Function at 0x180004ec0
Capabilities:
Check if file exists
Create pipe
Create process on windows
Get file attributes
Query environment variable
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1a60
call fcn.180019450
sub rsp, rax
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1800f4040]
xor rax, rsp
mov qword [rbp + 0x19e0], rax
xor r14d, r14d
mov dword [rbp + 8], r14d
movabs rbx, 0x405bbe4e93b6d2c6
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rdi, 0xd08d648355942fed
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rdx, 0x870a35d8be56889d
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rcx, 0x87bd4ded374516e2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs r12, 0x340df92ae9dae193
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
movabs r13, 0xedb025e723ad42b8
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x7d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x7d8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x7c0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xe0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0xf0], xmm1
lea rax, [rbp + 0xc0]
mov rsi, 0xffffffffffffffff
mov r8, rsi
vzeroupper
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x180005000
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xe0]
call fcn.180002220
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x360]
call fcn.1800017e0
nop
cmp qword [rax + 0x18], 0xf
jbe 0x18000503b
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x5d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5e8], xmm1
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180005060
mov rdx, rax
lea rcx, [rbp + 0x5d8]
call fcn.180002220
nop
mov rdx, qword [rbp + 0x378]
cmp rdx, 0xf
jbe 0x1800050be
inc rdx
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800050b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800050b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x370], xmm0
mov byte [rbp + 0x360], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x180005119
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005114
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005114
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
movabs rax, 0x585fca49dc94a7cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
movabs rax, 0x99ea6dbf5ae016da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
movabs rax, 0xca5806bbd200bbcf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
movabs rax, 0xf4c50ab7420c4183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
movabs r15, 0xb6bf4ec6a3de28e7
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs rcx, 0xca45f2f39716d0cc
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
movabs rax, 0x870a35d8be56889d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x790], rax
movabs rdx, 0x87bd4ded374516e2
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x798], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
vmovdqu ymm0, ymmword [rbp + 0x780]
vpxor ymm0, ymm0, ymmword [rbp + 0x300]
vmovdqa ymmword [rbp + 0x300], ymm0
vmovdqa xmm1, xmmword [rbp + 0x320]
vxorps xmm1, xmm1, xmmword [rbp + 0x7a0]
vmovdqa xmmword [rbp + 0x320], xmm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x100], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x110], xmm1
lea rax, [rbp + 0x300]
mov r8, rsi
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180005290
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x100]
call fcn.180002220
nop
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x380]
call fcn.1800017e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1800052d0
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x5d8]
call fcn.180014cb0
nop
mov rdx, qword [rbp + 0x398]
cmp rdx, 0xf
jbe 0x180005324
inc rdx
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000531f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000531f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x18000537f
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000537a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000537a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rdi, 0x870a35d8be56889d
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rbx, 0x87bd4ded374516e2
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x810], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x818], rax
vmovdqu ymm0, ymmword [rbp + 0x800]
vpxor ymm0, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x120], ymm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x150], xmm1
lea rax, [rbp + 0x120]
mov r8, rsi
vzeroupper
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180005460
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x140]
call fcn.180002220
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x480]
call fcn.1800017e0
nop
cmp qword [rax + 0x18], 0xf
jbe 0x18000549c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x5b8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5c8], xmm1
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800054c0
mov rdx, rax
lea rcx, [rbp + 0x5b8]
call fcn.180002220
nop
mov rdx, qword [rbp + 0x498]
cmp rdx, 0xf
jbe 0x18000551e
inc rdx
mov rcx, qword [rbp + 0x480]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005519
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x490], xmm0
mov byte [rbp + 0x480], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x180005579
