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x3c0], rax
movabs rax, 0x78a393ee8429f0
cmp qword [rsp + 0x3c0], rax
je 0x14000386f
jmp 0x1400039b1
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c]
add eax, ecx
mov rcx, qword [rsp + 0x188]
movzx ecx, word [rcx]
movzx edx, word [rsp + 0xe0]
imul ecx, edx
cmp eax, ecx
jge 0x1400038e3
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov word [rsp + 0x50], ax
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0x58]
or eax, ecx
mov word [rsp + 0x64], ax
jmp 0x1400039af
movzx eax, byte [rsp + 0x45]
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
or eax, ecx
movzx ecx, byte [rsp + 0x44]
mov dword [rsp + 0x280], ecx
movzx edx, byte [rsp + 0x41]
movzx ecx, dl
mov edx, dword [rsp + 0x280]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x140003938
mov rax, qword [rsp + 0x110]
movzx ecx, al
mov rax, qword [rsp + 0x1e0]
shr rax, cl
mov qword [rsp + 0xa0], rax
jmp 0x1400039af
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x88]
shl rax, cl
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0xd8]
xor rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140003995
mov eax, dword [rsp + 0x174]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x3c8], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3c8]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x70], eax
jmp 0x1400039af
mov edx, 0x16
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov dword [rsp + 0xac], eax
jmp 0x1400039c3
movsx eax, byte [0x140024ad0]
movsx ecx, byte [rsp + 0x40]
sub eax, ecx
mov byte [rsp + 0x42], al
cmp dword [rsp + 0x1b4], 0x6a47
jae 0x140003dde
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x230]
mov qword [rsp + 0x88], rax
movzx ecx, word [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov word [rsp + 0x108], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb8]
add eax, ecx
mov word [rsp + 0x64], ax
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
add eax, ecx
mov byte [rsp + 0x41], al
lea rdx, [rsp + 0x4a0]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x13c], eax
mov rax, qword [rsp + 0x238]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xf4]
shl eax, cl
mov dword [rsp + 0xc8], eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x180]
mov rax, qword [rax]
or rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0x1b4]
add eax, 0x67
mov dword [rsp + 0x1b4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x4a8], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x178], eax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x43]
and eax, ecx
mov byte [rsp + 0x5c], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x20c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x138], eax
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x168], eax
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x198], eax
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x3d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3d0]
mov eax, dword [rax]
shr eax, cl
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x178], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x4b0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x50]
sub eax, ecx
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0xac]
sub ecx, eax
mov eax, ecx
mov dword [0x140024008], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x68]
mov rcx, qword [section..data]
mov rax, qword [rax]
or rax, rcx
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
movzx eax, word [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x58], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleCount]
lea rcx, [rsp + 0x540]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sar eax, cl
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x160]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
add eax, dword [0x140024008]
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x3e8], rax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x5c]
add eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [0x140024ad8]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
add eax, ecx
mov word [rsp + 0x64], ax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
xor rax, rcx
mov qword [section..data], rax
xor r8d, r8d
mov edx, 0x80
lea rcx, [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [rsp + 0x2b4], eax
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x45], al
lea rdx, [rsp + 0x3d8]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x170], eax
mov rax, qword [rsp + 0x238]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xc8]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0xe8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnfix]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movsx eax, word [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
movsx ecx, word [rcx]
shl eax, cl
mov word [rsp + 0x50], ax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0xe0], ax
jmp 0x1400039c3
mov rax, qword [rsp + 0xa0]
imul rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x78], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x4b8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov eax, dword [rsp + 0x174]
mov dword [rsp + 0x204], eax
cmp dword [rsp + 0x204], 0
je 0x140003f59
cmp dword [rsp + 0x204], 0xff7
je 0x140003e42
jmp 0x140004940
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x48]
imul eax, ecx
movsx ecx, word [rsp + 0x54]
movsx edx, word [rsp + 0x50]
