Function at 0x1800b7290
Capabilities:
Contain obfuscated stackstrings
Delete file
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x520]
sub rsp, 0x620
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x660], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov qword [rsp + 0x60], r9
mov rdi, r8
mov qword [rsp + 0x48], r8
mov rbx, rdx
mov qword [rsp + 0x58], rdx
mov rcx, rdx
call fcn.180005c00
test al, al
jne 0x1800b8701
mov rax, qword [rdi]
mov rdx, qword [rdi + 8]
cmp rax, rdx
je 0x1800b8701
xor esi, esi
mov ecx, esi
sub rdx, rax
sar rdx, 7
test rdx, rdx
je 0x1800b8701
add rax, 0x7c
nop word [rax + rax]
cmp byte [rax], sil
jne 0x1800b7336
inc rcx
sub rax, 0xffffffffffffff80
cmp rcx, rdx
jb 0x1800b7320
jmp 0x1800b8701
mov r8, rbx
lea rdx, [rbp + 0x3f0]
call fcn.1800b8fd0
nop
xor eax, eax
mov qword [rbp + 0x378], rax
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x378]
call fcn.1800038c0
nop
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x378]
call fcn.180094b50
xor eax, eax
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rax
lea rcx, [rbp + 0x3a0]
call fcn.1800038c0
nop
lea rax, [rbp + 0x378]
mov qword [rbp + 0x3a0], rax
mov byte [rbp + 0x3a8], 0
mov rcx, qword [rbp + 0x378]
test rcx, rcx
jne 0x1800b73c8
xor al, al
jmp 0x1800b73e7
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1800b73de
xor al, al
jmp 0x1800b73e7
mov byte [rbp + 0x380], 1
mov al, 1
mov byte [rbp + 0x3a8], al
xor eax, eax
mov qword [rbp + 0x360], rax
mov qword [rbp + 0x368], rax
mov qword [rbp + 0x370], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov byte [rsp + 0x40], al
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x360]
mov rdx, rbx
call fcn.1800b88b0
test al, al
jne 0x1800b7449
cmp byte [rsp + 0x40], al
je 0x1800b7449
mov rcx, rbx
call fcn.180003a80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
mov byte [rsp + 0x40], bl
mov r13, rsi
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x1800b863b
mov r12, rsi
nop dword [rax]
lea r15, [rcx + r12]
cmp byte [r15 + 0x7c], 0
je 0x1800b779a
mov r14, rsi
mov rax, qword [rbp + 0x368]
mov rcx, qword [rbp + 0x360]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x1800b74f1
xor edi, edi
nop
shl rdi, 7
add rdi, rcx
mov rcx, r15
call fcn.180003a80
mov rbx, rax
mov rcx, rdi
call fcn.180003a80
mov rcx, rax
mov rdx, rbx
call fcn.1800fa088
test eax, eax
je 0x1800b74e9
inc esi
mov edi, esi
mov rax, qword [rbp + 0x368]
mov rcx, qword [rbp + 0x360]
sub rax, rcx
sar rax, 7
cmp rdi, rax
jb 0x1800b74a0
jmp 0x1800b74ec
mov r14, rdi
mov rdi, qword [rsp + 0x48]
test r14, r14
jne 0x1800b7639
lea rcx, [rbp + 0x410]
call fcn.180003c60
nop
lea rcx, [rbp + 0x430]
call fcn.180003c60
nop
lea rcx, [rbp + 0x450]
call fcn.180003c60
nop
xor eax, eax
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x480], rax
mov dword [rbp + 0x488], eax
mov byte [rbp + 0x48c], al
mov rdx, qword [rbp + 0x368]
cmp qword [rbp + 0x370], rdx
je 0x1800b75e4
mov ecx, 0x80
call fcn.1800037e0
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x410]
mov rcx, rax
call fcn.1800096b0
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x430]
call fcn.1800096b0
nop
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x450]
call fcn.1800096b0
nop
mov rax, qword [rbp + 0x470]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp + 0x478]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x480]
mov qword [rbx + 0x70], rax
mov eax, dword [rbp + 0x488]
mov dword [rbx + 0x78], eax
movzx eax, byte [rbp + 0x48c]
mov byte [rbx + 0x7c], al
mov rcx, qword [rbp + 0x368]
sub rcx, 0xffffffffffffff80
mov qword [rbp + 0x368], rcx
