Function at 0x180030c50
Capabilities:
Check if file exists
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x348
mov rax, qword [0x1800623f8]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x18c], 9
mov dword [rsp + 0x178], 5
mov eax, dword [rsp + 0x178]
test eax, eax
jle 0x180030d04
mov eax, dword [rsp + 0x178]
cmp eax, 1
jle 0x180030cd1
mov eax, dword [rsp + 0x18c]
and eax, 0x10a2
mov dword [rsp + 0x18c], eax
mov eax, dword [rsp + 0x178]
sub eax, 2
mov dword [rsp + 0x178], eax
jmp 0x180030c94
mov eax, dword [rsp + 0x18c]
cmp eax, 0x807
jle 0x180030cf2
mov eax, dword [rsp + 0x18c]
and eax, 0x80
mov dword [rsp + 0x18c], eax
mov eax, dword [rsp + 0x178]
dec eax
mov dword [rsp + 0x178], eax
jmp 0x180030c94
mov dword [rsp + 0x1a4], 0
mov dword [rsp + 0x190], 0xe
cmp dword [rsp + 0x190], 0
jle 0x180030d7a
mov eax, dword [rsp + 0x190]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030d5d
mov dword [rsp + 0x1a4], 4
mov eax, dword [rsp + 0x190]
sub eax, 2
mov dword [rsp + 0x190], eax
jmp 0x180030d1a
mov dword [rsp + 0x1a4], 4
mov eax, dword [rsp + 0x190]
dec eax
mov dword [rsp + 0x190], eax
jmp 0x180030d1a
mov dword [rsp + 0x1a0], 2
mov dword [rsp + 0x184], 0x13
cmp dword [rsp + 0x184], 0
jle 0x180030df1
mov eax, dword [rsp + 0x184]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030dd3
mov dword [rsp + 0x1a0], 4
mov eax, dword [rsp + 0x184]
sub eax, 2
mov dword [rsp + 0x184], eax
jmp 0x180030d90
mov dword [rsp + 0x1a0], 4
mov eax, dword [rsp + 0x184]
sub eax, 2
mov dword [rsp + 0x184], eax
jmp 0x180030d90
mov dword [rsp + 0x198], 4
mov dword [rsp + 0x180], 0x13
cmp dword [rsp + 0x180], 0
jle 0x180030e67
mov eax, dword [rsp + 0x180]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030e49
mov dword [rsp + 0x198], 0
mov eax, dword [rsp + 0x180]
dec eax
mov dword [rsp + 0x180], eax
jmp 0x180030e07
mov dword [rsp + 0x198], 0
mov eax, dword [rsp + 0x180]
sub eax, 2
mov dword [rsp + 0x180], eax
jmp 0x180030e07
mov dword [rsp + 0x194], 5
mov dword [rsp + 0x188], 8
mov eax, dword [rsp + 0x188]
test eax, eax
jle 0x180030eed
mov eax, dword [rsp + 0x188]
cmp eax, 1
jle 0x180030eba
mov eax, dword [rsp + 0x194]
and eax, 0xc22
mov dword [rsp + 0x194], eax
mov eax, dword [rsp + 0x188]
sub eax, 2
mov dword [rsp + 0x188], eax
jmp 0x180030e7d
mov eax, dword [rsp + 0x194]
cmp eax, 0x80a
jle 0x180030edb
mov eax, dword [rsp + 0x194]
and eax, 0x83
mov dword [rsp + 0x194], eax
mov eax, dword [rsp + 0x188]
dec eax
mov dword [rsp + 0x188], eax
jmp 0x180030e7d
mov dword [rsp + 0x17c], 3
mov dword [rsp + 0x19c], 0xf
cmp dword [rsp + 0x19c], 0
jle 0x180030f64
mov eax, dword [rsp + 0x19c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180030f46
mov dword [rsp + 0x17c], 0
mov eax, dword [rsp + 0x19c]
sub eax, 2
mov dword [rsp + 0x19c], eax
jmp 0x180030f03
mov dword [rsp + 0x17c], 4
mov eax, dword [rsp + 0x19c]
sub eax, 2
mov dword [rsp + 0x19c], eax
jmp 0x180030f03
mov qword [rsp + 0x170], 0
mov dword [rsp + 0x1b4], 3
mov dword [rsp + 0x1bc], 9
mov eax, dword [rsp + 0x1bc]
test eax, eax
jle 0x180030ff6
mov eax, dword [rsp + 0x1bc]
cmp eax, 1
jle 0x180030fc3
mov eax, dword [rsp + 0x1b4]
and eax, 0x15f8
mov dword [rsp + 0x1b4], eax
mov eax, dword [rsp + 0x1bc]
sub eax, 2
mov dword [rsp + 0x1bc], eax
jmp 0x180030f86