sub ecx, edx
cmp eax, ecx
jl 0x140003f13
movsx eax, word [rsp + 0x50]
mov dword [rsp + 0x2b8], eax
cmp dword [rsp + 0x2b8], 0x57e
je 0x140003e84
jmp 0x140003efe
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x5c]
sar eax, cl
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x11c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0xac], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x80]
mov qword [section..data], rax
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0xb8], ax
jmp 0x140003f11
mov ecx, 0xb0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x158], rax
jmp 0x140003f54
movzx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
shl eax, cl
movzx ecx, byte [rsp + 0x45]
movzx edx, byte [rsp + 0x44]
or ecx, edx
cmp eax, ecx
jl 0x140003f54
lea r8, [rsp + 0x10a0]
mov edx, 0x81
mov ecx, 0xb9
call qword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov dword [rsp + 0x144], eax
jmp 0x140004940
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movsx eax, byte [rsp + 0x43]
movsx ecx, byte [rsp + 0x40]
and eax, ecx
movsx ecx, byte [rsp + 0x42]
mov dword [rsp + 0x2bc], ecx
movsx edx, byte [rsp + 0x5c]
movzx ecx, dl
mov edx, dword [rsp + 0x2bc]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140003fed
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x418]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x1d8], eax
mov r9d, 0x66
mov r8d, 0x33
mov edx, 0x34
mov rcx, qword [rsp + 0x3e0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x4c0], rax
jmp 0x1400042b3
mov eax, dword [rsp + 0x150]
mov ecx, dword [rsp + 0xac]
or ecx, eax
mov eax, ecx
mov ecx, dword [0x140024008]
mov edx, dword [rsp + 0x11c]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jb 0x1400042b3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x3e8], rax
movsx eax, byte [rsp + 0x5c]
movsx ecx, byte [rsp + 0x43]
add eax, ecx
movsx ecx, byte [rsp + 0x40]
movsx edx, byte [rsp + 0x42]
sub ecx, edx
cmp eax, ecx
je 0x14000429b
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x3f0], rcx
movzx ecx, al
mov rax, qword [rsp + 0x3f0]
mov rax, qword [rax]
shl rax, cl
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
mov byte [rsp + 0x2c0], al
cmp byte [rsp + 0x2c0], 0x7c
je 0x140004094
jmp 0x14000427c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [section..data]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x180]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x140004238
movsx eax, byte [0x140024ad0]
movsx ecx, byte [rsp + 0x43]
xor eax, ecx
movsx ecx, byte [rsp + 0x40]
mov dword [rsp + 0x260], ecx
movsx edx, byte [rsp + 0x42]
movzx ecx, dl
mov edx, dword [rsp + 0x260]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x1400041a2
mov dword [rsp + 0x38], 6
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1d4]
mov r8d, 0xd5
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x32c], eax
lea rcx, [rsp + 0x7c0]
call qword [sym.imp.COMDLG32.dll_ChooseColorW]
mov dword [rsp + 0x1d4], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov edx, 2
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov dword [rsp + 0x328], eax
jmp 0x140004236
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x60]
or eax, ecx
movzx ecx, word [rsp + 0x64]
mov dword [rsp + 0x264], ecx
movzx edx, word [rsp + 0x58]
movzx ecx, dl
mov edx, dword [rsp + 0x264]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x1400041f4
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x110], rax
jmp 0x140004236
movsx eax, word [rsp + 0x54]
mov rcx, qword [rsp + 0x90]
movsx ecx, word [rcx]
imul eax, ecx
movsx ecx, word [rsp + 0x48]
movsx edx, word [rsp + 0x50]
sub ecx, edx
cmp eax, ecx
jl 0x140004226
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x150], eax
jmp 0x140004236
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x43]
sar eax, cl
mov byte [rsp + 0x5c], al
jmp 0x14000427a
lea rax, [rsp + 0x180]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1cc]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f0]
mov r8d, 0x83
mov edx, 0x1d
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_BackupSeek]
mov dword [rsp + 0x144], eax
jmp 0x140004299
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x11c]
shl eax, cl
mov dword [rsp + 0xa8], eax
jmp 0x1400042b3
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x43]
sar eax, cl
movsx ecx, byte [rsp + 0x5c]
movsx edx, byte [rsp + 0x42]
or ecx, edx
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0xec], al
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x33c], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0xd8]
mov qword [section..data], rax
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x48]
add eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0xb8]
and eax, ecx
mov rcx, qword [rsp + 0xc0]
mov word [rcx], ax
mov eax, dword [rsp + 0x1b8]
add eax, 0x65
mov dword [rsp + 0x1b8], eax
movzx eax, word [rsp + 0x4c]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
xor eax, ecx
mov word [rsp + 0x60], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x88]
shl rax, cl
mov qword [rsp + 0x180], rax
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [rsp + 0x5c]
or eax, ecx
mov byte [rsp + 0x43], al
mov eax, dword [rsp + 0x118]
movzx ecx, al
mov eax, dword [rsp + 0x98]
shr eax, cl
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0x1b8], 0x535d
jb 0x1400042bf
