Function at 0x1800510d0
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x180180040]
xor rax, rsp
mov qword [rbp + 0x260], rax
movabs rax, 0xaa5807e7d07cd83f
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x40], rax
movabs rdi, 0xaa2c0794d01dd84f
mov rax, qword [rsp + 0x40]
movabs rbx, 0x31eec079b84ced78
mov qword [rsp + 0x50], rax
movabs r14, 0x10e59a46ef166df9
movabs rax, 0x3181c016b824ed1d
movabs rsi, 0xc261ab353849842
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x108a9a2aef386d92
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0xc261ab353849825
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm6, xmmword [rsp + 0x50]
xorps xmm6, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x50], xmm6
movdqa xmmword [rsp + 0x60], xmm0
call fcn.180050c00
test al, al
je 0x180052107
cmp word [rbp + 0x50], 0
lea rax, [rbp + 0x50]
je 0x18005121a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x180051210
movq rcx, xmm6
test cx, cx
je 0x180051240
lea rdx, [rsp + 0x50]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x180051230
xor r13d, r13d
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 1
mov dword [rsp + 0x20], 2
mov word [rax], r13w
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x180180ed8], rax
cmp rax, 0xffffffffffffffff
je 0x180052107
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 3
lea rdx, [0x180167e38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.1800795c0
movabs rax, 0x8a4b69fdb77ab723
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
movabs r15, 0xc537644db01f512c
mov qword [rsp + 0x50], rax
movabs r12, 0x2d8cd0684818f713
movabs rax, 0x58cead1ccc3f940b
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x6a8cf62786620497
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x63453add3cedec23
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2de8b51c2d74877e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800513ef
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800513e4
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180079c70
test al, al
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd90c7ee6bf70bd22
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x5f87e014dd389e01
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x719ff32a8e7f1990
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x614979933debf136
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2d8cb40d3c7d9b63
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005155b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051550
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180079890
test al, al
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd95574b4b869b922
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x4587ae109821880c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x7991fb3c867a0c90
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x605677dc30a4f62d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2d8cd0682c7d8376
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800516bd
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800516b2
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1800602e0
test al, al
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xc94d61e6b569b626
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x589aa917d16c9e1d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x7f8cee27957f0198
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x694a6ade3ce7b82c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2d8cd068487c9267
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005181f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051814
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x1c4176aab3c45421
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
movabs r12, 0x9a1eab78d3d94c08
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0x579d3a86109e7e0e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0xeae31fdd50fd5d7b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x1c3376cfb3ad5455
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
movabs rax, 0x57f13ae210b07e3e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0xeae31fdd50fd5d17
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
movdqa xmm1, xmmword [rbp - 0x10]
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18007ad10
mov r8, rax
test rax, rax
je 0x180052107
movabs rax, 0x735f198cddc2176a
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
movabs rax, 0x16a87aa277c3334c
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x80], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x868c5c8b12b81c4f
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x78], rcx
movabs rcx, 0xeb39deb6a02ab5b2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0xde5cee2893993e67
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x9f943fa3444f74f3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0x1c3376cfb3ad5455
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
movabs rax, 0x57f13ae210b07e3e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
movabs rax, 0xeae31fdd50fd5d17
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0x9f943fa3444f2ea9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], rcx
mov rcx, r8
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x70], xmm1
call fcn.18007afe0
mov qword [0x180182c28], rax
test rax, rax
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xde4569fdf076bc3c
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x20], rax
movabs rax, 0x589aa103d1208c11
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0x7c95f7298c360396
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
movabs rax, 0xc261ab337e1ec27
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rsp + 0x68], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
test al, al
je 0x180051b5e
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051b53
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180182800]
test rcx, rcx
jne 0x180051bbb
nop word [rax + rax]
lea rdx, [0x180182800]
lea rcx, [0x180079540]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180182800]
test rcx, rcx
je 0x180051b90
lea r8, [0x18005d740]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x180182918], rax
test rax, rax
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd35f27e0a56db626
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
movabs r12, 0x2d8cd0684818f713
mov qword [rsp + 0x50], rax
mov r8d, edx
movabs rax, 0x5880a959d529990b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x6484e02f8377048d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x7c4b75d073eaf72b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2d8cd00c2d6c927f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x180051d1f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051d14
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [0x1801826f0]