jmp 0x1800b75fe
lea r8, [rbp + 0x410]
lea rcx, [rbp + 0x360]
call fcn.1800b9b20
mov rcx, qword [rbp + 0x368]
mov rax, qword [rbp + 0x360]
sub rcx, rax
and rcx, 0xffffffffffffff80
lea r14, [rax - 0x80]
add r14, rcx
lea rcx, [rbp + 0x450]
call fcn.180003b80
nop
lea rcx, [rbp + 0x430]
call fcn.180003b80
nop
lea rcx, [rbp + 0x410]
call fcn.180003b80
mov rdx, r14
lea rcx, [rbp + 0x490]
call fcn.1800096b0
nop
lea rbx, [r14 + 0x20]
mov rdx, rbx
lea rcx, [rbp + 0x4b0]
call fcn.1800096b0
nop
lea rdx, [r14 + 0x40]
lea rcx, [rbp + 0x4d0]
call fcn.1800096b0
nop
mov rax, qword [r14 + 0x60]
mov qword [rbp + 0x4f0], rax
mov rax, qword [r14 + 0x68]
mov qword [rbp + 0x4f8], rax
mov rax, qword [r14 + 0x70]
mov qword [rbp + 0x500], rax
mov eax, dword [r14 + 0x78]
mov dword [rbp + 0x508], eax
movzx eax, byte [r14 + 0x7c]
mov byte [rbp + 0x50c], al
mov rdx, r15
mov rcx, r14
call fcn.180003ae0
lea rdx, [r15 + 0x20]
mov rcx, rbx
call fcn.180003ae0
lea rdx, [r15 + 0x40]
lea rcx, [r14 + 0x40]
call fcn.180003ae0
mov rax, qword [r15 + 0x60]
mov qword [r14 + 0x60], rax
mov rax, qword [r15 + 0x68]
mov qword [r14 + 0x68], rax
mov rax, qword [r15 + 0x70]
mov qword [r14 + 0x70], rax
mov eax, dword [r15 + 0x78]
mov dword [r14 + 0x78], eax
movzx eax, byte [r15 + 0x7c]
mov byte [r14 + 0x7c], al
lea rdx, [rbp + 0x490]
mov rcx, r14
call fcn.18001c300
test al, al
jne 0x1800b775e
lea rdx, [rbp + 0x4b0]
mov rcx, rbx
call fcn.18001c300
test al, al
jne 0x1800b775e
mov rax, qword [rbp + 0x4f0]
cmp qword [r14 + 0x60], rax
jne 0x1800b775e
mov rax, qword [rbp + 0x4f8]
cmp qword [r14 + 0x68], rax
jne 0x1800b775e
mov rax, qword [rbp + 0x500]
cmp qword [r14 + 0x70], rax
jne 0x1800b775e
lea rdx, [rbp + 0x4d0]
lea rcx, [r14 + 0x40]
call fcn.18001c300
test al, al
jne 0x1800b775e
mov eax, dword [rbp + 0x508]
cmp dword [r14 + 0x78], eax
je 0x1800b776a
mov bl, 1
mov byte [rsp + 0x40], bl
mov byte [r14 + 0x7c], bl
jmp 0x1800b776f
movzx ebx, byte [rsp + 0x40]
lea rcx, [rbp + 0x4d0]
call fcn.180003b80
nop
lea rcx, [rbp + 0x4b0]
call fcn.180003b80
nop
lea rcx, [rbp + 0x490]
call fcn.180003b80
mov rcx, qword [rdi]
xor esi, esi
inc r13
sub r12, 0xffffffffffffff80
mov rax, qword [rdi + 8]
sub rax, rcx
sar rax, 7
cmp r13, rax
jb 0x1800b7470
test bl, bl
je 0x1800b863b
mov rax, qword [rbp + 0x368]
cmp qword [rbp + 0x360], rax
je 0x1800b863b
xor eax, eax
mov qword [rbp + 0x388], rax
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x398], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
mov r9, qword [rbp + 0x368]
mov rbx, r9
mov r8, qword [rbp + 0x360]
sub rbx, r8
sar rbx, 7
mov rcx, qword [rbp + 0x398]
sub rcx, qword [rbp + 0x388]
movabs r15, 0x20c49ba5e353f7cf
mov rax, r15
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jbe 0x1800b7891
movabs rax, 0x4189374bc6a7ef
mov qword [rsp + 0x48], rax
call fcn.1800037f0
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.180004d90
cmp rbx, qword [rax]
ja 0x1800b872d
mov rdx, rbx
lea rcx, [rbp + 0x388]
call fcn.1800b94f0
mov r9, qword [rbp + 0x368]
mov r8, qword [rbp + 0x360]
mov r13, rsi
mov rax, r9
sub rax, r8
sar rax, 7
test rax, rax
je 0x1800b7c08
mov r12, rsi
nop word [rax + rax]
lea r14, [r8 + r12]
mov eax, dword [r14 + 0x78]
dec eax
cmp eax, 2
ja 0x1800b7bee
mov dword [rsp + 0x70], esi
mov qword [rbp + 0x33c], rsi
mov qword [rbp + 0x344], rsi
mov qword [rbp + 0x34c], rsi
mov dword [rbp + 0x354], esi
xor edx, edx
mov r8d, 0x280
lea rcx, [rsp + 0x74]
call fcn.1800f7810
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1f4]
call fcn.1800f7810
xor eax, eax
mov qword [rbp + 0x2f4], rax
mov qword [rbp + 0x2fc], rax
mov qword [rbp + 0x304], rax