lea rdx, [rsp + 0x3f8]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x208], eax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x48]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov eax, dword [rsp + 0x1c4]
sub eax, 0xc1
mov dword [rsp + 0x1c4], eax
movzx eax, word [rsp + 0x58]
mov rcx, qword [rsp + 0x188]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd0]
mov word [rcx], ax
mov rax, qword [section..data]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
movzx eax, word [rsp + 0xe0]
movzx ecx, word [rsp + 0xb8]
or eax, ecx
mov word [rsp + 0x60], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x160]
sar rax, cl
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x180]
shl rax, cl
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0x292a
mov r9d, 0x296d
mov r8d, 0x2c86
mov edx, 0x148f
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x338], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
movsx eax, byte [rsp + 0x42]
movsx ecx, byte [0x140024ad0]
and eax, ecx
mov byte [rsp + 0x43], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x198], eax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x118]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0xec]
movzx ecx, byte [rsp + 0x44]
sub eax, ecx
mov byte [rsp + 0x41], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x168], eax
mov rax, qword [rsp + 0x2d8]
mov ecx, dword [rsp + 0x1cc]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x2d8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa0]
movzx ecx, al
mov rax, qword [rsp + 0x78]
shr rax, cl
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0xa8]
mov eax, dword [rax]
or eax, ecx
mov dword [0x140024008], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
shl eax, cl
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
movzx eax, word [rsp + 0x64]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xc0]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0xb8]
add eax, ecx
mov word [rsp + 0x64], ax
mov eax, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x174]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x14c], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x8922
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x268], eax
cmp dword [rsp + 0x1c4], 0xcaee
jae 0x1400043dc
movsx eax, byte [rsp + 0x5c]
movsx ecx, byte [rsp + 0x43]
add eax, ecx
mov byte [rsp + 0x40], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x50]
or eax, ecx
mov word [rsp + 0x48], ax
cmp dword [rsp + 0x1c8], 0xe05a
ja 0x140004940
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0x180]
sar rax, cl
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x1c8]
add eax, 0xe8
mov dword [rsp + 0x1c8], eax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x150]
and ecx, eax
mov eax, ecx
mov dword [0x140024008], eax
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x230]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
movzx ecx, al
mov rax, qword [rsp + 0xd8]
shl rax, cl
mov qword [rsp + 0x88], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0xf7fc
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x268], eax
lea rcx, [rsp + 0x570]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x4c]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
sub eax, ecx
mov word [rsp + 0x60], ax
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41]
or eax, ecx
mov byte [rsp + 0xec], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20c], eax
mov rax, qword [rsp + 0x2d8]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0xe8]
sar eax, cl
mov dword [rsp + 0xf8], eax
mov rcx, qword [rsp + 0x408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsp + 0x334], eax
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov eax, dword [0x140024008]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x410], rcx
movzx ecx, al
mov rax, qword [rsp + 0x410]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0x70], eax
mov r9d, 2
xor r8d, r8d
mov edx, 0x23ac
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x168], eax
lea rdx, [rsp + 0x26c]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x138], eax
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x42]
sub eax, ecx
mov byte [rsp + 0x5c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x270], eax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x310]
add rcx, rax
mov rax, rcx
mov qword [0x140024ad8], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
add eax, ecx
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x270], eax
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
jmp 0x1400046df
mov rdx, qword [rsp + 0x160]
mov ecx, dword [rsp + 0x1cc]
call fcn.140005670
jmp 0x140004a61
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
movzx eax, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x60]
sub eax, ecx
mov word [rsp + 0x64], ax
lea rdx, [rsp + 0xe50]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x240], rax
lea rdx, [rsp + 0xe50]
mov rcx, qword [rsp + 0x4c8]
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov word [rsp + 0x60], ax
lea r9, [rsp + 0x43]
mov r8d, 0xf0
mov edx, 0xf2
mov rcx, qword [rsp + 0x240]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x90]
mov edx, 0xf9
mov rcx, qword [rsp + 0x418]
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
mov dword [rsp + 0x11c], eax
mov r8d, 0x2c
mov rdx, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x238]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
mov dword [rsp + 0x140], eax
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x144], eax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x11c], eax