mov rdx, qword [0x1801826e8]
mov rcx, qword [0x180182800]
call fcn.180077cf0
xor ecx, ecx
call fcn.1800642c0
cmp byte [0x1801826f8], r13b
jne 0x180051d84
nop word [rax + rax]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1801826f8], r13b
je 0x180051d70
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd84975f1b473bd3d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x5580a512db2d8f58
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x7c84f332867804d9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x2c4875da27e5e22b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x48f8b50438759870
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xc537644db01f5148
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x180051ecb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051ec0
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180070c00
test al, al
jne 0x18005213e
mov dl, 3
call fcn.1800795c0
movabs rdi, 0x4b10779dd701eed
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x40], rdi
lea rcx, [rbp - 0x20]
mov rax, qword [rsp + 0x40]
movabs rsi, 0x7091631cb1197f8b
mov qword [rbp - 0x20], rax
movabs r14, 0x8d909f3df4db56c4
movabs rax, 0xecf9eb549ab276ab
movabs r15, 0xdf85db46e595ffbd
mov qword [rsp + 0x40], rax
movabs rbx, 0x79c4c16797ffa726
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x18], rax
movabs rax, 0xbeedb86680ef96d1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
movabs rax, 0x79c4c16797ffd44b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rsp + 0x68], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
test al, al
je 0x180051ffd
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180051ff2
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 3
call fcn.1800795c0
mov qword [rsp + 0x40], rdi
lea rdx, [rbp - 0x20]
mov rax, qword [rsp + 0x40]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
mov r8d, edx
movabs rax, 0xade0ea4991a876ab
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0xdff6b72790e696cb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rsp + 0x68], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
test al, al
je 0x1800520eb
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800520e0
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor al, al
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1800dea20
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd94975e1a47cbd29
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x5d8fa90dd1228458
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x308bf52f9b771790
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x69527fdf23e9f721
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2d8cd0684818f777
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005227b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052270
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xce0273fab574b42c
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
movabs rax, 0x31eec079b84c8114
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0xaa4907fcd07ed83c
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
movabs rax, 0x318dc026b82ded15
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x108b9a23ef7f6d95
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0xc5e1ac753aa9836
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x2d8cd0684818f767
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x38], rax
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x70], xmm1
call fcn.18006a210
test al, al
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd90c66f9b575bb3c
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x5f87e014dd389e01
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x719ff32a8e7f1990
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x614979933debf136
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2d8cb40d3c7d9b63
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005254b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052540
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xaa5a07fad072d82c
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0x31c0c00ab83eed19
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x10e59a32ef6e6d8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
call fcn.1800594b0
test al, al
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0x8a5f75f5a673b72c
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x52cea41cc821981c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x7480ee2383660096
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x78536ac726ebb86e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x4cfabe072b3ad729
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xc5151035c431225e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18005276e
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052763
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdx, 0x68045f57217a8e71
call fcn.180058420
movabs rdx, 0x8b4a6c039af717a8
mov qword [0x180182808], rax
mov r12, rax
call fcn.180058420
movabs rdx, 0xe2d2563b91bdc56c
mov qword [0x180182820], rax
mov r15, rax
call fcn.180058420
movabs rdx, 0xd5db34823d6f1c40
mov qword [0x180182818], rax
mov r14, rax
call fcn.180058420
movabs rdx, 0xb231a1bea995f83b
mov qword [0x180182828], rax
mov rsi, rax
call fcn.180058420
movabs rdx, 0x5f0720d54e5f164
mov qword [0x180182810], rax
mov rdi, rax
call fcn.180058420
movabs rdx, 0x483047d5ed936395
mov qword [0x180182830], rax
mov rbx, rax
call fcn.180058420
test rax, rax
mov qword [0x180182838], rax
mov edx, r13d
mov r8d, r13d
setne cl
test rbx, rbx
setne al
and cl, al
test rdi, rdi
movzx eax, cl
mov ecx, r13d
cmovne edx, eax
test rsi, rsi
setne al
and dl, al
test r14, r14
movzx eax, dl
cmovne r8d, eax
test r15, r15
setne al
and r8b, al
test r12, r12
movzx eax, r8b
cmovne ecx, eax
test cl, cl
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0x8a5f75f5a673b72c
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
movabs r12, 0xc537644db01f512c
mov qword [rsp + 0x50], rax
movabs rsi, 0xaa2c0794d01dd84f
movabs rax, 0x58cead1ccc3f940b
movabs rdi, 0x31eec079b84ced78
mov qword [rsp + 0x40], rax
movabs r15, 0x10e59a46ef166df9
mov rax, qword [rsp + 0x40]
movabs r14, 0xc261ab353849842
mov qword [rsp + 0x58], rax
movabs rbx, 0x2d8cd0684818f713
movabs rax, 0x6a8cf62786620497
mov r8d, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x63453add3cedec23
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x2de8b51c2d74877e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x1800529fb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800529f0
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18005b510
test al, al
je 0x180052107
xor edx, edx
call fcn.1800795c0
movabs rax, 0xc44527e7bb72b727
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x20], rax
movabs rax, 0x5094a915d9259911
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0x7d8af9668179048d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
movabs rax, 0xc267ed627e1f432
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rsp + 0x68], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
test al, al
je 0x180052b0b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052b00
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xaa4d07f2d078d82b
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
movabs rax, 0x31eec00db820ed0d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180054bc0
test al, al
jne 0x180052d37
mov dl, 2
call fcn.1800795c0
movabs rax, 0xde0c63f1bc74b929
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
movabs rcx, 0x91a81e57bbf770f6
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x80], rax
movabs rax, 0x119eb50ddd3fcd17
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x7cc5e829c0720398
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0x6d407fd773e0f92d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x4be2bf0b686c9b66
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0xaa5e102cc26a3645
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0xbc48f8aad1f78c83
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
movabs rax, 0xbc48f8aad1f78ced
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmm2, xmmword [rbp - 0x80]
xorps xmm2, xmmword [rbp + 0x10]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rbp + 0x48], rax
movq rax, xmm2
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x80], xmm2
movdqa xmmword [rbp - 0x60], xmm1
test al, al
je 0x180052d2b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052d20
sub r8d, edx
lea rdx, [rbp - 0x80]
jmp 0x180052e83
xor edx, edx
call fcn.1800795c0
movabs rax, 0xd85960fdb673b72c
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x489de017d7259919
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x798bf3668273198a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x784760da3fe5f136
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x5de1bf0b6876987a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xc5376429d56b3440
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
xorps xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x180052e7b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180052e70
sub r8d, edx
lea rdx, [rsp + 0x50]
mov rcx, qword [0x180180ed8]
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x9d0236bae029f67e
lea rbx, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x30]
mov rcx, qword [0x1801826e0]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x30], xmm0
mov rax, qword [rcx]
mov rdx, qword [rax + 0x290]
call rdx
test rax, rax
je 0x180052f2b
lea rcx, [rbp - 0x30]
sub rax, rcx
nop dword [rax + rax]
movzx ecx, byte [rax + rbx]
movzx edx, byte [rbx]
lea rbx, [rbx + 1]
test cl, cl
je 0x180052f23
cmp cl, dl
je 0x180052f10
cmp cl, dl
je 0x180053399
mov dl, 2
call fcn.1800795c0
movabs rax, 0x8a4268fda36fbd39
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x10]
mov rax, qword [rsp + 0x40]
movabs rbx, 0x2d8cd0684818f713
mov qword [rbp + 0x10], rax
mov r8d, edx
movabs rax, 0x598db418d53f8415
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
movabs rax, 0x3089fb25807a4dd8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
movabs rax, 0x7f547fc573b6cb01
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0x2d8cd0487276987a
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp + 0x10]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rbp + 0x20]
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm2
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x30], xmm1
test al, al
je 0x18005305f
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053054
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x9d0236bae029f67e
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x40]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movq rax, xmm0
movdqa xmmword [rbp - 0x40], xmm0
test al, al
je 0x1800530eb
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800530e0
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xc44975e6a57ef863
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x50], rax
movabs rax, 0x5498e04beb0fcd0c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movabs rax, 0x10c5a028807f1e8b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 8], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x60], xmm0
test al, al
je 0x1800531db
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800531d0
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1801826e0]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x290]
call rdx
mov rcx, rax
mov r8d, eax
cmp byte [rax], r13b
je 0x18005322b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053220
mov rcx, qword [0x180180ed8]
sub r8d, eax
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0xc24973e7b16df861
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x80], rax
movabs rax, 0x5989a91498278217
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x6583ba3280784d8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0x6d0674dc3af0fb2c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x41edbd1a2776d760
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0xc537644db01f5102
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x80]
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rbp - 0x70]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm2
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
test al, al
je 0x18005337b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180053370
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1800533a3
movabs rbx, 0x2d8cd0684818f713
xor edx, edx
call fcn.1800795c0
movabs rax, 0xc5436ff1a46eb93f
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x80], rax
movabs rax, 0x5087b410d625cd13
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0x7e8af3328e6c0495
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
movabs rax, 0x784376c33eebfb62
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
movabs rax, 0x5efeb51e68349376
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
movabs rax, 0xc537646d8a713e45
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x80]
xorps xmm2, xmmword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x70]
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x38], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x80], xmm2
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
test al, al
je 0x1800534db
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800534d0
mov rcx, qword [0x180180ed8]
sub r8d, edx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x20], r13
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str.1000
mov r8, rdx
inc r8
cmp byte [r8], r13b
jne 0x180053501
mov rcx, qword [0x180180ed8]
sub r8d, edx
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
jmp 0x180052109