Function at 0x1800811b0
Capabilities:
Contain obfuscated stackstrings
Delete file
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x550]
sub rsp, 0x650
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x690], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rbp + 0x540], rax
mov qword [rsp + 0x50], r9
mov rbx, r8
mov qword [rsp + 0x78], rbx
mov rdi, rdx
mov qword [rsp + 0x68], rdx
cmp qword [rdx + 0x10], 0
je 0x180082634
mov r10, qword [r8]
mov r9, qword [r8 + 8]
cmp r10, r9
je 0x180082634
xor esi, esi
mov ecx, esi
sub r9, r10
sar r9, 7
test r9, r9
je 0x180082634
mov eax, esi
cmp byte [rax + r10 + 0x7c], sil
jne 0x18008124a
inc rcx
sub rax, 0xffffffffffffff80
cmp rcx, r9
jb 0x180081232
jmp 0x180082634
mov r8, rdx
lea rdx, [rbp + 0x3b8]
call fcn.180082ec0
nop
xor eax, eax
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x390], rsi
mov word [rbp + 0x398], ax
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x390]
call fcn.1800500b0
xor eax, eax
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x410], rax
lea rax, [rbp + 0x390]
mov qword [rbp + 0x408], rax
mov byte [rbp + 0x410], 0
mov rcx, qword [rbp + 0x390]
test rcx, rcx
jne 0x1800812c1
xor r12b, r12b
jmp 0x1800812e0
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1800812d6
xor r12b, r12b
jmp 0x1800812e0
mov byte [rbp + 0x398], 1
mov r12b, 1
mov byte [rsp + 0x40], r12b
mov byte [rbp + 0x410], r12b
xor eax, eax
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 0x3b0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], rsi
mov byte [rsp + 0x41], al
lea r9, [rsp + 0x41]
lea r8, [rbp + 0x3a0]
mov rdx, rdi
call fcn.180082860
test al, al
jne 0x18008134c
cmp byte [rsp + 0x41], al
je 0x18008134c
cmp qword [rdi + 0x18], 8
jb 0x180081343
mov rcx, qword [rdi]
jmp 0x180081346
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor sil, sil
mov byte [rsp + 0x41], sil
xor r8d, r8d
mov edx, r8d
mov qword [rsp + 0x48], rdx
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
sar rax, 7
mov r14, qword [rbp + 0x3a8]
test rax, rax
je 0x1800824fa
movabs r9, 0x1ffffffffffffff
mov r12, qword [rbp + 0x3b0]
mov qword [rsp + 0x70], r12
nop dword [rax]
nop word [rax + rax]
mov rdi, rdx
shl rdi, 7
add rdi, rcx
cmp byte [rdi + 0x7c], 0
je 0x180081b42
mov rsi, r8
mov r13d, r8d
mov r15, r14
mov rcx, qword [rbp + 0x3a0]
sub r15, rcx
sar r15, 7
test r15, r15
je 0x180081432
mov rbx, r8
nop dword [rax]
nop word [rax + rax]
shl rbx, 7
add rbx, rcx
cmp qword [rdi + 0x18], 8
jb 0x1800813f3
mov rdx, qword [rdi]
jmp 0x1800813f6
mov rdx, rdi
cmp qword [rbx + 0x18], 8
jb 0x180081402
mov rcx, qword [rbx]
jmp 0x180081405
mov rcx, rbx
call fcn.18013f058
mov rcx, qword [rbp + 0x3a0]
test eax, eax
je 0x180081422
inc r13d
mov ebx, r13d
cmp rbx, r15
jb 0x1800813e0
jmp 0x180081425
mov rsi, rbx
movabs r9, 0x1ffffffffffffff
xor r8d, r8d
test rsi, rsi
jne 0x1800816eb
mov qword [rbp + 0x4d0], r8
mov qword [rbp + 0x4d8], r8
mov qword [rbp + 0x4d8], 7
mov qword [rbp + 0x4d0], r8
mov word [rbp + 0x4c0], r8w
mov qword [rbp + 0x4f0], r8
mov qword [rbp + 0x4f8], r8
mov qword [rbp + 0x4f8], 7
mov qword [rbp + 0x4f0], r8
mov word [rbp + 0x4e0], r8w
mov qword [rbp + 0x510], r8
mov qword [rbp + 0x518], r8
mov qword [rbp + 0x518], 7
mov qword [rbp + 0x510], r8