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x50]
sar eax, cl
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
xor r8d, r8d
mov rdx, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x1d0], eax
lea rcx, [rsp + 0xa70]
call qword [sym.imp.COMDLG32.dll_PageSetupDlgW]
mov dword [rsp + 0x140], eax
mov edx, 0xf6
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x16c], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x160], rax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
mov dword [rsp + 0xa8], eax
jmp 0x140004c0c
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x78]
ja 0x140004c0c
lea r9, [rsp + 0x420]
mov r8d, 0xb8
lea rdx, [rsp + 0x248]
mov ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [rsp + 0x1d4], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x50]
or eax, ecx
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0xa0]
movzx ecx, al
mov rax, qword [rsp + 0x78]
shl rax, cl
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x8e0]
call sub.MAGNIFICATION.dll_MagGetFullscreenColorEffect
mov dword [rsp + 0x214], eax
movsx eax, byte [0x140024ad0]
movsx ecx, byte [rsp + 0x40]
sar eax, cl
mov byte [rsp + 0x42], al
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x70]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x45]
movzx ecx, byte [rsp + 0x41]
xor eax, ecx
mov byte [rsp + 0x44], al
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x88]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
and eax, ecx
mov word [rsp + 0x60], ax
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x70], eax
mov ecx, 0x35
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov dword [rsp + 0xf8], eax
movzx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
sub eax, ecx
movzx ecx, byte [rsp + 0x45]
mov dword [rsp + 0x274], ecx
movzx edx, byte [rsp + 0x44]
movzx ecx, dl
mov edx, dword [rsp + 0x274]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x140004ca5
jmp 0x140004d46
mov rax, qword [rsp + 0x78]
movzx ecx, al
mov rax, qword [rsp + 0x110]
shl rax, cl
cmp rax, qword [rsp + 0xa0]
jae 0x140004cdd
mov edx, 0xdf
mov rcx, qword [rsp + 0x228]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0x144], eax
jmp 0x140004d46
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [section..data]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x140004d2a
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0xd8], rax
jmp 0x140004d46
mov edx, dword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [rsp + 0x16c], eax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x428]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x518]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4f
xor r9d, r9d
mov r8d, 0x11
lea rdx, [rsp + 0x518]
mov rcx, qword [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov dword [rsp + 0x214], eax
mov rax, qword [rsp + 0xd0]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx]
add eax, ecx
mov rcx, qword [rsp + 0xd0]
mov word [rcx], ax
jmp 0x140004e08
movzx eax, byte [rsp + 0x41]
movzx ecx, byte [rsp + 0x44]
add eax, ecx
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
movzx edx, byte [rsp + 0x45]
imul ecx, edx
cmp eax, ecx
jle 0x140004e08
movsx eax, word [rsp + 0x54]
mov rcx, qword [rsp + 0x90]
movsx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x50], ax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov dword [rsp + 0x28], 0xc7
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x518]
mov r8, qword [rsp + 0x220]
mov edx, 0xd5
mov ecx, 0xdc
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [rsp + 0xf8], eax
mov r8d, 1
mov rdx, qword [rsp + 0x4e8]
mov rcx, qword [rsp + 0x430]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xf4]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xe4]
mov edx, dword [rsp + 0xf8]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x140004ec1
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rsp + 0x144], eax
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x11c], eax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x11c], eax
mov edx, 0x68
mov rcx, qword [rsp + 0x1f0]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x90]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
sub eax, ecx
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rax]
xor rax, rcx
mov qword [rsp + 0x80], rax
movzx eax, word [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
movzx ecx, word [rcx]
shl eax, cl
mov rcx, qword [rsp + 0xc0]
mov word [rcx], ax
mov dword [rsp + 0x38], 0x7f
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
mov r8d, 0x4c
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x10c], eax
jmp 0x140005061
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x27c], eax
cmp dword [rsp + 0x27c], 0xcc44
je 0x140004fbd
jmp 0x140004fbf
jmp 0x140004fd1
movsx eax, byte [0x140024ad0]
movsx ecx, byte [rsp + 0x43]
sub eax, ecx
mov byte [rsp + 0x42], al
lea rdx, [rsp + 0x5d0]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x80]
mov qword [section..data], rax
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0xa8]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0xac], eax
mov r9d, 0xa1
lea r8, [rsp + 0x100]
lea rdx, [fcn.140005990]
mov rcx, qword [rsp + 0x430]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0x1d8], eax
movabs rax, 0x7b9f3f970f87c3
mov rcx, qword [rsp + 0x78]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
mov r8d, 0x42