mov eax, dword [rsp + 0x1b4]
cmp eax, 0x80b
jle 0x180030fe4
mov eax, dword [rsp + 0x1b4]
and eax, 0x84
mov dword [rsp + 0x1b4], eax
mov eax, dword [rsp + 0x1bc]
dec eax
mov dword [rsp + 0x1bc], eax
jmp 0x180030f86
mov dword [rsp + 0x1b0], 7
mov dword [rsp + 0x1b8], 0xb
mov eax, dword [rsp + 0x1b8]
test eax, eax
jle 0x18003107c
mov eax, dword [rsp + 0x1b8]
cmp eax, 1
jle 0x180031049
mov eax, dword [rsp + 0x1b0]
and eax, 0x66b
mov dword [rsp + 0x1b0], eax
mov eax, dword [rsp + 0x1b8]
sub eax, 2
mov dword [rsp + 0x1b8], eax
jmp 0x18003100c
mov eax, dword [rsp + 0x1b0]
cmp eax, 0x80d
jle 0x18003106a
mov eax, dword [rsp + 0x1b0]
and eax, 0x86
mov dword [rsp + 0x1b0], eax
mov eax, dword [rsp + 0x1b8]
dec eax
mov dword [rsp + 0x1b8], eax
jmp 0x18003100c
mov dword [rsp + 0x1ac], 7
mov dword [rsp + 0x1a8], 0x10
cmp dword [rsp + 0x1a8], 0
jle 0x1800310f2
mov eax, dword [rsp + 0x1a8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800310d5
mov dword [rsp + 0x1ac], 0
mov eax, dword [rsp + 0x1a8]
sub eax, 2
mov dword [rsp + 0x1a8], eax
jmp 0x180031092
mov dword [rsp + 0x1ac], 0
mov eax, dword [rsp + 0x1a8]
dec eax
mov dword [rsp + 0x1a8], eax
jmp 0x180031092
mov rax, qword [rsp + 0x360]
add rax, 0x1c
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [rsp + 0x1c4], 7
mov dword [rsp + 0x1cc], 0xd
cmp dword [rsp + 0x1cc], 0
jle 0x180031188
mov eax, dword [rsp + 0x1cc]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003116b
mov dword [rsp + 0x1c4], 0
mov eax, dword [rsp + 0x1cc]
sub eax, 2
mov dword [rsp + 0x1cc], eax
jmp 0x180031128
mov dword [rsp + 0x1c4], 4
mov eax, dword [rsp + 0x1cc]
dec eax
mov dword [rsp + 0x1cc], eax
jmp 0x180031128
mov dword [rsp + 0x1c8], 3
mov dword [rsp + 0x1d0], 0x12
cmp dword [rsp + 0x1d0], 0
jle 0x1800311ff
mov eax, dword [rsp + 0x1d0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800311e1
mov dword [rsp + 0x1c8], 4
mov eax, dword [rsp + 0x1d0]
sub eax, 2
mov dword [rsp + 0x1d0], eax
jmp 0x18003119e
mov dword [rsp + 0x1c8], 0
mov eax, dword [rsp + 0x1d0]
sub eax, 2
mov dword [rsp + 0x1d0], eax
jmp 0x18003119e
mov dword [rsp + 0x1c0], 3
mov dword [rsp + 0x1d4], 0xf
cmp dword [rsp + 0x1d4], 0
jle 0x180031276
mov eax, dword [rsp + 0x1d4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031258
mov dword [rsp + 0x1c0], 0
mov eax, dword [rsp + 0x1d4]
sub eax, 2
mov dword [rsp + 0x1d4], eax
jmp 0x180031215
mov dword [rsp + 0x1c0], 4
mov eax, dword [rsp + 0x1d4]
sub eax, 2
mov dword [rsp + 0x1d4], eax
jmp 0x180031215
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x18003140e
mov dword [rsp + 0x1dc], 9
mov dword [rsp + 0x1e8], 4
mov eax, dword [rsp + 0x1e8]
test eax, eax
jle 0x18003130d
mov eax, dword [rsp + 0x1e8]
cmp eax, 1
jle 0x1800312dc
mov eax, dword [rsp + 0x1dc]
and eax, 0x197d
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0x1e8]
sub eax, 2
mov dword [rsp + 0x1e8], eax
jmp 0x18003129f
mov eax, dword [rsp + 0x1dc]
cmp eax, 0x806
jle 0x1800312fb
mov eax, dword [rsp + 0x1dc]
and eax, 0x7f
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0x1e8]
dec eax
mov dword [rsp + 0x1e8], eax
jmp 0x18003129f
mov dword [rsp + 0x1ec], 0
mov dword [rsp + 0x1e4], 0xe
cmp dword [rsp + 0x1e4], 0
jle 0x180031383
mov eax, dword [rsp + 0x1e4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031366