mov qword [rbp + 0x30c], rax
mov qword [rbp + 0x314], rax
mov qword [rbp + 0x31c], rax
mov qword [rbp + 0x324], rax
mov qword [rbp + 0x32c], rax
mov qword [rbp + 0x334], rax
mov rdx, qword [rbp + 0x390]
cmp qword [rbp + 0x398], rdx
je 0x1800b7a1f
mov ecx, 0x3e8
call fcn.1800037e0
mov rdx, rax
lea rcx, [rsp + 0x70]
mov eax, 7
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rax, 1
jne 0x1800b7980
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rcx + 0x60]
mov qword [rdx + 0x60], rax
mov rdx, qword [rbp + 0x390]
add rdx, 0x3e8
mov qword [rbp + 0x390], rdx
jmp 0x1800b7a37
lea r8, [rsp + 0x70]
lea rcx, [rbp + 0x388]
call fcn.1800b98f0
mov rdx, qword [rbp + 0x390]
mov rcx, qword [rbp + 0x388]
sub rdx, rcx
mov rax, r15
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e8
lea r15, [rcx - 0x3e8]
add r15, rax
mov dword [r15], 0x23ab45db
lea rdi, [r15 + 4]
xor edx, edx
mov r8d, 0x280
mov rcx, rdi
call fcn.1800f7810
lea rsi, [r15 + 0x284]
xor edx, edx
mov r8d, 0x100
mov rcx, rsi
call fcn.1800f7810
lea rbx, [r15 + 0x384]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov rcx, r14
call fcn.180006030
mov rcx, r14
cmp rax, 0x13f
ja 0x1800b7af2
call fcn.180003a80
sub rdi, rax
nop
movzx ecx, word [rax]
mov word [rdi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1800b7ae0
jmp 0x1800b7b08
call fcn.180003a80
mov rdx, rax
mov r8d, 0x13e
mov rcx, rdi
call fcn.1801083c4
lea rcx, [r14 + 0x20]
call fcn.180006030
lea rcx, [r14 + 0x20]
cmp rax, 0x7f
ja 0x1800b7b42
call fcn.180003a80
sub rsi, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rsi], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1800b7b30
jmp 0x1800b7b58
call fcn.180003a80
mov rdx, rax
mov r8d, 0x7e
mov rcx, rsi
call fcn.1801083c4
lea rcx, [r14 + 0x40]
call fcn.180006030
lea rcx, [r14 + 0x40]
cmp rax, 0x23
ja 0x1800b7b92
call fcn.180003a80
sub rbx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rbx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1800b7b80
jmp 0x1800b7ba8
call fcn.180003a80
mov rdx, rax
mov r8d, 0x23
mov rcx, rbx
call fcn.1801083c4
mov rax, qword [r14 + 0x60]
mov qword [r15 + 0x3cc], rax
mov rax, qword [r14 + 0x68]
mov qword [r15 + 0x3d4], rax
mov rax, qword [r14 + 0x70]
mov qword [r15 + 0x3dc], rax
mov eax, dword [r14 + 0x78]
mov dword [r15 + 0x3e4], eax
mov r9, qword [rbp + 0x368]
mov r8, qword [rbp + 0x360]
xor esi, esi
movabs r15, 0x20c49ba5e353f7cf
inc r13
sub r12, 0xffffffffffffff80
mov rax, r9
sub rax, r8
sar rax, 7
cmp r13, rax
jb 0x1800b78b0
mov rcx, qword [rbp + 0x390]
cmp qword [rbp + 0x388], rcx
jne 0x1800b7d25
lea rcx, [rbp + 0x388]
call fcn.180003800
mov r8, qword [rbp + 0x388]
test r8, r8
je 0x1800b7c73
mov rcx, qword [rbp + 0x398]
sub rcx, r8
mov rax, r15
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rcx, r8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b7cc3
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x1800b7cea
cmp byte [rbp + 0x3a8], 0
je 0x1800b7cea
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800b7ce6
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3a0]
call fcn.180003800
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b7d17
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
jmp 0x1800b86e8
xor eax, eax
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], rax
mov qword [rbp + 0x3c0], rax
mov qword [rbp + 0x3b0], rsi
mov qword [rbp + 0x3b8], rsi
mov qword [rbp + 0x3c0], rsi
mov dword [rbp + 0x3d0], 0x2d2d4352
mov dword [rbp + 0x3d4], 0x35343332
mov dword [rbp + 0x3d8], 0x61534350
mov dword [rbp + 0x3dc], 0x2d302e32
mov dword [rbp + 0x3e0], 0x2d736843
mov dword [rbp + 0x3e4], 0x61435243
mov dword [rbp + 0x3e8], 0x38313031
mov dword [rbp + 0x3ec], 0x35313032
movdqa xmm2, xmmword [0x1801a4a70]
mov eax, esi
mov ecx, 1
movd xmm3, ecx
lea rcx, [rbp + 0x3d0]
nop dword [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x1800b7dc0
mov rcx, qword [rbp + 0x390]
mov r10, qword [rbp + 0x388]
sub rcx, r10
mov rax, r15
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test r10, r10
je 0x1800b84fc
imul r8d, edx, 0x3e8
lea r9, [rbp + 0x3b0]
mov rdx, r10
lea rcx, [rbp + 0x3d0]
call fcn.180047020
test al, al
je 0x1800b84fc
mov rax, qword [rbp + 0x3b8]
cmp qword [rbp + 0x3b0], rax
jne 0x1800b7f92
lea rcx, [rbp + 0x3b0]
call fcn.180003800
mov rcx, qword [rbp + 0x3b0]
test rcx, rcx
je 0x1800b7e89
mov rdx, qword [rbp + 0x3c0]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], rsi
lea rcx, [rbp + 0x388]
call fcn.180003800
mov r8, qword [rbp + 0x388]
test r8, r8
je 0x1800b7ee0
mov rcx, qword [rbp + 0x398]
sub rcx, r8
mov rax, r15
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rcx, r8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b7f30
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x1800b7f57
cmp byte [rbp + 0x3a8], 0
je 0x1800b7f57
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800b7f53
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3a0]
call fcn.180003800
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b7f84
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
jmp 0x1800b86e8
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.180003a80
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call fcn.18009ba50
mov rbx, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1800b803d
lea rdx, [0x18019f6fc]
mov rcx, rdi
call fcn.180097eb0
cmp rax, 0xffffffffffffffff
je 0x1800b803d
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0x3d0]
mov rcx, rdi
call fcn.18001c030
nop
lea rcx, [rbp + 0x3d0]
call fcn.180099460
mov rcx, rdi
call fcn.180003a80
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call fcn.18009ba50
mov rbx, rax
lea rcx, [rbp + 0x3d0]
call fcn.180003b80
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800b83bd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x3c8], esi
mov r8d, dword [rbp + 0x3b8]
mov rdx, qword [rbp + 0x3b0]
sub r8d, edx
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x3c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x3b8]
sub rcx, qword [rbp + 0x3b0]
mov eax, dword [rbp + 0x3c8]
cmp rax, rcx
jne 0x1800b82ac
lea rax, [rbp + 0x360]
mov rbx, qword [rsp + 0x60]
cmp rbx, rax
je 0x1800b8117
lea rdx, [rbp + 0x360]
mov rcx, rbx
call fcn.180003810
mov rcx, qword [rbx]
mov rax, qword [rbp + 0x360]
mov qword [rbx], rax
mov qword [rbp + 0x360], rcx
mov rcx, qword [rbx + 8]
mov rax, qword [rbp + 0x368]
mov qword [rbx + 8], rax
mov qword [rbp + 0x368], rcx
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbp + 0x370]
mov qword [rbx + 0x10], rax
mov qword [rbp + 0x370], rcx
mov r8, rsi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
sar rax, 7
test rax, rax
je 0x1800b8152
mov rdx, rsi
mov byte [rcx + rdx + 0x7c], 0
inc r8
lea rdx, [rdx + 0x80]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
sar rax, 7
cmp r8, rax
jb 0x1800b8130
lea rcx, [rbp + 0x3b0]
call fcn.180003800
mov rcx, qword [rbp + 0x3b0]
test rcx, rcx
je 0x1800b818b
mov rdx, qword [rbp + 0x3c0]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], rsi
lea rcx, [rbp + 0x388]
call fcn.180003800
mov rcx, qword [rbp + 0x388]
test rcx, rcx
je 0x1800b81df
mov rdx, qword [rbp + 0x398]
sub rdx, rcx
mov rax, r15
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b822f
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x1800b8256
cmp byte [rbp + 0x3a8], 0
je 0x1800b8256
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800b8252
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3a0]
call fcn.180003800
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b8283
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
lea rcx, [rbp + 0x378]
call fcn.180003800
nop
lea rcx, [rbp + 0x3f0]
call fcn.180003b80
mov al, 1
jmp 0x1800b8703
lea rcx, [rbp + 0x3b0]
call fcn.180003800
mov rcx, qword [rbp + 0x3b0]
test rcx, rcx
je 0x1800b82e5
mov rdx, qword [rbp + 0x3c0]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], rsi
lea rcx, [rbp + 0x388]
call fcn.180003800
mov rcx, qword [rbp + 0x388]
test rcx, rcx
je 0x1800b8339
mov rdx, qword [rbp + 0x398]
sub rdx, rcx
mov rax, r15
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b8389
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
lea rcx, [rbp + 0x3a0]
call fcn.1800224f0
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b83af
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
jmp 0x1800b86e8
lea rcx, [rbp + 0x3b0]
call fcn.180003800
mov rcx, qword [rbp + 0x3b0]
test rcx, rcx
je 0x1800b83f6
mov rdx, qword [rbp + 0x3c0]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], rsi
lea rcx, [rbp + 0x388]
call fcn.180003800
mov rcx, qword [rbp + 0x388]
test rcx, rcx
je 0x1800b844a
mov rdx, qword [rbp + 0x398]
sub rdx, rcx
mov rax, r15
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b849a
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x1800b84c1
cmp byte [rbp + 0x3a8], 0
je 0x1800b84c1
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800b84bd
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3a0]
call fcn.180003800
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b84ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
jmp 0x1800b86e8
lea rcx, [rbp + 0x3b0]
call fcn.180003800
mov rcx, qword [rbp + 0x3b0]
test rcx, rcx
je 0x1800b8535
mov rdx, qword [rbp + 0x3c0]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], rsi
lea rcx, [rbp + 0x388]
call fcn.180003800
mov rcx, qword [rbp + 0x388]
test rcx, rcx
je 0x1800b8589
mov rdx, qword [rbp + 0x398]
sub rdx, rcx
mov rax, r15
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b85d9
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x1800b8600
cmp byte [rbp + 0x3a8], 0
je 0x1800b8600
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800b85fc
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3a0]
call fcn.180003800
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b862d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
jmp 0x1800b86e8
lea rcx, [rbp + 0x360]
call fcn.180003800
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x1800b868b
mov rdx, qword [rbp + 0x368]
call fcn.1800b9cd0
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x360]
sub rdx, rcx
and rdx, 0xffffffffffffff80
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rsi
mov rbx, qword [rbp + 0x3a0]
test rbx, rbx
je 0x1800b86b2
cmp byte [rbp + 0x3a8], 0
je 0x1800b86b2
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800b86ae
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3a0]
call fcn.180003800
nop
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x1800b86df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x378], rsi
mov word [rbp + 0x380], 0
lea rcx, [rbp + 0x378]
call fcn.180003800
nop
lea rcx, [rbp + 0x3f0]
call fcn.180003b80
xor al, al
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x660]
add rsp, 0x620
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180024ea0
nop
int3