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005574
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005574
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
movabs rax, 0x4065ca488080a9cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x8685668456c52cdb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x870a35d88321cfff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
vmovdqu ymm0, ymmword [rbp + 0x7e0]
vpxor ymm0, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x190], xmm1
lea rax, [rbp + 0x160]
mov r8, rsi
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x180005663
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x180]
call fcn.180002220
nop
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x440]
call fcn.1800017e0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1800056a3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x5b8]
call fcn.180014cb0
nop
mov rdx, qword [rbp + 0x458]
cmp rdx, 0xf
jbe 0x1800056f7
inc rdx
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800056f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800056f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x450], xmm0
mov byte [rbp + 0x440], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x180005752
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000574d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000574d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x578], xmm0
mov qword [rbp + 0x588], r14
mov qword [rbp + 0x590], 0xf
mov byte [rbp + 0x578], 0
mov dword [rbp + 0x4b0], 0x18
mov dword [rbp + 0x4c0], 1
mov qword [rbp + 0x4b8], r14
xor r9d, r9d
lea r8, [rbp + 0x4b0]
lea rdx, [rbp + 0x4a8]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d0], xmm0
movups xmmword [rbp + 0x4e0], xmm0
movups xmmword [rbp + 0x4f0], xmm0
movups xmmword [rbp + 0x500], xmm0
movups xmmword [rbp + 0x510], xmm0
movups xmmword [rbp + 0x520], xmm0
mov dword [rbp + 0x4d0], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp + 0x50c], eax
mov word [rbp + 0x510], r14w
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x528], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x520], rax
movabs rax, 0x340df92ad4e786f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x730]
movdqa xmmword [rbp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f0], xmm1
lea rax, [rbp + 0x50]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800058c0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x1e0]
call fcn.180002220
nop
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x400]
call fcn.1800017e0
mov rdi, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1800058fb
mov rdi, qword [rax]
movabs rax, 0x7e75c979bd9ca4c5
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x2a0], rcx
movabs rax, 0xa7ea15ab44fc73ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movabs rax, 0xd24c708eea1ccbd4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0xe0f815b7500840b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
movabs rax, 0xf9d32592ec8844b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rax, 0xa707b195f05fa99e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x49ef0f5d8d181ff0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xc416789ba7f9e49f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0x78238f5bad3ccee1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rax, 0x37f3eb16e6a5ba89
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
movabs rax, 0x3285025c9ba1b807
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
movabs rax, 0x212629a5271a1c83
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x880], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x888], rax
movabs rax, 0x870a35d8be56889d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x890], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x898], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8a0], rax
movabs rax, 0xca45f2f39716d0cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8a8], rax
movabs rax, 0x1ed64c14e62d4891
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8b0], rax
movabs rax, 0xaa502ff9edb3a7d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8b8], rax
movabs rax, 0x1412d802e27e9dbb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8c0], rax
movabs rax, 0x47a9ac5fdee7d3c0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8c8], rax
movabs rax, 0x55dc3310fcf0d565
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8d0], rax
movabs rax, 0x212629a54e2a76ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x8d8], rax
vmovdqu ymm0, ymmword [rbp + 0x2a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x880]
vmovdqa ymmword [rbp + 0x2a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x8a0]
vmovdqa ymmword [rbp + 0x2c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x2e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x8c0]
vmovdqa ymmword [rbp + 0x2e0], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1c0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1d0], xmm1
lea rax, [rbp + 0x2a0]
mov r8, rsi
vzeroupper
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180005ba0
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x1c0]
call fcn.180002220
nop
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x460]
call fcn.1800017e0
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x180005bde
mov rbx, qword [rax]
movabs rax, 0x584cba4c8e97b9d9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xedb025e71e9035db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x740], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x748], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x740]
movdqa xmmword [rbp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x60]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x180005c55
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.180002220
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x420]
call fcn.1800017e0
cmp qword [rax + 0x18], 0xf
jbe 0x180005c8d
mov rax, qword [rax]
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
mov edx, 0x100
lea rcx, [rbp + 0x8e0]
call fcn.1800024c0
mov rdx, qword [rbp + 0x438]
cmp rdx, 0xf
jbe 0x180005ced
inc rdx
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005ce8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x430], xmm0
mov byte [rbp + 0x420], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x180005d48
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005d43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x478]
cmp rdx, 0xf
jbe 0x180005da3
inc rdx
mov rcx, qword [rbp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005d9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x470], xmm0
mov byte [rbp + 0x460], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x180005dfe
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005df9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005df9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp + 0x418]
cmp rdx, 0xf
jbe 0x180005e59
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005e54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x410], xmm0
mov byte [rbp + 0x400], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x180005eb4
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005eaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005eaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
lea rax, [rbp + 0x540]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x8e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
movabs rcx, 0x340df92ae9a893f6
test eax, eax
je 0x180005ff6
mov rcx, qword [rbp + 0x548]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x570]
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
mov rcx, qword [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180005fd7
mov eax, dword [rbp + 0x570]
test eax, eax
je 0x180005fd7
cmp rax, 0x1000
jae 0x18000715d
mov byte [rbp + rax + 0x9e0], 0
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180005f90
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x578]
call fcn.180014cb0
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x570]
mov r8d, 0x1000
lea rdx, [rbp + 0x9e0]
mov rcx, qword [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180005f65
mov rcx, qword [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x540]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800060c2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x750], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x758], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x750]
movdqa xmmword [rbp + 0x80], xmm0
movabs rax, 0x340df92ae9ebc1a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x770], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x778], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x770]
movdqa xmmword [rbp + 0x90], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x558], xmm1
mov qword [rbp + 0x568], r14
mov rbx, r14
movabs rdi, 0x930a870dd8c8cdf
nop dword [rax]
nop word [rax + rax]
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x760]
movdqa xmmword [rbp + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
lea rax, [rbp + 0x70]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180006150
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.180002220
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x340]
call fcn.1800017e0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x578]
call fcn.180014bb0
mov rbx, rax
mov rdx, qword [rbp + 0x358]
cmp rdx, 0xf
jbe 0x1800061ce
inc rdx
mov rcx, qword [rbp + 0x340]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800061c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006317
call fcn.180018a70
mov qword [rbp + 0x350], r14
mov qword [rbp + 0x358], 0xf
mov byte [rbp + 0x340], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x180006222
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000621d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000631e
call fcn.180018a70
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
cmp rbx, 0xffffffffffffffff
je 0x18000632c
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
add rbx, 4
mov r8, rbx
cmp qword [rbp + 0x588], rbx
cmovb r8, qword [rbp + 0x588]
lea rdx, [rbp + 0x578]
cmp qword [rbp + 0x590], 0xf
cmova rdx, qword [rbp + 0x578]
lea rcx, [rbp + 0x30]
call fcn.180002220
or dword [rbp + 8], 0x40
mov rdx, qword [rbp + 0x560]
cmp rdx, qword [rbp + 0x568]
je 0x1800062bb
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x40], r14
mov edx, 0xf
mov byte [rbp + 0x30], 0
add qword [rbp + 0x560], 0x20
jmp 0x1800062cf
lea r8, [rbp + 0x30]
lea rcx, [rbp + 0x558]
call fcn.180017110
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x180006302
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800062fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006325
call fcn.180018a70
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
jmp 0x1800060f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movabs rax, 0x5847a173daeb8ac5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0x87dc48835afb70ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xba5f72bdd263dbc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rdx, 0x87bd4ded374516e2
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x820], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x828], rax
movabs rax, 0x870a35d8be56889d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x830], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x838], rax
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x820]
vmovdqa ymmword [rbp + 0x200], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x260], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x270], xmm1
lea rax, [rbp + 0x200]
mov r8, rsi
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x180006413
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x260]
call fcn.180002220
nop
mov edi, dword [rbp + 8]
or edi, 1
mov dword [rbp + 8], edi
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x3a0]
call fcn.1800017e0
mov r14, rax
or edi, 2
mov dword [rbp + 8], edi
mov rbx, qword [rbp + 0x558]
mov r15, qword [rbp + 0x560]
cmp rbx, r15
je 0x1800064c2
mov r12, qword [rax + 0x18]
mov r13, qword [rax + 0x10]
mov rdx, r14
cmp r12, 0xf
jbe 0x18000647d
mov rdx, qword [r14]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18000648e
mov rcx, qword [rbx]
cmp r8, r13
jne 0x18000649c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800064a5
add rbx, 0x20
cmp rbx, r15
jne 0x180006471
movabs r13, 0xedb025e723ad42b8
movabs r12, 0x340df92ae9dae193
cmp rbx, r15
jne 0x180006661
movabs rax, 0x5847a173daeb8ac5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x818576824be70aee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x870a35d88303cff8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rcx, 0x87bd4ded374516e2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x840], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x848], rax
movabs rax, 0x870a35d8be56889d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x850], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x858], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x840]
vmovdqa ymmword [rbp + 0x220], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x240], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x250], xmm1
lea rax, [rbp + 0x220]
mov r8, rsi
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800065b0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x240]
call fcn.180002220
nop
mov edi, dword [rbp + 8]
or edi, 4
mov dword [rbp + 8], edi
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x3e0]
call fcn.1800017e0
mov r14, rax
or edi, 8
mov dword [rbp + 8], edi
mov rbx, qword [rbp + 0x558]
mov r15, qword [rbp + 0x560]
cmp rbx, r15
je 0x18000665d
mov r12, qword [rax + 0x18]
mov r13, qword [rax + 0x10]
nop
mov rdx, r14
cmp r12, 0xf
jbe 0x18000661c
mov rdx, qword [r14]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18000662d
mov rcx, qword [rbx]
cmp r8, r13
jne 0x18000663b
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180006644
add rbx, 0x20
cmp rbx, r15
jne 0x180006610
movabs r13, 0xedb025e723ad42b8
movabs r12, 0x340df92ae9dae193
cmp rbx, r15
jne 0x180006661
xor bl, bl
jmp 0x180006663
mov bl, 1
test dil, 8
je 0x1800066ca
and edi, 0xfffffff7
mov dword [rbp + 8], edi
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 0xf
jbe 0x1800066b3
inc rdx
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800066ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x3f0], xmm0
mov byte [rbp + 0x3e0], 0
test dil, 4
je 0x180006731
and edi, 0xfffffffb
mov dword [rbp + 8], edi
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x18000671a
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006715
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
test dil, 2
je 0x180006798
and edi, 0xfffffffd
mov dword [rbp + 8], edi
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0xf
jbe 0x180006781
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000677c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000677c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x3a0], 0
test dil, 1
je 0x1800067ff
and edi, 0xfffffffe
mov dword [rbp + 8], edi
mov rdx, qword [rbp + 0x278]
cmp rdx, 0xf
jbe 0x1800067e8
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800067e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
test bl, bl
je 0x1800068c8
movabs rax, 0x340df92ae9a893f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0x10], xmm0
movabs rax, 0x340df92ae9dae1a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x20], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x5d8]
cmp qword [rbp + 0x5f0], 0xf
cmova rcx, qword [rbp + 0x5d8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800069af
movabs rax, 0x340df92ae9a893f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x20], xmm0
movabs rax, 0x340df92ae9dae1a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0x10], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x5b8]
cmp qword [rbp + 0x5d0], 0xf
cmova rcx, qword [rbp + 0x5b8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180006a96
movabs rax, 0x340df92ae9a893f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x20], xmm0
movabs rax, 0x340df92ae9dae1a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0x10], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rax, 0x475fac709990d3c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0xd0c76285489801da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rdx, 0x870a35d8be56889d
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
movabs rcx, 0x87bd4ded374516e2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x860], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x868], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x870], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x878], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x860]
vmovdqa ymmword [rbp + 0x280], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1a0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1b0], xmm1
lea rax, [rbp + 0x280]
vzeroupper
inc rsi
cmp byte [rax + rsi], 0
jne 0x180006b70
mov r8, rsi
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1a0]
call fcn.180002220
nop
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x3c0]
call fcn.1800017e0
cmp qword [rax + 0x18], 0xf
jbe 0x180006bad
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0xf
jbe 0x180006bfd
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006bf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006bf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x180006c58
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006c53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
test rbx, rbx
je 0x180006d42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movabs rax, 0x340df92ae9a893f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x20], xmm0
movabs rax, 0x340df92ae9dae1a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0x10], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x600]
call sub.VCRUNTIME140.dll_memset
mov r8d, 1
lea rdx, str.aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1hlNVdNc1RV
lea rcx, [rbp + 0x600]
call fcn.1800143b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x598], xmm0
xor r12d, r12d
mov qword [rbp + 0x5a8], r12
mov qword [rbp + 0x5b0], 0xf
mov byte [rbp + 0x598], r12b
mov rax, qword [rbp + 0x600]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x600]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x598]
lea rcx, [rbp + 0x600]
call fcn.180016db0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x180006e9c
mov rbx, qword [rbp + 0x558]
mov rdi, qword [rbp + 0x560]
cmp rbx, rdi
je 0x180006e50
mov r14, qword [rbp + 0x5b0]
mov rsi, qword [rbp + 0x5a8]
mov r15, qword [rbp + 0x598]
nop word [rax + rax]
lea rdx, [rbp + 0x598]
cmp r14, 0xf
cmova rdx, r15
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180006e30
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x180006e3e
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180006e47
add rbx, 0x20
cmp rbx, rdi
jne 0x180006e10
cmp rbx, rdi
jne 0x180006ee7
mov rax, qword [rbp + 0x600]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x600]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x598]
lea rcx, [rbp + 0x600]
call fcn.180016db0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
jne 0x180006de2
mov rdx, qword [rbp + 0x5b0]
cmp rdx, 0xf
jbe 0x180006fb8
inc rdx
mov rcx, qword [rbp + 0x598]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006fb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006fb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
movabs rax, 0x340df92ae9a893f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rcx, 0x340df92ae9dae193
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x710]
movdqa xmmword [rbp + 0x20], xmm0
movabs rax, 0x340df92ae9dae1a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x720]
movdqa xmmword [rbp + 0x10], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.180018a70
nop
lea rcx, [rbp + 0x600]
call fcn.180008bd0
nop
mov rcx, qword [rbp + 0x558]
test rcx, rcx
je 0x180007031
mov rdx, qword [rbp + 0x560]
call fcn.180016760
mov rdx, qword [rbp + 0x568]
mov rcx, qword [rbp + 0x558]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000701a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000701a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x558], xmm0
mov qword [rbp + 0x568], r12
mov rdx, qword [rbp + 0x590]
cmp rdx, 0xf
jbe 0x180007075
inc rdx
mov rcx, qword [rbp + 0x578]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007070
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007070
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
mov qword [rbp + 0x588], r12
mov qword [rbp + 0x590], 0xf
mov byte [rbp + 0x578], 0
mov rdx, qword [rbp + 0x5d0]
cmp rdx, 0xf
jbe 0x1800070d2
inc rdx
mov rcx, qword [rbp + 0x5b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800070cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800070cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
movdqa xmm0, xmmword [0x1800edbd0]
movdqu xmmword [rbp + 0x5c8], xmm0
mov byte [rbp + 0x5b8], 0
mov rdx, qword [rbp + 0x5f0]
cmp rdx, 0xf
jbe 0x18000712d
inc rdx
mov rcx, qword [rbp + 0x5d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007128
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007128
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180018a70
mov rcx, qword [rbp + 0x19e0]
xor rcx, rsp
call fcn.1800182e0
lea r11, [rsp + 0x1a60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180018528
nop
int3