mov dword [rsp + 0x1ec], 4
mov eax, dword [rsp + 0x1e4]
sub eax, 2
mov dword [rsp + 0x1e4], eax
jmp 0x180031323
mov dword [rsp + 0x1ec], 4
mov eax, dword [rsp + 0x1e4]
dec eax
mov dword [rsp + 0x1e4], eax
jmp 0x180031323
mov dword [rsp + 0x1d8], 4
mov dword [rsp + 0x1e0], 3
mov eax, dword [rsp + 0x1e0]
test eax, eax
jle 0x180031407
mov eax, dword [rsp + 0x1e0]
cmp eax, 1
jle 0x1800313d6
mov eax, dword [rsp + 0x1d8]
and eax, 0xdd8
mov dword [rsp + 0x1d8], eax
mov eax, dword [rsp + 0x1e0]
sub eax, 2
mov dword [rsp + 0x1e0], eax
jmp 0x180031399
mov eax, dword [rsp + 0x1d8]
cmp eax, 0x805
jle 0x1800313f5
mov eax, dword [rsp + 0x1d8]
and eax, 0x7e
mov dword [rsp + 0x1d8], eax
mov eax, dword [rsp + 0x1e0]
dec eax
mov dword [rsp + 0x1e0], eax
jmp 0x180031399
xor eax, eax
jmp 0x18003278a
mov rcx, qword [rsp + 0x360]
call fcn.1800103c0
test eax, eax
jne 0x180031727
mov dword [rsp + 0x200], 4
mov dword [rsp + 0x210], 3
mov eax, dword [rsp + 0x210]
test eax, eax
jle 0x1800314a7
mov eax, dword [rsp + 0x210]
cmp eax, 1
jle 0x180031476
mov eax, dword [rsp + 0x200]
and eax, 0x1891
mov dword [rsp + 0x200], eax
mov eax, dword [rsp + 0x210]
sub eax, 2
mov dword [rsp + 0x210], eax
jmp 0x180031439
mov eax, dword [rsp + 0x200]
cmp eax, 0x805
jle 0x180031495
mov eax, dword [rsp + 0x200]
and eax, 0x7e
mov dword [rsp + 0x200], eax
mov eax, dword [rsp + 0x210]
dec eax
mov dword [rsp + 0x210], eax
jmp 0x180031439
mov dword [rsp + 0x20c], 8
mov dword [rsp + 0x218], 3
mov eax, dword [rsp + 0x218]
test eax, eax
jle 0x18003152b
mov eax, dword [rsp + 0x218]
cmp eax, 1
jle 0x1800314fa
mov eax, dword [rsp + 0x20c]
and eax, 0x1fed
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x218]
sub eax, 2
mov dword [rsp + 0x218], eax
jmp 0x1800314bd
mov eax, dword [rsp + 0x20c]
cmp eax, 0x805
jle 0x180031519
mov eax, dword [rsp + 0x20c]
and eax, 0x7e
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x218]
dec eax
mov dword [rsp + 0x218], eax
jmp 0x1800314bd
mov dword [rsp + 0x1fc], 3
mov dword [rsp + 0x208], 8
mov eax, dword [rsp + 0x208]
test eax, eax
jle 0x1800315b1
mov eax, dword [rsp + 0x208]
cmp eax, 1
jle 0x18003157e
mov eax, dword [rsp + 0x1fc]
and eax, 0x11d0
mov dword [rsp + 0x1fc], eax
mov eax, dword [rsp + 0x208]
sub eax, 2
mov dword [rsp + 0x208], eax
jmp 0x180031541
mov eax, dword [rsp + 0x1fc]
cmp eax, 0x80a
jle 0x18003159f
mov eax, dword [rsp + 0x1fc]
and eax, 0x83
mov dword [rsp + 0x1fc], eax
mov eax, dword [rsp + 0x208]
dec eax
mov dword [rsp + 0x208], eax
jmp 0x180031541
mov dword [rsp + 0x204], 7
mov dword [rsp + 0x1f4], 4
mov eax, dword [rsp + 0x1f4]
test eax, eax
jle 0x180031635
mov eax, dword [rsp + 0x1f4]
cmp eax, 1
jle 0x180031604
mov eax, dword [rsp + 0x204]
and eax, 0x21f3
mov dword [rsp + 0x204], eax
mov eax, dword [rsp + 0x1f4]
sub eax, 2
mov dword [rsp + 0x1f4], eax
jmp 0x1800315c7
mov eax, dword [rsp + 0x204]
cmp eax, 0x806
jle 0x180031623
mov eax, dword [rsp + 0x204]
and eax, 0x7f
mov dword [rsp + 0x204], eax
mov eax, dword [rsp + 0x1f4]
dec eax
mov dword [rsp + 0x1f4], eax
jmp 0x1800315c7
mov dword [rsp + 0x21c], 7
mov dword [rsp + 0x214], 0x11
cmp dword [rsp + 0x214], 0
jle 0x1800316aa
mov eax, dword [rsp + 0x214]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003168d
mov dword [rsp + 0x21c], 0
mov eax, dword [rsp + 0x214]
dec eax
mov dword [rsp + 0x214], eax
jmp 0x18003164b
mov dword [rsp + 0x21c], 0
mov eax, dword [rsp + 0x214]
dec eax
mov dword [rsp + 0x214], eax
jmp 0x18003164b
mov dword [rsp + 0x1f0], 8
mov dword [rsp + 0x1f8], 0x12
cmp dword [rsp + 0x1f8], 0
jle 0x180031720
mov eax, dword [rsp + 0x1f8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031702
mov dword [rsp + 0x1f0], 4
mov eax, dword [rsp + 0x1f8]
dec eax
mov dword [rsp + 0x1f8], eax
jmp 0x1800316c0
mov dword [rsp + 0x1f0], 0
mov eax, dword [rsp + 0x1f8]
sub eax, 2
mov dword [rsp + 0x1f8], eax
jmp 0x1800316c0
xor eax, eax
jmp 0x18003278a
xor edx, edx
mov rcx, qword [rsp + 0x360]
call fcn.180033bf0
test eax, eax
jne 0x1800318ee
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rsp + 0x360]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x360]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x360]
mov dword [rax + 0x18], 0
mov dword [rsp + 0x234], 7
mov dword [rsp + 0x22c], 0x11
cmp dword [rsp + 0x22c], 0
jle 0x1800317ec
mov eax, dword [rsp + 0x22c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800317cf
mov dword [rsp + 0x234], 0
mov eax, dword [rsp + 0x22c]
dec eax
mov dword [rsp + 0x22c], eax
jmp 0x18003178d
mov dword [rsp + 0x234], 0
mov eax, dword [rsp + 0x22c]
dec eax
mov dword [rsp + 0x22c], eax
jmp 0x18003178d
mov dword [rsp + 0x220], 4
mov dword [rsp + 0x228], 3
mov eax, dword [rsp + 0x228]
test eax, eax
jle 0x180031870
mov eax, dword [rsp + 0x228]
cmp eax, 1
jle 0x18003183f
mov eax, dword [rsp + 0x220]
and eax, 0x1891
mov dword [rsp + 0x220], eax
mov eax, dword [rsp + 0x228]
sub eax, 2
mov dword [rsp + 0x228], eax
jmp 0x180031802
mov eax, dword [rsp + 0x220]
cmp eax, 0x805
jle 0x18003185e
mov eax, dword [rsp + 0x220]
and eax, 0x7e
mov dword [rsp + 0x220], eax
mov eax, dword [rsp + 0x228]
dec eax
mov dword [rsp + 0x228], eax
jmp 0x180031802
mov dword [rsp + 0x224], 3
mov dword [rsp + 0x230], 0x12
cmp dword [rsp + 0x230], 0
jle 0x1800318e7
mov eax, dword [rsp + 0x230]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800318c9
mov dword [rsp + 0x224], 4
mov eax, dword [rsp + 0x230]
sub eax, 2
mov dword [rsp + 0x230], eax
jmp 0x180031886
mov dword [rsp + 0x224], 0
mov eax, dword [rsp + 0x230]
sub eax, 2
mov dword [rsp + 0x230], eax
jmp 0x180031886
xor eax, eax
jmp 0x18003278a
mov rax, qword [rsp + 0x360]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x23c], 4
mov dword [rsp + 0x248], 3
mov eax, dword [rsp + 0x248]
test eax, eax
jle 0x180031983
mov eax, dword [rsp + 0x248]
cmp eax, 1
jle 0x180031952
mov eax, dword [rsp + 0x23c]
and eax, 0x1891
mov dword [rsp + 0x23c], eax
mov eax, dword [rsp + 0x248]
sub eax, 2
mov dword [rsp + 0x248], eax
jmp 0x180031915
mov eax, dword [rsp + 0x23c]
cmp eax, 0x805
jle 0x180031971
mov eax, dword [rsp + 0x23c]
and eax, 0x7e
mov dword [rsp + 0x23c], eax
mov eax, dword [rsp + 0x248]
dec eax
mov dword [rsp + 0x248], eax
jmp 0x180031915
mov dword [rsp + 0x240], 8
mov dword [rsp + 0x244], 0x11
cmp dword [rsp + 0x244], 0
jle 0x1800319f9
mov eax, dword [rsp + 0x244]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800319db
mov dword [rsp + 0x240], 4
mov eax, dword [rsp + 0x244]
dec eax
mov dword [rsp + 0x244], eax
jmp 0x180031999
mov dword [rsp + 0x240], 4
mov eax, dword [rsp + 0x244]
sub eax, 2
mov dword [rsp + 0x244], eax
jmp 0x180031999
mov dword [rsp + 0x238], 4
mov dword [rsp + 0x24c], 0x11
cmp dword [rsp + 0x24c], 0
jle 0x180031a6e
mov eax, dword [rsp + 0x24c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031a51
mov dword [rsp + 0x238], 0
mov eax, dword [rsp + 0x24c]
dec eax
mov dword [rsp + 0x24c], eax
jmp 0x180031a0f
mov dword [rsp + 0x238], 4
mov eax, dword [rsp + 0x24c]
dec eax
mov dword [rsp + 0x24c], eax
jmp 0x180031a0f
mov ecx, 0x18
call fcn.180049f00
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x368]
mov qword [rax + 8], rcx
mov dword [rsp + 0x26c], 3
mov dword [rsp + 0x27c], 9
mov eax, dword [rsp + 0x27c]
test eax, eax
jle 0x180031b21
mov eax, dword [rsp + 0x27c]
cmp eax, 1
jle 0x180031aee
mov eax, dword [rsp + 0x26c]
and eax, 0x15f8
mov dword [rsp + 0x26c], eax
mov eax, dword [rsp + 0x27c]
sub eax, 2
mov dword [rsp + 0x27c], eax
jmp 0x180031ab1
mov eax, dword [rsp + 0x26c]
cmp eax, 0x80b
jle 0x180031b0f
mov eax, dword [rsp + 0x26c]
and eax, 0x84
mov dword [rsp + 0x26c], eax
mov eax, dword [rsp + 0x27c]
dec eax
mov dword [rsp + 0x27c], eax
jmp 0x180031ab1
mov dword [rsp + 0x258], 4
mov dword [rsp + 0x270], 0x11
cmp dword [rsp + 0x270], 0
jle 0x180031b97
mov eax, dword [rsp + 0x270]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031b79
mov dword [rsp + 0x258], 4
mov eax, dword [rsp + 0x270]
dec eax
mov dword [rsp + 0x270], eax
jmp 0x180031b37
mov dword [rsp + 0x258], 4
mov eax, dword [rsp + 0x270]
sub eax, 2
mov dword [rsp + 0x270], eax
jmp 0x180031b37
mov dword [rsp + 0x264], 5
mov dword [rsp + 0x278], 5
mov eax, dword [rsp + 0x278]
test eax, eax
jle 0x180031c1d
mov eax, dword [rsp + 0x278]
cmp eax, 1
jle 0x180031bea
mov eax, dword [rsp + 0x264]
and eax, 0x9c1
mov dword [rsp + 0x264], eax
mov eax, dword [rsp + 0x278]
sub eax, 2
mov dword [rsp + 0x278], eax
jmp 0x180031bad
mov eax, dword [rsp + 0x264]
cmp eax, 0x807
jle 0x180031c0b
mov eax, dword [rsp + 0x264]
and eax, 0x80
mov dword [rsp + 0x264], eax
mov eax, dword [rsp + 0x278]
dec eax
mov dword [rsp + 0x278], eax
jmp 0x180031bad
mov dword [rsp + 0x260], 4
mov dword [rsp + 0x250], 0x15
cmp dword [rsp + 0x250], 0
jle 0x180031c94
mov eax, dword [rsp + 0x250]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031c76
mov dword [rsp + 0x260], 0
mov eax, dword [rsp + 0x250]
sub eax, 2
mov dword [rsp + 0x250], eax
jmp 0x180031c33
mov dword [rsp + 0x260], 0
mov eax, dword [rsp + 0x250]
sub eax, 2
mov dword [rsp + 0x250], eax
jmp 0x180031c33
mov dword [rsp + 0x268], 7
mov dword [rsp + 0x254], 4
mov eax, dword [rsp + 0x254]
test eax, eax
jle 0x180031d18
mov eax, dword [rsp + 0x254]
cmp eax, 1
jle 0x180031ce7
mov eax, dword [rsp + 0x268]
and eax, 0x21f3
mov dword [rsp + 0x268], eax
mov eax, dword [rsp + 0x254]
sub eax, 2
mov dword [rsp + 0x254], eax
jmp 0x180031caa
mov eax, dword [rsp + 0x268]
cmp eax, 0x806
jle 0x180031d06
mov eax, dword [rsp + 0x268]
and eax, 0x7f
mov dword [rsp + 0x268], eax
mov eax, dword [rsp + 0x254]
dec eax
mov dword [rsp + 0x254], eax
jmp 0x180031caa
mov dword [rsp + 0x274], 2
mov dword [rsp + 0x25c], 0x13
cmp dword [rsp + 0x25c], 0
jle 0x180031d8f
mov eax, dword [rsp + 0x25c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031d71
mov dword [rsp + 0x274], 4
mov eax, dword [rsp + 0x25c]
sub eax, 2
mov dword [rsp + 0x25c], eax
jmp 0x180031d2e
mov dword [rsp + 0x274], 4
mov eax, dword [rsp + 0x25c]
sub eax, 2
mov dword [rsp + 0x25c], eax
jmp 0x180031d2e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x40]
lea r8, [0x1800309a0]
mov edx, 0x200000
xor ecx, ecx
call fcn.18004a0e4
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
jne 0x1800321c3
mov dword [rsp + 0x280], 3
mov dword [rsp + 0x294], 0xf
cmp dword [rsp + 0x294], 0
jle 0x180031e46
mov eax, dword [rsp + 0x294]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031e28
mov dword [rsp + 0x280], 0
mov eax, dword [rsp + 0x294]
sub eax, 2
mov dword [rsp + 0x294], eax
jmp 0x180031de5
mov dword [rsp + 0x280], 4
mov eax, dword [rsp + 0x294]
sub eax, 2
mov dword [rsp + 0x294], eax
jmp 0x180031de5
mov dword [rsp + 0x288], 9
mov dword [rsp + 0x290], 4
mov eax, dword [rsp + 0x290]
test eax, eax
jle 0x180031eca
mov eax, dword [rsp + 0x290]
cmp eax, 1
jle 0x180031e99
mov eax, dword [rsp + 0x288]
and eax, 0x197d
mov dword [rsp + 0x288], eax
mov eax, dword [rsp + 0x290]
sub eax, 2
mov dword [rsp + 0x290], eax
jmp 0x180031e5c
mov eax, dword [rsp + 0x288]
cmp eax, 0x806
jle 0x180031eb8
mov eax, dword [rsp + 0x288]
and eax, 0x7f
mov dword [rsp + 0x288], eax
mov eax, dword [rsp + 0x290]
dec eax
mov dword [rsp + 0x290], eax
jmp 0x180031e5c
mov dword [rsp + 0x28c], 4
mov dword [rsp + 0x284], 0x13
cmp dword [rsp + 0x284], 0
jle 0x180031f40
mov eax, dword [rsp + 0x284]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180031f22
mov dword [rsp + 0x28c], 0
mov eax, dword [rsp + 0x284]
dec eax
mov dword [rsp + 0x284], eax
jmp 0x180031ee0
mov dword [rsp + 0x28c], 0
mov eax, dword [rsp + 0x284]
sub eax, 2
mov dword [rsp + 0x284], eax
jmp 0x180031ee0
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [rsp + 0x2a8], 7
mov dword [rsp + 0x29c], 4
mov eax, dword [rsp + 0x29c]
test eax, eax
jle 0x180031fd7
mov eax, dword [rsp + 0x29c]
cmp eax, 1
jle 0x180031fa6
mov eax, dword [rsp + 0x2a8]
and eax, 0x21f3
mov dword [rsp + 0x2a8], eax
mov eax, dword [rsp + 0x29c]
sub eax, 2
mov dword [rsp + 0x29c], eax
jmp 0x180031f69
mov eax, dword [rsp + 0x2a8]
cmp eax, 0x806
jle 0x180031fc5
mov eax, dword [rsp + 0x2a8]
and eax, 0x7f
mov dword [rsp + 0x2a8], eax
mov eax, dword [rsp + 0x29c]
dec eax
mov dword [rsp + 0x29c], eax
jmp 0x180031f69
mov dword [rsp + 0x2bc], 0
mov dword [rsp + 0x2b4], 0xe
cmp dword [rsp + 0x2b4], 0
jle 0x18003204d
mov eax, dword [rsp + 0x2b4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180032030
mov dword [rsp + 0x2bc], 4
mov eax, dword [rsp + 0x2b4]
sub eax, 2
mov dword [rsp + 0x2b4], eax
jmp 0x180031fed
mov dword [rsp + 0x2bc], 4
mov eax, dword [rsp + 0x2b4]
dec eax
mov dword [rsp + 0x2b4], eax
jmp 0x180031fed
mov dword [rsp + 0x2a0], 4
mov dword [rsp + 0x2ac], 3
mov eax, dword [rsp + 0x2ac]
test eax, eax
jle 0x1800320d1
mov eax, dword [rsp + 0x2ac]
cmp eax, 1
jle 0x1800320a0
mov eax, dword [rsp + 0x2a0]
and eax, 0x1891
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2ac]
sub eax, 2
mov dword [rsp + 0x2ac], eax
jmp 0x180032063
mov eax, dword [rsp + 0x2a0]
cmp eax, 0x805
jle 0x1800320bf
mov eax, dword [rsp + 0x2a0]
and eax, 0x7e
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2ac]
dec eax
mov dword [rsp + 0x2ac], eax
jmp 0x180032063
mov dword [rsp + 0x2a4], 0
mov dword [rsp + 0x298], 0xd
cmp dword [rsp + 0x298], 0
jle 0x180032147
mov eax, dword [rsp + 0x298]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180032129
mov dword [rsp + 0x2a4], 4
mov eax, dword [rsp + 0x298]
dec eax
mov dword [rsp + 0x298], eax
jmp 0x1800320e7
mov dword [rsp + 0x2a4], 0
mov eax, dword [rsp + 0x298]
sub eax, 2
mov dword [rsp + 0x298], eax
jmp 0x1800320e7
mov dword [rsp + 0x2b8], 7
mov dword [rsp + 0x2b0], 0x11
cmp dword [rsp + 0x2b0], 0
jle 0x1800321bc
mov eax, dword [rsp + 0x2b0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003219f
mov dword [rsp + 0x2b8], 0
mov eax, dword [rsp + 0x2b0]
dec eax
mov dword [rsp + 0x2b0], eax
jmp 0x18003215d
mov dword [rsp + 0x2b8], 0
mov eax, dword [rsp + 0x2b0]
dec eax
mov dword [rsp + 0x2b0], eax
jmp 0x18003215d
xor eax, eax
jmp 0x18003278a
mov rax, qword [rsp + 0x360]
mov dword [rax], 1
mov dword [rsp + 0x2d4], 4
mov dword [rsp + 0x2e4], 3
mov eax, dword [rsp + 0x2e4]
test eax, eax
jle 0x180032255
mov eax, dword [rsp + 0x2e4]
cmp eax, 1
jle 0x180032224
mov eax, dword [rsp + 0x2d4]
and eax, 0x1891
mov dword [rsp + 0x2d4], eax
mov eax, dword [rsp + 0x2e4]
sub eax, 2
mov dword [rsp + 0x2e4], eax
jmp 0x1800321e7
mov eax, dword [rsp + 0x2d4]
cmp eax, 0x805
jle 0x180032243
mov eax, dword [rsp + 0x2d4]
and eax, 0x7e
mov dword [rsp + 0x2d4], eax
mov eax, dword [rsp + 0x2e4]
dec eax
mov dword [rsp + 0x2e4], eax
jmp 0x1800321e7
mov dword [rsp + 0x2c8], 8
mov dword [rsp + 0x2d0], 0x12
cmp dword [rsp + 0x2d0], 0
jle 0x1800322cb
mov eax, dword [rsp + 0x2d0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800322ad
mov dword [rsp + 0x2c8], 4
mov eax, dword [rsp + 0x2d0]
dec eax
mov dword [rsp + 0x2d0], eax
jmp 0x18003226b
mov dword [rsp + 0x2c8], 0
mov eax, dword [rsp + 0x2d0]
sub eax, 2
mov dword [rsp + 0x2d0], eax
jmp 0x18003226b
mov dword [rsp + 0x2dc], 7
mov dword [rsp + 0x2d8], 0x14
cmp dword [rsp + 0x2d8], 0
jle 0x180032341
mov eax, dword [rsp + 0x2d8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180032324
mov dword [rsp + 0x2dc], 0
mov eax, dword [rsp + 0x2d8]
sub eax, 2
mov dword [rsp + 0x2d8], eax
jmp 0x1800322e1
mov dword [rsp + 0x2dc], 0
mov eax, dword [rsp + 0x2d8]
dec eax
mov dword [rsp + 0x2d8], eax
jmp 0x1800322e1
mov dword [rsp + 0x2c4], 2
mov dword [rsp + 0x2cc], 0xa
mov eax, dword [rsp + 0x2cc]
test eax, eax
jle 0x1800323c7
mov eax, dword [rsp + 0x2cc]
cmp eax, 1
jle 0x180032394
mov eax, dword [rsp + 0x2c4]
and eax, 0x2106
mov dword [rsp + 0x2c4], eax
mov eax, dword [rsp + 0x2cc]
sub eax, 2
mov dword [rsp + 0x2cc], eax
jmp 0x180032357
mov eax, dword [rsp + 0x2c4]
cmp eax, 0x80c
jle 0x1800323b5
mov eax, dword [rsp + 0x2c4]
and eax, 0x85
mov dword [rsp + 0x2c4], eax
mov eax, dword [rsp + 0x2cc]
dec eax
mov dword [rsp + 0x2cc], eax
jmp 0x180032357
mov dword [rsp + 0x2e0], 7
mov dword [rsp + 0x2ec], 9
mov eax, dword [rsp + 0x2ec]
test eax, eax
jle 0x18003244d
mov eax, dword [rsp + 0x2ec]
cmp eax, 1
jle 0x18003241a
mov eax, dword [rsp + 0x2e0]
and eax, 0x19b6
mov dword [rsp + 0x2e0], eax
mov eax, dword [rsp + 0x2ec]
sub eax, 2
mov dword [rsp + 0x2ec], eax
jmp 0x1800323dd
mov eax, dword [rsp + 0x2e0]
cmp eax, 0x80b
jle 0x18003243b
mov eax, dword [rsp + 0x2e0]
and eax, 0x84
