Function at 0x18005aacc
Capabilities:
Encode data using xor
Get graphical window text

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11e8]
mov eax, 0x12e8
call fcn.18009d830
sub rsp, rax
mov r13, rcx
mov esi, 0x824
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x180]
call fcn.1800a02d0
movabs rbx, 0xd993efbb19cfe32d
mov r14d, 3
xor r15d, r15d
cmp byte [0x18010a364], r15b
je 0x18005ab6d
lea rcx, [rbp + 0x1230]
call fcn.180059f78
cmp byte [rax + 0x3e], r15b
je 0x18005ab58
mov r9d, r15d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rbx
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3e
jb 0x18005ab38
mov byte [rax + 0x3e], r15b
mov r9d, dword [0x18010850c]
mov r8, r13
mov rdx, rax
mov ecx, r14d
call fcn.18006a848
mov qword [rbp - 0x40], r15
call fcn.18000ce3c
test al, al
jne 0x18005ab9f
lea rcx, [rbp - 0x40]
call fcn.18005efe8
test eax, eax
je 0x18005ab8d
cmp dword [rbp - 0x40], 4
jae 0x18005ab9f
call fcn.18000ceb4
test al, al
jne 0x18005ab9f
call fcn.18000ce80
test al, al
je 0x18005aba4
call fcn.18005d8e4
xor edx, edx
mov r8d, 0xa7c
lea rcx, [0x180108580]
call fcn.1800a02d0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x180108ffc], eax
mov dword [0x180108fcc], eax
mov dword [0x180108fd0], eax
mov dword [0x180108508], 1
mov dword [0x180108504], 1
mov qword [0x180109108], r13
call fcn.18005ceb8
test al, al
jne 0x18005ac01
cmp byte [0x18010a5a4], r15b
je 0x18005bcc2
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x9b0]
call fcn.1800a02d0
mov r8, rsi
lea rdx, [rbp + 0x9b0]
mov rcx, r13
call fcn.18004fbec
lea rsi, [0x180108460]
lea r12, [0x1801012d0]
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x18005acf5
lea rcx, [rbp + 0x9b0]
mov rax, rdi
inc rax
cmp byte [rcx + rax], r15b
jne 0x18005ac48
test rax, rax
je 0x18005acf5
mov qword [rbp - 0x30], rsi
mov rcx, rsi
call fcn.180007dac
mov byte [rbp - 0x28], 1
lea rax, [rbp + 0x9b0]
mov rsi, rdi
inc rsi
cmp byte [rax + rsi], r15b
jne 0x18005ac74
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rsi, rax
ja 0x18005acb7
mov rbx, r12
cmp rax, 0x10
cmovae rbx, qword [0x1801012d0]
mov qword [0x1801012e0], rsi
mov r8, rsi
lea rdx, [rbp + 0x9b0]
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + rsi], r15b
jmp 0x18005accc
lea r9, [rbp + 0x9b0]
mov r8b, r15b
mov rdx, rsi
mov rcx, r12
call fcn.180003a38
mov r8d, 0x823
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 0x180]
call fcn.1800a8850
lea rsi, [0x180108460]
mov rcx, rsi
call fcn.180007dc4
nop
cmp byte [0x18010a5a4], r15b
je 0x18005b910
mov rbx, r13
call fcn.18004a0b0
lea rsi, str.Shell_Embedding
test al, al
jne 0x18005ad1e
call fcn.180049e38
test al, al
je 0x18005ad6d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], al
lea r14d, [rax + 0x19]
mov rcx, r13
jmp 0x18005ad4e
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetTopWindow]
test rax, rax
je 0x18005ad6d
mov rbx, rax
mov rcx, rax
mov r8d, r14d
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1800a86c0
test eax, eax
jne 0x18005ad3a
test rbx, rbx
je 0x18005ade1
xor r9d, r9d
lea r8, [0x1800d40c0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
cmovne rbx, rax
xor r9d, r9d
lea r8, str._ABROWSER_SITE
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
cmovne rbx, rax
xor r9d, r9d
lea r8, str._MINIBROWSER_SITE
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
cmovne rbx, rax
xor r9d, r9d
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x18005ade1
mov rbx, rax
jmp 0x18005ade9
mov rcx, r15
test rbx, rbx
je 0x18005ae00
xor r9d, r9d
xor r8d, r8d
mov edx, 0x407
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rax
mov sil, r15b
test rcx, rcx
je 0x18005b687
mov qword [rbp + 0x1248], r15
mov qword [rbp + 0x1240], r15
mov qword [rbp - 0x30], r15
mov rax, qword [rcx]
lea r8, [rbp - 0x30]
lea rdx, [0x1800da240]
call qword [rax]
test eax, eax
jne 0x18005b642
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x18005b642
mov rcx, qword [rbp + 0x1248]
test rcx, rcx
je 0x18005ae56
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov qword [rbp + 0x1248], r15
mov rax, qword [rbx]
lea r9, [rbp + 0x1248]
lea r8, [0x1800da240]
lea rdx, [0x1800da160]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
jne 0x18005b642
mov rbx, qword [rbp + 0x1248]
test rbx, rbx
je 0x18005b642
mov rcx, qword [rbp + 0x1240]
test rcx, rcx
je 0x18005aea6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov qword [rbp + 0x1240], r15
mov rax, qword [rbx]
lea r9, [rbp + 0x1240]
lea r8, [0x1800da210]
lea rdx, [0x1800da200]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
js 0x18005b642
mov rcx, qword [rbp + 0x1240]
test rcx, rcx
je 0x18005b642
mov qword [rsp + 0x60], r15
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x90]
test eax, eax
js 0x18005b631
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18005b636
mov qword [rbp + 0x1238], r15
mov rax, qword [rcx]
lea r8, [rbp + 0x1238]
lea rdx, [0x1800da1e0]
call qword [rax]
test eax, eax
js 0x18005b61f
mov rcx, qword [rbp + 0x1238]
test rcx, rcx
je 0x18005b626
mov qword [rbp - 0x48], r15
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [rbp - 0x48]
test eax, eax
js 0x18005b614
test rcx, rcx
je 0x18005b614
mov qword [rbp - 0x38], r15
mov rax, qword [rcx]
lea rdx, [rbp - 0x38]
call qword [rax + 0x40]
test eax, eax
js 0x18005b606
mov r15, qword [rbp - 0x38]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov esi, 0x80
xor ebx, ebx
test r15, r15
jne 0x18005af9d
mov edx, ebx
mov qword [rbp - 0x20], rbx
jmp 0x18005b084
mov r14, rdi
inc r14
cmp word [r15 + r14*2], bx
jne 0x18005afa0
inc r14d
lea ebx, [r14*4]
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.18000e834
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
mov ebx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x18005b076
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18005b076
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.18000e834
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
mov ebx, ecx
test eax, eax
sete bl
test ebx, ebx
jne 0x18005bd55
mov rdx, qword [rbp - 0x20]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], bl
lea rcx, [rsp + 0x40]
call fcn.180003104
nop
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
cmp rcx, rax
je 0x18005b0b8
call fcn.1800a89bc
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp + 0x1238]
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
call qword [rax + 0x88]
mov r15, qword [rbp - 0x50]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
test r15, r15
jne 0x18005b0ed
mov rbx, r15
mov qword [rbp - 0x20], rbx
jmp 0x18005b1d9
mov r14, rdi
inc r14
cmp word [r15 + r14*2], bx
jne 0x18005b0f0
inc r14d
lea ebx, [r14*4]
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.18000e834
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
mov ebx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x18005b1ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18005b1ca
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.18000e834
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r15d, r15d
mov ebx, r15d
test eax, eax
sete bl
jmp 0x18005b1cd
xor r15d, r15d
test ebx, ebx
jne 0x18005bd6b
mov rbx, qword [rbp - 0x20]
lea rdx, str.Parental_Control_Block
mov rcx, rbx
call fcn.1800a86c0
mov r14d, eax
lea rax, [rbp - 0x18]
cmp rbx, rax
je 0x18005b1fc
mov rcx, rbx
call fcn.1800a89bc
test r14d, r14d
jne 0x18005b51a
cmp byte [0x18010a364], r15b
je 0x18005b25a
lea rcx, [rbp + 0x1230]
call fcn.18005a078
cmp byte [rax + 0x12], r15b
je 0x18005b24d
mov r9, r15
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r10
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x12
jb 0x18005b22d
mov byte [rax + 0x12], r15b
mov rdx, rax
mov ecx, 3
call fcn.18006a848
mov r15, qword [rbp - 0x50]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
xor eax, eax
test r15, r15
jne 0x18005b279
mov rdx, r15
mov qword [rbp - 0x20], rdx
jmp 0x18005b365
mov r14, rdi
inc r14
cmp word [r15 + r14*2], ax
jne 0x18005b27c
inc r14d
lea ebx, [r14*4]
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.18000e834
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
mov ebx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x18005b356
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18005b356
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.18000e834
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r15d, r15d
mov ebx, r15d
test eax, eax
sete bl
jmp 0x18005b359
xor r15d, r15d
test ebx, ebx
jne 0x18005bd81
mov rdx, qword [rbp - 0x20]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x58], rsi
mov byte [rbp - 0x70], r15b
lea rcx, [rbp - 0x70]
call fcn.180003104
nop
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
cmp rcx, rax
je 0x18005b396
call fcn.1800a89bc
mov edx, 1
lea rcx, [rbp + 0x90]
call fcn.18000f948
nop
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rsi
mov byte [rsp + 0x70], r15b
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
add rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
lea r8, [rsp + 0x70]
call fcn.18004a3d8
lea rdx, str.aol:__waol.exe__cs_title
lea rcx, [rbp + 0x90]
call fcn.180003484
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rax
call fcn.180003dc4
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x98]
call fcn.18000b4c4
mov rdx, qword [rsp + 0x58]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x18005b461
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x18005b45c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bd97
call fcn.18009d1f4
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rbp + 0x80]
movups xmmword [rsp + 0x50], xmm1
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18005b4ae
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x18005b4a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bd9d
call fcn.18009d1f4
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rsi
mov byte [rsp + 0x70], r15b
lea rcx, [rbp + 0x118]
call fcn.18000f874
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.18009c330
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18005b51a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x18005b515
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bda3
call fcn.18009d1f4
lea r14, [0x180108460]
mov qword [rsp + 0x70], r14
mov rcx, r14
call fcn.180007dac
mov byte [rsp + 0x78], 1
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rsi, rax
ja 0x18005b57f
mov rbx, r12
cmp rax, 0x10
cmovae rbx, qword [0x1801012d0]
mov qword [0x1801012e0], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.18009fc20
mov byte [rsi + rbx], r15b
jmp 0x18005b58d
mov r8b, r15b
mov rdx, rsi
mov rcx, r12
call fcn.180003a38
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r12, qword [0x1801012d0]
mov r8d, 0x823
mov rdx, r12
lea rcx, [rbp + 0x180]
call fcn.1800a8850
mov rcx, r14
call fcn.180007dc4
mov sil, 1
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18005b606
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b600
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bda9
call fcn.18009d1f4
nop
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x18005b61f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x1238]
test rcx, rcx
je 0x18005b631
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18005b642
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x1240]
test rcx, rcx
je 0x18005b655
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rbx, qword [rbp + 0x1248]
test rbx, rbx
je 0x18005b66b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x18005b67e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
test sil, sil
jne 0x18005bc5e
test r13, r13
je 0x18005bc5e
mov rsi, r13
mov r14d, 0x50
mov rcx, r13
jmp 0x18005b6b2
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
test rax, rax
je 0x18005b6c5
mov rcx, rax
mov r8d, r14d
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
mov ebx, eax
jle 0x18005b69e
mov rcx, r13
call fcn.18004a1ec
test al, al
je 0x18005b702
movsd xmm0, qword [str.Read_Email]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x1800d4108]
mov word [rbp - 0x18], ax
mov al, byte [0x1800d410a]
mov byte [rbp - 0x16], al
lea rax, [rbp - 0x20]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], r15b
jne 0x18005b6f9
test ebx, ebx
je 0x18005bc5e
mov byte [rbp + 0x2f], r15b
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x40], r15b
lea rax, [rbp - 0x20]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x18005b72b
lea rcx, [rsp + 0x40]
cmp rdi, rsi
ja 0x18005b756
mov qword [rsp + 0x50], rdi
mov r8, rdi
lea rdx, [rbp - 0x20]
call fcn.18009fc20
mov byte [rsp + rdi + 0x40], r15b
jmp 0x18005b766
lea r9, [rbp - 0x20]
mov r8b, r15b
mov rdx, rdi
call fcn.180003a38
nop
lea rcx, [rsp + 0x40]
call fcn.180049c78
mov edx, 1
lea rcx, [rbp + 0x90]
call fcn.18000f948
nop
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rsi
mov byte [rbp - 0x70], r15b
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
add rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
lea r8, [rbp - 0x70]
call fcn.18004a3d8
lea rdx, str.aol:__waol.exe__cs_title
lea rcx, [rbp + 0x90]
call fcn.180003484
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, rax
call fcn.180003dc4
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x98]
call fcn.18000b4c4
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov r8d, 0x823
lea rcx, [rbp + 0x180]
call fcn.1800a8850
mov rdx, qword [rbp - 0x78]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x18005b863
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x18005b85d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bdaf
call fcn.18009d1f4
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18005b89a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x18005b895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bdb5
call fcn.18009d1f4
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rsi
mov byte [rbp - 0x70], r15b
lea rcx, [rbp + 0x118]
call fcn.18000f874
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.18009c330
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18005bc5e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x18005b906
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005bdbb
call fcn.18009d1f4
jmp 0x18005bc5e
cmp byte [rbp + 0x180], r15b
jne 0x18005bc5e
call sym.OSMIMHK.DLL_ConfigBrowsers
test al, al
jne 0x18005bc5e
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x18005bc5e
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1800d3f60]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1800d40b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18005bc47
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1230]
call qword [rax + 0x38]
test eax, eax
js 0x18005bc47
mov ebx, r15d
cmp dword [rbp + 0x1230], r15d
jle 0x18005bc47
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x48], ebx
mov qword [rbp + 0x1248], r15
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x70], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rbp - 0x80], xmm1
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0x1248]
lea rdx, [rsp + 0x70]
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x1248]
test eax, eax
js 0x18005ba3f
test rcx, rcx
je 0x18005ba3f
mov qword [rbp + 0x1238], r15
mov rax, qword [rcx]
lea r8, [rbp + 0x1238]
lea rdx, [0x1800d3828]
call qword [rax]
test eax, eax
js 0x18005ba23
mov rcx, qword [rbp + 0x1238]
test rcx, rcx
je 0x18005ba2a
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + pe_nt_image_headers64]
test eax, eax
js 0x18005ba23
cmp qword [rbp - 0x30], r13
je 0x18005ba69
mov rcx, qword [rbp + 0x1238]
test rcx, rcx
je 0x18005ba36
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x1248]
jmp 0x18005ba3f
test rcx, rcx
je 0x18005ba4b
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc ebx
cmp ebx, dword [rbp + 0x1230]
jge 0x18005bc47
jmp 0x18005b995
mov qword [rbp + 0x1240], r15
mov rcx, qword [rbp + 0x1238]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1240]
call qword [rax + 0xf0]
test eax, eax
js 0x18005bc08
mov rcx, qword [rbp + 0x1240]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x18005bc08
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call fcn.180007dac
mov byte [rsp + 0x78], 1
mov r14, qword [rbp + 0x1240]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
test r14, r14
jne 0x18005bad6
mov rdx, r15
mov qword [rbp - 0x20], rdx
jmp 0x18005bbbf
inc rdi
cmp word [r14 + rdi*2], r15w
jne 0x18005bad6
inc edi
lea ebx, [rdi*4]
mov esi, 0x80
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.18000e834
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
lea r13d, [rsi - 0x7d]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, r15d
test eax, eax
sete bl
test eax, eax
jne 0x18005bbac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18005bbac
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov r9d, esi
lea r8, [rbp - 0x18]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.18000e834
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, r15d
test eax, eax
sete bl
test ebx, ebx
jne 0x18005bd3f
mov rdx, qword [rbp - 0x20]
lea rsi, [0x180108460]
mov rcx, r12
call fcn.180003104
nop
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
cmp rcx, rax
je 0x18005bbda
call fcn.1800a89bc
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r12, qword [0x1801012d0]
mov r8d, 0x823
mov rdx, r12
lea rcx, [rbp + 0x180]
call fcn.1800a8850
mov rcx, rsi
call fcn.180007dc4
nop
mov rcx, qword [rbp + 0x1240]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp + 0x1238]
test rcx, rcx
je 0x18005bc29
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x1248]
test rcx, rcx
je 0x18005bc3c
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18005bc5e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
cmp byte [0x18010a364], r15b
je 0x18005bcbd
lea rcx, [rbp + 0x1230]
call fcn.18005a9e0
cmp byte [rax + 0x3a], r15b
je 0x18005bca9
mov r9, r15
movabs r15, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r15
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3a
jb 0x18005bc86
xor r15d, r15d
mov byte [rax + 0x3a], r15b
lea r8, [rbp + 0x180]
mov rdx, rax
mov ecx, 3
call fcn.18006a848
mov esi, 0x824
lea rdi, [0x180109220]
cmp byte [rbp + 0x180], r15b
je 0x18005bd16
lea rbx, [0x180108510]
mov qword [rsp + 0x70], rbx
mov rcx, rbx
call fcn.180007dac
mov byte [rsp + 0x78], 1
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.1800a02d0
mov r8d, 0x823
lea rdx, [rbp + 0x180]
mov rcx, rdi
call fcn.1800a8850
mov rcx, rbx
call fcn.180007dc4
nop
mov r8d, 0x823
mov rdx, rdi
lea rcx, [0x180108580]
call fcn.1800a8850
add rsp, 0x12e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, esi
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
call fcn.18000e6e8
call fcn.18004b03c
nop
mov r8d, esi
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
call fcn.18000e6e8
call fcn.18004b03c
nop
mov r8d, esi
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
call fcn.18000e6e8
call fcn.18004b03c
int3
mov r8d, esi
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
call fcn.18000e6e8
call fcn.18004b03c
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3