Function at 0x18001559c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x18004fa38]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rax, qword [rbp + 0x470]
mov r15d, 0x920ee697
mov qword [rbp], rax
movabs r13, 0xc8b9d252e1d5e
movsx rax, byte [0x18004f58e]
mov r11d, 1
mov qword [rbp - 0x70], rax
mov qword [rbp + 0x20], r9
movsxd r9, dword [0x18004f654]
mov eax, dword [0x18004f634]
mov word [rsp + 0x54], ax
mov rax, qword [0x18004f600]
mov dword [rbp - 0x68], eax
movabs rax, 0xe50c503a1ee80
movsx r12, word [0x18004f650]
movsx esi, word [0x18004f648]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x64], 0x90
mov dword [rsp + 0x58], 0xee
mov byte [rsp + 0x51], 0x28
movzx eax, word [0x18004f630]
mov dword [rbp - 0x64], eax
movsxd rax, dword [0x18004f54c]
mov qword [rbp - 0x58], rax
mov eax, dword [0x18004f62c]
mov r10d, dword [0x18004f54c]
mov byte [rsp + 0x50], al
mov rax, qword [0x18004f658]
mov dword [rsp + 0x60], eax
mov qword [rbp - 0x30], 0x50
mov byte [rsp + 0x51], 0x7b
mov word [rsp + 0x54], ax
mov qword [rbp - 0x30], 0x7f
mov eax, dword [0x18004f654]
mov byte [rsp + 0x51], al
mov eax, 0xffffa4f5
mov word [rsp + 0x54], ax
mov rax, qword [0x18004f620]
mov qword [rbp - 0x30], rax
mov al, byte [0x18004f537]
movsx eax, word [0x18004f66c]
mov dword [rbp - 0x60], eax
movsx rax, word [0x18004f650]
mov qword [rbp - 0x30], rax
mov byte [rsp + 0x51], 0xbe
movsx eax, byte [0x18004f535]
mov dword [rbp - 0x60], eax
mov eax, 0x62d7
mov word [rsp + 0x54], ax
movsx eax, byte [0x18004f537]
mov word [rsp + 0x54], ax
mov eax, dword [0x18004f62c]
mov byte [rsp + 0x51], al
mov rax, qword [0x18004f610]
mov qword [rbp - 0x30], rax
mov eax, dword [0x1809e7d20]
mov dword [rsp + 0x54], eax
mov eax, 0xca69
mov word [0x18004f630], ax
mov qword [rbp - 0x28], rcx
movsxd rcx, dword [0x18004f62c]
mov rax, qword [rsp + 0x78]
not rax
mov dword [rsp + 0x5c], r10d
add rax, rcx
mov qword [rbp + 0x28], r8
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x54]
add eax, 0x3a06
mov qword [rbp - 0x18], rdx
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x54]
add eax, 0x7179
mov dword [rbp - 0x80], r9d
mov dword [rbp - 0x7c], eax
mov eax, dword [rsp + 0x54]
add eax, 0xd9
mov dword [rbp - 0x40], 0xd6e7
mov dword [rbp - 0x60], eax
xor r10d, r10d
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x1800157fa
mov eax, dword [rsp + 0x60]
mov edx, r10d
mov rcx, qword [0x18004f600]
mov r8b, r9b
sub rcx, rax
mov dword [rsp + 0x5c], r11d
mov al, byte [rsp + 0x50]
test al, al
mov al, byte [rsp + 0x50]
cmove rdx, rcx
mov ecx, dword [0x18004f644]
sub r8b, al
test rdx, rdx
not r8b
sete al
add r8b, al
test ecx, ecx
sete al
add ecx, 0x8ad55b2
add al, r8b
mov dword [0x18004f644], ecx
mov byte [0x18004f535], al
movsxd rax, dword [0x18004f62c]
mov rdx, qword [rsp + 0x78]
imul rdx, rax
mov rax, qword [rsp + 0x78]
add rax, rdx
mov qword [rsp + 0x78], rax
jmp 0x180015800
mov al, byte [0x18004f5b6]
mov ecx, dword [rbp - 0x7c]
mov edx, r10d
movsx eax, byte [0x18004f563]
mov r8d, 0xc0
sub r8d, eax
mov eax, dword [rbp - 0x7c]
or ecx, eax
mov eax, 0x736a
xor ecx, 0x36
sub eax, ecx
mov ecx, r10d
mov dword [rbp - 0x3c], eax
mov al, byte [rsp + 0x50]
cmp al, byte [0x18004f536]
mov al, byte [rsp + 0x50]
setg dl
cmp al, 0x51
setg cl
cmp edx, ecx