mov word [rbp + 0x500], r8w
mov qword [rbp + 0x520], r8
mov qword [rbp + 0x528], r8
mov qword [rbp + 0x530], r8
mov dword [rbp + 0x538], r8d
mov byte [rbp + 0x53c], sil
lea rax, [rbp + 0x4c0]
cmp rax, r14
jae 0x18008159f
lea rax, [rbp + 0x4c0]
cmp rcx, rax
ja 0x18008159f
lea rbx, [rbp + 0x4c0]
sub rbx, rcx
cmp r14, r12
jne 0x180081578
mov rax, r12
sub rax, r14
sar rax, 7
cmp rax, 1
jae 0x180081578
mov rax, r9
sub rax, r15
cmp rax, 1
jb 0x180081b62
inc r15
sub r12, rcx
sar r12, 7
mov rcx, r12
shr rcx, 1
mov rax, r9
sub rax, rcx
cmp rax, r12
jae 0x180081545
mov r12, r8
jmp 0x180081548
add r12, rcx
cmp r12, r15
cmovb r12, r15
mov rdx, r12
lea rcx, [rbp + 0x3a0]
call fcn.180083a60
mov r12, qword [rbp + 0x3b0]
mov qword [rsp + 0x70], r12
mov r14, qword [rbp + 0x3a8]
mov rcx, qword [rbp + 0x3a0]
and rbx, 0xffffffffffffff80
add rbx, rcx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
test r14, r14
je 0x18008159a
mov rdx, rbx
mov rcx, r14
call fcn.180080ff0
nop
jmp 0x18008162f
cmp r14, r12
jne 0x180081610
mov rax, r12
sub rax, r14
sar rax, 7
cmp rax, 1
jae 0x180081610
mov rax, r9
sub rax, r15
cmp rax, 1
jb 0x180081b6f
inc r15
sub r12, rcx
sar r12, 7
mov rcx, r12
shr rcx, 1
mov rax, r9
sub rax, rcx
cmp rax, r12
jae 0x1800815e4
mov r12, r8
jmp 0x1800815e7
add r12, rcx
cmp r12, r15
cmovb r12, r15
mov rdx, r12
lea rcx, [rbp + 0x3a0]
call fcn.180083a60
mov r12, qword [rbp + 0x3b0]
mov qword [rsp + 0x70], r12
mov r14, qword [rbp + 0x3a8]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
test r14, r14
je 0x18008162f
lea rdx, [rbp + 0x4c0]
mov rcx, r14
call fcn.180080ff0
nop
sub r14, 0xffffffffffffff80
mov qword [rbp + 0x3a8], r14
mov rax, r14
mov rcx, qword [rbp + 0x3a0]
sub rax, rcx
and rax, 0xffffffffffffff80
lea rsi, [rcx - 0x80]
add rsi, rax
cmp qword [rbp + 0x518], 8
jb 0x180081668
mov rcx, qword [rbp + 0x500]
call fcn.180139b7c
mov qword [rbp + 0x518], 7
xor r8d, r8d
mov qword [rbp + 0x510], r8
mov word [rbp + 0x500], r8w
cmp qword [rbp + 0x4f8], 8
jb 0x18008169e
mov rcx, qword [rbp + 0x4e0]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbp + 0x4f8], 7
mov qword [rbp + 0x4f0], r8
mov word [rbp + 0x4e0], r8w
cmp qword [rbp + 0x4d8], 8
jb 0x1800816d1
mov rcx, qword [rbp + 0x4c0]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbp + 0x4d8], 7
mov qword [rbp + 0x4d0], r8
mov word [rbp + 0x4c0], r8w
mov qword [rbp + 0x450], r8
mov qword [rbp + 0x458], r8
mov qword [rbp + 0x458], 7
mov qword [rbp + 0x450], r8
mov word [rbp + 0x440], r8w
or r13, 0xffffffffffffffff
mov r9, r13
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x440]
call fcn.180005330
nop
xor r15d, r15d
mov qword [rbp + 0x470], r15
mov qword [rbp + 0x478], r15
mov qword [rbp + 0x478], 7
mov qword [rbp + 0x470], r15
mov word [rbp + 0x460], r15w
lea rbx, [rsi + 0x20]
mov r9, r13
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x460]
call fcn.180005330
nop
mov qword [rbp + 0x490], r15
mov qword [rbp + 0x498], r15
mov qword [rbp + 0x498], 7
mov qword [rbp + 0x490], r15
mov word [rbp + 0x480], r15w
lea r15, [rsi + 0x40]
mov r9, r13
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x480]
call fcn.180005330
nop
lea r13, [rsi + 0x60]
mov rax, qword [r13]
mov qword [rbp + 0x4a0], rax
