Function at 0x1800576f0
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x180195040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
xor edx, edx
call fcn.18008b850
movabs rax, 0x1df223c964523883
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
movabs r14, 0xd412b275cc13a930
mov qword [rsp + 0x40], rax
movabs rbx, 0x3d954da0033557ef
movabs rax, 0xaa7fcb446f97bbdf
movabs r12, 0xc35fa6211be4c2ac
mov qword [rsp + 0x30], rax
movabs rsi, 0xb1cca1f6a4657e31
mov rax, qword [rsp + 0x30]
movabs rdi, 0xd7e14f6740ca1b56
mov qword [rsp + 0x48], rax
movabs r15, 0xcad5cfe42c120603
movabs rax, 0xcba5cd97cd11175f
mov r8d, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xb8826f092fa36f37
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcab1aa90497e766e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x18005789f
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x180057894
sub r8d, edx
xor r13d, r13d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
call fcn.18008b850
movabs rax, 0x1df223c9775c3698
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xe33ace553b96adca
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x91a3d5d6c1081f56
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xb88d6f1e2ca66e30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5cfe42c126262
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x1800579fb
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800579f0
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdi, 0x3de64dd603545781
movabs rsi, 0xc33aa6551b97c2d5
movabs r14, 0xb1a0a192a44b7e5c
movabs r15, 0xd7e14f6740ca1b3a
mov r13, rbx
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0xb1cca1f6a4657e31
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
movabs rax, 0xd7e14f6740ca1b56
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x48], rax
movdqa xmm1, xmmword [rbp + 0x40]
xorps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18008d580
test rax, rax
je 0x180057b11
cmp qword [0x1801987a8], 0
jne 0x180057b29
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0x1388
call fcn.18005dda0
jmp 0x180057a50
xor edx, edx
call fcn.18008b850
movabs rax, 0x51e02b8066583688
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x30]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xd7e14f6740ca1b56
mov qword [rbp + 0x30], rax
movabs rdi, 0xb1cca1f6a4657e31
movabs rax, 0xa63bc74e77c4bbc0
mov r15, r13
mov qword [rsp + 0x30], rax
mov r8d, edx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0xb1cca1f6a4657e55
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x30], r13
mov r13d, 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rsp + 0x58], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmmword [rbp + 0x40], xmm0
test al, al
je 0x180057c1c
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180057c11
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x30]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18008c8e0
test al, al
je 0x180058997
xor edx, edx
call fcn.18008b850
movabs rax, 0x4eb534d26c583282
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
movabs rsi, 0xd412b275cc13a930
mov qword [rsp + 0x40], rax
movabs r14, 0xcad5cfe42c120603
movabs rax, 0xad36864c7e90b1d5
mov r8d, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xd0b6c89ac50c0a58
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xba8e2c472ea57222
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5ab8158776a73
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x180057d9b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180057d90
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.18008c500
test al, al
je 0x180058997
xor edx, edx
call fcn.18008b850
movabs rax, 0x4eec3e806b413682
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xb736c8483b89a7d8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xd8b8c08ccd091f58
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xbb91220823ea7539
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5cfe448777266
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x180057f00
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180057ef5
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180069ba0
test al, al
je 0x180058997
xor edx, edx
call fcn.18008b850
movabs rax, 0x5ef42bd266413986
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xaa2bcf4f72c4b1c9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xdea5d597de0c1250
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xb28d3f0a2fa93b38
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5cfe42c766377
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x68], rax
movq rax, xmm2
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x18005806b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180058060
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x471512950d538903
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
movabs rbx, 0x5615d8f3e356422
mov rax, qword [rsp + 0x30]
movabs rdi, 0x476712f00d3a8977
mov qword [rsp + 0x40], rax
movabs rsi, 0xa8aa0fa5beaf7210
movabs rax, 0xa8c60fc1be817220
movabs r14, 0x3af77fbaa0dfac31
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x3af77fbaa0dfac5d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x48], rax
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x50], xmm1
call fcn.18008d580
mov r8, rax
test rax, rax
je 0x180058997
movabs rax, 0x280b7db36355ca48
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x30], rax
movabs rax, 0xe9f34fe5d9dc3f62
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0x56983cece29aed69
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x78], rcx
movabs rcx, 0x159b36610cbb00c4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0x412318df7e75164d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xb7daa98cc1378b11
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x98], rax
movabs rax, 0xb7daa98cc137d14b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], rcx
mov rcx, r8
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x70]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
call fcn.18008d850
mov qword [0x180197e38], rax
test rax, rax
je 0x180058997
xor edx, edx
call fcn.18008b850
movabs rax, 0x49fc23c9235e339c
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x30]
mov rax, qword [rsp + 0x30]
movabs rdi, 0xb1cca1f6a4657e31
mov qword [rbp + 0x30], rax
movabs rbx, 0xd7e14f6740ca1b56
movabs rax, 0xaa2bc75b7288a3c5
mov r8d, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0xddbccc99c745105e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
movabs rax, 0xd7e14f6724af6f33
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rsp + 0x58], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmmword [rbp + 0x40], xmm0
test al, al
je 0x1800583c0
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800583b5
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x30]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180197858]
test rcx, rcx
jne 0x18005841b
nop dword [rax + rax]
lea rdx, [0x180197858]
lea rcx, [0x18008b660]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180197858]
test rcx, rcx
je 0x1800583f0
lea r8, [0x180066110]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x180197ae0], rax
test rax, rax
je 0x180058997
xor edx, edx
call fcn.18008b850
movabs rax, 0x44e66dd476453986
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
movabs rsi, 0xd412b275cc13a930
mov qword [rsp + 0x40], rax
movabs r14, 0xcad5cfe42c120603
movabs rax, 0xaa31cf017681b6df
mov r8d, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xc5addb9fc8041745
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xa78c200460a4743f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5cf804966636f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x18005858c
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180058581
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [0x180197840]
mov rdx, qword [0x180197838]
mov rcx, qword [0x180197858]
call fcn.180089cc0
xor ecx, ecx
call fcn.180075dd0
cmp byte [0x180197848], r13b
jne 0x1800585e7
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x180197848], r13b
je 0x1800585d3
xor edx, edx
call fcn.18008b850
movabs rax, 0x4ff03fc5675b329d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xa731c34a7885a08c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xddadc882cd0b1711
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xf78f200e34ab613f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xafa1aa885c7f6960
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xd412b275cc13a954
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x18005872c
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180058721
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180081b90
test al, al
jne 0x1800589ca
mov dl, 3
call fcn.18008b850
movabs rax, 0x3af3bc76e5b374a3
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x30]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rbp + 0x30], rax
movabs rax, 0x9b84e66337ea1289
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0x42087571b49b821b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
movabs rax, 0xb102b5288b11e625
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movabs rax, 0x4ed3d81389da15c5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xfaed920a598332e6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x23601651d1e1eb77
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xb102b5288b119548
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rsp + 0x58], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmmword [rbp + 0x40], xmm0
test al, al
je 0x18005885e
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180058853
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x30]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 3
call fcn.18008b850
movabs rcx, 0xc3be9da99ebef37a
lea rdx, [rbp + 0x30]
movabs rax, 0x25979b3b0fe0f701
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
movabs rax, 0x572ac43b62eb6a5f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0xfda2faa9933591df
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movabs rax, 0x51b7ff5e63899667
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0x775ab14f07984a30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xfdd196c8e646f8a9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x30]
mov rax, qword [rsp + 0x30]
mov r8d, ecx
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rsp + 0x58], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmmword [rbp + 0x40], xmm0
test al, al
je 0x18005897b
nop dword [rax]
inc rdx
mov r8, rdx
cmp byte [rdx], r13b
jne 0x180058970
sub r8d, ecx
mov qword [rsp + 0x20], r13
mov rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x30]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
int3
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1800f1520
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
call fcn.18008b850
movabs rax, 0x4ef03fd577543289
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xaf3ecf55728aab8c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x91a2ce9fd0040458
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xb2952a0b30a77435
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5cfe42c120667
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x180058b0b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180058b00
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x59bb39ce665c3b8c
xorps xmm1, xmm1
mov qword [rsp + 0x30], rax
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0xc35fa6211be4aec0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rbp + 0x58], rax
lea rax, [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movdqu xmmword [rbp - 0x20], xmm1
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180058ba0
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.18005dfa0
movabs rax, 0x13a728ce6a52398a
xorps xmm1, xmm1
mov qword [rsp + 0x30], rax
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0xc35fa6211b88aec8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rbp + 0x58], rax
lea rax, [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movdqu xmmword [rbp], xmm1
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180058c30
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x10]
call fcn.18005dfa0
movabs rax, 0x44e62ccd665d349c
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xaf33c20f7681b6df
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x48], rax
lea rax, [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm1
xorps xmm1, xmm1
movups xmmword [rbp + 0x10], xmm0
movdqu xmmword [rbp + 0x20], xmm1
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180058d10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.18005dfa0
xorps xmm0, xmm0
mov ecx, 0x60
movdqu xmmword [rbp + 0x30], xmm0
call fcn.180028220
mov rbx, rax
mov qword [rbp + 0x30], rax
mov rsi, rax
lea rdi, [rbp - 0x30]
lea rcx, [rax + 0x60]
mov qword [rbp + 0x40], rcx
nop
mov rdx, rdi
mov rcx, rsi
call fcn.18005c9a0
lea rax, [rbp + 0x30]
add rsi, 0x20
add rdi, 0x20
cmp rdi, rax
jne 0x180058d50
mov rdx, rsi
mov rcx, rsi
call fcn.18005e060
mov qword [rbp + 0x38], rsi
lea rdi, [rbp + 0x30]
mov r14d, 3
nop word [rax + rax]
mov rdx, qword [rdi - 8]
lea rdi, [rdi - 0x20]
dec r14
cmp rdx, 0xf
jbe 0x180058dd1
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180058dcc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180059f55
mov rcx, r8
call fcn.1800f1af0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r13b
test r14, r14
jne 0x180058d90
cmp rbx, rsi
je 0x180058e13
nop word [rax + rax]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
jbe 0x180058dfd
mov rcx, qword [rbx]
call fcn.180077700
test al, al
je 0x1800593a1
add rbx, 0x20
cmp rbx, rsi
jne 0x180058df0
xor edx, edx
call fcn.18008b850
movabs rax, 0x4eb52ccd665d349c
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
movabs rsi, 0xd412b275cc13a930
mov qword [rsp + 0x40], rax
movabs rdi, 0xb1cca1f6a4657e31
movabs rax, 0xad36864c7e90b1d5
movabs rbx, 0xd7e14f6740ca1b56
mov qword [rsp + 0x30], rax
movabs r14, 0xcad5cfe42c120603
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x48], rax
movabs rax, 0xd0b6c89ac50c0a58
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xba8e2c472ea57222
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcad5ab8158776a73
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x180058f7b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180058f70
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180062430
test al, al
je 0x1800593a1
xor edx, edx
call fcn.18008b850
movabs rax, 0x1de63fc1755b388c
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xa07fc2446b89b7c8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xd5a9d593c815135e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xa3943f1335a53b7a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xaba3a18b4f302639
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xd430c60db83dda42
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x1800590eb
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800590e0
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdx, 0x68045f57217a8e71
call fcn.1800622e0
movabs rdx, 0x8b4a6c039af717a8
mov qword [0x180197860], rax
mov r12, rax
call fcn.1800622e0
movabs rdx, 0xe2d2563b91bdc56c
mov qword [0x180197878], rax
mov r15, rax
call fcn.1800622e0
movabs rdx, 0xd5db34823d6f1c40
mov qword [0x180197870], rax
mov r14, rax
call fcn.1800622e0
movabs rdx, 0xb231a1bea995f83b
mov qword [0x180197880], rax
mov rsi, rax
call fcn.1800622e0
movabs rdx, 0x5f0720d54e5f164
mov qword [0x180197868], rax
mov rdi, rax
call fcn.1800622e0
movabs rdx, 0x483047d5ed936395
mov qword [0x180197888], rax
mov rbx, rax
call fcn.1800622e0
test rax, rax
mov qword [0x180197890], rax
mov edx, r13d
mov r8d, r13d
setne cl
test rbx, rbx
setne al
and cl, al
test rdi, rdi
movzx eax, cl
mov ecx, r13d
cmovne edx, eax
test rsi, rsi
setne al
and dl, al
test r14, r14
movzx eax, dl
cmovne r8d, eax
test r15, r15
setne al
and r8b, al
test r12, r12
movzx eax, r8b
cmovne ecx, eax
test cl, cl
je 0x1800593a1
xor edx, edx
call fcn.18008b850
movabs rax, 0x1de63fc1755b388c
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xd412b275cc13a930
mov qword [rsp + 0x40], rax
movabs r14, 0x3d954da0033557ef
movabs rax, 0xaa7fcb446f97bbdf
movabs rsi, 0xc35fa6211be4c2ac
mov qword [rsp + 0x30], rax
movabs r12, 0xb1cca1f6a4657e31
mov rax, qword [rsp + 0x30]
movabs r15, 0xd7e14f6740ca1b56
mov qword [rsp + 0x48], rax
movabs rdi, 0xcad5cfe42c120603
movabs rax, 0xcba5cd97cd11175f
mov r8d, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xb8826f092fa36f37
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xcab1aa90497e766e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x18005937b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059370
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.180063670
test al, al
jne 0x1800593b5
int3
xor edx, edx
call fcn.18008b850
movabs rax, 0x53fc6dd3685a3887
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x50]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rbp + 0x50], rax
movabs rax, 0xa225cf4d7a8db6c5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
movabs rax, 0xdca3c2d6ca0a1745
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
movabs rax, 0xd7e12b0234af7726
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
movdqa xmm1, xmmword [rbp + 0x50]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x60]
mov qword [rsp + 0x58], rax
movq rax, xmm1
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmmword [rbp + 0x60], xmm0
test al, al
je 0x18005949b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059490
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x50]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x3df44dc60350578b
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0xc35fa6551b88c2d9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rbp + 0x58], rax
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call fcn.18005ecd0
test al, al
jne 0x1800596f8
mov dl, 2
call fcn.18008b850
movabs rax, 0x49b529c56f5c3689
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x30], rax
movabs rcx, 0x83f142fb6a0a1a5a
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x70], rax
movabs rax, 0xe32fd3557e97e2c3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0xddecd3998b011050
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0xb6872a0360ae7a39
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xacbba0870c666a76
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0xbb7bc614be66ce59
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0x1d414eca57a6b51b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x98], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa8], rax
movabs rax, 0x1d414eca57a6b575
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xb0], rax
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp + 0x80]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0xb8], rax
movq rax, xmm2
xorps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm2
movdqa xmmword [rbp - 0x70], xmm1
test al, al
je 0x1800596eb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x1800596e0
sub r8d, edx
lea rdx, [rsp + 0x70]
jmp 0x180059845
xor edx, edx
call fcn.18008b850
movabs rax, 0x4fe02ac9655b388c
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xba2c864f748db6cd
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xd8a2c8d6c9000a42
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xa380350e2cab7222
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0xbab8a0870c7c696a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xd412b211a967cc5c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x18005983d
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059832
sub r8d, edx
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdi, 0xebb7f8e330179de
lea rbx, [rbp - 0x40]
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x40]
mov rcx, qword [0x180197830]
mov qword [rbp + 0x58], rax
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x40], xmm0
mov rax, qword [rcx]
mov rdx, qword [rax + 0x290]
call rdx
test rax, rax
je 0x1800598ee
nop word [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
movzx edx, byte [rbx]
lea rbx, [rbx + 1]
test cl, cl
je 0x1800598e6
cmp cl, dl
je 0x1800598d0
cmp cl, dl
je 0x180059d8a
mov dl, 2
call fcn.18008b850
movabs rax, 0x1dfb22c970473299
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x80]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xd412b275cc13a930
mov qword [rbp + 0x80], rax
mov r8d, edx
movabs rax, 0xab3cd2407697abc1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x88], rax
movabs rax, 0x91a0c095cb095e10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
movabs rax, 0xa4932a1160f84815
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x98], rax
movabs rax, 0xcad5cfc4167c696a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x68], rax
movabs rax, 0xcad5cfe42c120603
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rbp + 0x80]
xorps xmm2, xmmword [rbp + 0x50]
movdqa xmm0, xmmword [rbp + 0x90]
movdqa xmm1, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x60]
mov qword [rbp + 0x78], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x80], xmm2
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmmword [rbp + 0xa0], xmm1
test al, al
je 0x180059a5b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059a50
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x80]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x30], rdi
lea rdx, [rbp - 0x50]
mov rax, qword [rsp + 0x30]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
mov r8d, edx
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rbp + 0x58], rax
xorps xmm0, xmmword [rbp + 0x50]
movq rax, xmm0
movdqa xmmword [rbp - 0x50], xmm0
test al, al
je 0x180059adf
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059ad4
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rbp - 0x50]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x53f03fd2765677c3
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xa629861348a7e2d8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xb1ec9b98cb0c0d43
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x50]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp + 0x68], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
test al, al
je 0x180059bce
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059bc3
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180197830]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x290]
call rdx
mov rcx, rax
mov r8d, eax
cmp byte [rax], r13b
je 0x180059c1b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059c10
sub r8d, eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rax, 0x54c234d3627077c1
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x70], rax
movabs rax, 0xe32bce467289e2c2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0xd2a2d4908411115f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0xf7922e472ea57222
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xcafba3854160696d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x68], rax
movabs rax, 0xcad5cfe42c120603
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp + 0x50]
movdqa xmm0, xmmword [rbp - 0x80]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x60]
mov qword [rbp + 0x78], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x70]
movdqa xmmword [rsp + 0x70], xmm2
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rbp - 0x70], xmm1
test al, al
je 0x180059d6b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059d60
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180059d94
movabs rbx, 0xd412b275cc13a930
xor edx, edx
call fcn.18008b850
movabs rax, 0x1dfb24f77a4636aa
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x70], rax
movabs rax, 0xaa33c7486f8dacc5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0xd2eccf99cd111f4b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0xb3843b022cba7639
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xa5bcbc964964262f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0xd412b275cc33935e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x98], rax
movabs rax, 0xcad5cfe42c120603
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp + 0x80]
movdqa xmm0, xmmword [rbp - 0x80]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x90]
mov qword [rbp + 0xa8], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rsp + 0x70], xmm2
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rbp - 0x70], xmm1
test al, al
je 0x180059efb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r13b
jne 0x180059ef0
sub r8d, edx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str.1000
mov r8, rdx
inc r8
cmp byte [r8], r13b
jne 0x180059f22
sub r8d, edx
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x30]
mov bl, 1
call fcn.18005ca60
movzx eax, bl
jmp 0x18005899a
call fcn.1800f5950
int3