jne 0x18001585b
movzx eax, word [0x18004f650]
sub ax, 0x15
mov word [0x18004f638], ax
mov dword [rbp - 0x64], r11d
mov eax, dword [0x1809e7d20]
lea edi, [rsi - 0x4277]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
add eax, 0x24
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x54]
add eax, 0x7f81
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x54]
add eax, 0x52d0
mov dword [rbp - 0x78], eax
mov ecx, dword [rbp - 0x78]
mov eax, dword [rsp + 0x70]
or ecx, eax
sub ecx, 0x7f09
mov dword [rbp - 0x38], ecx
mov ecx, 0x334b
mov eax, dword [rsp + 0x60]
sub ax, cx
mov word [rsp + 0x54], ax
mov eax, dword [0x1809e7d20]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
add eax, 0xba85
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x60]
add eax, 0xd294
mov dword [rsp + 0x68], eax
movzx ecx, word [0x18004f638]
mov eax, dword [rsp + 0x58]
not ecx
cmp eax, ecx
jne 0x180015942
mov ecx, dword [0x18004f54c]
mov eax, r8d
not ecx
not eax
cmp eax, ecx
mov rdx, r10
movsxd rcx, dword [0x18004f62c]
mov rax, qword [0x18004f610]
setl dl
add rdx, 0xfffffffffffffffe
sub rcx, rax
cmp rdx, rcx
jg 0x180015926
mov eax, dword [rbp - 0x68]
xor rax, 0x5e02
mov qword [0x18004f648], rax
jmp 0x180015942
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x180015942
movsx eax, byte [0x18004f563]
add ax, 0x6e
mov word [0x18004f630], ax
mov eax, dword [rsp + 0x60]
mov rcx, r11
add eax, 0x94f4
mov dword [rbp - 0x78], eax
mov byte [rsp + 0x50], r10b
movsx rax, r9w
sub rcx, rax
mov rax, qword [0x18004f5f8]
imul rax, rcx
mov qword [0x18004f5f8], rax
mov al, byte [rsp + 0x50]
mov eax, dword [0x1809e7d20]
mov qword [rbp - 0x70], rax
mov eax, dword [rsp + 0x58]
shl ax, 6
mov word [0x18004f66c], ax
mov eax, edi
sar eax, 7
mov word [0x18004f638], ax
mov eax, dword [rbp - 0x78]
mov ecx, dword [rsp + 0x68]
mov edx, dword [rsp + 0x68]
sub ecx, eax
mov eax, dword [rsp + 0x68]
sub edx, eax
imul edx, ecx
mov eax, r10d
mov ecx, r10d
xor edx, 0x145
cmp si, r9w
mov dword [rbp + 8], edx
setge cl
cmp esi, 0xf
setge al
cmp ecx, eax
ja 0x1800159de
movsx eax, byte [0x18004f54b]
mov word [0x180b1d02c], ax
jmp 0x1800159f2
mov eax, dword [rsp + 0x58]
not eax
add eax, r8d
mov dword [rsp + 0x64], eax
mov byte [0x18004f5b6], 0xd1
mov eax, dword [0x1809e7d20]
mov edx, r10d
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, 0x13d
mov qword [rbp - 0x10], r10
mov dword [rbp - 0x20], eax
mov eax, dword [rsp + 0x68]
add eax, 0x363
mov dword [rbp - 0x7c], eax
movzx eax, word [rsp + 0x54]
mov word [0x18004f638], ax
mov eax, dword [rsp + 0x68]
add eax, 0x24a
mov dword [rsp + 0x70], eax
mov cl, byte [0x18004f537]
mov al, byte [0x18004f537]
add cl, 0x5e
or cl, al
mov byte [0x18004f537], cl
mov eax, dword [0x18004f62c]
movzx ecx, word [0x18004f61c]
mov dword [rbp - 0x60], eax
mov rax, qword [rsp + 0x78]
cmp rax, rcx
mov rax, qword [rsp + 0x78]
mov ecx, r10d
setne dl
cmp rax, 0x4e
setne cl
cmp edx, ecx
jne 0x180015b30
mov eax, dword [0x18004f634]
mov rcx, r10
test eax, eax
mov rax, qword [0x18004f610]
sete cl
cmp rax, rcx
jg 0x180015aa9
movsx eax, byte [0x18004f58f]
mov r8d, r10d
cmp dword [0x18004f54c], eax
jge 0x180015aac
mov r8d, r11d
mov ecx, dword [0x18004f654]
mov edx, r10d
mov eax, dword [rsp + 0x64]
cmp ecx, eax
movsx ecx, byte [rsp + 0x50]
mov eax, r10d