lea rax, [rsi + 0x68]
mov qword [rbp - 0x78], rax
mov rax, qword [rax]
mov qword [rbp + 0x4a8], rax
lea rax, [rsi + 0x70]
mov qword [rsp + 0x60], rax
mov rax, qword [rax]
mov qword [rbp + 0x4b0], rax
lea rax, [rsi + 0x78]
mov qword [rbp - 0x80], rax
mov eax, dword [rax]
mov dword [rbp + 0x4b8], eax
lea rax, [rsi + 0x7c]
mov qword [rsp + 0x58], rax
movzx eax, byte [rax]
mov byte [rbp + 0x4bc], al
cmp rsi, rdi
je 0x180081821
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.180005330
lea rdx, [rdi + 0x20]
cmp rbx, rdx
je 0x180081839
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
call fcn.180005330
lea rdx, [rdi + 0x40]
cmp r15, rdx
je 0x180081851
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, r15
call fcn.180005330
mov rax, qword [rdi + 0x60]
mov qword [r13], rax
mov rax, qword [rdi + 0x68]
mov r10, qword [rbp - 0x78]
mov qword [r10], rax
mov rax, qword [rdi + 0x70]
mov r11, qword [rsp + 0x60]
mov qword [r11], rax
mov eax, dword [rdi + 0x78]
mov rcx, qword [rbp - 0x80]
mov dword [rcx], eax
movzx eax, byte [rdi + 0x7c]
mov rdi, qword [rsp + 0x58]
mov byte [rdi], al
lea rcx, [rbp + 0x440]
cmp qword [rbp + 0x458], 8
cmovae rcx, qword [rbp + 0x440]
mov r9, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x1800818a9
mov rsi, qword [rsi]
mov r8, qword [rbp + 0x450]
mov rdx, r8
cmp r9, r8
cmovb rdx, r9
test rdx, rdx
jmp 0x1800818eb
movzx eax, word [rcx]
cmp word [rsi], ax
jne 0x1800818d5
add rsi, 2
add rcx, 2
dec rdx
jmp 0x1800818eb
mov edx, 1
cmp word [rsi], ax
mov rcx, 0xffffffffffffffff
cmovb edx, ecx
xor esi, esi
jmp 0x1800818f5
jne 0x1800818c0
xor esi, esi
or rcx, 0xffffffffffffffff
mov edx, esi
movsxd rax, edx
test edx, edx
jne 0x18008190d
cmp r9, r8
jae 0x180081905
mov eax, ecx
jmp 0x18008190d
mov eax, esi
cmp r9, r8
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
jne 0x180081a83
lea rcx, [rbp + 0x460]
cmp qword [rbp + 0x478], 8
cmovae rcx, qword [rbp + 0x460]
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x180081944
mov rbx, qword [rbx]
mov r8, qword [rbp + 0x470]
mov rdx, r8
cmp r9, r8
cmovb rdx, r9
test rdx, rdx
jmp 0x180081989
movzx eax, word [rcx]
cmp word [rbx], ax
jne 0x180081975
add rbx, 2
add rcx, 2
dec rdx
jmp 0x180081989
mov edx, 1
cmp word [rbx], ax
mov rbx, 0xffffffffffffffff
cmovb edx, ebx
jmp 0x180081991
jne 0x180081960
or rbx, 0xffffffffffffffff
mov edx, esi
movsxd rax, edx
test edx, edx
jne 0x1800819a9
cmp r9, r8
jae 0x1800819a1
mov eax, ebx
jmp 0x1800819a9
mov eax, esi
cmp r9, r8
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
jne 0x180081a83
mov rax, qword [rbp + 0x4a0]
cmp qword [r13], rax
jne 0x180081a83
mov rax, qword [rbp + 0x4a8]
cmp qword [r10], rax
jne 0x180081a83
mov rax, qword [rbp + 0x4b0]
cmp qword [r11], rax
jne 0x180081a83
lea rcx, [rbp + 0x480]
cmp qword [rbp + 0x498], 8
cmovae rcx, qword [rbp + 0x480]
mov r9, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 8
jb 0x180081a11
mov r15, qword [r15]
mov r8, qword [rbp + 0x490]
mov rdx, r8
cmp r9, r8
cmovb rdx, r9
test rdx, rdx
jmp 0x180081a4b
movzx eax, word [rcx]
cmp word [r15], ax
jne 0x180081a3d
add r15, 2
add rcx, 2
dec rdx
jmp 0x180081a4b
mov edx, 1
cmp word [r15], ax
cmovb edx, ebx
jmp 0x180081a4f
jne 0x180081a27
mov edx, esi
movsxd rax, edx