mov dword [rsp + 0x2e0], eax
mov eax, dword [rsp + 0x2ec]
dec eax
mov dword [rsp + 0x2ec], eax
jmp 0x1800323dd
mov dword [rsp + 0x2f0], 7
mov dword [rsp + 0x2c0], 0x11
cmp dword [rsp + 0x2c0], 0
jle 0x1800324c3
mov eax, dword [rsp + 0x2c0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800324a5
mov dword [rsp + 0x2f0], 0
mov eax, dword [rsp + 0x2c0]
dec eax
mov dword [rsp + 0x2c0], eax
jmp 0x180032463
mov dword [rsp + 0x2f0], 4
mov eax, dword [rsp + 0x2c0]
sub eax, 2
mov dword [rsp + 0x2c0], eax
jmp 0x180032463
mov dword [rsp + 0x2e8], 2
mov dword [rsp + 0x2f4], 0x10
cmp dword [rsp + 0x2f4], 0
jle 0x180032539
mov eax, dword [rsp + 0x2f4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18003251b
mov dword [rsp + 0x2e8], 4
mov eax, dword [rsp + 0x2f4]
dec eax
mov dword [rsp + 0x2f4], eax
jmp 0x1800324d9
mov dword [rsp + 0x2e8], 4
mov eax, dword [rsp + 0x2f4]
sub eax, 2
mov dword [rsp + 0x2f4], eax
jmp 0x1800324d9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x320]
lea rcx, [rsp + 0x30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x320]
mov rcx, qword [rsp + 0x360]
call fcn.180014750
mov dword [rsp + 0x304], 9
mov dword [rsp + 0x310], 4
mov eax, dword [rsp + 0x310]
test eax, eax
jle 0x1800325ff
mov eax, dword [rsp + 0x310]
cmp eax, 1
jle 0x1800325ce
mov eax, dword [rsp + 0x304]
and eax, 0x197d
mov dword [rsp + 0x304], eax
mov eax, dword [rsp + 0x310]
sub eax, 2
mov dword [rsp + 0x310], eax
jmp 0x180032591
mov eax, dword [rsp + 0x304]
cmp eax, 0x806
jle 0x1800325ed
mov eax, dword [rsp + 0x304]
and eax, 0x7f
mov dword [rsp + 0x304], eax
mov eax, dword [rsp + 0x310]
dec eax
mov dword [rsp + 0x310], eax
jmp 0x180032591
mov dword [rsp + 0x2fc], 2
mov dword [rsp + 0x2f8], 5
mov eax, dword [rsp + 0x2f8]
test eax, eax
jle 0x180032685
mov eax, dword [rsp + 0x2f8]
cmp eax, 1
jle 0x180032652
mov eax, dword [rsp + 0x2fc]
and eax, 0x204d
mov dword [rsp + 0x2fc], eax
mov eax, dword [rsp + 0x2f8]
sub eax, 2
mov dword [rsp + 0x2f8], eax
jmp 0x180032615
mov eax, dword [rsp + 0x2fc]
cmp eax, 0x807
jle 0x180032673
mov eax, dword [rsp + 0x2fc]
and eax, 0x80
mov dword [rsp + 0x2fc], eax
mov eax, dword [rsp + 0x2f8]
dec eax
mov dword [rsp + 0x2f8], eax
jmp 0x180032615
mov dword [rsp + 0x314], 2
mov dword [rsp + 0x300], 0x13
cmp dword [rsp + 0x300], 0
jle 0x1800326fc
mov eax, dword [rsp + 0x300]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800326de
mov dword [rsp + 0x314], 4
mov eax, dword [rsp + 0x300]
sub eax, 2
mov dword [rsp + 0x300], eax
jmp 0x18003269b
mov dword [rsp + 0x314], 4
mov eax, dword [rsp + 0x300]
sub eax, 2
mov dword [rsp + 0x300], eax
jmp 0x18003269b
mov dword [rsp + 0x308], 7
mov dword [rsp + 0x30c], 9
mov eax, dword [rsp + 0x30c]
test eax, eax
jle 0x180032782
mov eax, dword [rsp + 0x30c]
cmp eax, 1
jle 0x18003274f
mov eax, dword [rsp + 0x308]
and eax, 0x19b6
mov dword [rsp + 0x308], eax
mov eax, dword [rsp + 0x30c]
sub eax, 2
mov dword [rsp + 0x30c], eax
jmp 0x180032712
mov eax, dword [rsp + 0x308]
cmp eax, 0x80b
jle 0x180032770
mov eax, dword [rsp + 0x308]
and eax, 0x84
mov dword [rsp + 0x308], eax
mov eax, dword [rsp + 0x30c]
dec eax
mov dword [rsp + 0x30c], eax
jmp 0x180032712
mov rax, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.180049ea0
add rsp, 0x348
pop rdi
pop rsi
ret