seta dl
not ecx
cmp edx, ecx
setne al
add eax, r8d
jne 0x180015afc
mov eax, dword [0x18004f654]
mov rdx, qword [0x18004f608]
mov rax, qword [0x18004f608]
add rdx, rax
mov rax, qword [0x18004f608]
and rax, rdx
mov qword [0x18004f608], rax
jmp 0x180015b30
movsx rax, byte [0x18004f58f]
movabs rcx, 0x646e28f46a31c
imul rax, rcx
mov ecx, dword [0x18004f564]
mov qword [rsp + 0x78], rax
not ecx
mov rax, qword [rbp - 0x70]
not ax
or ax, cx
mov word [0x18004f66c], ax
mov dword [0x18004f634], 0x78313fb1
mov rbx, r10
movsx ecx, byte [rsp + 0x50]
mov edx, dword [rbp - 0x64]
not ecx
mov eax, dword [0x18004f62c]
add edx, ecx
movsx r8d, word [0x18004f650]
test eax, eax
mov rax, qword [rbp - 0x70]
not edx
mov ecx, r10d
mov qword [rbp + 0x10], r10
sete cl
movsxd r14, edi
sub edx, ecx
mov dword [rbp - 0x78], r10d
movsxd rdx, edx
sub r8d, 0x6df11969
sub r8, rdx
movsx ecx, r14b
movsx edx, al
imul edx, ecx
mov qword [rbp - 0x48], r10
mov qword [rbp - 0x30], r10
mov qword [rsp + 0x68], r10
add dl, r8b
mov byte [rsp + 0x51], dl
mov eax, dword [rbp - 0x64]
add ax, 0x66
mov word [0x18004f640], ax
movzx eax, word [0x18004f61c]
sub ax, r11w
mov word [0x18004f61c], ax
mov ecx, dword [0x18004f63c]
mov eax, dword [0x18004f634]
imul ecx, eax
mov eax, dword [0x18004f63c]
add eax, ecx
mov dword [0x18004f63c], eax
mov al, byte [0x18004f535]
cmp byte [0x18004f58f], r11b
jle 0x180015bf7
mov al, byte [0x180b29b44]
mov byte [0x18004f536], al
jmp 0x180015c09
mov al, byte [rsp + 0x50]
mov r15d, dword [0x18004f620]
add r15d, 0x4f5772ec
mov rcx, qword [rbp - 0x70]
movzx eax, word [0x18004f668]
add ecx, eax
mov dword [rsp + 0x60], ecx
mov rax, qword [rbp - 0x70]
add eax, 0x7ef12e2
mov dword [0x18004f63c], eax
movzx eax, word [0x18004f630]
mov eax, dword [rsp + 0x64]
mov rax, r10
mov dword [rbp + 0x60], 0x1f6e6d3b
mov dword [rbp + 0x64], 0x646c606d
mov word [rbp + 0x68], 0x3d
add byte [rbp + rax + 0x60], r11b
add rax, r11
cmp rax, 9
jb 0x180015c4b
lea rax, [rbp + 0x60]
mov qword [rbp - 8], r10
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0xa0]
mov al, byte [0x18004f5b6]
add al, byte [0x18004f644]
movups xmm0, xmmword [0x1800389e8]
mov qword [rbp - 0x50], r10
movups xmm1, xmmword [0x1800389f8]
mov byte [0x18004f5b6], al
mov eax, dword [0x180038a08]
mov dword [rbp + 0xc0], eax
movzx eax, word [0x180038a0c]
mov word [rbp + 0xc4], ax
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r9d, r9d
mov dword [rbp - 0x68], eax
cmp qword [0x18004f648], r9
je 0x180015ceb
movsx eax, word [0x18004f618]
mov ecx, eax
test ax, ax
jne 0x180015ce2
movsx ecx, byte [0x18004f535]
movsxd rax, ecx
mov qword [rbp - 0x70], rax
jmp 0x180015d1b
mov ecx, dword [0x18004f564]
movabs rax, 0xfff37462dad1e2a1
not ecx
imul rcx, rax
mov rax, qword [0x18004f600]
cmp rax, rcx
je 0x180015d1b
movsx ecx, word [rsp + 0x54]
xor ecx, 0xe26e7742
mov dword [rbp - 0x68], ecx
cmp qword [rbp - 0x28], 0xffffffffffffffff
mov rax, qword [rbp]
mov dword [rax], r9d
je 0x180016129
mov eax, dword [0x1809e7d20]
mov dword [rsp + 0x68], eax
mov ecx, dword [rsp + 0x68]
mov eax, dword [rbp - 0x3c]
add ecx, eax
mov dword [rbp - 0x3c], ecx
mov byte [0x18004f535], 3
mov eax, dword [0x18004f634]
mov ecx, dword [0x18004f634]
add eax, 0xfffff8f1
add ecx, eax
movsx rax, word [0x18004f628]
mov dword [0x18004f634], ecx
mov rcx, qword [rsp + 0x78]
add cx, ax
mov word [0x18004f61c], cx
movsx eax, byte [0x18004f535]
mov ecx, eax
test al, al
je 0x180015dd3
sub ecx, 1
je 0x180015dc9
sub ecx, 1
je 0x180015da9
cmp ecx, 1
jne 0x180015dd3
movsx ecx, byte [0x18004f537]
mov eax, dword [rsp + 0x60]
add eax, ecx
mov dword [rsp + 0x60], eax
jmp 0x180015dd3
movsx ecx, byte [0x18004f54b]
mov esi, 0xcb
movsx eax, byte [0x18004f536]
add esi, r15d
not eax
imul eax, ecx
movsxd r13, eax
jmp 0x180015dd3
mov rdi, qword [rbp - 0x58]
mov r15d, 0x903f106f
mov ecx, dword [rsp + 0x68]
mov eax, dword [rbp - 0x38]
add ecx, eax
mov r14d, dword [0x18004f660]
mov dword [rbp - 0x38], ecx
add r14d, 0xdfe27b3b
movzx eax, word [0x18004f66c]
movzx ecx, word [0x18004f640]
add cx, cx
sub cx, ax
mov eax, dword [rsp + 0x68]
add eax, 0xe1
mov word [0x18004f640], cx
mov dword [rsp + 0x68], eax
mov edx, dword [rsp + 0x68]
mov eax, dword [rbp - 0x3c]
sub edx, eax
mov ecx, dword [rsp + 0x68]
mov eax, dword [rbp + 8]
sub ecx, eax
mov eax, dword [rbp - 0x38]
or ecx, edx
cmp eax, ecx
je 0x18001611c
movsxd rax, edi
mov ecx, r9d
cmp qword [0x18004f620], rax
mov eax, r9d
setne cl
cmp dword [0x18004f5cc], 0x6809
sete al
cmp eax, ecx
jbe 0x180015f2c
mov cl, byte [0x18004f537]
mov al, byte [rsp + 0x51]
cmp al, cl
jle 0x180015eb6
mov edx, dword [0x18004f654]
mov ecx, r9d
mov ebx, dword [rsp + 0x5c]
test ebx, ebx
movsx rax, r12b
sete cl
add edx, ecx
mov ecx, dword [rbp - 0x64]
sub rdx, qword [0x18004f648]
add rdx, rax
mov eax, dword [rsp + 0x58]
mov r13, qword [0x18004f610]
add eax, ecx
not rdx
sub rdx, rax
mov al, byte [0x18004f618]
add r13, rdx
add byte [0x18004f58f], al
jmp 0x180015f3f
test r12b, r12b
je 0x180015ec2
mov edx, 0x52
jmp 0x180015eed
mov al, byte [0x18004f537]
mov edx, 0x70f
test al, al
jne 0x180015ef3
movsx eax, byte [0x18004f535]
imul eax, eax, 0x34
mov byte [0x18004f563], al
movsx eax, si
sub eax, 0x15970271
mov dword [rsp + 0x64], eax
mov ebx, dword [rsp + 0x5c]
jmp 0x180015f44
mov ebx, dword [rsp + 0x5c]
mov eax, r9d
mov ecx, 1
cmp cx, word [0x18004f628]
setg al
cmp eax, r15d
jne 0x180015f44
mov qword [rsp + 0x78], 0x5241e8f8
movzx ecx, word [0x18004f638]
sub ecx, 0xc9
mov dword [0x18004f54c], ecx
jmp 0x180015f44
mov rax, qword [0x18004f610]
mov ebx, dword [rsp + 0x5c]
add rax, 0x35
mov qword [rbp - 0x58], rax
mov edx, 0x70f
mov rcx, r9
movsx eax, si
cmp eax, edx
setne cl
cmp rcx, qword [0x18004f660]
je 0x180015f86
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x180015f86
mov esi, dword [rbp - 0x80]
mov eax, 0x5445
add eax, esi
mov word [0x18004f650], ax
mov eax, 0x26fe
movsx ecx, byte [rsp + 0x50]
sub cx, ax
mov word [rsp + 0x54], cx
jmp 0x180015fac
mov rax, qword [rbp - 0x70]
not rax
test rax, rax
je 0x180015fa9
mov eax, dword [rsp + 0x60]
test eax, eax
mov rax, qword [0x18004f648]
jne 0x180015fa5
mov eax, dword [rsp + 0x58]
mov qword [rbp - 0x70], rax
mov esi, dword [rbp - 0x80]
mov r12d, 0x400
mov edx, 1
mov ecx, r12d
call fcn.18002edf4
and qword [rsp + 0x40], 0
mov r15, rax
and qword [rsp + 0x38], 0
mov r9, r15
and qword [rsp + 0x30], 0
mov rdx, qword [rbp - 0x28]
mov rcx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r12, qword [rbp - 0x18]
mov r8, r12
call fcn.1800152bc
xor r8d, r8d
cmp byte [0x18004f58f], r8b