test edx, edx
jne 0x180081a67
cmp r9, r8
jae 0x180081a5f
mov eax, ebx
jmp 0x180081a67
mov eax, esi
cmp r9, r8
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
jne 0x180081a83
mov eax, dword [rbp + 0x4b8]
mov rcx, qword [rbp - 0x80]
cmp dword [rcx], eax
je 0x180081a90
mov sil, 1
mov byte [rsp + 0x41], sil
mov byte [rdi], sil
jmp 0x180081a95
movzx esi, byte [rsp + 0x41]
cmp qword [rbp + 0x498], 8
jb 0x180081aab
mov rcx, qword [rbp + 0x480]
call fcn.180139b7c
mov qword [rbp + 0x498], 7
xor r8d, r8d
mov qword [rbp + 0x490], r8
mov word [rbp + 0x480], r8w
cmp qword [rbp + 0x478], 8
jb 0x180081ae1
mov rcx, qword [rbp + 0x460]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbp + 0x478], 7
mov qword [rbp + 0x470], r8
mov word [rbp + 0x460], r8w
cmp qword [rbp + 0x458], 8
jb 0x180081b14
mov rcx, qword [rbp + 0x440]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbp + 0x458], 7
mov qword [rbp + 0x450], r8
mov word [rbp + 0x440], r8w
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
movabs r9, 0x1ffffffffffffff
inc rdx
mov qword [rsp + 0x48], rdx
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
sar rax, 7
cmp rdx, rax
jae 0x180081b7c
jmp 0x1800813a0
lea rcx, [0x1801a9c80]
call fcn.18011231c
int3
lea rcx, [0x1801a9c80]
call fcn.18011231c
nop
mov r15, qword [rbp + 0x3a0]
test sil, sil
je 0x180082503
cmp r15, r14
je 0x180082503
xor eax, eax
mov qword [rbp + 0x3d8], rax
mov qword [rbp + 0x3e0], rax
mov qword [rbp + 0x3e8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], r8
mov rdi, r14
sub rdi, r15
sar rdi, 7
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x180081c00
movabs rax, 0x4189374bc6a7ef
cmp rdi, rax
jbe 0x180081bee
lea rcx, [0x1801a9c80]
call fcn.18011231c
int3
mov rdx, rdi
lea rcx, [rbp + 0x3d8]
call fcn.180083d10
xor r8d, r8d
movabs rdx, 0x20c49ba5e353f7cf
test rdi, rdi
je 0x180081ebe
lea rbx, [r15 + 0x58]
mov r12, rdx
nop word [rax + rax]
mov eax, dword [rbx + 0x20]
dec eax
cmp eax, 2
ja 0x180081e89
mov dword [rbp - 0x60], r8d
mov qword [rbp + 0x36c], r8
mov qword [rbp + 0x374], r8
mov qword [rbp + 0x37c], r8
mov dword [rbp + 0x384], r8d
xor edx, edx
mov r8d, 0x280
lea rcx, [rbp - 0x5c]
call fcn.180140c00
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x224]
call fcn.180140c00
xor eax, eax
mov qword [rbp + 0x324], rax
mov qword [rbp + 0x32c], rax
mov qword [rbp + 0x334], rax
mov qword [rbp + 0x33c], rax
mov qword [rbp + 0x344], rax
mov qword [rbp + 0x34c], rax
mov qword [rbp + 0x354], rax
mov qword [rbp + 0x35c], rax
mov qword [rbp + 0x364], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x3d8]
call fcn.180083660
mov rcx, qword [rbp + 0x3e0]
mov r8, qword [rbp + 0x3d8]
sub rcx, r8
mov rax, r12
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e8
lea r15, [r8 - 0x3e8]
add r15, rax
mov qword [rsp + 0x78], r15
mov dword [r15], 0x23ab45db
lea rdi, [r15 + 4]
xor edx, edx
mov r8d, 0x280
mov rcx, rdi
call fcn.180140c00
lea rsi, [r15 + 0x284]
xor edx, edx
mov r8d, 0x100
mov rcx, rsi
call fcn.180140c00
add r15, 0x384
xor eax, eax
mov qword [r15], rax
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], rax
mov qword [r15 + 0x28], rax
mov qword [r15 + 0x30], rax
mov qword [r15 + 0x38], rax
mov qword [r15 + 0x40], rax
lea r13, [rbx - 0x58]
cmp qword [rbx - 0x48], 0x13f
ja 0x180081d95
cmp qword [rbx - 0x40], 8
jb 0x180081d78
mov rcx, qword [r13]
jmp 0x180081d80
mov rcx, r13
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x180081d80
jmp 0x180081db3
cmp qword [rbx - 0x40], 8
jb 0x180081da2
mov rdx, qword [r13]
jmp 0x180081da5
mov rdx, r13
mov r8d, 0x13e
mov rcx, rdi
call fcn.18013f010
cmp qword [rbx - 0x28], 0x7f
ja 0x180081de5
cmp qword [rbx - 0x20], 8
jb 0x180081dc7
mov rcx, qword [rbx - 0x38]
jmp 0x180081dd0
lea rcx, [rbx - 0x38]
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rsi], ax
lea rcx, [rcx + 2]
lea rsi, [rsi + 2]
test ax, ax
jne 0x180081dd0
jmp 0x180081e04
cmp qword [rbx - 0x20], 8
jb 0x180081df2
mov rdx, qword [rbx - 0x38]
jmp 0x180081df6
lea rdx, [rbx - 0x38]
mov r8d, 0x7e
mov rcx, rsi
call fcn.18013f010
cmp qword [rbx - 8], 0x23
ja 0x180081e36
cmp qword [rbx], 8
jb 0x180081e17
mov rcx, qword [rbx - 0x18]
jmp 0x180081e20
lea rcx, [rbx - 0x18]
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [r15], ax
lea rcx, [rcx + 2]
lea r15, [r15 + 2]
test ax, ax
jne 0x180081e20
jmp 0x180081e54
cmp qword [rbx], 8
jb 0x180081e42
mov rdx, qword [rbx - 0x18]
jmp 0x180081e46
lea rdx, [rbx - 0x18]
mov r8d, 0x23
mov rcx, r15
call fcn.18013f010
mov rax, qword [rbx + 8]
mov rcx, qword [rsp + 0x78]
mov qword [rcx + 0x3cc], rax
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x3d4], rax
mov rax, qword [rbx + 0x18]
mov qword [rcx + 0x3dc], rax
mov eax, dword [r13 + 0x78]
mov dword [rcx + 0x3e4], eax
mov rdi, qword [rsp + 0x48]
sub rbx, 0xffffffffffffff80
dec rdi
mov qword [rsp + 0x48], rdi
mov r8d, 0
jne 0x180081c20
mov r14, qword [rbp + 0x3a8]
mov r12, qword [rsp + 0x70]
mov r15, qword [rbp + 0x3a0]
movabs rdx, 0x20c49ba5e353f7cf
mov rcx, qword [rbp + 0x3e0]
mov r13, qword [rbp + 0x3d8]
cmp r13, rcx
jne 0x180081f9f
test r13, r13
je 0x180081ef8
mov rcx, r13
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
xor edi, edi
mov qword [rbp + 0x3e8], rdi
jmp 0x180081efa
xor edi, edi
test r15, r15
je 0x180081f2d
mov rbx, r15
mov rcx, rbx
call fcn.180080f60
sub rbx, 0xffffffffffffff80
cmp rbx, r14
jne 0x180081f02
mov rcx, r15
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], rdi
cmp byte [rsp + 0x40], 0
je 0x180081f4d
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x180081f46
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x398], 0
mov qword [rbp + 0x408], rdi
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x180081f6d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x390], rdi
mov word [rbp + 0x398], 0
cmp qword [rbp + 0x3d0], 8
jb 0x180081f8c
mov rcx, qword [rbp + 0x3b8]
call fcn.180139b7c
mov qword [rbp + 0x3c8], rdi
mov word [rbp + 0x3b8], di
jmp 0x180082629
xor eax, eax
mov qword [rbp + 0x3f0], rax
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x400], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
xor edi, edi
mov qword [rbp + 0x400], rdi
mov dword [rbp + 0x420], 0x2d2d4352
mov dword [rbp + 0x424], 0x35343332
mov dword [rbp + 0x428], 0x61534350
mov dword [rbp + 0x42c], 0x2d302e32
mov dword [rbp + 0x430], 0x2d736843
mov dword [rbp + 0x434], 0x61435243
mov dword [rbp + 0x438], 0x38313031
mov dword [rbp + 0x43c], 0x35313032
mov eax, 1
movd xmm2, eax
movdqu xmm1, xmmword [rbp + 0x420]
pslld xmm1, xmm2
paddd xmm0, xmmword [0x1801b3460]
paddd xmm0, xmm1
movdqu xmmword [rbp + 0x420], xmm0
movdqu xmm1, xmmword [rbp + 0x430]
pslld xmm1, xmm2
movdqa xmm0, xmmword [0x1801b3470]
paddd xmm0, xmmword [0x1801b3460]
paddd xmm0, xmm1
movdqu xmmword [rbp + 0x430], xmm0
sub rcx, r13
mov rax, rdx
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test r13, r13
je 0x180082496
imul r8d, edx, 0x3e8
lea r9, [rbp + 0x3f0]
mov rdx, r13
lea rcx, [rbp + 0x420]
call fcn.1800908b0
test al, al
je 0x180082496
mov rbx, qword [rbp + 0x3f0]
mov rsi, qword [rbp + 0x3f8]
cmp rbx, rsi
jne 0x18008211e
test rbx, rbx
je 0x1800820e2
mov rcx, rbx
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], rdi
mov rcx, r13
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rdi
test r15, r15
je 0x180081f2d
mov rbx, r15
mov rcx, rbx
call fcn.180080f60
sub rbx, 0xffffffffffffff80
cmp rbx, r14
jne 0x180082108
jmp 0x180081f13
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x18], 8
jb 0x18008212f
mov rcx, qword [rax]
jmp 0x180082132
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call fcn.180029ce0
mov rdi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x180082209
mov r9d, 2
lea rdx, [0x1801aa834]
mov rcx, qword [rsp + 0x68]
call fcn.180027750
cmp rax, 0xffffffffffffffff
je 0x180082209
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0x420]
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.180023940
nop
lea rcx, [rbp + 0x420]
call fcn.18003e510
cmp qword [rdi + 0x18], 8
jb 0x1800821b5
mov rdi, qword [rdi]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call fcn.180029ce0
mov rdi, rax
cmp qword [rbp + 0x438], 8
jb 0x1800821ee
mov rcx, qword [rbp + 0x420]
call fcn.180139b7c
mov qword [rbp + 0x438], 7
xor eax, eax
mov qword [rbp + 0x430], rax
mov word [rbp + 0x420], ax
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180082422
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov dword [rbp + 0x418], eax
mov r8d, esi
sub r8d, ebx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x418]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub rsi, rbx
mov eax, dword [rbp + 0x418]
cmp rax, rsi
jne 0x1800823ab
lea rax, [rbp + 0x3a0]
mov r8, qword [rsp + 0x50]
cmp r8, rax
je 0x1800822ae
mov rax, qword [r8]
mov qword [r8], r15
mov qword [rbp + 0x3a0], rax
mov rax, qword [r8 + 8]
mov qword [r8 + 8], r14
mov qword [rbp + 0x3a8], rax
mov rax, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov qword [rbp + 0x3b0], rax
xor edi, edi
mov edx, edi
mov rax, qword [r8 + 8]
sub rax, qword [r8]
sar rax, 7
test rax, rax
je 0x1800822e6
mov ecx, edi
mov rax, qword [r8]
mov byte [rcx + rax + 0x7c], dil
inc rdx
lea rcx, [rcx + 0x80]
mov rax, qword [r8 + 8]
sub rax, qword [r8]
sar rax, 7
cmp rdx, rax
jb 0x1800822c4
test rbx, rbx
je 0x180082305
mov rcx, rbx
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], rdi
mov rcx, r13
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rdi
lea rcx, [rbp + 0x3a0]
call fcn.180083430
nop
cmp byte [rsp + 0x40], 0
je 0x18008234c
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x180082345
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x398], 0
mov qword [rbp + 0x408], rdi
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x18008236c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x390], rdi
mov word [rbp + 0x398], 0
cmp qword [rbp + 0x3d0], 8
jb 0x18008238b
mov rcx, qword [rbp + 0x3b8]
call fcn.180139b7c
mov qword [rbp + 0x3d0], 7
mov qword [rbp + 0x3c8], rdi
mov word [rbp + 0x3b8], di
mov al, 1
jmp 0x180082636
test rbx, rbx
je 0x1800823cc
mov rcx, rbx
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
xor ebx, ebx
mov qword [rbp + 0x400], rbx
mov rcx, r13
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rbx
lea rcx, [rbp + 0x3a0]
call fcn.180083430
nop
lea rcx, [rbp + 0x408]
call fcn.180015ea0
nop
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x1800825fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x390], rbx
jmp 0x1800825fc
test rbx, rbx
je 0x180082443
mov rcx, rbx
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
xor ebx, ebx
mov qword [rbp + 0x400], rbx
mov rcx, r13
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rbx
lea rcx, [rbp + 0x3a0]
call fcn.180083430
nop
cmp byte [rsp + 0x40], 0
je 0x18008248a
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x180082483
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp + 0x398], 0
mov qword [rbp + 0x408], rbx
jmp 0x180082400
mov rcx, qword [rbp + 0x3f0]
test rcx, rcx
je 0x1800824b9
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], rdi
test r13, r13
je 0x1800824d8
mov rcx, r13
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rdi
test r15, r15
je 0x180081f2d
mov rbx, r15
mov rcx, rbx
call fcn.180080f60
sub rbx, 0xffffffffffffff80
cmp rbx, r14
jne 0x1800824e4
jmp 0x180081f13
mov r15, qword [rbp + 0x3a0]
jmp 0x180082509
movzx r12d, byte [rsp + 0x40]
test r15, r15
je 0x1800825b5
mov rbx, r15
mov qword [rsp + 0x50], rbx
cmp r15, r14
je 0x180082598
nop
cmp qword [rbx + 0x58], 8
jb 0x180082533
mov rcx, qword [rbx + 0x40]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbx + 0x58], 7
mov qword [rbx + 0x50], r8
mov word [rbx + 0x40], r8w
cmp qword [rbx + 0x38], 8
jb 0x180082557
mov rcx, qword [rbx + 0x20]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbx + 0x38], 7
mov qword [rbx + 0x30], r8
mov word [rbx + 0x20], r8w
cmp qword [rbx + 0x18], 8
jb 0x18008257a
mov rcx, qword [rbx]
call fcn.180139b7c
xor r8d, r8d
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r8
mov word [rbx], r8w
sub rbx, 0xffffffffffffff80
mov qword [rsp + 0x50], rbx
cmp rbx, r14
jne 0x180082520
mov rcx, r15
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3a0], xmm0
xor r8d, r8d
mov qword [rbp + 0x3b0], r8
test r12b, r12b
je 0x1800825d6
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x1800825cf
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
mov byte [rbp + 0x398], 0
mov qword [rbp + 0x408], r8
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x1800825fa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov qword [rbp + 0x390], rbx
jmp 0x1800825fc
xor ebx, ebx
mov word [rbp + 0x398], 0
cmp qword [rbp + 0x3d0], 8
jb 0x18008261b
mov rcx, qword [rbp + 0x3b8]
call fcn.180139b7c
mov word [rbp + 0x3b8], bx
mov qword [rbp + 0x3c8], rbx
mov qword [rbp + 0x3d0], 7
xor al, al
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x690]
add rsp, 0x650
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret