Function at 0x180111160
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xfb8
movaps xmmword [rsp + 0xfa0], xmm8
movdqa xmmword [rsp + 0xf90], xmm7
movaps xmmword [rsp + 0xf80], xmm6
mov rsi, rdx
mov qword [rsp + 0xe8], rcx
mov rbx, qword [rsp + 0x1038]
mov r14, qword [rsp + 0x1030]
mov r15, qword [rsp + 0x1028]
mov rax, qword [rsp + 0x1020]
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x248], rax
shr rsi, 1
cmp rsi, rax
jae 0x1801132c6
test r14, r14
je 0x1801133a5
lea r12, [r15 + r14*8]
mov r13, qword [rbx]
mov rbp, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x188], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x150], rax
xorps xmm6, xmm6
pcmpeqd xmm7, xmm7
mov eax, 8
mov qword [rsp + 0xf0], rax
xor eax, eax
mov qword [rsp + 0x140], rax
xor eax, eax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1e8], r13
mov qword [rsp + 0x1e0], rbp
jmp 0x1801112a6
mov rax, qword [rsp + 0x158]
mov qword [rsi + 0xe0], rax
mov rax, qword [rsp + 0x160]
mov qword [rsi + 0xe8], rax
movzx eax, word [rbp]
movzx edx, byte [rbp + 2]
shl edx, 0x10
or edx, eax
mov rax, qword [rsp + 0x188]
mov r8, qword [rax]
mov rax, qword [rsp + 0x150]
mov r9, qword [rax]
mov rcx, rsi
call fcn.180114650
add r15, 8
cmp r15, r12
je 0x180113300
mov rax, qword [r15]
movzx edi, word [rax + 0x38]
mov rbx, qword [rax + 0x40]
mov r14, qword [rax + 0x50]
mov rcx, qword [rax + 0x58]
mov qword [rsp + 0x168], rcx
mov rcx, qword [rax + 0x78]
mov qword [rsp + 0x160], rcx
mov rax, qword [rax + 0x90]
mov qword [rsp + 0x158], rax
mov rsi, qword [r13]
cmp qword [rsi + 0x18], 0
je 0x180111412
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov r8, r14
call fcn.180117ed0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, rax
shr r8, 0x39
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea r8, [rcx - 0x158]
xor r9d, r9d
and rax, rdx
movdqu xmm1, xmmword [rcx + rax]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r10d, xmm2
nop dword [rax + rax]
test r10w, r10w
je 0x180111370
lea esi, [r10 - 1]
and esi, r10d
tzcnt r10d, r10d
add r10, rax
and r10, rdx
neg r10
imul r11, r10, 0x158
mov r10d, esi
cmp qword [r8 + r11], r14
jne 0x180111340
jmp 0x180111390
pcmpeqb xmm1, xmm7
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x180111412
add rax, r9
add rax, 0x10
add r9, 0x10
jmp 0x180111326
lea rsi, [rcx + r11]
add rsi, 0xfffffffffffffeb0
mov rax, qword [rcx + r11 - 0x60]
test rax, rax
je 0x180111250
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x3a0], 0
mov qword [rsp + 0x7b0], 0
lea r8, [rsp + 0x7b0]
mov qword [rsp + 0x20], r8
lea rdx, [rsp + 0x3a0]
mov r9, r8
call sub.kernel32.dll_GetProcessTimes
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rsp + 0x3a0]
shr rdx, 0x17
movabs rax, 0xfffffffd49ef6f00
add rdx, rax
cmp rdx, qword [rsi + 0x118]
je 0x180111250
mov qword [rsp + 0x250], r14
test rbx, rbx
je 0x180111720
and edi, 0xfffffffe
add rdi, rbx
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3a8], rdi
mov word [rsp + 0x3b0], 0
mov qword [rsp + 0x7b0], 1
lea rax, [rsp + 0x7b8]
movups xmmword [rax], xmm6
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x3a0]
call fcn.1801103d0
mov rax, qword [rsp + 0x7c0]
mov qword [rsp + 0x120], rax
movdqu xmm0, xmmword [rsp + 0x7b0]
movdqa xmmword [rsp + 0x110], xmm0
xor edi, edi
cmp qword [rsp + 0x168], 0
setne dil
test r14, r14
je 0x180111600
mov rax, qword [rsp + 0x150]
mov rax, qword [rax]
mov qword [rsp + 0x228], rax
movzx eax, word [rbp]
mov dword [rsp + 0xf8], eax
movzx esi, byte [rbp + 2]
mov ecx, 0x410
xor edx, edx
mov r8d, r14d
call sub.kernel32.dll_OpenProcess
mov rbx, rax
test rax, rax
jne 0x1801114fd
mov ecx, 0x1000
xor edx, edx
mov r8d, r14d
call sub.kernel32.dll_OpenProcess
mov rbx, rax
test rax, rax
je 0x180111600
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x220], rdi
mov r8d, 0x20a
lea rdi, [rsp + 0x7b0]
mov rcx, rdi
xor edx, edx
call fcn.180182690
mov rcx, rbx
xor edx, edx
mov r8, rdi
mov r9d, 0x105
call sub.psapi.dll_GetModuleFileNameExW
mov r8d, 0x105
lea rcx, [rsp + 0x3a0]
mov rdx, rdi
call fcn.1801144d0
mov r13, qword [rsp + 0x3a0]
mov rbp, qword [rsp + 0x3a8]
mov r12, qword [rsp + 0x3b0]
test r12, r12
je 0x1801117a7
js 0x1801136a3
movzx eax, byte [0x180221a30]
mov rax, qword [0x1802219b8]
test rax, rax
jne 0x18011159b
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1801136b8
mov qword [0x1802219b8], rax
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1801136b8
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8, r12
call fcn.180181ff0
movzx edx, byte [rdi]
cmp dl, 0x2f
mov eax, 0x5c
cmove edx, eax
cmp r12, 1
mov qword [rsp + 0x48], rdi
jne 0x1801117da
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
xor r9d, r9d
xor r11d, r11d
jmp 0x180111990
lea rcx, [rsp + 0x320]
movups xmmword [rcx - 0xb0], xmm6
mov qword [rsp + 0x268], 1
mov byte [rsp + 0x280], 1
movups xmmword [rcx - 0x90], xmm6
mov qword [rsp + 0x288], 1
mov byte [rsp + 0x2a0], 1
movups xmmword [rcx - 0x70], xmm6
mov qword [rsp + 0x2a8], 1
mov byte [rsp + 0x2c0], 1
movups xmmword [rcx + 0x38], xmm6
movups xmmword [rcx + 0x28], xmm6
mov rax, qword [rsp + 0x120]
mov qword [rcx - 0x48], rax
movdqa xmm0, xmmword [rsp + 0x110]
movdqu xmmword [rcx - 0x58], xmm0
mov qword [rsp + 0x2e0], 8
movups xmmword [rcx - 0x38], xmm6
mov qword [rsp + 0x310], r14
mov qword [rsp + 0x318], 0
mov qword [rsp + 0x2f8], 8
movups xmmword [rcx - 0x20], xmm6
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x338], rax
mov qword [rsp + 0x250], rdi
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x260], 1
mov qword [rsp + 0x340], 0
mov dword [rsp + 0x398], 0
movups xmmword [rcx + 0x48], xmm6
mov byte [rsp + 0x39c], 1
movups xmmword [rcx + 0x68], xmm6
movups xmmword [rcx + 0x58], xmm6
jmp 0x18011275f
test r14, r14
je 0x180111805
cmp r14, 4
jne 0x180111873
movzx eax, byte [0x180221a30]
mov rax, qword [0x1802219b8]
test rax, rax
jne 0x18011175c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1801136c7
mov qword [0x1802219b8], rax
mov r8d, 6
mov rcx, rax
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1801136c7
mov word [rax + 4], 0x6d65
mov dword [rax], 0x74737953
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 6
mov qword [rsp + 0x120], 6
jmp 0x180111491
mov eax, 1
mov qword [rsp + 0x48], rax
mov ecx, 1
mov rdx, r13
mov r8, r12
call fcn.180181ff0
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
xor r9d, r9d
xor r11d, r11d
xor edx, edx
jmp 0x180111990
movzx r11d, byte [rdi + 1]
cmp r11b, 0x2f
cmove r11d, eax
cmp r12, 2
jne 0x1801118ef
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
xor r9d, r9d
jmp 0x180111990
movzx eax, byte [0x180221a30]
mov rax, qword [0x1802219b8]
test rax, rax
jne 0x18011182e
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1801136d8
mov qword [0x1802219b8], rax
mov r8d, 4
mov rcx, rax
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1801136d8
mov dword [rax], 0x656c6449
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 4
mov qword [rsp + 0x120], 4
jmp 0x180111491
lea rax, [rsp + 0x250]
mov qword [rsp + 0x3a0], rax
lea rax, [0x180114470]
mov qword [rsp + 0x3a8], rax
lea rax, [0x1801e70f8]
mov qword [rsp + 0x7b0], rax
mov qword [rsp + 0x7b8], 1
mov qword [rsp + 0x7d0], 0
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x7c0], rax
mov qword [rsp + 0x7c8], 1
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x7b0]
call fcn.18001e780
jmp 0x180111491
movzx r9d, byte [rdi + 2]
cmp r9b, 0x2f
cmove r9d, eax
cmp r12, 3
jne 0x180111913
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
xor edi, edi
jmp 0x180111990
mov rcx, rdi
movzx edi, byte [rdi + 3]
cmp dil, 0x2f
cmove edi, eax
cmp r12, 4
mov ebx, 0x5c
jne 0x180111938
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
xor eax, eax
jmp 0x180111990
movzx eax, byte [rcx + 4]
cmp al, 0x2f
cmove eax, ebx
cmp r12, 5
jne 0x180111951
xor ecx, ecx
xor r10d, r10d
xor r8d, r8d
jmp 0x180111990
movzx r8d, byte [rcx + 5]
cmp r8b, 0x2f
cmove r8d, ebx
cmp r12, 6
jne 0x18011196b
xor ecx, ecx
xor r10d, r10d
jmp 0x180111990
movzx r10d, byte [rcx + 6]
cmp r10b, 0x2f
cmove r10d, ebx
cmp r12, 7
jne 0x180111982
xor ecx, ecx
jmp 0x180111990
movzx ecx, byte [rcx + 7]
cmp cl, 0x2f
cmove ecx, ebx
shl rcx, 0x38
cmp r12, 8
mov ebx, 8
cmovb rbx, r12
cmp rbx, 2
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x210], r13
mov qword [rsp + 0x208], rbp
jb 0x180111a3a
movzx r11d, r11b
shl r11, 8
movzx edx, dl
or rdx, r11
cmp edx, 0x5c5c
jne 0x180111a3a
mov edx, ebx
and edx, 0xe
cmp edx, 2
je 0x180111a89
movzx edx, dil
shl edx, 8
movzx r9d, r9b
or r9d, edx
movzx edx, r9w
cmp edx, 0x5c2e
je 0x180111b8c
cmp edx, 0x5c3f
jne 0x180111a89
cmp r12, 3
jbe 0x1801136a3
mov rdi, qword [rsp + 0x48]
cmp byte [rdi], 0x2f
je 0x180111a33
cmp byte [rdi + 1], 0x2f
je 0x180111a33
cmp byte [rdi + 2], 0x2f
je 0x180111a33
cmp byte [rdi + 3], 0x2f
jne 0x180112cad
lea rdx, [r12 - 2]
jmp 0x180111aa5
mov bl, 6
cmp r12, 2
jb 0x180111ae4
mov bl, 6
mov rdi, qword [rsp + 0x48]
cmp byte [rdi + 1], 0x3a
jne 0x180111b87
movzx eax, byte [rdi]
mov ecx, eax
and cl, 0xdf
add cl, 0xbf
cmp cl, 0x1a
jae 0x180111b87
lea ecx, [rax - 0x61]
cmp cl, 0x1a
setb cl
shl cl, 5
xor cl, al
mov byte [rsp + 0x37], cl
mov edx, 2
mov bl, 5
jmp 0x180111beb
cmp r12, 1
jbe 0x1801136a3
mov rdx, r12
add rdx, 0xfffffffffffffffe
mov rdi, qword [rsp + 0x48]
je 0x180111b85
lea rcx, [rdi + 2]
mov r8d, 2
sub r8, r12
xor eax, eax
nop word cs:[rax + rax]
movzx r9d, byte [rdi + rax + 2]
cmp r9d, 0x2f
je 0x180111afd
cmp r9d, 0x5c
je 0x180111afd
inc rax
mov r9, r8
add r9, rax
jne 0x180111ac0
mov bl, 6
jmp 0x180111b71
mov rax, r12
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
test rax, rax
jne 0x180111c00
jmp 0x180111c13
lea r10, [rdx - 1]
mov bl, 6
sub r10, rax
je 0x180111b71
lea r8, [rdi + rax]
add r8, 3
mov r11, rax
sub r11, rdx
inc r11
lea rdx, [rdi + rax]
xor r9d, r9d
movzx edi, byte [rdx + r9 + 3]
cmp edi, 0x2f
je 0x180111b3e
cmp edi, 0x5c
je 0x180111b3e
inc r9
mov rdi, r11
add rdi, r9
jne 0x180111b20
mov r9, r10
test rax, rax
mov rdi, qword [rsp + 0x48]
je 0x180111b71
test r9, r9
je 0x180111b71
lea rdx, [r9 + 1]
test r9, r9
cmove rdx, r9
lea rdx, [rax + rdx + 2]
mov bl, 4
mov qword [rsp + 0x100], r8
mov qword [rsp + 0x138], r9
jmp 0x180111bd2
mov rax, r12
mov rdx, rdi
test rax, rax
jne 0x180111c00
jmp 0x180111c13
mov bl, 6
mov rdx, rdi
jmp 0x180111c00
cmp r12, 3
mov rdi, qword [rsp + 0x48]
jbe 0x1801136a3
lea rcx, [rdi + 4]
mov rdx, r12
xor eax, eax
add rdx, 0xfffffffffffffffc
je 0x180111bcc
nop word [rax + rax]
movzx r8d, byte [rcx + rax]
cmp r8d, 0x2f
je 0x180111bcc
cmp r8d, 0x5c
je 0x180111bcc
inc rax
cmp rdx, rax
jne 0x180111bb0
mov rax, rdx
lea rdx, [rax + 4]
mov bl, 3
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x1f8], rax
cmp r12, rdx
jb 0x1801136a3
mov rax, r12
sub rax, rdx
add rdx, rdi
test rax, rax
je 0x180111c13
nop dword [rax]
movzx eax, byte [rdx]
cmp al, 0x5c
sete cl
cmp al, 0x2f
sete bpl
or bpl, cl
jmp 0x180111c15
xor ebp, ebp
shl esi, 0x10
add dword [rsp + 0xf8], esi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r12
mov byte [rsp + 0x90], bl
movzx eax, byte [rsp + 0x37]
mov byte [rsp + 0x91], al
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xba], bpl
mov word [rsp + 0xb8], 0x200
cmp bl, 6
mov rsi, r12
lea r13, [rsp + 0x90]
mov eax, 0
cmove r13, rax
lea r12, [rsp + 0xa0]
mov eax, 0x10
cmove r12, rax
lea r15, [rsp + 0xb0]
mov eax, 0x20
cmove r15, rax
mov dil, 2
mov qword [rsp + 0x148], rsi
mov ecx, edi
nop word [rax + rax]
cmp cl, 2
jne 0x180111dc0
lea rcx, [rsp + 0x80]
call fcn.180104f70
cmp bl, 6
jne 0x180111d00
xor ecx, ecx
jmp case.0x180111d18.2
movzx edx, byte [r13]
mov ecx, 6
lea r8, [0x18011370c]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
mov rcx, qword [r12]
add rcx, 4
jmp case.0x180111d18.2
mov rcx, qword [r12]
mov rdx, qword [r15]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x180111d18.2
mov rcx, qword [r12]
mov rdx, qword [r15]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x180111d18.2
mov ecx, 2
nop
movzx eax, al
movzx edx, bpl
add rdx, rcx
add rdx, rax
cmp rsi, rdx
jbe 0x180111e20
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x80]
call fcn.180105080
sub rsi, qword [rsp + 0x7b0]
jb 0x1801136a3
movzx eax, byte [rsp + 0x7b8]
mov qword [rsp + 0x88], rsi
mov cl, 2
cmp al, 0xa
je 0x180111ce0
jmp case.0x180111e51.2
movzx eax, cl
test eax, eax
je 0x180111e30
mov byte [rsp + 0xb9], 0
test bpl, bpl
jne 0x1801120d9
xor edi, edi
cmp bl, 3
jb 0x180111cd8
movzx eax, bl
cmp eax, 5
je 0x180111cd8
cmp eax, 6
jne 0x180112d28
lea rcx, [rsp + 0x80]
call fcn.180104f70
xor edi, edi
test al, al
je 0x180111cd8
jmp 0x180112d3b
mov byte [rsp + 0xb9], 1
mov dil, 1
jmp 0x180111cd8
cmp bl, 6
je case.default.0x180111e51
movzx eax, byte [r13]
mov dil, 3
lea rdx, [0x180113724]
mov dh, 0x45
add byte [rax - 0x49], al
add ecx, dword [rax - 0x73]
adc eax, 0x18dc
movsxd rcx, dword [rdx + rax*4]
add rcx, rdx
mov eax, ebx
jmp rcx
mov rcx, qword [r12]
add rcx, 4
mov eax, ebx
test rcx, rcx
jne case.0x180111e51.2
jmp case.default.0x180111e51
mov rax, qword [r12]
mov rcx, qword [r15]
lea rdx, [rcx + 1]
test rcx, rcx
cmove rdx, rcx
lea rcx, [rax + rdx]
add rcx, 8
mov eax, ebx
test rcx, rcx
jne case.0x180111e51.2
jmp case.default.0x180111e51
mov rax, qword [r12]
mov rcx, qword [r15]
lea rdx, [rcx + 1]
test rcx, rcx
cmove rdx, rcx
lea rcx, [rax + rdx]
add rcx, 2
mov eax, ebx
test rcx, rcx
je case.default.0x180111e51
nop word cs:[rax + rax]
add al, 0xfa
cmp al, 3
ja case.default.0x180111e51
movzx eax, al
dec rax
cmp rax, 2
ja case.default.0x180111e51
cmp bl, 6
je 0x180111f0f
lea rcx, [rsp + 0x90]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x7cf], rax
movdqu xmm0, xmmword [rcx + 1]
movdqu xmm1, xmmword [rcx + 0x11]
movdqa xmmword [rsp + 0x7c0], xmm1
movdqa xmmword [rsp + 0x7b0], xmm0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0x3a8], rsi
mov byte [rsp + 0x3b0], bl
mov rax, qword [rsp + 0x7cf]