je 0x180016041
mov rax, qword [0x18004f608]
lea ecx, [r8 + 0x56]
add eax, 0xffffff31
add dword [rsp + 0x5c], eax
mov rax, qword [0x18004f610]
sub cl, al
movzx eax, word [0x18004f630]
sub cl, al
movzx eax, word [rsp + 0x54]
add al, cl
mov byte [0x18004f536], al
jmp 0x18001608c
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x18001608c
movzx eax, word [0x18004f668]
xor edi, r14d
imul rcx, rax, 0xea
mov qword [rbp - 0x70], rcx
movsx edx, byte [0x18004f537]
mov al, byte [0x18004f5b6]
inc edx
add edx, ebx
imul edx, edi
test al, al
sete cl
test r14d, r14d
sete al
not edx
add cl, 0x19
add cl, al
add cl, sil
add cl, dl
mov byte [rsp + 0x50], cl
movsxd rbx, dword [r15 + 0x3c]
lea rcx, [fcn.18002edf4]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov edx, dword [rbx + r15 + 0x50]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea r8d, [r9 + 1]
call fcn.1800152bc
and qword [rsp + 0x40], 0
lea rcx, [rbp + 0x10]
and qword [rsp + 0x38], 0
mov rdi, rax
and qword [rsp + 0x30], 0
mov r9, rdi
mov rdx, qword [rbp - 0x28]
mov r8, r12
mov qword [rsp + 0x28], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp - 0x48], rax
mov eax, dword [rbx + r15 + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1800152bc
mov rax, qword [rbp - 0x58]
and eax, 0x4488
mov qword [0x18004f648], rax
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
jmp 0x18001611f
mov rdi, rbx
mov qword [rsp + 0x68], rdi
jmp 0x1800161ba
mov ecx, dword [rsp + 0x64]
mov r8, qword [rbp - 0x18]
mov rax, qword [0x18004f608]
mov rdi, r8
mov qword [rbp - 0x48], r8
cmp rax, rcx
jbe 0x180016161
mov ecx, dword [rsp + 0x64]
mov rax, qword [rbp - 0x70]
cmp rcx, rax
je 0x180016161
mov al, byte [0x18004f5b6]
and al, 1
mov byte [0x18004f563], al
jmp 0x1800161b3
mov ecx, dword [rsp + 0x58]
mov rdx, r9
mov rax, qword [rbp - 0x58]
cmp rax, rcx
movabs rax, 0x3f0217dadfc85
setne dl
sub rdx, r14
cmp rdx, rax
je 0x18001619c
mov eax, dword [0x1809e7d20]
mov qword [rbp - 0x58], rax
mov eax, 0x7fc1
mov word [0x18004f638], ax
jmp 0x1800161b3
movsx eax, r12b
not eax
test eax, eax
je 0x1800161b3
mov rax, qword [0x18004f600]
mov byte [0x180b29b45], al
movsxd rbx, dword [r8 + 0x3c]
add rbx, r8
mov ecx, dword [rsp + 0x70]
xor r15d, r15d
mov eax, dword [rbp - 0x7c]
or ecx, eax
mov edx, dword [rbp - 0x7c]
mov eax, dword [rbp - 0x20]
add edx, eax
mov eax, dword [rsp + 0x70]
and edx, ecx
mov ecx, dword [rbp - 0x7c]
sub ecx, eax
cmp ecx, edx
je 0x180016a2d
movsx r8d, byte [rsp + 0x50]
mov ecx, 0x4b6c
movsx eax, byte [0x18004f58e]
mov edx, r15d
add ax, cx
movsx esi, ax
movzx eax, word [0x18004f61c]
cmp r8d, esi
movsx r8d, byte [0x18004f537]
mov r9d, esi
cmove edx, eax
imul r8d, edx
cmp dword [rbx + 0x88], r15d
je 0x180016a30
mov ecx, dword [0x18004f564]
add ecx, 0xffffff9e
mov dword [rsp + 0x58], 4
mov eax, dword [rsp + 0x64]
mov eax, dword [rsp + 0x58]
dec eax
mov qword [0x18004f620], rcx
sub eax, 1
je 0x180016270
cmp eax, 2
jne 0x18001627d
movsx rcx, byte [0x18004f5b6]
and rcx, qword [0x18004f620]
mov al, byte [0x18004f5b6]
add al, cl
mov byte [0x18004f5b6], al
jmp 0x18001627d
movsxd rax, dword [rbp - 0x60]
sub r13, rax
mov eax, dword [0x18004f63c]
mov r12d, dword [rbx + 0x88]
neg r8w
mov eax, dword [0x18004f63c]
add r12, rdi
mov word [0x18004f640], r8w
mov r8d, dword [r12 + 0x1c]
add r8, rdi
mov qword [rbp - 0x20], r8
test eax, eax
je 0x1800162b1
movzx r9d, word [0x18004f630]
movzx eax, word [0x1809e7d20]
mov dword [rsp + 0x58], r9d
mov r9d, dword [r12 + 0x20]
mov word [0x18004f630], ax
add r9, rdi
mov ebx, dword [r12 + 0x24]
lea rax, [r13 - 0x20642fa3]
add rbx, rdi
mov qword [rbp + 8], r9
mov r13d, r15d
mov qword [rbp - 0x60], rbx
mov dword [rsp + 0x70], 0x82
mov qword [rsp + 0x78], rax
cmp dword [r12 + 0x18], r15d
jbe 0x180016a30
mov esi, 0xffffcd29
mov dword [rbp - 0x80], esi
movsx rcx, word [0x18004f650]
mov rax, qword [0x18004f648]
mov r14d, r13d
lea rdx, [rax + rax]
add rcx, rdx
mov qword [0x18004f648], rcx
movzx eax, word [rbx + r14*2]
mov r15d, dword [r8 + rax*4]
add r15, rdi
cmp r13d, dword [r12 + 0x18]
jae 0x1800163c1
movsx eax, byte [rsp + 0x50]
mov dword [rsp + 0x64], eax
movsx rax, byte [0x18004f54b]
cmp dword [0x18004f644], 0
mov qword [0x18004f5f8], rax
je 0x18001638f
mov ecx, dword [0x18004f63c]
mov eax, dword [0x18004f63c]
cmp ecx, eax
jle 0x1800163b6
mov rax, qword [0x18004f608]
sub eax, 0xee99
mov dword [0x18004f5cc], eax
movsx eax, byte [0x18004f537]
mov dword [0x180a14aac], eax
jmp 0x1800163b6
mov ecx, dword [0x18004f654]
mov eax, dword [rbp - 0x68]
sub ecx, eax
mov eax, dword [0x18004f654]
add eax, ecx
mov dword [0x18004f654], eax
movsx eax, byte [rsp + 0x50]
imul eax, eax, 0x25
mov byte [0x18004f58e], al
mov eax, dword [r9 + r14*4]
add rax, rdi
mov qword [rbp + 0x18], rax
lea rdx, [rbp - 8]
mov rcx, r15
call fcn.1800192b8
mov esi, eax
cmp eax, 1
jbe 0x180016a14
call fcn.18001cf4c
mov rdi, rax
mov qword [rbp - 0x50], rax
xor eax, eax
lea rcx, [fcn.18002d990]
mov qword [rsp + 0x40], rax
mov r9d, 0x104
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rdx, [rdi + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.1800152bc
mov r8, qword [rbp + 0x18]
lea rdx, [rdi + 0x18]
xor eax, eax
lea rcx, [0x18002ec90]
mov qword [rsp + 0x40], rax
mov r9d, 0x103
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.1800152bc
mov rax, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x20]
mov qword [rdi], rax
movzx eax, word [rbx + r14*2]
mov word [rdi + 8], ax
movzx eax, word [rbx + r14*2]
mov r14, qword [rbp - 0x18]
mov ecx, dword [rcx + rax*4]
add rcx, r14
mov qword [rdi + 0x10], rcx
cmp esi, 2
jne 0x18001651b
movzx ecx, word [0x18004f638]
mov eax, dword [rsp + 0x58]
cmp eax, ecx
jbe 0x1800164d8
movsx ecx, byte [0x18004f535]
xor edx, edx
movzx eax, word [0x18004f650]
cmp cx, ax
mov al, byte [0x18004f535]
sete dl
xor ecx, ecx
cmp al, 0x34
sete cl
cmp edx, ecx
ja 0x1800164c6
mov eax, dword [0x18004f660]
add eax, 0x4a
mov dword [rsp + 0x64], eax
jmp 0x180016502
mov eax, dword [rbp - 0x64]
mov ecx, 0xffffa3a9
sub ecx, eax
add dword [0x18004f5cc], ecx
jmp 0x180016502
movzx eax, word [0x18004f630]
cmp qword [0x18004f660], 0
movsx rcx, word [rsp + 0x54]
jne 0x1800164f3
mov rcx, qword [rbp - 0x70]
mov dword [0x18004f654], ecx
mov qword [rsp + 0x78], 0x2a5d
mov rcx, qword [rbp - 8]
movsxd rax, dword [rcx + r15]
add rcx, 4
add rax, qword [rdi + 0x10]
mov rdi, qword [rbp - 0x50]
add rcx, rax
jmp 0x18001655b
cmp esi, 3
jne 0x180016567
movsd xmm0, qword [str.DisplayName]
lea rcx, [rbp + 0x90]
mov eax, dword [0x180038a18]
movsd qword [rbp + 0x90], xmm0
mov dword [rbp + 0x98], eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [0x18004f638], ax
mov rcx, qword [rdi + 0x10]
mov rax, qword [rbp - 8]
mov ecx, dword [rcx + rax]
mov qword [rdi + 0x220], rcx
jmp 0x180016655
mov edx, 4
cmp esi, edx
jne 0x180016655
movsx ecx, byte [0x18004f535]
mov eax, dword [rsp + 0x58]
cmp ecx, eax
jae 0x18001662c
mov word [rsp + 0x54], dx
movzx eax, word [0x18004f61c]
movsx edx, byte [0x18004f58e]
sub edx, eax
movzx eax, word [0x18004f61c]
add ax, dx
mov word [0x18004f61c], ax
movsx eax, word [rsp + 0x54]
mov ecx, eax
test eax, eax
je 0x18001661f
sub ecx, 1
je 0x1800165fb
sub ecx, 2
je 0x1800165d8
cmp ecx, 1
jne 0x18001663a
mov eax, dword [0x18004f620]
add eax, 0xff0f
mov dword [rsp + 0x5c], eax
jmp 0x18001663a
movsx ecx, byte [0x18004f535]
mov eax, dword [0x18004f63c]
imul ecx, dword [rbp - 0x40]
sub ecx, eax
mov al, byte [0x18004f537]
add al, cl
not al
mov byte [rsp + 0x50], al
jmp 0x18001663a
mov rcx, qword [0x18004f600]
sub rcx, qword [0x18004f648]
mov rax, qword [0x18004f600]
dec dword [rbp - 0x40]
sub rcx, rax
mov qword [0x18004f600], rcx
jmp 0x18001663a
mov eax, dword [rsp + 0x5c]
shl eax, 8
mov dword [rsp + 0x70], eax
jmp 0x18001663a
mov al, byte [0x18004f668]
add al, 0xc
mov byte [0x18004f563], al
mov rdx, qword [rdi + 0x10]
mov rax, qword [rbp - 8]
mov rdi, qword [rbp - 0x50]
mov ecx, dword [rdx + rax]
mov rax, qword [rcx + rdx + 6]
mov qword [rdi + 0x220], rax
mov rdx, qword [rdi + 0x220]
lea r8, [rbp + 0x30]
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea r9d, [r15 + 0x30]
mov qword [rsp + 0x20], r15
call fcn.1800152bc
test rax, rax
jne 0x1800166e5
mov rsi, qword [rbp - 0x10]
cmp rsi, qword [rbp + 0x20]
jae 0x1800166c1
mov rax, qword [rbp + 0x28]
movsx ecx, word [rsp + 0x54]
mov qword [rax + rsi*8], rdi
mov eax, dword [rsp + 0x64]
add ax, cx
mov word [rsp + 0x54], ax
lea eax, [r15 + 1]
add rsi, rax
mov qword [rbp - 0x10], rsi
jmp 0x1800166c6
mov eax, 1
mov rsi, qword [rbp]
mov dword [rbp - 0x78], 4
add dword [rsi], eax
lea rcx, [rbp - 0x50]
call fcn.180016e50
mov rdi, qword [rbp - 0x48]
jmp 0x180016a17
cmp qword [rbp + 0x38], r14
jne 0x1800166fb
mov al, byte [0x18004f660]
sub al, 0x63
mov byte [0x18004f537], al
jmp 0x1800166d3
mov qword [rsp + 0x40], r15
lea rdx, [rbp + 0x1e0]
mov qword [rsp + 0x38], r15
lea rcx, [fcn.18002d990]
mov qword [rsp + 0x30], r15
mov edi, 0x104
mov qword [rsp + 0x28], r15
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], r15
call fcn.1800152bc
mov rsi, qword [rbp - 0x28]
lea r8, [rbp + 0x1e0]
mov rcx, rsi
mov r9d, edi
mov rdx, r14
call fcn.180016fe4
mov qword [rsp + 0x40], r15
lea rdx, [rbp + 0x2f0]
mov qword [rsp + 0x38], r15
lea rcx, [fcn.18002d990]
mov qword [rsp + 0x30], r15
mov r9d, edi
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], r15
call fcn.1800152bc
mov eax, dword [0x18004f634]
lea r8, [rbp + 0x2f0]
mov rdx, qword [rbp + 0x38]
mov edi, 1
add eax, edi
mov r9d, 0x104
mov rcx, rsi
mov dword [0x18004f634], eax
call fcn.180016fe4
mov rax, r15
mov dword [rbp + 0x70], 0x94889f91
mov dword [rbp + 0x74], 0xc8c9969f
mov dword [rbp + 0x78], 0x96969ed4
mov byte [rbp + 0x7c], r15b
xor byte [rbp + rax + 0x70], 0xfa
add rax, rdi
cmp rax, 0xc
jb 0x1800167c5
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x180016848
mov dword [rbp + 0x80], 0x94889f91
mov rax, r15
mov dword [rbp + 0x84], 0x9b98969f
mov dword [rbp + 0x88], 0x9ed49f89
mov word [rbp + 0x8c], 0x9696
mov byte [rbp + 0x8e], r15b
xor byte [rbp + rax + 0x80], 0xfa
add rax, rdi
cmp rax, 0xe
jb 0x18001681a
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x1800166d3
mov qword [rsp + 0x40], r15
lea rdx, [rbp + 0xd0]
mov qword [rsp + 0x38], r15
lea rcx, [fcn.18002d990]
mov qword [rsp + 0x30], r15
mov ebx, 0x104
mov qword [rsp + 0x28], r15
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], r15
call fcn.1800152bc
mov rdx, qword [rbp + 0x38]
lea r8, [rbp + 0xd0]
mov r9d, ebx
mov rcx, rsi
call fcn.180016fe4
mov rbx, qword [rbp - 0x50]
lea r8, [rbp + 0xd0]
mov qword [rsp + 0x40], r15
lea rcx, [0x18002ec90]
mov qword [rsp + 0x38], r15
mov r9d, 0x103
mov qword [rsp + 0x30], r15
lea rdi, [rbx + 0x11c]
mov qword [rsp + 0x28], r15
mov rdx, rdi
mov qword [rsp + 0x20], r15
call fcn.1800152bc
mov qword [rsp + 0x40], r15
lea rcx, [0x18002f160]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, rdi
mov qword [rsp + 0x20], r15
call fcn.1800152bc
test rax, rax
je 0x1800169dd
mov eax, dword [rsp + 0x58]
mov ebx, 0x104
movsx rcx, word [rsp + 0x54]
mov r9d, ebx
mov rdx, qword [0x18004f660]
xor r8d, r8d
mov qword [rsp + 0x40], r15
not rdx
sub rdx, rax
mov qword [rsp + 0x38], r15
mov rax, qword [rsp + 0x78]
add al, cl
mov qword [rsp + 0x30], r15
and al, dl
mov qword [rsp + 0x28], r15
lea rdx, [rbp + 0xd0]
mov byte [0x18004f535], al
lea rcx, [fcn.18002d990]
mov qword [rsp + 0x20], r15
call fcn.1800152bc
movzx eax, word [0x18004f650]
lea r8, [rbp + 0xd0]
xor ax, word [0x18004f54c]
mov r9d, ebx
mov rdx, r14
mov word [0x18004f618], ax
mov rcx, rsi
call fcn.180016fe4
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call fcn.180016af0
test eax, eax
je 0x1800169d9
cmp dword [0x18004f644], r15d
jne 0x1800169c6
mov rcx, qword [rbp - 0x58]
movsxd rax, dword [rsp + 0x70]
sub rcx, rax
mov rax, qword [rbp - 0x58]
sub rcx, rax
mov qword [rbp - 0x58], rcx
lea rcx, [rbp - 0x50]
call fcn.180016e50
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
jmp 0x180016a17
mov rbx, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x10]
cmp rsi, qword [rbp + 0x20]
jae 0x180016a0c
mov rax, qword [rbp + 0x28]
mov ecx, 0x17d2
mov qword [rax + rsi*8], rbx
movzx eax, word [0x18004f650]
sub ax, cx
inc rsi
mov word [0x18004f638], ax
mov qword [rbp - 0x10], rsi
mov rax, qword [rbp]
inc dword [rax]
jmp 0x1800169cf
xor r15d, r15d
mov r8, qword [rbp - 0x20]
inc r13d
mov r9, qword [rbp + 8]
cmp r13d, dword [r12 + 0x18]
jb 0x180016306
mov esi, dword [rbp - 0x80]
cmp qword [rbp - 0x28], 0xffffffffffffffff
je 0x180016a96
mov rdx, qword [rbp - 0x30]
lea rcx, [fcn.18002f208]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.1800152bc
mov rdx, qword [rsp + 0x68]
lea rcx, [fcn.18002f208]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.1800152bc
test si, si
je 0x180016abc
movsx eax, byte [0x18004f58f]
add eax, 0xaf
cdqe
mov qword [0x18004f660], rax
mov eax, 0xd14f5171
mov qword [rsp + 0x78], rax
jmp 0x180016ac3
movzx ecx, word [0x18004f61c]
mov eax, dword [rbp - 0x78]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.18002c480
mov rbx, qword [rsp + 0x568]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret