Function at 0x180023cb0
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x768
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
xor r13d, r13d
mov dword [rbp + 0x6b0], r13d
mov qword [rbp + 0x6c0], r13
movups xmm0, xmmword [str.kVOKLZ]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x1801834b0]
movups xmmword [rbp + 0x78], xmm1
movsd xmm0, qword [str.__L]
movsd qword [rbp + 0x88], xmm0
movzx eax, word [0x1801834c8]
mov word [rbp + 0x90], ax
mov r8d, r13d
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp r12d, 2
jl 0x180023e49
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp + 0x68]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180023d52
cmp r8d, 0x15
jge 0x180023e97
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x15
jl 0x180023e60
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x20], rax
mov r15d, 1
mov r9d, r15d
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180023ed6
mov rcx, qword [rbp + 0x6c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180026928
mov eax, 0x22
mov word [rbp + 0x430], ax
mov dword [rbp + 0x6b8], 0x206
movups xmm0, xmmword [str.kM_ZQxFZ_]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x180183530]
mov ecx, 0x53
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x39
xor word [rsp + 0x44], 0x3a
xor word [rsp + 0x46], 0x3b
xor word [rsp + 0x48], 0x3c
xor word [rsp + 0x4a], 0x3d
xor word [rsp + 0x4c], 0x3e
xor word [rsp + 0x4e], 0x3f
xor ax, 0x40
mov word [rsp + 0x50], ax
lea rax, [rbp + 0x6b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x432]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x6c0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x6c0]
test eax, eax
jne 0x180023ecb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x430]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x180023fb0
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0xb8]
call fcn.180008fb0
nop
mov r8, r15
lea rdx, [0x18014063c]
lea rcx, [rbp + 0xb8]
call fcn.18000a7e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r14d, 8
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x180024055
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024050
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bc2
call fcn.1800d9c1c
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r13w
mov esi, reloc.WS2_32.dll_WSAStartup
movups xmm7, xmmword [0x1801834d0]
movups xmmword [rsp + 0x40], xmm7
pextrw eax, xmm7, 7
test ax, ax
je 0x1800241c7
cmp r12d, 2
jl 0x180024186
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187490]
movdqa xmm2, xmmword [0x180187330]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180187410]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm6
paddw xmm3, xmm2
movq xmm1, xmm7
xorps xmm3, xmm1
movq qword [rsp + 0x40], xmm3
movdqa xmm2, xmmword [0x180187370]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180187410]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm6
paddw xmm3, xmm2
movq xmm0, qword [rsp + 0x48]
xorps xmm3, xmm0
movq qword [rsp + 0x48], xmm3
jmp 0x1800241c7
lea r9, [rsp + 0x40]
mov r8d, r13d
nop
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 8
jl 0x180024190
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x40]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1800241e0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180008fb0
nop
cmp qword [rbp - 0x50], 0
je 0x1800244ce
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f3c]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x180024294
mov r8, rdi
lea rdx, [0x180181f6c]
lea rcx, [rsp + 0x60]
call fcn.180007730
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026bc8
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024487
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024300
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fb0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180024353
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024361
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024386
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18002438f
add rax, 2
sub rcx, 1
jne 0x180024373
cmp r9, r10
jae 0x180024397
mov ebx, edi
jmp 0x18002439d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002439d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1800243dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800243d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bce
call fcn.1800d9c1c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002442e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024429
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bd4
call fcn.1800d9c1c
test ebx, ebx
je 0x18002444c
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800242e0
jmp 0x180024487
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002447d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800244c9
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800244c4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bda
call fcn.1800d9c1c
mov esi, reloc.WS2_32.dll_WSAStartup
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18002450e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c64
call fcn.1800d9c1c
movups xmm0, xmmword [str.KM_ZQ]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180183518]
mov dword [rsp + 0x50], eax
cmp word [0x18018351a], 0
je 0x180024569
mov word [rsp + 0x40], si
xor word [rsp + 0x42], 0x39
xor word [rsp + 0x44], 0x3a
xor word [rsp + 0x46], 0x3b
xor word [rsp + 0x48], 0x3c
xor word [rsp + 0x4a], 0x3d
xor word [rsp + 0x4c], 0x3e
xor word [rsp + 0x4e], 0x3f
xor word [rsp + 0x50], 0x40
xor word [rsp + 0x52], 0x41
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x180024580
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180008fb0
nop
cmp qword [rbp - 0x50], 0
je 0x18002486a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f3c]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x180024634
mov r8, rdi
lea rdx, [0x180181f6c]
lea rcx, [rsp + 0x60]
call fcn.180007730
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026be0
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024827
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800246a0
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fb0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1800246f3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024701
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024726
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x18002472f
add rax, 2
sub rcx, 1
jne 0x180024713
cmp r9, r10
jae 0x180024737
mov ebx, edi
jmp 0x18002473d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002473d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002477d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024778
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026be6
call fcn.1800d9c1c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1800247ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800247c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bec
call fcn.1800d9c1c
test ebx, ebx