lea rcx, [rsp + 0x3b1]
mov qword [rcx + 0x1f], rax
movdqa xmm0, xmmword [rsp + 0x7b0]
movdqa xmm1, xmmword [rsp + 0x7c0]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmmword [rcx], xmm0
mov byte [rsp + 0x3da], bpl
mov byte [rsp + 0x3d8], 0
mov byte [rsp + 0x3d9], dil
cmp dil, 2
lea r13, [rsp + 0x3a0]
jne 0x1801120c3
lea r15, [rsp + 0x3c0]
movzx edi, bpl
cmp bl, 6
mov eax, 0x10
cmove r15, rax
lea r12, [rsp + 0x3d0]
mov eax, 0x20
cmove r12, rax
jne 0x180112010
nop
mov rcx, r13
call fcn.180104f70
movzx eax, al
add rax, rdi
cmp rsi, rax
mov rbx, qword [rsp + 0x28]
jbe 0x1801120c8
lea rcx, [rsp + 0x7b0]
mov rdx, r13
call fcn.180105080
cmp byte [rsp + 0x7b8], 0xa
jne 0x1801120c8
sub rsi, qword [rsp + 0x7b0]
jb 0x1801136a3
mov qword [rsp + 0x3a8], rsi
jmp 0x180111fb0
mov rcx, r13
call fcn.180104f70
mov ecx, 6
movzx edx, bl
lea r8, [0x18011373c]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
mov rcx, qword [r15]
add rcx, 4
jmp case.0x18011202e.2
mov rcx, qword [r15]
mov rdx, qword [r12]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x18011202e.2
mov rcx, qword [r15]
mov rdx, qword [r12]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x18011202e.2
mov ecx, 2
nop word cs:[rax + rax]
movzx eax, al
add rcx, rdi
add rcx, rax
cmp rsi, rcx
jbe 0x1801120c3
lea rcx, [rsp + 0x7b0]
mov rdx, r13
call fcn.180105080
cmp byte [rsp + 0x7b8], 0xa
jne 0x1801120c3
sub rsi, qword [rsp + 0x7b0]
jb 0x1801136a3
mov qword [rsp + 0x3a8], rsi
jmp 0x180112010
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x148]
cmp rax, rsi
cmovb rsi, rax
jmp 0x180112115
mov al, 6
test rsi, rsi
je 0x1801136a3
dec rsi
mov qword [rsp + 0x88], rsi
xor edi, edi
add al, 0xfa
cmp al, 3
jbe 0x180111eca
nop dword [rax + rax]
mov rsi, qword [rsp + 0x148]
lea r13, [rsp + 0x3a0]
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 0x1a
lea r8, [rsp + 0x238]
mov r9d, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x180112300
mov rdx, qword [rsp + 0x238]
test rdx, rdx
je 0x18011220b
mov qword [rsp + 0x20], 0
mov r9d, 0x470
mov rcx, rbx
lea r8, [rsp + 0x7b0]
call sub.kernel32.dll_ReadProcessMemory
cmp eax, 1
jne 0x180112300
mov edx, dword [rsp + 0x7c0]
mov qword [rsp + 0x20], 0
mov r9d, 0x2a4
mov rcx, rbx
mov r8, r13
call sub.kernel32.dll_ReadProcessMemory
cmp eax, 1
jne 0x180112300
movzx ebp, word [rsp + 0x3c4]
mov edi, dword [rsp + 0x3c8]
mov r12d, dword [rsp + 0x3e4]
movzx r15d, word [rsp + 0x3e0]
mov ebx, dword [rsp + 0x3e8]
mov rax, qword [0x180220050]
cmp rax, 2
jne 0x1801128b1
movzx eax, byte [0x180220058]
test al, al
mov qword [rsp + 0x38], rdi
je 0x1801128ca
lea rcx, [rsp + 0x170]
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
call fcn.180114b60
jmp 0x18011293c
mov qword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
lea r8, [rsp + 0x190]
mov r9d, 0x30
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x180112300
mov rdx, qword [rsp + 0x198]
mov qword [rsp + 0x20], 0
mov r9d, 0x7c8
mov rcx, rbx
lea r8, [rsp + 0x7b0]
call sub.kernel32.dll_ReadProcessMemory
cmp eax, 1
jne 0x180112300
mov rdx, qword [rsp + 0x7d0]
mov qword [rsp + 0x20], 0
mov r9d, 0x410
mov rcx, rbx
mov r8, r13
call sub.kernel32.dll_ReadProcessMemory
cmp eax, 1
jne 0x180112300
movzx ebp, word [rsp + 0x3d8]
mov rdi, qword [rsp + 0x3e0]
mov r12, qword [rsp + 0x418]
movzx r15d, word [rsp + 0x410]
mov rbx, qword [rsp + 0x420]
mov rax, qword [0x180220050]
cmp rax, 2
jne 0x180112d77
movzx eax, byte [0x180220058]
test al, al
mov qword [rsp + 0x38], rdi
je 0x180112d90
lea rcx, [rsp + 0x1c8]
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
call fcn.180114b60
jmp 0x180112e02
movaps xmmword [rsp + 0x7b0], xmm6
xorps xmm8, xmm8
mov eax, 8
mov qword [rsp + 0x40], rax
mov eax, 1
mov qword [rsp + 0x38], rax
xor edi, edi
xor ebp, ebp
mov r15d, 8
movaps xmm0, xmmword [rsp + 0x7b0]
movaps xmmword [rsp + 0x190], xmm0
mov eax, dword [rsp + 0x3a0]
mov ecx, dword [rsp + 0x3a3]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x53], ecx
mov qword [rsp + 0x3a0], 0
mov qword [rsp + 0x7b0], 0
lea r8, [rsp + 0x7b0]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r13
mov r9, r8
call sub.kernel32.dll_GetProcessTimes
mov r12, qword [rsp + 0x3a0]
mov eax, dword [rsp + 0xf8]
and eax, 0xffffff
cmp eax, 0x10000
jae 0x1801123bd
xor r13d, r13d
movzx eax, byte [0x180221a30]
mov rax, qword [0x1802219b8]
test rax, rax
jne 0x18011251c
jmp 0x180112506
mov qword [rsp + 0x80], 0
mov rcx, rbx
mov edx, 8
lea r8, [rsp + 0x80]
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x1801124eb
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x1801124eb
mov qword [rsp + 0xf8], r15
mov dword [rsp + 0xc0], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x18011243d
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1801124da
mov r15d, dword [rsp + 0xc0]
call qword [sym.imp.kernel32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1801124da
mov r15, rax
mov r9d, dword [rsp + 0xc0]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, 1
mov r8, r15
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x1801124c6
mov rdx, qword [r15]
lea rcx, [rsp + 0x7b0]
call fcn.180109930
mov r13, qword [rsp + 0x7b0]
test r13, r13
je 0x180112868
lea rax, [rsp + 0x7b8]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x3a0], xmm0
jmp 0x18011286b
call qword [sym.imp.kernel32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov r15, qword [rsp + 0xf8]
xor r13d, r13d
mov rbx, qword [rsp + 0x28]
movzx eax, byte [0x180221a30]
mov rax, qword [0x1802219b8]
test rax, rax
jne 0x18011251c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1801136a7
mov qword [0x1802219b8], rax
mov r8d, 0x18
mov rcx, rax
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1801136a7
mov rcx, rax
mov rax, r12
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
shr rdx, 0x17
movabs rax, 0xfffffffd49ef6f00
add rdx, rax
mov r9, qword [rsp + 0x228]
cmp rdx, r9
mov eax, 0
cmovbe rax, rdx
sub r9, rax
mov qword [rcx], 1
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rbx
mov qword [rsp + 0x318], r13
movaps xmm0, xmmword [rsp + 0x3a0]
lea r8, [rsp + 0x320]
movups xmmword [r8], xmm0
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x270], rax
mov r10, qword [rsp + 0x148]
mov qword [rsp + 0x278], r10
mov byte [rsp + 0x280], 1
mov eax, dword [rsp + 0x83]
mov dword [r8 - 0x9c], eax
mov eax, dword [rsp + 0x80]
mov dword [r8 - 0x9f], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x2b0], r10
mov qword [rsp + 0x2b8], rsi
mov byte [rsp + 0x2c0], 1
mov eax, dword [rsp + 0x7b3]
mov dword [r8 - 0x5c], eax
mov eax, dword [rsp + 0x7b0]
mov dword [r8 - 0x5f], eax
movups xmmword [r8 + 0x38], xmm6
movups xmmword [r8 + 0x28], xmm6
mov rax, qword [rsp + 0x120]
mov qword [r8 - 0x48], rax
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [r8 - 0x58], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], rdi
mov qword [rsp + 0x2f0], rbp
mov qword [rsp + 0x310], r14
mov qword [rsp + 0x2f8], r15
movups xmmword [rsp + 0x300], xmm8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x288], rax
movdqa xmm0, xmmword [rsp + 0x190]
movdqu xmmword [r8 - 0x90], xmm0
mov byte [rsp + 0x2a0], 1
mov eax, dword [rsp + 0x53]
mov dword [r8 - 0x7c], eax
mov eax, dword [rsp + 0x50]
mov dword [r8 - 0x7f], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x260], 1
mov qword [rsp + 0x340], rcx
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x370], r9
mov dword [rsp + 0x398], 0
mov byte [rsp + 0x39c], 1
movups xmmword [r8 + 0x68], xmm6
movups xmmword [r8 + 0x58], xmm6
mov r15, qword [rsp + 0x218]
mov r12, qword [rsp + 0x1f0]
mov r13, qword [rsp + 0x1e8]
mov rbp, qword [rsp + 0x1e0]
movzx eax, word [rbp]
movzx edx, byte [rbp + 2]
shl edx, 0x10
or edx, eax
mov rax, qword [rsp + 0x188]
mov r8, qword [rax]
mov rax, qword [rsp + 0x150]
mov r9, qword [rax]
lea rcx, [rsp + 0x250]
call fcn.180114650
mov rsi, qword [rsp + 0x250]
mov r8d, 0x148
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x258]
call fcn.180181ff0
cmp rsi, 2
je 0x180111299
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x3a8], rax
mov rdi, qword [rsp + 0x140]
mov qword [rsp + 0x3b0], rdi
cmp rdi, rax
jne 0x180112823
lea rcx, [rsp + 0x3a0]
mov rdx, rdi
call fcn.1801138f0
mov rdi, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x108], rax
jmp 0x18011282b
mov rcx, qword [rsp + 0xf0]
imul rax, rdi, 0x150
mov qword [rcx + rax], rsi
mov qword [rsp + 0xf0], rcx
add rcx, rax
add rcx, 8
mov r8d, 0x148
lea rdx, [rsp + 0x7b0]
call fcn.180181ff0
inc rdi
mov qword [rsp + 0x140], rdi
jmp 0x180111299
xor r13d, r13d
call qword [sym.imp.kernel32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rbx, qword [rsp + 0x28]
mov r15, qword [rsp + 0xf8]
movzx eax, byte [0x180221a30]
mov rax, qword [0x1802219b8]
test rax, rax
jne 0x18011251c
jmp 0x180112506
call fcn.18018d4b0
movzx eax, byte [0x180220058]
test al, al
mov qword [rsp + 0x38], rdi
jne 0x1801121f1
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x28]
mov r8, r12
mov r9, r15
call fcn.180114890
mov r12, qword [rsp + 0x80]
test r12, r12
je 0x180112920
mov rdi, qword [rsp + 0x88]
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.1801149e0
test rdi, rdi
je 0x180112937
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x180112937
mov qword [rsp + 0x170], 8
lea rax, [rsp + 0x178]
movups xmmword [rax], xmm6
mov rdi, qword [rsp + 0x28]
mov r9d, 0x30
mov rcx, rdi
mov rdx, rbx
lea r8, [rsp + 0x80]
call sub.kernel32.dll_VirtualQueryEx
test rax, rax
je 0x180112bc0
mov r9, qword [rsp + 0x80]
sub r9, rbx
add r9, qword [rsp + 0x98]
lea rcx, [rsp + 0xc0]
mov rdx, rdi
mov r8, rbx
call fcn.180114890
mov r11, qword [rsp + 0xc0]
test r11, r11
je 0x180112bcf
mov qword [rsp + 0x40], rbp
mov r12, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
mov qword [rsp + 0x50], 8
lea rax, [rsp + 0x58]
movups xmmword [rax], xmm6
mov rdi, rbp
add rdi, rbp
mov eax, 8
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov rbx, qword [rsp + 0x28]
cmp rcx, rbp
je 0x180112b97
lea rdx, [r11 + rcx*2]
mov r9, rdi
sub r9, rcx
sub r9, rcx
xor eax, eax
xor r8d, r8d
mov r10, rdx
nop word [rax + rax]
cmp word [r10], 0
je 0x180112a1d
add r10, 2
dec r8
add rax, 2
add r9, 0xfffffffffffffffe
jne 0x180112a00
jmp 0x180112b97
mov r15, rcx
sub r15, r8
cmp r15, rcx
jb 0x1801136a3
cmp r15, rbp
ja 0x1801136a3
neg r8
mov rcx, rdx
nop dword [rax + rax]
test rax, rax
je 0x180112b97
add rax, 0xfffffffffffffffe
cmp word [rcx], 0x3d
lea rcx, [rcx + 2]
jne 0x180112a40
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], r11
lea rcx, [rsp + 0x80]
call fcn.180104c10
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
lea rcx, [rsp + 0x190]
call fcn.180108840
mov r12, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x1a0]
test r12, r12
je 0x180112ab0
mov r13, qword [rsp + 0x198]
jmp 0x180112afb
mov r13, qword [rsp + 0x198]
test rbx, rbx
je 0x180112ae4
js 0x1801136a3
movzx eax, byte [0x180221a30]
mov edx, 1
mov rcx, rbx
call fcn.18001e100
mov r12, rax
test rax, rax
jne 0x180112aea
jmp 0x1801136fa
mov r12d, 1
mov rcx, r12
mov rdx, r13
mov r8, rbx
call fcn.180181ff0
mov r13, rbx
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x58]
jne 0x180112b20
lea rcx, [rsp + 0x50]
call fcn.180114c90
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
lea rax, [rdx + rdx*2]
mov qword [rcx + rax*8], r12
mov qword [rcx + rax*8 + 8], r13
mov qword [rsp + 0x78], rcx
mov qword [rcx + rax*8 + 0x10], rbx
inc rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x60], rdx
cmp qword [rsp + 0x88], 0
je 0x180112b66
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1802219b8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
inc r15
mov rcx, r15
cmp rbp, r15
lea r13, [rsp + 0x3a0]
mov rbx, qword [rsp + 0x28]
mov r11, qword [rsp + 0x130]
mov r12, qword [rsp + 0x128]
jae 0x1801129d9
jmp 0x1801136a3
mov r15, qword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x58]
test r12, r12
je 0x180112bb9
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, r11
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0x40]
jmp 0x180112bde
xorps xmm8, xmm8
mov r15d, 8
mov rbx, rdi
jmp 0x180112bde
xorps xmm8, xmm8
mov r15d, 8
mov rbx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x190]
mov rdx, rbx
mov r9, rbp
call fcn.180114890
mov rbx, qword [rsp + 0x190]
test rbx, rbx
je 0x180112c5c
mov r8, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x198]
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.1801144d0
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
movdqu xmm0, xmmword [rax - 8]
movdqa xmmword [rsp + 0x50], xmm0
test rdi, rdi
mov qword [rsp + 0x38], rcx
je 0x180112c6b
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x180112c6b
movaps xmmword [rsp + 0x50], xmm6
mov eax, 1
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
mov eax, dword [rsp + 0x190]
mov ecx, dword [rsp + 0x193]
jmp 0x180113175
cmp rbx, 3
jbe 0x1801136a3
and ebx, 0xc
cmp ebx, 4
je 0x180112d4b
movzx edx, r10b
shl rdx, 0x30
or rdx, rcx
movzx ecx, r8b
shl rcx, 0x28
movzx eax, al
shl rax, 0x20
or rax, rcx
or rax, rdx
movabs rcx, 0x5c434e5500000000
cmp rax, rcx
jne 0x180112d4b
cmp r12, 7
jbe 0x1801136a3
mov rcx, r12
add rcx, 0xfffffffffffffff8
je 0x180113214
lea rdx, [r12 - 8]
xor eax, eax
cmp byte [rdi + rax + 8], 0x5c
je 0x180113255
inc rax
cmp rdx, rax
jne 0x180112d10
jmp 0x180113216
mov al, 6
xor edi, edi
add al, 0xfa
cmp al, 3
jbe 0x180111eca
jmp case.default.0x180111e51
mov al, 7
test rsi, rsi
jne 0x1801120e4
jmp 0x1801136a3
lea rcx, [rdi + 4]
lea rax, [r12 - 4]
cmp rax, 3
jae 0x1801131b6
cmp r12, 4
je 0x18011324a
cmp r12, 6
je 0x1801131c4
jmp 0x1801131fb
call fcn.18018d4b0
movzx eax, byte [0x180220058]
test al, al
mov qword [rsp + 0x38], rdi
jne 0x1801122da
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x28]
mov r8, r12
mov r9, r15
call fcn.180114890
mov r12, qword [rsp + 0x80]
test r12, r12
je 0x180112de6
mov rdi, qword [rsp + 0x88]
lea rcx, [rsp + 0x1c8]
mov rdx, r12
call fcn.1801149e0
test rdi, rdi
je 0x180112dfd
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x180112dfd
mov qword [rsp + 0x1c8], 8
lea rax, [rsp + 0x1d0]
movups xmmword [rax], xmm6
mov rdi, qword [rsp + 0x28]
mov r9d, 0x30
mov rcx, rdi
mov rdx, rbx
lea r8, [rsp + 0x80]
call sub.kernel32.dll_VirtualQueryEx
test rax, rax
je 0x180113096
mov r9, qword [rsp + 0x80]
sub r9, rbx
add r9, qword [rsp + 0x98]
lea rcx, [rsp + 0x170]
mov rdx, rdi
mov r8, rbx
call fcn.180114890
mov r11, qword [rsp + 0x170]
test r11, r11
je 0x1801130a5
mov qword [rsp + 0x40], rbp
mov r12, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov qword [rsp + 0xc0], 8
lea rax, [rsp + 0xc8]
movups xmmword [rax], xmm6
mov rdi, rbp
add rdi, rbp
mov eax, 8
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov rbx, qword [rsp + 0x28]
cmp rcx, rbp
je 0x180113067
lea rdx, [r11 + rcx*2]
mov r9, rdi
sub r9, rcx
sub r9, rcx
xor eax, eax
xor r8d, r8d
mov r10, rdx
nop word cs:[rax + rax]
cmp word [r10], 0
je 0x180112eed
add r10, 2
dec r8
add rax, 2
add r9, 0xfffffffffffffffe
jne 0x180112ed0
jmp 0x180113067
mov r15, rcx
sub r15, r8
cmp r15, rcx
jb 0x1801136a3
cmp r15, rbp
ja 0x1801136a3
neg r8
mov rcx, rdx
nop dword [rax + rax]
test rax, rax
je 0x180113067
add rax, 0xfffffffffffffffe
cmp word [rcx], 0x3d
lea rcx, [rcx + 2]
jne 0x180112f10
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], r11
lea rcx, [rsp + 0x80]
call fcn.180104c10
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.180108840
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
test r12, r12
je 0x180112f74
mov r13, qword [rsp + 0x58]
jmp 0x180112fbc
mov r13, qword [rsp + 0x58]
test rbx, rbx
je 0x180112fa5
js 0x1801136a3
movzx eax, byte [0x180221a30]
mov edx, 1
mov rcx, rbx
call fcn.18001e100
mov r12, rax
test rax, rax
jne 0x180112fab
jmp 0x1801136fa
mov r12d, 1
mov rcx, r12
mov rdx, r13
mov r8, rbx
call fcn.180181ff0
mov r13, rbx
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0xc8]
jne 0x180112fed
lea rcx, [rsp + 0xc0]
call fcn.180114c90
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xd0]
lea rax, [rdx + rdx*2]
mov qword [rcx + rax*8], r12
mov qword [rcx + rax*8 + 8], r13
mov qword [rsp + 0x78], rcx
mov qword [rcx + rax*8 + 0x10], rbx
inc rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0xd0], rdx
cmp qword [rsp + 0x88], 0
je 0x180113036
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1802219b8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
inc r15
mov rcx, r15
cmp rbp, r15
lea r13, [rsp + 0x3a0]
mov rbx, qword [rsp + 0x28]
mov r11, qword [rsp + 0x130]
mov r12, qword [rsp + 0x128]
jae 0x180112ea5
jmp 0x1801136a3
mov r15, qword [rsp + 0xc0]
movups xmm8, xmmword [rsp + 0xc8]
test r12, r12
je 0x18011308f
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, r11
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0x40]
jmp 0x1801130b4
xorps xmm8, xmm8
mov r15d, 8
mov rbx, rdi
jmp 0x1801130b4
xorps xmm8, xmm8
mov r15d, 8
mov rbx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov rdx, rbx
mov r9, rbp
call fcn.180114890
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180113129
mov r8, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.1801144d0
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
movdqu xmm0, xmmword [rax - 8]
movdqa xmmword [rsp + 0xc0], xmm0
test rdi, rdi
mov qword [rsp + 0x38], rcx
je 0x18011313b
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x18011313b
movaps xmmword [rsp + 0xc0], xmm6
mov eax, 1
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x1d0]
mov rbp, qword [rsp + 0x1d8]
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x80], xmm0
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x53]
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xe3], ecx
movdqa xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x7b0], xmm0
mov eax, dword [rsp + 0xe0]
mov ecx, dword [rsp + 0xe3]
mov dword [rsp + 0x3a0], eax
mov dword [rsp + 0x3a3], ecx
jmp 0x18011232a
movzx edx, byte [rdi + 6]
cmp edx, 0x2f
je 0x1801131c4
cmp edx, 0x5c
jne 0x1801131fb
cmp byte [rdi + 5], 0x3a
jne 0x1801131fb
movzx edx, byte [rcx]
mov r8d, edx
and r8b, 0xdf
add r8b, 0xbf
cmp r8b, 0x19
ja 0x1801131fb
lea eax, [rdx - 0x61]
cmp al, 0x1a
setb al
shl al, 5
xor al, dl
mov byte [rsp + 0x37], al
mov edx, 6
mov bl, 2
jmp 0x180111beb
lea rdx, [r12 - 4]
xor r8d, r8d
cmp byte [rcx + r8], 0x5c
je 0x180113247
inc r8
cmp rdx, r8
jne 0x180113203
jmp 0x18011324a
xor ecx, ecx
lea rax, str.description___is_deprecated__use_Displayh
mov qword [rsp + 0x100], rax
lea rdx, [rcx + 8]
xor r10d, r10d
mov rax, rcx
mov qword [rsp + 0x138], r10
xor ecx, ecx
add rdx, rcx
lea rcx, [rdi + 8]
mov bl, 1
jmp 0x180111bd2
mov rax, r8
lea rdx, [rax + 4]
xor ebx, ebx
jmp 0x180111bd2
lea rcx, [r12 - 9]
lea rdx, [rdi + rax]
add rdx, 9
mov qword [rsp + 0x100], rdx
cmp rcx, rax
jne 0x180113274
mov rcx, rax
jmp 0x180113225
mov rcx, r12
sub rcx, rax
add rcx, 0xfffffffffffffff7
mov rdx, rax
sub rdx, r12
add rdx, 9
lea r8, [rdi + rax]
add r8, 9
xor r10d, r10d
cmp byte [r8 + r10], 0x5c
je 0x1801132a8
inc r10
mov r9, rdx
add r9, r10
jne 0x180113293
mov r10, rcx
lea rdx, [rax + 8]
test r10, r10
je 0x18011322f
mov qword [rsp + 0x138], r10
lea rcx, [r10 + 1]
jmp 0x180113239
mov rdi, r9
test r8b, r8b
je 0x180113394
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x18011342d
add rax, 0x110
jmp 0x180113432
mov rdi, qword [rsp + 0x140]
test rdi, rdi
je 0x1801133c2
movzx eax, byte [0x180221a30]
mov rcx, qword [0x1802219b8]
test rcx, rcx
mov rsi, qword [rsp + 0xf0]
jne 0x180113345
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1801136e9
mov rcx, rax
mov qword [0x1802219b8], rax
mov r8d, 0x28
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1801136e9
mov qword [rax], rsi
mov rcx, qword [rsp + 0x108]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
pxor xmm0, xmm0
movdqu xmmword [rax + 0x18], xmm0
mov rcx, qword [rsp + 0xe8]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 1
jmp 0x180113642
test rdi, rdi
je 0x1801111d4
shr rdi, 1
jmp 0x180113446
pxor xmm0, xmm0
mov rax, qword [rsp + 0xe8]
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
jmp 0x180113642
pxor xmm0, xmm0
mov rax, qword [rsp + 0xe8]
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
cmp qword [rsp + 0x108], 0
mov r8, qword [rsp + 0xf0]
je 0x180113642
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0xf80]
movaps xmm7, xmmword [rsp + 0xf90]
movaps xmm8, xmmword [rsp + 0xfa0]
add rsp, 0xfb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
call fcn.180077870
mov rax, qword [rax]
mov rax, qword [rax + 0x210]
shr rdi, 1
cmp rax, rdi
cmova rdi, rax
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x250], rsi
cmp rsi, r14
ja 0x1801136a3
lea rax, [r15 + rsi*8]
sub r14, rsi
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x7b0], rcx
lea rcx, [rsp + 0x250]
mov qword [rsp + 0x7b8], rcx
lea rdx, [rsp + 0x240]
mov qword [rsp + 0x7c0], rdx
mov qword [rsp + 0x7c8], rax
mov qword [rsp + 0x7d0], r14
mov qword [rsp + 0x7d8], rbx
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rdx
mov qword [rsp + 0x7f0], r15
mov qword [rsp + 0x7f8], rsi
mov qword [rsp + 0x800], rbx
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r8, qword [rax + 0x50]
test r8, r8
jne 0x180113534
call fcn.180077870
mov rax, qword [rax]
lea rdx, [rax + 0x80]
mov ecx, dword [0x180221a34]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov r8, qword [rcx + 0x50]
test r8, r8
je 0x18011366f
cmp qword [r8 + 0x110], rax
jne 0x180113689
lea rcx, [rsp + 0x3a0]
lea rdx, [rsp + 0x7b0]
xor r9d, r9d
call fcn.1801139c0
mov rsi, qword [rsp + 0x3a0]
mov r8, qword [rsp + 0x3a8]
mov r9, qword [rsp + 0x3b8]
mov rax, qword [rsp + 0x3c0]
mov rdx, qword [rsp + 0x3c8]
test r8, r8
je 0x18011359a
mov rcx, qword [rsp + 0x3b0]
test r9, r9
je 0x18011362c
mov qword [r8 + 0x18], r9
mov qword [r9 + 0x20], r8
add rcx, rdx
jmp 0x18011362f
mov rcx, qword [rsp + 0xe8]
mov qword [rcx], r9
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
test rsi, rsi
je 0x180113642
mov r14, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1801135d7
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, rsi
call r14
mov rsi, r15
test r15, r15
je 0x180113642
mov r15, qword [rsi + 0x18]
test r15, r15
je 0x1801135e8
mov qword [r15 + 0x20], 0
mov rdi, qword [rsi]
mov r12, qword [rsi + 0x10]
test r12, r12
je 0x180113614
mov rbx, rdi
nop word [rax + rax]
mov rcx, rbx
call fcn.180113760
add rbx, 0x150
dec r12
jne 0x180113600
cmp qword [rsi + 8], 0
je 0x1801135c0
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, rdi
call r14
jmp 0x1801135c0
mov rax, r8
mov rdx, qword [rsp + 0xe8]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rcx
movaps xmm6, xmmword [rsp + 0xf80]
movaps xmm7, xmmword [rsp + 0xf90]
movaps xmm8, xmmword [rsp + 0xfa0]
add rsp, 0xfb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x3a0]
lea r8, [rsp + 0x7b0]
call fcn.18018d290
jmp 0x18011354c
lea rcx, [rsp + 0x3a0]
lea r9, [rsp + 0x7b0]
call fcn.18018d3a0
jmp 0x18011354c
ud2
mov ecx, 8
mov edx, 0x18
call fcn.180183f50
ud2
mov ecx, 1
mov rdx, r12
call fcn.180183f50
ud2
mov ecx, 1
mov edx, 6
call fcn.180183f50
ud2
mov ecx, 1
mov edx, 4
call fcn.180183f50
ud2
mov ecx, 8
mov edx, 0x28
call fcn.180183f50
ud2
mov ecx, 1
mov rdx, rbx
call fcn.180183f50
ud2