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x118], eax
lea rdx, [rsp + 0x54]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x80]
movzx ecx, al
mov rax, qword [rsp + 0xd8]
shl rax, cl
mov qword [rsp + 0x88], rax
mov r9d, 0xc7
lea r8, [rsp + 0x5d0]
mov edx, 0xbb
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov dword [rsp + 0x144], eax
jmp 0x14000519c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x88]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jge 0x140005156
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xd8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
call fcn.140005990
jmp 0x14000519c
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x50]
sar eax, cl
mov word [rsp + 0x54], ax
mov edx, 0xe4
mov rcx, qword [rsp + 0x158]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x44]
or eax, ecx
mov rcx, qword [rsp + 0x100]
mov byte [rcx], al
mov dword [rsp + 0x28], 0x3f
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x20], rax
mov r9d, 0xcb
lea r8, [rsp + 0xc0]
mov edx, 0xea
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rsp + 0x228], rax
mov rdx, qword [rsp + 0x80]
mov ecx, dword [rsp + 0xf8]
call fcn.140005670
jmp 0x140005340
movabs rax, 0x7914f4504cfc23
mov rcx, qword [rsp + 0xa0]
or rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x78]
ja 0x140005340
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c]
or eax, ecx
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x14000524d
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
add eax, ecx
mov word [rsp + 0x4c], ax
jmp 0x1400052ed
mov eax, dword [rsp + 0xe8]
mov ecx, dword [rsp + 0xf4]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xe4]
mov edx, dword [rsp + 0xc8]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x140005295
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
jmp 0x1400052ed
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0xa8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x98]
mov ecx, dword [rcx]
sub ecx, edx
cmp eax, ecx
je 0x1400052bd
jmp 0x1400052ed
movzx eax, byte [rsp + 0x45]
movzx ecx, byte [rsp + 0x41]
sar eax, cl
mov rcx, qword [rsp + 0x100]
movzx ecx, byte [rcx]
cmp eax, ecx
jge 0x1400052ed
lea rcx, [rsp + 0x6c0]
call qword [sym.imp.COMDLG32.dll_PrintDlgExW]
mov dword [rsp + 0x330], eax
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x438], rcx
movzx ecx, al
mov rax, qword [rsp + 0x438]
mov eax, dword [rax]
shl eax, cl
mov dword [rsp + 0xac], eax
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x50]
or eax, ecx
mov word [rsp + 0x54], ax
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0xac], eax
mov dword [rsp + 0x28], 7
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0xd7
mov r8, qword [rsp + 0x1e8]
mov edx, 0xfd
mov ecx, 0xd6
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xf4]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xe4]
mov edx, dword [rsp + 0xe8]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x1400053c1
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x144], eax
jmp 0x14000541e
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x70]
shl eax, cl
mov ecx, dword [rsp + 0xa8]
mov edx, dword [rsp + 0x98]
shr edx, cl
mov ecx, edx
cmp eax, ecx
je 0x1400053ec
jmp 0x14000541e
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x4c]
or eax, ecx
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jle 0x14000541e
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
and eax, ecx
mov word [rsp + 0x4c], ax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0xe4], eax
movsx eax, word [rsp + 0x50]
movsx ecx, word [rsp + 0x48]
add eax, ecx
mov word [rsp + 0x54], ax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
movabs rax, 0x73ee8f1e2909b0
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
movzx eax, word [rsp + 0x4c]
add eax, 0x7d8
mov word [rsp + 0x58], ax
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea rax, [rsp + 0x640]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0xff
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x120], eax
movabs rax, 0x7daa11ddebf915
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
lea r9, [rsp + 0x4c]
mov r8d, 0xae
lea rdx, [rsp + 0x248]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov dword [rsp + 0x10c], eax
jmp 0x1400055be
movsx eax, word [rsp + 0x50]
add eax, 0x309
movsx ecx, word [rsp + 0x48]
cmp eax, ecx
jge 0x140005534
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [rsp + 0x58], ax
jmp 0x1400055be
movabs rax, 0x784d20ee874d8e
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0x98]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xac], eax
mov dword [rsp + 0x38], 0x1c
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
mov r8d, 0xac
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x140], eax
movsx eax, byte [rsp + 0x40]
shl eax, 1
mov byte [0x140024ad0], al
movsx eax, byte [0x140024ad0]
sub eax, 0x6e
mov byte [rsp + 0x40], al
jmp 0x14000563f
movzx eax, word [rsp + 0x4c]
cmp eax, 0x37a
jg 0x140005603
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov dword [rsp + 0x120], eax
jmp 0x14000563f
mov dword [rsp + 0x28], 0xa7
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f0]
mov r8, qword [rsp + 0x258]
mov edx, LBItemFromPt
mov ecx, 0x9e
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [rsp + 0xf4], eax
mov rdx, qword [rsp + 0x88]
mov ecx, dword [rsp + 0xc8]
call fcn.140005670
mov eax, dword [rsp + 0xe4]
add rsp, 0x12c8
ret