je 0x1800247ec
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024680
jmp 0x180024827
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002481d
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002486a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024864
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bf2
call fcn.1800d9c1c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1800248aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800248a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c64
call fcn.1800d9c1c
movups xmm0, xmmword [0x1801834e0]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1801834f0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183500]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x1800249f7
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180024900
cmp r8d, 0x11
jge 0x180024a47
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180024a10
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024a60
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.180008fb0
nop
cmp qword [rbp - 0x50], 0
je 0x180024d4a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f3c]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x180024b13
mov r8, rdi
lea rdx, [0x180181f6c]
lea rcx, [rsp + 0x60]
call fcn.180007730
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026bf8
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180024d07
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024b80
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fb0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180024bd3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180024be1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180024c06
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x180024c0f
add rax, 2
sub rcx, 1
jne 0x180024bf3
cmp r9, r10
jae 0x180024c17
mov ebx, edi
jmp 0x180024c1d
mov ebx, r15d
cmovb ebx, edi
jmp 0x180024c1d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180024c5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024c58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bfe
call fcn.1800d9c1c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x180024cae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024ca9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c04
call fcn.1800d9c1c
test ebx, ebx
je 0x180024ccc
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024b60
jmp 0x180024d07
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180024cfd
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180024d4a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024d44
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c0a
call fcn.1800d9c1c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180024d8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024d85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c64
call fcn.1800d9c1c
movups xmm0, xmmword [str.KM_ZQJ____.3_7h_0_J]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x180183570]
movups xmmword [rbp + 0x78], xmm1
mov eax, dword [0x180183580]
mov dword [rbp + 0x88], eax
movzx eax, word [0x180183584]
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180024ee7
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp + 0x68]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180024df0
cmp r8d, 0x13
jge 0x180024f37
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x180024f00
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x68]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180024f50
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.180008fb0
nop
cmp qword [rbp - 0x50], 0
je 0x18002523a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f3c]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x180025003
mov r8, rdi
lea rdx, [0x180181f6c]
lea rcx, [rsp + 0x60]
call fcn.180007730
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026c10
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, str..exe
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800251f7
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025070
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x80]
call fcn.180008fb0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x28]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1800250c3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1800250d1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800250f6
sub rbx, rax
movzx edx, word [rax + rbx]
cmp dx, word [rax]
jne 0x1800250ff
add rax, 2
sub rcx, 1
jne 0x1800250e3
cmp r9, r10
jae 0x180025107
mov ebx, edi
jmp 0x18002510d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002510d
mov ebx, r13d
seta bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x18002514d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025148
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c16
call fcn.1800d9c1c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002519e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c1c
call fcn.1800d9c1c
test ebx, ebx
je 0x1800251bc
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025050
jmp 0x1800251f7
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800251ed
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002523a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025234
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c22
call fcn.1800d9c1c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18002527a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025275
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c64
call fcn.1800d9c1c
movups xmm0, xmmword [str.KM_ZQ]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x180183518]
mov dword [rsp + 0x50], eax
cmp word [0x18018351a], 0
je 0x1800252da
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x40], ax
xor word [rsp + 0x42], 0x39
xor word [rsp + 0x44], 0x3a
xor word [rsp + 0x46], 0x3b
xor word [rsp + 0x48], 0x3c
xor word [rsp + 0x4a], 0x3d
xor word [rsp + 0x4c], 0x3e
xor word [rsp + 0x4e], 0x3f
xor word [rsp + 0x50], 0x40
xor word [rsp + 0x52], 0x41
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x1800252f1
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180008fb0
nop
or r14d, 1
mov dword [rbp + 0x6b0], r14d
lea rcx, [rbp - 0x80]
call fcn.1800c2f70
test al, al
jne 0x180025da2
movups xmm0, xmmword [0x1801834e0]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1801834f0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183500]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180025477
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180025380
cmp r8d, 0x11
jge 0x1800254c7
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180025490
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800254e0
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180008fb0
nop
or r14d, 2
mov dword [rbp + 0x6b0], r14d
cmp qword [rbp - 0x30], 0
je 0x1800257f1
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f50]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x18002559e
mov r8, rdi
lea rdx, str.....
lea rcx, [rsp + 0x60]
call fcn.180007730
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026c28
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181f40]
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180025630
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800257f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800257ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bb0
jmp 0x1800257ec
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025650
lea rdx, [rbp + 0x15c]
lea rcx, [rbp + 0x48]
call fcn.180008fb0
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1800256a3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1800256b1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800256d6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x1800256df
add rax, 2
sub rcx, 1
jne 0x1800256c3
cmp r9, r10
jae 0x1800256e7
mov ebx, edi
jmp 0x1800256ed
mov ebx, r15d
cmovb ebx, edi
jmp 0x1800256ed
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x18002572d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025728
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c2e
call fcn.1800d9c1c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x18002577e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c34
call fcn.1800d9c1c
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
test ebx, ebx
je 0x180025d36
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025630
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800257f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800257ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c52
call fcn.1800d9c1c
mov eax, dword [0x180183580]
mov dword [rbp + 0x88], eax
movups xmm0, xmmword [str.KM_ZQJ____.3_7h_0_J]
movups xmm1, xmmword [0x180183570]
movzx eax, word [0x180183584]
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm1
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180025949
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp + 0x68]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180025852
cmp r8d, 0x13
jge 0x180025997
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x180025960
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x68]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800259b0
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.180008fb0
nop
or r14d, 4
mov dword [rbp + 0x6b0], r14d
cmp qword [rbp - 0x50], 0
je 0x180025aed
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f50]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x180025a6e
mov r8, rdi
lea rdx, str.....
lea rcx, [rsp + 0x60]
call fcn.180007730
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026c3a
mov rcx, rbx
sub rcx, rax
mov rdx, rdi
cmp rcx, rdx
cmovb rdx, rcx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax*2]
sub rbx, rdx
lea rdx, [rcx + rdx*2]
mov r8, rbx
sub r8, rax
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181f40]
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180025b00
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025aed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025ae8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c40
call fcn.1800d9c1c
mov bl, 1
jmp 0x180025da4
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180025b20
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x20]
call fcn.180008fb0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x180025b73
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x180025b81
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x180025ba6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x180025baf
add rax, 2
sub rcx, 1
jne 0x180025b93
cmp r9, r10
jae 0x180025bb7
mov ebx, edi
jmp 0x180025bbd
mov ebx, r15d
cmovb ebx, edi
jmp 0x180025bbd
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x180025bfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025bf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c46
call fcn.1800d9c1c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x180025c4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025c49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c4c
call fcn.1800d9c1c
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
test ebx, ebx
je 0x180025cc5
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025b00
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025aed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025ae8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bb6
jmp 0x180025ae8
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180025ce5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025da2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bb6
jmp 0x180025d9d
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180025d56
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180025da2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c52
call fcn.1800d9c1c
xor bl, bl
test r14b, 4
je 0x180025def
and r14d, 0xfffffffb
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180025def
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c58
call fcn.1800d9c1c
nop
test r14b, 2
je 0x180025e3a
and r14d, 0xfffffffd
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180025e3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025e34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c5e
call fcn.1800d9c1c
nop
test r14b, 1
je 0x180025e84
and r14d, 0xfffffffe
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180025e84
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025e7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c64
call fcn.1800d9c1c
test bl, bl
jne 0x180025f3c
lea rcx, [rbp + 0x6c8]
call fcn.180023bc0
mov rbx, qword [rbp + 0x6c8]
movabs rax, 0x7ffffffffa0a1efe
cmp rbx, rax
jg 0x180025eb7
add rbx, 0x5f5e100
jmp 0x180025ec1
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0xb0]
call fcn.180023bc0
mov rax, qword [rbp + 0xb0]
cmp rbx, rax
mov esi, reloc.WS2_32.dll_WSAStartup
je 0x180024074
jl 0x180024074
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914effff
cmp rcx, rax
jg 0x180025f30
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x180025f27
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180025ec1
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x180025ec1
lea rax, [rsp + 0x60]
mov qword [rbp + 0x6b0], rax
movups xmm0, xmmword [0x180183588]
movups xmmword [rsp + 0x40], xmm0
movzx eax, word [0x180183598]
mov ecx, 0x2d
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x39
xor word [rsp + 0x44], 0x3a
xor word [rsp + 0x46], 0x3b
xor word [rsp + 0x48], 0x3c
xor word [rsp + 0x4a], 0x3d
xor word [rsp + 0x4c], 0x3e
xor word [rsp + 0x4e], 0x3f
xor ax, 0x40
mov word [rsp + 0x50], ax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rsp + 0x40]
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180025fb0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180008fb0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180013e90
mov rbx, rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp]
call fcn.180007a70
nop
lea r8, [rbp + 0xd8]
mov rdx, rbx
mov rcx, rax
call fcn.1800c2d00
movzx ebx, al
lea r9, [fcn.1800078e0]
mov r8, r15
mov edx, 0x20
lea rcx, [rbp - 0x80]
call fcn.1800d9c50
test bl, bl
jne 0x18002605a
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800268e2
movups xmm0, xmmword [0x1801834e0]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1801834f0]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183500]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x1800261a7
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x1800260b0
cmp r8d, 0x11
jge 0x1800261f7
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x1800261c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rax, [rbp]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180026210
lea rdx, [rbp]
lea rcx, [rbp - 0x40]
call fcn.180008fb0
nop
cmp qword [rbp - 0x30], 0
jne 0x180026237
xor bl, bl
jmp 0x18002656e
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007a70
nop
mov r8, rdi
lea rdx, [0x180181f50]
lea rcx, [rsp + 0x60]
call fcn.180007730
cmp rax, 0xffffffffffffffff
je 0x1800262c9
mov r8, rdi
lea rdx, str.....
lea rcx, [rsp + 0x60]
call fcn.180007730
mov r9, rax
mov rbx, qword [rsp + 0x70]
cmp rbx, rax
jb 0x180026c6a
mov rax, rbx
sub rax, r9
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
lea rcx, [rax + r9*2]
sub rbx, r8
lea rdx, [rcx + r8*2]
mov r8, rbx
sub r8, r9
lea r8, [r8*2 + 2]
call fcn.18010b6e0
mov qword [rsp + 0x70], rbx
lea rdx, [0x180181f40]
lea rcx, [rsp + 0x60]
call fcn.180009bd0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180026350
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800264fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800264f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026bbc
jmp 0x1800264f7
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rax, [rbp + 0x15c]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180026370
lea rdx, [rbp + 0x15c]
lea rcx, [rbp - 0x20]
call fcn.180008fb0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1800bd6b0
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.180007a70
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1800bd6b0
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1800263c3
mov rax, qword [rax]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1800263d1
mov rbx, qword [rbx]
mov rcx, r9
cmp r10, r9
cmovb rcx, r10
test rcx, rcx
je 0x1800263f6
sub rbx, rax
movzx edx, word [rbx + rax]
cmp dx, word [rax]
jne 0x1800263ff
add rax, 2
sub rcx, 1
jne 0x1800263e3
cmp r9, r10
jae 0x180026407
mov ebx, edi
jmp 0x18002640d
mov ebx, r15d
cmovb ebx, edi
jmp 0x18002640d
mov ebx, r13d
seta bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x18002644d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026448
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c70
call fcn.1800d9c1c
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x18002649e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c76
call fcn.1800d9c1c
test ebx, ebx
je 0x180026500
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180026350
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1800264fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800264f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c7c
call fcn.1800d9c1c
xor bl, bl
jmp 0x18002656e
mov r8d, dword [rbp + 0x138]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180026520
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18002656c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c7c
call fcn.1800d9c1c
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1800265ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800265a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026baa
call fcn.1800d9c1c
test bl, bl
jne 0x1800268e2
mov ecx, 0x98
call fcn.1800d9be0
mov rbx, rax
mov qword [rbp + 0x6b0], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x6c8], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
xor r8d, r8d
lea rdx, [0x180140640]
lea rcx, [rbp - 0x20]
call fcn.180008fb0
nop
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
xor r8d, r8d
lea rdx, [0x180140644]
lea rcx, [rbp + 0x28]
call fcn.180008fb0
nop
movups xmm0, xmmword [str.KM_ZQ]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x180183518]
mov dword [rsp + 0x70], eax
cmp word [0x18018351a], 0
je 0x180026684
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x60], ax
xor word [rsp + 0x62], 0x39
xor word [rsp + 0x64], 0x3a
xor word [rsp + 0x66], 0x3b
xor word [rsp + 0x68], 0x3c
xor word [rsp + 0x6a], 0x3d
xor word [rsp + 0x6c], 0x3e
xor word [rsp + 0x6e], 0x3f
xor word [rsp + 0x70], 0x40
xor word [rsp + 0x72], 0x41
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
lea rax, [rsp + 0x60]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1800266a0
mov r8, rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x48]
call fcn.180008fb0
nop
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.180038da0
mov r14, rax
mov rcx, qword [rbp + 0xd8]
mov qword [rax + 0x18], rcx
mov ecx, dword [rbp + 0xe8]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rbx, [rax + 0x7530]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
ja 0x1800268dc
movups xmm0, xmmword [str.KM_ZQN_M6__j_H]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x180183548]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x180183558]
mov word [rbp + 0x20], ax
mov r8d, r13d
cmp r12d, 2
jl 0x180026857
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187670]
movdqa xmm6, xmmword [0x180187410]
movdqa xmm7, xmmword [0x180187490]
lea rcx, [rbp]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x180026760
cmp r8d, 0x11
jge 0x1800268a7
movsxd rax, r8d
lea r9, [rbp]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x180026870
xor r8d, r8d
lea rdx, [rbp]
mov ecx, dword [rbp + 0xe8]
call fcn.1800c0910
test rax, rax
jne 0x18002694f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rbx
jbe 0x180026702
mov r15d, 0x405f
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x180026928
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026923
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026c82
call fcn.1800d9c1c
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x750]
movaps xmm7, xmmword [rsp + 0x740]
add rsp, 0x768
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 0x2a400
lea rdx, [0x180339820]
lea rcx, [rbp + 0x98]
call fcn.1800c05c0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov rdx, qword [rbp + 0xa0]
sub rdx, qword [rbp + 0x98]
je 0x1800269d2
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x180026c88
lea rcx, [rsp + 0x60]
call fcn.18000a760
mov rdi, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa0]
mov r8, rsi
sub r8, rdi
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call fcn.18010b6e0
sub rsi, rdi
add rsi, qword [rsp + 0x60]
mov qword [rsp + 0x68], rsi
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.180039120
lea rcx, [rbp + 0x98]
call fcn.1800075c0
mov rdx, qword [0x1803ad4d8]
lea rcx, [rbp + 0x370]
call fcn.180026ca0
nop
mov rax, qword [0x1803ad4d8]
mov dword [rax + 0x30], r13d
mov dword [rax + 0x24], r15d
mov dword [rax + 0x20], r15d
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180013d50
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.180013d30
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x58]
sub rax, rcx
cmp rax, 8
jb 0x180026c8e
lea r9, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova r9, qword [rbp + 0x48]
mov qword [rsp + 0x30], 8
lea rax, str.vcs2.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xf0]
call fcn.180009f30
nop
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0xf0]
call fcn.1800078a0
mov rbx, qword [rax]
lea rdx, [rbp + 0x6c8]
lea rcx, [rbp + 0xf0]
call fcn.1800078c0
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp - 0x80]
call fcn.180008e70
nop
lea rdx, [r14 + 0x20]
lea rcx, [rsp + 0x60]
call fcn.180007630
mov rdx, rax
lea rcx, [rbp + 0xf0]
call int.1800c5940
lea rdx, [rbp - 0x80]
lea rcx, [rbp]
call fcn.180007dc0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1800226d0
mov ebx, eax
lea rdx, [rbp + 0x370]
mov rcx, qword [0x1803ad4d8]
call fcn.180026dd0
test ebx, ebx
je 0x180026b16
call fcn.180023cb0
mov r15d, eax
jmp 0x180026b19
mov r15d, r13d
lea rcx, [rbp - 0x80]
call fcn.180007c60
nop
lea rcx, [rbp + 0xf0]
call fcn.1800078e0
nop
lea rcx, [rbp + 0x48]
call fcn.1800078e0
nop
lea rcx, [rbp + 0x3b8]
call fcn.1800136c0
lea rcx, [rbp + 0x370]
call fcn.180013f50
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1800268e2
mov rdx, qword [rbp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026b8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180026baa
call fcn.1800d9c1c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
jmp 0x1800268e2
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
int3
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800087b0
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800e5f80
nop
call fcn.1800086f0
nop
call fcn.180003590
int3